Describes significant changes and new features introduced in recent releases of the guide. Provides users with a summary of enhancements and documentation locations for quick reference and planning.
Trademarks
What's Changed in this guide
Describes significant changes and new features introduced in recent releases of the guide. Provides users with a summary of enhancements and documentation locations for quick reference and planning.
Overview
Introduces the security capabilities available in Cisco ACI for protecting the fabric against attacks, configuration mistakes, service degradation, and data compromise.
Access, Authentication, and Accounting
Covers user management fundamentals including local user configuration, access control workflows, authentication methods, and administrative recovery procedures for system security.
Restricting Access Using Security Domains and Node Rules
Explains how to implement role-based access control through security domains and node rules to restrict user access to specific network devices and resources.
RADIUS, TACACS+, LDAP, RSA, SAML, OAuth 2, and DUO
802.1X
Explains IEEE 802.1X network access control and provides guidance for configuring port and node authentication through the APIC GUI, NX-OS-style CLI, and REST API.
Port Security
Explains how port security protects the ACI fabric from unknown MAC address flooding and provides guidance for limiting MAC address learning, configuring protect mode, and verifying deployment.
First Hop Security
Explains IPv4 and IPv6 first-hop security capabilities and provides guidance for securing address assignment and neighbor-discovery operations through the APIC GUI, CLI, and REST API.
Protocol Authentication
Explains authentication for COOP and EIGRP and provides guidance for protecting protocol communications from unauthorized modification and malicious traffic injection.
Control Plane Traffic
Explains control plane policing and provides guidance for configuring rate limits, per-interface and per-protocol policies, prefilters, and statistics to protect ACI switches from excessive or malicious traffic.
Fabric Security
Explains FIPS 140-3 security requirements and provides guidance for enabling and configuring FIPS-compliant cryptographic operations on Cisco APIC.
Endpoint Security Groups
Explains Endpoint Security Group concepts and provides guidance for configuring selectors, contracts, route leaking, Layer 4–7 services, migration, and operational tools in Cisco ACI environments.
Security Policies
Explains the Cisco ACI contract-based security model and provides guidance for configuring traffic filters, policy enforcement, taboos, and ACL permit and deny logging.
Data Plane Policing
Explains data plane policing concepts and provides guidance for controlling bandwidth and marking or dropping excessive traffic on Layer 2 interfaces, Layer 3 interfaces, and endpoint groups.
HTTPS Access
Explains secure HTTPS access and provides guidance for configuring custom certificates, SSL ciphers and protocols, and Diffie-Hellman key exchange on Cisco APIC.
Additional ACI Security Features
Summarizes additional Cisco ACI security capabilities and provides guidance for restricting infrastructure VLAN traffic and disabling generated APIC session log files.