PLNOG14: Cisco ACI, Simplified Policy based SDN (N. Martin)

### Overview Presented at PLNOG14 by an infrastructure architect at Cisco, this talk introduces Cisco Application Centric Infrastructure (ACI) and its policy-based approach to software-defined networking (SDN). While computing, storage, operating systems, and application paradigms have modernized, traditional network management practices remain reliant on complex, error-prone manual device configurations. Cisco ACI addresses this operational bottleneck by presenting an integrated physical and virtual fabric managed as a single large switch driven by declarative intent rather than rigid, device-specific configurations.

### Key Topics - **Leaf-Spine (Clos) Fabric Architecture**: ACI deconstructs traditional chassis switches by mapping line cards to leaf switches and fabric modules to spine switches connected via 40GbE, enabling modular, horizontal scaling. - **Unified Underlay and Overlay Integration**: Fabric encapsulation uses VXLAN to separate endpoint identity from network location, enabling multi-tenancy and consistent handling of virtual machines, physical bare-metal workloads, and containers. - **Application Network Profiles & Group-Based Policy**: Moving away from VLANs, subnets, and ACLs, ACI defines communication via Endpoint Groups (EPGs) connected by contracts using a zero-trust whitelist model. - **Declarative vs. Imperative Control**: Rather than relying on centralized controllers that dictate step-by-step forwarding instructions (e.g., OpenFlow), ACI distributes policy declaratively to nodes via the OpFlex protocol, leaving forwarding decisions autonomous. - **ASIC-Driven Visibility and Telemetry**: Custom hardware ASICs measure packet latency and end-to-end congestion across hops, enabling dynamic load balancing, flow prioritization, and fabric-to-application health scores.

### Technical Details - **Scale and Forwarding Management**: Standard software overlay fabrics often experience scaling bottlenecks when endpoint mobility forces forwarding table updates across thousands of virtual tunnel endpoints (VTEPs). ACI resolves this by maintaining only local forwarding entries on leafs and routing non-local queries through spines using proxy tunnel routers, reducing updates to an order of magnitude of one. - **Pervasive Layer 3 Gateways**: Every leaf switch acts as a default gateway for every subnet, removing the need for broadcast flooding to locate endpoints and guaranteeing deterministic latency across a maximum of two hops (leaf-spine-leaf). - **Protocol and Ecosystem Integration**: Underlying fabric routing is handled by IS-IS. ACI policy definitions align with open industry standards such as OpFlex and OpenStack Group-Based Policy (GBP introduced in the Juno release), mapping OpenStack Neutron networks and routers directly to EPGs and contracts. - **Fabric Optimization**: Packet-level telemetry in the overlay allows flow switching when inter-packet gaps exceed latency deltas between paths, preventing out-of-order delivery while enabling link utilization up to 90% without packet loss or jitter.

### Takeaways ACI simplifies network operations by replacing imperative, fragmented configurations with an abstract, declarative application network profile. By decoupling the control and policy layer (handled by the APIC) from the underlying autonomous forwarding plane, network environments maintain continuous uptime even during controller disconnects. In addition to operational simplification, deep integration between hardware telemetry and software policy enables higher wire efficiency, cross-domain resource reclaiming for storage and compute teams, and faster root-cause analysis based on application health rather than individual port failures.