AnswerCorrect answer: D — Use a MAC address network-based attribute to microsegment endpoints within the same IP subnet for subnet independence.
An engineer implements an ACI fabric and must implement microsegmentation of endpoints within the same IP subnet using a network-based attribute. The attribute mapping must allow IP subnet independence. Which attribute must be selected?
IP
tag
custom
MAC address Correct Answer
Community Insight
ACI microsegmentation tests whether you know that IP-based uSeg EPGs cannot classify endpoints within the same subnet, making MAC address the required network-based attribute.
In Cisco ACI, microsegmenting endpoints within the same IP subnet requires using a MAC-based network attribute. This page establishes that MAC addresses provide the subnet independence necessary for intra-subnet microsegmentation enforcement.
Choosing IP because it seems like the primary network identifier, failing to recognize that IP-based uSeg EPGs only enforce policies on Layer 3 routed traffic, not bridged intra-subnet traffic.
Community Discussion (9 comments)
udo2020👍 1
Since 5.2 is it possible to use IP and MAC based. Not sure which version is related to exam.
BananaMilkZ👍 1
Still not possible for the same subnet in 6.2(x). "If you want to use a network-based attribute and classify IP addresses in the same subnet, you must use the MAC-based network attribute. IP-based microsegmented EPGs do not support classification for IP addresses in the same subnet. IP-based microsegmented EPGs are supported only when traffic requires Layer 3 routing. If the traffic is bridged, the microsegmentation policy cannot be enforced."
GuyThatTakesDumps👍 2
D is correct
mahmoudlol👍 2Selected: D
D is Correct
mauchi👍 2
subnet independence - not using IP address
sepehr63👍 9
D is correct
Pakawat👍 1
Network-Based Attributes The network-based attributes are IP (IP address filter) and MAC (MAC Address Filter). You can apply one or more MAC or IP addresses to a uSeg EPG. For IP addresses, you simply specify the address or the subnet; for MAC addresses, you simply specify the address.
Rmat2👍 3
Correct Answer - A
vincenzop👍 3
"If you want to use a network-based attribute and classify IP addresses in the same subnet, you must use the MAC-based network attribute. IP-based microsegmented EPGs do not support classification for IP addresses in the same subnet. IP-based microsegmented EPGs are supported only when traffic requires Layer 3 routing. If the traffic is bridged, the microsegmentation policy cannot be enforced" https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/3-x/virtualization/b_ACI_Virtualization_Guide_3_1_1/b_ACI_Virtualization_Guide_3_1_1_chapter_0100.html
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Log in to comment, report an error, or add a note about this question.
Expert Analysis
Why the Answer Is Correct
In Cisco ACI, when implementing microsegmentation for endpoints within the same IP subnet, the traffic is bridged at Layer 2. IP-based microsegmented EPGs only support classification and policy enforcement when traffic requires Layer 3 routing. Therefore, to classify and enforce policies on intra-subnet traffic, you must use the MAC-based network attribute. The MAC address also provides IP subnet independence, as it operates independently of the IP subnet structure. This makes MAC address the only valid network-based attribute for this specific scenario.
Why the Other Options Are Wrong
Option A (IP) is incorrect because IP-based uSeg EPGs cannot classify endpoints within the same subnet; they only work for routed traffic. Options B (tag) and C (custom) are incorrect because the question specifically requires a "network-based attribute." In ACI,B and C are VM-based or custom tracking attributes, which do not meet the network-based requirement specified in the prompt.
Community Comment Notes
Community members correctly highlight that MAC-based attributes are required for same-subnet classification. As vincenzop noted, "If you want to use a network-based attribute and classify IP addresses in the same subnet, you must use the MAC-based network attribute." Others like mauchi pointed out that "subnet independence" explicitly rules out using an IP address. BananaMilkZ confirmed this limitation persists in newer ACI versions like 6.2(x).