Cisco ACI: Application Centric Infrastructure Fundamentals

Introduction

Cisco ACI (Application Centric Infrastructure) is a Software-Defined Networking (SDN) solution for data centers. Unlike traditional networking where you configure each device individually, ACI uses a centralized controller (APIC) and a policy-based model. This guide covers ACI fundamentals for engineers transitioning from traditional networking.

ACI vs Traditional Networking

Concept	Traditional	ACI Equivalent
VLAN	VLAN	EPG (Endpoint Group)
IP Subnet	IP Subnet	BD (Bridge Domain)
VRF	VRF	VRF (Context)
Routing	Static/OSPF/BGP	L3Out
Security	ACL/Firewall	Contract
Grouping	VLAN membership	EPG membership

ACI Logical Model

TEXT

Tenant (customer or department)
 └── VRF (Layer 3 domain)
      └── BD (Bridge Domain = L2 + L3)
           └── EPG (Endpoint Group = endpoints with same policy)
                └── Contracts (allow/deny between EPGs)

ACI Physical Model

TEXT

APIC Cluster (3+ controllers)
 └── Spine Switches (high-speed fabric)
      └── Leaf Switches (ToR - Top of Rack)
           └── Servers, Firewalls, Load Balancers

All traffic between leaves goes through a spine — there's no direct leaf-to-leaf connection.

Key Concepts

EPG (Endpoint Group)

All VMs/servers with the same security policy belong to the same EPG
An EPG can span multiple leaf switches
Endpoints (VMs) are discovered automatically when they connect

BD (Bridge Domain)

Defines the L2 and L3 domain
Has one or more subnets (like an SVI)
Controls ARP behavior (unicast or flood)

Contract

Defines allowed traffic between EPGs
Replaces traditional ACLs
Applied between provider and consumer EPGs

L3Out

External Layer 3 connectivity (to internet, WAN, non-ACI networks)
Can run OSPF, BGP, or EIGRP with external routers

Basic Tenant Configuration (via GUI)

Create Tenant: Tenant → Add Tenant → Name: Production

Create VRF: Networking → VRFs → + → Name: Prod-VRF

Create BD: Networking → Bridge Domains → + → Name: Web-BD

Assign to Prod-VRF
Add subnet: 192.168.10.1/24

Create EPGs:

Application Profiles → + → Web-App
EPGs → + → Web-EPG → assign to Web-BD
EPGs → + → DB-EPG → assign to DB-BD

Create Contract:

Contracts → + → Web-to-DB → Port 3306
Apply: DB-EPG provides, Web-EPG consumes

ACI via REST API

ACI has a full REST API — great for automation:

PYTHON

import requests
import json

APIC = "https://apic.company.com"
USERNAME = "admin"
PASSWORD = "yourpassword"

# Login
login_data = {"aaaUser": {"attributes": {"name": USERNAME, "pwd": PASSWORD}}}
response = requests.post(f"{APIC}/api/aaaLogin.json", json=login_data, verify=False)
token = response.json()["imdata"][0]["aaaLogin"]["attributes"]["token"]
cookies = {"APIC-cookie": token}

# Create a tenant
tenant_data = {
    "fvTenant": {
        "attributes": {
            "name": "NewTenant",
            "descr": "Created via API"
        }
    }
}
response = requests.post(
    f"{APIC}/api/node/mo/uni/tn-NewTenant.json",
    json=tenant_data,
    cookies=cookies,
    verify=False
)
print(response.status_code)

# Get all EPGs
response = requests.get(
    f"{APIC}/api/node/class/fvAEPg.json",
    cookies=cookies,
    verify=False
)
epgs = response.json()["imdata"]
for epg in epgs:
    print(epg["fvAEPg"]["attributes"]["dn"])

ACI with Ansible

YAML

# Install collection
# ansible-galaxy collection install cisco.aci

- name: Create ACI Tenant
  hosts: apic
  gather_facts: no
  tasks:
    - name: Create tenant
      cisco.aci.aci_tenant:
        host: "{{ apic_host }}"
        username: "{{ apic_username }}"
        password: "{{ apic_password }}"
        tenant: Production
        description: "Production tenant"
        state: present
        validate_certs: no

    - name: Create VRF
      cisco.aci.aci_vrf:
        host: "{{ apic_host }}"
        username: "{{ apic_username }}"
        password: "{{ apic_password }}"
        tenant: Production
        vrf: Prod-VRF
        state: present
        validate_certs: no

    - name: Create EPG
      cisco.aci.aci_epg:
        host: "{{ apic_host }}"
        username: "{{ apic_username }}"
        password: "{{ apic_password }}"
        tenant: Production
        ap: Web-App
        epg: Web-EPG
        bd: Web-BD
        state: present
        validate_certs: no

Troubleshooting ACI

BASH

# On APIC CLI
show tenant <tenant-name>
show epg
show contract

# On Leaf CLI (SSH to leaf)
show endpoint
show vlan extended
show ip arp

# Faults (check APIC GUI)
# Tenant → Operational → Faults
# Look for: BD/EPG not deployed, Contract misconfiguration

# Trace a packet between EPGs
# APIC → Troubleshoot → Endpoint Reachability