300-630 Sample Questions Answers

Enabling ARP flooding is necessary when VMs are migrated from a pre-existing network to Cisco ACI and their gateways remain in the legacy setup. This allows the ACI fabric to learn about silent hosts that do not initiate communication, ensuring that the migrated VMs can communicate with all hosts in the network, including those that are silent.

For a new Cisco ACI Multi-Site Orchestrator (MSO) node to join an MSO cluster and ensure IP connectivity, it requires connectivity to the Cisco Application Policy Infrastructure Controllers (APICs) over the Out-of-Band (OOB) management network and the management IP of ESXi hosts where the controllers are deployed. The OOB management network allows the MSO node to communicate with the APICs for centralized management and policy control, while the management IP of the ESXi hosts provides the necessary connectivity for the virtual machine infrastructure where the MSO node is deployed123.

References := Cisco ACI Multi-Site Architecture White Paper, Cisco Multi-Site Deployment Guide for ACI Fabrics, ACI Multi-Site Architecture and Deployment - Cisco.

To ensure the Cisco ACI fabric adheres to strict security protocols and only learns endpoints from configured subnets on a bridge domain, the “Enforce Subnet Check” feature must be enabled. This feature restricts endpoint learning to IP addresses belonging to the subnets defined in the bridge domain associated with the endpoint’s VLAN, enhancing security by preventing learning of endpoints from unconfigured subnets. References: Implementing Cisco Application Centric Infrastructure Official Cert Guide

To support an application that is sensitive to latency and jitter, it is crucial to ensure that the Quality of Service (QoS) levels within the ACI fabric and the Inter-Pod Network (IPN) QoS policies are aligned. This alignment will help in maintaining consistent handling of the DSCP values set by the application (AF31 and CS6) as the packets traverse across the two ACI pods. By aligning the QoS levels and policies, the application’s packets are less likely to experience delays or drops, thus preserving the required performance levels for the application’s optimal functionality.

 For new nodes in a Cisco ACI Multi-Pod environment to be discoverable by existing APICs, DHCP relay needs to be enabled on the IPN devices’ links connected to the ACI spines. This allows the new nodes to obtain an IP address and be recognized by the APICs for integration into the fabric.

References := Implementing Cisco Application Centric Infrastructure Official Cert Guide

Removing pre-existing Fibre Channel over Ethernet (FCoE) configurations from Nexus devices is necessary to ensure compatibility with Cisco ACI mode. FCoE configurations are not supported in ACI mode, and their presence can hinder the migration process2.

The protocol used for exchanging MAC/IP address information for endpoints between spine switches in different pods within a Cisco Multi-Pod solution is MP-BGPEVPN (Multiprotocol BGP Ethernet VPN). This protocol facilitates scalable communication between separate locations by allowing MAC/IP address information sharing across pods. References := ( Implementing Cisco Application Centric Infrastructure Official Cert Guide )

 In Cisco ACI, the spines suppress STP BPDUs to prevent them from being forwarded to other pods. This behavior ensures that the ACI fabric operates efficiently without relying on STP for loop prevention.

References := Cisco APIC Layer 2 Networking Configuration Guide, Release 5.2(x)

Using an application-centric approach in Cisco ACI means that multiple VLANs and/or multiple EPGs can be grouped under one bridge domain. This approach aligns network constructs with application requirements, enabling more efficient and flexible network configurations.

References := Network Centric to ACI Centric Migration - Cisco

In a Cisco ACI Multi-Pod design, having separate Layer 3 Out (L3Out) connections for each pod is recommended when implementing active-standby firewalls in different pods. This setup allows for independent routing and failover mechanisms, ensuring that each pod can maintain external connectivity even if one firewall fails.

References := Implementing Cisco Application Centric Infrastructure Official Cert Guide

 In a Cisco ACI Multi-Site setup, the source leaf is responsible for flooding BUM (Broadcast, Unicast, and Multicast) traffic to the specific multicast group or GIPo (Group IP Overlay). This process involves the ingress replication function on the spine nodes of the source site to replicate BUM traffic to all remote sites where the bridge domain is stretched12.

