Home
Support
Product Support
Cloud and Systems Management
Cisco Application Policy Infrastructure Controller (APIC)
Configuration Guides

Cisco APIC Security Configuration Guide, Release 6.2(x)

Releases

6.2(x)
6.1(x)
6.0(x)
5.3(x)
5.2(x)
5.1(x)
5.0(x)
4.2(x)
4.1(x)
4.0(1)
3.x and Earlier

View all Saved Content

PDF

Is this content helpful?

Helpful Unhelpful

Suggestions for Improvement

Thank you for your feedback. Your response has been recorded.

Ask about this content

Cisco APIC Security Configuration Guide, Release 6.2(x)

Expand all sections

About this content

Trademarks

What's Changed in this guide

What's changed in this guide

Overview

Overview

Access, Authentication, and Accounting

User access, authorization, and accounting
Access rights workflow dependencies
APIC local users
Change remote user role
Signature-based transactions
Accounting
Local user configuration
Generate an X.509 certificate and a private key
Configure user lockout after continuous failed attempts to log in using the GUI
Configure local user for OTP-based authentication
Recover the Cisco APIC admin password

Restricting Access Using Security Domains and Node Rules

Restricting access by domains
Assigning a Node to a Domain
Guidelines and limitations for security domains and node rules
Create a security domain
Create a node rule to assign access to a node
Creating a Custom Role with Custom Privileges
Configure a custom privilege
Use case example of configuring an RBAC node rule

RADIUS, TACACS+, LDAP, RSA, SAML, OAuth 2, and DUO

Overview RADIUS, TACACS+, LDAP
User IDs in the APIC bash shell
AV pairs on external authentication servers
Remote users
Create a provider
Login domains
RADIUS authentication
TACACS+ authentication
LDAP/Active directory authentication
Multi-factor authentication with DUO
RSA secure ID authentication
SAML authentication
OAuth 2 / OIDC authentication

802.1X

802.1X authentication
802.1X host modes
802.1X authentication modes
802.1X Guidelines and limitations
802.1X and RADIUS configuration
Configure 802.1X node authentication using the NX-OS-style CLI
Configure 802.1X port authentication using the REST API
Configure 802.1X node authentication using the REST API

Port Security

Port security in Cisco ACI
Port security guidelines and limitations
Port-level port security
Port security learning behavior
Port security protect mode
Verify port security installation using Visore
Verify port security installation using Visore

First Hop Security

First-hop security
First-hop security policy deployment
First-hop security guidelines and limitations
Configure first-hop security using the Cisco APIC GUI
Configure first-hop security using the NX-OS-style CLI
Run first-hop security switch iBASH commands
Configure first-hop security in Cisco APIC using the REST API

Protocol Authentication

COOP
EIGRP

Control Plane Traffic

Control plane policing
CoPP prefilters

Fabric Security

Federal Information Processing Standard 140-3
FIPS guidelines and limitations
Configure FIPS mode for Cisco APIC by using the GUI
Configure FIPS mode for Cisco APIC by using the NX-OS-style CLI
Configure FIPS mode for Cisco APIC by using the REST API

Endpoint Security Groups

Endpoint security groups
ESG selectors
Layer 2 traffic limitations with IP-based selectors
Selector precedence
Contracts for endpoint security groups
ESG shared services and VRF route leaking
Layer 4 to Layer 7 services for endpoint security groups
Capacity dashboard
Endpoint tracker
Endpoint security group guidelines and limitations
EPG-to-ESG migration strategy
ESG migration assistant
Create an endpoint security group by using the GUI
Apply a contract to an endpoint security group by using the GUI
ESG and contract configuration in the REST API
Tags and selectors in the REST API
Configure route leaking for an internal bridge domain subnet by using the GUI
Route leaking for internal bridge domain subnets in the REST API
Configure route leaking for external prefixes by using the GUI
Route leaking for external prefixes in the REST API
Configure route leaking for internal prefixes by using the GUI
Apply Layer 4 to Layer 7 services to an endpoint security group by using the GUI
Layer 4 to Layer 7 services for endpoint security groups using the REST API

Security Policies

Contracts in the ACI fabric security policy model
Security policy enforcement
Multicast EPG security
Taboo contracts
ACL contract permit and deny logs
Enable ACL contract permit or deny logging by using the GUI
Enable ACL contract permit logging by using the NX-OS-style CLI
Enable ACL contract permit and deny logging by using the REST API
Enable taboo contract deny logging by using the GUI
Enable taboo contract deny logging by using the NX-OS-style CLI
Enable taboo contract deny logging by using the REST API
View ACL permit and deny logs by using the GUI
View ACL permit and deny logs by using the NX-OS-style CLI
View ACL permit and deny logs by using the REST API
Configure SSH host key sizes by using the GUI

Data Plane Policing

Data plane policing
Guidelines and limitations for data plane policing
Configure data plane policing for a Layer 2 interface by using the GUI
Configure data plane policing for a Layer 3 interface by using the GUI
Configuring Data Plane Policing Using the REST API
Configure data plane policing by using the NX-OS-style CLI
Data plane policing at the endpoint group level

HTTPS Access

Custom certificates for HTTPS access
Guidelines and limitations for custom certificates
SSL cipher configuration
Configure a custom certificate for Cisco ACI HTTPS access by using the GUI
Configure default SSL protocols and Diffie-Hellman key exchange by using the GUI
Enable certificate-based authentication by using the NX-OS-style CLI
SSL ciphers and TLS protocol support

Additional ACI Security Features

Additional Security Features
Restricting Infra VLAN Traffic
Turning Off Generated Session Log Files in APIC

Cisco APIC Security Configuration Guide, Release 6.2(x)

Data Plane Policing

Updated: April 17, 2026

Explains data plane policing concepts and provides guidance for controlling bandwidth and marking or dropping excessive traffic on Layer 2 interfaces, Layer 3 interfaces, and endpoint groups.

This chapter contains the following sections:

Data plane policing

Data plane policing (DPP) controls ingress and egress bandwidth on Cisco ACI fabric access interfaces by marking or dropping traffic that exceeds configured rates.

Guidelines and limitations for data plane policing

Review the supported data plane policing modes, actions, statistics, platforms, and feature combinations.

Configure data plane policing for a Layer 2 interface by using the GUI

Create a data plane policing (DPP) policy and configure its traffic rates, policing actions, and sharing mode for a Layer 2 interface.

Configure data plane policing for a Layer 3 interface by using the GUI

Create an ingress data plane policing (DPP) policy and apply it to a routed interface, switched virtual interface, or routed subinterface.

Configuring Data Plane Policing Using the REST API

Describes how to configure data plane policing for Layer 2 and Layer 3 traffic using the REST API. Provides XML configuration examples for both ingress and egress traffic on leaf switches to help users enforce traffic policies.

Configure data plane policing by using the NX-OS-style CLI

Configure and verify data plane policing (DPP) policies for Layer 2 and Layer 3 interfaces by using the NX-OS-style CLI.

Data plane policing at the endpoint group level

Data plane policing (DPP) limits traffic from endpoint group (EPG) members on each leaf switch where the EPG is deployed.

Need help?

Open a support case

(Requires a Cisco Service Contract)

Bias-free language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.