What is Rogue EP Control Feature in ACI?

--> Rogue EP Control feature is used to detect and prevent endpoint flapping issues in the ACI Network.

--> Once the Leaf Switch identifies any Endpoint in the network that is flapping then the Leaf Switch will block all the traffic to and from the endpoint instead of blocking the total bridge domain.

-->  Rogue EP Control also raises a fault that helps an administrator to identify the rogue endpoint.

--> By Default it is disabled to keep the settings the same as the older versions of ACI.

--> There are three parameters we need to configure for Rogue EP Control :

 i) Rogue EP Detection Interval : 

--> This is the time to detect Rogue Endpoint in the ACI Network.

--> Default is 60 Seconds.

--> Can be in the range of 30 seconds to 3600 seconds.

ii) Rogue EP Detection Multiplication Factor:

--> This is the number that tells how many times Endpoint moves/flaps to make the endpoint as Rogue Endpoint.

--> Default is 4.

--> Can be in the range of 2 to 10

iii) Hold Interval:

--> This is the time to stop the endpoint learning of Rogue Endpoint and make it a static Endpoint.

--> Once Hold Interval time is finished, The Endpoint information is deleted from Endpoint Table.

--> Default is 1800 Seconds.

--> Can be in the range of 1800 to 3600 Seconds.

--> Can be configured by navigating to System > System Settings > Endpoint Controls > Rogue EP Control

--> With the Default Configuration, The ACI Fabric detects and Identifies an endpoint as a rogue endpoint if the endpoint moves/flaps 4 times in 60 seconds which disables the endpoint learning of a particular endpoint.

--> There is an option to delete the rogue endpoint by going into the Leaf Switch.

--> If the Rogue EP Control feature is enabled then EP Move Dampening feature would not come into the picture.

Reference:

https://www.cisco.com/c/en/us/solutions/collateral/data-center-virtualization/application-centric-infrastructure/white-paper-c11-739989.html#Fabriclevelconfigurationoptions