Cisco ACI Contract Exceptions vs Subject Exceptions Explained with Examples and Configuration Guide

Introduction

Cisco ACI contracts are used to control communication between Endpoint Groups (EPGs). They provide application-centric security by defining which EPGs can communicate and what traffic is permitted.

In large-scale environments, a single contract may be consumed by many EPGs. However, there are situations where certain EPGs must be excluded from using that contract without creating multiple duplicate contracts.

To solve this challenge, Cisco introduced Contract Exceptions and Subject Exceptions in APIC Release 3.2(1).

These features allow administrators to selectively deny contract participation while maintaining a clean, scalable, and easy-to-manage policy model.

---

Why Contract Exceptions and Subject Exceptions Are Needed

Consider a production application environment with the following EPGs:

Consumer EPGs:

• Web-EPG
• App-EPG
• Reporting-EPG
• Test-EPG

Provider EPG:

• Database-EPG

Contract:

• DB-Access

Normally all consumer EPGs can access the database through the contract.

Web-EPG → Database-EPG

App-EPG → Database-EPG

Reporting-EPG → Database-EPG

Test-EPG → Database-EPG

Now assume the security team decides that Test-EPG should not access the production database.

Without Contract Exceptions, you would need to create additional contracts and duplicate policies.

With Contract Exceptions, you can simply exclude Test-EPG from participating in the contract.

---

What is a Contract Exception?

A Contract Exception selectively excludes an EPG from participating in a contract.

The key point is that the exception applies to ALL subjects within the contract.

For example:

Contract Name: DB-Access

Subjects:

• SQL
• Backup
• Monitoring

If Test-EPG is configured as a Contract Exception, it will be denied access to every subject under the contract.

Result:

• Web-EPG = Allowed
• App-EPG = Allowed
• Reporting-EPG = Allowed
• Test-EPG = Denied

This is useful when an EPG should be completely excluded from the contract.

---

What is a Subject Exception?

A Subject Exception applies only to a specific subject inside a contract.

Instead of blocking an entire contract, it blocks access only to a particular service.

For example:

Contract Name: Shared-Services

Subjects:

• HTTP
• HTTPS
• SQL
• DNS

Requirement:

• HTTP = Allowed
• HTTPS = Allowed
• DNS = Allowed
• SQL = Denied

In this scenario, a Subject Exception is the ideal solution because only the SQL subject needs to be restricted.

---

Contract Exception vs Subject Exception

Contract Exception affects the entire contract.

Subject Exception affects only a single subject.

Contract Exception is used when an EPG must be excluded completely.

Subject Exception is used when only specific services must be denied.

Contract Exception provides broader control.

Subject Exception provides finer granular control.

---

Real-World Production Example

Consider a banking environment.

Consumer EPGs:

• Internet-Web
• Mobile-App
• ATM-Services
• Audit-Tools

Provider EPG:

• Database-EPG

Contract:

• Database-Access

Business Requirement:

• Internet-Web = Allowed
• Mobile-App = Allowed
• ATM-Services = Allowed
• Audit-Tools = Denied

Without Contract Exceptions, multiple contracts would be required.

Database-Access

Database-Access-NoAudit

Database-Access-ATM

Database-Access-Web

This creates unnecessary complexity.

A better design is:

One shared Database-Access contract plus a Contract Exception for Audit-Tools.

This reduces contract sprawl and simplifies management.

---

Cisco ACI Contract Exception Configuration

Objective

Allow:

• Web-EPG
• App-EPG
• Reporting-EPG

Deny:

• Test-EPG

For the DB-Access contract.

Step 1: Create the Contract

Navigate to:

Tenant → Contracts → Standard → Create Contract

Configure:

Contract Name: DB-Access

Scope: Tenant

Step 2: Create a Subject

Open the DB-Access contract.

Navigate to:

Subjects → Create Subject

Configure:

Subject Name: SQL

Step 3: Create a Filter

Create a filter with:

Protocol: TCP

Destination Port: 1433

Action: Permit

Attach the filter to the SQL subject.

Step 4: Provide the Contract

Navigate to Database-EPG.

Under Provided Contracts, attach DB-Access.

Step 5: Consume the Contract

Navigate to:

• Web-EPG
• App-EPG
• Reporting-EPG
• Test-EPG

Attach DB-Access as a Consumed Contract.

At this stage all EPGs can access the database.

Step 6: Create Contract Exception

Navigate to:

Tenant → Contracts → DB-Access → Exceptions

Click Create Exception.

Configure:

Exception Name: Block-Test-EPG

Consumer EPG: Test-EPG

Save and Deploy.

Final Result

• Web-EPG → Allowed
• App-EPG → Allowed
• Reporting-EPG → Allowed
• Test-EPG → Denied

Because the exception is configured at the contract level, all subjects are affected.

---

Cisco ACI Subject Exception Configuration

Objective

Allow Web-EPG to access:

• HTTP
• HTTPS
• DNS

Deny access to:

• SQL

Step 1: Create Contract

Create a contract called Shared-Services.

Step 2: Create Subjects

Create the following subjects:

• HTTP
• HTTPS
• SQL
• DNS

Step 3: Attach Filters

HTTP Subject:

TCP Port 80

Permit

HTTPS Subject:

TCP Port 443

Permit

SQL Subject:

TCP Port 1433

Permit

DNS Subject:

UDP Port 53

Permit

Step 4: Create Subject Exception

Navigate to:

Shared-Services → Subject SQL → Exceptions

Click Create Exception.

Configure:

Exception Name: Web-No-SQL

EPG: Web-EPG

Save and Deploy.

Final Result

For Web-EPG:

• HTTP → Allowed
• HTTPS → Allowed
• DNS → Allowed
• SQL → Denied

Other EPGs continue to access SQL if no Subject Exception exists for them.

---

How Packet Processing Works

When traffic is initiated:

Step 1: Cisco ACI identifies the source EPG.

Step 2: Cisco ACI identifies the destination EPG.

Step 3: Contract lookup is performed.

Step 4: Subject filters are evaluated.

