A retail bank added a VLAN to an ACI pool and associated an EPG, but the leaf access port never accepts that VLAN. The physical domain for the pool is not attached to the AAEP on the port's interface policy group. What is missing?
Select an answer to reveal the explanation.
Short Explanation
The paint color is in the catalog, but nobody gave the painter a work order for this door. You attach the physical domain that holds the VLAN pool to the AAEP, because that is what lets the interface policy group use the VLAN. Hardware proxy only changes how unknown unicast is forwarded, and it does not deploy access VLANs.
Full Explanation
ACI access policies form a chain. A VLAN pool is linked to a domain, the domain is referenced by an attachable access entity profile, and that profile is tied to the interface policy group that an interface profile applies to a leaf port. The bank put the VLAN in the pool and associated the EPG, but the physical domain never made it onto the AAEP, so the leaf port has no policy path to that VLAN. Attaching the domain to the AAEP completes the chain. Hardware proxy is a bridge-domain forwarding choice for unknown unicast. It does not push a VLAN pool onto an access port. Marking the leaf port as a fabric port points it at spine discovery, not at an endpoint VLAN, and an EPG association still needs the access-policy chain. A WWNN pool allocates Fibre Channel node names on a server platform. ACI access policies do not copy Ethernet VLANs out of a WWNN pool onto leaf interfaces. Caveat: the EPG still needs a static path or a VMM binding to the port, or a correct AAEP can exist while no endpoint VLAN is deployed. Operational check: attach the domain to the AAEP, redeploy the interface, and confirm the leaf port shows the VLAN when the endpoint comes up.