Default-export route profile with a prefix-list in the L3Out.
In this scenario, the network router needs to communicate to the subnet 172.16.1.0/30 which is behind the Partner Router through the Cisco ACI fabric.
The Cisco ACI fabric needs to advertise (export) 172.16.1.0/30 that is learned from L3Out Partner to L3Out Legacy.
The above objective can be achieved by two ways.
Option 1 - "default-export" Route Profile
Go to Tenant(POC1) --> Networking --> L3Outs --> L3Out (POC1-L3OUT) --> Route map for import and export route control --> Right Click --> Create Route map for import and export route control --> select "default-export"
select "Match Routing Policy Only"
Now on Contexts --> click on "+"
Please note that the “default-export” route profile takes effect on the L3Out without associating it to L3Out EPG.
When using the "default-export" route profile the additional parameters to be set on the advertised route can be configured in the same "default-export" route profile.
There are several subnets that are received from the partner router that should be advertised to the legacy router. In this scenario, you can define the 0.0.0.0/0 prefix-list with Aggregate option.
Option 2: "Export Route Control Subnet" Scope with L3Out Subnets
When additional parameters such as BGP community need to be added to the advertised route, a route profile needs to be used as well. In this scenario, the recommended configuration is to use a route profile with a custom name (not "default-export") with Type "Match Prefix AND Routing Policy.” Then apply it to the L3Out subnet with "Export Route Control Subnet" scope or to the L3Out EPG itself.
Go to External EPG created under L3Out
Under Policy --> General --> click on "+" on subnet
Similary add 172.16.100.100/32 also as "Export Route Control Subnet"
If there are several subnets than use "Aggregate" option.
Now add 172.16.200.200/32 as "External Subnet for the External EPG" (checkmark this option & uncheck export route control subnet).
L3Out EPG needs to define the external subnet that belongs to itself via the scope "External Subnets for the External EPG."
L3 Out Transit Lab
L3 Out Transit
-----------------------------------------------------------------------------------------------------------
We are using Nexus Switch to Simulate as endpoint.
On doing "show lldp neighbour"
leaf1 Eth1/5 --> Nexus Port 120 BR Eth1/15 (Leaf 1 port)
leaf5 Eth1/24 --> Nexus Port 120 BR Eth1/14 (Leaf 5 port)
-------------------------------------------------------------------------------------------------------------
Let's check config on Nexus ports
Eth1/5
interface Ethernet1/5
no switchport
vrf member ISP1
ip address 10.0.0.2/24
ip ospf network point-to-point
ip ospf mtu-ignore
ip router ospf 1 area 0.0.0.0
no shutdown
n9k# show run vrf ISP1
interface Ethernet1/5
vrf member ISP1
vrf context ISP1
router ospf 1
vrf ISP1
Now add loopback interface
interface loopback101
vrf member ISP1
ip address 101.101.101.1/32
ip ospf network point-to-point
ip router ospf 1 area 0.0.0.0
interface loopback102
vrf member ISP1
ip address 102.102.102.1/32
ip ospf network point-to-point
ip router ospf 1 area 0.0.0.0
n9k# show ip interface brief vrf ISP1
IP Interface Status for VRF "ISP1"(53)
Interface IP Address Interface Status
Lo101 101.101.101.1 protocol-up/link-up/admin-up
