Accepted Solutions
Hi @dm2020 ,
Firstly, just my opinion, but
PLEASE DON'T USE ANY L2-OUTS. They are an abomination and should NEVER have been made a thing in ACI.
Phew. That feels better. So let me say it more politely.
Any time you think you need a L2 Domain or L2Out, just use a Physical Domain and regular Application EPG instead. It will achieve exactly the same result but give you future flexibility that just isn't there in L2Outs.
Now to your question.
Will the above be possible with just three Domains (one physical, one external bridged and one L3), with one AAEP and one VLAN pool?
ANSWER:
Actually, you only need just TWO Domains (one physical, and one L3), with one AAEP and one VLAN pool.
Your Network Centric approach is also perfectly sound for this task.
Here's some more tips:
- Don't use a VLAN range of 2-4095 at the get go. Or if you do, add them as several smaller ranges (a VLAN Pool can have many ranges added).
- The reason for this is that it is VERY EASY to add more VLANs to a VLAN pool. It is IMPOSSIBLE to remove a VLAN from a VLAN pool without removing the entire range. So if you DO need to allocate some Dynamic VLANs at a later date (which is reasonably likely) you'll have some spare VLAN ranges to do so.
- There are certain cases where overlapping VLAN pools can cause a problem, so if you ever need a 2nd Static VLAN pool, it will overlap with this one.
- Having said that, when it comes to Static VLAN pools, YOU are in control, so any overlapping you do is your fault. Since you have effectively ALWAYS had a VLAN range of 2-4095 on every switch since 1998, and have coped so far, you can probably continue to cope with one VLAN Pool with all VLANs
- As I mentioned above, don't use L2 Outs. Create an Application Profile in your Tenant1 and add 30 Bridge Domains (one for each subnet) and 30 EPGs (one for each VLAN).
- But there is nothing wrong with having fewer BDs and giving the BDs multiple default gateway addresses. One BD with 30 IP Addresses is probably going too far, but be aware that you have this additional level of segregation at your disposal. Initially, you probably won't use it. Just be aware that it is possible. And should you find that you have say two subnets that you want to have full communication with each other forever, you can actually create just one BD and one EPG for those two subnets. Since they are in the same EPG they will always have full communication.
- There's also nothing wrong with having a 2nd VLAN Pool just for the L3Out. Some people find this neater. I have mixed feelings.
- Finally, I love your names, and appreciate your great descriptive names, and the fact that you've avoided the hyphen character in your names.
- But as much as I love your names, you might consider abbreviating them a bit, simply because when you see lists of say EPGs you may only see the first 6 or so letters - now you can always make columns wider etc. One way to do this is to use the colon or period character in names rather than the underscore in some places. For example, I'd probably call the L3 Domain in your example
- Tenant1_L3Dom or Tenant1:External_L3Dom or T1:Ext_L3Dom
- I'd use the term L3Dom rather than Domain_L3_Out because ACI is now fairly consistent with calling these objects L3 Domains
- I'd actually use AAEP in the name of the AAEP rather than just AEP. This is part of my personal vendetta agains Cisco for using stupid and confusing abbreviations
- I'd use the term L3Dom rather than Domain_L3_Out because ACI is now fairly consistent with calling these objects L3 Domains
- These are purely aesthetic suggestions and in no way influences the design
You may also glean some more or my ideas from this previous answer I gave to a similar question and maybe even this one or this one
Hi @dm2020 ,
Firstly, just my opinion, but
PLEASE DON'T USE ANY L2-OUTS. They are an abomination and should NEVER have been made a thing in ACI.
Phew. That feels better. So let me say it more politely.
Any time you think you need a L2 Domain or L2Out, just use a Physical Domain and regular Application EPG instead. It will achieve exactly the same result but give you future flexibility that just isn't there in L2Outs.
Now to your question.
Will the above be possible with just three Domains (one physical, one external bridged and one L3), with one AAEP and one VLAN pool?
ANSWER:
Actually, you only need just TWO Domains (one physical, and one L3), with one AAEP and one VLAN pool.
Your Network Centric approach is also perfectly sound for this task.
Here's some more tips:
- Don't use a VLAN range of 2-4095 at the get go. Or if you do, add them as several smaller ranges (a VLAN Pool can have many ranges added).
- The reason for this is that it is VERY EASY to add more VLANs to a VLAN pool. It is IMPOSSIBLE to remove a VLAN from a VLAN pool without removing the entire range. So if you DO need to allocate some Dynamic VLANs at a later date (which is reasonably likely) you'll have some spare VLAN ranges to do so.
- There are certain cases where overlapping VLAN pools can cause a problem, so if you ever need a 2nd Static VLAN pool, it will overlap with this one.
- Having said that, when it comes to Static VLAN pools, YOU are in control, so any overlapping you do is your fault. Since you have effectively ALWAYS had a VLAN range of 2-4095 on every switch since 1998, and have coped so far, you can probably continue to cope with one VLAN Pool with all VLANs
- As I mentioned above, don't use L2 Outs. Create an Application Profile in your Tenant1 and add 30 Bridge Domains (one for each subnet) and 30 EPGs (one for each VLAN).
- But there is nothing wrong with having fewer BDs and giving the BDs multiple default gateway addresses. One BD with 30 IP Addresses is probably going too far, but be aware that you have this additional level of segregation at your disposal. Initially, you probably won't use it. Just be aware that it is possible. And should you find that you have say two subnets that you want to have full communication with each other forever, you can actually create just one BD and one EPG for those two subnets. Since they are in the same EPG they will always have full communication.
- There's also nothing wrong with having a 2nd VLAN Pool just for the L3Out. Some people find this neater. I have mixed feelings.
- Finally, I love your names, and appreciate your great descriptive names, and the fact that you've avoided the hyphen character in your names.
- But as much as I love your names, you might consider abbreviating them a bit, simply because when you see lists of say EPGs you may only see the first 6 or so letters - now you can always make columns wider etc. One way to do this is to use the colon or period character in names rather than the underscore in some places. For example, I'd probably call the L3 Domain in your example
- Tenant1_L3Dom or Tenant1:External_L3Dom or T1:Ext_L3Dom
- I'd use the term L3Dom rather than Domain_L3_Out because ACI is now fairly consistent with calling these objects L3 Domains
- I'd actually use AAEP in the name of the AAEP rather than just AEP. This is part of my personal vendetta agains Cisco for using stupid and confusing abbreviations
- I'd use the term L3Dom rather than Domain_L3_Out because ACI is now fairly consistent with calling these objects L3 Domains
- These are purely aesthetic suggestions and in no way influences the design
You may also glean some more or my ideas from this previous answer I gave to a similar question and maybe even this one or this one
