Cisco APIC Layer 3 Networking Configuration Guide, Release 6.2(x)

PDF

Cisco APIC Layer 3 Networking Configuration Guide, Release 6.2(x)

ACI border gateways

Updated: April 17, 2026

Want to summarize with AI?

Log in

ACI border gateways enable the seamless extension of virtual routing and forwarding instances and bridge domains between Cisco ACI and VXLAN EVPN domains.

An ACI border gateway is a node that provides connectivity between nodes within a site and nodes outside the site. An ACI border gateway provides the following functions:

  • Communicates with nodes within the site and nodes outside the site.

  • Enables the seamless extension of virtual routing and forwarding (VRF) instances and bridge domains between Cisco ACI and VXLAN EVPN domains.

  • Provides the network control boundary required for traffic enforcement and failure containment.

  • Enables site-local nodes to view all other sites as reachable only through the border gateways.

Multi-fabric domain architecture

ACI border gateways and VXLAN EVPN border gateways enable a multi-fabric domain. You can conceptualize this architecture as multiple site-local EVPN control planes and IP forwarding domains that are interconnected through a common EVPN control and forwarding domain.

The Virtual Extensible LAN (VXLAN) Ethernet VPN (EVPN) border gateway solution is a multisite solution that connects two or more BGP-based EVPN sites or fabrics, also called overlay domains, over an IP-only network. The solution uses border gateways (BGWs) in anycast mode to connect a Cisco ACI domain to one or more VXLAN EVPN sites. This architecture provides additional options for fabric scaling, compartmentalization, and data center interconnect (DCI) deployments.

A site-local EVPN domain consists of EVPN nodes that have the same VXLAN site identifier. Each border gateway is part of both the site-local EVPN domain and the common EVPN domain. The common EVPN domain connects the border gateways at different sites.

Beginning with Cisco ACI Release 6.1(4), you can extend the ACI policy domain end to end into the VXLAN EVPN domain. This extension enables security enforcement between security groups that are defined within each domain or extended across the domains.

For a specific site, the border gateways enable site-local nodes to view all other sites as reachable only through the border gateways. The following restrictions apply:

  • Site-local bridge domains can connect to bridge domains at other sites only through border gateways.

  • Site-local routing domains can connect to routing domains at other sites only through border gateways.