300-620 DCACI: Implementing Cisco Application Centric InfrastructureDemo

An SNMP Monitoring Destination Group can contain multiple SNMP trap receivers, providing redundant notification destinations. An SNMP source associates that destination group with the monitoring policy so that SNMP trap notifications are generated and sent when monitored events occur. Community and client-group policies instead control SNMP monitoring access and do not by themselves configure trap notification delivery.

In Cisco ACI hardware-proxy mode, Layer 2 unknown-unicast frames are sent to the spine-proxy anycast VTEP instead of being flooded. The spine proxy drops a frame when it cannot locate the destination MAC address in its proxy database.

Cisco ACI pre-provision resolution immediacy downloads VMM policies to the applicable leaf switches regardless of CDP/LLDP neighborship, including before a hypervisor host connects to the VMM switch.

Cisco ACI uses the physical pod’s external TEP pool to allocate routable addresses for communication with remote locations. Cisco specifies that this pool must be a subnet routable across the network connecting the physical pod and remote leaf location.

BPDU Guard is enabled in the STP interface policy. The STP interface policy must be attached to the access policy group, and that access policy group must be applied to the physical interface. With BPDU Guard enabled, receipt of a BPDU causes the port to be error-disabled.

An EPG is extended outside the ACI fabric by creating a static path binding that assigns a VLAN ID to a leaf port in that EPG. Traffic received on that port with the configured VLAN is classified into the EPG and is subject to its policy.

For traffic entering Cisco ACI from an L3Out, remote endpoint learning does not create a new remote endpoint from either the packet’s source MAC address or its source IP address. Existing remote-endpoint retention may be refreshed, but no new source MAC or IP remote endpoint is learned.

The L2VPN EVPN address family carries EVPN MAC/IP Advertisement routes, which convey endpoint MAC and IP reachability. In an ACI Multi-Pod fabric, the spine-to-spine MP-BGP EVPN peering between pods uses the L2VPN EVPN address family.

A tenant quota configured with Fail Transaction Action rejects an attempted creation that exceeds the maximum object count and returns a quota-exceeded error. Raise Fault Action instead creates the object and records a fault. Tenant quota policies are configured under Fabric > Fabric Policies.

Cisco APIC configuration exports can use SCP as the remote-file transfer protocol; SCP provides encrypted transfer over SSH. A recurring scheduler is required to run the backup regularly. The maximum-concurrent-nodes setting controls how many export policies may run at a scheduled time, not whether backups recur.

Cisco ACI removes secure properties such as passwords from exported configuration files unless global AES encryption is enabled. Enabling global AES encryption ensures those secure properties are included in backups. When importing a file without secure properties, merge mode preserves the fabric’s existing secure properties; replace mode can remove them. Cisco ACI Configuration Files: Import and Export

When unicast routing is enabled and a subnet is configured on a Cisco ACI bridge domain, the fabric supplies the default-gateway function. To use the firewall as the gateway instead, the bridge domain must operate as Layer 2 only with unicast routing disabled, and 10.10.10.254/24 must be configured on the firewall. Cisco also recommends leaving unicast routing disabled when endpoints use a gateway other than the bridge-domain SVI.

On Demand resolution immediacy pushes VMM EPG policies, including contracts, to a leaf only when an ESXi host is attached to the distributed virtual switch and a VM is placed in the EPG. LLDP neighborship is required, and policies are removed if that LLDP/CDP neighborship is lost. Deployment immediacy only controls when downloaded policy is programmed into the leaf hardware CAM.

Pod ID Aware Redirection enables location-aware policy-based redirection, programming preferred redirect destinations in the relevant pods. This keeps flows directed through the appropriate firewall service nodes and preserves symmetric traffic forwarding.

An AAEP is the interface-policy attachment that provides the VLAN-pool scope to physical infrastructure and associates the relevant domain with the interface policy group. Attaching AAEP_2 makes the VPC interface policy group use the domain and VLAN-pool context required for VLAN 20.

Pre-provision resolution immediacy downloads EPG policy to Cisco ACI leaf switches regardless of CDP/LLDP neighborship, including when no hypervisor host is connected to the VMM switch. Immediate and On Demand depend on host-to-leaf discovery information.

BGP selects the path with the highest local preference. Assigning local preference 200 to the default route received through GiDNS_CPN_L3Out makes the R1 path preferred over the firewall path. Adding 10.0.0.0/8 to the route-control map on FWE_GiDNS_L3out permits advertising the summarized private address space toward the firewall, enabling it to forward that traffic to R1. Cisco ACI route-control profiles apply route-map policy to routes advertised into and out of an L3Out, and their action rules support setting BGP preference.

Enabling ARP flooding floods ARP requests throughout the bridge domain. A silent host that has moved can receive the ARP request at its new location and respond, enabling the fabric to update its endpoint location instead of continuing to send ARP only toward the stale location until the endpoint ages out.

For a rising ACI threshold, the Set value triggers the fault and the Reset value clears it; the Reset value cannot be greater than the Set value. With Critical set at 500 and Warning set at 400, a critical reset value of 410 clears the critical severity once the statistic falls below 410 while retaining the warning threshold range.

Selecting Ignore Fault squelches the fault, preventing faults with that code from appearing in fault reports or dashboards. APIC automatically creates the related fault severity assignment (squelch) policy.

OSPF is the traditional underlay routing protocol used to establish routing adjacency between Cisco ACI physical spine switches and the Inter-Pod Network (IPN) in a Multi-Pod deployment. Later APIC releases added eBGP as an alternative, but OSPF is the expected protocol for this certification-context requirement.

A Cisco ACI external bridged network is a Layer 2 Outside (L2Out) connection. It must be associated with the relevant physical connectivity through a static path binding, which deploys the external Layer 2 network on a port, port channel, or vPC path.

Cisco ACI APIC provisions the VMM domain in VMware vCenter as a VMware vSphere Distributed Switch (VDS), which is then used for host connections and port groups.

Cisco ACI advertises only subnets marked Advertised Externally to routers through an L3Out; Private to VRF subnets remain internal to the fabric. Therefore, 192.168.11.0/24 and 192.168.21.0/24 are advertised, while 192.168.31.0/24 is kept private. Configuring 0.0.0.0/0 as External Subnets for the External EPG classifies WAN addresses as external endpoints, enabling contract-based access only from the permitted internal EPGs in vrf_prod. Shared Route Control Subnet is intended for route leaking between VRFs and is unnecessary for this design.