CCNP Data Center Application Centric Infrastructure 300-620 DCACI Official Cert Guide

Ammar Ahmadi, CCIE No. 50928, has nearly a decade of experience in data center design, implementation, optimization, and troubleshooting. He currently consults for Cisco Gold partner AHEAD INC, where he has been designing and supporting large-scale ACI fabrics since the early days of ACI. Occasionally, he breaks from design work to produce network modernization roadmaps or demonstrate the possibilities of software-defined networking (SDN) to customers.Ammar also owns and operates Networks Reimagined LLC, which focuses on SDN enablement and training. He can be reached at ammar.ahmadi@networksreimagined.com.

• Introduction xxvPart I Introduction to DeploymentChapter 1 The Big Picture: Why ACI? 2“Do I Know This Already?” Quiz 2Foundation Topics 4Understanding the Shortcomings of Traditional Networks 4Network Management 4Scalability and Growth 5Network Agility 8Security 8Network Visibility 9Recognizing the Benefits of Cisco ACI 9Network Management Touchpoints 9Traffic Flow Optimizations 10Scalability Optimizations 10Programmability 11Stateless Network 11Multitenancy 11Zero-Trust Security 14Cross-Platform Integrations 15New Architectural Possibilities 15Integrated Health Monitoring and Enhanced Visibility 16Policy Reuse 16Exam Preparation Tasks 16Review All Key Topics 16Complete Tables and Lists from Memory 17Define Key Terms 17Chapter 2 Understanding ACI Hardware and Topologies 18“Do I Know This Already?” Quiz 18Foundation Topics 21ACI Topologies and Components 21Clos Topology 21Standard ACI Topology 22ACI Stretched Fabric Topology 24ACI Multi-Pod Topology 25ACI Multi-Site Topology 26ACI Multi-Tier Architecture 28Remote Leaf Topology 30APIC Clusters 32APIC Cluster Scalability and Sizing 33Spine Hardware 36First-Generation Spine Switches 37Second-Generation Spine Switches 37Leaf Hardware 38First-Generation Leaf Switches 38Second-Generation Leaf Switches 39Exam Preparation Tasks 41Review All Key Topics 41Complete Tables and Lists from Memory 41Define Key Terms 41Chapter 3 Initializing an ACI Fabric 42“Do I Know This Already?” Quiz 42Foundation Topics 44Understanding ACI Fabric Initialization 44Planning Fabric Initialization 45Understanding Cabling Requirements 45Connecting APICs to the Fabric 46Initial Configuration of APICs 47APIC OOB Configuration Requirements 47Out-of-Band Versus In-Band Management 48Configuration Information for Fabric Initialization 48Switch Discovery Process 49Fabric Discovery Stages 51Switch Discovery States 51Initializing an ACI Fabric 52Changing the APIC BIOS Password 52Configuring the APIC Cisco IMC 52Initializing the First APIC 53Discovering and Activating Switches 55Understanding Graceful Insertion and Removal (GIR) 58Initializing Subsequent APICs 59Understanding Connectivity Following Switch Initialization 59Basic Post-Initialization Tasks 63Assigning Static Out-of-Band Addresses to Switches and APICs 63Applying a Default Contract to Out-of-Band Subnet 64Upgrading an ACI Fabric 66Understanding Schedulers 73Enabling Automatic Upgrades of New Switches 74Understanding Backups and Restores in ACI 75Making On-Demand Backups in ACI 76Making Scheduled Backups in ACI 79Taking Configuration Snapshots in ACI 80Importing Configuration Backups from Remote Servers 80Executing Configuration Rollbacks 82Pod Policy Basics 83Configuring Network Time Protocol (NTP) Synchronization 84Configuring DNS Servers for Lookups 90Verifying COOP Group Configurations 92Exam Preparation Tasks 93Review All Key Topics 93Complete Tables and Lists from Memory 94Define Key Terms 94Chapter 4 Exploring ACI 96“Do I Know This Already?” Quiz 96Foundation Topics 98ACI Access Methods 98GUI 99CLI 100APIC CLI 100Switch CLI 102API 103Management Access Modifications 103Understanding the ACI Object Model 105Learning ACI Through the Graphical User Interface 107Exploring the Object Hierarchy by Using Visore 108Why Understand Object Hierarchy Basics for DCACI? 