An engineer must attach an ESXi host to the Cisco ACI fabric. The host is connected to Leaf 1 and has its gateway IP address 10.10.10.254/24 configured inside the ACI fabric. A new firewall is attached to Leaf 2 and mapped to the same EPG and BD as the ESXi host. The engineer must migrate the gateway of the ESXi host to the firewall. Which configuration set accomplishes this goal?
Answer(s): B
Option B is correct because in ACI, moving the default gateway for VMs/hosts to an external firewall requires the host network to be L3-routed via the firewall while preserving the EPG/BD association. Disabling unicast routing prevents hosts in the same BD from routing to the firewall, allowing gateway traffic to be handled by the firewall device attached to Leaf 2. Enabling unicast routing (C, D) would permit internal routing within the BD, which would keep the gateway within the BD rather than migrating to the firewall. Options A and B are duplicates; the correct choice is B.
A Cisco ACI fabric with an ARP packet must ensure detection of silent hosts with an ARP packet. The current bridge domain is configured with hardware proxy and unicast routing. Which step must be taken on the bridge domain to complete the configuration?
Answer(s): D
Option D is correct because enabling ARP Flooding in the bridge domain ensures ARP packets from silent hosts are propagated to all relevant endpoints, allowing detection when hardware proxy with unicast routing is configured but ARP responses from unknown/silent hosts must still be flooded to learn paths.A) Incorrect — Optimized Flood for L3 Unknown Multicast controls multicast flooding behavior, not ARP handling for silent hosts.B) Incorrect — Flood in MDF is about general multicast traffic; it does not address ARP propagation for host detection with ARP proxy.C) Incorrect — L2 Unknown Unicast to Flood affects unknown unicast frames; ARP-specific flooding is the correct mechanism for ARP detection.
A network engineer configures a Cisco ACI fabric with this configuration:· Endpoint-1 with an IP address 10.1.0.1/24 is attached to Leaf-101. · Endpoint-2 with an IP address 10.1.0.2/24 is attached to Leaf-102.· Both endpoints are in EPG-A.· The bridge domain for EPG-A is called BD-A and contains a single subnet 10.1.0.254/24.· Endpoint-1 cannot reach Endpoint-2.Which action allows Endpoint-1 to communicate with Endpoint-2?
Answer(s): A
Option A is correct because L2 Unknown Unicast to Hardware Proxy forces the leaf to forward unknown L2 unicast traffic to the spine, enabling inter-EPG communication within the same BD/EPG when no ARP learning path exists across leaves. This addresses inter-leaf L2 forwarding for endpoints in the same EPG when BD subnet is only 10.1.0.254/24 and endpoints 10.1.0.1/24 and 10.1.0.2/24 reside on different leaves.B is incorrect because a contract is not required for same-EPG communication; contracts govern L3/L4-L7 policies between EPGs or external endpoints, not intrinsic BD L2 reachability.C is incorrect because a contract with a preferred group is still a contract, and the scenario involves L2 reachability within the same EPG, not L3/L4 policy.D is incorrect because silent host detection affects host movement events, not L2 forwarding between endpoints in the same BD/EPG.
An engineer configures two Cisco ACI leaf switches called Leaf1 and Leaf2 as VPC peers. The server called S1 is connected to Leaf1 with a port channel interface. How is S1 learned in the endpoint table of Leaf2?
Option D is correct because in a VPC pair, endpoints on one leaf (Leaf1) that are attached to a port-channel are learned on the peer leaf (Leaf2) as on-peer endpoints, enabling cross-peer MAC/IP learning without violating VPC isolation. Incorrect — A: remote endpoint is not the defined term for an endpoint learned on the peer in VPC; B: bounce entry endpoint is not applicable to standard VPC endpoint learning; C: local endpoint would indicate the endpoint is learned on the local leaf, not Leaf2; D: on-peer endpoint is the correct Cisco terminology for endpoints learned via VPC peer adjacency.
https://www.cisco.com/c/en/us/solutions/collateral/data-center-virtualization/application-centric- infrastructure/white-paper-c11-739989.html
How does Cisco ACI detect the IP address of a silent host that moved from one location to another without notifying a Cisco ACI leaf?
Answer(s): C
Option C is correct because ARP requests are flooded in the bridge domain to learn the IP/MAC mapping when a silent host moves, enabling the fabric to detect the new location without prior notification to a specific leaf. Incorrect — A: Silent hosts are not detected by the fabric independently; movement is learned via ARP/ND resolution, not passive detection. Incorrect — B: COOP (Connectivity-Out-of-Place) is not involved in host movement detection at the leaf; endpoint announce messages are not sent to COOP for this purpose. Incorrect — D: Bounce entries are used for specific failure scenarios, not for detecting silent host movement or IP address learning.
A Cisco ACI fabric contains 10 standalone leaf switches. An engineer must configure only the first two leaf switches in a VPC. Which VPC protection type must be configured to accomplish this goal?
Option B is correct because explicit VPC protection type allows targeted protection configuration on specific leaf pairs, enabling only the first two leaves to participate in the VPC while others are protected or ignored as needed. This provides precise control over which switches form the VPC domain, aligning with the requirement to configure only the first two leaves. Incorrect — A) serial: not a VPC protection mode; it does not define selective leaf participation. C) reciprocal: not a valid VPC protection type in Cisco ACI. D) consecutive: not a recognized VPC protection type and does not convey selective activation of a subset of leaves.
Which endpoint type is used when the entries are pushed down from the COOP database of the spine switches to the ACI leaf switches?
In a Cisco ACI fabric, remote endpoint entries are pushed from the COOP (Council of Oracles Protocol) database on the spine switches to the leaf switches. The COOP database stores endpoint information for the entire fabric, and when a leaf switch needs information about an endpoint located on a different leaf switch, the entry is retrieved from the COOP database. This allows the leaf switch to forward traffic to the remote endpoint efficiently.
A Cisco ACI leaf node has received a Layer 2 frame from an unknown endpoint. The bridge domain is configured for Hardware Proxy. Which action will the ACI fabric take on the traffic?
When a Cisco ACI bridge domain is configured for Hardware Proxy mode, the leaf node does not flood unknown Layer 2 frames within the bridge domain. Instead, the leaf sends the frame to a spine node. The spine node checks its COOP (Council of Oracles Protocol) database to determine the endpoint location. If the COOP database does not have information about the endpoint, the spine node drops the traffic, as flooding is not allowed in Hardware Proxy mode. This behavior optimizes network traffic by reducing unnecessary flooding.
Post your Comments and Discuss Cisco 300-620 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the 300-620 content, but please register or login to continue.