Step 5: Contract and Subject Exceptions are checked.

Step 6: Traffic is either permitted or denied.

This enables very granular policy enforcement within the ACI fabric.

---

Logging and Visibility Features

Contract Exceptions and Subject Exceptions support:

Labels

Useful for policy identification.

Examples:

• Production-SQL
• PCI-Restricted
• Database-Security

Counters

Used to track:

• Permit Hits
• Deny Hits
• Bytes
• Packets

Permit and Deny Logging

Helpful during troubleshooting and audits.

Administrators can determine whether traffic was blocked due to:

• Contract Exception
• Subject Exception
• Deny Filter
• Missing Contract

---

Troubleshooting Tips

Verify zoning rules using:

show zoning-rule scope tenant

Monitor contract counters from:

Tenant → Operations → Counters → Contracts

Review:

• Permit Hits
• Deny Hits
• Packet Counts
• Byte Counts

Check Events and Faults under:

Operations → Events

Operations → Faults

This helps quickly identify policy-related connectivity issues.

---

Design Best Practices

Use Contract Exceptions when:

• Development EPGs must be blocked completely.
• Test EPGs must be isolated.
• Audit environments should not reach production systems.
• Temporary projects require full exclusion.

Use Subject Exceptions when:

• HTTP should be allowed but SQL denied.
• HTTPS should be allowed but SSH denied.
• DNS should be allowed but ICMP denied.

Avoid creating multiple duplicate contracts.

Instead of:

Web-To-DB

App-To-DB

ATM-To-DB

Audit-To-DB

Use:

Shared Database Contract

Plus

Contract Exception or Subject Exception

This creates a simpler and more scalable design.

---

Interview Questions

Q1. What is the difference between Contract Exception and Subject Exception?

Contract Exception applies to the entire contract and affects all subjects. Subject Exception applies only to a specific subject within the contract.

Q2 Can Contract Exceptions be configured for both Providers and Consumers?

Yes. Contract Exceptions can exclude both provider and consumer EPGs.

Q3. When should Subject Exceptions be used?

When only specific application services need to be denied while allowing other services within the same contract.

Q4. Which APIC release introduced Contract and Subject Exceptions?

APIC Release 3.2(1).

Q5. What is the main benefit of Contract Exceptions?

They reduce contract sprawl and simplify policy management.

---

Key Takeaways

• Contract Exceptions apply to the entire contract.
• Subject Exceptions apply to a specific subject only.
• Both features were introduced in APIC 3.2(1).
• They help implement granular micro-segmentation.
• They reduce the need for duplicate contracts.
• Logging, counters, labels, and deny/permit monitoring are fully supported.
• They improve scalability and operational simplicity in large Cisco ACI deployments.

---

Conclusion

Contract Exceptions and Subject Exceptions are powerful Cisco ACI features that help architects implement flexible micro-segmentation policies without increasing configuration complexity. Contract Exceptions are ideal when an EPG must be excluded from an entire contract, while Subject Exceptions are best suited for restricting access to specific services within a contract. By using these features effectively, organizations can simplify policy management, reduce contract sprawl, improve security, and maintain a cleaner ACI policy model across the fabric.

Recommended for: CCNP Data Center, CCIE Data Center, ACI Administrators, Data Center Engineers, Network Architects, and anyone designing secure Cisco ACI environments.

Summary

Related Links

Cisco ACI MoQuery – Advanced Commands for Day-to-Day Operations
Useful for verifying contracts, providers/consumers, subjects, filters, and Taboo contracts.
Read the MoQuery guide

What is a Contract Preferred Group in ACI?
Related to ACI contract policy and EPG communication within a VRF.
Read the Contract Preferred Group guide

Cisco ACI Explained: Concepts, Learning Prerequisites, Benefits, and Limitations
Provides a broader introduction to ACI contracts, EPGs, filters, and the deny-by-default model.
Read the Cisco ACI guide

Top 10 Cisco ACI Multiple Choice Questions (MCQs)
Useful for reinforcing contract scope, filter direction, consumer/provider relationships, and vzAny.
Read the ACI MCQs

L3Out Subnet Scope Options in Cisco ACI
Useful as a related policy/security topic, particularly for understanding external EPG security import subnets and contract-based traffic control.
Read the L3Out Subnet Scope guide

Cisco ACI vPC Explained – Architecture, Working, Traffic Flow, Configuration, Best Practices & Interview Questions

 

Cisco ACI vPC Explained: Architecture, Working, Benefits & Traffic Flow

High availability is one of the most important design goals in modern data centers. Whether you are deploying virtual machines, physical servers, firewalls, or storage arrays, network redundancy is essential to eliminate single points of failure.

Cisco Application Centric Infrastructure (ACI) provides a powerful feature called Virtual Port Channel (vPC) that allows an endpoint to connect simultaneously to two different leaf switches while appearing as a single logical switch from the endpoint's perspective. This design delivers redundancy, active-active forwarding, and efficient bandwidth utilization without relying on traditional Spanning Tree Protocol (STP) blocking.

In this guide, you'll learn:

• What Cisco ACI vPC is
• Why vPC is required
• How Cisco ACI vPC works internally
• Differences between traditional Nexus vPC and ACI vPC
• MCT architecture
• ZMQ communication
• Traffic flow
• Design options
• Best practices

Whether you're preparing for the CCNP Data Center, CCIE Data Center, or working in a production ACI environment, this guide will provide a solid understanding of Cisco ACI vPC.

Table of Contents

1. What is Cisco ACI vPC?
2. Why Do We Need vPC?
3. Traditional Network Challenges
4. Cisco ACI vPC Architecture
5. Components of vPC
6. MCT Architecture Explained
7. How Peer Communication Works
8. ZMQ and URIB Explained
9. Traffic Flow in Cisco ACI vPC
10. Benefits of Cisco ACI vPC
11. Design Best Practices

What is Cisco ACI vPC?

