600-660 Sample Questions & Answers

Symmetric PBR ensures that return traffic from the server to the client is also redirected through the same firewall instance, which is essential for stateful inspection.

Since the client and server are in the same EPG (and therefore the same BD), this is an intra-EPG contract scenario. For PBR to work in this case, both the consumer and provider connectors of the service graph must be attached to the same EPG (EPG-A), effectively redirecting traffic that originates and terminates within that EPG.

This statement is false. COOP is responsible for distributing endpoint information (MAC and IP addresses) to the spine proxy database within its local pod only. For inter-pod communication, MP-BGP EVPN is used over the IPN to advertise endpoint reachability information between the pods.

The 'Limit IP Learning to Subnet' option (also known as Enforce Subnet Check in some versions/contexts) on a Bridge Domain enforces that the fabric only learns endpoint IP addresses that fall within the subnets configured under that BD. This is a security and hygiene feature to prevent learning of unexpected or misplaced endpoints.

In MSO, communication between EPGs in different VRFs and different sites is achieved by configuring route leaking between the VRFs at the schema level. This is typically done in conjunction with an inter-site L3Out configuration within the template. MSO automates the underlying BGP EVPN route-target configurations on both fabrics to allow the selective exchange of routes between VRF1 in SiteA and VRF2 in SiteB, enabling the required communication.

When configuring inter-VRF route leaking, the subnet object under the EPG that is providing the contract must have its scope configured correctly. To leak the subnet to another VRF, the scope must be set to 'Shared between VRFs'. This tells the fabric that this specific prefix is eligible to be advertised to other VRFs that consume the contract.

The 'Export Route Control Subnet' option under the external EPG (InstP) is used to control which learned routes are re-advertised out of that L3Out. It is a fundamental component of transit routing.

The 'Import Route Control Subnet' option controls which external routes are imported into the ACI fabric's routing table for the VRF. For transit routing, routes learned from one L3Out (import) must be allowed to be advertised to the other (export).

In ACI, multi-destination traffic (like multicast or broadcast) needs to be forwarded efficiently. The fabric builds multicast trees, and the Forwarding Tag (FTAG) is used by the ingress leaf to select a specific tree (and therefore a specific spine switch) to forward the traffic. This acts as a load-balancing mechanism, ensuring that not all multi-destination traffic from a leaf goes to the same spine.

When a service device like a firewall is in one pod, and the consumer/provider is in another, the return traffic from the firewall needs a way to get back to the correct pod. The subnet of the firewall's bridge domain must be advertised externally (e.g., via an L3Out) so that it is propagated over the IPN via MP-BGP EVPN. This ensures that when the server in Pod2 replies, the fabric knows to route the traffic to the firewall in Pod1 for inspection before forwarding it to the original client.

The network-centric approach (1 VLAN = 1 BD = 1 EPG) is a common first step in migration because it mirrors the traditional network construct. However, its main drawback is that all devices within that legacy VLAN are now in the same EPG, and by default, all endpoints within an EPG can communicate freely. This fails to leverage the primary benefit of ACI: using contracts between more granular EPGs to achieve zero-trust micro-segmentation based on application function, not just network location.

This statement is false. Cisco MSO maintains a compatibility matrix that allows it to manage ACI fabrics running different, but compatible, versions of APIC software. While it's a best practice to keep versions closely aligned, they are not required to be identical. The MSO version must be compatible with the APIC versions of the sites it manages, as documented by Cisco.