Item: Cisco Application Centric Infrastructure (Cisco ACI)
Rating: 9
Author: Mark Healey

Overall Satisfaction with Cisco Application Centric Infrastructure (Cisco ACI)

Use Cases and Deployment Scope

We currently use Cisco ACI as the fabric for our next generation data centre. The platform is managed by the Network Team within our IT department, and hosts all of the internal application we use, as well as providing secure access to applications on the Police National Network, private and public clouds, and the Internet at large.

Pros and Cons

Pros

Security being at the heart of Cisco ACI made it the perfect choice.
The web management GUI is intuitive and feature rich.
Troubleshooting and fault finding facilities are excellent.

Cons

Some parts of ACI are very complex to understand and implement.
Upgrades are complicated and difficult to implement.
Third Party Support is hard to come by.

Return on Investment

Cisco ACI has had a major positive impact on our core direction to embed security in everything we do.

Cisco & Partner Integrations

Cisco ASA

We have been able to implement service insertion Cisco ASA firewalls directly into the fabric, to allow extra security around traffic that is allowed between two end points. This allows load balancing and traffic inspection from layer 4 upwards, rather than just relying upon the layer 3 security baked into Cisco ACI itself.

Performance

Day to day operations on Cisco ACI do not require much human intervention, the platform ticks over without any major faults. Being able to rapidly replicate the communication between two groups of machines across multiple sub networks speeds up new application delivery, and the integration into vmWare allows multiple teams within IT to work together to problem solve rapidly.

Scalability

Security

Zero-trust security is baked into the core of Cisco ACI. Two machines cannot communicate unless you specifically allow them to, and only on the specific ports and in the specific direction you allow. There is no lateral movement allowed across the network, and even if a single machine was compromised, it would not be possible to leverage that to compromise other machines in the same data centre.

Alternatives Considered

As a Cisco house, we did not evaluate any other products.

Other Software Used

Cisco ASA, Cisco ASA 5500-X with FirePOWER Services, Palo Alto Networks Next-Generation Firewalls - PA Series

Likelihood to Recommend

Implementation of a new application into Cisco ACI, with all of the relevant groups of servers and storage, is very easy to carry out, as long as all of the communications between the servers are known. Migrating an existing application into the platform was found to be extremely difficult, as legacy applications are often built on a flat network, where this kind of information wasn't documented in the required depth.

Using Cisco Application Centric Infrastructure (Cisco ACI)

Users and Roles

7 - Cisco ACI is managed and maintained by the Network team, with input from the Server and IT Security Teams.

Support Headcount Required

7 - Cisco ACI is managed and maintained by the Network team, with input from the Server and IT Security Teams.

Business Processes Supported

We use this for installation of all new applications.

Innovative Uses

We have improved security of some of our legacy applications by moving them into ACI.

Future Planned Uses

We will soon be implementing a second Cisco ACI data centre, to extend the fabric over the WAN, providing better resiliency.

Likelihood to Renew

Cisco ACI is doing exactly what was intended for it to do, that is support our next generation data centre, improve security, and increase resiliency. Migrating to another platform would be a waste of time, resource and energy, which could be better spent migrating more legacy applications into the Cisco ACI fabric.

Cisco Application Centric Infrastructure (Cisco ACI) Training

Training Types Used

in-person training

In-Person Training

The Cisco ACI training provided by Cisco was in depth, covered all of our requirements, and allowed us to implement and maintain the platform without issues.

Cisco ACI - perfect for Public Sector Data Centers