Cisco DCCOR (350-601) cheat sheet

Cisco Nexus uses NX-OS with a two-stage or three-stage CLI; feature commands (feature lacp, feature vpc, feature ospf) must be enabled before the related configuration is available.

vPC requires a peer-link (port-channel carrying all VLANs) plus a separate vPC peer-keepalive link; the keepalive is used only for peer liveness, not for data forwarding.

vPC domain rules: both switches need the same vPC domain ID, unique role priority (lower wins primary), matching vPC system MAC, and a peer-keepalive reachable over the mgmt VRF or a dedicated link.

Cisco Fabric Services (CFS) distributes vPC configuration; a vPC consistency check compares Type-1 (mandatory, e.g. MTU, STP mode) and Type-2 (advisory, e.g. VLAN list) parameters.

On Nexus 9000 in ACI mode, the fabric is spine-leaf with VXLAN data plane and MP-BGP EVPN control plane; the APIC cluster manages policy, not per-switch CLI.

Cisco FabricPath and OTV are legacy DC technologies; modern designs favor VXLAN EVPN. OTV uses a join interface and overlay interface for L2 extension across L3.

HSRP/VRRP/GLBP on Nexus: HSRP uses virtual MAC 0000.0c07.acXX; VRRP uses 0000.5e00.01XX; GLBP uses 0007.b400.XXYY.

Underlay routing choices: OSPF, IS-IS, or eBGP; for VXLAN EVPN, eBGP underlay with per-leaf AS is common because it avoids IGP flooding and simplifies scale.

Cisco UCS Managed mode uses Fabric Interconnects (FIs) in a cluster (active/active) with a virtual IP; the cluster must be in End-Host mode, not Switch mode, for UCS Manager.

Service profiles are built from pools (server, MAC, WWNN, WWPN, UUID, IQN) plus a server pool policy qualification; a service profile template enables rapid provisioning.

UCS B-Series blades connect to FIs via IOM/fabric extenders; A-Series rack servers connect via FEX or directly to FI ports.

LAN pin groups and SAN pin groups on the FI control which uplink ports a vNIC/vHBA uses; without pin groups, the FI uses system-selected uplinks.

Cisco Intersight is the SaaS/on-prem management platform replacing UCS Manager for many deployments; it uses device connectors and supports policies, profiles, and workflows.

BIOS policy vs boot policy: BIOS policy sets server firmware tunables (e.g. hyperthreading, VT, power); boot policy defines boot order and SAN boot targets.

UCS firmware management uses firmware policies and packages; host firmware packages apply to blades, while FI/IO module firmware is applied at the infrastructure level.

Cisco CIMC manages standalone C-Series servers; it provides KVM, virtual media, SOL, and SNMP/Redfish APIs without a Fabric Interconnect.

Fibre Channel login sequence: FLOGI (fabric login) assigns FCID; PLOGI establishes N_Port-to-N_Port; PRLI establishes process login for SCSI; fabric login happens before name service registration.

VSANs partition a physical SAN into isolated logical fabrics; each VSAN has its own domain ID, FLOGI database, and zoning. Trunking ports carry multiple VSANs with EISL.

Zoning types: hard zoning (per-port) vs soft zoning (per-WWN); enhanced zoning enforces a single zoning mode per VSAN and locks the zoning database during changes.

Cisco MDS uses NPV/NPIV for fabric extension; NPV makes the switch a host, NPIV allows multiple logins from one port.

FCoE requires a lossless Ethernet fabric (DCB/PFC, priority flow control) and an FCoE VLAN; FIP is used for discovery and login before FCoE data.

FCID format is 0xDDAAAA (domain, area, port); domain IDs are 1-239; principal switch election uses lowest WWN with priority tie-break.

iSCSI uses TCP/3260; CHAP authentication is one-way or mutual; multipath I/O (MPIO) and Cisco Fabric Manager/Nexus Dashboard manage paths.

SAN boot requires a boot policy with a vHBA and target WWPN/LUN; the FI must have SAN pin groups and correct VSAN membership.

AAA on NX-OS: aaa authentication login default group local; use local as fallback; TACACS+ encrypts the full payload, RADIUS encrypts only the password.

RBAC uses roles and rules; Cisco NX-OS predefined roles include network-admin, network-operator, and vdc-admin; custom roles map to privilege levels.

First-hop security: DHCP snooping, dynamic ARP inspection (DAI), and IP Source Guard; DAI requires DHCP snooping to build the binding table.

Port security on Nexus limits MAC addresses per port; violations are protect, restrict, or shutdown; sticky MACs are learned and saved.

Control-plane policing (CoPP) protects the supervisor CPU; default CoPP policy is applied unless a custom policy is attached.

MACsec provides hop-by-hop L2 encryption on Nexus 9000; it requires a key chain and is configured on point-to-point links.

Cisco TrustSec uses SGTs and SGACLs; on Nexus, SGT imposition and propagation can be done inline or via SXP.

ACLs on NX-OS are applied with the ip access-group command; they are stateless; reflexive ACLs are not supported on all platforms, so use firewall or stateful devices for return traffic.

NX-OS supports NETCONF (RFC 6241) over SSH and RESTCONF; YANG models define the data; Cisco native and IETF models are both available.

NX-API supports JSON-RPC and XML; enable with feature nxapi; use nxapi sandbox for testing; CLI transport vs NXAPI transport differ in response format.

Cisco Ansible modules for NX-OS (nxos_*) use network_cli or httpapi connection; httpapi maps to NX-API.

Cisco Intersight and Nexus Dashboard provide REST APIs; authentication commonly uses tokens or OAuth; the API is versioned and documented in the DevNet sandbox.

Python libraries: ncclient for NETCONF, requests for REST, paramiko/netmiko for SSH; NX-OS supports guest shell for on-box Python.

Model-driven telemetry (MDT) streams data via gRPC or gNMI; it replaces periodic SNMP polling for high-frequency counters.

Idempotency is the property that repeated execution yields the same state; Ansible and Terraform both aim for idempotent operations, but Terraform tracks state explicitly.

Cisco NX-OS configuration replace/rollback: configure replace and rollback running-config checkpoint ; checkpoints are stored locally.