Hi Mario,
I can see there are a lot of fundamental ACI concepts you need to grasp, so I'll try to keep it simple.
First of all:
ISIS in ACI
Perhaps one of the best places to start to understand ISIS in ACI is to read up a little about ISIS, COOP, BGP and MP-BGP in CIsco ACI. You will probably find an answer I gave on this forum or a better version of it in a blog post.
The key conscept you need to understand it that ISIS exists ONLY as a routing protcol to provide the leaves and spines connectivy (routing) information about how to reach other leaves and spines. Critically, it has absolutely NOTHING to do with transporting traffic from one leaf to another. And therefore, absolutely nothing to do with routed sub-interfaces on the end-point side.
ISIS exists only within the ACI UNDERLAY network (which is called VRF overlay-1 in ACI).
Internal VLANs in ACI
The fact that your infrastructure VLAN (often VLAN 3967, but not necessarily) is potentially mapped to a different VLAN on every switch is just how ACI overcomes the limitations of there being only 4095 possible VLANs.
Because each switch can only support 4095 VLANs, and in a tenanted network there may exist millions of VLANs and multiple instances of the same VLAN ID, Cisco ACI switches simply map every external VLAN (including the infrastructure VLAN) to one of the 4095 locally available VLAN IDs.
As you have discovered, the command show vlan extended lists you the mappings between the user-defined VLANs and the internal VLANs for each switch.
p2p - hello VXLAN
There is no p2p for ISIS.
All traffic from user-attached ports that need to have a p2p like connection to another leaf is carried in VXLAN encapsulation. The way this is done is by allocating a VXLAN Network ID (VNID) to every L2 broadcast domain (Bridge Domain or BD) and every VRF within ACI. If the user-to-user traffic needs to be L2 bridged, it will be transported across the underlay in VXLAN encapsulation using the VNID of the BD. If it is to be routed, it will be VXLAN encapsulated using the VNID of the VRF.
encapsulation dot1Q
I hope that my explanation of VXLAN shows you that looking for the equivalent of "encapsulation dot1Q xxx" is not really relevant. You will never be able to configure the internal VLAN mappings or the internal VXLAN mappings.
For teh record though, you can actually see the bexternal VLAN configuration with a command like show running‑config leaf 101 interface ethernet 1/x where you will see something like:
# Command: show running-config leaf 101 interface ethernet 1/7
# Time: Thu Mar 26 06:15:01 2020
leaf 101
interface ethernet 1/7
# policy-group Common:SharedServices_APPG
switchport trunk allowed vlan 1001 tenant common application SharedServices_AP epg SharedServices_EPG exit
exit
And one final point about the diagram
Thanks so much for adding a diagram to you post. It makes a huge difference to the effort I will put into answering a post if the person posting has clealy made an effort.
You should also know that as far as the APIC connection to the ACI leaves is concerned, the connection is via a bond interface on the APIC (bond0.3967 if the infrastructure VLAN is 3967) with one physical interface active and the other in standby. The command cat /proc/net/bonding/bond0 on the APIC will show you the configuration.
I hope this helps
Don't forget to mark answers as correct if it solves your problem. This helps others find the correct answer if they search for the same problem
RedNectar aka Chris Welsh.
Forum Tips: 1. Paste images inline - don't attach. 2. Always mark helpful and correct answers, it helps others find what they need.
