The table that holds IP address, MAC address, and VXLAN/VLAN information on a Cisco ACI leaf is the  endpoint table 6 . This table is essential for the ACI fabric’s ability to track and apply policies to endpoints.

 When two interface protocol policies need to be used together in a single policy, the ACI object that must be used is an interface policy group

 The statement about the MTU value of MP-BGP EVPN control plane packets in Cisco ACI that is true for communication between spine nodes in different sites is that by default, spine nodes generate  9000-bytes packets  to exchange endpoints routing information.  As a result, the Inter-Site network should be able to carry  9000-bytes packets 2 .  This ensures that the control plane traffic, which is not VXLAN encapsulated, can be properly handled across the sites 2 .

The characteristic of Cisco ACI Multi-Pod that makes it unsuitable for deploying three separate data centers is that it requires all pods to share the same Cisco APIC cluster. In a Multi-Pod deployment, all the pods are part of the same fabric and are managed by a single APIC cluster, which means that they are not completely isolated from each other.

 To redirect traffic to the firewall using a one-armed policy-based redirect service insertion, the following configuration set should be used:

Configure a service graph : This involves defining the service graph template that represents the logical flow of traffic through network services.

Associate the service graph with All_Traffic_Allowed : By associating the service graph with the contract named All_Traffic_Allowed, traffic that matches the contract will be redirected through the service graph to the firewall device.

References  :=

Cisco ACI Fabric Administration Guide, Release 4.2(1)

Cisco ACI Virtualization Guide, Release 4.2(1)

 To limit management access to the Cisco ACI fabric that originates from a single subnet where the NOC operates, the policy should be configured  in the management tenant  on the Cisco APIC 5 .

https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/ apic/sw/1-x/Operating_ACI/guide/b_Cisco_Operating_ACI/b_Cisco_Operating_ACI_chapter _0111.html

In Cisco ACI fabric, MP-BGP (Multi-Protocol Border Gateway Protocol) is utilized for several purposes, one of which includes the propagation of L3Out (Layer 3 Out) routes within the fabric.  Specifically, MP-BGP with VPNv4 address family (AF) is used in the ACI infra VRF (overlay-1 VRF) to distribute external routes from a border leaf to other leaf switches 1 . This allows for the efficient dissemination of routing information and ensures that all relevant leaf switches are aware of the routes necessary to reach external networks.

References  :=

ACI Fabric L3Out White Paper - Cisco 1

Configuring ACI Fabric BGP Route Reflectors - Cisco 2

ACI Fabric - Underlying protocols - Cisco Community 3

Cisco Application Centric Infrastructure Fundamentals, Release 5.3(x) 4

To complete the task of configuring a Layer 3 connection to the WAN router and allowing hosts in the production VRF to access WAN subnets, the engineer should configure the Export Route Control Subnet scope for the external EPG. This setting allows the subnets associated with the external EPG to be advertised to external routers, enabling connectivity to the WAN.

 In Cisco ACI, a contract is used to define the communication policy between EPGs (Endpoint Groups). It specifies which types of traffic are allowed to pass between EPGs and can include filters for protocols, ports, and other attributes.  In the context of the logical system design, the contract would be the object that completes the communication requirements as indicated by the dotted line in the exhibit 1 2 .

References  :=

Cisco Application Centric Infrastructure (ACI) Design Guide 1

Cisco ACI Policy Model Guide 2

To support the addition of new ESXi hosts to the existing VMM domain, the action that should be taken is to map the leaf interface selector to the AEP that is associated with the VMM domain (Option D). This ensures that the correct policies are applied to the interfaces where the new ESXi hosts are connected.