Why Service Graphs Matter in Cisco ACI

Service graphs in Cisco ACI simplify network and security integration by offering several key benefits:

• Traffic Redirection Made Easy: Direct traffic to L4-L7 devices without complex designs.
• Automated VLAN Management: No manual VLAN assignments needed.
• Seamless vNIC Connectivity: Virtual NICs are automatically connected.
• Reusable Templates: Configure once, reuse multiple times.
• Logical & Application-Centric View: Gain clarity and better visibility of services.
• Shared Device Model: Efficiently share devices across departments.
• Health & Performance Insights: Collect health scores and statistics from devices.
• Dynamic Updates: ACLs and pools update automatically with endpoint discovery.

However, in Service Policy Mode:

• The model leans heavily on automation.
• Managing numerous configuration parameters can be overwhelming for frequent changes.

Bottom Line:
Service graphs offer a streamlined, application-focused approach compared to traditional designs—but choose wisely based on your operational needs.

Cisco ACI Service Graph Management Models Explained

Cisco ACI provides three distinct approaches to manage service graphs, each offering different levels of control and integration:

1. Network Policy Mode (Unmanaged)
   In this mode, ACI configures only the network aspects of the service graph within the fabric. No configuration changes are pushed to the L4-L7 device, making it suitable when device policies are managed externally.

2. Service Policy Mode (Managed)
   Here, ACI not only handles the fabric configuration but also manages VLAN settings on the L4-L7 device. The APIC administrator can directly input device-specific configurations through the APIC interface, ensuring centralized control.

3. Service Manager Mode
   This model allows the firewall or load balancer administrator to define L4-L7 policies. ACI takes care of the fabric and VLAN configurations, while the APIC administrator links these policies with the network policy, enabling a collaborative approach.

Choosing the Right Cisco ACI Service Graph Mode

When designing with Cisco ACI, selecting the right service graph mode depends on your operational needs:

• Dynamic Configuration Needs?
  If firewalls and load balancers must be configured dynamically through APIC, choose Service Policy Mode. If a separate administrator handles device configuration, opt for Network Policy Mode or Service Manager Mode.

• Frequent Commissioning Like Cloud Services?
  For environments where devices are frequently added or removed, Service Policy Mode or Service Manager Mode works best. If services remain static for long periods, Network Policy Mode or Service Manager Mode is more practical.

• Complex Multi-Leg Designs?
  If your design requires multiple interfaces or DMZ configurations, manual service insertion using EPGs and bridge domains may be more convenient than using a service graph.

Bottom Line:
Your choice should align with automation needs, operational flexibility, and design complexity.