Home
Support
Product Support
Cloud and Systems Management
Cisco Application Policy Infrastructure Controller (APIC)
Configuration Guides

Cisco APIC Security Configuration Guide, Release 6.2(x)

Releases

6.2(x)
6.1(x)
6.0(x)
5.3(x)
5.2(x)
5.1(x)
5.0(x)
4.2(x)
4.1(x)
4.0(1)
3.x and Earlier

View all Saved Content

PDF

Is this content helpful?

Helpful Unhelpful

Suggestions for Improvement

Thank you for your feedback. Your response has been recorded.

Ask about this content

Cisco APIC Security Configuration Guide, Release 6.2(x)

Expand all sections

About this content

Trademarks

What's Changed in this guide

What's changed in this guide

Overview

Overview

Access, Authentication, and Accounting

User access, authorization, and accounting
Access rights workflow dependencies
APIC local users
Change remote user role
Signature-based transactions
Accounting
Local user configuration
Generate an X.509 certificate and a private key
Configure user lockout after continuous failed attempts to log in using the GUI
Configure local user for OTP-based authentication
Recover the Cisco APIC admin password

Restricting Access Using Security Domains and Node Rules

Restricting access by domains
Assigning a Node to a Domain
Guidelines and limitations for security domains and node rules
Create a security domain
Create a node rule to assign access to a node
Creating a Custom Role with Custom Privileges
Configure a custom privilege
Use case example of configuring an RBAC node rule

RADIUS, TACACS+, LDAP, RSA, SAML, OAuth 2, and DUO

Overview RADIUS, TACACS+, LDAP
User IDs in the APIC bash shell
AV pairs on external authentication servers
Remote users
Create a provider
Login domains
RADIUS authentication
TACACS+ authentication
LDAP/Active directory authentication
Multi-factor authentication with DUO
RSA secure ID authentication
SAML authentication
OAuth 2 / OIDC authentication

802.1X

802.1X authentication
802.1X host modes
802.1X authentication modes
802.1X Guidelines and limitations
802.1X and RADIUS configuration
Configure 802.1X node authentication using the NX-OS-style CLI
Configure 802.1X port authentication using the REST API
Configure 802.1X node authentication using the REST API

Port Security

Port security in Cisco ACI
Port security guidelines and limitations
Port-level port security
Port security learning behavior
Port security protect mode
Verify port security installation using Visore
Verify port security installation using Visore

First Hop Security

First-hop security
First-hop security policy deployment
First-hop security guidelines and limitations
Configure first-hop security using the Cisco APIC GUI
Configure first-hop security using the NX-OS-style CLI
Run first-hop security switch iBASH commands
Configure first-hop security in Cisco APIC using the REST API

Protocol Authentication

COOP
EIGRP

Control Plane Traffic

Control plane policing
CoPP prefilters

Fabric Security

Federal Information Processing Standard 140-3
FIPS guidelines and limitations
Configure FIPS mode for Cisco APIC by using the GUI
Configure FIPS mode for Cisco APIC by using the NX-OS-style CLI
Configure FIPS mode for Cisco APIC by using the REST API

Endpoint Security Groups

Endpoint security groups
ESG selectors
Layer 2 traffic limitations with IP-based selectors
Selector precedence
Contracts for endpoint security groups
ESG shared services and VRF route leaking
Layer 4 to Layer 7 services for endpoint security groups
Capacity dashboard
Endpoint tracker
Endpoint security group guidelines and limitations
EPG-to-ESG migration strategy
ESG migration assistant
Create an endpoint security group by using the GUI
Apply a contract to an endpoint security group by using the GUI
ESG and contract configuration in the REST API
Tags and selectors in the REST API
Configure route leaking for an internal bridge domain subnet by using the GUI
Route leaking for internal bridge domain subnets in the REST API
Configure route leaking for external prefixes by using the GUI
Route leaking for external prefixes in the REST API
Configure route leaking for internal prefixes by using the GUI
Apply Layer 4 to Layer 7 services to an endpoint security group by using the GUI
Layer 4 to Layer 7 services for endpoint security groups using the REST API

