Cisco 700-702 Exam Dumps

  Per-tenant admin separation

Explanation: Cisco ACI permits tenant users to modify the parameters and configuration
of the ACI fabric that they own and control. They can also read statistics and monitor faults
and events for the entities (managed objects) that apply to them, such as endpoints, EPGs,
and application profiles. Tenant users can perform configuration changes and read fault
and event logs from the parts of the ACI fabric to which they have access.
The ACI switch operating system includes a role-based access control (RBAC) feature that
allows highly specific access for a given role. This RBAC feature scales to a maximum of
64 unique roles and 256 rules per role. The ACI APIs retrieve data directly from the object
store. A core APIC internal data access control system provides multitenant isolation and
prevents information privacy from being compromised across tenants. Read and write
restrictions prevent any tenant from seeing any other tenant's configuration, statistics,
faults, or event data. Unless the administrator assigns permissions to do so, tenants are
restricted from reading fabric configuration, policies, statistics, faults, and events.
The APIC implements a two-level solution for access control:
• Traditional role-based control: This control level defines the types of objects that a user is
authorized to access. Users are assigned roles (collections of privileges) that govern readonly
or read-write access to managed objects in the system. All managed object classes
have one or more privileges that are assigned to them.
• Domain-based control. This control level defines the domains in which a user is
authorized to access objects.

 VxLAN
 

Reference: http://keepingitclassless.net/2013/11/insieme-and-cisco-aci-part-2-aci-andprogrammability/
(see the para below the figure)
The ACI fabric supports more than 64,000 dedicated tenant networks. A single fabric can
support more than one million IPv4/IPv6 endpoints, more than 64,000 tenants, and more
than 200,000 10G ports. The ACI fabric enables any service (physical or virtual) anywhere
with no need for additional software or hardware gateways to connect between the physical
and virtual services and normalizes encapsulations for Virtual Extensible Local Area
Network (VXLAN) / VLAN / Network Virtualization using Generic Routing Encapsulation
(NVGRE).
rhe ACI fabric decouples the endpoint identity and associated policy from the underlying
forwarding graph. It provides a distributed Layer 3 gateway that ensures optimal Layer 3
and Layer 2 forwarding. The fabric supports standard bridging and routing semantics
without standard location constraints (any IP address anywhere), and removes flooding
requirements for the IP control plane Address Resolution Protocol (ARP) / Generic Attribute
Registration Protocol (GARP). All traffic within the fabric is encapsulated within VXLAN.

External OSPF router