In Cisco ACI, a Contract with specific filters provides granular, unidirectional control over communication between EPGs. This allows you to explicitly deny traffic from the trading EPG to the research EPG while permitting the necessary return traffic (market data pulls) from research to trading, which matches the scenario’s requirements precisely. Taboo contracts block all traffic, VRFs provide routing separation but not granular filtering, and microsegmentation is for intra-EPG policy.

In a proper vPC design, traffic to a single-homed device (an “orphan port”) connected to only one vPC peer must cross the peer-link to reach the other peer if the destination MAC is learned there. This causes the peer-link to carry user data traffic. The correct design is to dual-home downstream devices to both vPC peers to allow local forwarding. The other options do not directly cause sustained user data traffic on the peer-link.

To statically attach a bare-metal server or legacy device (like a storage array) to a specific interface/port on a leaf switch and pin it to a specific EPG, you must use a Physical Domain. The configuration involves creating a Static Port policy within that domain, which includes the specific leaf, interface, and VLAN, and then applying a ‘Static Path’ annotation to bind the EPG to that precise physical path.

For a leaf to become active in the ACI fabric, it must successfully establish VXLAN tunnels with the spines. This requires Layer 2 connectivity over the Infra VLAN (typically VLAN 3967). If the leaf is physically connected but inactive, the most common issue is that the Infra VLAN is not properly configured or trunked on the intermediate links or spine switch ports. Without Infra VLAN connectivity, the control-plane (COOP) adjacency cannot form.

In a multi-pod ACI design, the pods are managed as a single fabric. Endpoint reachability (the mapping of endpoints to their locator TEPs) is synchronized between the pods via the COOP protocol extended across the IPN. However, the overall policy and orchestration across multiple pods (or multiple independent fabrics in a multi-site design) is managed by the Multi-Site Orchestrator (MSO). The IPN provides IP connectivity, and the APICs manage their local pod.

For a FEX to be dual-homed via vPC, it must be configured identically on both parent switches. This includes using the same FEX ID number on both switches. If the IDs mismatch, the configuration will fail, and the host interfaces will not activate. This ensures both parent switches have a consistent view of the FEX and its downstream ports.

A Bridge Domain (BD) in ACI is a Layer 2 forwarding construct, similar to a VLAN. An EPG is placed inside a BD. The BD provides the Layer 2 boundary for the EPG and is where you configure the Layer 3 properties, such as the gateway IP address (if the BD is routed), subnet, and associated DHCP or ARP flooding settings. Multiple EPGs can share a single BD.

The peer-link must be sized to handle not only control traffic but also data traffic destined for orphaned ports and traffic during failure scenarios. Oversubscription is a common cause of discards. A ‘stuck’ MAC address (where one peer thinks a MAC is locally reachable but it’s actually behind the other peer) can cause all traffic for that destination to be sent across the peer-link, exacerbating congestion. The other options list possible issues, but oversubscription and MAC issues are the most direct and common causes of peer-link data discards.

Within a contract subject (the filter defining the allowed protocol/port), you can enable the ‘Log’ flag. This instructs the ACI fabric to generate log messages (sent to the APIC) for every session that matches this filter, providing the required audit trail. This is a policy-based logging feature. SPAN is a mirroring tool, Taboo contracts block traffic, and atomic counters are for statistics, not per-session logging.

In Cisco ACI, a Contract with specific filters provides granular, unidirectional control over communication between EPGs. This allows you to explicitly deny traffic from the trading EPG to the research EPG while permitting the necessary return traffic (market data pulls) from research to trading, which matches the scenario’s requirements precisely. Taboo contracts block all traffic, VRFs provide routing separation but not granular filtering, and microsegmentation is for intra-EPG policy.0