Yesterday, Cisco announced a new software release for ACI. If you are looking to automate IT, or build out your cloud environment, and want to do so in an open fashion that provides a lot of flexibility -then you'll probably be interested.

Why? The new ACI release:

1. Makes managing and securing your cloud environment easier;
2. Provides openness, expanding customer choice; and
3. Delivers operational flexibility

View this post on Instagram

Data Center Application Agility Policy Driven Automation Operational Choice Open Ecosystem Security#CiscoACI http://cs.co/9001Brljv

A post shared by Cisco Data Center (@ciscodc) on Dec 3, 2015 at 12:04pm PST

OK, so what does this actually mean?

1. Makes managing and securing your cloud environment easier

Three of the most popular cloud management tools include Microsoft Azure Pack, OpenStack and VMware vRealize. Earlier this year, we announced Windows Azure Pack ACI integration. With this new ACI release, we integrate ACI with OpenStack and vRealize, as well. (More details are here.) So this means that if you need to, say, provision a virtual workload in vCenter, ACI automagically orchestrates things to match computing resources and networking infrastructure.  So, you can enjoy the policy based automation and all the other benefits of ACI regardless of which of these tools you use to manage your cloud environment.

This also means OpenStack users can now create and manage their own virtual networks, extending ACI policy directly into the hypervisor with a hardware-accelerated, fully distributed OpenStack networking solution -the only one available that integrates both physical and virtual environments.

To more easily and completely secure these environments, the new release provides micro-segmentation support for VMware VDS, Microsoft Hyper-V virtual switch, and bare-metal endpoints. Essentially, this means more granular enforcement of security policies.   These can be based on numerous different criteria relevant to attributes associated with the network, e.g. IP address, or the virtual machine, e.g. VM identifier, Name, etc. There are additional capabilities that can, for example, disable communication between devices within a policy group (intra EPG, for those more familiar with ACI) -useful in thwarting lateral expansion of attacks.

1. Provides openness, expanding customer choice

Piggybacking off some comments above, it's worth noting that since ACI's inception, one of its differentiators has been the ability to integrate physical servers as well as virtual machines, and to apply policy consistently across them. Well, now there's a new kid on the block, as the industry observes an increasingly popular trend to use containers as another way of operating applications.   As part of this announcement, we are extending ACI support to include Docker containers, in addition to VM's and bare metal servers. This is done by using Project Contiv, which is an open source project that has a Docker network plugin allowing, among other things, automatic configuration of Docker hosts to integrate with ACI. Check out details on this video and/or this white paper. Network Computing commented here, that:

"Given all the hubbub in the industry over Docker, ACI's new Docker container support is noteworthy."

Another way this new release is driving openness and providing more choice for customers is around L4-7 services. ACI now supports service insertion and chaining foranyservice device.  So, customers can leverage their existing model of deploying and operating their L4-L7 device, while automating the network connectivity. This is in addition to, not instead of, the device package model, which provides for more comprehensive 'soup to nuts' automation. Speaking of which, as part of this announcement, several new partners also joined the ACI Ecosystem. This video provides some insight into how some of them automate your applications.

1. Delivers operational flexibility

The new release has a number of tools that create more flexible operating environments. A quick rundown includes the multi-site app, which enables policy-driven automation across multiple datacenters, providing enhanced application mobility and disaster recovery. In short, this means you can run ACI in 2 different data centers, and extend the policy across them. Other tools provide the ability to do configuration rollback, as well as NX-OS Style CLI. This is for the CLI junkie that wants to run the entire ACI fabric as a single switch. There are some other cool nuggets in here as well, like a heat map that provides real-time visibility into system health.

Clayton Weise, Director of Cloud Services at KeyInfo, summed it up best when he said:

"ACI is the direction we're going to go because it gives us the best flexibility." (Read the entire Network World story here.)

In summary, this new release adds capabilities that will help you more effectively manage and secure your cloud environment, as well as leverage the benefits of both openness and operational flexibility.