Layer 3 Virtual Network

Location in GUI: Provision » SD-Access » Virtual Networks » Layer 3 Virtual Networks

Diagram

Classes

fabric (catalyst_center)

Name	Type	Constraint	Mandatory	Default Value
l3_virtual_networks	List	[l3_virtual_networks]	No

l3_virtual_networks (catalyst_center.fabric)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
anchor_site	String		No

Layer 3 Virtual Networks provide isolated routing domains within the SD-Access fabric for network segmentation. They are created globally and assigned to Fabric Sites, where they host Anycast Gateways for endpoint connectivity. L3 VNs are handed off to external networks via Layer 3 Handoffs on Border Devices. This resource is SDA fabric only.

Examples

Example-1: Basic Layer 3 Virtual Network Creation and Assignment

This example demonstrates how to create Layer 3 virtual networks at the global level and assign them to specific fabric sites. Layer 3 virtual networks enable network segmentation and micro-segmentation within SD-Access fabric, providing isolated routing domains for different user groups, applications, or security zones.

The Layer 3 virtual network configuration includes:

• Global L3 VN creation (SDA_VN_USERS, SDA_VN_PRINTERS, SDA_VN_CORPORATE) for reusable network segments
• Virtual network names that reflect organizational structure and traffic types
• Site-specific assignment enabling selective deployment across fabric sites
• Flexible assignment allowing different combinations per site based on requirements

catalyst_center:
  fabric:
    l3_virtual_networks:
      - name: SDA_VN_USERS
      - name: SDA_VN_PRINTERS
      - name: SDA_VN_CORPORATE

Next, you need to assign the L3 VN to a Fabric Site:

catalyst_center:
  fabric:
    fabric_sites:
      - name: Global/Canada
        authentication_template:
          name: No Authentication
        l3_virtual_networks:
          - SDA_VN_USERS
          - SDA_VN_PRINTERS
          - SDA_VN_CORPORATE

      - name: Global/United States
        authentication_template:
          name: No Authentication
        l3_virtual_networks:
          - SDA_VN_CORPORATE
          - SDA_VN_PRINTERS

Example-2: Department-Based Layer 3 Virtual Networks

This example shows how to create Layer 3 virtual networks organized by department or functional area for enterprise environments requiring departmental isolation and security policies.

catalyst_center:
  fabric:
    l3_virtual_networks:
      - name: FINANCE_VN
      - name: HR_VN
      - name: ENGINEERING_VN
      - name: MARKETING_VN
      - name: GUEST_VN

Site assignment with department-specific virtual networks:

catalyst_center:
  fabric:
    fabric_sites:
      - name: Global/North_America/Corporate HQ
        authentication_template:
          name: Closed Authentication
        l3_virtual_networks:
          - FINANCE_VN
          - HR_VN
          - ENGINEERING_VN
          - MARKETING_VN
          - GUEST_VN

      - name: Global/Europe/Branch Office
        authentication_template:
          name: Closed Authentication
        l3_virtual_networks:
          - ENGINEERING_VN
          - GUEST_VN

Example-3: Service-Based Layer 3 Virtual Networks

This example demonstrates how to create Layer 3 virtual networks based on network services and application types for service-oriented network architectures.

catalyst_center:
  fabric:
    l3_virtual_networks:
      - name: WEB_SERVICES_VN
      - name: DATABASE_SERVICES_VN
      - name: APPLICATION_SERVICES_VN
      - name: MANAGEMENT_SERVICES_VN
      - name: BACKUP_SERVICES_VN

Service-oriented site assignment:

catalyst_center:
  fabric:
    fabric_sites:
      - name: Global/Data Center/Primary
        authentication_template:
          name: Closed Authentication
        l3_virtual_networks:
          - WEB_SERVICES_VN
          - DATABASE_SERVICES_VN
          - APPLICATION_SERVICES_VN
          - MANAGEMENT_SERVICES_VN
          - BACKUP_SERVICES_VN

      - name: Global/Data Center/DR Site
        authentication_template:
          name: Closed Authentication
        l3_virtual_networks:
          - DATABASE_SERVICES_VN
          - BACKUP_SERVICES_VN

