Cisco DCACI 300-620 flashcards

33 cards. Read the term and the definition here. The deck at the top of this page is optional.

APIC cluster size

An odd number of APIC controllers (3, 5, or 7) is recommended so the cluster maintains quorum; APICs are out-of-band controllers and do not forward tenant data traffic.

Spine role

Spines interconnect leaf switches and form the IS-IS/VXLAN underlay; every leaf should connect to every spine for full bandwidth. Spines do not host tenant endpoints.

Leaf role

Leaves connect endpoints and external networks; they perform policy enforcement, endpoint learning, and VXLAN encapsulation toward spines.

VXLAN in ACI

ACI uses VXLAN as the data-plane encapsulation between leaf VTEPs; the outer header uses loopback addresses distributed by IS-IS, and the inner frame is preserved.

COOP database

The Council of Oracles Protocol synchronizes endpoint (IP/MAC) reachability across spines and leaves, enabling remote endpoint lookup without flooding.

VPC requirements

VPC needs a VPC domain, a peer link between the two leaves, and a peer-keepalive path that does not use the peer link; both leaves must share the domain ID.

Tenant hierarchy

Tenant contains VRFs; each VRF contains bridge domains; each bridge domain contains subnets and is associated with EPGs; contracts define allowed traffic between EPGs.

Bridge domain subnet

A bridge domain subnet is the default gateway for endpoints in that BD and is anycast across all leaves hosting the BD, so endpoints can move without gateway changes.

Fabric port vs access port

Fabric ports connect leaf to spine and carry IS-IS/VXLAN; access ports connect endpoints or external devices and carry tenant VLANs.

Ingress leaf lookup

The ingress leaf learns the source, classifies it to an EPG, enforces contracts, then looks up the destination; unknown destinations are sent to spines via COOP.

Known unicast flow

A known unicast frame is VXLAN-encapsulated by the ingress leaf with its loopback as source VTEP and the destination leaf loopback as destination VTEP.

Unknown unicast flooding

Unknown unicast, broadcast, and multicast are flooded only to leaves where the source bridge domain/EPG is instantiated, not to the entire fabric.

Contract enforcement point

Contracts are enforced at the ingress leaf of the source EPG; the egress leaf does not re-apply the same contract, so policy is applied once per flow.

Endpoint learning

Local endpoints are learned from data-plane source MAC/IP; remote endpoints are learned via COOP from the owning leaf, and moves trigger COOP updates.

L3Out packet flow

Traffic destined outside the fabric is routed to a border leaf, which performs a VRF lookup and forwards out the external interface after contract filtering.

ERSPAN in ACI

ERSPAN copies traffic from a source leaf to a remote destination; the destination must be reachable from the source leaf, and ACL filters can limit captured traffic.

APIC management access

APICs are reached out-of-band via their management ports and in-band via the fabric; GUI, SSH, and REST API use these paths.

RBAC security domains

Users are assigned roles and security domains; a tenant-admin scoped to one tenant cannot modify fabric-wide policies or other tenants.

APIC backup

APIC supports on-demand and scheduled configuration exports to SCP/FTP/TFTP; backups capture fabric, tenant, and access policies for restore.

AAA providers

APIC supports TACACS+, RADIUS, and LDAP for external authentication, with local users as fallback; provider group order sets the authentication sequence.

Firmware upgrade order

APIC cluster firmware is upgraded before switches; maintenance groups control the order and grouping of switch upgrades to limit disruption.

Fault severity and health

Faults carry severity (critical, major, minor, warning, info); critical and major faults lower the affected object's health score until cleared or acknowledged.

APIC REST API basics

The APIC API uses HTTPS with JSON or XML; aaaLogin returns a token cookie used for later calls, and class queries read object state.

L3Out components

An L3Out requires a VRF, logical node profile, logical interface profile, external EPG, and route control profile to connect the fabric to external L3 networks.

L3Out routing protocols

ACI L3Outs support static routes, OSPF, EIGRP, and BGP on routed interfaces; BGP commonly uses route control profiles with route-maps and prefix-lists.

External EPG subnets

Subnets configured in an external EPG classify external prefixes; contracts between internal EPGs and the external EPG permit traffic in each direction.

L2Out use case

An L2Out extends a bridge domain to an external L2 switch via a port or VPC, used when the external device must be Layer 2 adjacent on the same subnet.

Border leaf redundancy

At least two border leafs provide L3Out redundancy; each border leaf needs its own logical node and interface profile entries within the L3Out.

Fabric MTU policy

Fabric MTU is a fabric-wide policy (default 9000 for jumbo frames); external interfaces must match or large packets are dropped.

Ansible ACI modules

Ansible aci modules map to APIC objects such as aci_tenant, aci_epg, and aci_contract; inventory supplies APIC host, credentials, and certificate validation.

Terraform ACI provider

The Terraform ACI provider uses the APIC URL and credentials; state tracks objects, and plan/apply reveals drift between configuration and fabric.

API token refresh

APIC aaaLogin returns a token cookie with a limited lifetime; automation must refresh or re-authenticate before the token expires to avoid failed calls.

Idempotent automation

Automation should query existing APIC objects before creating them; POST creates or updates, DELETE removes, and class queries read current state.