Role of VRF in ACI VXLAN Endpoint Routing
Short answer
A The VRF is essential because it provides the routing context required to look up and determine the IP address of a remote endpoint.
Question
Key Takeaways
The main trap is confusing Layer 2 isolation (BD/EPG) with Layer 3 routing context (VRF); VRF is required for IP lookup.
This page explains why the VRF is the correct answer for determining remote endpoint IP addresses in ACI VXLAN headers, distinguishing it from BD, pcTag, and EPG.
Common mistake: Choosing B (bridge domain) is common because BDs define Layer 2 segments, but they do not provide the routing table context needed for IP address determination.
Expert Analysis
The question asks which VXLAN header field is essential for determining the IP address of a remote endpoint. In Cisco ACI, the VXLAN Network Identifier (VNI) is used to identify the broadcast domain (Bridge Domain). However, the VNI itself does not contain routing information.
To route traffic to a specific IP address within that BD, the switch must know which Virtual Routing and Forwarding (VRF) instance owns that BD. The VRF provides the routing table context. Without knowing the VRF, the switch cannot perform Layer 3 lookup to determine the next-hop or resolve the destination IP. Therefore, the VRF is the critical piece of information in the forwarding decision process (often carried via the tenant/VRF mapping in the policy model) to reach a remote endpoint's IP.
Comments correctly note that the Bridge Domain (BD) is for Layer 2 isolation and MAC learning, not IP routing. The pcTag (Policy Class Tag) is used for contract enforcement (policy matching), not for IP address resolution or routing. The EPG (Endpoint Group) is a logical grouping of endpoints but does not directly provide the IP routing context needed to reach a specific remote IP.
Exam Strategy
When asked about 'determining an IP address' or 'routing' in ACI, always look for VRF or L3Out components first. If the question focuses on 'policy', 'contracts', or 'classification', look for pcTag or EPG. If it focuses on 'broadcast domains' or 'MAC learning', look for BD or VNI. This distinction between L2 and L3 contexts is a frequent exam theme.
Frequently Asked Questions
Why isn't the Bridge Domain used to find the IP address?
What is the role of pcTag in ACI?
Community Votes
100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 1 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 1
-
ostych 👍 1 Answered AVRF is used when routing, e.g. L3. BD - used only for L2 and MAC. pcTag - policy class tag used for the classification of traffic and for Policy Enforcement (Contract Enforcement)
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.