Cisco APIC Layer 3 Networking Configuration Guide, Release 6.2(x)

Layer 3 outside connection guidelines

Updated: April 17, 2026

Want to summarize with AI?

Provides configuration and maintenance guidelines for Layer 3 outside connections to support stable routing, traffic forwarding, and policy enforcement across the fabric.

A Layer 3 outside connection guideline is an operational recommendation that

promotes consistent routing across border leaf switches
prevents configuration conflicts and traffic disruptions, and
supports efficient traffic forwarding and policy enforcement for external networks.

Layer 3 outside connection configuration guidelines

Use the following guidelines when you configure and maintain Layer 3 outside connections.

Table 1. Layer 3 outside connection guidelines
Topic	Guideline
IPv6 endpoints	When a border leaf switch has high utilization of Layer 3 next-hop entries, the switch might drop traffic for bridge domains that contain many IPv6 endpoints.
Unique IP addresses	Configure a unique SVI primary or preferred IP address on each leaf switch to prevent network disruptions.
vPC pair BGP forwarding	If a vPC peer forwards a transit BGP packet with the bridge domain VNID instead of the VRF VNID, move the endpoint to a nonpeer leaf switch.
GIR maintenance mode	When a border leaf switch operates in GIR mode, configure the same static route on the other border leaf switch or use IP SLA or BFD to track reachability.
L3Out aggregate statistics	L3Out aggregate statistics do not include egress-drop counters because no hardware table records egress drops from the EPG VLAN.
CLI updates	Before you perform updates through the CLI, enable the protocols globally and add the node profiles through the API or GUI.
Loopbacks	Configure a separate loopback for each Layer 3 network when you use two networks on the same node.
Ingress-based policy enforcement	After you upgrade to Release 1.2(1) or later, set the global property to ingress to enforce policy in both directions.
Bridge domains	A bridge domain can contain a public subnet that is advertised through an `l3extOut` provisioned in the common tenant.
OSPF and EIGRP advertisement	Bridge domain route advertisement applies at the VRF level. When you enable route advertisement on one L3Out, all routing protocols enabled on other L3Outs in the same VRF advertise the route.
BGP maximum-prefix limit	Configure a maximum-prefix limit to monitor and restrict route prefixes. The default limit is 20,000 prefixes.
MTU settings	Configure the appropriate interface MTU on both ends of the connection. The subinterface MTU is fixed at 9216, and the SVI MTU follows the fabric policy.
QoS for L3Outs	Set VRF policy-control enforcement to Egress and Enabled, and include a QoS class or target DSCP in the contract.
ICMP settings	The fabric disables ICMP redirects and unreachable messages by default to protect the switch CPU.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.