L3Out on an existing BD subnet

[SandevChopra07800]

Hi Board, I am in the middle of migrating from Legacy NXOS to ACI. There is a vlan on the legacy side that is used for both servers and transit to firewall having static routes configured towards the FW. So basically, there is a /24 SVI that has both servers and firewalls, and there are static routes pointed towards the FW ip. 

When translating this into ACI world, this would be equivalent to a BD holding the subnet-gateway ip. The question is, can I configure a L3Out using the same BD vlan encapsulation towards the FW (When comparing this from Legacy NW side, the idea is to have the secondary ip on the L3Out same as the BD-subnet ip). ? Is this supported? If not, what option is out there if you get into this issue where you need to add static routes using the same BD subnet.

Thx

[AshSe]

Hi @SandevChopra07800 

Before we come to the solution, here are some questions:

---

@SandevChopra07800 wrote:

Hi Board, I am in the middle of migrating from Legacy NXOS to ACI.

---

Have you prepared the migration plan and started executing it? Can you share your migration plan?

---

There is a vlan on the legacy side that is used for both servers and transit to firewall having static routes configured towards the FW. So basically, there is a /24 SVI that has both servers and firewalls, and there are static routes pointed towards the FW ip. 

---

Could you please explain this. Would appreciate a diagrammatic explanation.

---

When translating this into ACI world, this would be equivalent to a BD holding the subnet-gateway ip. The question is, can I configure a L3Out using the same BD vlan encapsulation towards the FW (When comparing this from Legacy NW side, the idea is to have the secondary ip on the L3Out same as the BD-subnet ip). ? Is this supported? If not, what option is out there if you get into this issue where you need to add static routes using the same BD subnet.

Thx

---

Have you explored L2Out for the migration?

Please check the example digram below, providing a high level diagram of L2Out-BD extension for migration:

Also check the below links:

https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/migration_guides/migrating_existing_networks_to_aci.html

Few more points:

1. Migration from NX-OS to ACI is primarily about transitioning the network's operational model and configuration to align with ACI's SDN approach.
2. Physical migration of devices is not typically required unless your existing hardware is incompatible with ACI.
3. The process involves building the ACI fabric, connecting it to the legacy network, migrating workloads, and eventually decommissioning the legacy network.

Awaiting your response to suggest the best!

AshSe

[AshSe]

.... Continuing the above, about L2Out and L3Out:

• L2Out is primarily used for extending VLANs and enabling Layer 2 communication between the legacy network and ACI during a phased migration.
• L3Out is used for routing between the ACI fabric and the legacy network or external devices.
• In most migrations, both L2Out and L3Out are used together to ensure a smooth transition from the legacy NX-OS network to the ACI fabric.

I think we have sufficient ground to prepare/check migration plan.

HTH

AshSe

[SandevChopra07800]

Layer2 migrations have been completed. All servers are physically connected to the ACI fabric. We are now planning for Layer3 moves (Getting the SVIs migrated over). Hope this clarifies. 

[AshSe]

Please let us know, what's your requirement now.

[SandevChopra07800]

Please re-read my original Question. 

[RedNectar]

Hi @SandevChopra07800 ,

Don't have time to do a full answer right now - but I can answer the first bit

---

The question is, can I configure a L3Out using the same BD vlan encapsulation towards the FW (When comparing this from Legacy NW side, the idea is to have the secondary ip on the L3Out same as the BD-subnet ip). ? Is this supported?

Sorry, but NO

If not, what option is out there if you get into this issue where you need to add static routes using the same BD subnet.

This is what I don't have time to think through right now