Physical domains vs External bridge domains.

[MarkoMilosavljevic4884]

Hi,

In APIC -> Access Policies, there are two thing that I don't see the different between them ( Physical domains and External bridge domains).
What is the purpose & differences of each one, what is the equal configure in IOS for them ?

[Robert Burns]

Domains are a necessary link in the ACI policy structure that provide RBAC between Access Policies (mainly VLANs) and Logical Policies (Tenant).  Physical Domains are used for "EPG static port paths", and External Bridge Domains are used for "External Bridged Networks".  In my opinion there's little need to use External Bridged Networks and you should focus on Physical Domains & Static paths when connecting baremetal workloads to ACI.

Robert

[mvknl]

An External Bridged Domain in ACI is used to create an L2out. L2outs are rarely used. You would use a L2out when you have a network which is routed outside of the fabric, but L2 attached within the fabric and you want to apply contracts on them.

Usually you can't apply contracts on L2 only bridge domains, but with L2outs that is possible. I have never seen this implemented anywhere, but there must be some ACI deployments out there using this as it wouldn't be in ACI otherwise.