Home
Support
Product Support
Cloud and Systems Management
Cisco Application Policy Infrastructure Controller (APIC)
Configuration Guides

Cisco APIC Layer 2 Networking Configuration Guide, Release 6.2(x)

Releases

6.2(x)
6.1(x)
6.0(x)
5.3(x)
5.2(x)
5.1(x)
5.0(x)
4.2(x)
4.1(x)
4.0(x)
4.0(1)
3.x and Earlier

View all Saved Content

PDF

Is this content helpful?

Helpful Unhelpful

Suggestions for Improvement

Thank you for your feedback. Your response has been recorded.

Ask about this content

Cisco APIC Layer 2 Networking Configuration Guide, Release 6.2(x)

Expand all sections

About this content

Trademarks

What's Changed in this guide

What's Changed in this guide

Cisco ACI Forwarding

ACI Fabric Optimizes Modern Data Center Traffic Flows
VXLAN in ACI
Layer 3 VNIDs facilitate transporting inter-subnet tenant traffic
Transmission of Spanning Tree Protocol BPDU

Prerequisites for Configuring Layer 2 Networks

Layer 2 Prerequisites

Networking Domains

Networking domains
About Bridge Domains
Virtual Machine Manager Domain Main Components
Virtual Machine Manager Domains
Configure a Physical Domain

Bridging

Bridged interface to an external router
Bridge domains and subnets
Create a tenant, VRF, and bridge domain using the GUI
Create a tenant, VRF, and bridge domain using the NX-OS style CLI
Enforced bridge domains
Flood in encapsulation for all protocols and proxy ARP across encapsulations

EPGs

Endpoint groups
Deploy an EPG on a specific node or port using the GUI
Deploy an EPG on a specific port with APIC using the NX-OS style CLI
Domains, attachable access entity profiles, and VLAN for EPG deployment
Create domains and VLANS to deploy an EPG on a specific port using the GUI
Create AEP, domains, and vlans to deploy an EPG on a specific port using the NX-OS style CLI
Overlapping VLAN validation
Validate overlapping VLANs using the GUI
Deploy an application EPG through an AEP to multiple ports
Deploy an EPG through an AEP to multiple interfaces using the APIC GUI
Intra-EPG endpoint isolation
Intra-EPG isolation for bare metal servers
Configure intra-EPG isolation for bare metal servers using the GUI
Configure intra-EPG isolation for bare metal servers using the NX-OS style CLI
Intra-EPG Isolation for VMware VDS or Microsoft Hyper-V Virtual Switch
Configuring Intra-EPG Isolation for VMware VDS or Microsoft Hyper-V Virtual Switch using the GUI
Configure intra-EPG isolation for vmware VDS or microsoft Hyper-V virtual switch using the NX-OS style CLI
Intra-EPG isolation enforcement for Cisco ACI Virtual Edge
Configure Intra-EPG Isolation for Cisco ACI Virtual Edge Using the GUI
Choose statistics for isolated endpoints on Cisco ACI Virtual Edge Under the Tenants Tab
View Statistics for Isolated Endpoints on Cisco ACI Virtual Edge Under the Tenants Tab
Choose statistics for isolated endpoints on Cisco ACI Virtual Edge under the virtual networking tab
View statistics for isolated endpoints on Cisco ACI Virtual Edge under the Virtual Networking tab
Configure Intra-EPG Isolation for Cisco ACI Virtual Edge Using the NX-OS Style CLI
Troubleshoot endpoint connectivity
Inspect the endpoint status
Inspect the tunnel interface status
Perform a traceroute between endpoints
Configure atomic counters
Configure a tenant SPAN session using the Cisco APIC GUI
Verify IP-based EPG configurations using the GUI
IP-EPG configuration verification using switch commands

Access Interfaces

Access interfaces
Physical ports configuration
Port channels
Virtual port channels in Cisco ACI
Reflective relay (802.1Qbg)
Configure Port, PC, and vpc connections to FEX devices
Port profile configuration
Edit an interface configuration

FCoE Connections

Supporting Fibre Channel over Ethernet traffic on the Cisco ACI fabric
Requirement: configure global VLAN scope for FCoE
Fibre channel over ethernet supported hardware
FCoE policy, profile, and domain configurations
Deploy FCoE vFC Ports Using the APIC GUI
Deploying EPG Access to vFC Ports Using the APIC GUI
Deploy the EPG to support the FCoE initiation protocol
Undeploy FCoE connectivity using the APIC GUI
Configure FCoE connectivity without policies or profiles using the NX-OS style CLI
Configure FCoE connectivity with policies and profiles using the NX-OS style CLI
Configure FCoE over FEX using NX-OS style CLI
Verify FCoE configuration using the NX-OS style CLI
Undeploying FCoE elements using the NX-OS style CLI
Recommendation: SAN boot with vPC

