Cisco Application Centric Infrastructure Ordering Guide

 

At-a-glance: The Cisco ACI solution

Cisco^® Application Centric Infrastructure (Cisco ACI^®) is the industry’s most secure, open, and comprehensive solution for intent-based networking for datacenters. It enables businesses to innovate faster and minimize downtime by radically simplifying, optimizing, and accelerating infrastructure deployment through consistent security and automation for any workload, in any location, and in any cloud.

Cisco ACI delivers an intent-based networking framework that extends to the WAN and campus, capturing higher-level business and user intent in the form of a policy, and translates this intent into the network constructs necessary to dynamically provision the network, security, and infrastructure services.

Cisco ACI: any workload, any location, any cloud.

Cisco ACI building blocks

The Cisco ACI solution consists of the following blocks:

●      Cisco Application Policy Infrastructure Controller (APIC)

●      Cisco Nexus^® 9000 Series Spine and Leaf Switches for Cisco ACI

●      Cisco Nexus Dashboard Orchestrator

●      Cisco ACI Remote Leaf

●      Cisco Mini ACI Fabric

●      Cisco Cloud Network Controller

Cisco ACI Architecture

1. Cisco ACI solution components

The minimum set of components required to enable an on-premises ACI fabric are:

a. Cisco Application Policy Infrastructure Controller (APIC)

The infrastructure controller is the main architectural component of the Cisco ACI solution. It is the unified point of automation and management for the Cisco ACI fabric, policy enforcement, and health monitoring. The APIC appliance is a centralized, clustered controller that optimizes performance and unifies the operation of physical and virtual environments. The controller manages and operates a scalable multitenant Cisco ACI fabric.

b. Cisco Nexus 9000 Series spine and leaf switches for Cisco ACI

The Cisco ACI fabric is a full-mesh topology of high-speed links (40/100/400 G) between redundant spine switches and leaf switches. The Cisco Nexus^® 9500 Series Switches operate as ACI spine switches and the Cisco Nexus 9300 Series Switches as ACI leaf or spine switches. Modular spines provide the scale and capability to incrementally add ACI leafs to the ACI fabric and grow the ACI fabric to the maximum scale.

Cisco ACI: Spine Leaf Architecture

2. Cisco ACI deployment models

In addition to the core capabilities enabled by the mandatory building blocks, Cisco ACI provides additional functions that span virtualization, infrastructure, and security. Depending on the deployment architectures, customers can choose to enable any or all of the following additional optional components for their solutions:

●      Cisco Nexus Dashboard Orchestrator

●      Cisco ACI Remote Leaf

●      Cisco Cloud Network Controller

For further details on the capabilities of these components and the Cisco ACI solution, click here.

Cisco ACI Multi-Site

3. Cisco ACI licensing components

3.1 On-premises physical ACI fabric

The on-premises ACI fabric is licensed per the Cisco Nexus 9000 devices running in the fabric. There are tiered license options along with add-on licenses for on-premises ACI deployments.

For more information, refer to section 5: Greenfield ACI fabric deployment Ordering Guide.

3.2 Cisco Cloud Network Controller

Cisco Cloud Network Controller is a comprehensive solution for simplified operations, automated network connectivity, consistent policy management, and visibility for multiple on-premises data centers and public cloud environments.

Cisco Cloud Network Controller, which runs natively on a public cloud, is the key component of this solution. Cisco Cloud Network Controller enables policy translation of ACI policies into cloud-native policies and programs them in every Virtual Machine (VM) workload running application logic. Cisco Cloud Network Controller is licensed per workload managed by the solution.

3.3 Licenses bundled with APIC clusters

APIC clusters (APIC-CLUSTER-L4, APIC-CLUSTER-M4) are now bundled with 2 (two) Advantage XF2 3-year-term licenses that can be applied to any switch that uses XF2 licenses. Please reference Table 3 below for full switch-to- license-class mapping. When ordering in Cisco Commerce, these licenses will be automatically added to the APIC cluster. The inclusion and quantity of licenses cannot be modified.

APIC L4 Cluster with subscription licenses

APIC M4 Cluster with subscription licenses

4. Cisco ACI tiered licensing

Cisco ACI licenses are applied per Cisco Nexus 9000 device in a physical on-premises ACI deployment.

The per-device ACI licenses are offered as tiered licenses for easy consumption. Add-on licenses are charged per device, based on value-added feature offerings. For details on Datacenter licenses, please see the DCN software licensing BDM here.

For the full breakdown of what features are included in each tier (Essentials, Advantage, and Premier), please reference the Cisco DCN Software Subscriptions page.

5. Greenfield ACI fabric deployment ordering guide

This section lists the steps to order a base ACI fabric for greenfield ACI deployments.