Lo102 102.102.102.1 protocol-up/link-up/admin-up
Eth1/5 10.0.0.2 protocol-up/link-up/admin-up
--------------------------------------------------------------------------------------------------
Eth1/24
interface Ethernet1/24
no switchport
vrf member ISP2
ip address 172.16.0.2/24
ip ospf network point-to-point
ip ospf mtu-ignore
ip router ospf 1 area 0.0.0.0
no shutdown
n9k# show run vrf ISP2
interface Ethernet1/24
vrf member ISP2
vrf context ISP2
router ospf 1
vrf ISP2
interface loopback201
vrf member ISP2
ip address 201.201.201.1/32
ip ospf network point-to-point
ip router ospf 1 area 0.0.0.0
interface loopback202
vrf member ISP2
ip address 202.202.202.1/32
ip ospf network point-to-point
ip router ospf 1 area 0.0.0.0
n9k# show ip interface brief vrf ISP2
IP Interface Status for VRF "ISP2"(54)
Interface IP Address Interface Status
Lo201 201.201.201.1 protocol-up/link-up/admin-up
Lo202 202.202.202.1 protocol-up/link-up/admin-up
Eth1/24 172.16.0.2 protocol-up/link-up/admin-up
-------------------------------------------------------------------------------------------------------------------------------
Now the task here is to
Advertise interface Lo101 from ISP1 to ISP2
Advertise interface Lo201 from ISP2 to ISP1
External Subnet for External EPG --> Local Subnet of External EPG
For ISP1 --> 101.101.101.1/32
For ISP2 --> 201.201.201.1/32
External Route Control Subnet --> Export Route into the EPG
For ISP1 --> 201.201.201.1/32
For ISP2 --> 101.101.101.1/32
-------------------------------------------------------------------------------------------------------------------------------
n9k# show ip route vrf ISP1
1.1.1.1/32, ubest/mbest: 1/0 → Router ID set while configuring L3out OSPF
*via 10.0.0.1, Eth1/5, [110/5], 00:25:24, ospf-1, intra
10.0.0.0/24, ubest/mbest: 1/0, attached
*via 10.0.0.2, Eth1/5, [0/0], 00:25:25, direct
10.0.0.2/32, ubest/mbest: 1/0, attached
*via 10.0.0.2, Eth1/5, [0/0], 00:25:25, local
101.101.101.1/32, ubest/mbest: 2/0, attached
*via 101.101.101.1, Lo101, [0/0], 00:25:25, local
*via 101.101.101.1, Lo101, [0/0], 00:25:25, direct
102.102.102.1/32, ubest/mbest: 2/0, attached
*via 102.102.102.1, Lo102, [0/0], 00:25:25, local
*via 102.102.102.1, Lo102, [0/0], 00:25:25, direct
201.201.201.1/32, ubest/mbest: 1/0
*via 10.0.0.1, Eth1/5, [110/1], 00:25:24, ospf-1, type-2, tag 4294967295
n9k# show ip route vrf ISP2
99.99.99.99/32, ubest/mbest: 1/0 → Router ID set while configuring L3out OSPF
*via 172.16.0.1, Eth1/24, [110/5], 00:25:23, ospf-1, intra
101.101.101.1/32, ubest/mbest: 1/0
*via 172.16.0.1, Eth1/24, [110/1], 00:25:23, ospf-1, type-2, tag 4294967295
172.16.0.0/24, ubest/mbest: 1/0, attached
*via 172.16.0.2, Eth1/24, [0/0], 00:25:24, direct
172.16.0.2/32, ubest/mbest: 1/0, attached
*via 172.16.0.2, Eth1/24, [0/0], 00:25:24, local
201.201.201.1/32, ubest/mbest: 2/0, attached
*via 201.201.201.1, Lo201, [0/0], 00:25:24, local
*via 201.201.201.1, Lo201, [0/0], 00:25:24, direct
202.202.202.1/32, ubest/mbest: 2/0, attached
*via 202.202.202.1, Lo202, [0/0], 00:25:24, local
*via 202.202.202.1, Lo202, [0/0], 00:25:24, direct
Note: Leaf switch anyways learn all neighbours routes
leaf1# show ip route vrf ISP:VRF-ISP
1.1.1.1/32, ubest/mbest: 2/0, attached, direct
*via 1.1.1.1, lo5, [0/0], 11:30:15, local, local
