Which configuration is needed to extend the EPG out of the Cisco ACI fabric?

"External bridged networks" (L2Out) are used to connect an ACI Bridge Domain to an external Layer 2 network, not directly to extend an EPG to a specific port for an endpoint within the fabric.

To extend an EPG to physical machines or non-ACI devices directly connected to a leaf port, a static binding must be configured by statically assigning a specific access port (or port channel/VPC) on a leaf switch to the EPG. This action associates the port with the EPG's VLAN or VXLAN encapsulation, allowing external endpoints to join that EPG.

Applying a policy (contract) between an internal and external EPG is necessary for communication between them, but it does not *extend* the internal EPG itself out of the fabric to a physical port.

Extending the tenant subnet of the bridge domain out of the fabric (e.g., via L3Out) allows routing traffic to external networks but does not directly make a specific physical port part of an EPG for local endpoint connectivity.