5.1 Cisco Application Policy Infrastructure Controller (APIC)

The following table lists the SKUs for a physical APIC.

Table 1.        Orderable SKUs for physical APIC

5.2 Cisco ACI tiered and add-on licenses

ACI software licenses are available as subscription and perpetual consumption models.

Subscription – These term-based software licenses are available in 3-year, 5-year, and 7-year terms.

●      Tiered licenses are available in DCN Essentials, DCN Advantage, and DCN Premier levels tiers as well as add-ons that support Cisco ACI.

●      For customers that have a net Total Contract Value (TCV) of more than $100,000, we recommend data-center enrollment for a Cisco Enterprise Agreement. Learn more about Enterprise Agreements to cover your data-center technologies.

Perpetual – This is a nontransferable, fixed-price, traditional licensing model with the right to use covered features for a perpetual term. DCN Perpetual licenses are not portable between devices.

●      The DCN Advantage tier is available as a perpetual license, as well as add-ons that support Cisco ACI.

Nexus licenses are categorized on platform bandwidth capacity. The following sections list the switches mapped to each license class and the SKUs required to order ACI software licenses for ACI deployment. Licenses are required for both leaf and spine switches.

Table 2.        License categories and associated supported platforms (Cisco Nexus 9000 Series Switches)

5.2.1 Cisco ACI subscription software license SKUs

Select the options below when selecting the Cisco Nexus 9000 Series device, or standalone (without hardware) under top-level PID C1-N9K-ADD-T.

Table 3.        PIDs for subscription tier-based licenses for DCN (ACI+NX-OS) (Cisco Nexus 9000 Series Switches in fixed platforms)

A security add-on license is mandatory for the N9K-C9348D-GX2A platform. This platform is targeted for use cases that require MACsec on all ports.

Table 4.        PIDs for subscription tier-based licenses for DCN (ACI+NX-OS) (Cisco Nexus 9000 Series Switches in modular platforms)

5.2.2 Cisco ACI perpetual software license SKUs

Select the options below while selecting the Cisco Nexus 9000 Series device, or standalone (without hardware) by adding an equal sign and searching in Cisco Commerce (for example, ACI-AD-GF=.)

Note:      There is no perpetual offer for Cisco ACI Premier; Premier must be purchased as a subscription.

Table 5.        PIDs for perpetual tier-based licenses for DCN (ACI+NX-OS) (Cisco Nexus 9000 Series Switches)

Table 6.        PIDs for perpetual tier-based licenses for Cisco ACI (Cisco Nexus 9000 Series Switches in modular platforms)

Table 7.        PIDs for port-upgrade licenses

6. Brownfield ACI deployment ordering guide

6.1 Cisco ACI upgrade for tiered licenses

This section lists the SKUs required to order upgrade licenses for Cisco ACI deployments. This is typically applicable for brownfield deployments when customers have purchased a lower-tier Cisco ACI license and want to migrate to a higher-tier license for existing hardware.

Table 8.        License-upgrade SKUs

6.2 Cisco ACI perpetual to subscription upgrade

●      No upgrade is available to migrate from a perpetual to a subscription license model. For this case, order new subscription licenses under C1-N9K-ADD-T (refer to Table 5. PIDs for subscription tier-based licenses for DCN (ACI+NX-OS).

Alternatively, some credit may be offered for migrating to an Enterprise Agreement. For more information on the Enterprise Agreement, please reference the Cisco Enterprise Agreement page.

6.3 Cisco NX-OS to Cisco ACI upgrade licenses

This section is applicable for customers who had purchased perpetual licenses for Cisco Nexus 9000 in Cisco NX-OS standalone mode and want to migrate to perpetual ACI licenses.

Table 9.        Perpetual to subscription upgrade license SKUs

7. Product solution purchasing reference

7.1 Cisco Nexus Dashboard Orchestrator

Cisco Nexus Dashboard Orchestrator provides a single point of provisioning for multiple Cisco ACI fabrics.

Cisco Nexus Dashboard Orchestrator Licensing Components

Cisco Nexus Dashboard Orchestrator requires purchase of the following:

●      Cisco ACI spine-leaf architecture with an APIC cluster for each fabric

●      One Data Center Networking Advantage or Premier License per device for all of the connected fabrics

7.2 Virtual APIC

Ordering option 1: Purchase virtual APIC (vAPIC) bundle

Table 10.     vAPIC ordering option 1

Ordering option 2: Purchase virtual APIC standalone

Table 11.     vAPIC ordering option 2

7.3 ACI security feature licensing

7.3.1 Encryption (MACsec)

MACsec is an IEEE 802.1AE standard that provides MAC-layer hop-by-hop encryption for data confidentiality and integrity for media-access-independent protocols. MACsec uses out-of-band methods for encryption keying. The APIC will be responsible for the MACsec keychain distribution to all the nodes in a pod or to specific ports on a node.

