Configuring an L3OUT in Cisco ACI

About ucsguru

Principal Consultant and Data Center Subject Matter Expert. I do not work or speak for Cisco or any other vendor.
This entry was posted in Cisco ACI and tagged , , , , , . Bookmark the permalink.

7 Responses to Configuring an L3OUT in Cisco ACI

  1. sandev chopra says:

    Hi, great byte size video. I did not understand why you had to create the subnet: inside the aci? Shouldn’t that be learned over ospf from the router?

    • ucsguru says:

      Great question Sandev, the subnet defined within the External EPG is to define the destination IP addresses required for the contract (ACL) between your external and internal EPGs. You can define multiple External EPGs to an L3out each with different defined subsets, allowing for granularity of control to different external networks.

  2. Mousa says:

    Hi Colin …. I need to have the same subnet shared between VRFs, advertised externally & limit IP learning to that subnet
    In this case, I will need to configure the subnet under the Bridge domain to limit IP learning to that subnet & to associate that subnet to the L3Out …. In addition, I will need to configure the same subnet under the EPG to have proper route leaking (as that EPG is used a contract provider) … I am a little bit confused about this configuration

    Is it going to work to have the same SVI interface created under the EPG & the bridge domain?

    Should I flag the subnet as shared between VRFs & advertise externally from both places (Under the EPG & the Bridge Doamin)?

  3. will25u says:

    Is it possible to have two VRFs within the same tenant share the same L3Out ?

  4. Alif says:

    Hi, Colin,

    I just watched your video.
    I have 2 question.

    1. At this time that our ACI infrastructure has Scope settings on all bridge domains it is “Private to VRF”. As you explained in your video, if we want to advertise routing using OSPF / EIGRP, the scope on the bridge domain must be changed to “Advertised Externally”. My question is, when changes are made, will there be a downtime?

    2. I will connect our 2 ACI Data Centers using OSPF.
    On DC 1, we have 1 Tenant, namely ProdX.
    On DC 2, we have 3 Tenants, namely Common, DevX, BigData.
    My question is, do I have to make 3 L3out on DC 2 for each tenant or can I just use 1 L3out?

    Thank you

    • ucsguru says:

      Changing that setting on a BD to advertising the bridge domain prefix via an L3OUT does not cause any downtime.

      Re question 2:
      Best way would be to just create a single L3OUT in the common Tenant and then just use that for all 3 of your Tenants.
      As You will be providing/consuming contracts between Tenants, the scope of the Contract needs to be “Global”
      Also If they are using separate vrfs from common, you also need to tick the “Shared Route Control Subnet” and “Shared Security Import Subnet” box’s on your External EPG to ensure the external/default routes are learned by your Tenant vrf.

  5. Pingback: Configuring an L3OUT in Cisco ACI – Real World UCS

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.