*via 1.1.1.1, lo5, [0/0], 11:30:15, direct
10.0.0.0/24, ubest/mbest: 1/0, attached, direct
*via 10.0.0.1, eth1/15, [0/0], 11:30:14, direct
10.0.0.1/32, ubest/mbest: 1/0, attached
*via 10.0.0.1, eth1/15, [0/0], 11:30:14, local, local
99.99.99.99/32, ubest/mbest: 1/0
*via 10.0.120.70%overlay-1, [1/0], 10:30:10, bgp-65005, internal, tag 65005
101.101.101.1/32, ubest/mbest: 1/0
*via 10.0.0.2, eth1/15, [110/5], 00:33:32, ospf-default, intra
102.102.102.1/32, ubest/mbest: 1/0
*via 10.0.0.2, eth1/15, [110/5], 00:32:39, ospf-default, intra
172.16.0.0/24, ubest/mbest: 1/0
*via 10.0.120.70%overlay-1, [200/0], 10:30:02, bgp-65005, internal, tag 65005
201.201.201.1/32, ubest/mbest: 1/0
*via 10.0.120.70%overlay-1, [200/5], 00:35:17, bgp-65005, internal, tag 65005
202.202.202.1/32, ubest/mbest: 1/0
*via 10.0.120.70%overlay-1, [200/5], 00:34:58, bgp-65005, internal, tag 65005
leaf5# show ip route vrf ISP:VRF-ISP
1.1.1.1/32, ubest/mbest: 1/0
*via 10.0.120.67%overlay-1, [1/0], 10:31:25, bgp-65005, internal, tag 65005
10.0.0.0/24, ubest/mbest: 1/0
*via 10.0.120.67%overlay-1, [200/0], 10:31:25, bgp-65005, internal, tag 65005
99.99.99.99/32, ubest/mbest: 2/0, attached, direct
*via 99.99.99.99, lo2, [0/0], 10:31:26, local, local
*via 99.99.99.99, lo2, [0/0], 10:31:26, direct
101.101.101.1/32, ubest/mbest: 1/0
*via 10.0.120.67%overlay-1, [200/5], 00:34:49, bgp-65005, internal, tag 65005
102.102.102.1/32, ubest/mbest: 1/0
*via 10.0.120.67%overlay-1, [200/5], 00:33:56, bgp-65005, internal, tag 65005
172.16.0.0/24, ubest/mbest: 1/0, attached, direct
*via 172.16.0.1, eth1/14, [0/0], 10:31:19, direct
172.16.0.1/32, ubest/mbest: 1/0, attached
*via 172.16.0.1, eth1/14, [0/0], 10:31:19, local, local
201.201.201.1/32, ubest/mbest: 1/0
*via 172.16.0.2, eth1/14, [110/5], 00:36:33, ospf-default, intra
202.202.202.1/32, ubest/mbest: 1/0
*via 172.16.0.2, eth1/14, [110/5], 00:36:15, ospf-default, intra
------------------------------------------------------------------------------------------------------------------
Now in order to communicate between two external EPGs we need a contract
Let’s add a contract in both Ex EGP to allow communication to each other.
n9k# ping 201.201.201.1 vrf ISP1 source 101.101.101.1
PING 201.201.201.1 (201.201.201.1) from 101.101.101.1: 56 data bytes
64 bytes from 201.201.201.1: icmp_seq=0 ttl=252 time=1.6 ms
64 bytes from 201.201.201.1: icmp_seq=1 ttl=252 time=1.22 ms
64 bytes from 201.201.201.1: icmp_seq=2 ttl=252 time=1.202 ms
64 bytes from 201.201.201.1: icmp_seq=3 ttl=252 time=1.196 ms
64 bytes from 201.201.201.1: icmp_seq=4 ttl=252 time=1.263 ms
--- 201.201.201.1 ping statistics ---
5 packets transmitted, 5 packets received, 0.00% packet loss
round-trip min/avg/max = 1.196/1.296/1.6 ms
n9k# ping 101.101.101.1 vrf ISP2 source 201.201.201.1
PING 101.101.101.1 (101.101.101.1) from 201.201.201.1: 56 data bytes
64 bytes from 101.101.101.1: icmp_seq=0 ttl=252 time=2.392 ms
64 bytes from 101.101.101.1: icmp_seq=1 ttl=252 time=1.968 ms
64 bytes from 101.101.101.1: icmp_seq=2 ttl=252 time=2.146 ms
64 bytes from 101.101.101.1: icmp_seq=3 ttl=252 time=7.412 ms
64 bytes from 101.101.101.1: icmp_seq=4 ttl=252 time=1.617 ms
--- 101.101.101.1 ping statistics ---
5 packets transmitted, 5 packets received, 0.00% packet loss
round-trip min/avg/max = 1.617/3.107/7.412 ms
ความคิดเห็น