ACI Endpoint Learning from Layer 3 Out

300-620 By islever Editorial Last updated

Describe endpoint learning

Short answer

A The source MAC address of the traffic is learned as a local endpoint.

Question

Which endpoint learning operation is completed on the ingress leaf switch when traffic is received from a Layer 3 Out?
  1. The source MAC address of the traffic is learned as a local endpoint. Correct Answer
  2. The source MAC address of the traffic is learned as a remote endpoint.
  3. The source IP address of the traffic is learned as a remote endpoint.
  4. The source IP address of the traffic is learned as a local endpoint.

Key Takeaways

The main trap is confusing MAC vs. IP learning and local vs. remote classification; ACI learns source MAC as a local endpoint from L3Out ingress, not the IP address.

Learn how Cisco ACI handles endpoint learning when traffic enters from a Layer 3 Out. The correct answer explains why the source MAC is learned as a local endpoint while IP addresses are ignored.

Common mistake: Option B is a common wrong guess because candidates assume external traffic implies a 'remote' endpoint. However, on the ingress leaf, the learning behavior is classified as 'local' based on the interface where the packet entered.

Expert Analysis

The correct answer is A. This question tests the specific endpoint learning behaviors defined in Cisco ACI architecture, specifically how the fabric handles traffic entering from an external Layer 3 Out (L3Out).

When a packet arrives at an ingress leaf switch from an L3Out connection, the ACI policy engine performs local endpoint learning based on the source MAC address. The leaf switch learns the source MAC address and associates it with the local interface where the packet arrived. Crucially, the source IP address is not learned as a local endpoint in this scenario; ACI relies on the Endpoint Group (EPG) contract and routing policies rather than dynamic IP-based learning for external sources entering via L3Out.

Option B is incorrect because the endpoint is not marked as "remote" on the ingress leaf; it is treated as a locally reachable entity for forwarding decisions within that specific leaf's context, even if the ultimate destination or origin is outside the fabric. Options C and D are incorrect because ACI does not learn source IP addresses as endpoints in the standard endpoint database for L3Ingress traffic; it learns MAC addresses. The distinction between MAC and IP learning, and local versus remote classification, is the key trap here. As noted in community discussions, official Cisco whitepapers confirm that for incoming packets from L3Out, only the source MAC is learned as a local endpoint.

Official Reference

https://www.cisco.com/c/en/us/solutions/collateral/data-center-virtualization/application-centric-infrastructure/white-paper-c11-739989.html#L3Outendpointlearningconsiderations

This link opens the official vendor documentation in a new tab.

Exam Strategy

Memorize the four distinct endpoint learning scenarios in ACI: Local Ingress, Remote Ingress, Local Egress, and Remote Egress. Focus on what is learned (MAC vs. IP) and the classification (Local vs. Remote) for each. For L3Out ingress, always recall that only the source MAC is learned as a local endpoint.

Frequently Asked Questions

Why is the source IP not learned as an endpoint in ACI L3Out?

ACI uses a policy-driven model where endpoints are identified by MAC addresses and associated with EPGs. Dynamic IP learning is not used for standard endpoint discovery to maintain policy consistency and security.

What is the difference between local and remote endpoint learning?

Local learning occurs on the leaf switch receiving the traffic, associating the MAC with the ingress port. Remote learning involves advertising the endpoint to other leaves in the fabric so they know how to reach it without having seen the packet directly.

