300-620 · Question #284
An engineer must attach an ESXi host to the Cisco ACI fabric. The host is connected to Leaf 1 and has its gateway IP address 10.10.10.254/24 configured inside the ACI fabric. A new firewall is…
The correct answer is B. Disable unicast routing. When ACI Bridge Domain has unicast routing enabled, the gateway IP is served by ACI (Anycast Gateway), which distributes the IP to all relevant leaf switches. To migrate the gateway to an external device (the firewall), unicast routing in the ACI BD must be disabled, preventing…
Question
An engineer must attach an ESXi host to the Cisco ACI fabric. The host is connected to Leaf 1 and has its gateway IP address 10.10.10.254/24 configured inside the ACI fabric. A new firewall is attached to Leaf 2 and mapped to the same EPG and BD as the ESXi host. The engineer must migrate the gateway of the ESXi host to the firewall. Which configuration set accomplishes this goal?
Options
- ADisable unicast routing.
- BDisable unicast routing.
- CEnable unicast routing.
- DEnable unicast routing.
How the community answered
(21 responses)- A5% (1)
- B76% (16)
- C5% (1)
- D14% (3)
Explanation
When ACI Bridge Domain has unicast routing enabled, the gateway IP is served by ACI (Anycast Gateway), which distributes the IP to all relevant leaf switches. To migrate the gateway to an external device (the firewall), unicast routing in the ACI BD must be disabled, preventing ACI from advertising or responding on that gateway IP. The firewall will take over as the default gateway by configuring the gateway IP address on it, and all endpoints will use the firewall as their next hop. This approach allows ARP and Layer 2 traffic to flow through the ACI fabric, but all routing (Layer 3) occurs on the external firewall.
Topics
Community Discussion
No community discussion yet for this question.