CCNA Virtualization Questions

The vEdge must first connect to the vBond orchestrator to learn about vSmart and vManage. The vBond IP address must be correctly configured, and UDP port 12346 must be open for the DTLS control connection. If the vEdge cannot reach vBond, it will not obtain the vSmart information and cannot establish control connections. This is the first step in troubleshooting.

VXLAN tunnels Layer 2 over Layer 3.

VXLAN tunnels use a loopback interface as the source to ensure high availability and stability. A /32 loopback is always up and not tied to a physical port, so the tunnel source remains reachable even if a link fails. This is the recommended design for VTEPs in a VXLAN EVPN fabric.

The 'interface nve 1' command creates a Network Virtualization Edge (NVE) interface, which is the logical interface used for VXLAN tunneling. Under this interface, you configure the source-interface and member VNIs. This is the standard way to enable VTEP functionality on Cisco platforms.

Creating an 802.1Q trunk with subinterfaces lets each switch or router terminate multiple VLANs on a single physical link, and each subinterface can be explicitly bound to a tenant's VRF. This gives each tenant an isolated routing table; the switch will route packets received on a subinterface using only the routes in that subinterface's assigned VRF. The trunk carries tagged frames for all tenants, but the VRF association ensures that traffic from tenant A's VLAN never enters tenant B's routing path, even though they share the same physical ports and trunk. This is a standard VRF-lite design for inter-switch VRF connectivity.

VXLAN with EVPN is the correct solution because it combines a Layer 2 data-plane overlay (VXLAN over UDP) with a modern BGP-based control plane (EVPN) that advertises MAC and IP reachability per VNI. This enables stretched Layer 2 forwarding across an IP underlay, allowing VMs to retain their IP and MAC addresses while migrating between switches, with EVPN providing MAC learning, ARP suppression, and multi-homing capabilities. It is purpose-built for constructing flexible, scalable network fabrics for internal mobility and is the standard approach for legacy-to-fabric migration scenarios.

VRF-Lite isolates routing by binding interfaces to a VRF and running an independent routing process per VRF. Without a routing instance inside the VRF, the router has no routes for that VRF, and without interface binding, traffic uses the global table. This combination provides the required isolation on a single device.

The fabric control-plane node runs LISP as the control plane for SD-Access, maintaining the endpoint ID-to-RLOC mapping database. Edge nodes register locally learned endpoints with it and query it to resolve remote endpoint locations before building VXLAN tunnels. This centralized mapping service enables same-virtual-network communication across edge nodes while keeping different virtual networks isolated through separate LISP instance IDs.

Cisco ISE authenticates endpoints using 802.1X, MAC authentication bypass, or web authentication, and returns the VLAN and VRF (or SGT) assignment to the fabric edge node. This is the identity services function that enforces policy before forwarding.

Spine switches form the fabric backbone.

The Nexus 1000V VEM runs inside the hypervisor and performs local Layer 2 forwarding between virtual machines on the same host, so intra-host traffic never traverses the physical uplink. It also enforces port profiles and VLAN policies pushed from the Virtual Supervisor Module, which matches both stated requirements.

The command 'show bgp l2vpn evpn' displays the BGP EVPN table, including Type-2 routes (MAC/IP advertisement routes). If the switch is not receiving Type-2 routes, this command will show an empty table or missing entries for the expected MAC addresses. It is the primary command to verify EVPN route reception and is essential for troubleshooting control-plane learning.

VM-FEX in Cisco UCS Manager presents virtual interfaces from the fabric interconnect down to the hypervisor, so virtual machine traffic is treated like traffic from a physical adapter. It is managed directly in UCS Manager and provides the upstream visibility the administrator wants, satisfying both requirements in the scenario.

The fabric edge node is the first-hop device that connects wired endpoints to the fabric. It runs the host tracking database and acts as the authenticator for 802.1X, mapping the endpoint to the appropriate virtual network based on the Cisco DNA Center policy. When a user connects, the edge node performs authentication and assigns the endpoint to the correct overlay segment.

For VXLAN EVPN to learn remote MAC addresses, the VNI must be mapped to the correct VLAN. If the mapping is missing or incorrect, the switch cannot associate incoming EVPN routes with the local VLAN, preventing MAC learning. This is a common misconfiguration that breaks overlay connectivity.

An anycast gateway uses the same virtual IP and virtual MAC on every leaf that participates in the VLAN, so a host keeps the same default gateway regardless of which leaf it attaches to. This is what enables seamless workload mobility without re-ARPing or changing host configuration when a virtual machine moves between racks.

