300-170 · Question #112
Refer to the exhibit. What is the result of the configuration?
The correct answer is A. It enforces the distributed firewall. Assuming the exhibit displays a Cisco ACI security policy configuration, the result is the enforcement of the distributed firewall functionality across the ACI fabric.
Question
Refer to the exhibit. What is the result of the configuration?
Exhibit
Options
- AIt enforces the distributed firewall.
- BIt requires a reboot of the Cisco APIC before enabling the firewall rules
- CIt removes firewall information from the Cisco AVS.
- DIt monitors all the TCP traffic without enforcing the firewall rules.
How the community answered
(28 responses)- A75% (21)
- B7% (2)
- C14% (4)
- D4% (1)
Why each option
Assuming the exhibit displays a Cisco ACI security policy configuration, the result is the enforcement of the distributed firewall functionality across the ACI fabric.
In Cisco ACI, security policies defined through contracts between EPGs are enforced as a distributed firewall by the leaf switches, directly at the point where traffic enters the fabric.
Enabling firewall rules in ACI does not require a reboot of the Cisco APIC; changes are dynamically pushed to the fabric.
Security policy configurations in ACI define firewall rules; they do not remove firewall information from Cisco AVS (Application Virtual Switch) unless explicitly configured to do so for specific AVS ports.
ACI security policies are designed for enforcement, not just monitoring all TCP traffic without enforcing rules, unless specifically configured in a 'log' or 'permit' with logging action.
Concept tested: Cisco ACI distributed firewall enforcement
Source: https://www.cisco.com/c/en/us/td/docs/dcn/aci/apic/5x/config-guide/cisco-apic-config-guide-5x/m_contracts.html
Topics
Community Discussion
No community discussion yet for this question.