Connect. Secure. Manage.
Cisco ACI External Routing
Design ACI L3Out connectivity with supported routing, external networks and security boundaries between the fabric and wider enterprise.
Devices supported
across the UK
Client locations
supported
Traffic handled
at peak time
Average
response time
Average response is not a resolution time or a contractual guarantee. Support scope and response commitments are agreed for each engagement.
Cisco ACI external routing connects a fabric to the rest of the enterprise, cloud services and other private networks. The L3Out design must align route exchange with policy and the actual application path. MCI Network Services plans, implements and troubleshoots ACI external connectivity, checking both the fabric view and the neighbouring routers or firewalls. We aim for predictable reachability without accidental transit or unclear security boundaries.
Workload-led design
Start with application, compute and storage dependencies rather than the switch model.
Clear failure domains
Understand which links, devices and sites can fail together.
Operational clarity
Make fabrics, external routing and management responsibilities supportable.
Establish the external service requirements
We identify the networks that need to communicate, the applications involved and the organisation responsible for each external connection. Internet access, a private WAN and a partner interconnect may require different routing and security policies. The design records expected prefixes, default-route handling and any restrictions on traffic passing between external domains through the fabric.
The assessment includes the existing gateway and firewall topology. Applications may depend on fixed addresses, a particular inspection path or a return route that is not obvious from a routing table alone. We map these dependencies before choosing L3Out placement and protocol settings. This avoids a technically valid routing design that fails to preserve the service the business actually uses.
Standards & partnerships
Confidence in the team behind your network.
Cisco Partner
Cisco Meraki
Cyber Essentials
Cyber Essentials PlusMCI Network Services is operated by Proxar Ltd. Certifications apply to the certified legal entity and the scope of its certificates. View accreditation information
Design the L3Out components coherently
The physical and logical elements of an L3Out are reviewed as a whole: selected border nodes, interfaces, routing context and neighbouring systems. We verify supported topology and protocol combinations for the exact ACI and external-platform releases. A configuration example from another environment is not treated as universal support for every peer arrangement.
Addressing, MTU and interface dependencies are documented with the teams responsible for the handoff. Where redundant connections are used, we examine their physical separation and the capacity of the surviving path. The design should explain what happens when a link or border node is lost, rather than assuming that two configured interfaces automatically provide useful resilience.
A useful starting point
Not sure where to start?
Bring the requirement. We will help you define the engineering work.
Separate route control from security classification
Route import and export policy determines which networks become reachable. External endpoint-group classification and contracts determine how the relevant traffic is permitted within the policy model. We review both layers and explain their distinct roles. Confusing them can lead to a route being present while traffic is blocked, or to broader access than the application requirement intended.
Default and summary routes require explicit treatment. We identify what they represent, when they should be advertised and how failure of an underlying service affects them. Where routes are shared across contexts or external connections, the scope is documented and tested. The customer should not become an unintended transit path because a broad policy was introduced to make one application work.
Different environments. The same care.
Built around the work
your network supports.
Finance, banking and the wider private sector. We start with the systems and people that depend on your connections.
Finance & banking
Market-data paths, routing and provider coordination on clients’ behalf.
Financial-market services ↗Offices & multi-site teams
Reliable access between people, workplaces and business applications.
Office network design ↗Data centres & cloud
Network boundaries, workload connections and operational ownership.
Data centre networks ↗Coordinate stateful services and return traffic
Firewalls, load balancers and translation services can constrain path selection. We trace traffic in both directions and establish where session state is maintained. A routing change that sends the return path through a different device may interrupt service even though all routes remain valid. The design includes these dependencies in its normal and failure-state analysis.
Security ownership is clear at the boundary. ACI contracts and external firewall rules may both be needed, but they should implement an agreed access requirement rather than contradictory assumptions. We coordinate changes with the relevant team and document which system provides each control. Private transport is not described as encryption unless the deployed service actually includes it.
Implement with joint acceptance checks
The change plan identifies pre-checks, configuration steps, remote-team participation and rollback conditions. We compare expected advertisements with what each side receives and verify the selected next hops. Bringing up a neighbour is a milestone, not the final acceptance condition. The implementation must also demonstrate representative application traffic and the intended security restrictions.
Failure tests are chosen according to the design and the safety of the environment. We observe routing convergence, application recovery and restoration of preferred paths where authorised. Any test not performed is recorded as a limitation. This provides the customer with evidence of the delivered behaviour without converting theoretical redundancy into an unsupported guarantee of uninterrupted service.
Leave usable border documentation
The handover includes L3Out topology, neighbour details, route-policy intent, external classifications and escalation contacts. Changes to prefixes, default routes or shared services should follow a defined review process. Monitoring needs to reveal lost redundancy and unexpected advertisements, not just complete neighbour failure. The record gives operations staff a starting point for investigating a future path problem.
MCI can integrate a new ACI fabric, review an existing external-routing design or investigate a connectivity fault involving several teams. The service complements ACI policy design and private network interconnects. Share the external topology, intended flows and current route ownership to begin. We will scope the work around the actual boundary and its supported implementation options.
Talk to a specialist
What does your network need next?
Tell us what you are planning, changing or trying to improve. We will help define a practical next step and the engineering scope.
+44 203 196 6566Choose option 1
sales@proxar.co.ukUK-wide service.
Most of our engineers are based in Kent, with a focus on London, Sussex, Essex and Berkshire.
Existing customers should use their agreed support and escalation channels. This form is for service enquiries, not a monitored emergency ticket.
Tell us what you need.
A short outline is enough. Please do not include passwords or sensitive network details.
Thank you. Your enquiry has been submitted.
Please check your name, email and message, then try again.
Your form session expired. Please try again.
Please wait a minute before sending another enquiry.
We could not submit your enquiry. Please call or email us instead.