Enabling BGP as the host-reachability protocol on the NVE interface causes the leaf to advertise and learn MAC/IP and IMET routes through EVPN, so remote MAC addresses are resolved from the control plane instead of flood-and-learn. The loopback source provides a stable VTEP address reachable across the underlay, which is required for the EVPN peering and for tunnel endpoints to be consistent.

The command 'router ospf 1 vrf CUSTOMER' starts an OSPF process with process ID 1 and associates it with the VRF named CUSTOMER. This is the correct syntax to enable OSPF within a specific VRF on Cisco IOS-XE. Once configured, OSPF will run in the context of that VRF, and routes will be installed in the VRF's routing table.

Fabric edge nodes are responsible for enforcing group-based policies using Scalable Group ACLs (SGACLs). They encapsulate traffic with VXLAN and include the source group tag (SGT) and destination group tag (DGT) in the VXLAN header. Based on these tags, the edge node applies the appropriate SGACL. This enforces segmentation between user groups even when they share the same physical network.

The 'show bgp l2vpn evpn' command displays the EVPN routes in the BGP table, including Type-2 and Type-3 routes for MAC and IMET. By checking this output, the engineer can verify whether the VNI is being advertised. If the VNI is not present, it indicates a configuration issue with the EVPN control plane, such as missing VNI configuration under the EVPN address family or BGP neighbor issues.

Enabling unicast routing on the bridge domain allows the ACI fabric to perform Layer 3 routing between subnets within the bridge domain and to external networks. This is required for the Layer 3 gateway services specified in the scenario, as the bridge domain acts as the default gateway for endpoints.

Type 2 MAC/IP Advertisement routes carry the host MAC address and optionally the host IP address, along with the originating VTEP, for a given VNI. Advertising Type 2 routes lets remote leaf switches install MAC and ARP/ND entries and forward unicast traffic directly, avoiding flooding for known hosts.

The global configuration command 'vrf definition TENANT_A' creates a VRF instance named TENANT_A and enters VRF configuration mode. This command is used on Cisco IOS-XE routers to define a VRF, which provides separate routing and forwarding tables for each tenant. Within VRF configuration mode, the engineer can configure route distinguishers (RD) and route targets (RT) to control route import and export. This command is essential for enabling VRF-lite or MPLS Layer 3 VPNs, allowing overlapping IP addresses across tenants.

Isolating storage on its own vSwitch with a 9000 MTU and dedicated uplinks on the storage VLAN separates the traffic from management and VM flows while enabling jumbo frames end to end. The storage VMkernel adapter carries the HyperFlex data traffic, and the dedicated uplinks ensure the storage VLAN is not shared with other traffic types. This matches HyperFlex networking requirements.

Enabling IP routing on the Cisco CSR 1000v allows it to route traffic between different VLANs. By default, routing may be disabled. Once enabled with the 'ip routing' command, the router can forward packets between subnets, including those on different VLANs, provided interfaces are configured correctly.

The VNI must be explicitly activated under BGP EVPN. Without the 'vni 10100 l2' configuration inside address-family l2vpn evpn, BGP has no awareness of this L2 VNI and will not originate or import the type-2 (MAC/IP) and type-3 (inclusive multicast) routes needed for remote VTEPs to learn MAC addresses. Adding that command, along with 'evpn' as the address family, is what makes the control plane advertise the VNI. This is the missing configuration causing the issue.

Under the NVE interface, source-interface loopback0 sets the VTEP IP address, and host-reachability protocol bgp enables BGP EVPN for remote VTEP and MAC learning. This combination is essential for a functioning VTEP in an EVPN fabric. Without the source-interface, the NVE would not know which IP to use for tunnels, and without host-reachability, it would rely on data-plane learning.

VRF instances are isolated by default. By assigning interfaces to the guest VRF, traffic within that VRF is separate from the corporate VRF. As long as no route leaking (such as static routes or BGP route targets) is configured, the VRFs remain isolated. This is the correct and sufficient step to maintain isolation.

VRF creates multiple independent Layer 3 routing and forwarding tables on a single physical device, so each tenant gets its own RIB/FIB and can run a separate routing protocol instance. This directly satisfies the requirement of isolated routing tables plus independent protocol instances sharing the same physical uplinks and hardware.

