Endpoint Learning Optimizations

If limit IP learning to subnet option is enabled, the local endpoint IP learning will be limited to only IP addresses for subnets configured on the bridge domain. This option does not limit remote endpoint IP learning. This option is enabled by default.

If this option is enabled on a bridge domain that had the option that is disabled, endpoint IP addresses that do not belong to the bridge domain subnet are flushed

if a bridge domain is configured with a subnet address of 192.168.1.254/24, the fabric does not learn a local endpoint IP address, such as 192.168.2.1/24, that is outside this range. This behavior prevents unnecessary IP learning, as shown in the following figure.

Although this feature prevents local IP learning, the local leaf still learns the MAC address, and the remote leaf still learns the IP and MAC addresses (although the local leaf does not learn the IP address, it does not drop the packet). For example, leaf 1 does not learn 192.168.2.1, but it learns MAC B, and leaf 2 learns 192.168.2.1 and MAC B.

Enforce Subnet Check

Cisco ACI offers two similar configurations that are related to limiting the data plane learning of endpoints’ IP addresses:

• Per-bridge domain limit IP address learning to subnet
• Global enforce subnet check knob

Enforce subnet check feature ensures that Cisco ACI learns endpoints whose IP addresses belong to the bridge domain subnet. This feature also ensures that leaf switches learn remote entries whose IP addresses belong to the VRF that they are associated with, preventing the learning of IP addresses that are not configured as subnets on the bridge domains of the VRF.

This feature can be enabled and disabled only globally under fabric wide setting policy. You cannot enable this option only in one VRF instance. This feature is disabled by default.

Enforce subnet check works as follows:

• On the ingress leaf (local endpoint learning): The option enforces bridge domain–level subnet checks for local endpoint learning. When this feature is enabled, the Cisco ACI leaf learns an IP address and MAC address as a new local endpoint only when the source IP address of the incoming packet belongs to one of the ingress bridge domain subnets. This behavior is almost the same as limit IP learning to subnet option under the bridge domain. The difference is that limit IP learning to subnet limits only IP learning if the source IP address of a packet does not belong to an ingress bridge domain subnet, whereas this feature limits learning of both the MAC address and IP address when IP learning is triggered but yet prevented because the source IP address does not belong to an ingress bridge domain subnet. This check will be enabled on all bridge domains, and you cannot turn the checks on and off per bridge domain. Therefore, limit IP learning to subnet is not required when this feature is enabled.

• On the egress leaf (remote endpoint learning): This option enforces VRF-level subnet checks for remote endpoint learning. When this feature is enabled, the Cisco ACI leaf will learn an IP address as a remote endpoint only when the source IP address of the incoming packet belongs to any bridge domain subnet in the same VRF instance on the egress leaf. This behavior prevents IP spoofing scenarios, in which an endpoint sends a packet with an unexpected source IP address that does not belong to any of the bridge domains on the VRF instance, such as an IP address that exists behind the Layer 3 Outside connection.

Enforce Subnet Check Use Case

When enforce subnet check is enabled leaf 1 does not learn either MAC S2 or IP 172.16.0.1 as a local endpoint, because 172.16.0.1 does not belong to ingress BD1. Leaf 2 does not learn IP 172.16.0.1 as a remote endpoint, because 172.16.0.1 does not belong to any of the bridge domain subnets on leaf 2 in the same VRF instance. If 172.16.0.1 is learned as a local endpoint on leaf 1 and the remote endpoint on leaf 2 before this feature is enabled, those two endpoints are cleared after this feature is enabled.

IP Data-Plane Learning (VRF-Level)