A Virtual Port Channel (vPC) in Cisco ACI enables two independent leaf switches to present themselves as a single logical switch to a connected device such as:

• Physical servers
• VMware ESXi hosts
• Hyper-V hosts
• Firewalls
• Load Balancers
• Storage Arrays
• Traditional Ethernet switches

The connected endpoint forms one LACP Port Channel, but the physical links terminate on two separate ACI leaf switches.

This provides:

✅ Link redundancy

✅ Switch redundancy

✅ Active-active forwarding

✅ Increased bandwidth

✅ Zero blocked links

Unlike traditional Layer 2 designs, both links remain forwarding simultaneously.

Why Do We Need vPC?

Imagine a server connected to only one switch.

Server
   |
 Leaf201

If Leaf201 fails, the server immediately loses connectivity.

Now imagine connecting the server to two switches without vPC.

      Server
      /    \
Leaf201   Leaf202

This creates a Layer-2 loop.

Traditional Ethernet networks solve loops using Spanning Tree Protocol (STP).

Unfortunately STP blocks one of the redundant links, wasting available bandwidth.

ACI vPC eliminates this limitation by allowing both links to remain active.

Result:

• No blocked ports
• Better utilization
• Higher availability
• Faster convergence

Traditional Nexus vPC vs Cisco ACI vPC

Many engineers assume ACI vPC works exactly like traditional Cisco Nexus vPC.

It does not.

Traditional Nexus vPC	Cisco ACI vPC
Uses dedicated peer-link	No dedicated peer-link
Uses CFS messaging	Uses ZMQ messaging
Manual synchronization	Fabric-based synchronization
Standalone switches	Fabric-managed leaf switches
Peer keepalive required	Fabric manages peer communication

This architectural difference is one of the biggest reasons Cisco ACI scales much better in large data centers.

Cisco ACI vPC Architecture

A typical deployment looks like this.

             Spine101
                 |
        -------------------
        |                 |
    Leaf201           Leaf202
        \               /
         \             /
          \           /
           Server (LACP)

Both Leaf201 and Leaf202 participate in a vPC domain.

The server believes it is connected to a single logical switch.

Internally, however, both leaf switches coordinate forwarding decisions through the ACI fabric.

Key Components of Cisco ACI vPC

1. Leaf Switches

Leaf switches provide endpoint connectivity.

Each endpoint connects to one or more leaf switches.

For vPC deployments:

• Two leaf switches form one logical vPC pair.
• Both switches actively forward traffic.
• Either switch can independently forward packets to the spine layer.

2. Spine Switches

Spine switches never connect directly to endpoints.

Their responsibilities include:

• Forwarding traffic between leaves
• Maintaining fabric connectivity
• Providing equal-cost paths
• Supporting IS-IS routing inside the fabric

Every leaf switch connects to every spine switch.

3. APIC Controller

The Application Policy Infrastructure Controller (APIC) is the management plane of Cisco ACI.

APIC performs:

• Policy management
• Automation
• Monitoring
• Fabric discovery
• Endpoint learning
• Configuration deployment

Importantly, APIC does not forward data traffic.

Even if APIC becomes unavailable, data forwarding continues because forwarding decisions are distributed across the fabric.

4. LACP Port Channel

The endpoint uses IEEE 802.3ad LACP.

Instead of seeing two independent switches, the endpoint sees one logical port channel.

This allows:

• Load balancing
• Automatic failure detection
• Link aggregation
• Active-active forwarding

Understanding MCT Architecture

One of the biggest differences between traditional Nexus vPC and Cisco ACI is the implementation of Multichassis Trunking (MCT).

Traditional Nexus switches require a dedicated peer-link between vPC peers.

Leaf1 -------- Peer Link -------- Leaf2

Cisco ACI removes this dependency.

Instead, synchronization occurs through the fabric itself.

Leaf201
    |
 Spine
    |
Leaf202

Benefits include:

• Simpler cabling
• No dedicated peer-link
• Better scalability
• Reduced operational complexity

This architecture allows leaf switches to synchronize state information without requiring a separate physical interconnect dedicated to vPC.

How Peer Communication Works

Cisco ACI uses the fabric network to exchange state information between vPC peers.

Internally:

1. Leaf201 discovers Leaf202 through the ACI fabric.
2. IS-IS establishes routing information.
3. URIB learns the peer's reachability.
4. The vPC Manager receives routing updates.
5. The vPC Manager establishes a communication channel using ZeroMQ (ZMQ).
6. Both leaf switches synchronize operational state for the vPC.

If the route to the peer becomes unavailable, the vPC Manager is notified and the logical MCT relationship is taken down accordingly, helping maintain a consistent operational state. This behavior aligns with Cisco's ACI vPC architecture and avoids relying on a dedicated peer-link.

What is ZeroMQ (ZMQ)?

One of the most common interview questions is:

Why does Cisco ACI use ZMQ instead of CFS?

ZeroMQ (ZMQ) is a lightweight, high-performance messaging library that Cisco ACI uses for communication between vPC peer switches.

Instead of sending synchronization data over a dedicated peer-link, the ACI fabric transports these messages over IP connectivity between the leaf switches.

Advantages of ZMQ include:

• Faster communication
• Lower overhead
• High scalability
• Reliable message delivery
• Better support for large-scale ACI fabrics

This messaging mechanism is one of the reasons Cisco ACI can simplify vPC design compared to traditional NX-OS implementations.

Understanding URIB

URIB (Unicast Routing Information Base) is responsible for maintaining routing information on each leaf switch.

The vPC Manager subscribes to URIB updates.

Whenever a new route to the peer leaf becomes available, URIB notifies the vPC Manager, allowing it to establish the required communication session.

If the route disappears because of a failure, URIB notifies the vPC Manager again so it can update the operational state appropriately.

Benefits of Cisco ACI vPC

Organizations deploy Cisco ACI vPC because it provides:

• High Availability: Loss of a single link or leaf switch does not interrupt connectivity.
• Active-Active Forwarding: Both uplinks remain in service, maximizing bandwidth utilization.
• Simplified Operations: No dedicated peer-link reduces cabling and operational complexity.
• Faster Convergence: Failures are detected and handled quickly, minimizing application downtime.
• Scalability: Fabric-based synchronization supports large-scale data center deployments.
• Efficient Load Balancing: Traffic is distributed across all active links.

