Cisco APIC Security Configuration Guide, Release 6.2(x)

PDF

Cisco APIC Security Configuration Guide, Release 6.2(x)

Accounting

Updated: April 17, 2026

Want to summarize with AI?

Log in

Explains how Cisco Application Centric Infrastructure fabric accounting is handled by managed objects that track user sessions and configuration changes.

Accounting is a fabric security mechanism that

  • tracks user account login and logout sessions on the Cisco Application Policy Infrastructure Controller and switches

  • monitors changes users make to objects and when the changes occurred, and

  • processes data using the same mechanism as faults and events.

Managed objects

Cisco Application Centric Infrastructure (ACI) fabric accounting is handled by these managed objects:

  • The aaaSessionLR managed object tracks user account login and logout sessions on the Cisco Application Policy Infrastructure Controller (APIC) and switches, and token refresh. The Cisco ACI fabric session alert feature stores information such as:

    • Username

    • IP address initiating the session

    • Type (telnet, HTTPS, REST, and so on)

      Note

      Beginning with the 5.3(1) release, telnet is not supported.

    • Session time and length

    • Token refresh: A user account login event generates a valid active token which is required in order for the user account to exercise its rights in the Cisco ACI fabric.

      Note
      Token expiration is independent of login; a user could log out but the token expires according to the duration of the timer value it contains.

  • The aaaModLR managed object tracks the changes users make to objects and when the changes occurred.

  • If the AAA server is not pingable, it is marked unavailable and a fault is seen.

Both the aaaSessionLR and aaaModLR event logs are stored in Cisco APIC shards. After the data exceeds the pre-set storage allocation size, it overwrites records on a first-in first-out basis.

Note
In the event of a destructive event such as a disk crash or a fire that destroys a Cisco APIC cluster node, the event logs are lost; event logs are not replicated across the cluster.

The aaaModLR and aaaSessionLR managed objects can be queried by class or by distinguished name (DN). A class query provides all the log records for the whole fabric. All aaaModLR records for the whole fabric are available from the GUI at the Fabric > Inventory > POD > History > Audit Log section. The Cisco APIC GUI History > Audit Log options enable viewing event logs for a specific object identified in the GUI.

The standard syslog, callhome, REST query, and CLI export mechanisms are fully supported for aaaModLR and aaaSessionLR managed object query data. There is no default policy to export this data.

There are no pre-configured queries in the Cisco APIC that report on aggregations of data across a set of objects or for the entire system. A fabric administrator can configure export policies that periodically export aaaModLR and aaaSessionLR query data to a syslog server. Exported data can be archived periodically and used to generate custom reports from portions of the system or across the entire set of system logs.

Routed connectivity to external networks as a shared service billing and statistics

Routed connectivity to external networks as a shared service billing and statistics is a ACI feature that

  • enables collection of byte count and packet count billing statistics from ports configured for routed connectivity to external networks as a shared service

  • allows any EPG in any tenant to share an external L3Out EPG for routed connectivity to external networks

  • aggregates billing statistics at the Cisco APIC from leaf switches where external L3Out EPGs are provisioned, and

  • supports periodic export of billing statistics to a server through configurable accounting policies.

External network representation and billing collection

The Cisco Application Policy Infrastructure Controller (APIC) can be configured to collect billing statistics from ports configured for routed connectivity to external networks as a shared service. External networks are represented as external L3Out endpoint group (l3extInstP managed object) in Cisco Application Centric Infrastructure (ACI).

Billing statistics can be collected for each EPG in any tenant that uses an external L3Out EPG as a shared service. The leaf switch where the external L3Out EPG is provisioned forwards the billing statistics to the Cisco APIC where they are aggregated. Accounting policies can be configured to export these billing statistics periodically to a server.