Cisco NFVIS is a Linux KVM-based virtualization platform that provides the hypervisor, VM lifecycle management, and orchestration APIs needed to host multiple virtual network functions on a single branch server. It allows the engineer to deploy, monitor, and manage VNFs such as virtual routers and firewalls from a centralized interface, directly supporting the multi-VNF branch design in the scenario.

In Cisco ACI, an L2Out is used to extend a bridge domain to an external Layer 2 network. It is configured on a border leaf and includes an external bridged domain and an external bridged network. This allows Layer 2 connectivity between the ACI fabric and external devices, which is exactly what is needed to extend the tenant's bridge domain.

This sequence enables the NV overlay feature, creates the NVE interface, sets the loopback as the tunnel source, adds the VNI as a member, and maps VLAN 100 to VNI 10000 using vn-segment under the SVI. This is the correct Nexus 9000 method for defining a VTEP and binding a VLAN to a VNI for Layer 2 VXLAN bridging. All required elements are present and correctly placed.

SGTs are used in Cisco SD-Access to provide micro-segmentation. Each endpoint is assigned an SGT, and group-based policies (SGACLs) enforce traffic between groups. This allows segmentation without traditional VRFs on every switch, meeting the requirement for secure departmental separation.

The source interface for the NVE interface must be reachable via the underlay network so that VXLAN tunnels can be established. Typically, a loopback interface is used, and its IP address must be advertised into the underlay routing protocol. Without reachability, VXLAN traffic cannot be encapsulated and forwarded to remote VTEPs.

This command correctly specifies the loopback 0 interface as the source for VXLAN tunnel traffic. It ensures that the VTEP IP address is derived from a stable, always-up interface, which is a best practice for VXLAN deployments. The loopback interface provides redundancy and avoids disruption if a physical interface goes down.

The NVE interface requires a source-interface, typically a loopback, to establish the VTEP address used in VXLAN tunnels. If the source interface is missing or the VNI-to-VLAN mapping under the NVE interface is incomplete, the switch cannot build tunnels or map traffic into VNIs. This directly explains why VXLAN tunnels to remote leaf switches are not forming in the scenario.

VRF selection is driven by the ingress interface. Because the receiving interface is bound to VRF CUSTOMER_A, the router performs the lookup in the CUSTOMER_A forwarding table, where the 10.20.30.0/24 route may point to a different next hop than the global entry, keeping tenant traffic isolated.

An interface assigned to a VRF contributes its connected route to that VRF's table only if it has an IP address. If the interface has no address, or if no static route or routing protocol is configured inside the VRF address family, the VRF routing table will be empty. This matches the symptom of show ip route vrf CUST_A returning no routes.

The 'source-interface loopback1' command under the NVE interface configuration sets Loopback1 as the source for all VXLAN encapsulated traffic. Since Loopback1 is also used for BGP EVPN peering, this ensures consistent reachability and avoids asymmetric routing. This is the correct way to bind the VTEP source to a specific loopback, which is a common best practice in VXLAN EVPN deployments.

In VRF-lite or MPLS L3VPN, route targets control the import and export of routes between VRFs. By configuring matching route targets on two VRFs, routes from one VRF can be imported into another. This is the standard method for route leaking between VRFs. It allows controlled communication between VRFs without merging them entirely.

This sequence turns on authentication globally, creates the MD5 key, marks that key as trusted so the router accepts it, and associates the key with the server. Each step is required: without `ntp authenticate` the router ignores authentication, without a trusted key it rejects valid packets, and without the key number on the server command it will not use the key for that peer. Together they enforce authenticated peering.

VRF segregation creates an independent routing and CEF table, so next hops must reside within the same VRF. If the next-hop addresses belong to the global table, they are unresolvable inside VRF TENANT_A, leaving prefixes present but next hops unreachable.

In Cisco ACI, the common tenant can host shared services EPGs, and contracts can be exported and consumed across tenants. This allows a tenant EPG to communicate with the shared firewall or load balancer while keeping other inter-tenant traffic isolated. The contract defines exactly which protocols and ports are permitted, satisfying both sharing and isolation.

Ingress replication with BGP EVPN allows the leaf to replicate BUM traffic to all remote VTEPs in the EVPN control plane without using multicast in the underlay. This is the correct approach when multicast replication is not desired. The command `ingress-replication protocol bgp` enables this behavior.

