Objectives
The simulator ticks each one as soon as the network meets it.
Register all switches, and build the access policies, with ports 1/3 on leaves 101, 102 and 103 using a policy group.
Create tenant T1 with VRF V1, and bridge domains BD10, BD20 and BD30 with gateways at .254.
Create application SHOP with EPGs WEB, APP and DB, with static paths on VLANs 10, 20 and 30.
Create contracts WEB-APP (APP provides, WEB consumes) and APP-DB (DB provides, APP consumes).
WEB1 reaches APP1 (192.168.20.20), and APP1 reaches DB1 (192.168.30.30).
WEB1 cannot reach DB1, and the reason names the missing contract.
Before you start
Contracts are not transitive: WEB can reach APP, and APP can reach DB, but that gives WEB nothing toward DB. Read show contract as the application’s map.
Concept
ACI: a fabric run by policy
An ACI fabric is run from a controller. You describe tenants, bridge domains and groups of hosts, and the controller works out what each switch needs. An endpoint group (EPG) is hosts that share policy, wherever they are. A static path puts a leaf port and VLAN into an EPG, and the access-policy chain limits which VLANs may be used where. Underneath, leaves are VXLAN tunnel endpoints, which you never configure.
