Refer to the exhibit. All nodes in the Cisco ACI fabric have been statically assigned out-of-band management IP addresses in the 10.100.180.0/24 range. An engineer is attempting to SSH into Leaf101…

Adding a contract filter to oobbrc-default is typically for in-band management or specific tenant-level access, not the fundamental out-of-band access subnet definition.

Changing the Leaf101 IP address to be in the same subnet as the laptop would allow direct access, but it's not a general solution for allowing access from multiple subnets and would require reconfiguring the leaf's management IP.

Cisco ACI's out-of-band management access policies include an 'Allowed Subnets' field, which specifies the IP subnets from which management access (like SSH) is permitted. Since the engineer's laptop (10.101.180.100/24) is in a different subnet than the fabric nodes (10.100.180.0/24), this field must be configured to include the 10.101.180.0/24 subnet to allow SSH access. This policy acts as an access control list for management plane traffic.

Selecting a default QoS Class policy has no impact on IP subnet-based management access control.