Example-4: Security Zone Layer 3 Virtual Networks

This example shows how to create Layer 3 virtual networks based on security zones and trust levels for environments requiring strict security segmentation and compliance.

catalyst_center:
  fabric:
    l3_virtual_networks:
      - name: SECURE_ZONE_VN
      - name: DMZ_ZONE_VN
      - name: INTERNAL_ZONE_VN
      - name: PUBLIC_ZONE_VN
      - name: QUARANTINE_ZONE_VN

Security zone site assignment:

catalyst_center:
  fabric:
    fabric_sites:
      - name: Global/Security/High_Security_Facility
        authentication_template:
          name: Closed Authentication
        l3_virtual_networks:
          - SECURE_ZONE_VN
          - INTERNAL_ZONE_VN
          - QUARANTINE_ZONE_VN

      - name: Global/Security/Public_Access_Area
        authentication_template:
          name: Closed Authentication
        l3_virtual_networks:
          - DMZ_ZONE_VN
          - PUBLIC_ZONE_VN
          - QUARANTINE_ZONE_VN

Example-5: Multi-Tenant Layer 3 Virtual Networks

This example demonstrates how to create Layer 3 virtual networks for multi-tenant environments with customer isolation and service provider deployments.

catalyst_center:
  fabric:
    l3_virtual_networks:
      - name: TENANT_A_PROD_VN
      - name: TENANT_A_DEV_VN
      - name: TENANT_B_PROD_VN
      - name: TENANT_B_DEV_VN
      - name: SHARED_SERVICES_VN

Multi-tenant site assignment:

catalyst_center:
  fabric:
    fabric_sites:
      - name: Global/Service Provider/CustomerA_Site
        authentication_template:
          name: Closed Authentication
        l3_virtual_networks:
          - TENANT_A_PROD_VN
          - TENANT_A_DEV_VN
          - SHARED_SERVICES_VN

      - name: Global/Service Provider/CustomerB_Site
        authentication_template:
          name: Closed Authentication
        l3_virtual_networks:
          - TENANT_B_PROD_VN
          - TENANT_B_DEV_VN
          - SHARED_SERVICES_VN

Example-6: Environment-Based Layer 3 Virtual Networks

This example shows how to create Layer 3 virtual networks based on environment types for development life-cycle management and application deployment stages.

catalyst_center:
  fabric:
    l3_virtual_networks:
      - name: PRODUCTION_VN
      - name: STAGING_VN
      - name: DEVELOPMENT_VN
      - name: TESTING_VN
      - name: SANDBOX_VN

Environment-based site assignment:

catalyst_center:
  fabric:
    fabric_sites:
      - name: Global/Development/Primary_Lab
        authentication_template:
          name: Closed Authentication
        l3_virtual_networks:
          - DEVELOPMENT_VN
          - TESTING_VN
          - SANDBOX_VN

      - name: Global/Production/Data_Center
        authentication_template:
          name: Closed Authentication
        l3_virtual_networks:
          - PRODUCTION_VN
          - STAGING_VN

Example-7: VN Anchoring to a Fabric Site

VN Anchoring lets you designate one fabric site as the routing anchor for an L3 Virtual Network. All traffic for that VN is forwarded to the Anchor Site — only the Anchor Site owns the L3 routing, and every Anchoring Site where the VN is deployed forwards through it. This is typically used for centralized guest internet break-out, shared services, or DMZ deployments where you want a single egress and policy enforcement point.

Key concepts:

• Anchor Virtual Network (VN): A virtual network that exists across multiple fabric sites in a network. The associated IP subnet and segment are common across these multiple sites.
• Anchor Site: The fabric site that hosts the common border and control plane for an Anchor VN. The Anchor Site handles the ingress and egress traffic for the Anchor VN.
• Anchoring Sites: Fabric sites other than the Anchor Site where the Anchor VN is deployed.

The anchor_site attribute lives on the global L3 VN definition under fabric.l3_virtual_networks and takes the full site hierarchy path of the Anchor Site. The Anchor Site must be one of the fabric sites the VN is assigned to.