Security Policies

Contracts in the ACI fabric security policy model
Security policy enforcement
Multicast EPG security
Taboo contracts
ACL contract permit and deny logs
Enable ACL contract permit or deny logging by using the GUI
Enable ACL contract permit logging by using the NX-OS-style CLI
Enable ACL contract permit and deny logging by using the REST API
Enable taboo contract deny logging by using the GUI
Enable taboo contract deny logging by using the NX-OS-style CLI
Enable taboo contract deny logging by using the REST API
View ACL permit and deny logs by using the GUI
View ACL permit and deny logs by using the NX-OS-style CLI
View ACL permit and deny logs by using the REST API
Configure SSH host key sizes by using the GUI

Data Plane Policing

Data plane policing
Guidelines and limitations for data plane policing
Configure data plane policing for a Layer 2 interface by using the GUI
Configure data plane policing for a Layer 3 interface by using the GUI
Configuring Data Plane Policing Using the REST API
Configure data plane policing by using the NX-OS-style CLI
Data plane policing at the endpoint group level

HTTPS Access

Custom certificates for HTTPS access
Guidelines and limitations for custom certificates
SSL cipher configuration
Configure a custom certificate for Cisco ACI HTTPS access by using the GUI
Configure default SSL protocols and Diffie-Hellman key exchange by using the GUI
Enable certificate-based authentication by using the NX-OS-style CLI
SSL ciphers and TLS protocol support

Additional ACI Security Features

Additional Security Features
Restricting Infra VLAN Traffic
Turning Off Generated Session Log Files in APIC

Cisco APIC Security Configuration Guide, Release 6.2(x)

Security Policies

Updated: April 17, 2026

Explains the Cisco ACI contract-based security model and provides guidance for configuring traffic filters, policy enforcement, taboos, and ACL permit and deny logging.

This chapter contains the following sections:

Contracts in the ACI fabric security policy model

Contracts define the traffic that can pass between endpoint groups (EPGs) in the Cisco Application Centric Infrastructure (ACI) fabric.

Security policy enforcement

Leaf switches enforce security policies by identifying the source and destination endpoint groups (EPGs) of traffic that enters the fabric.

Multicast EPG security

Multicast security policies control which endpoint groups (EPGs) can send traffic to or receive traffic from a multicast group.

Taboo contracts

Taboo contracts deny specific traffic that another contract would otherwise permit between endpoint groups (EPGs).

ACL contract permit and deny logs

Access control list (ACL) contract logs record traffic that contract rules permit or deny in the Cisco Application Centric Infrastructure (ACI) fabric.

Enable ACL contract permit or deny logging by using the GUI

Enables access control list (ACL) logging for flows and packets that a contract subject permits or denies.

Enable ACL contract permit logging by using the NX-OS-style CLI

Enables access control list (ACL) logging for packets and flows that contract permit rules allow.

Enable ACL contract permit and deny logging by using the REST API

Enables access control list (ACL) logging for contract subjects that contain permit or deny actions.

Enable taboo contract deny logging by using the GUI

Enables access control list (ACL) logging for packets and flows that a taboo contract denies.

Enable taboo contract deny logging by using the NX-OS-style CLI

Enables access control list (ACL) logging for packets and flows that taboo contract rules deny.

Enable taboo contract deny logging by using the REST API

Enables access control list (ACL) logging for traffic that a taboo contract denies.

View ACL permit and deny logs by using the GUI

Displays access control list (ACL) logs for permitted and denied network traffic.

View ACL permit and deny logs by using the NX-OS-style CLI

Displays access control list (ACL) permit and deny logs for Layer 2 and Layer 3 packets and flows.

View ACL permit and deny logs by using the REST API

Retrieves access control list (ACL) permit and deny log entries by querying the applicable managed object class.

Configure SSH host key sizes by using the GUI

Configures one or more Secure Shell (SSH) host key algorithms and key sizes for console access.

Need help?

Open a support case

(Requires a Cisco Service Contract)

Bias-free language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.