To redirect HTTP traffic between an EPG client and EPG server through a Cisco ASA firewall in a Cisco

ACI environment, a contract filter must be configured to allow both ARP and HTTP. ARP is essential

for IP to MAC address resolution, which is necessary for layer 2 communications within the same

subnet or across subnets when routing is involved. The HTTP filter ensures that only HTTP traffic is

redirected to the firewall for inspection or policy enforcement. Reference: Implementing Cisco

Application Centric Infrastructure Official Cert Guide

https://kxbjsyuhceggsyvxdkof.supabase.co/storage/v1/object/public/file-images/300-630/page_28_img_1.jpg

Before associating a schema with a newly configured site in Cisco ACI Multi-Site Orchestrator, it’s

essential to configure a provider. This establishes a communication link between the orchestrator

and the sites, enabling proper deployment and management of objects across multiple sites.

In a Cisco ACI Multi-Pod environment that is expanding, spine headend replication should be

configured to ensure efficient forwarding of BUM (Broadcast, Unknown unicast, Multicast) traffic

across the IPN (Inter-Pod Network). This configuration optimizes the control plane scaling and

ensures that BUM traffic is handled effectively, maintaining network performance and stability.

Reference: Implementing Cisco Application Centric Infrastructure Official Cert Guide

The minimum MTU value that must be supported by the ISN to allow control plane endpoint

information exchange between sites in a Cisco ACI Multi-Site setup with default settings is 1554

bytes (B). This accounts for the standard MTU of 1500 bytes plus additional overhead for VXLAN

encapsulation. An MTU of 9000 (A) or 9100 © is not the minimum required, and 1600 (D) is not

related to the default fabric settings5. Reference := (Multi-site / Multi-Pod MTU Jumbo Frames5)

To address loops detected from endpoints in a Cisco ACI fabric, the engineer should enable the

rogue endpoint feature and set the Error Disabled Recovery Policy. This will allow the system to

detect rogue endpoints causing loops and automatically recover the port if it was disabled due to the

loop detection2.

Reference := ( Implementing Cisco Application Centric Infrastructure Official Cert Guide )

The best practices for configuring NIC teaming load balancing for Cisco UCS B-Series blades

connected to Cisco ACI leaf switches involve enabling LACP (Link Aggregation Control Protocol) in

active mode and enabling MAC pinning.

LACP active mode (option B) allows for the automatic bundling of several physical links into a single

logical link, providing redundancy and increased bandwidth. This mode actively tests the link to

ensure its functionality, which is essential for maintaining a stable connection.

MAC pinning (option E) is a method that assigns a virtual machine’s MAC address to a specific uplink.

This ensures consistent forwarding paths for traffic within the same session, which is crucial for

avoiding potential traffic distribution issues that could arise from dynamic changes in the network

topology.

Creating vPC+ (option A) and vPC (option D) are not recommended as they are related to virtual port

channels, which are not applicable in this scenario. PAgP (Port Aggregation Protocol) (option C) is

Cisco’s proprietary protocol similar to LACP, but it is not the recommended practice in this context.

Reference :=

Implementing Cisco Application Centric Infrastructure Official Cert Guide

Cisco’s documentation on UCS B-Series Teaming Bonding Options

To enable SSH communication between Web_EPG (Web Endpoint Group) and App_EPG (Application

Endpoint Group), it’s necessary to apply a configuration that allows bidirectional communication

while not restricting ports based on their directionality. By enabling “Apply Both Directions” and

disabling “Reverse Filter Ports,” this ensures that the filter allows SSH packets to flow from Web_EPG

to App_EPG and vice versa without any restrictions based on the port’s direction, which is essential

for establishing an SSH session. Reference := ( Implementing Cisco Application Centric Infrastructure

Official Cert Guide )

The integration of service nodes in transparent mode with a Cisco ACI Multi-Pod setup is achieved by

using an active-standby firewall mode stretched across pods. This configuration ensures that the

standby node takes over if the active node fails, providing high availability and seamless

operation. Reference := Cisco ACI Multi-Pod and Service Node Integration White Paper

To allow only the return traffic to be redirected to the service node when the load balancer does not

perform source NAT, we need to configure a Policy-Based Redirect (PBR). Here’s how it can be

achieved:

Create a Contract:

Create a contract linked to the common/default filter. This contract will define the communication

rules between the client endpoint and the server endpoint.

Configure L4-L7 Device:

Create an L4-L7 device with the function type set to “GoThrough.” This device will be used to redirect

traffic to the service node.

Create a Policy-Based Redirect Policy:

Set up a Policy-Based Redirect (PBR) policy.

Specify the L3 Destination as the load balancer’s inside IP/MAC address.

Ensure that the L4-L7 Policy-Based Redirect Policy has the “GoThrough” function type.

Create a Service Graph Template:

Define a service graph template that

the previously created contract and L4-L7 device.

Apply the service graph template to the relevant connectors.

Connector Configuration:

On the consumer connector, reference the L4-L7 Policy-Based Redirect Policy.

On the provider connector, also reference the L4-L7 Policy-Based Redirect Policy.

By following this configuration, only the return traffic (from the server to the client) will be redirected

to the service node, ensuring proper load balancing and traffic management.

Reference:

Implementing Cisco Application Centric Infrastructure Official Cert Guide