Cisco APIC Security Configuration Guide, Release 6.2(x)

COOP

Updated: April 17, 2026

Want to summarize with AI?

The Council of Oracle Protocol (COOP) distributes endpoint identity and location information throughout the Cisco ACI fabric.

COOP enables spine switches to maintain a consistent endpoint mapping database for forwarding traffic through the fabric.

Council of Oracle Protocol

COOP distributes endpoint identity and location information to the spine proxy so that all spine switches maintain a consistent endpoint mapping database.

COOP uses Zero Message Queue (ZMQ) to transport endpoint information from leaf switches to spine switches.
Spine switches that run COOP maintain endpoint identity-to-location mappings in a distributed hash table (DHT).
COOP can use MD5 authentication to prevent unauthorized message injection.

COOP authentication modes

COOP supports the following ZMQ connection authentication modes:

Strict mode —Accepts only MD5-authenticated ZMQ connections.
Compatible mode —Accepts MD5-authenticated and unauthenticated ZMQ connections.

For data-path communication, COOP prioritizes authenticated connections. Cisco APIC and the fabric switches support COOP authentication.

COOP authentication in Cisco APIC

COOP authentication protects the Zero Message Queue (ZMQ) connections that transport endpoint mapping information within the fabric.

COOP supports MD5-authenticated ZMQ connections.
COOP provides compatible and strict authentication modes.
Cisco APIC rotates the security token that supplies the authentication credential every hour.

Authentication modes

Table 1. COOP authentication modes
Mode	Default	Connection behavior
`compatible`	Yes	Accepts MD5-authenticated and unauthenticated ZMQ connections.
`strict`	No	Accepts only MD5-authenticated ZMQ connections.

Authentication managed objects

Cisco APIC stores the COOP authentication policy and security token in managed objects in the Data Management Engine (DME) and COOP database.

Table 2. COOP authentication managed objects
Managed object	Purpose
`coop:AuthP`	Configures the authentication mode in the COOP database at `coop/inst/auth` .
`fabric:SecurityToken`	Contains the `@token` attribute that supplies the MD5 authentication credential.

Cisco APIC changes the security token every hour in both authentication modes.

Note

The value of the @token attribute is not displayed.

COOP authentication guidelines and limitations

The COOP authentication mode determines whether fabric switches accept authenticated connections only or accept both authenticated and unauthenticated connections.

Fabric upgrade restriction

During a Cisco Application Centric Infrastructure (ACI) fabric upgrade, do not enable strict COOP authentication until all switches in the fabric have been upgraded.

Caution

Enabling strict authentication before all switches are upgraded can cause a switch to reject a COOP connection.

Configure COOP authentication by using the Cisco APIC GUI

Before you begin

If a fabric upgrade is in progress, upgrade all switches in the fabric before selecting strict authentication.

Procedure

On the menu bar, choose System > System Settings .
In the Navigation pane, choose COOP Group .
In the Work pane, locate the Policy Property area. In the Type field, choose Compatible Type or Strict Type .
- Compatible Type accepts authenticated and unauthenticated COOP connections.
- Strict Type accepts only authenticated COOP connections.
Click Submit .

The selected COOP authentication mode is applied.

Configure COOP authentication by using the Cisco NX-OS-style CLI

Before you begin

If a fabric upgrade is in progress, upgrade all switches in the fabric before configuring strict authentication.

Procedure

Enter global configuration mode.

Example:

apic1# configure
                                                apic1(config)#

Enter COOP fabric configuration mode.

Example:

apic1(config)# coop-fabric
                                                apic1(config-coop-fabric)#

Display the supported authentication modes.

Example:

apic1(config-coop-fabric)# authentication type ?
                                                compatible  Compatible type
                                                strict      Strict type

Configure strict authentication.
Example:
```
apic1(config-coop-fabric)# authentication type strict
```
COOP accepts only authenticated connections.

Configure COOP authentication by using the Cisco NX-OS-style CLI

Before you begin

If a fabric upgrade is in progress, upgrade all switches in the fabric before configuring strict authentication.

Procedure

Enter global configuration mode.

Example:

apic1# configure
                        apic1(config)#

Enter COOP fabric configuration mode.

Example:

apic1(config)# coop-fabric
                        apic1(config-coop-fabric)#

Display the supported authentication modes.

Example:

apic1(config-coop-fabric)# authentication type ?
                        compatible  Compatible type
                        strict      Strict type

Configure strict authentication.
Example:
```
apic1(config-coop-fabric)# authentication type strict
```
COOP accepts only authenticated connections.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.