Cisco DCID 300-610 cheat sheet

Cisco Nexus VPC (virtual PortChannel) lets two switches present one logical PortChannel to downstream devices; peer-link carries control traffic and must be a PortChannel of at least two 10G/40G/100G links, and the peer-keepalive runs over a separate L3 path (mgmt or dedicated).

VXLAN encapsulation adds 50 bytes (8 outer UDP/IPv4 header + 8 VXLAN + 14 inner MAC + 4 original FCS treated as overhead); with a 1500-byte payload the underlay MTU must be at least 1550, and Nexus defaults to 9216 jumbo on fabric links.

VXLAN VNI is 24 bits (up to ~16.7 million segments); VTEP addresses are loopback interfaces advertised into the underlay IGP (OSPF/IS-IS) or BGP; BGP EVPN uses route types: Type 2 (MAC/IP), Type 3 (Inclusive Multicast), Type 5 (IP Prefix).

Spanning tree: Rapid PVST+ per VLAN is default on Nexus; MST allows mapping multiple VLANs to one instance; for a two-tier vPC design, STP is only relevant for orphan ports and single-attached devices, and the vPC peer must be the STP root for all vPC VLANs.

Cisco ACI uses a spine-leaf topology with APIC cluster (3 or 5 controllers for HA); fabric discovery uses LLDP and DHCP; endpoint groups (EPGs) are policy containers and contracts define permitted traffic between EPGs (provider/consumer with filters).

Underlay routing options: OSPF (area 0 on all fabric links, passive on loopbacks), IS-IS (common for large fabrics), or eBGP (each leaf/spine pair uses unique ASN, typically with allowas-in or AS-path manipulation); overlay is typically iBGP EVPN with route reflectors or full mesh.

Oversubscription ratio = total downlink bandwidth / total uplink bandwidth; common access-layer designs are 3:1 to 1:1 for compute, and 1:1 for storage or spine links; leaf-spine is preferred over three-tier for east-west traffic because every leaf is exactly one hop from every other leaf.

Cisco Nexus Dashboard (formerly DCNM) provides fabric controller/insights; NX-OS supports ISSU on dual-supervisor and vPC for in-service upgrades; vPC consistency check requires matching type-1 parameters (STP mode, MTU, vPC domain ID) across peers.

Cisco UCS Manager manages a UCS domain (up to 160 blades per domain in current 6454/6536 fabric interconnect generations; earlier 6248/6296 limited to 20 chassis); the fabric interconnect pair forms an active/active cluster with one VIP; all configuration is service-profile driven.

UCS service profiles reference: server pool (or explicit blade), BIOS policy, boot policy, local disk policy, vNIC/vHBA templates, LAN/SAN connectivity policies, and firmware policy; the server pool + UUID + MAC/WWPN pools make a profile hardware-independent for stateless computing.

UCS B-series uses fabric extenders (FEX/IOM) in each chassis; the IOM connects to both fabric interconnects, providing HA; C-series rack servers connect via fabric interconnect ports or Nexus, and UCS Manager supports them in the same domain in newer releases.

Cisco Intersight is the cloud-managed successor to UCS Manager; it supports policy-based configuration, firmware management, and HCL checks; Intersight Managed Mode (IMM) replaces UCSM on supported platforms (e.g., 6400/6500 series FI, X-series).

BIOS/UEFI boot order precedence: local disk, SAN boot (FC/iSCSI), PXE, virtual media, and CIMC-mounted ISO; a boot policy must match the SAN LUN's WWPN zoning and LUN ID; SAN boot requires consistent LUN 0 mapping or explicit boot LUN setting.

Hypervisor design: VMware ESXi requires management, vMotion, and storage VMkernel ports; vMotion on 1G is insufficient for large VMs, so 10G/25G is standard; NIOC or vSphere Network I/O Control can reserve bandwidth for vMotion and storage traffic.

Power and cooling: compute rack density is often measured in kW per rack; a typical blade chassis (e.g., 5108) draws up to ~5-6 kW fully populated; design must respect per-rack power budget, PDU redundancy (A/B feeds), and cooling airflow (hot aisle/cold aisle).

Cisco UCS firmware bundles: infrastructure bundle (FI, IOM, CIMC) and server bundle (BIOS, adapter, storage controller); firmware policies can be applied at service-profile or domain level, and Auto Install enables automatic firmware sync on discovery.

FC SAN topologies: single-fabric (no redundancy), dual-fabric (A/B, each host has two HBAs, one per fabric - the standard for production), and full mesh; a host must never have both HBAs in the same fabric for redundancy; NPV/NPIV reduce domain count and simplify edge switch management.

Fibre Channel addressing: 24-bit FCID (domain 8 bits, area 8 bits, port 8 bits); domain IDs are assigned by the principal switch; FC speeds: 8/16/32/64G; a single 32G port provides ~3200 MB/s full duplex line rate.

Zoning: hard zoning uses FCID, soft zoning uses WWN (pWWN); single-initiator-single-target zoning is best practice; zones are grouped into zonesets, and only one zoneset is active per VSAN; default zoning should be set to deny (default zone: deny).

VSANs provide independent fabric instances on the same physical switch; each VSAN has its own domain ID, zoning database, and principal switch election; IVR (Inter-VSAN Routing) is required to route between VSANs, typically via a transit VSAN.