Fibre Channel NPV

Fibre Channel connectivity in N-Port Virtualization mode
Managing Fibre Channel NPV traffic
SAN A/B separation
SAN port channels
Fibre Channel NPV requirements and limitations
Fibre Channel NPV supported hardware
Fibre Channel NPV interoperability
Configure a native Fibre Channel port profile using the GUI
Configure a native FC port channel profile using the GUI
Deploy Fibre Channel ports
Configure a traffic map for a Fibre Channel port
Configure Fibre Channel interfaces using the CLI
Configure Fibre Channel NPV policies using the CLI
Configure an NPV traffic map using the CLI
Configure FC connectivity using the REST API

802.1Q Tunnels

ACI 802.1Q tunnels
Configure 802.1Q tunnel interfaces using the APIC GUI
Configure 802.1Q tunnels using the NX-OS style CLI
Example: Configure an 802.1Q tunnel using ports with the NX-OS style CLI
Example: Configure an 802.1Q tunnel using port-channels with the NX-OS style CLI
Example: Configure an 802.1Q tunnel using virtual port-channels with the NX-OS style CLI

Q-in-Q Encapsulation Mapping for EPGs

Q-in-Q Encapsulation Mapping for EPGs
Enabling Q-in-Q Encapsulation on Specific Leaf Switch Interfaces Using the GUI
Enabling Q-in-Q Encapsulation for Leaf Interfaces With Fabric Interface Policies Using the GUI
Mapping an EPG to a Q-in-Q Encapsulation-Enabled Interface Using the GUI
Mapping EPGs to Q-in-Q Encapsulated Leaf Interfaces Using the NX-OS Style CLI

Breakout Ports

Configuration of Breakout Ports
Guidelines and Limitations for Dynamic Breakout Ports on Down Links
Guidelines and Limitations for Auto Breakout Ports on Fabric Links
Configuring Breakout Ports With Profiles and Selectors Using the GUI
Configuring Breakout Ports With the Interface Configuration Using the GUI
Configuring Dynamic Breakout Ports Using the NX-OS Style CLI

Proxy ARP

Proxy ARP
Guidelines and Limitations
Proxy ARP Supported Combinations
Configure Proxy ARP Using the Advanced GUI
Configure Proxy ARP Using the Cisco NX-OS Style CLI
Local proxy ARP

Traffic Storm Control

Traffic storm control
Guidelines for storm control configuration
Configure a traffic storm control policy using the GUI
Configure a traffic storm control policy using the NX-OS style CLI
Storm control SNMP traps

MACsec

Macsec
Guidelines and limitations for macsec on switches
Configure macsec for fabric links using the GUI
Configure macsec for access links using the GUI
Configure macsec parameters using the APIC GUI
Configure macsec keychain policy using the GUI
Configure macsec using the NX-OS style CLI

Fabric Port Tracking

Fabric port tracking
Configure fabric port tracking using the GUI

Cisco APIC Layer 2 Networking Configuration Guide, Release 6.2(x)

MACsec

Updated: July 7, 2026

This chapter contains the following sections:

Macsec

Describes an IEEE 802.1AE standards-based Layer 2 hop-by-hop encryption protocol that provides data confidentiality and integrity for media access independent protocols.

Guidelines and limitations for macsec on switches

Lists the switches and line cards that support MACsec and provides configuration guidelines and limitations.

Configure macsec for fabric links using the GUI

Configure MACsec fabric interface policies and apply them to leaf, spine, or pod policy groups to secure fabric links.

Configure macsec for access links using the GUI

Configure MACsec for access links by creating a MACsec Fabric Interface Policy and applying it to a Fabric Leaf or Spine Port Policy Group using the GUI.

Configure macsec parameters using the APIC GUI

Configure MACsec access parameters policy and apply it to interface policy groups to secure traffic on fabric interfaces.

Configure macsec keychain policy using the GUI

Configure MACsec keychain policy through the GUI to define key policies with pre-shared keys for secure fabric interface communication.

Configure macsec using the NX-OS style CLI

Configure MACsec security policies and key chains for both access and fabric interfaces using the NX-OS style CLI interface.

Need help?

Open a support case

(Requires a Cisco Service Contract)

Bias-free language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.