Cisco APIC Security Configuration Guide, Release 6.2(x)

PDF

Cisco APIC Security Configuration Guide, Release 6.2(x)

Configure first-hop security in Cisco APIC using the REST API

Updated: April 17, 2026

Want to summarize with AI?

Log in

Configures First-Hop Security and trust control policies through the Cisco APIC REST API and applies them to a bridge domain and endpoint group.

Use this procedure to create First-Hop Security and trust control policies and associate them with a bridge domain and endpoint group.

Before you begin

Configure the tenant, bridge domain, application profile, and endpoint group (EPG).

Procedure

  1. Post an XML payload similar to the following to create a First-Hop Security policy and apply it to a bridge domain:

    Example:

    <polUni>
                        <fvTenant name="<tenant-name>">
                        <fhsBDPol name="<FHS-policy-name>"
                        ipInspectAdminSt="enabled-ipv6"
                        srcGuardAdminSt="enabled-both"
                        raGuardAdminSt="enabled">
                        <fhsRaGuardPol name="<RA-Guard-policy-name>"
                        managedConfigCheck="true"
                        managedConfigFlag="true"
                        otherConfigCheck="true"
                        otherConfigFlag="true"
                        maxRouterPref="medium"
                        minHopLimit="3"
                        maxHopLimit="15"/>
                        </fhsBDPol>
                        <fvBD name="<bridge-domain-name>">
                        <fvRsBDToFhs tnFhsBDPolName="<FHS-policy-name>"/>
                        </fvBD>
                        </fvTenant>
                        </polUni>

  2. Post an XML payload similar to the following to create a trust control policy and apply it to an EPG:

    Example:

    <polUni>
                        <fvTenant name="<tenant-name>">
                        <fhsTrustCtrlPol name="<trust-control-policy-name>"
                        hasDhcpv4Server="true"
                        hasDhcpv6Server="true"
                        hasIpv6Router="true"
                        trustRa="true"
                        trustArp="true"
                        trustNd="true"/>
                        <fvAp name="<application-profile-name>">
                        <fvAEPg name="<EPG-name>">
                        <fvRsTrustCtrl tnFhsTrustCtrlPolName="<trust-control-policy-name>"/>
                        </fvAEPg>
                        </fvAp>
                        </fvTenant>
                        </polUni>

    The First-Hop Security and trust control policies are associated with the specified bridge domain and EPG.