Cisco APIC Security Configuration Guide, Release 6.2(x)

PDF

Cisco APIC Security Configuration Guide, Release 6.2(x)

RADIUS authentication

Updated: April 17, 2026

Want to summarize with AI?

Log in

Explains a networking protocol that provides centralized authentication, authorization, and accounting management for network users.

RADIUS authentication is a networking protocol that

  • provides centralized authentication, authorization, and accounting (AAA) management for users who connect and use a network service,

  • requires configuration of user attributes using the cisco-av-pair attribute on RADIUS servers by the APIC administrator, and

  • assigns network-operator as the default user role.

Configuration requirements

To configure users on RADIUS servers, the APIC administrator must configure the required attributes (shell:domains) using the cisco-av-pair attribute.

The SNMPv3 authentication protocol options are SHA and MD5. The privacy protocol options are AES-128 and DES. If these options are not specified in the cisco-av-pair attribute, MD5 and DES are the default authentication protocols.

SNMPv3 configuration examples

SNMPv3 authentication and privacy protocol attributes can be specified as follows:

snmpv3:auth=SHA priv=AES-128

Similarly, the list of domains would be as follows:

shell:domains="domainA domainB …"

Configure APIC for RADIUS access

Configure APIC for RADIUS access to enable centralized authentication and authorization for user access to the APIC.

This configuration allows the APIC to authenticate users against a RADIUS server, providing centralized user management and enhanced security for the ACI fabric.

Before you begin

  • The ACI fabric is installed, Application Policy Infrastructure Controllers (APICs) are online, and the APIC cluster is formed and healthy.

  • The RADIUS server host name or IP address, port, authorization protocol, and key are available.

  • The APIC management endpoint group is available.

Procedure

  1. In the APIC, create the RADIUS provider.

    For configuring a RADIUS provider, see Create a provider.

    For toggling in-band or out-of-band management in the APIC GUI:

    In the Navigation pane, choose System > System Settings > APIC Connectivity Preferences. In the Work Pane select either inband or ooband.

  2. Create the Login Domain for RADIUS.

    For the detailed procedure, see Create login domain using the GUI.

The APIC is now configured for RADIUS access with the necessary provider and login domain created.

What to do next

This completes the APIC RADIUS configuration steps. Next, configure the RADIUS server.

Configure RADIUS in APIC using REST API

Configure RADIUS authentication in APIC to enable centralized user authentication and authorization through external RADIUS servers.

Use this configuration when you need to integrate APIC with external RADIUS servers for user authentication instead of using local user accounts.

Procedure

  1. Configure the RADIUS provider using HTTP POST.

    Example:

    
HTTP POST to https://{{apichost}}/api/node/mo/.xml
<aaaRadiusProvider authPort="1812" authProtocol="pap" descr="myradius"   
    monitorServer="disabled" 
    name="server.radius.local" key="mykey"
    retries="1" timeout="5"/>

  2. Configure a login domain for RADIUS using HTTP POST.

    Example:

    
HTTP POST to https://{{apichost}}/api/node/mo/.xml
<aaaUserEp  descr="" dn="uni/userext"  name=""  pwdStrengthCheck="yes" rn="" status="modified">
    <aaaLoginDomain descr="" name="RadDom" rn="logindomain-RadDom" status="created">
        <aaaDomainAuth name="" providerGroup="RadDom" realm="radius" rn="domainauth"  status="created"/>
    </aaaLoginDomain>
    <aaaRadiusEp descr="" name="" retries="1" rn="radiusext" status="modified" timeout="5">
        <aaaRadiusProviderGroup descr=""  name="RadDom"  rn="radiusprovidergroup-RadDom"  status="created">
            <aaaProviderRef descr="acs" name="radius1.server.com" order="1"   
                rn="providerref-radius.server.com" status="created" />
            <aaaProviderRef descr="acs" name="radius2.server.com" order="2"   
                rn="providerref-radius2.server.com" status="created" />
        </aaaRadiusProviderGroup>
    </aaaRadiusEp>
</aaaUserEp>

The RADIUS provider and login domain are configured in APIC, enabling RADIUS-based authentication for user logins.