External Layer 3 Network Connectivity

By default, a bridge domain subnet scope is Private to VRF. You must designate internal networks (such as, bridge domain subnets) as public or advertised externally to allow their propagation via external Layer 3 connections.

Cisco ACI fabric supports transit routing, which enables border routers to perform bidirectional redistribution with other routing domains. Such redistribution lets the ACI fabric provide full IP connectivity between different routing domains. Doing so can also provide redundant connectivity by enabling backup paths between routing domains.

By default, ACI learns any routes from external devices via the routing protocol. ACI has import filters that limit the external routes ACI will learn and use. The import filters select a subset of routes that are advertised by the external peers to the fabric. The import filter is implemented with a route-map internally and is generated by using the prefixes in the prefix-based EPG (such as external EPG, L3Out EPG). Set actions can also be associated with import route-maps.

You can select subnets to advertise to external routers via L3Out. The advertised subnets are bridge domain subnets and external routes from another external router. A default route can be advertised to external routers if required.

Configuring External Layer 3 Networks

 L3Out Configuration

OSPF is one of the protocols that you can enable between Cisco ACI and an external router. Cisco ACI supports all common options, such as OSPF area including backbone, various stub options, neighbor authentication, and other similar options.

An L3Out must be associated with a VRF and an external routed domain. The ExtL3Out external routed domain references a VLAN pool and interfaces (via AAEP). If a routed interface or routed subinterface is used, External Routed Domain is not required.

EBGP Peering Configuration

You can use External Border Gateway Protocol (EBGP) to attach the Cisco ACI fabric to an outside domain. The L3Out configuration contains (in addition to the selection of peering interface) a rich set of BGP neighbor options, such as MD5 authentication, next-hop-self, and so on.

For example, the local AS number feature is to disguise the ACI BGP AS number that is shared with infra MP-BGP. Just like a normal router, users can configure the local AS option to make itself look like a different AS to its BGP peer in case external routers cannot peer with ACI BGP AS number directly for some reason.

External Network EPG Configuration

 You should set the scope to External Subnets for the External EPG, which is the default setting.

 The following are the most relevant settings:

• Export Route Control Subnet: Controls which subnets are advertised out of the fabric. This scope is mainly for Transit Routing.

• Import Route Control Subnet: Controls the external subnets allowed into the fabric. Supported for BGP and OSPF, but not for EIGRP. This scope can be used only when Import Route Control Enforcement is enabled in the L3Out via Route Control Enforcement option.

• Shared Route Control Subnet: Controls which external subnets are advertised to other VRFs for shared L3Out (VRF Route leaking with L3Out).

• External Subnets for the External EPG: A classifier for the external EPG. The subnet defined by this scope belongs to this External EPG and will use the contracts in it. Please note that the scope of this option is not closed to the L3Out, but is VRF wide. For example, even if 10.0.0.0/8 is learned via L3Out A, but 10.0.0.0/8 is configured in an External EPG in L3Out B in the same VRF, it will use contract from the EPG in L3Out B.

• Shared Security Import Subnet: Configures the classifier for the external subnets in the VRF where the routes are leaked for shared L3Out (VRF Route leaking with L3Out).

External Subnets for the External EPG