Hi there,
I haven't worked with NX-OS yet, so i don't know if this will work with them but if you have grouped the Nexus devices in the ACS in the 'Network Configuration' tab, you can try the following to deny access to them to users.
Once you've grouped them properly, you can then create a 'Network Access Filter' which is found under 'Shared Profile Components', name it and select the group you put your nexus' in.
Then go to the group of the users that you don't want to allow access to the Nexus and in the 'Network Access Restrictions (NAR)' section, look for the 'Per Group Defined Network Access Restrictions' part, select the 'define IP-based access restrictions', select 'Denied Calling/Point of Access Locations' from the 'Table Defines' drop down. In the 'AAA Client' drop down you can select the NDG Nexus group, put a * in 'Port and a * in 'Address' and then add it.
I think you need to restart the ACS service..
See how that goes. I hope I've understood what you're after and if not I apologise.
Brad