110Policy in Context 110Integrated Health Monitoring and Enhanced Visibility 110Understanding Faults 111The Life of a Fault 113Acknowledging Faults 115Faults in the Object Model 116Monitoring Policies in ACI 118Customizing Fault Management Policies 120Squelching Faults and Changing Fault Severity 121Understanding Health Scores 124Understanding Events 126Squelching Events 127Understanding Audit Logs 127Exam Preparation Tasks 128Review All Key Topics 128Complete Tables and Lists from Memory 129Define Key Terms 129Part II ACI FundamentalsChapter 5 Tenant Building Blocks 130“Do I Know This Already?” Quiz 130Foundation Topics 132Understanding the Basic Objects in Tenants 132Tenants 133Predefined Tenants in ACI 134VRF Instances 135Bridge Domains (BDs) 137Endpoint Groups (EPGs) 137Application Profiles 138The Pain of Designing Around Subnet Boundaries 139BDs and EPGs in Practice 141Configuring Bridge Domains, Application Profiles, and EPGs 142Classifying Endpoints into EPGs 146APIC CLI Configuration of Tenant Objects 147Contract Security Enforcement Basics 148Contracts, Subjects, and Filters 148Contract Direction 149Contract Scope 150Zero-Trust Using EPGs and Contracts 151Objects Enabling Connectivity Outside the Fabric 151External EPGs 151Layer 3 Outside (L3Out) 153Tenant Hierarchy Review 153Exam Preparation Tasks 154Review All Key Topics 154Complete Tables and Lists from Memory 154Define Key Terms 154Chapter 6 Access Policies 156“Do I Know This Already?” Quiz 156Foundation Topics 158Pools, Domains, and AAEPs 158VLAN Pools 159Domains 160Common Designs for VLAN Pools and Domains 161Challenges with Overlap Between VLAN Pools 164Attachable Access Entity Profiles (AAEPs) 165Policies and Policy Groups 169Interface Policies and Interface Policy Groups 169Planning Deployment of Interface Policies 173Switch Policies and Switch Policy Groups 174Profiles and Selectors 176Configuring Switch Profiles and Interface Profiles 179Stateless Networking in ACI 182Bringing It All Together 183Access Policies Hierarchy in Review 183Access Policies and Tenancy in Review 184Exam Preparation Tasks 184Review All Key Topics 184Complete Tables and Lists from Memory 185Define Key Terms 185Chapter 7 Implementing Access Policies 186“Do I Know This Already?” Quiz 186Foundation Topics 188Configuring ACI Switch Ports 188Configuring Individual Ports 188Configuring Port Channels 196Configuring Virtual Port Channel (vPC) Domains 201Configuring Virtual Port Channels 204Configuring Ports Using AAEP EPGs 208Implications of Initial Access Policy Design on Capabilities 210Configuring Access Policies Using Quick Start Wizards 211The Configure Interface, PC, and VPC Wizard 211The Configure Interface Wizard 211Additional Access Policy Configurations 212Configuring Fabric Extenders 212Configuring Dynamic Breakout Ports 215Configuring Global QoS Class Settings 217Configuring DHCP Relay 219Configuring MCP 221Configuring Storm Control 223Configuring CoPP 225Modifying BPDU Guard and BPDU Filter Settings 230Modifying the Error Disabled Recovery Policy 231Configuring Leaf Interface Overrides 232Configuring Port Channel Member Overrides 232Exam Preparation Tasks 235Review All Key Topics 235Complete Tables and Lists from Memory 236Define Key Terms 236Chapter 8 Implementing Tenant Policies 238“Do I Know This Already?” Quiz 238Foundation Topics 241ACI Endpoint Learning 241Lookup Tables in ACI 241Local Endpoints and Remote Endpoints 242Understanding Local Endpoint Learning 243Unicast Routing and Its Impact on Endpoint Learning 243Understanding Remote Endpoint Learning 244Understanding the Use of VLAN IDs and VNIDs in ACI 245Endpoint Movements Within an ACI Fabric 247Understanding Hardware Proxy and Spine Proxy 247Endpoint Learning Considerations for Silent Hosts 248Where Data Plane IP Learning Breaks Down 249Endpoint Learning on L3Outs 249Limiting IP Learning to a Subnet 249Understanding Enforce Subnet Check 250Disabling Data Plane Endpoint Learning on a Bridge Domain 250Disabling IP Data