Skip to main content

Cisco ACI

Cisco Application Centric Infrastructure (ACI) is a software-defined networking solution that provides centralized automation and policy-driven application profiles for data center environments. This integration enables visibility into your ACI fabric topology, tenants, networking constructs (VRFs, Bridge Domains), application profiles, endpoint groups, and discovered endpoints with their IP and MAC addresses.

Installation​

Prerequisites in Cisco ACI​

The JupiterOne Cisco ACI integration requires read-only access to the APIC (Application Policy Infrastructure Controller) REST API. You will need to create a local user account with the appropriate role.

Creating a Local User Account​

  1. Log in to the APIC GUI with administrator credentials.

  2. Navigate to Admin > AAA > Users.

  3. Select the Local Users tab.

  4. Click Create Local User and configure the following:

    • Login ID: A unique username for the integration (for example, jupiterone-readonly).
    • Password: A strong password meeting APIC requirements (minimum 8 characters, including at least three character types: lowercase, uppercase, digits, or symbols).

  5. In the Security section:

    • Security Domain: Select all to allow access to every tenant, or select specific tenant domains to limit the integration's scope.

  6. In the Roles section, assign the following role:

    • Role: read-all
    • Privilege Type: Read
    note

    The read-all role with the Read privilege provides read-only access to tenant configurations, fabric topology, and endpoint information without the ability to modify any settings.

  7. Click Submit to create the user.

Network Requirements​

  • The JupiterOne integration must be able to reach the APIC controller over HTTPS (port 443).
  • If the APIC uses a self-signed certificate, ensure your JupiterOne Collector is deployed in an environment that trusts the APIC's certificate.
  • For on-premises deployments, ensure the JupiterOne Collector has network access to the APIC URL.

Configuration in JupiterOne​

To install the Cisco ACI integration in JupiterOne, navigate to the Integrations tab and select Cisco ACI. Click New Instance to begin configuring your integration.

Authentication Settings​

  • APIC URL: The URL of your Cisco ACI APIC controller (for example, https://apic.example.com). This should be the management IP or hostname of your primary APIC.

  • Username: The username of the read-only APIC user created for JupiterOne.

  • Password: The password for the APIC user.

General Settings​

  • Account Name: Used to identify the Cisco ACI account in JupiterOne. Ingested entities will have this value stored in tag.AccountName when the Account Name toggle is enabled.

  • Description: Optional description to help identify the integration instance.

  • Polling Interval: Select the frequency for data synchronization. You may leave this set to DISABLED and run the integration manually.

Data Sources​

The integration provides granular control over what data is ingested. You can enable or disable specific ingestion sources:

Data SourceDescriptionEntities Created
Fabric & ControllersACI fabric topology, APIC controllers, and network switchescisco_aci_fabric, cisco_aci_controller, cisco_aci_switch
TenantsACI tenants (logical containers for policies) and the L4-L7 firewall service devices attached to themcisco_aci_tenant, cisco_aci_firewall
NetworkingVRFs (Virtual Routing and Forwarding contexts) and Bridge Domainscisco_aci_vrf, cisco_aci_bridge_domain
ApplicationsApplication Profiles and Endpoint Groups (EPGs)cisco_aci_application_profile, cisco_aci_epg
EndpointsDiscovered client endpoints with IP and MAC addresses, and DNS recordscisco_aci_endpoint, cisco_aci_dns_record

Click Create once all values are provided to finalize the integration.

Using a JupiterOne Collector​

For on-premises Cisco ACI deployments that are not accessible from the internet, you can use a JupiterOne Collector to run the integration within your network:

  1. Deploy a JupiterOne Collector in your network with access to the APIC controller.
  2. When configuring the integration instance, select the appropriate Collector.
  3. The Collector will execute the integration locally and securely upload the data to JupiterOne.

Next Steps​

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue to our Instance management guide to learn more about working with and editing integration instances.

Additional Resources​