L3OUT with VRF unenforced

[guidov2]

Hello,

is it correct that without enforcement L3OUT on same VRF do not need contracts ? 

May be that there are some difference between releases  ?

Thanks and regard 

[6askorobogatov]

Correct. Unenforced VRF is not using security zone table, so contracts are ignored. 

[guidov2]

Thanks,

but what about the fact that to install BD route on border leaf it is necessary a contract ?

So also if unenforced the contact is necessary .... or not ?

Thanks and regards

[6askorobogatov]

not sure what is :

"but what about the fact that to install BD route on border leaf it is necessary a contract"

you do not contact to allow connections between EPGs on the same VRF, if VRF is unrestricted. 

you need contract to leak route via l3out or to another vrf. 

[Timothy Rothenberg · Accepted solution]

When the VRF is unenforced, every leaf with an interface in that VRF will install the pervasive routes for every bridge domain in the VRF.  External routes are downloaded to every leaf participating in the VRF as well (normal behavior).