7 Responses to Configuring an L3OUT in Cisco ACI

1. sandev chopra says:

   January 27, 2018 at 7:00 pm

   Hi, great byte size video. I did not understand why you had to create the subnet: 0.0.0.0/0 inside the aci? Shouldn’t that be learned over ospf from the router?

   Reply
   • ucsguru says:

     January 29, 2018 at 12:18 pm

     Great question Sandev, the subnet defined within the External EPG is to define the destination IP addresses required for the contract (ACL) between your external and internal EPGs. You can define multiple External EPGs to an L3out each with different defined subsets, allowing for granularity of control to different external networks.
     Regards
     Colin

     Reply
2. Mousa says:

   July 7, 2018 at 3:45 pm

   Hi Colin …. I need to have the same subnet shared between VRFs, advertised externally & limit IP learning to that subnet
   In this case, I will need to configure the subnet under the Bridge domain to limit IP learning to that subnet & to associate that subnet to the L3Out …. In addition, I will need to configure the same subnet under the EPG to have proper route leaking (as that EPG is used a contract provider) … I am a little bit confused about this configuration

   Is it going to work to have the same SVI interface created under the EPG & the bridge domain?

   Should I flag the subnet as shared between VRFs & advertise externally from both places (Under the EPG & the Bridge Doamin)?

   Reply
3. will25u says:

   November 24, 2018 at 2:04 am

   Is it possible to have two VRFs within the same tenant share the same L3Out ?

   Reply
4. Alif says:

   February 16, 2019 at 10:24 am

   Hi, Colin,

   I just watched your video.
   I have 2 question.

   1. At this time that our ACI infrastructure has Scope settings on all bridge domains it is “Private to VRF”. As you explained in your video, if we want to advertise routing using OSPF / EIGRP, the scope on the bridge domain must be changed to “Advertised Externally”. My question is, when changes are made, will there be a downtime?

   2. I will connect our 2 ACI Data Centers using OSPF.
   On DC 1, we have 1 Tenant, namely ProdX.
   On DC 2, we have 3 Tenants, namely Common, DevX, BigData.
   My question is, do I have to make 3 L3out on DC 2 for each tenant or can I just use 1 L3out?

   Thank you

   Reply
   • ucsguru says:

     August 28, 2019 at 11:22 am

     Changing that setting on a BD to advertising the bridge domain prefix via an L3OUT does not cause any downtime.

     Re question 2:
     Best way would be to just create a single L3OUT in the common Tenant and then just use that for all 3 of your Tenants.
     As You will be providing/consuming contracts between Tenants, the scope of the Contract needs to be “Global”
     Also If they are using separate vrfs from common, you also need to tick the “Shared Route Control Subnet” and “Shared Security Import Subnet” box’s on your External EPG to ensure the external/default routes are learned by your Tenant vrf.
     Regards
     Colin

     Reply

5. Pingback: Configuring an L3OUT in Cisco ACI – Real World UCS

This site uses Akismet to reduce spam. Learn how your comment data is processed.