ACI Port Protection Against STP Loops

300-620 By islever Editorial Last updated

Implement Layer 2 connectivity (STP/MCP basics and EPG port bindings)

Short answer

B Per-VLAN MCP must be enabled on ACI leaf ports to protect the fabric from spanning-tree loops.

Question

An organization has encountered many STP-related issues in the past due to failed hardware components. They are in the process of long-term migration to a newly deployed ACI fabric. Senior engineers are worried that spanning-tree loops in the existing network may be extended to the ACI fabric. Which feature must be enabled on the ACI leaf ports to protect the fabric from spanning-tree loops?
  1. BPDU Guard
  2. per-VLAN MCP Correct Answer
  3. Storm Control
  4. BPDU Filter

Key Takeaways

The exam tests knowledge of ACI's loop prevention mechanisms, specifically distinguishing between BPDU Guard (which shuts down ports) and MCP (which drops frames silently), with the trap being the assumption that standard STP features apply directly.

This question addresses how to secure an ACI fabric during migration from legacy networks using Spanning Tree Protocol (STP). It establishes that Multi-Path Control (MCP) is the specific feature required to prevent loop propagation by dropping BPDUs without disabling ports.

Common mistake: Most candidates select BPDU Guard because it is a well-known STP protection mechanism in traditional networking; however, it is incorrect for ACI leaf ports because it causes port shutdowns, disrupting connectivity during migration.

Expert Analysis

Why the Answer Is Correct

Correct answer: B — Per-VLAN MCP must be enabled on ACI leaf ports to protect the fabric from spanning-tree loops. In Cisco ACI, the fabric does not participate in STP but acts as a hub, meaning BPDUs can traverse the fabric and cause loops if not handled. Multi-Path Control (MCP) is designed to detect and drop these BPDUs at the ingress port, preventing them from propagating into the fabric while keeping the link active.

Why the Other Options Are Wrong

BPDU Guard (A) and BPDU Filter (D) are traditional switchport features. BPDU Guard disables the port upon receiving a BPDU, which would break connectivity to the legacy network during migration. BPDU Filter ignores BPDUs but does not actively enforce the loop-prevention policy structure ACI uses. Per-VLAN MCP is the ACI-native solution that provides the necessary protection without disrupting the link state.

Community Comment Notes

Community consensus strongly favors option B, recognizing that ACI does not run STP. As user Marinheiro noted, "The ACI Fabric does not participate in spanning tree protocol..." User imanus highlighted that "failed hardware components" points to MCP's role in controlling paths. While some users suggested BPDU Guard or Filter based on general networking knowledge, the specific context of ACI migration requires MCP.

Exam Strategy

When migrating to ACI, always look for MCP when the scenario involves protecting against external STP BPDUs or miscabling issues. Do not assume traditional STP features like BPDU Guard are the correct ACI implementation unless explicitly stated otherwise.

Frequently Asked Questions

Why is BPDU Guard wrong for ACI leaf ports?

BPDU Guard shuts down the port when a BPDU is received, which would disconnect the ACI leaf from the legacy network during migration.

Does ACI participate in Spanning Tree Protocol?

No, ACI does not run STP. It acts as a hub for BPDUs, so MCP is needed to drop them and prevent loops within the fabric.

More 300-620 FAQ →

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

  1. udo2020 👍 2 Answered A
    BPDU Guard is a feature that protects the ACI fabric from potential spanning-tree loops by disabling ports that receive BPDUs. When enabled on the ACI leaf ports, BPDU Guard shuts down the port immediately if it detects BPDUs, preventing spanning-tree issues from propagating into the ACI fabric. This is especially critical during migration scenarios where legacy networks using Spanning Tree Protocol (STP) are connected to the ACI fabric, as it ensures the integrity of the ACI environment by isolating potential STP-related problems.
  2. imanus 👍 2 Answered B
    i think the key is failed hardware components - MCP controls that
  3. Marinheiro 👍 1 Answered B
    The ACI Fabric does not participate in spanning tree protocol (STP) but instead acts as hub with respect to STP. https://unofficialaciguide.com/2018/03/27/using-mcp-miscabling-protocol-for-aci/#:~:text=MCP%20supports%20256%20VLANs%20per,from%20APIC%20version%203.2%20onward.)
  4. Mars1017 👍 1 Answered D
    BPDUFilter is the correct answer. It will prevent loops from external network without disabling the port.
  5. Learninp09 👍 1 Answered B
    I go with B, Cisco ACI doesn't participate on Spanning Tree

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Cisco ACI L2Out Loop-Free Topology Actions

S-grade

Configuring In-Band Management in Cisco ACI

S-grade

ACI Management and Data Plane Separation

S-grade

ACI Host Tracking ARP Request Count

S-grade

← Back to 300-620 Study Guide