References := Cisco ACI Multi-Site Architecture White Paper, ACI Multi-Site Data Plane Communication - DCLessons

 Deploying a new Cisco ACI Multi-Pod setup involves configuring the TEP pool of the new pod to be routable across the IPN (B) and increasing the interface MTU on all IPN routers to support VXLAN traffic (D). Configuring anycast RP (A) and MP-BGP on IPN routers © are not specific actions for deploying a Multi-Pod setup. Connecting all spines to the IPN (E) is not a required action for deployment3. References := (ACI Multi-Pod White Paper

 For a full mesh Cisco ACI Multi-Site architecture, configuring the BGP-EVPN Router-ID on each spine is essential. This configuration ensures unique identification and proper routing of traffic within the overlay network1

To implement the vPC (Virtual Port Channel) in the Cisco ACI fabric, one should select a common vPC interface policy group (Option A), select common interface profiles (Option C), and select common switch profiles (Option E). These steps ensure that both switches in a vPC domain are configured with consistent policies and profiles for interfaces and switches. This consistency is crucial for the proper functioning of a vPC setup where two or more links that are physically connected to two different Cisco ACI leaf switches appear as a single “logical” port channel to a third device, like the depicted WebServer.

To allow only the return traffic to be redirected to the service node when the load balancer does not perform source NAT, we need to configure a Policy-Based Redirect (PBR). Here’s how it can be achieved:

Create a Contract:

Create a contract linked to the common/default filter. This contract will define the communication rules between the client endpoint and the server endpoint.

Configure L4-L7 Device:

Create an L4-L7 device with the function type set to “GoThrough.” This device will be used to redirect traffic to the service node.

Create a Policy-Based Redirect Policy:

Set up a Policy-Based Redirect (PBR) policy.

Specify the L3 Destination as the load balancer’s inside IP/MAC address.

Ensure that the L4-L7 Policy-Based Redirect Policy has the “GoThrough” function type.

Create a Service Graph Template:

Define a service graph template that references the previously created contract and L4-L7 device.

Apply the service graph template to the relevant connectors.

Connector Configuration:

On the consumer connector, reference the L4-L7 Policy-Based Redirect Policy.

On the provider connector, also reference the L4-L7 Policy-Based Redirect Policy.

By following this configuration, only the return traffic (from the server to the client) will be redirected to the service node, ensuring proper load balancing and traffic management.

References:

Implementing Cisco Application Centric Infrastructure Official Cert Guide

 The output shows details of tunnel 6 within a Cisco ACI fabric. The transport protocol is listed as “isvlan,” which is typically associated with the GRE protocol in Cisco ACIterminology. GRE, a tunneling protocol developed by Cisco, encapsulates various network layer protocols inside virtual point-to-point links over an IP internetwork. References: Implementing Cisco Application Centric Infrastructure Official Cert Guide

Table Description automatically generated

To prevent MAC flapping on Cisco UCS Fabric Interconnects and ACI leaf switches, MAC Pinning should be selected for the VMM vSwitch Port Channel policy. This ensures consistent uplink usage for each virtual machine’s traffic, avoiding MAC address movement across multiple uplinks.

References := Implementing Cisco Application Centric Infrastructure Official Cert Guide

 In an Active-Active Across Pods deployment mode, traffic is intelligently redirected to the firewall that currently owns the connection state, allowing for efficient use of network resources. Additionally, the connection state being unsynchronized means that each pod can independently manage its connections without relying on a centralized state, enhancing the resilience and scalability of the network1.

References := (Implementing Cisco Application Centric Infrastructure Official Cert Guide)

Before associating a schema with a newly configured site in Cisco ACI Multi-Site Orchestrator, it’s essential to configure a provider. This establishes a communication link between the orchestrator and the sites, enabling proper deployment and management of objects across multiple sites.

To create an exit point from all the tenants using the common tenant after removing RT-2 and RT-3 devices, the following two configuration tasks must be completed:

Update L3Out ExtEPG Subnet: The L3Out ExtEPG subnet in the common tenant should be updated with the flag “Shared Route Control Subnet” and “Aggregate Shared Routes” (Option C). This configuration allows for the sharing of routes between different tenants through a common exit point.

Mark Subnets and Attach Contract: All subnets should be marked with the flag “Shared between VRFs,” and contract Ctr-3 should be attached as a provider to all the EPGs (Option D). This ensures that all EPGs can provide services under contract Ctr-3 across different VRFs, facilitating inter-tenant communication via shared routes. References := (Implementing Cisco Application Centric Infrastructure Official Cert Guide)

Enabling GARP EP Move Detection allows the Cisco ACI fabric to dynamically update the IP address to use the MAC address of NIC2 when NIC1 goes offline. This feature is crucial for maintaining network connectivity and ensuring that traffic continues to flow seamlessly through the standby interface1.