Coming Up in Part 2

In the next part, we'll cover:

• Cisco ACI vPC Design Options (Combined vs Individual Profiles)
• Packet Flow Explained Step by Step
• Configuration Workflow in APIC
• Common Configuration Mistakes
• Best Practices
• Troubleshooting Commands
• 20 Cisco ACI vPC Interview Questions
• FAQ Section (Schema-ready)
• Conclusion
• Related Reading from Your Blog

📚 Related Cisco ACI Articles

If you're learning Cisco ACI from the ground up, these articles will help you understand the technologies that work together with Virtual Port Channel (vPC).

 1. Cisco ACI Explained – Concepts, Learning Prerequisites, Benefits & Interview Questions

If you're new to Cisco ACI, start with this comprehensive guide that covers the core architecture, policy model, and key building blocks before diving into advanced topics like vPC. It provides a strong foundation for understanding how the ACI fabric operates. Cisco ACI Explained – Concepts, Learning Prerequisites, Benefits & Interview Questions

2. Understanding VLAN Pool Roles in Cisco ACI

vPC deployments often use VLAN Pools to map VLAN encapsulations for endpoint connectivity. Learn the difference between Internal and External (On-the-Wire) VLAN Pool roles and understand when each should be used in production environments. Understanding VLAN Pool Roles in Cisco ACI

 3. Understanding Domain Types in Cisco ACI

Before configuring vPC, it's important to understand Physical Domains, L3 Domains, Fibre Channel Domains, and External Bridge Domains. This article explains where each domain type fits within the ACI policy model. Understanding Domain Types in Cisco ACI

4. Key Concepts of Application Profile in Cisco ACI

Application Profiles organize Endpoint Groups (EPGs) that communicate using policies and contracts. This guide explains how Application Profiles fit into the ACI hierarchy and why they're essential for application-centric networking. Key Concepts of Application Profile in Cisco ACI

5. Cisco ACI Static EPG Configuration – Step-by-Step Guide

After creating a vPC, you'll typically bind servers to an Endpoint Group (EPG). This practical walkthrough demonstrates how to configure a static EPG, associate it with a Bridge Domain, and apply the required policies. Cisco ACI Static EPG Configuration – Step-by-Step Deployment Guide

 6. Cisco ACI Port Channel Configuration (eth1/4 & eth1/5)

Want to configure a Port Channel in Cisco ACI? This article provides a detailed step-by-step guide for creating a Port Channel using LACP, configuring interface policies, AAEPs, domains, and deploying a Static EPG. It's an ideal follow-up after understanding vPC concepts. Cisco ACI Port Channel (eth1/4 & eth1/5) Trunk Configuration for VLAN 420

7. Configuring Port Profiles in Cisco ACI

Learn how Port Profiles work in Cisco ACI, including converting uplink ports to downlink ports using NX-OS style CLI. Understanding interface profiles and policy groups will help you design flexible and scalable vPC deployments. Configuring Port Profiles in Cisco ACI

8. L3Out Subnet Scope Options in Cisco ACI

Many production environments use vPC together with L3Out connections. This guide explains the different L3Out subnet scope options, including export, import, shared route control, and security import subnets, helping you design secure external connectivity. L3Out Subnet Scope Options in Cisco ACI

 9. What is a Contract Preferred Group in Cisco ACI?

Contract Preferred Groups simplify communication between Endpoint Groups (EPGs) within the same VRF by reducing the need for explicit contracts. Learn when to use this feature and how it affects traffic flow in Cisco ACI. What is a Contract Preferred Group in ACI?

Top 20 Data Center Interview Questions for Network Engineers (2026 Guide)

Introduction

If you are preparing for Data Center, Cisco Nexus, or VMware interviews, this guide provides important MCQs along with detailed explanations.

It helps you:

• Understand real concepts
• Prepare for interviews
• Build strong fundamentals

1. What is the role of the control plane in the Cisco Nexus switch?

• Controls switch management
• Controls access to the console
• Controls access to the remote console
• Runs network protocols like OSPF and Spanning Tree

Answer: Runs network protocols like OSPF and Spanning Tree
Explanation: The control plane is responsible for network decision-making. It runs routing protocols like OSPF and STP to determine how traffic should flow. It acts as the brain of the device, while the data plane forwards actual traffic.

2. Which option creates a Layer 3 isolated segment?

• Create a VRF instance
• Create a VLAN
• Create subnet in management VRF
• Create subnet in default VRF

Answer: Create a VRF instance
Explanation: VRF allows multiple routing tables on the same device, providing full isolation. It is widely used in multi-tenant environments where separation is required.

3. What are three components of vSphere? (Choose Three)

• ESXi hypervisor
• VMware Workstation
• vCenter Server
• Hyper-V Server
• Active Directory Server
• vSphere Web Client

Answer: ESXi hypervisor, vCenter Server, vSphere Web Client
Explanation: ESXi hosts the virtual machines, vCenter manages the infrastructure, and the Web Client provides GUI access for administration.

4. VM disk images characteristics (Choose Two)

• Files can be copied and moved
• Changes are not saved
• Works only on same hardware
• Stored as .vmdk files
• .vmdd extension used

Answer: Files can be copied and moved, Stored as .vmdk files
Explanation: VM disks are portable and stored as .vmdk files. This allows easy backup, cloning, and migration across environments.

5. Which connects virtual machines inside a hypervisor?

• VRF
• Virtual router
• Virtual center
• Virtual switch
• Virtual LAN

Answer: Virtual switch
Explanation: A virtual switch connects VMs internally and to external networks. It functions like a physical switch inside the hypervisor.

6. VXLAN encapsulation uses:

• Mac-in-TCP
• Mac-in-UDP
• Mac-in-Mac
• IPsec
• Mac-in-GRE

Answer: Mac-in-UDP
Explanation: VXLAN encapsulates Layer 2 frames into UDP packets, enabling Layer 2 communication over Layer 3 networks and supporting large-scale environments.

