I85PREP
⌘ K
Cisco DCACI 300-620 study materials
Cisco DCACI 300-620 study resources

Cisco DCACI 300-620: ACI Fabric Connectivity

Cisco DCACI 300-620 · Work through your exam, one topic at a time.

All guide sections

ACI Fabric Connectivity

Domain 4 is the configuration core: building forwarding domains inside a tenant and connecting them to the outside world, with contracts and routing policies that make the design work.

Inside the tenant

  • VRF policy enforcement mode: enforced (default) applies contracts; unenforced disables contract filtering for the whole VRF, a silent way to make a broken contract "work".
  • Bridge domain subnet scope: private means not advertised out an L3Out; public advertises. Choose public for subnets external routers must reach.
  • BD options: unicast routing, ARP flooding, L2 unknown-unicast flood.
  • EPG binding: static path (leaf, interface, VLAN encapsulation, deploy immediacy) or VMM domain; port channels to external switches need a vPC interface policy group on an explicit vPC pair.
  • Contracts: provider/consumer, subject, filter, with reverse ports where the return flow needs permitting.

Outside the tenant

An L3Out contains a node profile (which border leaves), interface profiles (routed ports or routed sub-interfaces with VLAN encapsulation), a routing protocol (BGP, OSPF, EIGRP, static), and an external EPG whose prefixes classify outside addresses. Route control decides which prefixes are imported or exported. L2Out extends a BD to an external L2 switch by mapping VLANs. Objects several tenants need - L3Outs, contracts, filters, VRFs - live in the common tenant and are referenced.

Worked example

Tenant A's Web EPG needs internet via border leaves 103/104 running BGP to a core router. Build the VRF, then the BD with gateway 10.1.1.1/24 and public scope so the subnet is exported. Create the L3Out with a node profile for 103/104, routed sub-interfaces, a loopback as BGP router-id, and BGP to the core. Add an external EPG containing 0.0.0.0/0 with import route control so the default route is taken, and a contract provided by the external EPG and consumed by Web. Reasoning: without public scope the core has no return path; without the contract the flow is denied; without import route control the default route never reaches the leaf.

Traps

  • Leaving a subnet private and blaming the L3Out for return-traffic loss.
  • Building a port channel with a regular access policy group instead of a vPC one, so both leaves forward independently.
  • Expecting one tenant's L3Out to serve another tenant's VRF.
  • Forgetting that unenforced VRF mode bypasses all contracts.