The control plane TEP (Tunnel Endpoint) IP address is a unique IP address assigned to each spine node within a Cisco ACI fabric. This IP address is used to establish MP-BGP EVPN (Multiprotocol Border Gateway Protocol Ethernet VPN) and VPNv4 (VPN version 4) adjacencies with the spine nodes in remote sites when configuring Cisco ACI Multi-Site. The control plane TEP IP enables the spine nodes to exchange routing information and network reachability for seamless integration of multiple sites into a single ACI fabric. References := Implementing Cisco Application Centric Infrastructure Official Cert Guide

To allow reachability to services outside of the Cisco ACI fabric while conserving TCAM resources, an engineer should use a contract insertion method where L30ut external EPGsact as providers and vzAny inside VRF acts as consumers. This configuration allows for communication from all EPGs within a VRF (represented by vzAny) to access external services through L30ut without having to create individual contracts for each service EPG, thus saving TCAM resources. References: Implementing Cisco Application Centric Infrastructure Official Cert Guide

To redirect HTTP traffic between an EPG client and EPG server through a Cisco ASA firewall in a Cisco ACI environment, a contract filter must be configured to allow both ARP and HTTP. ARP is essential for IP to MAC address resolution, which is necessary for layer 2 communications within the same subnet or across subnets when routing is involved. The HTTP filter ensures that only HTTP traffic is redirected to the firewall for inspection or policy enforcement. References: Implementing Cisco Application Centric Infrastructure Official Cert Guide

When a packet is routed between two endpoints on different Cisco ACI leaf switches, the VXLAN VNID applied to the packet is the VRF (Virtual Routing and Forwarding) VNID. This VNID enables forwarding of the packet through tenant virtual routing and forwarding domains within the fabric34.

References := Cisco APIC Layer 3 Networking Configuration Guide, Release 3.x and later

 In Cisco ACI fabric, STP BPDUs are flooded in the bridge domain VLAN. This allows the BPDUs to be propagated throughout the fabric, maintaining the STP topology2.

References := Implementing Cisco Application Centric Infrastructure Official Cert Guide

 In a Cisco ACI Multi-Site setup, it’s important to configure the ISN interfaces to handle the encapsulation overhead introduced by the multi-site architecture. Option C is typically the correct choice because it includes:

A subinterface with a specific VLAN ID for traffic segregation.

An increased MTU size to accommodate the extra bytes added by encapsulation.

The correct VRF for inter-site communication.

OSPF configuration for dynamic routing between sites.

References: = Implementing Cisco Application Centric Infrastructure Official Cert Guide

The VXLAN source port adds entropy to the overlay packet forwarding by using a hash of the inner packet’s Layer 2, Layer 3, and Layer 4 headers. This entropy enables Equal-Cost Multi-Path (ECMP) routing, allowing for multiple parallel paths in the network, which increases bandwidth and redundancy2.

References := VXLAN Traffic Forwarding | VXLAN Packet Flow

Configuring Protocol Independent Multicast (PIM) anycast RP allows for efficient multicast traffic routing between pods by having multiple Rendezvous Points (RPs) share the same IP address. A maximum multicast range of /15 provides sufficient address space to support the scale of multicast traffic typically required in such deployments. References := (Implementing Cisco Application Centric Infrastructure Official Cert Guide)

 Anycast services in a Cisco ACI fabric allow services like firewalls to be stretched across multiple pods, providing high availability and resiliency. The correct setups for implementing anycast services include configuring the firewalls behind an EPG subnet ©and deploying a Layer 4 to Layer 7 service graph with Policy-Based Routing (PBR) (E). Modifying the ACI contract scope (A) or the MAC address on the second firewall (B) are not related to anycast service implementation. Deselecting No Default SVI Gateway under EPG Subnet (D) is not a setup for anycast services1. References := (Cisco APIC Online Help - About Anycast Services2)

 To allow communication between two application profiles that are configured in the same tenant but different VRFs, the contract scope must be set to ‘tenant.’ This is because the contract scope defines the level at which the contract is enforced. A ‘tenant’ scope means the contract applies to all application profiles within the same tenant, regardless of the VRFs they are in. This allows for the necessary route-leaking between the provider and consumer VRFs to enable communication between the application profiles.