7. VXLAN packet destination MAC?

• Anycast gateway MAC
• Local VTEP MAC
• ESXi NIC MAC
• Broadcast MAC

Answer: Local VTEP MAC
Explanation: Encapsulated packets are sent to the destination VTEP, which handles decapsulation and forwards traffic to the target host.

8. OSPF Graceful Restart works in:

• Switch reload
• Supervisor switchover
• OSPF failure
• Misconfigured neighbor
• Misconfigured OSPF

Answer: Switch reload, Supervisor switchover
Explanation: Graceful restart ensures uninterrupted forwarding during control plane restarts, improving network availability.

9. What is a datastore?

• Physical ESXi storage
• Only VM storage
• Logical container for VMs
• Local storage only
• File-sharing storage

Answer: Logical container for VMs
Explanation: A datastore abstracts physical storage and holds VMs, templates, and ISO files, simplifying storage management.

10. When are multiple vNICs needed?

• Improve stability
• Multiple VMs
• Connect to multiple networks
• Reduce latency
• Internet access

Answer: Connect to multiple networks
Explanation: Multiple vNICs allow a VM to connect to different networks, improving segmentation and flexibility.

11. VXLAN forwarding statement:

• L2 lookup when MAC not local
• Anycast gateway always bridges
• MP-BGP uses VTEP IP as next hop
• Uses anycast VTEP as next hop

Answer: MP-BGP uses VTEP IP as next hop
Explanation: In VXLAN EVPN, MP-BGP distributes MAC/IP routes, and VTEP IP addresses are used as next hop for routing decisions.

12. VMware standard switch features (Choose Two)

• CDP support
• Visibility
• ACL support
• VLAN tagging support
• QoS
• STP participation

Answer: CDP support, VLAN tagging support
Explanation: Standard switches support VLAN tagging and CDP, enabling basic networking features within ESXi.

13. Purpose of CoPP:

• Blocks control traffic
• Drops attackers
• Limits control-plane traffic
• Monitors CPU only

Answer: Limits control-plane traffic
Explanation: CoPP protects the control plane by rate-limiting traffic, preventing CPU overload and improving device stability.

14. Management VRF characteristics (Choose Two)

• Not default
• mgmt0 uses it
• Default routing
• EIGRP supported
• Static routing supported
• OSPF supported

Answer: mgmt0 uses it, Static routing supported
Explanation: Management VRF is used for out-of-band management. It isolates management traffic from data traffic and supports static routing.

---

15. VRF-aware service command:

• Manual routing needed
• Auto detection
• Must specify always
• Uses default VRF
• Defaults to default if not specified

Answer: Defaults to default if not specified
Explanation: If VRF is not specified, the command runs in the default VRF. Explicit VRF mention is needed for non-default contexts.

16. Benefits of virtualization (Choose Three)

• Resource efficiency
• Better utilization
• Hardware issues reduced
• Licensing free
• Easy hardware movement
• VM portability
• Hardware independence

Answer: Resource efficiency, Better utilization, VM portability, Hardware independence
Explanation: Virtualization optimizes resource usage, allows easy VM migration, and abstracts hardware dependencies.

17. VM migration behavior:

• VM downtime
• Host shutdown
• Isolation
• No interruption

Answer: No interruption
Explanation: Features like vMotion enable live migration of VMs without downtime, ensuring service continuity.

18. Overlay network:

• Modify physical network
• Virtual addressing
• Uses physical infrastructure to carry virtual traffic
• Only in VMware

Answer: Uses physical infrastructure to carry virtual traffic
Explanation: Overlay networks run on top of physical networks using tunneling protocols like VXLAN.

19. Layer 3 encapsulation:

• No changes
• Change MAC
• Adds new header
• L2 tunnel
• Overlay creation

Answer: Adds new header
Explanation: Layer 3 encapsulation adds an IP header, enabling packets to travel across routed networks.

20. Anycast gateway:

• Same IP different MAC
• No mobility
• Needs ARP again
• Same IP and MAC

Answer: Same IP and MAC
Explanation: Anycast gateway uses the same IP and MAC across all VTEPs, allowing seamless host mobility without ARP changes.

AI Related Articles

Networklearner: Generative AI Fundamentals Explained for Beginners (With IT & Network Engineering Examples)

 

https://netterrene.blogspot.com/2026/06/generative-ai-quiz-beginners-mcq-answers.html

Top 15 Cisco Data Center Interview Questions with Answers (Spine-Leaf, SAN, HCI)

Introduction

This guide covers important Cisco Data Center interview questions with clear explanations. These questions are commonly asked in CCNA, CCNP Data Center interviews and real-world networking roles.

Q1 - Which two devices would you choose to be a part of the core layer in the three-tier network design? (Choose two.)

• Cisco Nexus 9500 Series Switch
• Cisco Catalyst 9800 Series Switch
• Cisco UCS 6200 Series Fabric Interconnect
• hypervisor
• Cisco Nexus 9300 Series Switch

Answer: Cisco Nexus 9500 Series Switch and Cisco Catalyst 9800 Series Switch

Explanation:
The core layer requires high-performance devices that provide:

• High throughput
• High availability
• Fast forwarding

Cisco Nexus 9500 is designed for core/spine roles in data centers. Catalyst 9800 can also act in aggregation/core roles in some architectures. Devices like UCS Fabric Interconnect and hypervisors are not part of the core switching layer.

Q2 - Which option lists the three tiers of a three-tier architecture?

• core, aggregation, and access
• core, spine, and leaf
• base, spine, and leaf
• physical, data link, and network

Answer: core, aggregation, and access

Explanation:
The traditional enterprise/data center network is divided into:

• Core layer → backbone connectivity
• Aggregation layer → policy enforcement & routing
• Access layer → connects end devices

This model is now being replaced by spine-leaf architecture in modern data centers.

Q3 - Cisco Unified Data Center is based on which three pillars of Cisco innovation? (Choose three.)

