Distributed Services and Stateful Firewall (AMD Pensando DPU)
The CX 10000's differentiator is stateful, distributed services enforced on the DPU at each switch. Candidates must understand what "stateful" buys you: connection tracking so return traffic is permitted automatically, plus policy that can match on L3/L4 (and often L7 context) rather than stateless ACL tuples. Services include distributed firewall, NAT, and encryption, all applied close to the workload.
Understand how traffic is steered to the DPU: policy is authored centrally (a fabric/policy manager) and pushed to switches, where classification and redirection send selected flows through the DPU. Know that state is maintained per enforcement point, and that asymmetric routing across switches can break stateful inspection - a classic exam trap.
Traps to watch:
- Assuming stateless ACLs and stateful firewall policy behave the same for return traffic.
- Forgetting that stateful inspection requires symmetric flow paths; asymmetric routing across leaves causes drops.
- Believing the DPU enforces policy for all traffic regardless of steering configuration.
- Confusing NAT directionality and where translation occurs.
Rule of thumb: stateful policy is only as reliable as flow symmetry. Worked example: a client on leaf-1 talks to a server on leaf-2; if return traffic is routed back through leaf-3, leaf-2's DPU sees only one direction and drops the flow. Fix with consistent routing/anycast design so both directions traverse the same enforcement point, then verify with flow/session tables on the DPU. Always ask: does the same DPU see both directions?
Also review how policy is centrally managed and how to validate enforcement with telemetry.