350-601: Implementing and Operating Cisco Data Center Core TechnologiesDemo

During a Cisco Nexus 7000 in-service software upgrade, configuration settings and network connections must not be changed. Changes to network settings during the upgrade can cause it to become disruptive.

Before a Cisco UCS firmware upgrade, create both Full State and All Configuration backups so that the system state and configuration can be recovered if needed. Ensure that the fabric interconnect bootflash has at least 10% available space for the upgrade files. Smart Call Home is disabled rather than enabled during upgrades to prevent unnecessary alerts, and firmware conformance is validated after the upgrade.

DCNM absolute value thresholds apply directly to the gathered traffic statistics and compare them, as a percentage of total link capacity, with the configured utilization threshold. Baseline thresholds use a calculated historical average rather than the directly collected value.

Cisco APIC represents managed-object properties such as name and dn inside an attributes object. Creating and configuring the physDomP object with its infraRsVlanNs VLAN-pool relationship is performed by sending the JSON payload with an HTTP POST request. Cisco DevNet: Getting Started—Physical Domain Configuration

With the secure-MAC maximum already reached, a new source MAC causes a MAC-count violation. The protect violation action drops traffic from the violating newly learned MAC address and stops further address learning, while traffic from the existing secure MAC addresses continues to be forwarded. Cisco Nexus 9000 supports protect, restrict, and shutdown as port-security violation actions.

Strict Unicast RPF mode on Cisco NX-OS is enabled per interface with the command "ip verify unicast source reachable-via rx", which verifies that the source address of an incoming packet is reachable via the same interface (rx) on which the packet arrived, per the FIB entry. This differs from loose mode, which uses "reachable-via any" and only checks that the source is reachable via any interface. Configuring the Ethernet1/1 interface with the IP address and the "ip verify unicast source reachable-via rx" statement therefore implements strict uRPF for IPv4 traffic on that interface, as described in the Cisco Nexus 9000 Series NX-OS Security Configuration Guide's section on Configuring Unicast RPF.

The application_profile_dn attribute must contain the distinguished name of the parent application profile. Terraform exposes that DN as the application-profile resource’s id; the resource’s Terraform label is test_ap, so the correct reference is aci_application_profile.test_ap.id.

A system-configuration backup includes system settings such as usernames and roles. SCP transfers that backup to the external server using Secure Shell, providing authenticated and encrypted transport.

Cisco ACI uses contracts to govern communication between an internal EPG and an external EPG. The external EPG classifies the external network associated with an L3Out and is the policy construct to which contracts are attached, enabling controlled connectivity from internal endpoint groups.

JSON represents objects with curly braces, arrays with square brackets, and fields as quoted key-value pairs separated by colons.

CHAP is a challenge-response authentication protocol that uses MD5 hashing, and aaa authentication login chap enable enables it on Cisco MDS. radius distribute enables RADIUS configuration distribution through Cisco Fabric Services, while radius commit commits the distributed configuration to the running configuration on the participating switches.

A vPC peer link configured on port-channel100 requires its physical member interfaces to be bundled into that port channel. Ethernet1/1 and Ethernet1/2 are configured only as trunk ports, so they must be added to vPC peer-link port-channel 100 to form the peer link.

A full-state backup is a binary snapshot of the entire Cisco UCS system and is the backup type used to restore or rebuild the configuration on a fabric interconnect. All, system, and logical configuration backups are configuration exports for import operations, not system restoration.

Cisco NX-OS RBAC supports user-defined roles with rules that grant only the necessary permissions, and those roles can be assigned to user accounts. The predefined network-admin role provides complete device-wide read-write access, while network-operator and vdc-operator are read-only predefined roles that cannot be modified. A custom role with the necessary FCoE/VLAN privileges therefore preserves restricted access while enabling the required configuration.

Guest Shell requires a DNS nameserver in /etc/resolv.conf to resolve the package repository hostname. chvrf management runs pip through the management VRF, providing the network path needed to download and install the Python package.

In Cisco UCS Manager, Preserve Identities is available for All Configuration and System Configuration backups and can be selected for Logical Configuration backups. A Full State backup is a binary disaster-recovery snapshot and does not include the Preserve Identities feature.

aaa authentication login console fallback error local configures the console login method to fall back to local authentication when remote AAA servers are unreachable because of an authentication error. Cisco documents separate fallback settings for default and console login methods.

On Cisco Fibre Channel interfaces, switchport mode sd sets the port to SPAN destination (SD) mode, allowing it to serve as the destination interface for SPAN traffic monitoring.

A maintenance policy defines how disruptive service-profile changes are deployed. For a server firmware upgrade, its reboot setting controls whether the server reboots immediately, after user acknowledgment, or at a scheduled time.

A host firmware policy applies its firmware settings to all service profiles that reference it. Cisco documents that changing firmware versions in a firmware package applies the new versions to all affected service profiles; therefore, changing the global-default host firmware policy affects every service profile that uses it.

A VMM domain in Read Only Mode allows Cisco APIC to discover and view the existing VMware vCenter VDS inventory without managing it. Cisco documents that a read-only VMM domain is not managed by APIC, which prevents APIC from changing the vCenter-created port-group configuration.