Cisco ACI Control Plane and Data Plane

[thirodmorais]

I am looking for more information to get a better understanding of how the control plane and data plane works in the ACI. I know the APIC controllers are completely separate from the operation of the ACI, even when the APIC cluster is lost the fabric will not be impacted. During this time, the new configuration will not be deployed in the fabric.

The data plane still resides in the devices, but the control plane is in the APIC or not? It is clear to me, that all configuration is done in the APIC and deploy in the devices including the control plane functions (IS-IS, BGP RR, and etc.).

Does the control plane is in the APIC?

Thanks in advance.

TM

[tonybourke · Accepted solution]

Hello, 

With ACI, there is the data plane, the control plane, and the policy plane. 

The data plane is of course the packets being forwarded by the ASICs in the spines and leafs (or via software in vLeaf/AVE/etc.). That's the same as with NX-OS. 

The control plane involves the L2/L3 protocols running on each individual leaf. This is also not any different from a traditional NX-OS deployment. If ACI is peering with an external router for an L3Out using OSPF, the OSPF process runs on the border leaf(s). The router updates/etc. originate and terminate on the border leafs. LLDP is turned on by default on all active ports, and the LLDP packets are generated from each leaf and spine's CPU. You can log into a leaf and run show commands like "show ip ospf neighbor vrf [Tenant:VRF]" and see the same output you'd see on an NX-OS device. 

In both cases, the APIC doesn't see those packets. Data plane packets do not traverse the APIC, and control plane packets do not originate or terminate at the APIC. Note, this is different from some other SDN solutions. 

The APIC instead is what configures the switches. While you can SSH into each leaf/spine, you cannot go into config mode (no "conf t", so to speak). The APIC, through the CLI, the GUI, or the API, has policy set on the APIC. The APIC will then take that policy and push it to the appropriate leafs/spines. When you create a Bridge Domain, Subnet, and EPG (which is attached to a domain), for example, it pushes an anycast SVI, a set of VLAN/VXLANs, etc., to the leaf to enable packets to forward as per the APIC's config. 

[Nameless-IT]

Thanks for the clarification.

[thirodmorais]

Hi tonybourke,

Thanks for the explanation, very clear to me.

Please, do you have any sites or books to suggest to me?

[Sergiu.Daniluk]

Hi @tonybourke 

If you wish to deep dive into ACI word, I would recommend the following approach:

1. Start with "Deploying ACI" - as @tonybourke  mentioned, its a very good book.

2. Watch ciscolive videos - this are gold nuggets for learning ACI. You could use the CL learning maps, and go by pillars: 

If you think these are too many videos, no worries I got you. This is my recommendation:

i) Must watch (seriously! You must watch these ones!)

• BRKACI 3545 - ACI Packet Walk https://www.ciscolive.com/global/on-demand-library.html?#/session/1564527372479001cZRq
• BRKACI 2301 - ACI Micro Segmentation - https://www.ciscolive.com/global/on-demand-library.html?#/session/1564527368333001crvi

ii) A bit of a intro to different things. These will help building the fundamentals of ACI:

• BRKACI-2210 - The missing ACI Pilot's Operating Handbook - https://www.ciscolive.com/global/on-demand-library.html?#/session/1564610724739001cWCH
• BRKACI-1001 - First 7 Days of ACI - https://www.ciscolive.com/global/on-demand-library.html?#/session/1542224296189001r3AP
• BRKACI 2125 - ACI Multi Site - https://www.ciscolive.com/global/on-demand-library.html?#/session/1564527370186001cmin
• BRKACI-2003 - ACI Multi-POD - https://www.ciscolive.com/global/on-demand-library.html?#/session/1564527368297001cZrJ

iii) Troubleshooting (the best ones a.k.a. the ones you learned the most from a.k.a. the ones you need to re-watch at least 2 times)

• BRKACI 2641 - Troubleshooting Endpoints -  https://www.ciscolive.com/global/on-demand-library.html?#/session/1564526717174001Jnt7
• BRKACI 2642 - Troubleshooting ACI L3 Out -  https://www.ciscolive.com/global/on-demand-library.html?#/session/1564526717136001JPXf
• BRKACI 2644 - Troubleshooting PBR - https://www.ciscolive.com/global/on-demand-library.html#/session/1564526717094001J6vS
• BRKACI 2674 - Troubleshooting Multi Site -  https://www.ciscolive.com/global/on-demand-library.html?#/session/1573153536593001J0NI
• BRKACI-2934 - Troubleshooting Multi-Pod - https://www.ciscolive.com/global/on-demand-library.html?#/session/1573153536777001JSmV
• BRKACI-2645 - Troubleshooting ACI VMM - https://www.ciscolive.com/global/on-demand-library.html?#/session/1564527378677001cqrW

3. The third very good learning material, especially for small things which usually make the difference - whitepapers. There are whitepapers for a lot of things in ACI.

4. And finally, maybe the most important out of all. practice practice practice. If you do not have a real lab with hardware and stuff, try the always-on sandbox https://developer.cisco.com/docs/aci/#!sandbox/aci-sandboxes or the good old dcloud https://dcloud.cisco.com/

Hope you will find this helpful!

Good luck with the learning.

Sergiu

[Nameless-IT]

Thank you so much for the clarification

[tonybourke]

For books, the Cisco Press book "Deploying ACI" is one of the best Cisco Press books I've come across. It's very thorough. 

For websites, The Unofficial ACI Guide http://unofficialaciguide.com is great.