Home
Support
Product Support
Cloud and Systems Management
Cisco Application Policy Infrastructure Controller (APIC)
Configuration Guides

Cisco APIC Security Configuration Guide, Release 6.2(x)

Releases

6.2(x)
6.1(x)
6.0(x)
5.3(x)
5.2(x)
5.1(x)
5.0(x)
4.2(x)
4.1(x)
4.0(1)
3.x and Earlier

View all Saved Content

PDF

Is this content helpful?

Helpful Unhelpful

Suggestions for Improvement

Thank you for your feedback. Your response has been recorded.

Ask about this content

Cisco APIC Security Configuration Guide, Release 6.2(x)

Expand all sections

About this content

Trademarks

What's Changed in this guide

What's changed in this guide

Overview

Overview

Access, Authentication, and Accounting

User access, authorization, and accounting
Access rights workflow dependencies
APIC local users
Change remote user role
Signature-based transactions
Accounting
Local user configuration
Generate an X.509 certificate and a private key
Configure user lockout after continuous failed attempts to log in using the GUI
Configure local user for OTP-based authentication
Recover the Cisco APIC admin password

Restricting Access Using Security Domains and Node Rules

Restricting access by domains
Assigning a Node to a Domain
Guidelines and limitations for security domains and node rules
Create a security domain
Create a node rule to assign access to a node
Creating a Custom Role with Custom Privileges
Configure a custom privilege
Use case example of configuring an RBAC node rule

RADIUS, TACACS+, LDAP, RSA, SAML, OAuth 2, and DUO

Overview RADIUS, TACACS+, LDAP
User IDs in the APIC bash shell
AV pairs on external authentication servers
Remote users
Create a provider
Login domains
RADIUS authentication
TACACS+ authentication
LDAP/Active directory authentication
Multi-factor authentication with DUO
RSA secure ID authentication
SAML authentication
OAuth 2 / OIDC authentication

802.1X

802.1X authentication
802.1X host modes
802.1X authentication modes
802.1X Guidelines and limitations
802.1X and RADIUS configuration
Configure 802.1X node authentication using the NX-OS-style CLI
Configure 802.1X port authentication using the REST API
Configure 802.1X node authentication using the REST API

Port Security

Port security in Cisco ACI
Port security guidelines and limitations
Port-level port security
Port security learning behavior
Port security protect mode
Verify port security installation using Visore
Verify port security installation using Visore

First Hop Security

First-hop security
First-hop security policy deployment
First-hop security guidelines and limitations
Configure first-hop security using the Cisco APIC GUI
Configure first-hop security using the NX-OS-style CLI
Run first-hop security switch iBASH commands
Configure first-hop security in Cisco APIC using the REST API

Protocol Authentication

COOP
EIGRP

Control Plane Traffic

Control plane policing
CoPP prefilters

Fabric Security

Federal Information Processing Standard 140-3
FIPS guidelines and limitations
Configure FIPS mode for Cisco APIC by using the GUI
Configure FIPS mode for Cisco APIC by using the NX-OS-style CLI
Configure FIPS mode for Cisco APIC by using the REST API

Endpoint Security Groups

Endpoint security groups
ESG selectors
Layer 2 traffic limitations with IP-based selectors
Selector precedence
Contracts for endpoint security groups
ESG shared services and VRF route leaking
Layer 4 to Layer 7 services for endpoint security groups
Capacity dashboard
Endpoint tracker
Endpoint security group guidelines and limitations
EPG-to-ESG migration strategy
ESG migration assistant
Create an endpoint security group by using the GUI
Apply a contract to an endpoint security group by using the GUI
ESG and contract configuration in the REST API
Tags and selectors in the REST API
Configure route leaking for an internal bridge domain subnet by using the GUI
Route leaking for internal bridge domain subnets in the REST API
Configure route leaking for external prefixes by using the GUI
Route leaking for external prefixes in the REST API
Configure route leaking for internal prefixes by using the GUI
Apply Layer 4 to Layer 7 services to an endpoint security group by using the GUI
Layer 4 to Layer 7 services for endpoint security groups using the REST API

Security Policies

Contracts in the ACI fabric security policy model
Security policy enforcement
Multicast EPG security
Taboo contracts
ACL contract permit and deny logs
Enable ACL contract permit or deny logging by using the GUI
Enable ACL contract permit logging by using the NX-OS-style CLI
Enable ACL contract permit and deny logging by using the REST API
Enable taboo contract deny logging by using the GUI
Enable taboo contract deny logging by using the NX-OS-style CLI
Enable taboo contract deny logging by using the REST API
View ACL permit and deny logs by using the GUI
View ACL permit and deny logs by using the NX-OS-style CLI
View ACL permit and deny logs by using the REST API
Configure SSH host key sizes by using the GUI

Data Plane Policing

Data plane policing
Guidelines and limitations for data plane policing
Configure data plane policing for a Layer 2 interface by using the GUI
Configure data plane policing for a Layer 3 interface by using the GUI
Configuring Data Plane Policing Using the REST API
Configure data plane policing by using the NX-OS-style CLI
Data plane policing at the endpoint group level

HTTPS Access

Custom certificates for HTTPS access
Guidelines and limitations for custom certificates
SSL cipher configuration
Configure a custom certificate for Cisco ACI HTTPS access by using the GUI
Configure default SSL protocols and Diffie-Hellman key exchange by using the GUI
Enable certificate-based authentication by using the NX-OS-style CLI
SSL ciphers and TLS protocol support

Additional ACI Security Features

Additional Security Features
Restricting Infra VLAN Traffic
Turning Off Generated Session Log Files in APIC

Cisco APIC Security Configuration Guide, Release 6.2(x)

Configure route leaking for an internal bridge domain subnet by using the GUI

Updated: April 17, 2026

Want to summarize with AI?

Leaks an internal bridge domain subnet from a source virtual routing and forwarding (VRF) instance to one or more destination VRF instances.

Before you begin

Configure the tenant, source and destination VRF instances, bridge domain, and subnet to leak.

VRF-level route leaking provides routing reachability for the specified bridge domain subnet. Configure the required contract relationships separately to permit traffic between endpoint security groups (ESGs) in different VRF instances.

Procedure

In the Navigation pane, navigate to Tenants > tenant-name > Networking > VRFs > source-vrf-name > Inter-VRF Leaked Routes for ESG > EPG/BD Subnets .
Right-click EPG/BD Subnets, and choose Configure EPG/BD Subnet to leak.
In the Configure EPG/BD Subnet to leak dialog box, configure the subnet.
1. In the IP field, enter the bridge domain subnet and prefix length to leak.
2. Optional: In the Description field, enter a description of the leaked subnet.
3. Optional: Set Allow L3Out Advertisement to True if Layer 3 Outside (L3Out) connections in the destination VRF instances must advertise the leaked subnet.
In the Tenant and VRF destinations field, click +.
In the Create Tenant and VRF destination dialog box, configure the destination.
1. In the Tenant and VRF field, choose the destination tenant and VRF instance.
2. Optional: In the Description field, enter a description of the destination.
3. For Allow L3Out Advertisement, choose the advertisement behavior for this destination VRF instance.
  - True: Allows L3Out connections in this destination VRF instance to advertise the leaked subnet.
  - False: Prevents L3Out connections in this destination VRF instance from advertising the leaked subnet.
  - inherit (default): Uses the Allow L3Out Advertisement value configured for the leaked subnet.
4. Click OK.
Click Submit.

The internal bridge domain subnet is leaked to the selected destination VRF instances with the configured L3Out advertisement behavior.

Need help?

Open a support case

(Requires a Cisco Service Contract)

Bias-free language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.