Properties of L3Out

[aloysius.liu]

Hi all, 

I'm new in ACI and has one question in regard to the basic property of ACI L3Out. I know that multiple L3Outs configured can talk to each other via route-leaking if they are in different vrf and contracts if there are in the same vrf. Are there such properties for one L3 out associating to multiple end devices via multiple leaves ? One example is that you have a pair of leaves connecting to a pair of ASA firewall while the other pair of leaves connecting to another pair of remote routers. Can these be connected via one L3Out ?

Thanks

Aloysius Liu 

[RedNectar]

Hi @aloysius.liu ,

I don't have tome to give a detailed reply - perhaps someone else will - but I've written about this on the forum before - Google search site:community.cisco.com l3out rednectar or look at this one

The key thing to understand is that you are configuring routers - the L3out is nothing magical. What matters are the leaf/interface profiles in the L3Out.

Use One L3out

Use Two L3Outs 

It makes very little diffference. Perhaps LESS confusing (meaning you don't make stupid assumptions about the leaves in the L3Out being able to magically communicate with each other in the sam L3Out) if you use two.

I hope this helps

---

Don't forget to mark answers as correct if it solves your problem. This helps others find the correct answer if they search for the same problem

---

[joezersk · Accepted solution]

Hi Aloysius.  The short answer to your question is yes, you can have more than one peering or adjacency on a given L3out.  The longer answer is this.  Think of the L3Out as equivalent to a routing process.  As long as all your routing peers are using the same protocol (like OSPF for example) and general policy, you can specify many links, peers or adjacencies under the same L3out.  You just need to tell the L3out which leaf, interface and IP needs to be used on the ACI side for each one. 

Hope that helps.

-J

[aloysius.liu · Accepted solution]

Yes, finally I'm able to lab it out. I'm able to create an L3Out that consists of 2 logical Interfaces profiles each mapping to a pair of configured nodes where static routes are define. You will need to create 2 x L3OutNetwork to signify two external EPGs with applied scope on subnets defined in respective L3OutNetwork so as to apply contracts or the like between the two networks. 

Basically I would consider L3Out as a routing container with one vrf where you can define multiple node profiles & Interface profiles which is equivalent to ports/routes in network configuration layman term and applying the necessary control  and contract on L3OutNetwork.

It is advisable that one Interface profile created map to one L3OutNetwork (external EPGs) to avoid confusion when applying access control on enforced vrf.

In the lab, I created one L3Out which had two Interfaces profiles and each profile consists of a pair of nodes. One profile is connected to a pair of ASA while the other profile connected to a pair of L3 routers. 2 external EPGs or L3Out were created each mapping to the respective profile.

Thus in conclusion One L3Out can support many interface and node profiles together with multiple L3Out EPGs.