• Cisco Unified Computing System
• Cisco Unified Fabric
• Cisco Unified Access
• Cisco Unified Communications
• Cisco Unified Management
• Cisco Overlay Transport Virtualization
• Cisco FabricPath

Answer: Cisco Unified Management, Cisco Unified Computing System, Cisco Unified Fabric

Explanation:
Cisco Unified Data Center is built on:

• UCS → compute and server infrastructure
• Unified Fabric → converged network (LAN + SAN)
• Unified Management → centralized control

These pillars simplify operations and reduce infrastructure complexity.

Q4 - Which device would you choose to be a part of the core layer in a three-tier network design?

• Cisco UCS 6400 Series Fabric Interconnect
• Cisco Nexus 9500, Cisco Catalyst 6800, or Cisco Catalyst 6500 Series Switch
• hypervisor
• Cisco ASA security appliance

Answer: Cisco Nexus 9500, Cisco Catalyst 6800, or Cisco Catalyst 6500 Series Switch

Explanation:
Core layer devices must handle:

• Large-scale traffic aggregation
• High-speed switching
• Redundancy

Nexus 9500 and Catalyst 6500/6800 are modular switches designed for core environments.

Important Note - Spine-Leaf vs Three-Tier

A spine-leaf architecture provides:

• Better scalability → add spine/leaf easily
• Predictable low latency → always 2-hop path
• Higher performance → optimized for east-west traffic

Spine-leaf can provide approximately 25% better scalability compared to traditional three-tier designs.

Q5 - Which option describes the topology design in a spine-and-leaf network?

• The design uses a partial mesh of links at the leaf layer
• The design uses a full mesh of links between the leaf and aggregation layers
• The design uses a full mesh of links between the spine and leaf layers
• The design uses a full mesh of links at the leaf layer

Answer: The design uses a full mesh of links between the spine and leaf layers

Explanation:
In a spine-leaf topology:

• Every leaf connects to every spine
• There are no leaf-to-leaf links
• Traffic always flows in predictable paths

This ensures consistent latency and scalability.

Q6 - What are three benefits of the two-tier storage network design? (Choose three.)

• It is recommended for larger storage environments
• It is elastic in case of failures
• It is recommended for small-to-medium environments
• It is redundant through dual-fabric design
• It is very expensive
• It is a single point of failure
• It is optimum for IP storage

Answer:

• It is recommended for larger storage environments
• It is elastic in case of failures
• It is redundant through dual-fabric design

Explanation:
Two-tier storage designs provide:

• Redundancy using dual fabrics
• Fault tolerance during failures
• Scalability compared to single-tier designs

This is commonly used in enterprise SAN environments.

Q7 - Which statement about Cisco Compute Hyperconverged with Nutanix is correct?

• It provides network connectivity with the Cisco Nexus 9500 series switches
• Hardware compute platforms used are Cisco UCS blade servers
• The solution is a combination of hardware and software
• It uses SAN protocols like Fibre Channel

Answer: The Cisco Compute Hyperconverged with Nutanix solution is a combination of hardware and software

Explanation:
Hyperconverged infrastructure (HCI):

• Combines compute + storage + networking
• Uses software-defined storage
• Eliminates traditional SAN dependency

Nutanix solutions integrate tightly with Cisco UCS hardware.

Q8 - Cisco Unified Data Center infrastructure eliminates silos and allows consolidation of which option?

• LAN and WAN
• LAN and SAN
• LAN and WLAN
• performance and security management

Answer: LAN and SAN

Explanation:
Unified Fabric merges:

• LAN (Ethernet traffic)
• SAN (storage traffic)

This reduces:

• Cabling
• Complexity
• Operational cost

Q9 - In a spine-and-leaf topology, what is the minimum number of spines for redundancy?

• one
• two
• four
• six

Answer: two

Explanation:
At least two spines are needed:

• To avoid single point of failure
• To ensure high availability

If one spine fails, traffic can still flow through the second.

Q10 - What are two benefits of SAN storage network design? (Choose two.)

• Allows easier maintenance
• Redundant through dual fabric design
• Very affordable
• Single point of failure
• Optimum for IP storage

Answer:

• Allows easier maintenance
• Redundant through dual fabric design

Explanation:
SAN provides:

• Centralized storage management
• High availability with redundancy
• Improved server maintenance

Q11 - Which are three characteristics of a hyperconverged storage system? (Choose three.)

• easy expansion
• no SAN network
• usage of multiple storage arrays
• usage of redundant SAN switches
• easy deployment and maintenance
• fast convergence

Answer:

• easy expansion
• no SAN network
• easy deployment and maintenance

Explanation:
Hyperconverged systems:

• Scale easily by adding nodes
• Remove need for external SAN
• Simplify deployment and operations

Q12 - Which option lists the two tiers of a Clos-collapsed core architecture?

• aggregation and access
• spine and leaf
• spine and access
• collapsed core and leaf

Answer: spine and leaf

Explanation:
Clos architecture simplifies traditional design into:

• Spine layer (backbone)
• Leaf layer (access)

This improves scalability and performance.

Q13 - Small company storage expansion scenario

Question: Which network design approach is required?

• cloud storage solution
• three-tier network with Cisco MDS multilayer switches
• directly attached network
• storage area network

Answer: storage area network

Explanation:
When scaling storage:

• DAS becomes inefficient
• SAN provides centralized storage
• Supports multiple servers

Q14 - If you are running out of physical ports, what should you do?

• Add a core switch to each leaf
• Add core switches together
• Add a leaf switch connected to all spines
• Add a leaf switch to each leaf

Answer: Add an additional leaf switch and connect it to each spine

Explanation:
In spine-leaf design:

• Leaf switches connect end devices
• Adding a leaf increases port capacity
• No changes required in existing topology

Top Data Center Networking Interview Questions for CCNA & CCNP (Cisco Nexus Guide)

How Rogue Endpoint Detection Works in Cisco ACI

Cisco ACI continuously monitors endpoint behavior and identifies abnormal movement patterns.

