1. What Is Cisco ACI?
Cisco Application Centric Infrastructure (ACI) is Cisco’s policy-driven data center networking architecture. Instead of treating the network primarily as a collection of individually configured switches, ACI models application and connectivity requirements as policy and uses that policy to provision and operate the fabric.
At the physical level, an ACI fabric uses a spine-leaf topology built around Cisco Nexus 9000 Series switches. The Application Policy Infrastructure Controller (APIC) provides centralized policy, automation, management and health monitoring for the fabric.
The key idea is to separate application intent from individual device configuration. Administrators define constructs such as tenants, VRFs, bridge domains, application profiles, endpoint groups and contracts; ACI translates those policies into fabric behavior.
2. Why Cisco ACI Uses an Application-Centric Model
Traditional networking often starts with interfaces, VLANs, routing protocols and ACLs. ACI can use these concepts, but its policy model starts with application relationships: which workloads need to communicate, under what conditions, and through which services.
Endpoint Groups (EPGs) represent groups of endpoints that share policy. Contracts define permitted communication between EPGs. Cisco also supports network-centric designs, so ACI does not require every deployment to use a highly granular application model.
3. Cisco ACI Architecture at a Glance
| Layer | Main Elements | Purpose |
|---|---|---|
| Management / Policy | APIC | Centralized policy definition, automation, management and health monitoring |
| Fabric | Spine + Leaf | High-speed forwarding fabric connecting endpoints |
| Platform | Cisco Nexus 9000 Series | Switching platform for ACI spine/leaf roles |
| Overlay | VXLAN | Carries logical tenant and endpoint traffic |
| Policy model | Tenant, VRF, BD, EPG, Contract | Defines segmentation and communication policy |
| External connectivity | L2Out / L3Out | Connects ACI to external networks |
| Integrations | VMM / L4–L7 services | Connects virtualization and service devices |
Cisco’s current ACI documentation describes a spine-leaf fabric using VXLAN to decouple Layer 2 domains from the underlying Layer 3 infrastructure. Traffic is classified and policy is applied at the fabric edge. Cisco documents IS-IS and COOP for internal fabric operations and MP-BGP for external routing information.
4. Core Cisco ACI Components
4.1 Cisco APIC
The Application Policy Infrastructure Controller (APIC) is the central management and policy component of ACI. It provides the interface for defining policy and supports automation, fabric monitoring and operational visibility.
4.2 Spine Switches
Spine switches form the central transport layer. They connect to leaf switches and provide the high-speed paths used for traffic across the fabric. Endpoints normally connect to leaf switches.
4.3 Leaf Switches
Leaf switches form the edge of the fabric. Servers, virtual workloads and external connections attach to leaf interfaces. Leaf switches classify traffic entering or leaving the fabric and enforce relevant policy.
4.4 Cisco Nexus 9000 Series
Cisco identifies Nexus 9000 Series switches as the switching foundation for on-premises ACI fabrics. Exact models and supported roles vary by release, so deployment planning should use current Cisco compatibility documentation.
5. Cisco ACI Logical Constructs
| Construct | Simple Explanation | Relationship |
|---|---|---|
| Tenant | Logical container for application policies | Contains or references VRFs, application profiles, EPGs and network objects |
| VRF | Layer 3 forwarding and policy domain | One VRF can contain multiple bridge domains |
| Bridge Domain | Layer 2 forwarding / broadcast-domain construct | Associated with a VRF |
| Application Profile | Container for application EPGs | Contains one or more EPGs |
| EPG | Logical group of endpoints sharing policy | Associated with a BD; participates in contracts |
| Contract | Policy describing permitted communication | Connects provider and consumer EPGs |
| Filter | Traffic-matching rules | Used by contracts |
| L3Out | External Layer 3 connectivity construct | Connects ACI to external routed networks |
5.1 Tenant
A tenant is a logical container for application policies. It is a policy-level construct, not automatically a private physical network.
5.2 VRF
A VRF, or context, defines a Layer 3 address and forwarding domain. A tenant can contain multiple VRFs, and a VRF can be associated with multiple bridge domains.
5.3 Bridge Domain
A bridge domain represents a Layer 2 forwarding construct and broadcast-domain boundary. It is associated with a VRF and can contain a subnet used for routing.
5.4 Application Profile
An application profile groups EPGs representing application components. A three-tier application might use Web, App and Database EPGs.
5.5 Endpoint Group (EPG)
An EPG is a logical group of endpoints that share common policy. EPGs are central to the application-centric model.
5.6 Contracts
Contracts define permitted communication between EPGs. An EPG can provide a contract while another consumes it; filters identify the traffic allowed.
6. How Cisco ACI Works: From Policy to Packet
Step 1: Define the policy
An administrator defines tenants, VRFs, bridge domains, application profiles, EPGs and contracts through APIC.
Step 2: Attach endpoints
Servers or virtual workloads connect to leaf switches and are classified into the appropriate EPG.
