Free 300-620 Practice Test Questions and Answers (2026)

To resolve the VRF route leaking issue and ensure that the route in the Non-Production:vrf-nonprod

VRF to the production tenant is present, the action that should be taken is to enable the “Shared

between VRFs” option for the bridge domain (BD) subnet in the production VRF. This setting allows

the subnet to be shared across different VRFs within the same tenant or across tenants, enabling

communication between EPGs that are in different VRFs1.

Reference:

ACI Inter VRF/Tenant Route Leaking Configuration Example

To complete the task of configuring a Layer 3 connection to the WAN router and allowing hosts in the

production VRF to access WAN subnets, the engineer should configure the Export Route Control

Subnet scope for the external EPG. This setting allows the subnets associated with the external EPG

to be advertised to external routers, enabling connectivity to the WAN.

:

The two protocols used for fabric discovery in Cisco ACI are LLDP (Link Layer Discovery Protocol) and

ISIS (Intermediate System to Intermediate System). LLDP is used for neighbor discovery on the data

link layer, while ISIS is a routing protocol used for reachability between the TEP IPs (VTEPs) within the

ACI fabric23.

Reference: https://www.dclessons.com/aci-fabric-discovery

To implement a Layer 3 out (L3Out) inside the Cisco ACI fabric that meets the specified requirements,

the following steps should be taken:

Configure the OSPF Protocol policy with an area of 0: This step involves setting up OSPF, a link-state

routing protocol that supports hierarchical network design, as the routing protocol for the L3Out1.

Create Routed Outside object and Node Profile, selecting OSPF: This step involves creating a Routed

Outside object and associating it with a Node Profile that specifies OSPF as the routing protocol1.

Build the Interface profile, selecting Routed Sub-interface and the appropriate VLAN: This step

involves creating an Interface profile for the connection to the data center core switch, using 802.1Q

tagging for VLAN separation2.

Configure the External Network object with a network of 0.0.0.0/0: This step involves setting up the

External Network object to advertise routes to the rest of the network1.

:

To enable inter-VRF communication, the following configurations are necessary:

Set the subnet scope to Shared Between VRFs: This allows the subnets to be shared across different

VRFs within the same tenant or across tenants, enabling communication between EPGs that are in

different VRFs1.

Export the contract and import as a contract interface: By exporting a contract from the provider

tenant and importing it as a contract interface in the consumer tenant, you establish a relationship

that allows for controlled communication between EPGs in separate VRFs or tenants1.

Reference:

ACI Inter VRF/Tenant Route Leaking Configuration Example1

MisCabling Protocol (MCP) detects loops from external sources (i.e., misbehaving servers, external

networking equipment running STP, etc.) and will err-disable the interface on which ACI receives its

own packet. Enabling this feature is a best practice, and it should be enabled globally and on all

interfaces, regardless of the end device. For MCP to be enabled, you need to have it enabled globally

and on a per-interface basis. While MCP is enabled on all interfaces by default, it is not turned “on”

until you also enable it globally. The global configuration knob for MCP can be enabled by configuring

the global settings here: Fabric > Access Policies > Global Policies > MCP Instance Policy default.

https://www.cisco.com/c/dam/en/us/solutions/collateral/data-center-virtualization/applicationcentric-infrastructure/aci-guide-using-mcp-mis-cabling-protocol.pdf

To enable communication between the external subnet and internal EPG1, and to allow L3Out traffic

to leak into the VRF named “VF1”, the following configuration set should be used:

External Subnets for External EPG: This configuration defines the subnets that are external to the ACI

fabric but need to be reachable from within the fabric. It is necessary to specify which subnets are to

be considered part of the L3Out1.

Shared Route Control Subnet: This setting allows the subnets to be shared across different VRFs,

enabling communication between EPGs that are in different tenants but within the same VRF1.

Shared Security Import Subnet: This configuration ensures that the security policies (contracts)

associated with the shared subnets are also imported, allowing for the necessary traffic to flow

between the internal and external endpoints1.

By applying this configuration set, the external subnet and internal EPG1 will be able to

communicate, and the L3Out traffic will be properly leaked into the designated VRF, meeting the

specified goals.

Reference:

ACI Inter VRF/Tenant Route Leaking Configuration Example1

To support cross-site connectivity in a production Multi-Site solution, where connectivity from EPGs

from a specific site to networks reachable through a remote site L3OUT is required, the additional

configuration that must be implemented in the Multi-Site Orchestrator is to add a new stretched

external EPG to the existing L3OUT1. This allows the EPGs from one site to communicate with the

networks defined in the L3OUT at the remote site, facilitating the required connectivity across sites.