MACsec Encryption Licensing Components

The encryption capability requires purchase of the following:

●      ACI spine-leaf architecture with an APIC cluster for the main fabric

●      One Essentials, Advantage, or Premier license per device in the fabric

●      An add-on license ACI-SEC-XF/GF per device (leaf) for encryption

●      An add-on license ACI-SEC-XF per device (fixed spine) for encryption

●      An add-on license ACI-SEC-XM per device (modular spine) for encryption

7.3.2 Encryption (CloudSec)

Cisco ACI Multi-Site uses VXLAN overlay tunnels over the Intersite Network (ISN) to interconnect each ACI data center site; these VXLAN tunnels are not encrypted. CloudSec is a new technology that solves this problem by providing site-to-site encryption for all data center interconnect traffic in a Cisco Nexus Dashboard Orchestrator deployment. Encryption keys are configured on each site’s APIC, and Cisco Nexus Dashboard Orchestrator will automatically exchange and distribute keys to sites as well as refresh keys automatically periodically.

CloudSec encryption licensing components

The CloudSec encryption capability requires purchase of the following:

●      ACI spine-leaf architecture with an APIC cluster for each site

●      Deployment of a Cisco Nexus Dashboard Orchestrator to manage each site

●      One Advantage or Premier license per device in the fabric

●      An add-on license ACI-SEC-XF per device (fixed spine) for encryption

●      An add-on license ACI-SEC-XM per device (modular spine) for encryption

7.4 Fiber Channel over Ethernet (FCoE)

Cisco ACI enables the configuration and management for Fibre Channel over Ethernet (FCoE) traffic on the ACI fabric. A typical implementation of FCoE protocol support on the ACI fabric enables hosts located on the Ethernet-based ACI fabric to communicate with SAN storage devices located on a Fibre Channel network.

ACI FCOE licensing components

The FCoE solution requires purchase of the following:

●      ACI spine-leaf architecture with an APIC cluster for the main fabric

●      One Essential, Advantage, or Premier license per device for the main fabric

●      An add-on license ACI-STRG per device with FCOE/FC NPV configuration

8. Cisco Cloud Network Controller

Cisco Cloud Network Controller (formerly Cloud ACI) is a comprehensive solution for simplified operations, automated network connectivity, consistent policy management, and visibility for multiple on-premises data centers and public cloud environments. This solution introduces the Cisco Cloud Application Policy Infrastructure Controller, which runs natively in public clouds in a virtualized form factor.

Cisco Cloud Network Controller is being offered natively on AWS, Azure, and Google Cloud Platform. The Cisco Network Controller binary image is available on AWS Market Place and Google Cloud Marketplace and supports the Bring Your Own License (BYOL) model. AWS Market Place also supports the Pay As You Go (PAYG) model.

Cisco Cloud Network Controller

The licenses for Cisco Cloud Network Controller (CCNC) are charged per workload (VM instance) under policy management of the CCNC. Typically, these virtual-machine instances will be used to deploy application workloads on a public cloud. The Essentials Cloud tier includes licenses for a single policy domain or a single instance of CCNC on a public cloud. If multiple instances of CCNC need to be deployed for scale reasons, then the Advantage Cloud licenses need to be purchased for each workload instance managed by the Cisco Cloud Network Controllers.

For example, assume that a single instance of Cisco Cloud Network Controller can manage instances spread across sixteen different regions in AWS/Azure/Google Cloud. If a customer needs to deploy 100 EC2 instances under the policy management of the CCNC, and these are running within a single region on AWS/Azure/Google Cloud, 100 Essentials Cloud licenses will be required. If these 100 EC2 instances are spread across seventeen or more different AWS/Azure/Google Cloud regions, then two instances of CCNC will be needed. In this case, 100 Advantage Cloud licenses need to be purchased. The licenses are portable across AWS, Azure, and Google clouds, and the license SKUs are the same for all the clouds.

Table 12.     Required license components for Cisco Cloud Network Controller

The Cisco Cloud Network Controller solution requires the following license components:

On the on-premises data center (If applicable)

1.     ACI Device licenses

One ACI Essentials/Advantage/Premier license per device for all Cisco Nexus 9000 devices running in Cisco ACI mode.

Note:      A single physical on-premises site can run in the Essentials license tier if it is connected to one or more cloud sites. More than one physical on-premises sites connected to Cisco Nexus Dashboard Orchestrator and one or more cloud sites will require a minimum of one ACI Advantage license per device.

On public cloud

1.     Workload licenses for Cisco Cloud Network Controller

Cisco Cloud Network Controller licenses are subscriptions of 3-, 5-, or 7-year duration. A Cisco Smart Account is mandatory for ordering Cisco Cloud Network Controller licenses.

