Cisco APIC Security Configuration Guide, Release 6.2(x)

Use case example of configuring an RBAC node rule

Updated: April 17, 2026

Want to summarize with AI?

Describes a practical scenario for configuring RBAC node rules to control user access to specific tenants and leaf nodes. Provides step-by-step guidance and highlights access behaviors for different users.

The use case demonstrates how RBAC node rules and security domains are configured to restrict user access to specific tenants and leaf nodes in a Cisco ACI fabric.

Multiple tenants and leaf nodes are managed within the Cisco ACI fabric.
Security domains and RBAC node rules are used to assign users to specific tenants and leaf nodes.
Each user receives access privileges based on their assigned security domains and roles.

Configuration Overview and Access Behavior

This section provides an overview of the configuration steps and access behaviors for users in the RBAC node rule scenario.

User1 can manage only Tenant1, leaf node 101 and 102.
User2 can manage only Tenant2, leaf node 201 and 202.

Follow these steps to configure RBAC node rules and security domains:

Create security domains for tenants and leaf nodes.
Create RBAC node rules to assign leaf nodes to security domains.
Create users and assign security domains and roles.

Security domains and roles assigned to users:

all: Role port-mgmt with the Write privilege
Leaf100: Role admin with the Write privilege
Tenant1: Role admin with the Write privilege

Comparison of access privileges for User1 and User2:

Table 1. Access Privileges Comparison
Attributes	User1	User2
Tenant Access	Tenant1	Tenant2
Leaf Node Access	Leaf101, Leaf102	Leaf201, Leaf202
Role	admin, port-mgmt	admin, port-mgmt

Note

Enabling Restricted RBAC Domain for a leaf security domain prevents users from seeing access policies created by other users in different domains. Default interface policies remain visible but cannot be modified if restriction is enabled.

The following figures illustrate the relationships and configuration steps for User1 and User2:

Figure 1. Access Requirements for User1 and User2

Figure 2. Configuration Relationships for User1

Figure 3. Configuration Relationships for User2

Example Configuration for User1

This example shows User1 assigned to Tenant1 and Leaf101/102 with admin and port-mgmt roles. User1 cannot access other tenants or leaf nodes, and only sees policies created within the same security domain.

Counter-Example: Access Outside Assigned Domains

Analogy: RBAC Node Rule as Access Filter

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.