There are several different ways to extend layer 2 domain beyond the ACI fabric:
* Extend the EPG out of the ACI fabric - A user can extend an EPG out of the ACI fabric by statically assigning a port (along with VLAN ID) to an EPG. The leaf will learn the endpoint information and assign the traffic (by matching the port and VLAN ID) to the proper EPG, and then enforce the policy. The endpoint learning, data forwarding, and policy enforcement remain the same whether the endpoint is directly attached to the leaf port or if it is behind a layer 2 network (provided the proper VLAN is enabled in the layer2 network).
* Extend the bridge domain out of the ACI fabric - Another option to extend the layer 2 domain is to create a layer 2 outside connection (or external bridged network, as called in the APIC GUI) for a given bridge domain. It effectively extends the bridge domain to the outside network.
https://www.cisco.com/c/en/us/solutions/collateral/data-center-virtualization/application-centric- infrastructure/white-paper-c07-732033.html#_Toc395143568