CCNA Virtualization Questions

The 'show nve vni' command displays the VNIs configured on the NVE interface along with their associated VLANs, the VNI state, and the multicast group or peer information. This directly verifies the VNI-to-VLAN mapping and confirms that the NVE interface is operational. It is the most comprehensive command for checking both the VTEP status and the VNI mapping, making it the correct choice for this scenario.

Leaf switches in Cisco ACI are responsible for policy enforcement and forwarding decisions. They connect to endpoints (servers, storage, etc.) and apply the policies defined by the APIC. The leaf switches maintain the forwarding tables and enforce contracts between endpoint groups.

The VLAN-to-VNI mapping is configured on the ingress leaf switch to associate a VLAN with a VNI. When a frame arrives on an access port in a VLAN, the switch uses this mapping to encapsulate the frame in VXLAN with the corresponding VNI. This allows Layer 2 connectivity to be extended across the VXLAN fabric. The mapping is typically configured under the VLAN configuration or via a VLAN-VNI mapping command. Without this mapping, the switch would not know which VNI to use for encapsulation.

Route leaking allows selective import of routes between VRFs or between a VRF and the global table. By configuring a static route in VRF RED pointing to a global next-hop, or by using BGP import/export, you can allow VRF RED to reach the internet while keeping VRF BLUE isolated.

EVPN Type 3 Inclusive Multicast Ethernet Tag routes advertise VTEP and VNI membership, letting each ingress VTEP build a replication list of remote VTEPs. The ingress leaf then replicates BUM frames individually to every remote VTEP, which is head-end or ingress replication. This removes the requirement for multicast in the underlay entirely.

VXLAN data plane encapsulation wraps the original Ethernet frame in a VXLAN header, then UDP, IP and a new outer Ethernet header. The outer destination IP is the remote VTEP's loopback address, which is reachable over the routed underlay. This is precisely how frames cross the Layer 3 fabric between leaf switches in the scenario.

A Cisco ACI bridge domain can have multiple subnets configured under it. Each subnet is associated with a gateway IP address on the ACI fabric. This allows a single bridge domain to support multiple IP subnets, providing flexibility in addressing and segmentation within the same Layer 2 domain.

When an interface is moved into a VRF, Cisco IOS-XE removes its existing IP address because the address belonged to the global routing table. The administrator must re-enter the IP address after the VRF assignment so the interface has an address within the VRF's own address space. This is expected behavior, not a fault.

The command 'show bgp l2vpn evpn' displays the EVPN routes received from BGP peers, including Type 2 (MAC/IP advertisement) routes. If the leaf is not learning remote MACs, this command will show whether Type 2 routes are present. If they are missing, the issue may be with the BGP EVPN configuration or route reflectors. This is the correct verification step.

A virtual switch connects virtual NICs within the hypervisor and forwards frames between them based on MAC addresses, giving each virtual machine its own vNIC and MAC. Virtual machines placed on different virtual switches or port groups remain isolated unless an uplink or explicit connection joins them, matching the requirement.

EVPN uses MP-BGP with the L2VPN EVPN address family to advertise MAC addresses, IP-to-MAC bindings, and VTEP reachability in a VXLAN fabric. Enabling this address family in the leaf's BGP configuration lets the switch exchange Type 2 and Type 3 routes with the spine route reflectors, which is exactly the overlay control plane required here.

Route leaking is the process of importing routes from one VRF into another, including the global routing table. By configuring route targets or using static routes with the global keyword, you can leak routes between a VRF and the global table. This allows traffic from the VRF to be routed to the internet via the global table, provided that the global table has a route to the destination.

Uplink ports bind a virtual switch to physical NICs, bridging guest VM traffic onto the wired network. This satisfies the stem's requirement for correct virtual switching statements, since without uplinks, VMs on the vSwitch could only communicate internally, isolated from the physical infrastructure.

A Layer 2 Outside (L2Out) is specifically designed to extend a Layer 2 bridge domain to an external Layer 2 network. It allows the ACI fabric to connect to external switches and forward Layer 2 traffic without routing. This is achieved by mapping the bridge domain to an external VLAN on the L2Out. Thus, L2Out is the correct construct for extending a Layer 2 bridge domain to an external Layer 2 network.

On Nexus 9000, the VLAN-to-VNI binding is created with the vn-segment command under the VLAN configuration, which maps VLAN 100 to VNI 10100. The NVE interface then references that VNI with member vni 10100 and uses loopback0 as the VTEP source. Together these commands correctly encapsulate VLAN 100 traffic and extend the Layer 2 segment to leaf-2.

In MPLS Layer 3 VPNs, each VRF is configured with import and export route targets; a received VPNv4 route is installed into a VRF only if its route-target list matches one of the VRF's import targets. If the export RT on the advertising PE does not match the import RT configured in the remote PE for VRF CUSTOMER_C, the route is accepted into the BGP VPNv4 table but silently filtered out of the VRF. Verifying and correcting the RT values to be consistent on both PEs is the requisite fix, as this is the control-plane mechanism responsible for the observed missing route.

The NVE interface on a Nexus 9000 requires a source-interface, typically a loopback, whose IP address becomes the tunnel endpoint. This address must be reachable across the underlay so remote VTEPs can establish VXLAN tunnels. Configuring the loopback and referencing it with the source-interface command under interface nve1 is the standard method to define the tunnel source.

In Cisco SD-Access, a Virtual Network (VN) is a logical partition that provides Layer 3 isolation. Each VN is associated with a VRF, and endpoints in different VNs cannot communicate at Layer 3 unless there is a fusion router or external policy. This meets the requirement for department isolation while sharing the physical underlay.