Key Actions Performed:

• Detects endpoints moving frequently across leaf switches
• Marks the endpoint as rogue
• Converts the endpoint entry into a static entry
• Deletes the endpoint after a configured timeout
• Generates faults and alerts for visibility
• Sends host tracking packets to relearn correct location

👉 This ensures stability while preventing network disruption.

🔄 Behavior Based on Cisco ACI Version

Before Version 3.2(6)

• Endpoint is marked as static
• Traffic is dropped during quarantine
• MAC/IP entry is deleted after timeout

👉 Impact:
This behavior was highly disruptive because legitimate traffic could be blocked.

Version 3.2(6) and Later

• Endpoint is marked as static
• Traffic is allowed even during quarantine
• MAC/IP entry is deleted after timeout

👉 Improvement:
From version 3.2(6), Cisco improved the design to ensure:

• Minimal traffic disruption
• Better user experience
• Continued monitoring of rogue behavior

📊 Quick Comparison

Feature	Before 3.2(6)	After 3.2(6)
Endpoint Handling	Static	Static
Traffic During Quarantine	Dropped	Allowed
Network Impact	High	Low
Stability	Moderate	High

📝 Rogue / COOP Exception List

✅ Why It Is Needed

Some endpoints (like load balancers, clustered systems, or hypervisors) may naturally move frequently and should not be flagged as rogue.

📋 How Exception List Works

• Allows higher tolerance for endpoint movement
• Endpoint is marked rogue only after 3000 moves in 10 minutes
• Once marked:
  • Converted to static entry
  • Deleted after 30 seconds

👉 This avoids false positives while still protecting the network.

🆕 Enhancements from APIC 6.0(3)

Latest versions introduce more granular control:

New Capabilities

• Create global rogue exception lists
• Exclude specific MAC addresses from detection
• Apply exclusions across:
  • Bridge Domains
  • L3Out networks

👉 This is very useful in:

• Multi-tenant environments
• Large-scale data centers
• Automation-heavy environments

🚀 Real-World Use Case

Imagine a virtualized environment where VMs keep moving between hosts:

Without Rogue Detection:

• Continuous MAC flapping
• CPU spikes
• Control-plane instability

With Rogue Detection:

• Endpoint is quarantined
• Stability is restored
• Network continues to operate normally

💡 Best Practices

• Always enable Rogue Endpoint Detection in production fabrics
• Configure exception lists for:
  • Load balancers
  • VMware vMotion environments
• Monitor faults regularly in APIC
• Upgrade to ACI 3.2(6) or later for better behavior

💰

Cisco ACI Port Security – MAC Limit, Protect Mode & APIC Configuration Guide

 

Cisco ACI Port Security – MAC Limit, Protect Mode & APIC Configuration Guide

Cisco ACI Port Security is a critical feature for securing access layer ports in your ACI fabric. It controls the number of MAC addresses that can be learned on an interface, protecting against MAC flooding attacks and unauthorized device access.

In this guide, we cover everything you need to know — how it works, its restrictions, configuration steps in APIC, and how to monitor violations.

🔐 What is Cisco ACI Port Security?

Port Security in Cisco ACI limits the number of MAC addresses allowed to be learned on a given interface. When the limit is exceeded, ACI takes a Protect action — dropping traffic from unknown MAC addresses and temporarily halting MAC learning on that port.

This is especially useful in environments where you want to prevent rogue devices from flooding the ACI fabric's endpoint table (COOP database).

⚙️ Key Features of ACI Port Security

• MAC Limit: Set a maximum of 0 to 12,000 MAC addresses per interface.
• Protect Mode: The only supported violation action. Excess MACs are dropped silently.
• Learning Timeout: MAC learning is disabled temporarily (default: 60 seconds) when the limit is breached, then resumes automatically.
• Supported Interfaces: Physical ports, Port Channels, and vPCs.
• Monitoring: ACI generates faults and syslogs when the MAC limit is exceeded.

🚫 Restrictions & Limitations

• Port Security is not supported on FEX (Fabric Extender) ports.
• Only MAC address limits are enforced — MAC+IP sticky binding is not supported in ACI.
• You cannot configure "Shutdown" or "Restrict" violation modes (unlike classic NX-OS port security).

🛠️ Configuration Steps in APIC GUI

Follow these steps to configure Port Security in Cisco ACI via the APIC GUI:

1. Navigate to Fabric → Access Policies → Interface Policies → Port Security
2. Click + to create a new Port Security Policy
3. Set the Maximum Endpoints (MAC limit) — e.g., 5 for an access port
4. Set the Violation Action to Protect
5. Set the Timeout value (default 60 seconds)
6. Attach this policy to an Interface Policy Group (Leaf Access Port or vPC Policy Group)
7. Bind the Policy Group to your Interface Profile under the correct Switch Profile

📊 How Protect Mode Works — Step by Step

1. ACI learns MAC addresses on the port normally until the configured limit is hit.
2. Once the limit is reached, any new (unknown) source MAC is dropped at the leaf.
3. MAC learning is paused on that interface for the timeout duration.
4. After the timeout expires, learning resumes — if original MACs age out, new ones can be learned.
5. A fault is raised in APIC and a syslog is generated for visibility.

🔍 Monitoring Port Security Violations

You can monitor Port Security violations from:

• APIC GUI → Fabric → Inventory → Leaf → Faults
• Operations → Faults (filter by "port-security")
• Syslog forwarding to your external syslog server

💡 Interview Questions — Cisco ACI Port Security

If you are preparing for CCNP DC or CCIE Data Center interviews, here are common questions on this topic:

1. What violation modes are supported in ACI Port Security?
2. Can you configure Port Security on FEX ports?
3. What happens when a MAC limit is exceeded in Protect mode?
4. How long does the learning timeout last by default?
5. Where do you attach the Port Security policy in ACI?
6. What is the maximum MAC address limit you can set per interface in ACI?
7. How does ACI Port Security differ from NX-OS Port Security?

