Privilege Level to Scan Cisco APIC

A role is a collection of privileges for reading or writing classes of managed objects (MOs).  For an object class, some roles may have read-only, read-write, or no access privileges.

 The Admin role has read access to all classes and write access to all configurable classes.

The minimum privilege level of the user role can be set to read-all.

Configuring a User with a Security Domain and Adding Custom Roles and Privileges

To configure a user with a security domain, and adding custom roles and privileges. perform the following steps.

1. Navigate to User management
   1. Login to Cisco APIC 
   2. Go to Admin tab > AAA (Authentication, Authorization, and Accounting) menu
   3. Click Users in the left navigation pane. Ensure you have selected the Local Users tab in the work pane.
      
      
2. Create a New Local User
   1. Click the Actions icon drop-down list in the work pane and then click Create Local User.
      
      
      The Create Local User window opens.
   2. Enter the user ID in the Login ID field and the password in the Password field.
      
      
   3. Click Next to navigate to the Security domain.
3. Assign Security Domains
   1. Select the all checkbox under Security Domain, and then click Next to navigate to the Roles domain.
      
      
   2. Click Next.
4. 
   4a) Assign Roles and Privileges
   1. Click add symbol in Domain all.
   2. Click Role Name drop-down list to select read-all and configure the Role Privilege Type as Read.
      
      
   3. Click Update
   4b) For Cisco APIC 5.x and later
          You must also perform the following: 
   • Select AAA, from Role Name
   • Set Privilege Type to Read

   This is required as, from APIC version 5.x onwards, certain authentication and authorization objects are segregated into the AAA role.
   
   

   4c) For assessing controls 27973 and 31036
          You need to perform the following:
   • Select admin from Role Name
   • Set Privilege Type to Read

    The admin role is a high-privilege role. If you are not assessing controls 27973 and 31036, you do not need to grant this role. If you grant the admin role, you do not need to assign the read-all role or the AAA role described in sections 4a and 4b, because the admin role already includes both.

   
5. Verify if your scan account was created successfully with the necessary privileges. 
   
   Login to APIC controller and run the following command to verify whether your scan account has the required privileges to perform a complete assessment.
   
   show username <username> detail
   For example:
   
   
   
   If you are granted the admin role in step 4c
   
   

Create an Authentication Record for Cisco APIC

To create an authentication record for Cisco APIC:

1. Go to Authentication > New > Network and Security > Cisco_APIC
   
   
2. Enter the Authentication Type as Basic, Username .
3. Enter a Password.
4. Click Create.