I85PREP
⌘ K
Cisco DCID 300-610 study materials
Cisco DCID 300-610 study resources

Cisco DCID 300-610: Data Center Network Services Design

Cisco DCID 300-610 · Work through your exam, one topic at a time.

All guide sections

Data Center Network Services Design

Network Services Design covers how the fabric delivers shared services-ACI contracts and L4-L7 insertion, multicast, QoS, and anycast/edge services-rather than basic connectivity.

Rules

  • ACI object model. Tenant → VRF → bridge domain → EPG; contracts (subjects + filters) provide the only allowed communication unless a preferred group or vzAny is configured. Contract scope (VRF, tenant, application profile, global) decides where the contract can be consumed.
  • vzAny applies a contract to all EPGs in a VRF, typically for shared services such as DNS or AD; it must not become a default-allow shortcut.
  • Service insertion. Model the device with a device package, device cluster, and interfaces; define a service graph with function nodes (GoThrough for inline, GoTo/PBR for one-arm or source-NAT devices) and attach it to the contract between consumer and provider EPGs.
  • PBR redirects traffic to a service node using the node's MAC and adjacency; the node must be reachable in the same bridge domain, and the return path must be designed.
  • Multicast. The underlay uses PIM (ASM or BiDir) per fabric; VXLAN VTEPs replicate or use multicast groups. In ACI, multicast is enabled per bridge domain and requires the spine replication scope.
  • Anycast. Distributed anycast gateway for default gateways; anycast DHCP/DNS/RADIUS improves locality but requires consistent service configuration.

Worked example

Insert a two-arm load balancer between a web EPG and an app EPG. Because the LB is inline (traffic in and out of the same interfaces), the service graph uses GoThrough nodes: consumer web EPG → function node LB → provider app EPG, attached to a contract. If the LB is one-arm with source NAT, use a PBR node instead, because traffic must be redirected to a MAC rather than routed through the device. The reasoning is path symmetry: GoThrough preserves the original 5-tuple; PBR changes the next hop and requires the service node to route back into the correct BD.

Traps

  • Applying a contract in only one direction and expecting return traffic.
  • Choosing the wrong contract scope, so an EPG cannot consume it.
  • Using PBR for an inline device-traffic loops or bypasses inspection.
  • Designing ACI Multi-Pod without validating IPN MTU and multicast.
  • Enabling preferred group everywhere and calling it segmentation.