The Cisco APIC Tenant Traceroute tool allows engineers to trace the path of a specific flow through the ACI fabric, from source to destination. It simulates the flow and shows each step, including policy enforcement points, leaf and spine switches, and any drop or redirect actions. This is ideal for troubleshooting intermittent connectivity issues because it provides visibility into the actual forwarding path and policy application. It helps identify where packets may be dropped or misrouted within the fabric.

An L2Out connects the ACI fabric to an external Layer 2 network, but by default BUM (broadcast, unknown unicast, multicast) traffic is not automatically flooded through every L2Out. The 'flood on' setting under the L2Out must be explicitly enabled so that BUM frames received in the BD are also sent to the external network; without it, BUM traffic is dropped or handled only locally. Since this L2Out lacks that flood configuration, the L2 extension does not actually extend L2 flooding, which explains the connectivity problem.

Cisco SD-WAN centralizes configuration and policy in vManage, which pushes feature templates and centralized policies to vEdge and cEdge devices. This enables consistent, scalable provisioning of thousands of branches without manual CLI configuration. It directly supports the architect's goal of managing branch-to-data-center and cloud connectivity in a unified, policy-driven manner across the overlay.

In ACI, the leaf switch acts as the policy enforcement point, translating contracts into hardware ACL and forwarding rules applied to the EPG interfaces. When a contract permitting TCP 443 is attached between EPGs, the leaf enforces that filter for traffic between them, which is exactly the construct required.

In a multicast-based VXLAN fabric, each VNI is mapped to a multicast group address. VTEPs that have the VNI configured join that group via IGMP. When a VTEP needs to send BUM traffic for that VNI, it sends the VXLAN-encapsulated packet to the multicast group, and all VTEPs in the group receive it. This mapping is configured on each VTEP.

Correct: VDCs provide administrative and management isolation.

This command correctly sets the loopback0 interface as the source for VXLAN tunnels on the NVE interface. In Cisco NX-OS, under interface nve1, the 'source-interface loopback0' command designates the loopback interface whose IP address will be used as the source IP in the outer IP header of VXLAN encapsulated packets. This is essential for VTEP reachability and tunnel establishment.

In a VXLAN EVPN fabric, BGP is used as the EVPN control plane. The spine and leaf switches must be configured with the EVPN address family (address-family l2vpn evpn) to exchange EVPN routes. This allows the fabric to learn MAC addresses and IP addresses dynamically, reducing the need for flooding. Without BGP EVPN, the fabric would rely on data plane learning, which is less efficient. Thus, this statement is true for Nexus 9000 VXLAN EVPN configuration.

VRF leaking allows routes to be selectively imported and exported between VRF instances, enabling controlled communication while maintaining isolation for other traffic. This is the standard method to allow specific inter-VRF communication on Cisco IOS-XE routers without merging the routing tables entirely.

EVPN Type-3 (Inclusive Multicast Ethernet Tag) routes advertise the originating VTEP's loopback IP address along with the VNI and Ethernet tag information. Receiving VTEPs build an ingress replication list from these advertisements, allowing them to replicate broadcast, unknown-unicast, and multicast traffic to every remote VTEP in the same VNI. This is exactly the control-plane mechanism the design requires.

A standard HyperFlex cluster with UCS Manager-managed fabric interconnects lets the HyperFlex installer discover and configure the fabric interconnects, server policies, and VLANs automatically. This matches the requirement for automated configuration of both fabric interconnects and UCS servers in a data-center cluster, which is exactly what the standard deployment model delivers.

VXLAN uses MAC-in-UDP encapsulation with the standard destination UDP port 4789. The original Ethernet frame is carried inside the UDP payload, allowing Layer 2 segments to be stretched across a Layer 3 underlay. This is a defining operational characteristic of VXLAN and is accurate for this fabric design.

The system IP and organization name are the two identifiers the SD-WAN controllers use to authenticate and track a device. Without a matching organization name and a unique system IP, the device cannot establish control connections to vBond, vSmart, and vManage, so it will not receive centralized policy or join the overlay.

The packet enters via Gi0/1/0, and the exhibit shows this interface is configured in VRF CUSTOMER-A. When a packet arrives on an interface, the router immediately associates it with that interface's VRF and performs the destination IP lookup in the corresponding VRF-specific routing table. Because Gi0/1/0 belongs to CUSTOMER-A, the forwarding decision uses the routes, next hops, and constructs (e.g., VRF-specific ARP or CEF) belonging to CUSTOMER-A. This is why CUSTOMER-A is the correct answer.