Note: When site-level anchoring is enabled, the Anchor Site must have at least one CP and one External Border; otherwise the workflow throws an error.

Note: For a VN to be anchored across sites, all participating fabric sites (the Anchor Site and every Anchoring Site) must use the same fabric control plane type — for example, LISP Pub/Sub. Mixing control plane types across the participating sites is not supported for an Anchor VN.

The L3 Virtual Network configuration with an Anchor VN:

catalyst_center:
  fabric:
    l3_virtual_networks:
      - name: GUEST_VN
        anchor_site: Global/United States/NYC/Headquarters
      - name: SDA_VN_USERS
      - name: SDA_VN_CORPORATE

The Anchor Site — and the Anchoring Sites where the Anchor VN is deployed — are defined in the standard fabric_sites block. Only the Anchor Site owns the L3 routing for GUEST_VN; Anchoring Sites forward through it.

The Anchor VN’s Anycast Gateway is defined on the Anchor Site and reused as-is on every Anchoring Site where the VN is deployed. Each participating fabric site declares the same anycast gateway for the VN under its anycast_gateways block, and the ip_pool_name must be identical to the one used on the Anchor Site (in this example GuestVN_IPPool, together with the same vlan_name Guest_VLAN). The Anchor Site owns the L3 routing and egress for the VN; Anchoring Sites host the same anchored gateway to provide local endpoint connectivity and forward the VN’s routed traffic to the Anchor Site.

Note: The ip_pool_name of the Anchor VN’s anycast gateway on every Anchoring Site must match the ip_pool_name configured on the Anchor Site. Using a different IP pool on an Anchoring Site is not valid for an Anchor VN.

catalyst_center:
  fabric:
    l3_virtual_networks:
      - name: GUEST_VN
        anchor_site: Global/United States/NYC/Headquarters
      - name: SDA_VN_USERS
      - name: SDA_VN_CORPORATE
    fabric_sites:
      # Anchor Site — owns the L3 routing and hosts the anycast gateway for GUEST_VN
      - name: Global/United States/NYC/Headquarters
        authentication_template:
          name: No Authentication
        l3_virtual_networks:
          - GUEST_VN
          - SDA_VN_USERS
          - SDA_VN_CORPORATE
        anycast_gateways:
          # Anycast gateway for the Anchor VN, deployed at the Anchor Site
          - ip_pool_name: GuestVN_IPPool
            vlan_name: Guest_VLAN
            traffic_type: DATA
            l3_virtual_network: GUEST_VN

      # Anchoring Site — forwards GUEST_VN traffic to the Anchor Site above
      - name: Global/United States/Chicago/BranchOffice
        authentication_template:
          name: No Authentication
        l3_virtual_networks:
          - GUEST_VN
          - SDA_VN_USERS
        anycast_gateways:
          # Same anchored anycast gateway as the Anchor Site — identical ip_pool_name and vlan_name
          - ip_pool_name: GuestVN_IPPool
            vlan_name: Guest_VLAN
            traffic_type: DATA
            l3_virtual_network: GUEST_VN

      # Another Anchoring Site where the same Anchor VN is deployed
      - name: Global/Canada/Toronto/BranchOffice
        authentication_template:
          name: No Authentication
        l3_virtual_networks:
          - GUEST_VN
          - SDA_VN_CORPORATE
        anycast_gateways:
          # Same anchored anycast gateway as the Anchor Site — identical ip_pool_name and vlan_name
          - ip_pool_name: GuestVN_IPPool
            vlan_name: Guest_VLAN
            traffic_type: DATA
            l3_virtual_network: GUEST_VN

Note: An Anchor VN cannot be handed off on a Border Device in an Anchoring Site — neither as a Layer 3 Handoff nor as a Layer 2 Handoff. Do not include the Anchor VN (or its anycast gateway IP pool) in the l3_handoffs or l2_handoffs of any border device in an Anchoring Site.

