Skip to main content

Cisco ACI

Cisco Application Centric Infrastructure (ACI) is a software-defined networking solution that provides centralized automation and policy-driven application profiles for data center environments. This integration enables visibility into your ACI fabric topology, tenants, networking constructs (VRFs, Bridge Domains), application profiles, endpoint groups, and discovered endpoints with their IP and MAC addresses.

"## Installation\n\n### Prerequisites in Cisco ACI\n\nThe JupiterOne Cisco ACI integration requires read-only access to the APIC (Application Policy Infrastructure Controller) REST API. You will need to create a local user account with appropriate permissions.\n\n#### Creating a Local User Account\n\n1. Log in to the APIC GUI with administrator credentials.\n\n2. Navigate to Admin > AAA > Users.\n\n3. Select the Local Users tab.\n\n4. Click Create Local User and configure the following:\n - Login ID: A unique username for the integration (e.g., jupiterone-readonly)\n - Password: A strong password meeting APIC requirements (minimum 8 characters, including at least three character types: lowercase, uppercase, digits, or symbols)\n\n5. In the Security section:\n - Security Domain: Select all to allow access to all tenants, or select specific tenant domains if you want to limit the integration's scope\n\n6. In the Roles section, assign the following role:\n - Role: read-all\n - Privilege Type: Read\n\n :::info\n The read-all role with Read privilege provides read-only access to tenant configurations, fabric topology, and endpoint information without the ability to modify any settings.\n :::\n\n7. Click Submit to create the user.\n\n#### Network Requirements\n\n- The JupiterOne integration must be able to reach the APIC controller over HTTPS (port 443)\n- If using a self-signed certificate on the APIC, ensure your JupiterOne Collector is deployed in an environment that trusts the APIC's certificate\n- For on-premises deployments, ensure the JupiterOne Collector has network access to the APIC URL\n\n### Configuration in JupiterOne\n\nTo install the Cisco ACI integration in JupiterOne, navigate to the Integrations tab and select Cisco ACI. Click New Instance to begin configuring your integration.\n\n#### Authentication Settings\n\n- APIC URL: The URL of your Cisco ACI APIC controller (e.g., https://apic.example.com). This should be the management IP or hostname of your primary APIC.\n\n- Username: The username of the read-only APIC user created for JupiterOne.\n\n- Password: The password for the APIC user.\n\n#### General Settings\n\n- Account Name: Used to identify the Cisco ACI account in JupiterOne. Ingested entities will have this value stored in tag.AccountName when the Account Name toggle is enabled.\n\n- Description: Optional description to help identify the integration instance.\n\n- Polling Interval: Select the frequency for data synchronization. You may leave this as DISABLED and manually execute the integration.\n\n#### Data Sources\n\nThe integration provides granular control over what data is ingested. You can enable or disable specific ingestion sources:\n\n| Data Source | Description | Entities Created |\n|-------------|-------------|------------------|\n| Fabric & Controllers | ACI fabric topology, APIC controllers, and network switches | cisco_aci_fabric, cisco_aci_controller, cisco_aci_switch |\n| Tenants | ACI tenants (logical containers for policies) | cisco_aci_tenant |\n| Networking | VRFs (Virtual Routing and Forwarding contexts) and Bridge Domains | cisco_aci_vrf, cisco_aci_bridge_domain |\n| Applications | Application Profiles and Endpoint Groups (EPGs) | cisco_aci_application_profile, cisco_aci_epg |\n| Endpoints | Discovered client endpoints with IP/MAC addresses and DNS records | cisco_aci_endpoint, cisco_aci_dns_record |\n| L4-L7 Devices | Firewall service devices attached to ACI tenants | cisco_aci_firewall |\n\nClick Create once all values are provided to finalize the integration.\n\n### Using a JupiterOne Collector\n\nFor on-premises Cisco ACI deployments that are not accessible from the internet, you can use a JupiterOne Collector to run the integration within your network:\n\n1. Deploy a JupiterOne Collector in your network with access to the APIC controller\n2. When configuring the integration instance, select the appropriate Collector\n3. The Collector will execute the integration locally and securely upload data to JupiterOne\n\n### Next Steps\n\nNow that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue to our Instance management guide to learn more about working with and editing integration instances.\n\n### Additional Resources\n\n- Cisco APIC Basic Configuration Guide - User Access and Authentication\n- Cisco APIC REST API Configuration Guide\n"