Cisco APIC Layer 3 Networking Configuration Guide, Release 6.2(x)

PDF

Cisco APIC Layer 3 Networking Configuration Guide, Release 6.2(x)

OSPF external routed networks

Updated: April 17, 2026

Want to summarize with AI?

Log in

Configuration procedures for establishing routing connectivity between Open Shortest Path First (OSPF) domains and external networks.

Use these procedures to configure OSPF external routed networks.

OSPF Layer 3 Outside connections

Open Shortest Path First (OSPF) Layer 3 Outside (L3Out) connections provide connectivity through normal, not-so-stubby area (NSSA), or backbone areas.

  • Supports OSPFv2 for IPv4 and OSPFv3 for IPv6.

  • Supports dual-stack configurations through separate interface profiles.

  • Creates the appropriate OSPF process automatically based on the addressing in the interface profile.

OSPF Layer 3 Outside behavior

OSPF L3Out connections can use normal or NSSA areas. The OSPF backbone area, area 0, is also supported. Cisco Application Centric Infrastructure (ACI) supports OSPFv2 for IPv4 and OSPFv3 for IPv6. When you create an OSPF L3Out, you do not need to specify the OSPF version. The system automatically creates the appropriate OSPF process based on whether the interface profile uses IPv4 or IPv6 addressing. You can configure IPv4 and IPv6 on the same interface for dual-stack operation, but you must create a separate interface profile for each IP version.

L3Out connections support routed interfaces, routed subinterfaces, and switched virtual interfaces (SVIs). Use an SVI when a physical connection must carry both Layer 2 and Layer 3 traffic. SVIs are supported on physical ports, port channels, and virtual port channels (vPCs).

Figure 1. OSPF Layer 3 Outside connections


When you use an SVI for an L3Out connection, the system creates an external bridge domain on the border leaf switches. The external bridge domain provides connectivity between the two vPC peer switches across the Cisco ACI fabric. This connectivity enables both vPC peer switches to establish OSPF adjacencies with each other and with the external OSPF device.

When OSPF runs over a broadcast network, neighbor failure detection is based on the dead interval, which is 40 seconds by default. Reestablishing neighbor adjacencies after a failure can take additional time because of the designated router (DR) election.

Note

  • A link or port-channel failure on one vPC peer does not cause the OSPF adjacency to go down. The adjacency can remain up through the external bridge domain that is accessible through the other vPC peer.

  • When you apply an OSPF timer policy or an OSPF or EIGRP address-family policy to an L3Out, the following behaviors apply:

    • If the L3Out and the policy are defined in the same tenant, the behavior does not change.

    • If the L3Out is configured in a user tenant other than the common tenant, the L3Out VRF instance is resolved to the common tenant, and the policy is defined in the common tenant, only the default values are applied. Changes to the policy do not take effect.

  • If a border leaf switch forms OSPF adjacencies with two external switches and one external switch loses a route while the other does not, the Cisco ACI border leaf switch reconverges the route for both neighbors.

  • OSPF supports aggressive timers. However, aggressive timers can quickly bring down an adjacency and increase CPU utilization. Use the default OSPF timers and Bidirectional Forwarding Detection (BFD) for subsecond failure detection.

Create an OSPF L3Out for the management tenant by using the GUI

  • Verify that the router ID and the logical interface profile IP address are different and do not overlap.

  • This procedure creates an OSPF L3Out for the management tenant. To create an OSPF L3Out for a user tenant, choose the tenant and create a virtual routing and forwarding (VRF) instance for it.

  • For more information, see Cisco APIC and Transit Routing .

Procedure

  1. On the menu bar, choose Tenants > mgmt .

  2. In the Navigation pane, expand Networking > L3Outs .

  3. Right-click L3Outs and choose Create L3Out .

    The Create L3Out wizard appears.

  4. In the Identity window of the Create L3Out wizard, configure the L3Out identity:

    1. In the Name field, enter a name, such as RtdOut .
    2. From the VRF drop-down list, choose inb .
      Note

      This selection associates the L3Out with the in-band VRF.

    3. From the L3 Domain drop-down list, choose the appropriate domain.
    4. Check the OSPF check box.
    5. In the OSPF Area ID field, enter the area ID.
    6. In the OSPF Area Control field, check the appropriate check box.
    7. In the OSPF Area Type field, choose the appropriate area type.
    8. In the OSPF Area Cost field, choose the appropriate value.
    9. Click Next .

      The Nodes and Interfaces window appears.

  5. In the Nodes and Interfaces window, configure the nodes and interfaces:

    1. Clear the Use Defaults check box.

      You can now edit the Node Profile Name field.

    2. In the Node Profile Name field, enter a name for the node profile, such as borderLeaf .
    3. From the Node ID drop-down list, choose the first node, such as leaf1 .
    4. In the Router ID field, enter a unique router ID.
    5. In the Loopback Address field, enter a different IP address, or leave the field empty if you do not want to use the router ID as the loopback address.
      Note

      The Loopback Address field is automatically populated with the value that you enter in the Router ID field. This behavior is equivalent to the Use Router ID for Loopback Address option in earlier releases.

    6. As needed, enter the appropriate values in the Interface , IP Address , Interface Profile Name , and MTU fields for the node.
    7. In the Nodes field, click + to add another node.
      Note

      This action adds a second set of node configuration fields.

    8. From the Node ID drop-down list, choose the second node, such as leaf2 .
    9. In the Router ID field, enter a unique router ID.
    10. In the Loopback Address field, enter a different IP address, or leave the field empty if you do not want to use the router ID as the loopback address.
      Note

      The Loopback Address field is automatically populated with the value that you enter in the Router ID field. This behavior is equivalent to the Use Router ID for Loopback Address option in earlier releases.

    11. As needed, enter the appropriate values in the Interface , IP Address , Interface Profile Name , and MTU fields for the node.
    12. Click Next .

      The Protocols window appears.

  6. In the Protocols window, in the Policy area, choose default and click Next .

    The External EPG window appears.

  7. In the External EPG window, configure the external endpoint group (EPG):

    1. In the Name field, enter a name for the external network, such as extMgmt .
    2. Clear the Default EPG for all external networks check box.

      The Subnets area appears.

    3. Click + to open the Create Subnet dialog box.
    4. In the Create Subnet dialog box, enter the subnet IP address and mask in the IP address field.
    5. In the Scope field, check the appropriate check boxes, and click OK .
    6. In the External EPG dialog box, click Finish .
      Note

      The L3Out icon, RtdOut , appears in the L3Outs area of the Work pane.