While ACI will solve a number of problems, troubleshooting configuration problems is very frustrating, the dependent configuration items are too disjoint and scattered over the UI and it is not well documented what needs what. I agree that the FABRIC is easy to get working, the policies are another matter altogether. If I can get a signoff from our security people that contracts can replace at least the L4 filtering options on firewalls then it is worth it. By the by some information comparing ACI to say ASA or some other firewall in terms of features and functions would help.