ACI Unknown Unicast Forwarding with Hardware Proxy

300-620 By islever Editorial Last updated

Implement bridge domain configuration settings such as unicast routing, Layer 2 unknown unicast, ARP flooding Describe ACI Object Model

Short answer

A LEAF102 forwards the packet to the spine (to the proxy VTEP address) for endpoint resolution.

Question

Refer to the exhibit.
Exhibit: ACI Unknown Unicast Forwarding with Hardware Proxy
HOST A and HOST B are connected to the same bridge domain with data plane learning and hardware proxy enabled. HOST B sends a packet to HOST A. If LEAF102 does not know the MAC address for HOST A, what is the forwarding mechanism?
  1. to forward the packet to the spine Correct Answer
  2. to flood the packet in the same bridge domain
  3. to look up its endpoint manager table cache
  4. to query the CO-OP database on the spine

Key Takeaways

Hardware proxy disables flooding for unknown unicasts; instead, traffic is sent to a proxy VTEP for EPm resolution.

In ACI with data plane learning and hardware proxy enabled, unknown unicast packets are forwarded to the proxy VTEP address rather than being flooded.

Common mistake: Choosing B (flood) because it assumes traditional Layer 2 behavior, ignoring that ACI's hardware proxy changes the forwarding mechanism for unknown destinations.

Expert Analysis

The Trap: Traditional Flood-and-Learn

The most attractive but incorrect approach is Option B (flood). In traditional Layer 2 networks, an unknown unicast frame is flooded to all ports within the broadcast domain. However, ACI uses a source-destination based forwarding model where endpoints are mapped to specific leaf switches via the Endpoint Manager (EPm). Because the question states that data plane learning is enabled, the leaf switch relies on hardware-assisted resolution rather than simple flooding.

Why A and D Are Incorrect

Option A (forwarding to spine) and Option D (querying CO-OP database) describe control-plane behaviors. While the APIC does use the CO-OP database for global endpoint mapping, individual leaf switches do not query the spine's CO-OP database for every unknown packet. Instead, they rely on local caches or proxy mechanisms. Furthermore, forwarding unknown traffic to the spine would create unnecessary latency and backbone congestion, violating ACI’s optimized forwarding principles.

The Correct Mechanism: Hardware Proxy

When hardware proxy is enabled and data plane learning is active, the leaf switch (LEAF102) does not flood the packet. Instead, it forwards the unknown destination packet to a proxy VTEP address. This proxy VTEP is typically associated with the bridge domain’s anycast gateway or a specific proxy endpoint managed by the fabric. The proxy VTEP then handles the lookup against the EPm table. If the endpoint is known in the fabric (but not locally cached), the proxy facilitates the correct encapsulation and forwarding. This mechanism ensures efficient, deterministic forwarding without flooding or excessive control-plane queries to the spine. Therefore, the packet is forwarded to the proxy VTEP address, which aligns with the behavior described in Option A if interpreted as sending to the fabric's proxy infrastructure, but strictly speaking, the action is 'forward to proxy VTEP'. Among the choices, forwarding to the spine is often used loosely to represent sending to the fabric's central proxy logic, but technically, the leaf sends it to the proxy VTEP. Given the options, A is the intended answer because the proxy VTEP resides in the fabric core/spine context for resolution, whereas flooding (B) is disabled by hardware proxy settings.

Correct answer: A — LEAF102 forwards the packet to the spine (specifically to the proxy VTEP address for resolution).

Exam Strategy

When you see 'hardware proxy' and 'data plane learning' in ACI questions, immediately rule out flooding (Option B). Remember that leaves do not query the spine's CO-OP directly for every packet (ruling out D). Instead, they send traffic to a proxy VTEP, which effectively acts as a central resolution point often associated with the spine or fabric core. Look for answers involving 'proxy VTEP' or forwarding to the fabric's central logic.

Frequently Asked Questions

Why doesn't ACI flood unknown unicast packets?

ACI uses a source-destination based forwarding model. With hardware proxy enabled, the leaf switch forwards unknown traffic to a proxy VTEP for resolution, avoiding the inefficiency of flooding.

Do leaf switches query the CO-OP database directly?

No, individual leaf switches do not query the spine's CO-OP database for every unknown packet. They rely on local caches or forward to the proxy VTEP, which handles the global lookup.

More 300-620 FAQ →

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 1 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 1

  1. ostych 👍 1 Answered A
    Leaf never queries COOP. If destination is unknown, it sends packet to proxy VTEP address.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Cisco ACI L2Out Loop-Free Topology Actions

S-grade

Configuring In-Band Management in Cisco ACI

S-grade

ACI Management and Data Plane Separation

S-grade

ACI Host Tracking ARP Request Count

S-grade

← Back to 300-620 Study Guide