To facilitate communication between EPG1 in VRF1 and External EPG in VRF2, the following actions

are necessary:

Enable Shared Route Control Subnet: This allows subnets to be shared across different VRFs, which is

essential for inter-VRF communication.

Enable External Subnets for External EPG: Activating this makes the subnets within the External EPG

routable to external networks.

Enable Import Route Control Subnet: This enables the importation of routes from L3Out into the VRF,

permitting connectivity between different VRFs.

These steps ensure that routing and security policies are correctly implemented to permit traffic flow

between EPG1 and External EPG across distinct VRFs.

Reference: Implementing Cisco Application Centric Infrastructure Official Cert Guide

When a packet is routed between two endpoints on different Cisco ACI leaf switches, the VXLAN

VNID applied to the packet is the VRF (Virtual Routing and Forwarding) VNID. This VNID enables

forwarding of the packet through tenant virtual routing and forwarding domains within the fabric34.

Reference := Cisco APIC Layer 3 Networking Configuration Guide, Release 3.x and later

In an Active-Active Across Pods deployment mode, traffic is intelligently redirected to the firewall

that currently owns the connection state, allowing for efficient use of network

resources. Additionally, the connection state being unsynchronized means that each pod can

independently manage its connections without relying on a centralized state, enhancing the

resilience and scalability of the network1.

Reference := (Implementing Cisco Application Centric Infrastructure Official Cert Guide)

The Forwarding Tag (FTAG) in Cisco ACI is used to load balance multi-destination traffic. FTAG trees

facilitate efficient forwarding of multicast traffic within the fabric, ensuring optimal distribution and

load balancing across multiple paths. All multi-destination traffic is encapsulated within VXLAN, and

FTAG trees play a crucial role in achieving efficient traffic flow345.

Reference: Implementing Cisco Application Centric Infrastructure Official Cert Guide

The output shows details of tunnel 6 within a Cisco ACI fabric. The transport protocol is listed as

“isvlan,” which is typically associated with the GRE protocol in Cisco ACI terminology. GRE, a

tunneling protocol developed by Cisco, encapsulates various network layer protocols inside virtual

point-to-point links over an IP internetwork. Reference: Implementing Cisco Application Centric

Infrastructure Official Cert Guide

To advertise routes from border leaf switches to compute leaf switches in a shared services scenario,

the shared L3Out should be defined in the common tenant. This allows all tenants to access the

shared services provided by the L3Out. By configuring the L3Out in the common tenant, routes can

be advertised to the compute leaf switches, ensuring that the services are available across the ACI

fabric.

Reference: Implementing Cisco Application Centric Infrastructure Official Cert Guide

The L2 Stretch feature allows for the extension of a Layer 2 network across multiple sites without

changing the IP addressing scheme, which satisfies the requirement for starting an application at a

DR site without re-IPing servers. Disabling inter-site BUM (Broadcast, Unknown unicast, and

Multicast) traffic prevents broadcast storms between sites while still allowing IP mobility, meeting

both specified criteria. Reference := (Implementing Cisco Application Centric Infrastructure Official

Cert Guide)

When allowing routes learned from one L3Out to be advertised out another L3Out, the Export Route

Control Subnet should be enabled, and Aggregate Export should also be enabled. This configuration

allows the necessary routes within the specified CIDR block to be aggregated and advertised out,

facilitating efficient route advertisement without the need for an explicit list of all routes.

Reference: Implementing Cisco Application Centric Infrastructure Official Cert Guide

To create an exit point from all the tenants using the common tenant after removing RT-2 and RT-3

devices, the following two configuration tasks must be completed:

Update L3Out ExtEPG Subnet: The L3Out ExtEPG subnet in the common tenant should be updated

with the flag “Shared Route Control Subnet” and “Aggregate Shared Routes” (Option C). This

configuration allows for the sharing of routes between different tenants through a common exit

point.

Mark Subnets and Attach Contract: All subnets should be marked with the flag “Shared between

VRFs,” and contract Ctr-3 should be attached as a provider to all the EPGs (Option D). This ensures

that all EPGs can provide services under contract Ctr-3 across different VRFs, facilitating inter-tenant

communication via shared routes. Reference := (Implementing Cisco Application Centric

Infrastructure Official Cert Guide)

In a Cisco ACI Multi-Site deployment, proper configuration of the inter-site link is crucial for traffic to

pass between different sites. The MTU size is particularly important; if it’s not set correctly, packets

may be dropped or fragmented, leading to connectivity issues. By configuring the MTU on the link to

be at least 100 bytes larger than that of the ACI fabrics, you allow for encapsulation overhead

without packet drops due to exceeding MTU limits. Additionally, configuring the link as a routed

subinterface using VLAN-4 is necessary for routing across different broadcast domains, which is

essential for inter-site communication in an ACI fabric. Reference: Implementing Cisco Application

Centric Infrastructure Official Cert Guide