ACI Microsegmentation Network-Based Attribute

350-601 By islever Editorial Last updated

Apply ACI concepts

Short answer

D Use a MAC address network-based attribute to microsegment endpoints within the same IP subnet for subnet independence.

Question

An engineer implements an ACI fabric and must implement microsegmentation of endpoints within the same IP subnet using a network-based attribute. The attribute mapping must allow IP subnet independence. Which attribute must be selected?
  1. IP
  2. tag
  3. custom
  4. MAC address Correct Answer

Key Takeaways

ACI microsegmentation tests whether you know that IP-based uSeg EPGs cannot classify endpoints within the same subnet, making MAC address the required network-based attribute.

In Cisco ACI, microsegmenting endpoints within the same IP subnet requires using a MAC-based network attribute. This page establishes that MAC addresses provide the subnet independence necessary for intra-subnet microsegmentation enforcement.

Common mistake: Choosing IP because it seems like the primary network identifier, failing to recognize that IP-based uSeg EPGs only enforce policies on Layer 3 routed traffic, not bridged intra-subnet traffic.

Expert Analysis

Why the Answer Is Correct

In Cisco ACI, when implementing microsegmentation for endpoints within the same IP subnet, the traffic is bridged at Layer 2. IP-based microsegmented EPGs only support classification and policy enforcement when traffic requires Layer 3 routing. Therefore, to classify and enforce policies on intra-subnet traffic, you must use the MAC-based network attribute. The MAC address also provides IP subnet independence, as it operates independently of the IP subnet structure. This makes MAC address the only valid network-based attribute for this specific scenario.

Why the Other Options Are Wrong

Option A (IP) is incorrect because IP-based uSeg EPGs cannot classify endpoints within the same subnet; they only work for routed traffic. Options B (tag) and C (custom) are incorrect because the question specifically requires a "network-based attribute." In ACI,B and C are VM-based or custom tracking attributes, which do not meet the network-based requirement specified in the prompt.

Community Comment Notes

Community members correctly highlight that MAC-based attributes are required for same-subnet classification. As vincenzop noted, "If you want to use a network-based attribute and classify IP addresses in the same subnet, you must use the MAC-based network attribute." Others like mauchi pointed out that "subnet independence" explicitly rules out using an IP address. BananaMilkZ confirmed this limitation persists in newer ACI versions like 6.2(x).

Discussion 7 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 7

  1. vincenzop 👍 3
    "If you want to use a network-based attribute and classify IP addresses in the same subnet, you must use the MAC-based network attribute. IP-based microsegmented EPGs do not support classification for IP addresses in the same subnet. IP-based microsegmented EPGs are supported only when traffic requires Layer 3 routing. If the traffic is bridged, the microsegmentation policy cannot be enforced" https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/3-x/virtualization/b_ACI_Virtualization_Guide_3_1_1/b_ACI_Virtualization_Guide_3_1_1_chapter_0100.html
  2. Rmat2 👍 3
    Correct Answer - A
  3. mauchi 👍 2
    subnet independence - not using IP address
  4. GuyThatTakesDumps 👍 2
    D is correct
  5. BananaMilkZ 👍 1
    Still not possible for the same subnet in 6.2(x). "If you want to use a network-based attribute and classify IP addresses in the same subnet, you must use the MAC-based network attribute. IP-based microsegmented EPGs do not support classification for IP addresses in the same subnet. IP-based microsegmented EPGs are supported only when traffic requires Layer 3 routing. If the traffic is bridged, the microsegmentation policy cannot be enforced."
Show 2 more comments
  1. Pakawat 👍 1
    Network-Based Attributes The network-based attributes are IP (IP address filter) and MAC (MAC Address Filter). You can apply one or more MAC or IP addresses to a uSeg EPG. For IP addresses, you simply specify the address or the subnet; for MAC addresses, you simply specify the address.
  2. udo2020 👍 1
    Since 5.2 is it possible to use IP and MAC based. Not sure which version is related to exam.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

NX-OS Software Downgrade Impact Check

S-grade

Terraform ACI Provider Authentication and APIC DOS Threshold Counting

S-grade

MDS 9000 TE Port Channel for Multi-VSAN Trunking with Mismatch Suspension

S-grade

FCoE FC-Map Configuration to Prevent Cross-Fabric Talk

S-grade

← Back to 350-601 Study Guide