Data Center · ACI
Design an ACI tenant from scratch — VRF, bridge domains, EPGs, subnets, contracts, and L3Out — then export the APIC REST payload and object tree.
ACI is powerful but unforgiving about object naming. Rename a BD later and your contracts break silently. This planner locks down the schema up front: one VRF per tenant, BDs grouped by app tier, EPG-per-subnet by default, contracts by intent (app-to-db, web-to-app, any-to-inet).
Output includes: the object tree (tenant → VRF → AP → BDs/EPGs → contracts → L3Out), an APIC REST payload skeleton (JSON), and the recommended contract matrix. Apply via Ansible cisco.aci, Terraform ciscodevnet/aci, or direct POST to /api/mo/uni/tn-<Tenant>.json.
The common mistake is creating one BD per EPG with the same subnet. That forces you to manage IP allocation twice. Instead, map one BD per IP subnet and put one EPG per tier in that BD. If tiers share a subnet (rare), put them in the same BD with intra-BD isolation via microsegmentation EPGs.
Contracts: use filters (not just IP) so you can enforce at L4. A web-to-app contract should permit TCP 8080 only, not "permit any". For brownfield, start with vzAny + log, then gradually replace with strict contracts.
Contracts — always. Preferred group disables enforcement for listed EPGs and is a security hole. Use it only for lab/temporary workarounds.
Depends on scale. Small: one tenant per environment (Prod, NonProd). Large: one tenant per app domain with shared services in the common tenant.
Tenant T-ProdApps, VRF VRF-Prod, AP AP-Ecom. BDs BD-Web (10.10.10.0/24), BD-App (10.10.20.0/24), BD-DB (10.10.30.0/24). Contracts C-Web-to-App TCP 8080, C-App-to-DB TCP 1433. L3Out L3Out-Core provides the C-Any-to-Inet consumed by Web EPG.
Single vzAny contract permitting IP any, with log filter. Migrate app-by-app to tier-to-tier contracts; remove permit-any once migration is complete.