FCoE: Fibre Channel frames encapsulated in Ethernet (FCoE Ethertype 0x8906), requires lossless Ethernet (PFC/802.1Qbb and ETS/802.1Qaz) and DCB; FCoE uses FIP for discovery and login (Ethertype 0x8914); FCoE is typically deployed between server and FCF (Fibre Channel Forwarder).

iSCSI: SCSI over TCP/IP, port 3260; uses IQN or EUI names; CHAP authentication (one-way or mutual) for security; multipath I/O (MPIO) with multiple sessions for redundancy; iSCSI benefits from jumbo frames and dedicated VLANs; DCB is optional but recommended for lossless behavior.

NPV (N_Port Virtualization) makes an edge switch behave as an NP_Port to the core, passing traffic without consuming a domain ID; NPIV (N_Port ID Virtualization) lets a single physical port register multiple WWNs (used for VM HBAs); NPV requires upstream NPIV support.

Storage replication/recovery metrics: RPO (recovery point objective, acceptable data loss) and RTO (recovery time objective, acceptable downtime); synchronous replication requires low latency (typically <5-10 ms RTT) and is distance-limited; asynchronous replication tolerates WAN latency.

First-hop redundancy: HSRP (Cisco, active/standby, virtual MAC 0000.0c07.acXX), VRRP (standards-based, virtual MAC 0000.5e00.01XX), GLBP (Cisco, load balancing with multiple forwarders); on Nexus, HSRP/VRRP can use vPC for active/active forwarding, and the vPC peer must match the FHRP timers.

Load balancing: Cisco Application Centric Infrastructure uses PBR/service graphs for L4-L7 insertion; standalone load balancers (e.g., Citrix NetScaler, F5 BIG-IP) can be deployed one-arm or inline; server farm health monitors (HTTP, TCP, ICMP) determine member state.

QoS: classification (DSCP/CoS), marking, policing, shaping, and queuing; DCBX negotiates QoS/PFC/ETS between DCB-capable peers; standard DSCP markings for storage/FCoE are often 3 (FCoE) and 4 (iSCSI) in some designs; trust boundaries should be set at the server edge.

Multicast: PIM Sparse Mode with Rendezvous Point (RP) is typical; VXLAN requires multicast or ingress replication for BUM traffic (broadcast, unknown unicast, multicast); EVPN replaces multicast underlay requirement with ingress replication or assisted replication.

DNS/DHCP design: redundant DHCP servers or DHCP relay on the ToR; DHCP snooping and dynamic ARP inspection prevent spoofing; in ACI, DHCP relay is configured on bridge domains; IP address management (IPAM) integration (e.g., Infoblox, Cisco Network Registrar) automates address pools.

Network services insertion in ACI: service graph with PBR (Policy-Based Redirect) to a firewall/load balancer; unmanaged mode (no APIC control of device) vs managed mode; the graph defines provider/consumer connectors and device cluster interface configuration.

Security services: stateful firewalls (Cisco Firepower, ASA) at the perimeter or between EPGs via contracts; microsegmentation via ACI contracts or VMware NSX distributed firewall; 802.1X for port authentication; ACLs on Nexus use TCAM and are applied per interface or per VLAN.

AAA and management services: TACACS+ (encrypts full payload, port 49) vs RADIUS (encrypts password only, ports 1812/1813); NTP for time sync (stratum hierarchy); syslog for event logging; SNMPv3 for encrypted monitoring; these are baseline services for any DC design.

Cisco NX-OS automation: Python (on-box scripting with the Cisco Python API), NX-API (REST/JSON over HTTP/HTTPS), NETCONF/RESTCONF with YANG models, and Ansible/Terraform modules; NX-API can run in CLI mode (show/exec) or JSON-RPC mode for structured output.

Cisco ACI automation: APIC REST API (XML/JSON) with authentication via a token (aaaLogin); Cobra SDK (Python), Ansible ACI modules, and Terraform ACI provider; object model uses distinguished names (DNs) like uni/tn-/ap-/epg-.

UCS automation: UCS Manager XML API with aaaLogin and cookie-based auth; UCS Central for multi-domain management; Intersight API for cloud management; Ansible and Terraform providers exist for UCSM and Intersight.

Configuration management: Ansible uses YAML playbooks, idempotent modules, and inventory files; Terraform uses HCL with state files and providers; both are agentless; Git-based workflows (GitOps) with CI/CD pipelines (Jenkins, GitLab CI) enable version-controlled infrastructure changes.

Infrastructure as Code best practices: source control everything, use variables/environments (dev/staging/prod), implement drift detection, test in a lab or simulation (e.g., Cisco Modeling Labs, pyATS), and use role-based access control on automation platforms.

Telemetry: streaming telemetry (model-driven, gNMI/gRPC, or Cisco NX-OS telemetry) pushes data at intervals instead of SNMP polling; Cisco Nexus Dashboard Insights provides assurance and anomaly detection; NetFlow/sFlow for traffic analysis.

Power/cooling design: calculate total load in kW, use N+1 or 2N redundancy for PDU and UPS, and design cooling per ASHRAE recommendations (inlet 18-27°C); hot-aisle/cold-aisle containment improves efficiency; rack U-space and weight limits constrain hardware placement.

Cabling and optics: use structured cabling with LC/MPO connectors; 40G/100G uses MPO-12 or MPO-24 for parallel optics; DAC cables for short in-rack runs; validate transceiver compatibility (Cisco QSFP/SFP part numbers); cable management and labeling are part of design documentation.

High availability: design for N+1 or N+N redundancy at every layer (power, network, compute, storage); use vPC/MLAG for L2, ECMP for L3, dual-fabric for SAN; test failover paths and document RTO/RPO; avoid single points of failure in management networks (out-of-band, console servers).