PDF

Configure the recommended Cisco application policy infrastructure controller settings

Updated: April 15, 2026

Want to summarize with AI?

Log in

Configure the recommended Cisco Application Policy Infrastructure Controller (APIC) settings to optimize fabric performance and security.

Enable certain APIC settings to enhance network security, improve endpoint tracking, and detect potential loop conditions in the fabric.

These recommended settings help optimize the Cisco Application Centric Infrastructure (ACI) fabric by enforcing subnet validation, managing IP address aging, and detecting miscabling issues that could affect network performance.

Procedure

  1. Enable the enforce subnet check to prevent the fabric from learning endpoint information from subnets other than those configured on the bridge domain.

    The enforce subnet check feature enforces subnet checks at the VRF instance level, which is when Cisco Application Centric Infrastructure (ACI) learns the IP address as an endpoint from the data plane. Although the subnet check scope is the VRF instance, you can enable and disable this feature only globally under the fabric-wide setting policy. If you enable this option, the fabric will not learn IP addresses from a subnet other than the one configured on the bridge domain. This feature prevents the fabric from learning endpoint information in this scenario.

    Guidelines and limitations for the enforce subnet check

    You cannot enable this option in only a single VRF instance. If you enable the option, it gets enabled in all VRF instances.

    1. Navigate to System > System Settings > Fabric Wide Setting.
    2. Put a check in the Enforce Subnet Check box.

  2. Enable the IP aging policy to track and age unused IP addresses on endpoints.

    The IP aging policy tracks and ages unused IP addresses on an endpoint. The Cisco Application Policy Infrastructure Controller performs tracking using the endpoint retention policy, which is configured for the bridge domain to send ARP requests for IPv4 and neighbor solicitations for IPv6 at 75% of the local endpoint aging interval. When the Cisco APIC does not receive a response from an IP address, that IP address is aged out.

    1. Navigate to System > System Settings > Endpoint Controls.
    2. Click the IP Aging tab.
    3. For Administrative State, choose Enabled.

  3. Enable the mis-cabling protocol to detect loops that cannot be discovered by LLDP and STP.

    The mis-cabling protocol (MCP) detects loops that can be caused by various issues, such as misconfiguration, that the link layer discovery protocol (LLDP) and spanning tree protocol (STP) cannot discover. This option enables MCP to send packets on a per-EPG basis.

    1. Navigate to Fabric > Access Policies > Policies > Global > MCP Instance Policy default.
    2. For Admin State, choose Enabled.
    3. Put a check in the Enable MCP PDU per VLAN box.

The recommended APIC settings are now enabled, providing enhanced subnet validation, IP address management, and loop detection capabilities for your ACI fabric.