More 300-620 FAQ →

Community Votes

A
80%
C
20%

80% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 13 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 13

  1. TCoder 👍 21
    It is A. The source MAC address is learnt as local endpoint. https://www.cisco.com/c/en/us/solutions/collateral/data-center-virtualization/application-centric-infrastructure/white-paper-c11-739989.pdf Refer to Table 6 which says, Local endpoint learning with an incoming packet from L3Out to Cisco ACI: Only the source MAC address is learned as a local endpoint. The source IP address is not learned as a local endpoint.
  2. Kalpesh 👍 7
    Isn't it A? As per below document, in endpoint learning behavior for traffic coming in from L3 out, only source mac address will be learned as local endpoint and of course that will be on ingress leaf for traffic coming in https://www.cisco.com/c/en/us/solutions/collateral/data-center-virtualization/application-centric-infrastructure/white-paper-c11-739989.html
  3. designated 👍 3 Answered C
    C is correct.. When traffic is received on an ACI leaf switch from a Layer 3 Out (L3Out) connection, the source IP address of the traffic is learned as a remote endpoint. This is because the endpoint is external to the ACI fabric and communicates with the fabric through the L3Out. The ACI fabric tracks such endpoints as remote entities since they are not directly connected to the fabric as local endpoints. • Local Endpoint Learning: Refers to endpoints connected directly to the ACI leaf switch on an access port or through a Layer 2 domain. • Remote Endpoint Learning: Refers to endpoints external to the ACI fabric, typically reachable via an L3Out or through VXLAN tunnels from another leaf.
  4. emoemo 👍 3
    sorry, This question is about "ingress leaf". So, The correct answer is C ???
  5. ostych 👍 1 Answered A
    https://www.cisco.com/c/en/us/products/collateral/networking/cloud-networking/application-centric-infrastructure/fabric-endpoint-learning-wp.html#Remoteendpointlearning Local endpoint learning with an incoming packet from L3Out to Cisco ACI: Only the source MAC address is learned as a local endpoint. The source IP address is not learned as a local endpoint. Remote endpoint learning with an incoming packet from L3Out to Cisco ACI: No source MAC or IP address is learned as a new remote endpoint by a packet.*
Show 8 more comments
  1. Mr_Certifiable 👍 1
    A Scenario 1 Local endpoint learning with an incoming packet from L3Out to Cisco ACI: Only the source MAC address is learned as a local endpoint. The source IP address is not learned as a local endpoint. Scenario 2 Remote endpoint learning with an incoming packet from L3Out to Cisco ACI: No source MAC or IP address is learned as a new remote endpoint by a packet.* https://www.cisco.com/c/en/us/solutions/collateral/data-center-virtualization/application-centric-infrastructure/white-paper-c11-739989.html
  2. 7korn7 👍 1 Answered A
    https://www.cisco.com/c/en/us/solutions/collateral/data-center-virtualization/application-centric-infrastructure/white-paper-c11-739989.html Local endpoint learning with an incoming packet from L3Out to Cisco ACI: Only the source MAC address is learned as a local endpoint. The source IP address is not learned as a local endpoint.
  3. eddyedwards257 👍 1
    Is it not B ? The source MAC on this leaf is learnt as a remote endpoint given the L3 out from which the end host is being may be on another leaf . It does not say it's the same leaf as what the L3 configured on ?
  4. asd248402 👍 1 Answered A
    Scenario 1 Local endpoint learning with an incoming packet from L3Out to Cisco ACI: Only the source MAC address is learned as a local endpoint. The source IP address is not learned as a local endpoint.
  5. Dspam 👍 1
    Local endpoint learning with an incoming packet from L3Out to Cisco ACI: Only the source MAC address is learned as a local endpoint. The source IP address is not learned as a local endpoint.
  6. hebdeb 👍 1 Answered A
    It is A https://www.cisco.com/c/en/us/solutions/collateral/data-center-virtualization/application-centric-infrastructure/white-paper-c11-739989.html#L3Outendpointlearningconsiderations
  7. korthab 👍 1
    This question is not stating where the L3Out is connected and therefore it is not possible to determine it is a local of remote endpoint.
  8. emoemo 👍 1
    I think B is correct. A is a description of "dest MAC", I thought.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Cisco ACI L2Out Loop-Free Topology Actions

S-grade

Configuring In-Band Management in Cisco ACI

S-grade

ACI Management and Data Plane Separation

S-grade

ACI Host Tracking ARP Request Count

S-grade

← Back to 300-620 Study Guide