Cisco APIC Security Configuration Guide, Release 6.2(x)

PDF

Cisco APIC Security Configuration Guide, Release 6.2(x)

Configure 802.1X node authentication using the REST API

Updated: April 17, 2026

Want to summarize with AI?

Log in

Creates, updates, and deletes an 802.1X node authentication policy by submitting XML payloads to the Cisco APIC REST API.

This procedure manages an 802.1X node authentication policy named 802-node-2 under uni/infra.

Before you begin

Establish an authenticated Cisco APIC REST API session before you begin.

Configure the RADIUS provider group referenced in the payload.

Procedure

  1. Submit this XML payload to create an 802.1X node authentication policy:

    Example:

    <polUni>
            <infraInfra>
            <l2NodeAuthPol annotation="" descr=""
            dn="uni/infra/nodeauthpol-802-node-2"
            failAuthEpg="tn-t2,ap-ap,epg-epg1"
            failAuthVlan="vlan-2078" name="802-node-2"
            nameAlias="" ownerKey="" ownerTag="">
            <l2RsAaaRadiusProviderGroup annotation=""
            tDn="uni/userext/radiusext/radiusprovidergroup-radius-grp"/>
            </l2NodeAuthPol>
            </infraInfra>
            </polUni>

  2. Submit this XML payload to change the failed-authentication VLAN to vlan-2066:

    Example:

    <polUni>
            <infraInfra>
            <l2NodeAuthPol annotation="" descr=""
            dn="uni/infra/nodeauthpol-802-node-2"
            failAuthEpg="tn-t2,ap-ap,epg-epg1"
            failAuthVlan="vlan-2066" name="802-node-2"
            nameAlias="" ownerKey="" ownerTag="">
            <l2RsAaaRadiusProviderGroup annotation=""
            tDn="uni/userext/radiusext/radiusprovidergroup-radius-grp"/>
            </l2NodeAuthPol>
            </infraInfra>
            </polUni>

  3. Submit this XML payload to delete the 802.1X node authentication policy:

    Example:

    <polUni>
            <infraInfra>
            <l2NodeAuthPol annotation="" descr=""
            dn="uni/infra/nodeauthpol-802-node-2"
            failAuthEpg="tn-t2,ap-ap,epg-epg1"
            failAuthVlan="vlan-2078" name="802-node-2"
            nameAlias="" ownerKey="" ownerTag="" status="deleted">
            <l2RsAaaRadiusProviderGroup annotation=""
            tDn="uni/userext/radiusext/radiusprovidergroup-radius-grp"
            status="deleted"/>
            </l2NodeAuthPol>
            </infraInfra>
            </polUni>

The REST API creates, updates, or deletes the specified 802.1X node authentication policy according to the submitted payload.