ACI Fabric Infrastructure
Domain 1 covers the physical and logical skeleton of the fabric: what spines and leaves each do, how a new switch is bootstrapped and discovered, and which objects hold policy. Questions are conceptual but hinge on exact roles - which device forwards traffic, which one stores endpoint locations, and which one sits outside the data path.
Device roles
- Spine: connects leaves, forwards VXLAN on the outer header only, and hosts the COOP database - the fabric-wide endpoint location table that leaves keep updating. Spines are not contract enforcement points.
- Leaf: VTEP and enforcement point. It learns endpoints (data-plane MAC/IP learning, VMM/OpFlex, or static), holds policy-CAM entries, routes inside the VRF, and encapsulates toward the destination leaf's TEP.
- APIC: management plane only. It renders policy into each node's policy element but never carries tenant traffic, so losing a controller does not stop forwarding. Controllers form an odd-sized cluster (three in production) that shards and replicates the MIT.
Discovery sequence
A switch boots with a bootstrap: fabric name, infrastructure VLAN, TEP pool, APIC addresses. It then uses LLDP to find neighbors, forms IS-IS adjacencies on fabric links, receives a /32 TEP address from the pool, and forms COOP adjacencies with the spines. Registration in APIC is the point where tenant configuration starts to be pushed. A fabric link that refuses to come up usually points to a mismatched infrastructure VLAN or a port bound to the wrong interface policy.
Policy objects
Fabric then tenant, then VRF (L3 context), then bridge domain (L2 domain with gateway subnets), then EPG (endpoints with identical policy, bound to one BD), then application profile. Every BD and VRF gets a 24-bit VNID; the BD VNID is what appears in the VXLAN header and identifies the segment on the wire. NTP, DNS, SNMP, syslog, interface and firmware policies are fabric-wide, not tenant objects.
Worked example
Leaf 105 is racked and cabled to both spines; the TEP pool is 10.0.0.0/16. After applying the bootstrap you check Fabric > Inventory: node 105 is registered with TEP 10.0.0.105, IS-IS neighbors to both spines are up, and the COOP database lists it. Reasoning: discovery is sequential - LLDP, then IS-IS, then TEP allocation, then registration - so a node that shows up but has no TEP cannot take tenant config yet.
Traps
- Believing an APIC failure blacks out tenant traffic.
- Expecting spines to filter or route tenant traffic.
- Forgetting that same-EPG endpoints on the same leaf switch locally; no VXLAN is built.
- Overlapping the TEP pool with OOB, management, or tenant subnets.
- Answering a "where is NTP set" item with a tenant object.