Location in GUI: Provision » SD-Access » Virtual Networks » Layer 3 Virtual Networks

Diagram

Classes

fabric (catalyst_center)

Name	Type	Constraint	Mandatory	Default Value
l3_virtual_networks	List	[l3_virtual_networks]	No

l3_virtual_networks (catalyst_center.fabric)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
anchor_site	String		No

Layer 3 Virtual Networks provide isolated routing domains within the SD-Access fabric for network segmentation. They are created globally and assigned to Fabric Sites, where they host Anycast Gateways for endpoint connectivity. L3 VNs are handed off to external networks via Layer 3 Handoffs on Border Devices. This resource is SDA fabric only.

Examples

Example-1: Basic Layer 3 Virtual Network Creation and Assignment

This example demonstrates how to create Layer 3 virtual networks at the global level and assign them to specific fabric sites. Layer 3 virtual networks enable network segmentation and micro-segmentation within SD-Access fabric, providing isolated routing domains for different user groups, applications, or security zones.

The Layer 3 virtual network configuration includes:

• Global L3 VN creation (SDA_VN_USERS, SDA_VN_PRINTERS, SDA_VN_CORPORATE) for reusable network segments
• Virtual network names that reflect organizational structure and traffic types
• Site-specific assignment enabling selective deployment across fabric sites
• Flexible assignment allowing different combinations per site based on requirements

catalyst_center:
  fabric:
    l3_virtual_networks:
      - name: SDA_VN_USERS
      - name: SDA_VN_PRINTERS
      - name: SDA_VN_CORPORATE

Next, you need to assign the L3 VN to a Fabric Site:

catalyst_center:
  fabric:
    fabric_sites:
      - name: Global/Canada
        authentication_template:
          name: No Authentication
        l3_virtual_networks:
          - SDA_VN_USERS
          - SDA_VN_PRINTERS
          - SDA_VN_CORPORATE

      - name: Global/United States
        authentication_template:
          name: No Authentication
        l3_virtual_networks:
          - SDA_VN_CORPORATE
          - SDA_VN_PRINTERS

Example-2: Department-Based Layer 3 Virtual Networks

This example shows how to create Layer 3 virtual networks organized by department or functional area for enterprise environments requiring departmental isolation and security policies.

catalyst_center:
  fabric:
    l3_virtual_networks:
      - name: FINANCE_VN
      - name: HR_VN
      - name: ENGINEERING_VN
      - name: MARKETING_VN
      - name: GUEST_VN

Site assignment with department-specific virtual networks:

catalyst_center:
  fabric:
    fabric_sites:
      - name: Global/North_America/Corporate HQ
        authentication_template:
          name: Closed Authentication
        l3_virtual_networks:
          - FINANCE_VN
          - HR_VN
          - ENGINEERING_VN
          - MARKETING_VN
          - GUEST_VN

      - name: Global/Europe/Branch Office
        authentication_template:
          name: Closed Authentication
        l3_virtual_networks:
          - ENGINEERING_VN
          - GUEST_VN

Example-3: Service-Based Layer 3 Virtual Networks

This example demonstrates how to create Layer 3 virtual networks based on network services and application types for service-oriented network architectures.

catalyst_center:
  fabric:
    l3_virtual_networks:
      - name: WEB_SERVICES_VN
      - name: DATABASE_SERVICES_VN
      - name: APPLICATION_SERVICES_VN
      - name: MANAGEMENT_SERVICES_VN
      - name: BACKUP_SERVICES_VN

Service-oriented site assignment:

catalyst_center:
  fabric:
    fabric_sites:
      - name: Global/Data Center/Primary
        authentication_template:
          name: Closed Authentication
        l3_virtual_networks:
          - WEB_SERVICES_VN
          - DATABASE_SERVICES_VN
          - APPLICATION_SERVICES_VN
          - MANAGEMENT_SERVICES_VN
          - BACKUP_SERVICES_VN

      - name: Global/Data Center/DR Site
        authentication_template:
          name: Closed Authentication
        l3_virtual_networks:
          - DATABASE_SERVICES_VN
          - BACKUP_SERVICES_VN

