Objectives
The simulator ticks each one as soon as the network meets it.
The session is down: R1 is AS 65100, and the L3Out says 65199. Fix the remote-as.
R1 learns nothing from the fabric: give BD10 scope public.
No contract can match the outside: add external-subnet 10.100.100.0/24 to the L3Out.
show l3out shows the session up, and PC1 reaches 10.100.100.1.
Before you start
An L3Out has three jobs, and each fails alone: the session, what goes out (scope public plus the L3Out named on the bridge domain), and what counts as outside for contracts (external-subnet). show ip route on R1 shows what got out.
Concept
ACI: a fabric run by policy
An ACI fabric is run from a controller. You describe tenants, bridge domains and groups of hosts, and the controller works out what each switch needs. An endpoint group (EPG) is hosts that share policy, wherever they are. A static path puts a leaf port and VLAN into an EPG, and the access-policy chain limits which VLANs may be used where. Underneath, leaves are VXLAN tunnel endpoints, which you never configure.
Concept
ACI: fabric BGP and route reflectors
A leaf that learns an outside route must tell the other leaves. Fabric BGP does that: every switch shares one ASN, spines act as route reflectors, and each leaf peers only with those spines. Without it, an L3Out’s routes stay on its border leaf, and hosts elsewhere have no way out.
Concept
ACI: L3Outs and a firewall in a service graph
An L3Out has three jobs: a routing session with the outside (BGP or OSPF), what the fabric sends out (a subnet with scope public, and the L3Out named on its bridge domain), and what counts as outside for contracts (external-subnet). A service graph on a contract subject puts a firewall in the path. Here the DMZ has two VRFs, joined only through the firewall, so traffic can’t skip it.
