Cisco DCACI 300-620 cheat sheet

The APIC cluster is the fabric controller: an odd number of APICs (3, 5, or 7 recommended) provides controller redundancy; APICs are not in the data path, so a full APIC outage stops policy changes but leaves existing forwarding intact.

Spine-leaf topology: every leaf must connect to at least one spine; Cisco recommends each leaf connect to every spine for full bandwidth and fast convergence. Spine ports toward leaves are fabric ports; leaf ports toward spines are fabric ports.

Fabric ports carry IS-IS (underlay) and VXLAN-encapsulated traffic; access ports are configured as individual, PC (static port-channel), or VPC (virtual port-channel) and carry endpoint VLANs.

VXLAN is used as the data-plane encapsulation; the fabric uses a COOP database synchronized across spines and leaves to distribute endpoint (IP/MAC) reachability, and IS-IS to distribute router loopback addresses.

VPC (Virtual Port Channel) lets two leaves act as one logical switch to a downstream device; requires a VPC domain, a peer link (typically 2+ links), and a VPC peer-keepalive over the management or in-band network.

Tenant construct hierarchy: Tenant > VRF > Bridge Domain > Subnet/EPG. EPGs are policy containers for endpoints and are associated to bridge domains; contracts define permitted traffic between EPGs.

VRF provides Layer 3 isolation (separate routing table); a bridge domain belongs to exactly one VRF, and an EPG belongs to exactly one bridge domain.

Fabric discovery uses LLDP plus DHCP-relayed control-plane addressing: leaves receive infrastructure addresses from the APIC pool; a leaf with no discovered APIC will show as unregistered until it can reach the APIC via in-band or management connectivity.

Fabric-wide policies (NTP, DNS, syslog, SNMP, fabric MTU, global QoS) are configured at the fabric level under Fabric > Fabric Policies and inherited by switches; switch-level policies override only where allowed.

Ingress leaf lookup order: source endpoint learning (MAC/IP) first, then policy enforcement (contract/EPG classification), then destination lookup in the local endpoint table; if the destination is unknown locally, the leaf forwards to a spine via the COOP-derived endpoint database.

Known unicast to a remote leaf is VXLAN-encapsulated with the source leaf's VTEP (loopback) as outer source and the destination leaf's VTEP as outer destination; the original frame is preserved inside.

Unknown unicast, broadcast, and multicast are flooded to all leaves that have the source bridge domain/EPG instantiated (or to the multicast group tree when fabric multicast is enabled); ACI does not flood to every leaf unconditionally.

Contract enforcement is statically applied at the ingress leaf of the source EPG (provider/consumer direction depends on contract direction); the egress leaf does not re-filter the same contract, so policy is applied once.

VRF route leaking is done via contract between EPGs in different VRFs or via shared L3Out; a bridge domain subnet is the default gateway for endpoints and is anycast across all leaves hosting that BD.

Endpoint learning: local endpoints are learned from data-plane source MAC/IP; remote endpoints are learned via COOP from the leaf that owns them. A move triggers COOP update and stale-entry aging.

Packet flow to an L3Out: leaf routes to the border leaf, which performs VRF lookup and sends traffic out the external interface; PBR (policy-based redirect) can steer traffic to a service node before egress.

Traceroute/SPAN considerations: ERSPAN destination must be reachable from the source leaf; fabric SPAN can source from access ports or fabric ports, and ACL-based filters limit captured traffic.

APIC management access: out-of-band (management port on each APIC) and in-band (via the fabric). The APIC cluster uses the management network for cluster communication and for GUI/API/SSH access.

RBAC: users are assigned to roles (admin, network-admin, tenant-admin, read-only, etc.) and security domains; a tenant-admin scoped to a tenant cannot modify fabric-wide policies.

Configuration backup: APIC supports on-demand and scheduled backups (config export) to remote locations (SCP/FTP/TFTP); backups capture fabric, tenant, and access policies.

AAA: TACACS+, RADIUS, and LDAP are supported; local users remain as fallback. Login domain and provider group order determine authentication sequence.

Firmware management: APIC and switch firmware are bundled in a release; upgrade is done via APIC GUI/API in a controlled sequence (APIC cluster first, then switches), with maintenance groups controlling switch upgrade order.

Health scores aggregate faults: a fault with severity critical/major reduces the affected object's health score; faults have lifecycle states (raised, soaking, cleared) and can be acknowledged or suppressed.

Syslog, SNMP (v2c/v3), NTP, and DNS are fabric-wide policies; NTP is required for accurate timestamps and for certificate validation.

APIC REST API uses HTTPS with JSON/XML payloads; authentication returns a token (cookie) used for subsequent calls, and the API supports class-based queries (e.g., /api/class/fvTenant.json).

Tech support: 'show tech' per switch and APIC techsupport collection; fabric-wide techsupport gathers logs from all controllers and switches for TAC.

L3Out components: VRF, logical node profile (border leafs), logical interface profile (routed sub-interface or SVI), external EPG, and route control profile. The external EPG defines the networks reachable outside the fabric.

L3Out routing protocols: static, OSPF, EIGRP, and BGP are supported on routed interfaces; BGP is common for external connectivity and supports route-maps/prefix-lists via route control profiles.

Border leaf design: at least two border leafs for redundancy; an L3Out can span multiple border leafs, and each border leaf needs its own logical node/interface profile entries.

External EPG classification: subnets in the external EPG match external prefixes; contracts are applied between internal EPGs and the external EPG to permit traffic.

L2Out uses a bridge domain extended to an external switch via a port or VPC; it is used when the external device is L2-adjacent and requires the same subnet.

VPC to external switches: the VPC domain must match on both leaves; peer-keepalive must not traverse the VPC peer link, and the downstream device must support LACP or static VPC.

Route leaking between VRFs uses contracts (preferred) or shared L3Out; a contract between EPGs in different VRFs requires the contract to be provided/consumed with matching subjects.

MTU: fabric MTU is a fabric-wide policy (default 9000 for jumbo); external interfaces must be configured consistently or large packets will drop.

First-hop redundancy: ACI does not run HSRP/VRRP on bridge domain SVIs for endpoint gateways; the distributed anycast gateway provides the default gateway, while HSRP/VRRP is used only on L3Out external interfaces where required.

APIC REST API is the integration point for automation; tools such as Ansible (aci modules), Terraform (ACI provider), and Python SDK (cobra/acitoolkit) call the API.

Authentication: POST to /api/aaaLogin.json with username/password returns a token cookie; subsequent requests include the cookie; tokens expire and must be refreshed.

Idempotency: automation should query existing objects before creating; API POST creates or updates, DELETE removes; use class queries to read state.

Monitoring integration: SNMP traps, syslog, and streaming telemetry (where supported) feed external NMS; APIC also supports syslog to multiple destinations.

Configuration management: APIC config export/import via API or GUI supports backup to SCP/FTP; scheduled backups integrate with external backup servers.

Ansible aci modules map to APIC object model (e.g., aci_tenant, aci_epg, aci_contract); inventory uses APIC host, username, password, and validate_certs.

Terraform ACI provider uses the APIC URL and credentials; state tracks objects, and plan/apply shows drift against the fabric.

Webhooks/event integration: APIC can send fault and event notifications to external systems via syslog, SNMP, or API polling; there is no native generic webhook in older releases, so polling is common.

Cisco Nexus Dashboard / Intersight integrations consume APIC data for assurance and compliance; they require API credentials with appropriate RBAC scope.