Plane Learning at the VRF Level 251Packet Forwarding in ACI 251Forwarding Scenario 1: Both Endpoints Attach to the Same Leaf 251Understanding Pervasive Gateways 252Forwarding Scenario 2: Known Destination Behind Another Leaf 254Verifying the Traffic Path Between Known Endpoints 254Understanding Learning and Forwarding for vPCs 256Forwarding Scenario 3: Spine Proxy to Unknown Destination 258Forwarding Scenario 4: Flooding to Unknown Destination 261Understanding ARP Flooding 262Deploying a Multi-Tier Application 263Configuring Application Profiles, BDs, and EPGs 264Assigning Domains to EPGs 267Policy Deployment Following BD and EPG Setup 267Mapping EPGs to Ports Using Static Bindings 267Verifying EPG-to-Port Assignments 269Policy Deployment Following EPG-to-Port Assignment 270Mapping an EPG to All Ports on a Leaf 270Enabling DHCP Relay for a Bridge Domain 271Whitelisting Intra-VRF Communications via Contracts 272Planning Contract Enforcement 272Configuring Filters for Bidirectional Application 273Configuring Subjects for Bidirectional Application of Filters 275Understanding Apply Both Directions and Reverse Filter Ports 277Verifying Subject Allocation to a Contract 278Assigning Contracts to EPGs 278Understanding the TCP Established Session Rule 279Creating Filters for Unidirectional Application 280Configuring Subjects for Unidirectional Application of Filters 280Additional Whitelisting Examples 282Verifying Contract Enforcement 283Understanding the Stateful Checkbox in Filter Entries 284Contract Scopes in Review 284Exam Preparation Tasks 285Review All Key Topics 285Complete Tables and Lists from Memory 287Define Key Terms 287Part III External ConnectivityChapter 9 L3Outs 288“Do I Know This Already?” Quiz 288Foundation Topics 291L3Out Fundamentals 291Stub Network and Transit Routing 291Types of L3Outs 292Key Functions of an L3Out 293The Anatomy of an L3Out 293Planning Deployment of L3Out Node and Interface Profiles 295Understanding L3Out Interface Types 296Understanding L3Out Bridge Domains 296Understanding SVI Encap Scope 298Understanding SVI Auto State 299Understanding Prerequisites for Deployment of L3Outs 301L3 Domain Implementation Examples 301Understanding the Need for BGP Route Reflection 303Implementing BGP Route Reflectors 304Understanding Infra MP-BGP Route Distribution 305Deploying L3Outs 307Configuring an L3Out for EIGRP Peering 307Deploying External EPGs 310Verifying Forwarding Out an L3Out 312Advertising Subnets Assigned to Bridge Domains via an L3Out 314Enabling Communications over L3Outs Using Contracts 316Deploying a Blacklist EPG with Logging 318Advertising Host Routes Out an ACI Fabric 321Implementing BFD on an EIGRP L3Out 321Configuring Authentication for EIGRP 324EIGRP Customizations Applied at the VRF Level 324Configuring an L3Out for OSPF Peering 325A Route Advertisement Problem for OSPF and EIGRP L3Outs 328Implementing BFD on an OSPF L3Out 328OSPF Customizations Applied at the VRF Level 329Adding Static Routes on an L3Out 329Implementing IP SLA Tracking for Static Routes 330Configuring an L3Out for BGP Peering 334Implementing BGP Customizations at the Node Level 337Implementing Per-Neighbor BGP Customizations 339Implementing BFD on a BGP L3Out 341Implementing BGP Customizations at the VRF Level 342Implementing OSPF for IP Reachability on a BGP L3Out 343Implementing Hot Standby Router Protocol (HSRP) 344IPv6 and OSPFv3 Support 344Implementing Route Control 344Route Profile Basics 344Modifying Route Attributes to All Peers Behind an L3Out 346Modifying Route Attributes to a Specific Peer Behind an L3Out 349Assigning Different Policies to Routes at the L3Out Level 351Configuring Inbound Route Filtering in ACI 352Exam Preparation Tasks 353Review All Key Topics 353Complete Tables and Lists from Memory 356Define Key Terms 356Chapter 10 Extending Layer 2 Outside ACI 358“Do I Know This Already?” Quiz 358Foundation Topics 361Understanding Network Migrations into ACI 361Understanding Network-Centric Deployments 