https://www.cisco.com/c/en/us/support/docs/cloud-systems-management/application-policy-infrastructure-controller-apic/221867-configure-in-band-management-in-aci.html Scope - Choose according to the route leakage method you use. Here choose to use L3out, and then click Advertised Externally.

https://www.cisco.com/c/en/us/td/docs/dcn/aci/apic/5x/security-configuration/cisco-apic-security-configuration-guide-release-52x/protocol-authentication-52x.html

To meet the requirements for the new endpoint group’s bridge domain in the Cisco ACI fabric, the following actions must be taken:

Disable ARP Flooding : This action prevents ARP requests from being broadcast across the entire bridge domain, which reduces excessive broadcast traffic.

Enable Limit IP Learning to Subnet : This setting restricts IP address learning to only those IPs within the configured subnet, minimizing the impact of misconfigured virtual machines.

Enable Unicast Routing on the bridge domain and configure a subnet : Enabling unicast routing allows the bridge domain to function as the default gateway for the subnet, ensuring that routing remains within the Cisco ACI fabric.

To meet the requirements for the new e-commerce software deployed on the Cisco ACI fabric, the scope of the contracts should be set to “Application Profile”. This scope ensures that the contracts are applied within the same Application Network Profile (ANP), allowing the e-commerce software to communicate only with software Endpoint Groups (EPGs) that are part of the same ANP. It also prevents communication with applications in different ANPs, thus maintaining the necessary isolation and reducing the overall number of contracts by reusing existing ones within a VRF.

References  :=

Cisco ACI Contracts and Scopes Documentation

Cisco ACI Best Practices Guide

To set Layer 2 loop migration in an ACI Fabric with a Layer 2 Out configured,  MCP (Misconfiguration Protocol) must be enabled  on the ACI fabric 5 6 .  MCP helps to prevent Layer 2 loops by detecting misconfigurations that could potentially cause loops 5 6 .

To clear the fault raised by the Cisco APIC when the EPG must accept endpoints from a VMM domain, the EPG should be associated with the VMM domain. This association is necessary for the APIC to recognize the endpoints within the VMM domain as part of the EPG.  Without this association, the APIC cannot apply the policies defined in the EPG to the endpoints, which can result in errors 1 .

References  :=

APIC Policy Deployment and Resolution Immediacy For AVS VMM Domain - Cisco Community

To extend the EPG-100 to the vCenter as a port group with a tagged VLAN ID of 100, the following actions should be taken:

Define a static VLAN range (from 100-200) under a VLAN pool : This step involves creating a VLAN pool that includes the desired VLAN range.  The VLAN pool is then associated with the VMM domain that corresponds to the vCenter integration 1 .

Associate the dc1vcdev domain with EPG : The VMM domain named ‘dc1vcdev’ should be associated with the EPG-100.  This association allows for the automatic creation of port groups in vCenter when the EPG is associated with a VMM domain 1 .

Select the appropriate settings for the domain association :

Untagged VLAN Access : This should be unselected because the VLAN ID needs to be tagged.

VLAN Mode : Set to ‘Static’ to specify the encapsulation VLAN ID.

Encap : Set to ‘100’ to define the specific VLAN ID that should be tagged for the port group 1 .

References  :=

Cisco APIC Layer 2 Networking Configuration Guide 1

Cisco APIC Layer 2 Networking Configuration Guide 1

To deploy an access port policy group within Cisco ACI, an  attachable entity profile (AEP)  needs to be created.  An AEP is a policy construct that groups together various domains and allows them to be attached to the fabric access layer