Step 3: Establish forwarding context
The EPG is associated with a bridge domain, which is associated with a VRF.
Step 4: Apply communication policy
Contracts determine whether traffic between EPGs is allowed and which traffic characteristics are permitted.
Step 5: Encapsulate and forward
Traffic entering the fabric is classified and encapsulated for transport. VXLAN carries overlay traffic while the underlay provides transport.
Step 6: Deliver at the destination leaf
The fabric forwards traffic toward the destination leaf, where it is delivered to the endpoint.
Step 7: Monitor
APIC provides faults, events, health and policy information for operations and troubleshooting.
7. Cisco ACI VXLAN and the Underlay/Overlay
ACI uses a routed fabric underlay and an overlay that carries endpoint and tenant traffic. VXLAN helps preserve Layer 2 adjacency across the fabric while decoupling Layer 2 domains from the underlying Layer 3 transport.
A useful mental model is: the underlay provides the transport path between fabric nodes; the overlay represents the logical connectivity ACI is delivering.
| Concept | Role |
|---|---|
| Underlay | IP-based transport between fabric nodes |
| VXLAN overlay | Carries logical endpoint and tenant traffic |
| Leaf | Fabric edge where endpoints attach and traffic is classified |
| Spine | Central transport layer between leaves |
| COOP | Supports endpoint information distribution |
| IS-IS | Used for internal fabric routing/operations |
| MP-BGP | Used for propagating external routing information in relevant designs |
8. External Connectivity: L2Out and L3Out
8.1 L2Out
L2Out provides Layer 2 extension between ACI and an external Layer 2 network. Design considerations include the external topology, EPG port bindings and loop-prevention interactions.
8.2 L3Out
L3Out provides Layer 3 connectivity from ACI to external routed networks. It is associated with a VRF and can use supported dynamic routing protocols or static routing depending on the design. External networks are represented through policy constructs, including external EPGs.
9. ACI Contracts and Policy Enforcement
Contracts are one of the most important ACI concepts because they turn application relationships into enforceable network policy.
| Scenario | ACI Policy Model |
|---|---|
| Web needs App | Web EPG consumes a contract provided by App EPG |
| App needs DB | App EPG consumes a contract provided by DB EPG |
| Web should not reach DB | Do not define a permitted contract relationship, or use explicit policy to restrict traffic |
| Internal app needs an external service | Connect internal and external policy constructs through the relevant contract relationship |
Cisco describes the ACI security architecture as an allow-list model. By default, unicast communication between different EPGs is not permitted unless policy such as a contract allows it; special modes and exceptions should be understood from the relevant ACI release documentation.
10. ACI Integrations: VMM and Layer 4–7 Services
10.1 Virtual Machine Manager Integration
ACI can integrate with virtualization environments so virtual workloads participate in the ACI policy model. Cisco’s DCACI training specifically includes VMM integration and VMware vCenter integration.
10.2 Layer 4–7 Service Integration
ACI can integrate supported Layer 4–7 services such as firewalls and load balancers. Service graphs and related policy mechanisms can insert services into application traffic paths where required.
11. Cisco ACI Management and Visibility
ACI centralizes policy and operational visibility through APIC. Administrators can inspect fabric discovery, faults, events, audit information, health, endpoints and policy relationships. Management can use in-band and out-of-band approaches, with monitoring and logging options depending on the release and design.
12. Cisco ACI vs Traditional Data Center Networking
| Area | Traditional Approach | ACI Approach |
|---|---|---|
| Configuration | Often device/interface focused | Policy model coordinated through APIC |
| Segmentation | VLANs, VRFs, ACLs and device-level constructs | Tenants, VRFs, BDs, EPGs and contracts |
| Application policy | Often distributed across configuration points | Application relationships represented through policy |
| Fabric topology | May use hierarchical designs | Spine-leaf fabric |
| Overlay | May be separately designed | VXLAN-based ACI overlay |
| Operations | Multiple device views | Fabric-wide policy and operational view |
| Automation | Depends on tools and processes | Policy-driven automation is a core design principle |
13. Cisco ACI and the 300-620 DCACI Exam
Cisco ACI is directly relevant to the 300-620 DCACI: Implementing Cisco Application Centric Infrastructure exam, a concentration option for CCNP Data Center.
Cisco currently lists 300-620 DCACI as a 90-minute exam. Passing earns the Cisco Certified Specialist – Data Center ACI Implementation credential and can satisfy the concentration exam requirement for CCNP Data Center when combined with the required core exam. Cisco currently lists no formal prerequisites.
| Item | Current Cisco Information |
|---|---|
| Exam | 300-620 DCACI: Implementing Cisco Application Centric Infrastructure |
| Duration | 90 minutes |
| Cost | US$300, or Cisco Learning Credits |
| Language | English |
| Prerequisites | None |
| Specialist credential | Cisco Certified Specialist – Data Center ACI Implementation |
The current Cisco DCACI training outline covers ACI fabric infrastructure and concepts, policy model constructs, packet forwarding, external connectivity, VMM integration, Layer 4–7 integrations and management. Cisco’s training labs include fabric discovery, access policies, vPC, EPG connectivity, L2/L3 external connections and VMware vCenter integration.
