Integrate ACI with External Tools
Domain 5 covers the interfaces ACI exposes to everything outside it: hypervisor integration, the REST API and automation tooling, L4-L7 service insertion, and monitoring exports.
REST API
Everything in the GUI is a REST call. Log in with a POST to /api/aaaLogin.json carrying username and password; the reply sets an APIC-cookie token used by later calls. Read with class queries (/api/class/fvTenant.json) and write with distinguished-name posts (/api/mo/uni/tn-TenantA.json plus a payload). The API Inspector records the calls the GUI makes, which is the fastest way to learn a correct payload.
Automation
Cisco's Ansible collection and Terraform provider both drive that same API. Playbooks and plans are idempotent, so re-running creates nothing new, whereas raw POSTs need care.
VMM integration
A VMM domain binds vCenter to the fabric. With a standard distributed switch the leaf is the VTEP and enforcement stays in the fabric; with Cisco ACI Virtual Edge the host runs the VTEP and OpFlex carries policy to the leaf. APIC creates a port group per EPG and allocates VLANs from the VMM domain's VLAN pool. Deploy immediacy decides whether the port group appears only when a VM is placed or as soon as the EPG exists.
Services and monitoring
L4-L7 insertion uses a device package, a logical device, a concrete device, a function profile (GoTo, GoThrough, NAT) and a service graph template attached to a contract; policy-based redirect steers traffic to a firewall without an in-line graph. SNMP, syslog and Call Home are fabric monitoring policies pointing at external collectors.
Worked example
An EPG must appear as a port group for a vCenter cluster. Create the VMM domain, register vCenter credentials, attach a VLAN pool sized for the cluster, bind the EPG to the VMM domain, and set deploy immediacy to immediate. Reasoning: an exhausted VLAN pool silently blocks new port groups, and an EPG bound to the domain without a VLAN pool cannot allocate an encapsulation.
Traps
- Mixing up ACI Virtual Edge and distributed-switch modes when asked where policy is enforced.
- Using a raw POST and assuming it is idempotent.
- Calling the API without first obtaining the authentication cookie.
- Expecting syslog or SNMP destinations to be tenant objects.