📚 Related Posts You May Also Like

• 👉 Cisco ACI – Fabric Secure Mode Overview
• 👉 Concept of vPC in ACI
• 👉 Complete Steps to Create vPC in Cisco ACI (via APIC)
• 👉 vPC EPG Deployment Rule
• 👉 ACI Contracts Components – Contracts vs Filters
• 👉 What is a Contract Preferred Group in ACI?
• 👉 Comparison Between CDP and LLDP in Cisco ACI
• 👉 ACI BFD Support Overview
• 👉 COOP: Council of Oracle Protocol – Cisco ACI
• 👉 ACI Leaf as Ethernet Hub – Spanning Tree Handling

Found this helpful? Leave a comment below or share it with your network. For Cisco ACI / Nexus consulting or freelancing, reach out at rockingoa@gmail.com

Cisco ACI Multi-Pod IPN Configuration Explained (Design, Requirements & Best Practices)

Introduction

In Cisco ACI Multi-Pod architecture, the Inter-Pod Network (IPN) is a critical component that connects spine switches across different pods. A properly designed IPN ensures stable control plane communication, efficient traffic forwarding, and overall data center reliability.

This guide explains IPN configuration requirements, supported hardware, and key design considerations for real-world deployments.

Why IPN Is Important in ACI Multi-Pod

The IPN enables communication between multiple ACI pods and is responsible for:

• MP-BGP control plane communication
• Endpoint information exchange
• Forwarding BUM traffic (Broadcast, Unknown Unicast, Multicast)
• Maintaining inter-pod connectivity

Incorrect IPN design can lead to MP-BGP instability, endpoint learning issues, and network outages.

Mandatory IPN Configuration Requirements

Routed Sub-Interface with VLAN 4

IPN interfaces must be configured as routed sub-interfaces using VLAN 4. Other configurations like routed physical ports or SVIs are not supported.

Jumbo MTU Requirement

IPN devices must support an MTU of 9150 bytes. All devices in the path must support jumbo frames.

If MTU is not consistent:

• MP-BGP adjacency may flap
• VXLAN traffic may fail

PIM BiDir Support

IPN must support PIM Bidirectional mode.

This is required to handle:

• Broadcast traffic
• Unknown unicast traffic
• Multicast traffic

OSPF Routing Protocol

• Only OSPF is supported between IPN devices and ACI spine switches.
• Other routing protocols like BGP and EIGRP cannot be used in this scenario.

DHCP Relay Requirement

If you plan to deploy additional pods using Zero Touch Provisioning (ZTP), DHCP relay must be configured on the IPN network.

QoS Policy Recommendation

QoS is not mandatory but recommended.

It helps prioritize:

• Control plane traffic
• MP-BGP updates
• Critical ACI communication

Design Best Practices

For a stable Multi-Pod deployment, ensure:

• End-to-end MTU consistency
• Redundant IPN paths
• Correct multicast design
• Stable OSPF neighbor relationships

These factors directly impact performance and scalability.

Supported IPN Hardware

IPN devices must support all required features such as MTU, PIM BiDir, and OSPF.

Commonly used hardware includes:

• Cisco Nexus 7000
• Cisco ASR 1000 Series
• Nexus N3K-C3548P-10GX

Unsupported hardware:

• Nexus N3K-C3172PQ-10GE

Always validate hardware capability before deployment.

Real-World Deployment Tips

• Verify MTU end-to-end before deployment
• Validate multicast configuration carefully
• Monitor MP-BGP sessions between pods
• Use QoS to protect control plane traffic
• Avoid unsupported hardware

Important Cisco ACI IPN Questions (Multi-Pod Interview Guide)

1. What are the Cisco ACI IPN configuration requirements?

Answer:
Key requirements for IPN in ACI Multi-Pod include:

• Routed sub-interface using VLAN 4
• MTU size of 9150 across the entire path
• Support for PIM Bidirectional (BiDir)
• OSPF as the routing protocol
• DHCP relay for zero-touch deployment (optional but recommended)
• QoS for prioritizing control-plane traffic

Explanation:
These requirements ensure stable communication between pods. Any mismatch (especially MTU or VLAN) can cause MP-BGP instability and traffic drops.

2. Why is VLAN 4 used in Cisco ACI IPN?

Answer:
VLAN 4 is a mandatory VLAN used for IPN connectivity between ACI spine switches across different pods.

Explanation:
Cisco ACI is designed to use VLAN 4 internally for IPN communication. It cannot be changed or replaced. This ensures standardized communication and compatibility in Multi-Pod deployments.

3. Why is MTU 9150 required in Cisco ACI?

Answer:
MTU 9150 is required to support VXLAN encapsulated traffic in ACI Multi-Pod environments.

Explanation:
VXLAN adds additional headers to packets. If MTU is less than 9150:

• Packets may get fragmented
• MP-BGP sessions may flap
• Traffic forwarding may fail

Ensuring jumbo frame support across all devices is critical.

4. What is the role of PIM BiDir in ACI Multi-Pod?

Answer:
PIM Bidirectional (BiDir) is used to carry BUM traffic (Broadcast, Unknown Unicast, Multicast) across pods.

Explanation:
In ACI Multi-Pod:

• BUM traffic must reach all endpoints
• PIM BiDir provides efficient multicast forwarding
• Reduces unnecessary flooding

This ensures optimized and scalable communication between pods.

5. How does IPN work in Cisco ACI Multi-Pod?

Answer:
IPN acts as a Layer 3 interconnect between spine switches of different pods.

Explanation:
It enables:

• MP-BGP exchange between spines
• Endpoint learning across pods
• VXLAN traffic forwarding

Traffic flow:

• Leaf → Local Spine → IPN → Remote Spine → Remote Leaf

This ensures seamless communication across geographically separated data centers.

6. What are the best practices for ACI Multi-Pod IPN design?

Answer:
Best practices include:

• Ensure MTU 9150 end-to-end
• Use redundant IPN paths
• Enable PIM BiDir correctly
• Maintain stable OSPF adjacency
• Implement QoS for control traffic
• Avoid unsupported hardware

Explanation:
Following these practices prevents:

• Traffic loss
• Control plane instability
• Fabric outages

A properly designed IPN ensures scalability and high availability.