ACI Fabric Management
Domain 3 tests the day-2 side of ACI: who can log in and what they can touch, how controllers and switches are upgraded, how configuration is protected and restored, and how the fabric reports health.
AAA and RBAC
Authentication can be local, TACACS+, RADIUS, or LDAP; accounting is available on TACACS+ and RADIUS. Keep the local fallback administrator enabled, otherwise a failed AAA server locks everyone out. Authorization is two-dimensional: a security domain defines object scope (all, a tenant, or a single object) and a role defines the privilege level inside it. Assigning a full role with a tenant-scoped domain produces a tenant administrator and nothing more; fabric policy work requires the "all" domain.
Firmware
Upgrades need a maintenance group of nodes and a maintenance policy controlling scheduling and validation. Controllers are upgraded first, one at a time so the cluster keeps quorum; switches follow by group. NTP must be healthy before you start - a skewed controller cluster causes failures.
Backup and restore
A configuration export policy writes a backup to a remote server (SCP, SFTP, FTP, TFTP) or APIC-local storage, one time or on a schedule, optionally encrypted with a passphrase. Restore uses an import policy and overwrites configuration, so confirm you are importing into the intended fabric.
Monitoring
Health scores are computed per object from fault state; fault severity runs critical, major, minor, warning, info, cleared. Audit logs record configuration changes by user, event logs record system events. On top of that come SNMP polling and traps, syslog, Call Home, SPAN/ERSPAN, and atomic counters that show where drops occur. Out-of-band access uses the mgmt tenant's oob EPG; in-band uses the inb EPG.
Worked example
A contractor needs to manage only tenant Payments. Create a security domain scoped to that tenant, create the user, and assign a full role inside that domain. Reasoning: the domain, not the role, bounds what is visible; the same role in the "all" domain would let the contractor change fabric policies. Test by logging in and confirming fabric-level menus are unavailable.
Traps
- Disabling local fallback and then losing AAA connectivity.
- Granting a role with domain "all" when tenant scope was requested.
- Scheduling an upgrade without a maintenance group.
- Treating a low health score as a fault object rather than a derived metric.