Cisco ACI L2Out Loop-Free Topology Actions

The question asks for two actions to ensure a loop-free topology when deploying an L2Out in a Cisco ACI fabric with default forwarding behavior. The exhibit shows Leaf3 and Leaf4 connected via Eth1/1 and Eth1/2, which are also used as uplinks to external switches (implied by the context of L2Out deployment). This creates a potential Layer 2 loop within the fabric if not handled correctly.

First, consider the connection between Leaf3 and Leaf4. In Cisco ACI, direct inter-leaf links are generally discouraged unless specifically configured for Multi-Pod or other advanced features, but more importantly, connecting leaf switches directly can create loops if they share the same bridge domains or VLANs. Disconnecting the link between Leaf3 and Leaf4 eliminates a potential physical loop path that could form if both leaves connect to the same external Layer 2 network. Therefore, option C is a valid action to prevent loops.

Second, regarding the ports Eth1/1 and Eth1/2 on Leaf2 (and potentially others), these are likely the uplink ports to the external switches. To prevent loops from external STP/BPDUs entering the ACI fabric and causing issues, it is standard practice to use Link Aggregation Control Protocol (LACP) port channels for redundancy and load balancing, while also ensuring loop prevention mechanisms are in place. However, simply adding ports to an LACP port channel (Option A) provides redundancy but does not inherently prevent loops if there is a physical loop elsewhere. But wait, let's re-evaluate. The key here is "loop free topology".

Let's look at Option B: Enable MCP on the ports between the leafs and spine switches. MCP (MisCabling Protocol) is used in ACI to detect and mitigate misconfigurations, including potential loops caused by incorrect cabling. However, MCP is typically enabled globally or on specific interfaces to detect loops. Enabling it between leafs and spines helps maintain the integrity of the fabric's internal topology, preventing loops caused by accidental cabling errors. This is a strong candidate for maintaining a loop-free fabric.

Let's look at Option E: Configure BPDU guard on Catalyst switch ports. While BPDU guard is useful on access ports to prevent rogue switches, configuring it on the external Catalyst switches doesn't directly address the ACI fabric's internal loop prevention or the specific L2Out configuration within ACI. It's an external measure.

Re-evaluating based on ACI best practices for L2Out: When connecting an ACI fabric to an external Layer 2 network (L2Out), you must ensure that the connections do not create loops. The exhibit suggests a scenario where multiple leaves might be connected to the same external network. If Leaf3 and Leaf4 are both connected to the same external switch/VLAN, and they are also connected to each other, this creates a triangle loop. Disconnecting Leaf3 and Leaf4 (Option C) breaks this loop.

Additionally, using LACP port channels (Option A) for the uplinks to the external switches ensures that if one link fails, traffic can failover without creating a loop, provided the external switch is also configured with LACP. More critically, LACP itself prevents loops by negotiating the port channel state. If Eth1/1 and Eth1/2 are part of a port-channel to the external switch, LACP ensures only one active path exists logically, preventing loops. Thus, adding these ports to an LACP port channel is a correct action to ensure loop-free operation for the uplinks.

Therefore, the two actions are: Implementing LACP on the uplink ports to provide loop-free redundancy (A) and disconnecting the direct inter-leaf link that could cause a loop (C).