361Understanding Full-Mesh Network-Centric Contracts 362Understanding Any EPG 364Understanding Preferred Group Members 365Disabling Contract Enforcement at the VRF Instance Level 367Flooding Requirements for L2 Extension to Outside Switches 368Understanding GARP-Based Detection 370Understanding Legacy Mode 371Endpoint Learning Considerations for Layer 2 Extension 371Preparing for Network-Centric Migrations 372Implementing Layer 2 Connectivity to Non-ACI Switches 372Understanding EPG Extensions 372Understanding Bridge Domain Extensions 374Comparing EPG Extensions and BD Extensions 374Implementing EPG Extensions 375Implementing L2Outs 380Migrating Overlapping VLANs into ACI 385Understanding ACI Interaction with Spanning Tree Protocol 386Remediating Against Excessive Spanning Tree Protocol TCNs 386Configuring MST Instance Mappings in ACI 387Understanding Spanning Tree Protocol Link Types 388Using MCP to Detect Layer 2 Loops 388Exam Preparation Tasks 389Review All Key Topics 389Complete Tables and Lists from Memory 390Define Key Terms 390Part IV IntegrationsChapter 11 Integrating ACI into vSphere Using VDS 392“Do I Know This Already?” Quiz 392Foundation Topics 394Understanding Networking in VMware vSphere 394Understanding vSphere Standard Switches 395Understanding vSphere Distributed Switches 397Understanding vSphere System Traffic 397Impact of vCenter Failure on Production Traffic 399Understanding Port Bindings in vSphere 400Understanding Teaming and Failover Policies 400Understanding VMM Integration 403Planning vCenter VMM Integrations 403What Happens After VDS Deployment? 405Understanding Immediacy Settings 405Connecting ESXi Servers to the Fabric 407Configuring Connectivity to ESXi in UCS Domains 407Integrating ACI into vSphere Using VDS 407Prerequisites for VMM Integration with vSphere VDS 408Configuring a VMM Domain Profile 408Adding ESXi Hosts to a VDS 411Pushing EPGs to vCenter as Distributed Port Groups 415Assigning VMs to Distributed Port Groups 417Less Common VMM Domain Association Settings 418Enhanced LACP Policy Support 419Exam Preparation Tasks 422Review All Key Topics 422Complete Tables and Lists from Memory 423Define Key Terms 423Chapter 12 Implementing Service Graphs 424“Do I Know This Already?” Quiz 424Foundation Topics 426Service Graph Fundamentals 426Service Graphs as Concatenation of Functions 427Service Graph Management Models 428Understanding Network Policy Mode 428Understanding Service Policy Mode 430Understanding Service Manager Mode 432When to Use Service Graphs 434Choosing an L4–L7 Services Integration Method 435Understanding Deployment Modes and the Number of BDs Required 435Deploying Service Graphs for Devices in GoTo Mode 436Deploying Service Graphs for Devices in GoThrough Mode 437Deploying Service Graphs for One-Arm Load Balancers 437Understanding Route Peering 438Understanding Dynamic Endpoint Attach 439Understanding Bridge Domain Settings for Service Graphs 439Understanding Service Graph Rendering 440Service Graph Implementation Workflow 441Importing Device Packages 441Identifying L4–L7 Devices to the Fabric 443Creating Custom Function Profiles 444Configuring a Service Graph Template 445Configuring Device Selection Policies 446Applying a Service Graph Template 446Configuring Additional Service Graph Parameters 447Monitoring Service Graphs and Devices 447Service Graph Implementation Examples 447Deploying an Unmanaged Firewall Pair in a Service Graph 447Deploying Service Graphs for a Firewall in Managed Mode 453Exam Preparation Tasks 460Review All Key Topics 460Complete Tables and Lists from Memory 461Define Key Terms 461Part V Management and MonitoringChapter 13 Implementing Management 462“Do I Know This Already?” Quiz 462Foundation Topics 464Configuring Management in ACI 464Understanding Out-of-Band Management Connectivity 464Understanding In-Band Management Connectivity 465Deploying In-Band and OOB Management Side by Side 467Configuring In-Band Management 467Configuring Access Policies for APIC