Example-4: Security Zone Layer 3 Virtual Networks

This example shows how to create Layer 3 virtual networks based on security zones and trust levels for environments requiring strict security segmentation and compliance.

catalyst_center:
  fabric:
    l3_virtual_networks:
      - name: SECURE_ZONE_VN
      - name: DMZ_ZONE_VN
      - name: INTERNAL_ZONE_VN
      - name: PUBLIC_ZONE_VN
      - name: QUARANTINE_ZONE_VN

Security zone site assignment:

catalyst_center:
  fabric:
    fabric_sites:
      - name: Global/Security/High_Security_Facility
        authentication_template:
          name: Closed Authentication
        l3_virtual_networks:
          - SECURE_ZONE_VN
          - INTERNAL_ZONE_VN
          - QUARANTINE_ZONE_VN

      - name: Global/Security/Public_Access_Area
        authentication_template:
          name: Closed Authentication
        l3_virtual_networks:
          - DMZ_ZONE_VN
          - PUBLIC_ZONE_VN
          - QUARANTINE_ZONE_VN

Example-5: Multi-Tenant Layer 3 Virtual Networks

This example demonstrates how to create Layer 3 virtual networks for multi-tenant environments with customer isolation and service provider deployments.

catalyst_center:
  fabric:
    l3_virtual_networks:
      - name: TENANT_A_PROD_VN
      - name: TENANT_A_DEV_VN
      - name: TENANT_B_PROD_VN
      - name: TENANT_B_DEV_VN
      - name: SHARED_SERVICES_VN

Multi-tenant site assignment:

catalyst_center:
  fabric:
    fabric_sites:
      - name: Global/Service Provider/CustomerA_Site
        authentication_template:
          name: Closed Authentication
        l3_virtual_networks:
          - TENANT_A_PROD_VN
          - TENANT_A_DEV_VN
          - SHARED_SERVICES_VN

      - name: Global/Service Provider/CustomerB_Site
        authentication_template:
          name: Closed Authentication
        l3_virtual_networks:
          - TENANT_B_PROD_VN
          - TENANT_B_DEV_VN
          - SHARED_SERVICES_VN

Example-6: Environment-Based Layer 3 Virtual Networks

This example shows how to create Layer 3 virtual networks based on environment types for development life-cycle management and application deployment stages.

catalyst_center:
  fabric:
    l3_virtual_networks:
      - name: PRODUCTION_VN
      - name: STAGING_VN
      - name: DEVELOPMENT_VN
      - name: TESTING_VN
      - name: SANDBOX_VN

Environment-based site assignment:

catalyst_center:
  fabric:
    fabric_sites:
      - name: Global/Development/Primary_Lab
        authentication_template:
          name: Closed Authentication
        l3_virtual_networks:
          - DEVELOPMENT_VN
          - TESTING_VN
          - SANDBOX_VN

      - name: Global/Production/Data_Center
        authentication_template:
          name: Closed Authentication
        l3_virtual_networks:
          - PRODUCTION_VN
          - STAGING_VN

Example-7: VN Anchoring to a Fabric Site or Fabric Zone

VN Anchoring (introduced in module 0.4.3) lets you designate one fabric site or fabric zone as the routing anchor for an L3 Virtual Network. All traffic for that VN is forwarded to the anchor — only the anchor owns the L3 routing, and every other fabric site that consumes the VN forwards through it. This is typically used for centralized guest internet break-out, shared services, or DMZ deployments where you want a single egress and policy enforcement point.

The anchor_site attribute lives on the global L3 VN definition under fabric.l3_virtual_networks and takes the full site hierarchy path of the anchor. The path may resolve to either a fabric site or a fabric zone — both are supported.

Note: When site-level anchoring is enabled, the site must have at least one CP and one External Border; otherwise the workflow throws an error.

