A network engineer must allow secure access to the Cisco ACl out-of-band (OOB) management only from external subnets 10 0 0024 and 192.168 20 G'25…

In Cisco ACI, restricting and securing out-of-band (OOB) management access requires establishing governed communication between specific external subnets and the fabric's management interfaces. This is achieved by first creating an OOB contract that specifies permitted management protocols, such as SSH or HTTPS. The designated Node Management OOB EPG provides this contract. To enforce the external subnet restrictions, an OOB External Management Network Instance Profile is configured to consume this contract. Finally, the specific allowed external subnets (10.0.0.0/24 and 192.168.20.0/25) are explicitly defined as subnet entries directly within the External Management Network Instance Profile.

Option A OOB management does not utilize an L3Out. L3Out configurations are exclusively used for In-Band management or standard tenant data plane external routing.

Option B Policy-Based Routing (PBR) service graphs redirect data plane traffic to Layer 4-7 devices. They are entirely inapplicable to foundational ACI node management access control.

Option D OOB management strictly relies on specialized Node Management EPGs and External Management Network Instance Profiles, not standard tenant EPGs and Bridge Domains.

Cisco Systems. Cisco APIC Basic Configuration Guide, Release 5.2(x). Chapter: Configuring Node Management. Section: "Configuring Out-of-Band Management using the GUI". Document ID: 1546282.

Cisco Systems. Cisco Application Centric Infrastructure Fundamentals. Chapter: "Management and Access". Section: "Out-of-Band Management Contract Configuration".