Layer2 OUT vs Extending static EPGs

[cowser1979]

Hello -

I am working on migrating an exiting DC to an ACI fabric.  Initially, we will be mapping EPGs to the legacy VLAN tags as most of my existing connections are all just plain dotq trunks between my existing switch infrastructure (Cisco 6500s and 5548s) out towards BM servers, VM servers (in my case Cisco FIs that I do not manage), LBs, and FWs.  Each EPG will be assigned its own bridge domain, and each bridge domain will be set up in "legacy" mode with NO ip address, and unicast and arp flooding enabled.  

I have a question regarding dotq trunks:

Is there a difference between just setting a L2 out to those devices vs. statically mapping multiple EPGs (with their own respective VLAN tag) to the same ports?  I have done it both ways, but can't really determine if there is a difference.  Also, I have read the ACI design and Operations guides, and I haven't really found a good explanation, other than to say that you have either option.  I want to understand if there is some fundamental difference between the two?  The only thing I can think of is that if you were set up your EPGs and BDs in "routed" mode, you wouldn't have the option to flood unknown traffic, thus if you needed that ability, you would need to create an additional L2 OUT object to handle that action?

thank you

[cowser1979]

Hello - I think I should also point out, that I will NOT be doing any Layer4-7 service insertion, as part of this project.  We would like to test that feature on its own after the Palo Alto api is released.

[cowser1979]

I also forgot to mention that I am aware of the contract requirement for a layer 2 out...so other than that, is there a functional difference between the L2 out and EPG extension?

thanks

[dpita]

When extending the BD via L2 out. you are associating multiple external VLANs to the one BD. you are applying policy on a per -vlan or per-l2-out basis. On the other hand, when extending the EPG out, you are associating 1 or more VLANs to a particular EPG where you are somewhat limited in how granular policy can be. 

For example, if you needed to bring in external VLAN 10, 20, and 30 and you made an L2 out for each of those three VLANs, yes they would each be tied to the same BD but you can apply policy to each one individually. If I'm not mistaken you could re-use the same node profile and interface profile for each individual L2 out referencing a different VLAN. *With this model, endpoints from the external network are learned in this external EPG and require policy to communicate with any other endpoint attached to the fabric. *

Whereas, if you extend the EPG you can have EPGA with vlan 10 OR 20 OR 30 static paths on the same leaf/interface but not all three(to be technical, you can have 1 but no more than that). You would need to use a different interface or a different EPG to use the same interface. *With this model, internal endpoints (attached to the fabric and learned in EPGA) will be able to forward without restriction to the external endpoints learned on the VLAN associated to the EPG. *

ACI currently has a very tight correlation between an EPG and a VLAN. Please reference this white paper on external networks with ACI:

http://www.cisco.com/c/en/us/solutions/collateral/data-center-virtualization/application-centric-infrastructure/white-paper-c07-732033.html#_Toc395143568

hope this helps. have a nice day!

[cowser1979]

Awesome, thanks!