The L3 Virtual Network configuration with an anchored VN:

catalyst_center:
  fabric:
    l3_virtual_networks:
      - name: GUEST_VN
        anchor_site: Global/United States/NYC/Headquarters
      - name: SDA_VN_USERS
      - name: SDA_VN_CORPORATE

The site that becomes the anchor — and the consumer sites that reference the anchored VN — are defined in the standard fabric_sites block. Only the anchor site owns the L3 routing for GUEST_VN; consumer sites forward through it:

catalyst_center:
  fabric:
    fabric_sites:
      # Anchor site — owns the L3 routing for GUEST_VN
      - name: Global/United States/NYC/Headquarters
        authentication_template:
          name: No Authentication
        l3_virtual_networks:
          - GUEST_VN
          - SDA_VN_USERS
          - SDA_VN_CORPORATE

      # Consumer site — forwards GUEST_VN traffic to the anchor above
      - name: Global/United States/Chicago/BranchOffice
        authentication_template:
          name: No Authentication
        l3_virtual_networks:
          - GUEST_VN
          - SDA_VN_USERS

      # Another consumer site referencing the same anchored VN
      - name: Global/Canada/Toronto/BranchOffice
        authentication_template:
          name: No Authentication
        l3_virtual_networks:
          - GUEST_VN
          - SDA_VN_CORPORATE

Location in GUI: Provision » SD-Access » Virtual Networks » Layer 3 Virtual Networks

Diagram

Classes

fabric (catalyst_center)

Name	Type	Constraint	Mandatory	Default Value
l3_virtual_networks	List	[l3_virtual_networks]	No

l3_virtual_networks (catalyst_center.fabric)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes

Layer 3 Virtual Networks provide isolated routing domains within the SD-Access fabric for network segmentation. They are created globally and assigned to Fabric Sites, where they host Anycast Gateways for endpoint connectivity. L3 VNs are handed off to external networks via Layer 3 Handoffs on Border Devices. This resource is SDA fabric only.

Examples

Example-1: Basic Layer 3 Virtual Network Creation and Assignment

This example demonstrates how to create Layer 3 virtual networks at the global level and assign them to specific fabric sites. Layer 3 virtual networks enable network segmentation and micro-segmentation within SD-Access fabric, providing isolated routing domains for different user groups, applications, or security zones.

The Layer 3 virtual network configuration includes:

• Global L3 VN creation (SDA_VN_USERS, SDA_VN_PRINTERS, SDA_VN_CORPORATE) for reusable network segments
• Virtual network names that reflect organizational structure and traffic types
• Site-specific assignment enabling selective deployment across fabric sites
• Flexible assignment allowing different combinations per site based on requirements

catalyst_center:
  fabric:
    l3_virtual_networks:
      - name: SDA_VN_USERS
      - name: SDA_VN_PRINTERS
      - name: SDA_VN_CORPORATE

Next, you need to assign the L3 VN to a Fabric Site:

catalyst_center:
  fabric:
    fabric_sites:
      - name: Global/Canada
        authentication_template:
          name: No Authentication
        l3_virtual_networks:
          - SDA_VN_USERS
          - SDA_VN_PRINTERS
          - SDA_VN_CORPORATE

      - name: Global/United States
        authentication_template:
          name: No Authentication
        l3_virtual_networks:
          - SDA_VN_CORPORATE
          - SDA_VN_PRINTERS

Example-2: Department-Based Layer 3 Virtual Networks

This example shows how to create Layer 3 virtual networks organized by department or functional area for enterprise environments requiring departmental isolation and security policies.

catalyst_center:
  fabric:
    l3_virtual_networks:
      - name: FINANCE_VN
      - name: HR_VN
      - name: ENGINEERING_VN
      - name: MARKETING_VN
      - name: GUEST_VN

Site assignment with department-specific virtual networks:

catalyst_center:
  fabric:
    fabric_sites:
      - name: Global/North_America/Corporate HQ
        authentication_template:
          name: Closed Authentication
        l3_virtual_networks:
          - FINANCE_VN
          - HR_VN
          - ENGINEERING_VN
          - MARKETING_VN
          - GUEST_VN

      - name: Global/Europe/Branch Office
        authentication_template:
          name: Closed Authentication
        l3_virtual_networks:
          - ENGINEERING_VN
          - GUEST_VN

