Cisco DCACI 300-620 key terms

A logical container in ACI that isolates policy, users, and networking resources. Each tenant holds its own private network, bridge domains, application profiles, and contracts, so policies in one tenant do not leak into another.

A virtual routing and forwarding instance inside a tenant that provides its own Layer 3 routing table and address space. Endpoints in different VRFs cannot communicate unless policy explicitly allows it.

A Layer 2 forwarding domain inside a tenant that groups subnets and decides whether routing is enabled and how unknown traffic is handled. It maps to a VLAN-like broadcast boundary and holds the subnet gateway addresses.

An endpoint group is a collection of endpoints that share the same policy requirements. It acts as the policy anchor: contracts attach to EPGs, and endpoints enter EPGs through static paths or dynamic VLAN pools.

A container that groups EPGs and the contracts between them so a whole application can be deployed as a unit. It supports reuse across tenants and can be exported as a template.

A policy object that defines which traffic is allowed between two EPGs. It contains subjects with filters, and it must be provided by one EPG and consumed by another to take effect.

A reusable set of Layer 3 and Layer 4 match criteria, such as protocol, port range, or ICMP type, used inside a contract subject. Filters decide which packets are permitted or denied.

A component of a contract that groups one or more filters and applies direction and QoS settings. A contract can have multiple subjects, and each subject can reference different filters.

The collection of interconnected ACI switches managed as a single system by the APIC cluster. It provides a shared policy model and a spine-leaf topology for endpoint connectivity.

The Application Policy Infrastructure Controller is the cluster that manages the ACI fabric. It hosts the policy database, provides the GUI and APIs, and programs policy into the switches.

A high-throughput switch in the ACI fabric that connects to every leaf and forwards traffic between them. Spines do not connect to endpoints and do not run endpoint learning.

An ACI switch that connects endpoints, external networks, and services to the fabric. Leaves learn endpoint addresses and enforce policy pushed by the APIC.

The object-oriented data model in ACI that describes tenants, networking, and security as hierarchical managed objects. The APIC stores this model and resolves it into switch-level configuration.

The process by which leaf switches discover endpoint MAC and IP addresses from data-plane traffic and record them in a local table. This table drives forwarding and is synchronized across the fabric.

The Council of Oracles Protocol runs on spine switches and distributes endpoint and routing information among leaves. It keeps endpoint databases consistent so any leaf can forward to any endpoint.

The encapsulation ACI uses to carry tenant traffic between leaf and spine switches. Each packet gets a VXLAN header with a VNID that identifies the source bridge domain or context.

A 24-bit identifier in the VXLAN header that represents a bridge domain or VRF inside the fabric. It lets switches distinguish tenant traffic without relying on VLAN tags.

The internal VXLAN header and outer IP header added to tenant frames as they cross the fabric. It carries the VNID and source and destination leaf addresses used for forwarding.

A configuration that maps a leaf interface and VLAN to an EPG, placing endpoints on that port into the group. It is used for bare-metal servers and devices that cannot use dynamic discovery.

A pool of VLAN IDs assigned automatically to EPGs when endpoints connect through a VMM domain or similar integration. It avoids manual VLAN assignment and conflicts.

An integration between ACI and a hypervisor manager such as vCenter or SCVMM. It lets the APIC create port groups and place virtual machine endpoints into EPGs automatically.

A logical external Layer 3 connection object that defines routing protocols, interfaces, and external EPGs for connecting the fabric to routers or firewalls.

An EPG in an L3Out that represents networks reachable outside the fabric. Contracts between internal and external EPGs control which external prefixes may communicate with which internal endpoints.

A link-state routing protocol supported on ACI L3Out interfaces for exchanging routes with external routers. ACI supports OSPFv2 and OSPFv3 with configurable areas and authentication.

A path-vector routing protocol used on ACI L3Outs to peer with external routers and exchange prefixes. It supports eBGP and iBGP, route reflectors, and prefix-based route control.

A policy attached to an L3Out that permits or denies specific prefixes learned from or advertised to external peers. It filters routes without changing the underlying routing protocol.

The HTTP-based interface the APIC exposes for reading and changing managed objects. Requests use JSON or XML payloads, and authentication uses a token obtained from a login request.

A single configurable or observable element in the APIC data model, identified by a distinguished name and a class. Tenants, EPGs, and contracts are all managed objects.

The unique path that identifies a managed object in the APIC hierarchy, such as uni/tn-exam/ap-app/epg-web. It is used in API calls and in policy references.

An APIC object raised when a condition violates a configured rule, such as a link down or a policy mismatch. Faults carry severity, lifecycle state, and a unique code.

A numeric indicator from 0 to 100 that summarizes the condition of a managed object based on faults and other events. Lower scores indicate problems needing attention.

Management access to ACI switches through the fabric data network, typically using an in-band EPG and management subnet. It is an alternative to dedicated out-of-band ports.

Dedicated management connectivity through the physical management ports on APIC and switches, separate from tenant data traffic. It is used for initial setup and administrative access.

The time synchronization protocol configured on APIC and switches so logs, faults, and certificates stay consistent. Fabric-wide time agreement is required for cluster and certificate functions.

A remote authentication protocol ACI can use for administrative login to APIC and switches. It provides per-command authorization and separates authentication from authorization.

Role-based access control in ACI assigns security domains and roles to users so they can view or change only permitted objects. It applies to local and remote authentication alike.

A logging destination configured on ACI components to send event and audit messages to external collectors. Multiple servers and severity filters can be defined per policy.

A protocol ACI supports for polling statistics and sending traps to external monitoring systems. SNMPv2c and SNMPv3 communities and users are configured as monitoring policies.

The API surface external tools use to automate ACI, including REST calls, subscriptions, and the Cobra SDK. It lets orchestration systems create and query managed objects programmatically.