In-Band Interfaces 468Configuring the In-Band Management Bridge Domain 469Configuring In-Band Management IP Addressing 470Optionally Extending the In-Band Network Out of the Fabric 474Optionally Setting Up Additional Connectivity 476Whitelisting Desired Connectivity to and from an In-Band EPG 476Evaluating APIC Connectivity Preferences 478Out-of-Band Management Contracts in Review 479Exam Preparation Tasks 481Review All Key Topics 481Memory Tables 481Define Key Terms 481Chapter 14 Monitoring ACI Using Syslog and SNMP 482“Do I Know This Already?” Quiz 482Foundation Topics 485Understanding System Messages 485Forwarding System Messages to Syslog Servers 487Apply Necessary Contracts to Allow Syslog Forwarding 487Configuring Syslog Monitoring Destination Groups 492Configuring Syslog Sources for Desired Monitoring Policies 494Verify Syslog Forwarding to Desired Syslog Servers 498Using SNMP in ACI 500ACI Support for SNMP 501ACI SNMP Configuration Caveats 502Configuring ACI for SNMP 502Apply Necessary Contracts for SNMP 503Associate an SNMP Policy with a Pod Policy 504Associate SNMP Contexts with Desired VRF Instances 506Configure SNMP Monitoring Destination Groups 507Configure SNMP Sources for All Desired Monitoring Policies 508Verify SNMP Forwarding to Desired SNMP Servers 509Exam Preparation Tasks 511Review All Key Topics 511Complete Tables and Lists from Memory 512Define Key Terms 512Chapter 15 Implementing AAA and RBAC 514“Do I Know This Already?” Quiz 514Foundation Topics 516Implementing Role-Based Access Control (RBAC) 516Understanding Security Domains 517Understanding Privileges and Roles 519Creating Local Users and Assigning Access 521Tweaking Roles and User Access 525Custom RBAC Rules 528A Common RBAC Pitfall 531Integrating with External AAA Servers 532Configuring ACI for TACACS+ 532Configuring ISE to Authenticate and Authorize Users for ACI 536Expected Cisco AV Pair Formatting for ACI 538Configuring ACI for RADIUS 540Configuring ACI for LDAP 541AAA Authentication Policy Settings 547Regaining Access to the Fabric via Fallback Domain 550Exam Preparation Tasks 550Review All Key Topics 550Complete Tables and Lists from Memory 551Define Key Terms 551Part VI OperationsChapter 16 ACI Anywhere 552“Do I Know This Already?” Quiz 552Foundation Topics 555ACI Multi-Site Fundamentals 555Interconnecting ACI Fabrics with ACI Multi-Site 555New ACI Multi-Site Constructs and Configuration Concepts 557Locally Governed Versus MSO-Governed Configurations 557Schemas and Templates in Practice 557Building Primary and Disaster RecoveryData Centers with ACI 558Centralized Orchestration and Management of Multiple Fabrics 559Tweaking Broadcast and Stretch Settings on a Per-BD Basis 560Cross-Data Center Ingress Routing Optimizations 561Simultaneous or Independent Policy Deployment to Sites 561Building Active/Active Data Centers with ACI 562VMM Integrations Applicable to Multiple Data Centers 563Stateful-Services Integration in ACI Multi-Pod and Multi-Site 563Extending ACI to Remote Locations and Public Clouds 564Extending ACI into Public Clouds with ACI Multi-Site 564Extending ACI into Bare-Metal Clouds with vPod 564Integrating Remote Sites into ACI Using Remote Leaf Switches 564Exam Preparation Tasks 565Review All Key Topics 565Memory Tables 565Define Key Terms 565Part VII Final PreparationChapter 17 Final Preparation 566Getting Ready 566Tools for Final Preparation 567Pearson Cert Practice Test Engine and Questions on the Website 567Accessing the Pearson Test Prep Software Online 567Accessing the Pearson Test Prep Software Offline 568Customizing Your Exams 568Updating Your Exams 569Premium Edition 569Suggested Plan for Final Review/Study 570Summary 570Appendix A Answers to the “Do I Know This Already?” Questions 572Appendix B CCNP Data Center Application Centric Infrastructure DCACI 300-620 Exam Updates 586Glossary 589Online ElementsAppendix C Memory TablesAppendix D Memory Tables Answer KeyAppendix E Study PlannerGlossary9780136602668 TOC 12/15/2020