The show vxlan vni command displays the mapping between VLANs and VNIs and indicates whether the VXLAN interface is up. If the VLAN-to-VNI mapping is missing or the VXLAN interface is down, hosts cannot be placed into the correct overlay, which matches the symptom of remote reachability failing despite EVPN routes being present.

A VRF maintains its own separate routing and forwarding table, so prefixes in the global table are not automatically visible inside CUSTOMER_A. Because the destination prefix exists only in the global table, the VRF has no matching route and drops the traffic. The engineer must either leak the global prefix into the VRF or provide a default route within the VRF.

The 'vrf definition CUSTOMER' command in global configuration mode creates a VRF instance named CUSTOMER. This command is used in Cisco IOS-XE to define a VRF and enter VRF configuration mode, where you can specify address families, route targets, and other parameters. It is the correct way to create a VRF for MPLS VPN or other segmentation purposes.

SD-Access uses VXLAN encapsulation in the fabric data plane. Each virtual network is mapped to a unique VNI, and the fabric edge nodes and border nodes act as VTEPs. The endpoint traffic is carried inside VXLAN tunnels across the underlay, which allows Layer 2 and Layer 3 communication between endpoints attached to different edge nodes while maintaining segmentation.

In EVPN, each leaf switch advertises locally learned MAC addresses via MP-BGP Type-2 routes. If the target VM's MAC is learned on a leaf different from the one the source leaf expects, or if that leaf has not advertised the route, the source leaf has no EVPN entry for that MAC. It floods the ARP request as BUM, but the reply is sent as unicast, and without a Type-2 route the source cannot properly deliver or cache the reply, leading to unidirectional communication failure.

Type 2 EVPN routes are used to advertise MAC addresses and optionally IP addresses. When a VTEP learns a MAC address from a local host, it generates a Type 2 route and advertises it to other VTEPs via BGP EVPN. This allows remote VTEPs to learn the MAC-to-VTEP mapping and forward traffic correctly. Type 2 routes are essential for Layer 2 and Layer 3 VXLAN EVPN operation.

With EVPN, MAC and IP bindings are advertised as BGP route types, so each VTEP learns remote host locations from the control plane rather than from data-plane flooding. This reduces unknown-unicast flooding and speeds convergence. In a flood-and-learn design, every VTEP must flood to discover remote MACs, which wastes bandwidth and creates scaling problems in large fabrics.

An L3Out defines the Layer 3 connection to an external router. It includes an external EPG that represents the external network, and routing protocols like OSPF or BGP can be configured to exchange routes. The border leaf advertises the BD subnet and learns external routes, enabling dynamic endpoint reachability. This is the correct construct for external Layer 3 connectivity.

MP-BGP with the EVPN address family is the control plane for VXLAN EVPN. It advertises Type-2 and Type-3 routes that carry VTEP IP addresses, enabling automatic discovery of remote VTEPs. Without it, VTEPs must be statically configured, losing the dynamic fabric benefits of EVPN.

To enable inter-subnet routing within a bridge domain, you must configure the bridge domain with unicast routing enabled and define the subnets on the bridge domain. This allows the ACI fabric to route between EPGs in different subnets that are part of the same bridge domain.

VXLAN EVPN relies on MP-BGP EVPN to advertise MAC and MAC-IP reachability between VTEPs. Without an established EVPN session and the corresponding type-2 routes for the VNI, leaf-1 does not know which remote VTEP owns the destination MAC, so it cannot encapsulate the frame toward leaf-2 and traffic is dropped even though the VNI is up.

Type 2 MAC/IP Advertisement routes carry the MAC address, IP address, and VTEP information for a host, allowing remote leaf switches to install the MAC into their forwarding tables without flooding. This route type is the core of EVPN MAC learning and enables efficient unicast forwarding across the VXLAN fabric. It directly satisfies the requirement for MAC reachability advertisement.

On Nexus 9000 switches, enabling the VXLAN feature allows the hardware ASIC to perform VXLAN encapsulation and decapsulation at line rate, avoiding supervisor CPU involvement. Configuring a distributed anycast gateway with the same virtual IP and MAC on every leaf provides optimal first-hop routing for tenant subnets. Together these features satisfy both the hardware-based VXLAN data plane and the anycast gateway design requirement.

This command displays the status of VXLAN tunnel endpoints (VTEPs) and their peering relationships. It shows the IP addresses of remote VTEPs, the VNI, and the state of the tunnel. If the tunnel is down, this command will indicate that, helping the engineer identify why hosts cannot communicate despite EVPN MAC entries.