ACI TALKs (2024)

Cisco ACI || VLAN Types

It is very important to understand the different VLAN types that is run behind the scenes.

VLAN in Cisco ACI is just an identifier to classify endpoints to each EPG.

Bridge domain is the layer 2 domain instead of VLAN.

There are 4 types of identifiers in Cisco ACI:

1. Access Encapsulation VLAN ID: we can call it VLAN on the wire which is used to communicate with external device. it is configured on Cisco ACI and external device as well, as shown in the example below and different mapping to the same access encapsulation VLAN.
2. Platform-independent VLAN (PI) VLAN ID: used internally on a Leaf node, it is mapping the internal PI VLAN ID to an access encap. VLAN ID or VXLAN ID. you can have the same access encap. VLAN ID on different Leaf, but the PI VLAN ID for the same access encap. will be different from Leaf to another.
3. VXLAN ID: This ID is very important because when it comes to forwarding traffic across different leafs, you need identifier that is shared among all leafs. this identifier is VNID. When it comes to bridging traffic this VNID is the bridge domain VNID. and incase of routing traffic this VNID is the VRF VNID.
4. FD_VLAN ID: it is locally significant VLAN ID on the leaf assigned to the individual access encap VLAN in an EPG, BD have multiple access encap VLAN with its own FD_VLAN, each FD_VLAN has its own VXLAN ID and it must be the same across all leaf switches where that particular access encap VLAN presents.

For traffic between two endpoints on different Leafs on the same EPG, with the same VLAN.

• Packets arrived at Ingress leaf-101 are tagged with access encap vlan 200.
• Internally at leaf-101 the packets are mapped to FD_VLAN 40.
• The lookup for the destination endpoint address resolves in the endpoint table with the same BD VXLAN.
• Traffic needs to be forwarded to destination on Leaf-102 and that traffic is bridging, so the VXLAN ID here is the BD VNID (15761388).
• At leaf-102, after decapsulation of VXLAN, the destination lookup resolves to endpoint in FD_VLAN 39.
• And now we need to send this traffic to the destination endpoint on the downlink, so traffic is sent tagging with access encap. VLAN ID 200 according to the mapping in the VLANS table.