Cisco APIC Security Configuration Guide, Release 6.2(x)

PDF

Cisco APIC Security Configuration Guide, Release 6.2(x)

Remote users

Updated: April 17, 2026

Want to summarize with AI?

Log in

Describes users who authenticate through external authentication providers instead of local user configuration.

A remote user is an authentication method that

  • enables the APIC to point at centralized enterprise credential datacenters instead of configuring local users,

  • supports multiple protocols including Lightweight Directory Access Protocol (LDAP), active directory, RADIUS, and TACACS+, and

  • provides server monitoring capabilities starting with the 3.1(1) release to determine whether AAA servers are alive.

Remote user authentication requirements

To configure a remote user authenticated through an external authentication provider, you must meet these prerequisites:

  • The DNS configuration should have already been resolved with the hostname of the RADIUS server.

  • You must configure the management subnet.

Note

When an APIC is in minority (disconnected from the cluster), remote logins can fail because the ACI is a distributed system and the user information is distributed across APICS. Local logins, however, continue to work because they are local to the APIC.

Server monitoring can be configured through RADIUS, TACACS+, LDAP, and RSA to determine whether the respective AAA servers are alive. Server monitoring feature uses the respective protocol login to check for server aliveness. For example, a LDAP server will use LDAP login and a RADIUS server will use RADIUS login with server monitoring to determine server aliveness.

Remote user configuration using the NX-OS style CLI

A remote user configuration is a centralized authentication mechanism that

  • points the APIC at the centralized enterprise credential datacenter instead of configuring local users

  • supports Lightweight Directory Access Protocol (LDAP), active directory, RADIUS, and TACACS+ authentication protocols, and

  • requires specific prerequisites to be met before configuration.

Prerequisites for remote user configuration

To configure a remote user authenticated through an external authentication provider, you must meet these prerequisites:

  • The DNS configuration should have already been resolved with the hostname of the RADIUS server.

  • You must configure the management subnet.

Change the default behavior for remote users with missing or bad Cisco AV pairs

This task configures how the system handles remote users with authentication issues by assigning default roles instead of denying access completely.

Remote users may occasionally have missing or malformed Cisco AV pairs that prevent proper authentication. By default, these users are denied login access. You can modify this behavior to provide minimal access instead.

Procedure

  1. On the menu bar, choose Admin > Authentication > AAA > Policy tab.

  2. From the Remote user login policy drop-down list, choose Assign Default Role.

    The default value is No Login. The Assign Default Role option assigns the minimal read-only privileges to users that have missing or bad Cisco AV Pairs. Bad AV Pairs are those AV Pairs that fail the parsing rules.

Remote users with missing or bad Cisco AV pairs will now be assigned the default role with minimal read-only privileges instead of being denied login access.