In a Cisco ACI fabric, Spanning Tree Protocol (STP) Bridge Protocol Data Units (BPDUs) that are generated by an external switch, such as Switch2 in this scenario, are indeed forwarded across the fabric. This allows externally connected switches to maintain a loop-free topology.  While Cisco ACI does not participate in STP as it uses its own protocols and mechanisms for loop prevention within the fabric, it will forward STP BPDUs across End Point Groups (EPGs) on which they are received 1 . This ensures that the connected external switches can still use STP for their loop prevention mechanisms.

References  :=

Cisco Community Discussion on STP BPDUs in ACI 1

To minimize possible traffic impact during the upgrade of an ACI fabric with 3 APIC controllers and servers dual-homed to pairs of leaf switches configured in VPC mode, the fabric should be upgraded following  Option A 2 .  This option involves creating two maintenance groups for the APIC controllers, upgrading one group at a time, and then proceeding with the leaf switches 2 .  This staged approach helps ensure that not all paths are affected simultaneously, thereby reducing the potential for traffic disruption 2 .

 In the Cisco ACI Active-Active Across Pods deployment mode, one of the key characteristics of Policy-Based Redirect (PBR) is that traffic is dynamically redirected to the firewall that owns the connection. This allows for load distribution across multiple Layer 4 to Layer 7 devices, also known as symmetric PBR.  Additionally, deployment in this mode occurs in go-to mode only, which means that traffic is explicitly directed to a service node or firewall for processing

 A bridge domain in Cisco ACI represents a  Layer 2 forwarding construct 3 4 5 . It defines a unique Layer 2 MAC address space and can include one or more subnets.  Bridge domains are associated with a VRF and can contain multiple EPGs 3 4 5 .

 To resolve the VRF route leaking issue and ensure that the route in the Non-Production:vrf-nonprod VRF to the production tenant is present, the action that should be taken is to enable the “Shared between VRFs” option for the bridge domain (BD) subnet in the production VRF.  This setting allows the subnet to be shared across different VRFs within the same tenant or across tenants, enabling communication between EPGs that are in different VRFs 1 .

References  :=

ACI Inter VRF/Tenant Route Leaking Configuration Example

To configure a Cisco ACI system to detect network loops for both untagged and tagged traffic and to stop the loop by disabling an interface within 4 seconds, the following configuration must be used:

Enable Mis-Cabling Protocol (MCP) : MCP detects loops from external sources and will err-disable the interface on which Cisco ACI receives its own packet.  This is crucial for preventing loops in the network 1 .

Configure MCP Transmit Frequency : Set the MCP transmit frequency to a value that allows for quick loop detection. The Cisco ACI fabric provides faster loop detection with transmit frequencies from 100 milliseconds to 300 seconds.  To meet the requirement of detecting and stopping a loop within 4 seconds, you would set the transmit frequency to a value less than 4 seconds 2 .

Set Action on Loop Detection : Configure the MCP policies to identify loops and decide how to act upon them.  You can set the policy to generate a syslog message or disable the port upon loop detection 2 .

Implement Error Disabled Recovery Policy : Configure an error disabled recovery policy to automatically re-enable ports that were disabled due to loop detection after a configurable interval 2 .

By implementing these configurations, the Cisco ACI system will be able to detect and stop network loops quickly and efficiently, ensuring network stability and preventing potential disruptions.

References  :=

Cisco APIC Online Help - Loop Detection 2

Cisco ACI Best Practices Quick Summary

The unique identifier of an ACI object is represented by the  universal resource identifier (URI) 2 .

To determine which user is responsible for the disappearance of a previously existing port group from vCenter, the engineer should check the EPG audit logs for any ‘deletion’ actions.  By comparing the affected object and the user who performed the action, the engineer can identify the responsible individual 2 .

The setting that prevents the learning of Endpoint IP addresses whose subnet does not match the bridge domain subnet is the  “Limit IP learning to subnet”  setting within the bridge domain 1 .  This setting ensures that only IP addresses belonging to the subnets configured on the bridge domain are learned, preventing mis-learning of IP addresses that may not belong to the fabric 1 .