I85PREP
⌘ K
Cisco DCACI 300-620 study materials
Cisco DCACI 300-620 study resources

Cisco DCACI 300-620: ACI Packet Flow

Cisco DCACI 300-620 · Work through your exam, one topic at a time.

All guide sections

ACI Packet Flow

Domain 2 follows a frame from the source leaf to the destination leaf: where the forwarding decision is made, what goes into the VXLAN header, where contracts are checked, and how flooded traffic moves.

Unicast path

  1. The ingress leaf receives the frame on a static path or VMM binding and identifies the source EPG.
  2. If source and destination EPGs differ, the leaf matches the flow against policy CAM using the source and destination pcTags. No matching contract subject means drop.
  3. If the destination is in another subnet of the same VRF, the ingress leaf routes; the packet carries the destination BD's VNID so the egress leaf can deliver it into the right L2 domain.
  4. The ingress leaf encapsulates: outer source is its TEP, outer destination is the remote leaf's TEP, VNID is the destination BD, and the source EPG's pcTag rides along as the source group tag in the VXLAN-GPO header.
  5. Spines forward on the outer header only. The egress leaf decapsulates and delivers to the endpoint.

Flooding

Broadcast, unknown unicast and multicast are flooded to every leaf that has the BD deployed, using underlay multicast (a per-BD multicast group), not head-end replication. That is why unknown unicast still crosses the fabric when the endpoint is unknown.

Contracts

Contracts are unidirectional: a subject with a filter and entries permits traffic from consumer to provider. Return traffic needs its own rule, a filter entry using reverse ports / apply both directions, or a second contract. Traffic between EPGs in different VRFs is not permitted by a contract alone; it needs a shared L3Out or route leaking.

Worked example

Host A is in Web on leaf 101 (10.1.1.10/24), host B in App on leaf 102 (10.2.2.20/24), same VRF, different BDs. A sends to its gateway; leaf 101 routes, looks up B's /32 learned through COOP, checks the Web-to-App contract permitting TCP 443, encapsulates with the App BD VNID and Web's pcTag, and sends it to leaf 102's TEP. B's reply bears App's pcTag; if only Web-to-App exists and no reverse ports, leaf 102 drops it - a half-open flow.

Traps

  • Assuming contracts are stateful or bidirectional.
  • Applying policy enforcement to the spine.
  • Using the source BD's VNID after routing.
  • Expecting intra-EPG traffic to be filtered; it is permitted unless isolation is configured.