Skip to main content

Cisco ACI

Cisco Application Centric Infrastructure (ACI) is a software-defined networking solution that provides centralized automation and policy-driven application profiles for data center environments. This integration enables visibility into your ACI fabric topology, tenants, networking constructs (VRFs, Bridge Domains), application profiles, endpoint groups, and discovered endpoints with their IP and MAC addresses.

Installation​

Prerequisites in Cisco ACI​

The JupiterOne Cisco ACI integration requires read-only access to the APIC (Application Policy Infrastructure Controller) REST API. You will need to create a local user account with appropriate permissions.

Creating a Local User Account​

  1. Log in to the APIC GUI with administrator credentials.

  2. Navigate to Admin > AAA > Users.

  3. Select the Local Users tab.

  4. Click Create Local User and configure the following:

    • Login ID: A unique username for the integration (e.g., jupiterone-readonly)
    • Password: A strong password meeting APIC requirements (minimum 8 characters, including at least three character types: lowercase, uppercase, digits, or symbols)

  5. In the Security section:

    • Security Domain: Select all to allow access to all tenants, or select specific tenant domains if you want to limit the integration's scope

  6. In the Roles section, assign the following role:

    • Role: read-all
    • Privilege Type: Read
    info

    The read-all role with Read privilege provides read-only access to tenant configurations, fabric topology, and endpoint information without the ability to modify any settings.

  7. Click Submit to create the user.

Network Requirements​

  • The JupiterOne integration must be able to reach the APIC controller over HTTPS (port 443)
  • If using a self-signed certificate on the APIC, you may need to configure TLS verification settings accordingly
  • For on-premises deployments, ensure the JupiterOne Collector has network access to the APIC URL

Configuration in JupiterOne​

To install the Cisco ACI integration in JupiterOne, navigate to the Integrations tab and select Cisco ACI. Click New Instance to begin configuring your integration.

Authentication Settings​

  • APIC URL: The URL of your Cisco ACI APIC controller (e.g., https://apic.example.com). This should be the management IP or hostname of your primary APIC.

  • Username: The username of the read-only APIC user created for JupiterOne.

  • Password: The password for the APIC user.

General Settings​

  • Account Name: Used to identify the Cisco ACI account in JupiterOne. Ingested entities will have this value stored in tag.AccountName when the Account Name toggle is enabled.

  • Description: Optional description to help identify the integration instance.

  • Polling Interval: Select the frequency for data synchronization. You may leave this as DISABLED and manually execute the integration.

Data Sources​

The integration provides granular control over what data is ingested. You can enable or disable specific ingestion sources:

Data SourceDescriptionEntities Created
Fabric & ControllersACI fabric topology and APIC controllerscisco_aci_fabric, cisco_aci_controller
TenantsACI tenants (logical containers for policies)cisco_aci_tenant
NetworkingVRFs (Virtual Routing and Forwarding contexts) and Bridge Domainscisco_aci_vrf, cisco_aci_bridge_domain
ApplicationsApplication Profiles and Endpoint Groups (EPGs)cisco_aci_application_profile, cisco_aci_epg
EndpointsDiscovered client endpoints with IP/MAC addresses and DNS recordscisco_aci_endpoint, cisco_aci_dns_record

Click Create once all values are provided to finalize the integration.

Using a JupiterOne Collector​

For on-premises Cisco ACI deployments that are not accessible from the internet, you can use a JupiterOne Collector to run the integration within your network:

  1. Deploy a JupiterOne Collector in your network with access to the APIC controller
  2. When configuring the integration instance, select the appropriate Collector
  3. The Collector will execute the integration locally and securely upload data to JupiterOne

Next Steps​

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue to our Instance management guide to learn more about working with and editing integration instances.

Additional Resources​