Cisco ACI Spine-Leaf Fabric & Endpoint Policy Flow

What is Cisco Application Centric Infrastructure (ACI)?

Cisco ACI is Cisco's flagship software-defined networking (SDN) solution[cite: 1] for data centers. It unifies physical and virtual environments under an intent-based, policy-driven architecture using a centralized controller called the Application Policy Infrastructure Controller (APIC).

Core Policy Engine & Fabric Architecture

• Application Policy Infrastructure Controller (APIC): The central point of management, policy enforcement, and health monitoring that programs the underlying Spine-Leaf fabric.
• Spine-Leaf Clos Topology: A high-bandwidth, non-blocking fabric topology where Leaf switches connect to all Spine switches, providing consistent latency for east-west traffic.
• Endpoint Groups (EPGs): Logical abstractions that cluster objects (VMs, bare-metal servers, containers) sharing identical security and network policy needs regardless of IP or VLAN placement.
• Contracts & Subjects: Dictate how EPGs communicate. By default, ACI enforces a zero-trust model where communication between EPGs is denied unless explicitly permitted by a Contract.
• VXLAN Data Plane Overlay: Normalizes all fabric communication into VXLAN tunnels, mapping internal Virtual Network Identifiers (VNIDs) and Class-IDs (Source/Destination EPG tags) for distributed policy execution.

Key ACI Policy Hierarchy Terminology

• Tenant: A logical container for administrative isolation (e.g., Enterprise, Production, Dev, or Multi-tenant environments).
• VRF (Virtual Routing and Forwarding): Defines a unique Layer 3 routing domain / address space within a Tenant.
• Bridge Domain (BD): A Layer 2 forwarding construct within a VRF that defines broadcast domains and subnet gateways.