Table 13.     Cloud Network Controller workload license SKUs

2.     Cisco Catalyst 8000V license SKUs for Cisco Cloud Network Controller solution

At least two Cisco Catalyst 8000V (Cat8kV) Cisco DNA Advantage licenses are required to run the Cisco Cloud Network Controller solution on a public cloud.

The PID for adding Cat8kV license is L-DNA-C8000V, and it has two mandatory configuration options that have to be chosen.

Table 14.     Catalyst 8000V license and its components

In addition to that, the choice of subscription must be made based on bandwidth requirements and term of the license.

Table 15.     Subscription tiers for Catalyst 8000V

3.     CSR 1000V to Catalyst 8000V tier mapping

Catalyst 8000V provides new bandwidth tiers. The table below provides the mapping that should be used for picking up the right Catalyst 8000V tier during the migration from CSR 1000V.

Table 16.      Bandwidth tiers for Catalyst 8000V

While any of Catalyst 8kV tiers mentioned above are available for ordering, for customers who are migrating from CSR1kV to Catalyst 8kV as a part of their Cloud ACI setup the suggestion is to use Tier 2 and Tier 3 as the closest matches of previous CSR1kV licenses for Cloud ACI production customers.

8.1 Cloud Network Controller bundle

The Cloud Network Controller bundle is a single SKU for purchasing all the licensing components required for the Cloud Network Controller solution. The following are the components of the bundle with limited-time built-in discounts:

●      CAPIC-C8KV-B

◦    ACI-CAPIC (15% discount)

◦    Catalyst 8000V (15% discount)

8.2 Cloud Network Controller evaluation licenses

Cloud Network Controller evaluation licenses can be requested using this site (choose Product Family as APIC).

For Catalyst 8000V: use L-C8000-DEMO PID on CCW. This demo PID has no tiers, and the customer will get full bandwidth access for the time of evaluation.

Note:      Cisco Cloud Network Controller Catalyst 8000V licenses are Cisco^® licensing-enabled SKUs. A Cisco Smart Account is mandatory while placing an order for these SKUs. It is recommended to keep the customer’s Cisco Smart Account ready at the time of placing the order. For a more detailed overview of Cisco Licensing, go to cisco.com/go/licensingguide.

9. Day 2 Operations

Cisco’s Day 2 Operations solution stands out as the first comprehensive technology solution in the industry developed by Cisco for network operators to manage day-2 operations in their networks. Our solution automates, monitors, and analyzes your data center fabric in real time. The components of Day 2 Operations include:

●      Cisco Nexus Dashboard

●      Cisco Nexus Dashboard Platform

●      Cisco Nexus Insights

See Cisco Nexus Dashboard and Cisco Data Center Day 2 Operations Solution Suite Ordering Guide.

10. Cisco ACI Smart Licensing

Cisco Smart Licensing is a flexible licensing model that provides you with an easier, faster, and more consistent way to purchase and manage software across the Cisco portfolio and across your organization. And it’s secure – you control what users can access. With Smart Licensing you get:

●      Easy Activation: Smart Licensing establishes a pool of software licenses that can be used across the entire organization—no more PAKs (Product Activation Keys).

●      Unified management: My Cisco Entitlements (MCE) provides a complete view into all your Cisco products and services in an easy-to-use portal, so you always know what you have and what you are using.

●      License flexibility: your software is not node-locked to your hardware, so you can easily use and transfer licenses as needed.

To use Smart Licensing, you must first set up a Smart Account on Cisco Software Central (software.cisco.com).

For a more detailed overview of Cisco Licensing, go to cisco.com/go/licensingguide.

11. Cisco services and support

Achieve business outcomes faster with Cisco Services for Cisco ACI: The Cisco ACI Services portfolio provides a range of professional and support services for each stage of your Cisco ACI journey. Cisco ACI can deliver significant advantages for your business. To help you quickly gain the benefits of your Cisco ACI solution while also mitigating risk, we offer a comprehensive portfolio of services. These services provide expert guidance to enable you to accomplish your business and technical outcomes. Cisco Services can help ensure your success with Cisco ACI, delivering expert support for planning, designing, deploying, and supporting your new infrastructure. To get started in learning more about Cisco Services for ACI, visit this link.

12. Cisco Capital

Flexible payment solutions to help you achieve your objectives

Cisco Capital^® makes it easier to get the right technology to achieve your objectives, enable business transformation and help you stay competitive. We can help you reduce the total cost of ownership, conserve capital, and accelerate growth. In more than 100 countries, our flexible payment solutions can help you acquire hardware, software, services, and complementary third-party equipment in easy, predictable payments. Learn more.

13. More information