Example-3: Service-Based Layer 3 Virtual Networks

This example demonstrates how to create Layer 3 virtual networks based on network services and application types for service-oriented network architectures.

catalyst_center:
  fabric:
    l3_virtual_networks:
      - name: WEB_SERVICES_VN
      - name: DATABASE_SERVICES_VN
      - name: APPLICATION_SERVICES_VN
      - name: MANAGEMENT_SERVICES_VN
      - name: BACKUP_SERVICES_VN

Service-oriented site assignment:

catalyst_center:
  fabric:
    fabric_sites:
      - name: Global/Data Center/Primary
        authentication_template:
          name: Closed Authentication
        l3_virtual_networks:
          - WEB_SERVICES_VN
          - DATABASE_SERVICES_VN
          - APPLICATION_SERVICES_VN
          - MANAGEMENT_SERVICES_VN
          - BACKUP_SERVICES_VN

      - name: Global/Data Center/DR Site
        authentication_template:
          name: Closed Authentication
        l3_virtual_networks:
          - DATABASE_SERVICES_VN
          - BACKUP_SERVICES_VN

Example-4: Security Zone Layer 3 Virtual Networks

This example shows how to create Layer 3 virtual networks based on security zones and trust levels for environments requiring strict security segmentation and compliance.

catalyst_center:
  fabric:
    l3_virtual_networks:
      - name: SECURE_ZONE_VN
      - name: DMZ_ZONE_VN
      - name: INTERNAL_ZONE_VN
      - name: PUBLIC_ZONE_VN
      - name: QUARANTINE_ZONE_VN

Security zone site assignment:

catalyst_center:
  fabric:
    fabric_sites:
      - name: Global/Security/High_Security_Facility
        authentication_template:
          name: Closed Authentication
        l3_virtual_networks:
          - SECURE_ZONE_VN
          - INTERNAL_ZONE_VN
          - QUARANTINE_ZONE_VN

      - name: Global/Security/Public_Access_Area
        authentication_template:
          name: Closed Authentication
        l3_virtual_networks:
          - DMZ_ZONE_VN
          - PUBLIC_ZONE_VN
          - QUARANTINE_ZONE_VN

Example-5: Multi-Tenant Layer 3 Virtual Networks

This example demonstrates how to create Layer 3 virtual networks for multi-tenant environments with customer isolation and service provider deployments.

catalyst_center:
  fabric:
    l3_virtual_networks:
      - name: TENANT_A_PROD_VN
      - name: TENANT_A_DEV_VN
      - name: TENANT_B_PROD_VN
      - name: TENANT_B_DEV_VN
      - name: SHARED_SERVICES_VN

Multi-tenant site assignment:

catalyst_center:
  fabric:
    fabric_sites:
      - name: Global/Service Provider/CustomerA_Site
        authentication_template:
          name: Closed Authentication
        l3_virtual_networks:
          - TENANT_A_PROD_VN
          - TENANT_A_DEV_VN
          - SHARED_SERVICES_VN

      - name: Global/Service Provider/CustomerB_Site
        authentication_template:
          name: Closed Authentication
        l3_virtual_networks:
          - TENANT_B_PROD_VN
          - TENANT_B_DEV_VN
          - SHARED_SERVICES_VN

Example-6: Environment-Based Layer 3 Virtual Networks

This example shows how to create Layer 3 virtual networks based on environment types for development life-cycle management and application deployment stages.

catalyst_center:
  fabric:
    l3_virtual_networks:
      - name: PRODUCTION_VN
      - name: STAGING_VN
      - name: DEVELOPMENT_VN
      - name: TESTING_VN
      - name: SANDBOX_VN

Environment-based site assignment:

catalyst_center:
  fabric:
    fabric_sites:
      - name: Global/Development/Primary_Lab
        authentication_template:
          name: Closed Authentication
        l3_virtual_networks:
          - DEVELOPMENT_VN
          - TESTING_VN
          - SANDBOX_VN

      - name: Global/Production/Data_Center
        authentication_template:
          name: Closed Authentication
        l3_virtual_networks:
          - PRODUCTION_VN
          - STAGING_VN