cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

232
Views
15
Helpful
4
Replies
Highlighted
Beginner

Cisco ACI Control Plane and Data Plane

I am looking for more information to get a better understanding of how the control plane and data plane works in the ACI. I know the APIC controllers are completely separate from the operation of the ACI, even when the APIC cluster is lost the fabric will not be impacted. During this time, the new configuration will not be deployed in the fabric.

 

The data plane still resides in the devices, but the control plane is in the APIC or not? It is clear to me, that all configuration is done in the APIC and deploy in the devices including the control plane functions (IS-IS, BGP RR, and etc.).

 

Does the control plane is in the APIC?

 

Thanks in advance.

TM

1 ACCEPTED SOLUTION

Accepted Solutions
Highlighted
Beginner

Hello, 

 

With ACI, there is the data plane, the control plane, and the policy plane. 

 

The data plane is of course the packets being forwarded by the ASICs in the spines and leafs (or via software in vLeaf/AVE/etc.). That's the same as with NX-OS. 

 

The control plane involves the L2/L3 protocols running on each individual leaf. This is also not any different from a traditional NX-OS deployment. If ACI is peering with an external router for an L3Out using OSPF, the OSPF process runs on the border leaf(s). The router updates/etc. originate and terminate on the border leafs. LLDP is turned on by default on all active ports, and the LLDP packets are generated from each leaf and spine's CPU. You can log into a leaf and run show commands like "show ip ospf neighbor vrf [Tenant:VRF]" and see the same output you'd see on an NX-OS device. 

 

In both cases, the APIC doesn't see those packets. Data plane packets do not traverse the APIC, and control plane packets do not originate or terminate at the APIC. Note, this is different from some other SDN solutions. 

 

The APIC instead is what configures the switches. While you can SSH into each leaf/spine, you cannot go into config mode (no "conf t", so to speak). The APIC, through the CLI, the GUI, or the API, has policy set on the APIC. The APIC will then take that policy and push it to the appropriate leafs/spines. When you create a Bridge Domain, Subnet, and EPG (which is attached to a domain), for example, it pushes an anycast SVI, a set of VLAN/VXLANs, etc., to the leaf to enable packets to forward as per the APIC's config. 

View solution in original post

4 REPLIES 4
Highlighted
Beginner

Hello, 

 

With ACI, there is the data plane, the control plane, and the policy plane. 

 

The data plane is of course the packets being forwarded by the ASICs in the spines and leafs (or via software in vLeaf/AVE/etc.). That's the same as with NX-OS. 

 

The control plane involves the L2/L3 protocols running on each individual leaf. This is also not any different from a traditional NX-OS deployment. If ACI is peering with an external router for an L3Out using OSPF, the OSPF process runs on the border leaf(s). The router updates/etc. originate and terminate on the border leafs. LLDP is turned on by default on all active ports, and the LLDP packets are generated from each leaf and spine's CPU. You can log into a leaf and run show commands like "show ip ospf neighbor vrf [Tenant:VRF]" and see the same output you'd see on an NX-OS device. 

 

In both cases, the APIC doesn't see those packets. Data plane packets do not traverse the APIC, and control plane packets do not originate or terminate at the APIC. Note, this is different from some other SDN solutions. 

 

The APIC instead is what configures the switches. While you can SSH into each leaf/spine, you cannot go into config mode (no "conf t", so to speak). The APIC, through the CLI, the GUI, or the API, has policy set on the APIC. The APIC will then take that policy and push it to the appropriate leafs/spines. When you create a Bridge Domain, Subnet, and EPG (which is attached to a domain), for example, it pushes an anycast SVI, a set of VLAN/VXLANs, etc., to the leaf to enable packets to forward as per the APIC's config. 

View solution in original post

Highlighted
Beginner

Hi tonybourke,

 

Thanks for the explanation, very clear to me.

 

Please, do you have any sites or books to suggest to me?

Highlighted

Hi @tonybourke 

If you wish to deep dive into ACI word, I would recommend the following approach:

1. Start with "Deploying ACI" - as @tonybourke  mentioned, its a very good book.

2. Watch ciscolive videos - this are gold nuggets for learning ACI. You could use the CL learning maps, and go by pillars: 

Screenshot 2021-01-24 190716.png

Screenshot 2021-01-26 203413.png

 

If you think these are too many videos, no worries I got you. This is my recommendation:

 

i) Must watch (seriously! You must watch these ones!)

 

ii) A bit of a intro to different things. These will help building the fundamentals of ACI:

 

iii) Troubleshooting (the best ones a.k.a. the ones you learned the most from a.k.a. the ones you need to re-watch at least 2 times)

 

 

3. The third very good learning material, especially for small things which usually make the difference - whitepapers. There are whitepapers for a lot of things in ACI.

4. And finally, maybe the most important out of all. practice practice practice. If you do not have a real lab with hardware and stuff, try the always-on sandbox https://developer.cisco.com/docs/aci/#!sandbox/aci-sandboxes or the good old dcloud https://dcloud.cisco.com/

 

Hope you will find this helpful!

Good luck with the learning.

 

Sergiu

Highlighted
Beginner

For books, the Cisco Press book "Deploying ACI" is one of the best Cisco Press books I've come across. It's very thorough. 

For websites, The Unofficial ACI Guide http://unofficialaciguide.com is great. 

Content for Community-Ad