ACI Port Protection Against STP Loops
An organization has encountered many STP-related issues in the past due to failed hardware components. They are in the process of long-term migration to a newly deployed ACI fabric. Senior engineers are worried that spanning-tree loops in the existing network may be extended to the ACI fabric. Which feature must be enabled on the ACI leaf ports to protect the fabric from spanning-tree loops?
Community Insight
The exam tests knowledge of ACI's loop prevention mechanisms, specifically distinguishing between BPDU Guard (which shuts down ports) and MCP (which drops frames silently), with the trap being the assumption that standard STP features apply directly.
This question addresses how to secure an ACI fabric during migration from legacy networks using Spanning Tree Protocol (STP). It establishes that Multi-Path Control (MCP) is the specific feature required to prevent loop propagation by dropping BPDUs without disabling ports.
Most candidates select BPDU Guard because it is a well-known STP protection mechanism in traditional networking; however, it is incorrect for ACI leaf ports because it causes port shutdowns, disrupting connectivity during migration.
Community Discussion (5 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Correct answer: B — Per-VLAN MCP must be enabled on ACI leaf ports to protect the fabric from spanning-tree loops. In Cisco ACI, the fabric does not participate in STP but acts as a hub, meaning BPDUs can traverse the fabric and cause loops if not handled. Multi-Path Control (MCP) is designed to detect and drop these BPDUs at the ingress port, preventing them from propagating into the fabric while keeping the link active.Why the Other Options Are Wrong
BPDU Guard (A) and BPDU Filter (D) are traditional switchport features. BPDU Guard disables the port upon receiving a BPDU, which would break connectivity to the legacy network during migration. BPDU Filter ignores BPDUs but does not actively enforce the loop-prevention policy structure ACI uses. Per-VLAN MCP is the ACI-native solution that provides the necessary protection without disrupting the link state.Community Comment Notes
Community consensus strongly favors option B, recognizing that ACI does not run STP. As user Marinheiro noted, "The ACI Fabric does not participate in spanning tree protocol..." User imanus highlighted that "failed hardware components" points to MCP's role in controlling paths. While some users suggested BPDU Guard or Filter based on general networking knowledge, the specific context of ACI migration requires MCP.Official Reference
Exam Strategy
When migrating to ACI, always look for MCP when the scenario involves protecting against external STP BPDUs or miscabling issues. Do not assume traditional STP features like BPDU Guard are the correct ACI implementation unless explicitly stated otherwise.
Frequently Asked Questions
Why is BPDU Guard wrong for ACI leaf ports?
BPDU Guard shuts down the port when a BPDU is received, which would disconnect the ACI leaf from the legacy network during migration.
Does ACI participate in Spanning Tree Protocol?
No, ACI does not run STP. It acts as a hub for BPDUs, so MCP is needed to drop them and prevent loops within the fabric.