Hi @BertiniB ,
Starting out in ACI is sometimes easier if you forget everything you've ever learned about networking!
But. To your questions
In the Cisco's documentation it says the following: "A bridge domain represents a Layer 2 forwarding construct within the fabric."
Yep. That's correct. If two devices need to talk MAC to MAC, they must be in the same Bridge Domain (BD)
and "In ACI the Bridge Domain or BD is a logical construct where a set of logical ports share the same flooding and/or broadcast domain."
Also correct, but not as succinct. Keep in mind we are talking about L2 flooding/broadcast domains. So the reference to logical ports has a VLAN tag component on top of the physical port.
BUT... there are a bunch of controls regarding flooding and broadcasts that you can tweak. In particular, you can actually turn off ARP broadcasts completely
So for example, if I had 2x EPGs sharing the same single Bridge Domain, would a broadcast frame from one EPG be able to reach another EPG even without contracts?
If the two EPGs shared the same BD, correct. Remember, we are talking L2 broadcasts, and in a normal IP environment the only L2 broadcast you'll ever see are ARP broadcasts, and as I mentioned above, you can disable those. (OK. There will be DHCP broadcasts, maybe some NetBIOS name resolution broadcasts, but no big deal really.)
Oh - and don't forget, if a endpoint receives a broadcast - say a netBIOS name request, the reply won't get back without a contract.
Another confusion is the fact that it is said that in the Bridge Domain is where the subnet (L3) is defined.
Correct again, but if you prefer, you can define a L3 subnet on the EPG. (oops. Sorry if I just raised more questions)
So what is the best way to explain a Bridge Domain, is it a Layer 2 Construct with L3 capabilities?
"Layer 2 Construct with L3 capabilities" is a good description - much like you'd describe a VLAN on a regular L2 switch. On a regular L2/L3 Switch, a VLAN can define a L2 broadcast domain, but can be assigned a L3 IP address (=SVI or Switch Virtual Interface)
Lastly, is the statement that a "BD + EPG = VLAN" correct?
No. Nowhere near correct - although in MANY implementations users configure one BD and one EPG per VLAN. This approach is sometimes referred to as a Network Centric Design. But there is no such construct in ACI as a Network Centric Design.
Firstly, separate the idea of a VLAN and am 802.1Q VLAN tag in your mind.
The 802.1Q VLAN tag on a frame that arrives at an ACI Leaf determines which EPG the frame is associated with. It has nothing to do with the L2 broadcast domain that the frame belongs to. Many EPGs can (although seldom implemented in this way) share the same L2 broadcast domain or Bridge Domain - as described earlier. Now, as I mentioned earlier, there are tweaks. You can, for instance specify that broadcasts are only flooded within the incoming encapsulation, which more or less guarantees broadcasts cant leak from one VLAN to another.
So. Where to from here?
I suggest you read some of my other answers on this forum. A google search for something like "rednectar aci bridge domain epg" should get you started - it may even lead to some of these answers (and even some blog posts on my private blog)
https://community.cisco.com/t5/application-centric-infrastructure/bd-vrf-and-sebnet-in-aci/m-p/4703964/highlight/true#M12996
https://community.cisco.com/t5/application-centric-infrastructure/cisco-aci-same-vlan-on-different-bridge-domain/m-p/4848856/highlight/true#M14132 - and my other answers to the same thread.
This Cisco Live presentation is my favourite of all time, but probably has too much detail at this stage: https://www.ciscolive.com/c/dam/r/ciscolive/emea/docs/2019/pdf/BRKACI-3101.pdf
Once you've done your homework - come back and ask for clarification till we get this sorted.
RedNectar aka Chris Welsh.
Forum Tips: 1. Paste images inline - don't attach. 2. Always mark helpful and correct answers, it helps others find what they need.
