CCNP Data Center cheat sheet

vPC peer-link must be a port channel with at least two member links; it carries CFSoE control traffic plus flooded data, and both peers must be configured with the same vPC domain ID.

vPC peer-keepalive runs out-of-band in the management VRF or a dedicated link on UDP 3200; if the peer-link fails, vPC member ports are suspended on the secondary peer.

vPC member ports must match on both peers: same port-channel ID, allowed VLAN list, MTU, speed and LACP mode; any mismatch keeps the port in a suspended state.

VXLAN adds 50 bytes of overhead (outer Ethernet 14 + outer IP 20 + UDP 8 + VXLAN 8) and uses UDP destination port 4789; underlay MTU must be raised to carry 1500-byte inner frames.

The VNI is 24 bits, giving usable values 1 through 16,777,214; each VTEP maps a local VLAN to a VNI and learns remote MAC-to-VTEP bindings.

BGP EVPN route types: type 2 = MAC/IP advertisement (host reachability, ARP/ND suppression), type 3 = inclusive multicast (BUM replication), type 5 = IP prefix (L3VNI).

Fabric Extender ports are not locally switched; a FEX forwards all host traffic to its parent, and a vPC FEX configuration requires the same FEX ID on both parent switches.

HSRPv2 uses multicast 224.0.0.102 and HSRPv1 uses 224.0.0.2, both over UDP 1985, with default hello 3 s and hold 10 s.

OTV transports Layer 2 frames between edge devices inside IP GRE tunnels and runs IS-IS as the overlay control plane over the same tunnel; the join interface sources the unicast replication.

UCS Manager runs on a pair of fabric interconnects in active/standby roles; both FIs must be the same model and are connected to each other as a cluster.

A service profile contains vNICs, vHBAs, boot policy, BIOS policy, firmware policy, scrubbing policy, and identity taken from MAC, WWN, UUID and IQN pools.

WWN pools are split into an A pool and a B pool; each vHBA draws its WWPN from the pool it was created with, so a profile keeps identity after a blade swap.

The UCS 5108 chassis holds eight half-width blades, two IOM slots, four power supplies and eight fan modules; IOMs uplink to the FIs over 10/40G fabric ports.

FI ports must be explicitly typed: server, uplink Ethernet, uplink Fibre Channel, FCoE uplink, FC storage, appliance, monitoring, or unconfigured.

Fabric failover on a vNIC moves traffic to the peer fabric interconnect when the primary path fails; enable it on vNICs that must survive an FI or uplink failure.

LAN pin groups and SAN pin groups restrict which uplinks a vNIC or vHBA may use; without a pin group the FI selects uplinks from the VLAN or VSAN membership.

Infrastructure firmware (FI, IOM, adapter) is updated per UCS domain, while host firmware packages are applied through the host firmware policy referenced by the service profile.

Once ports are configured as server ports, the FI automatically discovers chassis IOMs and adapters; no manual per-blade configuration is required.

FC port types: N (host), F (fabric-facing to host), FL (fabric loop), E (ISL), TE (trunking ISL), NP (NPV uplink), TF (NPV host port), SD (SPAN destination).

The FC ID is 24 bits: 8-bit domain ID, 8-bit area, 8-bit port; domain IDs range 1-239 and must be unique within the fabric.

FLOGI assigns the 24-bit FC ID to an N port; FDISC registers additional FC IDs for NPV/NPIV without performing a new fabric login.

NPIV lets a single F port register up to 255 FC IDs; an NPV switch takes no domain ID and runs no fabric services, proxying logins to the core switch.

A VSAN is an independent fabric instance; an interface joins with 'switchport mode F' plus 'switchport trunk allowed vsan X' or VSAN database membership.

Zone sets must be activated ('zoneset activate name X vsan Y') before they take effect; hard zoning enforces access by FC ID in hardware, soft zoning filters in the name server.

Default zone policy 'permit' allows unzoned devices to communicate; configure 'no zone default-zone permit vsan X' to block them.

FCoE data frames use Ethertype 0x8906 and FIP uses 0x8914; the FCoE MAC is FC-MAP (default 0x0EFC00) plus the 24-bit FC ID, and PFC/ETS must be enabled for lossless service.

SAN port channels are built from E or TE ports; TE (trunking) ISLs carry multiple VSANs, while E ports carry a single VSAN.

NX-API is enabled with 'feature nxapi' and listens on HTTP 80 and HTTPS 443; the ins_api payload supports cli_show, cli_conf and cli_ascii message types with JSON or XML output.

NX-API accepts multiple commands in one request, and setting chunk to '1' splits large responses into smaller messages.

POAP: a switch with an empty startup configuration boots, receives an address and script location by DHCP, then downloads and applies image and configuration from TFTP or HTTP.

APIC REST base path is https:///api/; authenticate with aaaLogin to obtain a token carried in the APIC-Cookie, then address objects by distinguished names such as uni/tn-TENANT/ap-APP/epg-EPG.

Ansible nxos_command, nxos_config and nxos_facts use the httpapi connection plugin for NX-API or the network_cli plugin for SSH.

Model-driven telemetry subscriptions define YANG sensor paths, encoding (GPB or JSON) and sample interval; data is streamed to a collector over gRPC in a dial-out model.

NETCONF runs over SSH on port 830; the Python library ncclient issues RPCs such as get-config and edit-config against YANG models.

DCNM exposes REST endpoints under /rest/ for fabric discovery, configuration deployment and image management, returning JSON or XML responses.

TACACS+ uses TCP 49, encrypts the full packet body, and supports per-command authorization through AV pairs; RADIUS uses UDP 1812/1813 and encrypts only the password.

NX-OS AAA order: define 'aaa group server', add 'server ', then apply 'aaa authentication login default group X'; the local database is used only if configured as fallback.

Built-in NX-OS roles are network-admin, network-operator, vdc-admin, vdc-operator and san-admin; custom roles combine read or read-write rules per feature.

Port security limits learned MAC addresses per interface; violation modes are protect (drop), restrict (drop plus log/SNMP) and shutdown (err-disable the port).

DHCP snooping builds the binding table of MAC, IP, VLAN and port; Dynamic ARP Inspection validates ARP against it, and IP Source Guard uses it to filter traffic.

CoPP attaches a policy-map to the control plane, classifying and rate-limiting traffic punted to the supervisor so a flood cannot exhaust CPU resources.

MACsec (IEEE 802.1AE) encrypts each link hop at line rate; MACsec Key Agreement derives session keys from a pre-shared connectivity association key.

In ACI, EPGs exchange traffic only through contracts whose filters permit specific protocols and ports; shared objects such as filters can live in the common tenant.