700-702 Sample Questions Answers

Cisco ACI permits tenant users to modify the parameters and configuration of the ACI fabric that they own and control. They can also read statistics and monitor faults and events for the entities (managed objects) that apply to them, such as endpoints, EPGs, and application profiles. Tenant users can perform configuration changes and read fault and event logs from the parts of the ACI fabric to which they have access.

The ACI switch operating system includes a role-based access control (RBAC) feature that allows highly specific access for a given role. This RBAC feature scales to a maximum of 64 unique roles and 256 rules per role. The ACI APIs retrieve data directly from the object store. A core APIC internal data access control system provides multitenant isolation and prevents information privacy from being compromised across tenants. Read and write restrictions prevent any tenant from seeing any other tenant's configuration, statistics, faults, or event data. Unless the administrator assigns permissions to do so, tenants are restricted from reading fabric configuration, policies, statistics, faults, and events.

The APIC implements a two-level solution for access control:

• Traditional role-based control: This control level defines the types of objects that a user is authorized to access. Users are assigned roles (collections of privileges) that govern read-only or read-write access to managed objects in the system. All managed object classes have one or more privileges that are assigned to them.

• Domain-based control. This control level defines the domains in which a user is authorized to access objects.

​Reference: http://www.cisco.com/c/en/us/solutions/collateral/data-center-virtualization/application-centric-infrastructure/white-paper-c07-732033.html ​

Endpoint and Network Event APIs

The following APIs are called when an endpoint or a network configuration changes for endpoint groups (EPGs) that are associated with the graph:

def attachEndpoint( device, configuration, endpoints )

def detachEndpoint( device, configuration, endpoints )

def attachNetwork( device, configuration, networks)

def detachNetwork( device, configuration, networks )

These APIs are called only if the device specification supports an endpoint or network attach notification and you have enabled a notification on the function connector. The AttachEndpoint and DetachEndpoint events are called when an endpoint within an EPG attaches or detaches. The network APIs are called when you modify the subnet configuration under the bridge domain or EPG. These APIs provide information to enable the automation of any service function configuration that should be modified on an endpoint or network configuration change. An example would be if you dynamically add and remove a server from a pool that is attached to a load balancer or dynamically update a subnet within an access list defined for a firewall. The device specification file can define an empty function that returns success in the return format that is required by the APIC. It is not mandatory to support endpoint or network event handling functionality.

Under a normal migration, when a VM moves due to vMotion onto a leaf that does not have those EPGs and VLANs programmed, the will be deployed immediately. vCenter/ESXI host will send a GARP to ACI, the old leaf will bounce traffic to the new location of the endpoint and traffic/learning will occur. The bounce entry will stick around for a bit (about 5 minutes) and then be removed. The EPGs, VLANs, and Default Gateway will be deployed as soon as the move is detected and there will be little to no downtime (i usually see 0-1 ping loss, most of the time just increased latency)

https://supportforums.cisco.com/discussion/12394516/importance-your-management-network-aci-world