14. Common Cisco ACI Concepts to Master
| Concept | What to Understand |
|---|---|
| APIC | Policy, automation, management and health |
| Spine-leaf | How the fabric forwarding topology works |
| Tenant | Policy-level logical container |
| VRF | Layer 3 forwarding/policy domain |
| Bridge Domain | Layer 2 forwarding and broadcast-domain construct |
| EPG | Logical group of endpoints sharing policy |
| Contract | Permitted communication relationship |
| Filter | Traffic-matching rules used by contracts |
| VXLAN | Overlay encapsulation across the fabric |
| L3Out | External Layer 3 connectivity |
| Endpoint learning | How the fabric learns endpoint information |
| VMM integration | How virtual workloads participate in policy |
| Service graph | Mechanism for supported L4–7 service integration |
15. Common Mistakes When Learning ACI
- Memorising object names without understanding their relationships.
- Treating a tenant as automatically equal to a physical network.
- Confusing a bridge domain with an EPG.
- Assuming an EPG is simply another name for a VLAN.
- Learning contracts only as ACLs instead of provider-consumer policy.
- Skipping packet forwarding and endpoint learning.
- Learning L3Out only from GUI steps instead of understanding routing.
- Focusing on configuration screens without tracing traffic.
- Practising theory without a hands-on lab.
- Using an old exam blueprint without checking current Cisco documentation.
16. A Practical Cisco ACI Learning Path
| Phase | Focus | Outcome |
|---|---|---|
| 1 | Networking foundation: Ethernet, VLANs, STP, routing, VRF, BGP | Understand what ACI abstracts |
| 2 | Fabric architecture: spine, leaf, APIC, discovery | Explain physical/control architecture |
| 3 | Policy model: tenant, VRF, BD, AP, EPG, contracts | Build a basic application policy |
| 4 | Forwarding: endpoint learning, VXLAN, traffic flow | Trace endpoint traffic |
| 5 | External connectivity: L2Out, L3Out, routing | Connect ACI to external networks |
| 6 | Integrations: VMM and L4–7 | Understand workload/service integration |
| 7 | Operations: faults, events, health, audit, troubleshooting | Diagnose issues |
| 8 | Certification practice: DCACI topics + labs | Validate theory and configuration skills |
The strongest learning approach combines documentation with hands-on work. ACI becomes easier to reason about when you can create a small policy model, connect endpoints, permit traffic with contracts and trace the resulting packet path.
17. Frequently Asked Questions
What is Cisco ACI in simple terms?
Cisco ACI is a policy-driven data center networking architecture using APIC and a spine-leaf fabric to translate application and network policy into fabric behavior.
What are the main components of Cisco ACI?
The primary building blocks are APIC and Cisco Nexus 9000 Series spine and leaf switches. The logical model adds tenants, VRFs, bridge domains, application profiles, EPGs and contracts.
What is APIC in Cisco ACI?
APIC is the Application Policy Infrastructure Controller, providing centralized policy, automation, management and health visibility.
What is an EPG in ACI?
An Endpoint Group is a logical grouping of endpoints that share policy and participate in contract relationships.
What is the difference between a bridge domain and an EPG?
A bridge domain is a Layer 2 forwarding/broadcast-domain construct associated with a VRF. An EPG is a policy grouping of endpoints and can be associated with a bridge domain.
What is a contract in Cisco ACI?
A contract is a policy construct defining permitted communication between EPGs using provider-consumer relationships and filters.
Does Cisco ACI use VXLAN?
Yes. VXLAN is used as part of the ACI fabric overlay to carry logical endpoint and tenant traffic.
What is L3Out in Cisco ACI?
L3Out is the construct used to provide Layer 3 connectivity from the ACI fabric to external routed networks.
Is Cisco ACI included in CCNP Data Center?
ACI is a concentration option through the 300-620 DCACI exam. Passing DCACI can satisfy the concentration requirement when combined with the required core exam.
Are there prerequisites for 300-620 DCACI?
Cisco currently lists no formal prerequisites, while recommending knowledge of networking, Cisco switching, data center architecture and virtualization fundamentals.
18. Conclusion
Cisco ACI is easiest to understand as a relationship between architecture, policy and forwarding. The spine-leaf fabric provides the transport foundation. APIC provides the policy and management model. Tenants, VRFs, bridge domains, application profiles and EPGs describe the logical environment, while contracts determine how workloads are allowed to communicate.
For engineers learning ACI, the goal should not be to memorise every APIC screen. The stronger approach is to understand why each object exists, how objects relate, and what happens to a packet as it moves from an endpoint into and across the fabric.
For certification candidates, this foundation is especially useful for the 300-620 DCACI exam, which covers ACI infrastructure, policy constructs, forwarding, external connectivity, integrations and management.