To perform a Cisco ACI fabric upgrade that minimizes the impact on user traffic and allows only

permitted users to perform an upgrade, the following configuration steps should be taken:

Divide Cisco APIC controllers into two or more maintenance groups: This step involves organizing the

APIC controllers into separate maintenance groups to allow for a phased upgrade process, reducing

the impact on user traffic5.

Divide switches into two or more maintenance groups: This step involves organizing the switches into

separate maintenance groups, which allows for a controlled and phased upgrade process, minimizing

the impact on the network during the upgrade5.

Reference: https://www.cisco.com/c/en/us/td/docs/dcn/whitepapers/cisco-application-centricinfrastructure-design-guide.html

The advantage of implementing an active-active firewall cluster that is stretched across separate

pods when anycast services are configured is that local traffic within a pod is load-balanced between

the clustered firewalls. This means that traffic destined for the anycast IP address of the service node

(firewall) will preferentially be directed to the local node within the same pod, thus optimizing traffic

flows and reducing latency by avoiding unnecessary traffic tromboning to a remote pod1.

To meet the requirements for the new endpoint group’s bridge domain in the Cisco ACI fabric, the

following actions must be taken:

Disable ARP Flooding: This action prevents ARP requests from being broadcast across the entire

bridge domain, which reduces excessive broadcast traffic.

Enable Limit IP Learning to Subnet: This setting restricts IP address learning to only those IPs within

the configured subnet, minimizing the impact of misconfigured virtual machines.

Enable Unicast Routing on the bridge domain and configure a subnet: Enabling unicast routing allows

the bridge domain to function as the default gateway for the subnet, ensuring that routing remains

within the Cisco ACI fabric.

When upgrading the Cisco ACI fabric through an intermediate release, the following steps should be

taken:

Upgrade the APICs to an interim release: This is the first step to ensure that the APICs are running a

stable version that is compatible with both the current and the targeted release1.

Upgrade the switches to an interim release: After the APICs are upgraded, the next step is to upgrade

the leaf and spine switches to the same interim release. This ensures that the entire fabric is running

on a compatible version before moving to the targeted release1.

Upgrade the APICs to the targeted release: Once the fabric is stable on the interim release, the APICs

can be upgraded to the targeted release. It’s important to verify that the APICs are fully operational

before proceeding to upgrade the switches1.

Upgrade the leaf and spine switches to the targeted release: The final step is to upgrade the leaf and

spine switches to the targeted release. This should be done after the APICs have been successfully

upgraded and are stable on the targeted release1.

By following these steps, the customer can successfully upgrade the Cisco ACI fabric to the new code

release that includes the desired feature.

To advertise the 0.0.0.0/0 prefix out on L3Out-2 OSPF, when it is configured as a default static route

on L3Out-1, the action that should be taken is to enable the Export Route Control Subnet. This setting

allows the default route to be advertised to other L3Outs, enabling the ACI fabric to act as a transit

network1.

Reference:

ACI Fabric L3Out White Paper - Cisco1

In Cisco ACI, when a packet is routed between two endpoints on different leaf switches, the VXLAN

VNID that is applied to the packet corresponds to the Bridge Domain (BD). The BD VNID is used to

encapsulate the packet for Layer 2 transport across the fabric. This VNID ensures that the packet is

delivered to the correct bridge domain, maintaining the segmentation and policy enforcement

required by the ACI fabric.

Reference:

Cisco ACI Fabric Forwarding White Paper

Cisco ACI Basic Configuration Guide

For external connections to the fabric that only require a default route, there is support for

originating a default route for OSPF, EIGRP, and BGP L3Out connections. If a default route is received

from an external peer, this route can be redistributed out to another peer following the transit export

route control as described earlier in this article. A default route can also be advertised out using a

Default Route Leak policy. This policy supports advertising a default route if it is present in the

routing table or it always supports advertising a default route. The Default Route Leak policy is

configured in the L3Out connection.

https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/2x/L3_config/b_Cisco_APIC_Layer_3_Configuration_Guide/b_Cisco_APIC_Layer_3_Configuration_Gui

de_chapter_010100.html

:

https://www.cisco.com/c/en/us/support/docs/cloud-systems-management/application-policyinfrastructure-controller-apic/221867-configure-in-band-management-in-aci.html Scope - Choose

according to the route leakage method you use. Here choose to use L3out, and then click Advertised

Externally.

In the Cisco ACI fabric, Spanning Tree Protocol (STP) Bridge Protocol Data Units (BPDUs) are flooded

within the bridge domain VLAN. This allows the BPDUs to be propagated throughout the bridge

domain, enabling STP to function correctly for the associated VLAN.