Reference:

Cisco ACI Multi-Site Configuration Guide1

To perform a Cisco ACI fabric upgrade that minimizes the impact on user traffic and allows only

permitted users to perform an upgrade, the following configuration steps should be taken:

Divide Cisco APIC controllers into two or more maintenance groups: This step involves organizing the

APIC controllers into separate maintenance groups to allow for a phased upgrade process, reducing

the impact on user traffic5.

Divide switches into two or more maintenance groups: This step involves organizing the switches into

separate maintenance groups, which allows for a controlled and phased upgrade process, minimizing

the impact on the network during the upgrade5.

Reference: https://www.cisco.com/c/en/us/td/docs/dcn/whitepapers/cisco-application-centricinfrastructure-design-guide.html

The advantage of implementing an active-active firewall cluster that is stretched across separate

pods when anycast services are configured is that local traffic within a pod is load-balanced between

the clustered firewalls. This means that traffic destined for the anycast IP address of the service node

(firewall) will preferentially be directed to the local node within the same pod, thus optimizing traffic

flows and reducing latency by avoiding unnecessary traffic tromboning to a remote pod1.

To meet the requirements for the new endpoint group’s bridge domain in the Cisco ACI fabric, the

following actions must be taken:

Disable ARP Flooding: This action prevents ARP requests from being broadcast across the entire

bridge domain, which reduces excessive broadcast traffic.

Enable Limit IP Learning to Subnet: This setting restricts IP address learning to only those IPs within

the configured subnet, minimizing the impact of misconfigured virtual machines.

Enable Unicast Routing on the bridge domain and configure a subnet: Enabling unicast routing allows

the bridge domain to function as the default gateway for the subnet, ensuring that routing remains

within the Cisco ACI fabric.

When upgrading the Cisco ACI fabric through an intermediate release, the following steps should be

taken:

Upgrade the APICs to an interim release: This is the first step to ensure that the APICs are running a

stable version that is compatible with both the current and the targeted release1.

Upgrade the switches to an interim release: After the APICs are upgraded, the next step is to upgrade

the leaf and spine switches to the same interim release. This ensures that the entire fabric is running

on a compatible version before moving to the targeted release1.

Upgrade the APICs to the targeted release: Once the fabric is stable on the interim release, the APICs

can be upgraded to the targeted release. It’s important to verify that the APICs are fully operational

before proceeding to upgrade the switches1.

Upgrade the leaf and spine switches to the targeted release: The final step is to upgrade the leaf and

spine switches to the targeted release. This should be done after the APICs have been successfully

upgraded and are stable on the targeted release1.

By following these steps, the customer can successfully upgrade the Cisco ACI fabric to the new code

release that includes the desired feature.

To advertise the 0.0.0.0/0 prefix out on L3Out-2 OSPF, when it is configured as a default static route

on L3Out-1, the action that should be taken is to enable the Export Route Control Subnet. This setting

allows the default route to be advertised to other L3Outs, enabling the ACI fabric to act as a transit

network1.

Reference:

ACI Fabric L3Out White Paper - Cisco1

In Cisco ACI, when a packet is routed between two endpoints on different leaf switches, the VXLAN

VNID that is applied to the packet corresponds to the Bridge Domain (BD). The BD VNID is used to

encapsulate the packet for Layer 2 transport across the fabric. This VNID ensures that the packet is

delivered to the correct bridge domain, maintaining the segmentation and policy enforcement

required by the ACI fabric.

Reference:

Cisco ACI Fabric Forwarding White Paper

Cisco ACI Basic Configuration Guide

For external connections to the fabric that only require a default route, there is support for

originating a default route for OSPF, EIGRP, and BGP L3Out connections. If a default route is received

from an external peer, this route can be redistributed out to another peer following the transit export

route control as described earlier in this article. A default route can also be advertised out using a

Default Route Leak policy. This policy supports advertising a default route if it is present in the

routing table or it always supports advertising a default route. The Default Route Leak policy is

configured in the L3Out connection.

https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/2x/L3_config/b_Cisco_APIC_Layer_3_Configuration_Guide/b_Cisco_APIC_Layer_3_Configuration_Gui

de_chapter_010100.html

:

https://www.cisco.com/c/en/us/support/docs/cloud-systems-management/application-policyinfrastructure-controller-apic/221867-configure-in-band-management-in-aci.html Scope - Choose

according to the route leakage method you use. Here choose to use L3out, and then click Advertised

Externally.

In the Cisco ACI fabric, Spanning Tree Protocol (STP) Bridge Protocol Data Units (BPDUs) are flooded

within the bridge domain VLAN. This allows the BPDUs to be propagated throughout the bridge

domain, enabling STP to function correctly for the associated VLAN.