This topic discusses the architecture of the Dynamic Attributes Connector.

You can collect these tags and attributes using Docker containers running on an Ubuntu, CentOS, or Red Hat Enterprise Linux virtual machine. Install the Dynamic Attributes Connector on the Ubuntu host using an Ansible collection.

The following figure shows how the system functions at a high level.

• Install the dynamic attributes connector on a supported Linux virtual machine.

  For more information, see Supported operating systems and third-party software.

• The system supports certain public cloud providers.

  This topic discusses supported connectors (which are the connections to those providers).

• The adapter defined by the dynamic attributes connector receives those dynamic attributes filters as dynamic objects and enables you to use them in access control rules.

  You can create the following types of adapters:

  • ASA adapter used only by the Cisco APIC connector.

  • On-Prem Firewall Management Center for an on-premises Management Center device.

    This type of Management Center device might be managed by Security Cloud Control or it might be a standalone.

  • Cloud-Delivered Firewall Management Center for devices managed by Security Cloud Control.

The dynamic attributes connector enables you to send Cisco APIC dynamic endpoint group (EPG) and endpoint security group (ESG) data from Cisco APIC tenants to . The following figure shows how this works at a high level.

Cisco APIC defines endpoint groups (EPGs) and endpoint security groups (ESGs) that have network object groups. Create a connector in the dynamic attributes connector that pulls that data from Cisco APIC tenants to ASA on which you can use those objects in access control rules. An ASA adapter pushes network object groups in the configured security context.

(You have the option to specify the tenants from which retrieve EPG and ESG objects when you set up the ASA adapter in the dynamic attributes connector. The Cisco APIC user determines which tenants data can be pulled from.)

You can optionally create an empty network object in the ASA CLI under which to create additional network objects sent from Cisco APIC. For more information, see Access Control Lists.

Note	ASDM does not support creating empty network objects at this time.

Sample configuration

The following sample configuration shows how network object groups are named in ASA based on names in APIC and the APIC connector (not shown).

Network object group names are a concatenation of (in order):

• Cisco ACI Endpoint Update App Site Prefix value

  Cisco APIC tenant name); in this example, CSDAC.

• Cisco APIC application profile name (in this example, AP1)

• Cisco APIC EPG name (in this example, EPG1 through EPG4)

Assuming the connector's Site Prefix is DOCS and the Cisco APIC tenant name the CSDAC user has rights to is CSDAC, network object groups on ASA are named as follows (in ASDM, Configuration > Firewall > Objects > Network Objects/Groups):