Cisco APIC Security Configuration Guide, Release 6.2(x)

PDF

Cisco APIC Security Configuration Guide, Release 6.2(x)

Recover the Cisco APIC admin password

Updated: April 17, 2026

Want to summarize with AI?

Log in

Configure admin password recovery for Cisco APIC with TAC assistance.

Recover the admin password when access to the Cisco APIC is lost.

Note

Admin password recovery in the 6.1(1) through 6.1(3) releases needs a special internal image to perform a different procedure than the one explained in this section, which cannot be done without TAC support. The 6.1(4) release introduces a simplified procedure involving the root user; however, you still require TAC assistance.

You need to do this procedure on one node only.

This procedure provides an example of logging in as the root user using the CIMC vKVM, but you can also use SSH or other CLI options to log in as user "root" as long as you have a valid password from TAC.

For the 6.1(4) release and later, this procedure applies to all platforms.

Follow these steps to recover the Cisco APIC admin password:

Procedure

  1. Contact Cisco TAC to recover the Cisco Application Policy Infrastructure Controller (APIC) password. You cannot recover the password on your own.

  2. Log into the CIMC using a web browser.

  3. Click Launch vKVM.

  4. Switch from TTY1 to TTY5 using Ctrl + Alt + F5 for Windows, or Fn + Option + F5 for Mac, then press Enter.

    The token displays after token =.

    The token changes every 60 minutes.

  5. Give the token to TAC, so the representative can generate a root password.

  6. Follow these substeps to log in to the Cisco APIC as the root user.

    You can also use SSH or CIMC to directly connect to the node and log in as user "root" as long as you have a valid password from TAC.

    The password will not be valid when the token changes, which is every 60 minutes.

    1. Connect to the APIC.

      Use one of these methods:

      • In the vKVM console, switch back to TTY1 from TTY5 using Ctrl + Alt + F1 for Windows, or Fn + Option + F1 for Mac. If you are already logged in as another user, log out by using the exit command to go back to the login prompt.

      • Connect to the CIMC using SSH and enter the connect host command to use serial over LAN (SoL).

      • Use the SSH client to connect to the APIC's OOB address.

    2. Type the username "root".
    3. Choose File > Paste Text From File/Send Text.
    4. Copy the password from TAC, paste it in the Send Text Data field, then click Send.
    5. After the copy completes, press Enter.

  7. Change the password by executing the command acidiag passwd admin.

    After you confirm the password, you will see Admin password reset successful!.

  8. Log out of the root user by using the exit command.

The admin password is successfully reset and you can log in to the Cisco APIC using the new credentials.

Use the rescue-user account to erase the Cisco APIC configuration using the NX-OS style CLI

Use the rescue-user account to perform emergency troubleshooting and configuration erasure on the Cisco APIC.

The rescue-user is an emergency login that provides access to the Cisco APIC even when it is not in a cluster. You can use this login to run troubleshooting commands including erasing the configuration.

Note

For a standby Cisco APIC, you can log in using SSH with the username "rescue-user" and no password. If the standby Cisco APIC was previously part of a fabric, the "rescue-user" account will retain the old administrator password, unless the operating system is re-installed using the keyboard, video, mouse (KVM) console.

Procedure

  1. Access the APIC using the Cisco Integrated Management Controller (CIMC) console.

  2. Login as rescue-user.

    Note

    If an admin password is in place and the Cisco APIC is logged onto the fabric, the rescue-user password is the same as the admin password. Otherwise there is no rescue-user password.

  3. Use the acidiag touch command to clear the configuration.

    Example:

    apic1# acidiag touch setup

The Cisco APIC configuration is cleared and the device is ready for reconfiguration.

Using the fallback login domain to log in to the local database

This task allows you to access the local user database when normal authentication methods fail or when you are locked out of the system.

There is a hidden login domain named "fallback" that allows you to log in using the local user database in case of lockout. The format of the username used for the authentication method is apic#fallback\\<username>.

Procedure

  1. Use the fallback login domain to log in to the local database in the GUI or log in to the fallback login domain using the NX-OS-style CLI, shown as follows:

    apic1(config)# aaa authentication login domain fallback
apic1(config-domain)# ?
group Set provider group for login domain
realm Specify server realm

  2. Optionally, you can instead use the REST API to log in to the fallback login domain, shown as follows:

    • URL: https://ip_address/API/aaaLogin.xml

    • DATA:

      <aaaUser name="apic#fallback\\admin"
pwd="passwordhere"/>

You successfully log in to the local database using the fallback login domain, bypassing any authentication issues with external login domains.