Cisco ACI vs Traditional DC

[Asfandyar70754]

Hey guys,

I have been reading Cisco ACI from last couple of days and have found it really interesting. Our organization is looking to propose it to one of the Banks.

I am looking to be prepared before going to the client with this. 

In traditional DC our VLANs are not routable on different sites/DCs, but VXLANs did solve the issue, so I wanted to know why still ACI is preferred or how ACI makes VXLAN better.

I know ACI has Central management Dashboard, it is quite scalable, it is sort of zero touch provisioning(once leaf switch is powered on and cables are connected to Spine and APIC it is discovered automatically and policies are applied).

If I am missing something please let me know.

Just to be exact I wanted to know difference between Traditional DC/switching and ACI, features, benefits e.t.c.

[Sergiu.Daniluk]

Hi @Asfandyar70754 

I will list here some advantages of ACI over standalone VXLAN EVPN fabric:

+ Controllers = central management (used for provisioning as well)
+ Integration (with so many other solutions: VMware vCenter, Microsoft SCVMM, K8, OpenShift, OpenStack)
+ Built in automation (REST APIs)
+ Network services insertion/integration (Service Graphs w/ or w/o PBR)
+ Distributed firewall (zoning-rules)

+ Extension of policies to Cloud through CloudAPIC

Cheers,

Sergiu

[Robert Burns]

I'd really recommend you try to engage your local Cisco team to help deliver a joint value proposition overview to your client.  There's really so much to the ACI ecosystem and what it enables.  ACI benefits far extend beyond just offering a centralized controller for the DC - it enables multi location/site extension, public cloud extension, Virtual Machine Manager (VMM) Integration for any Hypervisor & Container provider, Day 2 Operations tools -  and the list continues.  

Generally for any next-Gen architecture we should only be considering a fabric-based design (even if the solution isn't from Cisco, but  hopefully is).  Sure, there are smaller deployments where ACI may seem like overkill, but when you weigh in the benefits of OPEX and new capabilities you'll find far greater ROI than a legacy standalone tier-based DC design.    This is one of my primary day-to-day focuses - to educate customers about the capabilities and benefits of a fabric based solution and shift their thinking from legacy box-by-box designs.  

To your comment above, VXLAN not only solves the problem of extending L2 segments across L3, but the greater benefit is the policy (security) extension that comes with it.  ACI leverages the extensibility of VXLAN to include policy based security policies between other on-prem and/or cloud sites so you achieve a truly consistent deployment to serve your applications & services. There's alot of great Whitepapers available that speak to the many benefits of an ACI-based solution.  Take a look here: https://www.cisco.com/c/en/us/solutions/data-center-virtualization/application-centric-infrastructure/white-paper-listing.html.  there's alot a ton of excellent Cisco Live sessions which are available that speak to similar topics.  https://www.ciscolive.com/on-demand/on-demand-library.html?search=ACI#/ .
If I had to throw a top 5 Benefits bullet list together to pitch to a potential customer, here's what I'd focus on:

• Automated underlay and overlay 
• Single pane of glass for configuration of policies, operations & monitoring across the fabric
• ACI is Endpoint, Hypervisor & Cloud agnostic providing consistent policy for Physical or Virtual workloads (any Hypervisor /Container solution), across any on-Prem and/or Public Cloud provider (AWS, Azure, GCP).
• Open API for easy automation & programmability - including Ansible, Terraform, Python etc.
• Zero-trust security policies for applications which aren't limited to VLAN and/or IP based constructs

Above and beyond this, there's a whole another world that ACI enables from it's ecosystem integration with our Day 2 Ops tools hosted on Nexus Dashboard which enable Analytics & Telemetry Insights, Configuration Compliance, Advisories, Change Modeling and Historical troubleshooting of past events/issues. 

We'll start with this, and happy to discuss further here, but as stated above, this would be a good opportunity to engage your local Cisco DC Technical Solution Architecture team.

Robert

[Claudia de Luna]

Hi @Asfandyar70754 

In addition to what @Sergiu.Daniluk  and @Robert Burns have shared, these are the things I have always found resonated with clients looking at ACI.

First its important to understand that ACI is not just VXLAN.  Its quite alot more and so putting it in that context I don't think its a valid comparison.

• Managing a fabric as a whole rather than 20 (or however many) individual switches and being able to scale your data center easily. Need to add a couple of switches? No problem. In fact all the configuration is already there!
• For organizations who are moving an existing data center that has grown "organically" the ability to layer in additional security *without* changing IPs is really compelling.  This is often a game changer for many of my clients.  And many times this alone sells it. An organization invariably has a subnet that has all kinds of services on it which in todays environment is risky.  Don't want to move the database servers but they live with the front end web servers?  with ACI you can keep them on the same subnet but provide protection by putting them in different EPGs.  In fact, for the Web servers..maybe they should not be able to talk to each other, just communicate out, no problem.  That is a checkbox. 
• The ability to fully integrate with your Virtualization Environment really reduces the network "turn around time" which, lets face it, in traditional networks often takes far longer than it should.  They need to bring up a new VM?  They don't have to wait for the network team any more. In fact you can give them some level of control (if appropriate).
• Because it's a unified fabric, the level of visibility you have into your data center network often dramatically improves.  Need to see how an endpoint has moved around? No problem.
  
  Be up front that there is a learning curve but well worth it and make sure that at the end they understand it's just a network.

Good Luck!