GBP V2

update the GBP plugin to implement the full NAT feature set of opflex agent

Change-Id: Ic06a039c889445ed0b9087fa1f292634192b0f8d
Signed-off-by: Neale Ranns <neale.ranns@cisco.com>

74 files changed, 7570 insertions, 1168 deletions

diff --git a/src/plugins/gbp.am b/src/plugins/gbp.am
index 644d08ccb49..7271a0de45c 100644
--- a/src/plugins/gbp.am
+++ b/src/plugins/gbp.am
@@ -13,8 +13,17 @@
 
 vppplugins_LTLIBRARIES += gbp_plugin.la
 
-gbp_plugin_la_SOURCES = 	\
-	gbp/gbp.c		\
+gbp_plugin_la_SOURCES = 		\
+	gbp/gbp_subnet.c		\
+	gbp/gbp_contract.c		\
+	gbp/gbp_endpoint.c		\
+	gbp/gbp_endpoint_group.c	\
+	gbp/gbp_classify.c  		\
+	gbp/gbp_recirc.c  		\
+	gbp/gbp_policy.c		\
+	gbp/gbp_policy_dpo.c		\
+	gbp/gbp_fwd.c			\
+	gbp/gbp_fwd_dpo.c		\
 	gbp/gbp_api.c
 
 API_FILES += gbp/gbp.api
diff --git a/src/plugins/gbp/gbp.api b/src/plugins/gbp/gbp.api
index 491ad363c75..b2b32e90d4b 100644
--- a/src/plugins/gbp/gbp.api
+++ b/src/plugins/gbp/gbp.api
@@ -1,6 +1,6 @@
 /* Hey Emacs use -*- mode: C -*- */
 /*
- * Copyright (c) 2016 Cisco and/or its affiliates.
+ * Copyright (c) 2018 Cisco and/or its affiliates.
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at:
@@ -27,6 +27,7 @@ typeonly define gbp_endpoint
   u32 epg_id;
   u8  is_ip6;
   u8  address[16];
+  u8  mac[6];
 };
 
 autoreply define gbp_endpoint_add_del
@@ -49,6 +50,93 @@ define gbp_endpoint_details
   vl_api_gbp_endpoint_t endpoint;
 };
 
+typeonly define gbp_endpoint_group
+{
+  u32 epg_id;
+  u32 bd_id;
+  u32 ip4_table_id;
+  u32 ip6_table_id;
+  u32 uplink_sw_if_index;
+};
+
+autoreply define gbp_endpoint_group_add_del
+{
+  u32 client_index;
+  u32 context;
+  u8  is_add;
+  vl_api_gbp_endpoint_group_t epg;
+};
+
+define gbp_endpoint_group_dump
+{
+  u32 client_index;
+  u32 context;
+};
+
+define gbp_endpoint_group_details
+{
+  u32 context;
+  vl_api_gbp_endpoint_group_t epg;
+};
+
+typeonly define gbp_recirc
+{
+  u32 epg_id;
+  u32 sw_if_index;
+  u8  is_ext;
+};
+
+autoreply define gbp_recirc_add_del
+{
+  u32 client_index;
+  u32 context;
+  u8  is_add;
+  vl_api_gbp_recirc_t recirc;
+};
+
+define gbp_recirc_dump
+{
+  u32 client_index;
+  u32 context;
+};
+
+define gbp_recirc_details
+{
+  u32 context;
+  vl_api_gbp_recirc_t recirc;
+};
+
+typeonly define gbp_subnet
+{
+  u32 table_id;
+  u32 sw_if_index;
+  u32 epg_id;
+  u8  is_ip6;
+  u8  is_internal;
+  u8  address_length;
+  u8  address[16];
+};
+
+autoreply define gbp_subnet_add_del
+{
+  u32 client_index;
+  u32 context;
+  u8  is_add;
+  vl_api_gbp_subnet_t subnet;
+};
+
+define gbp_subnet_dump
+{
+  u32 client_index;
+  u32 context;
+};
+
+define gbp_subnet_details
+{
+  u32 context;
+  vl_api_gbp_subnet_t subnet;
+};
+
 typeonly define gbp_contract
 {
   u32 src_epg;
diff --git a/src/plugins/gbp/gbp.c b/src/plugins/gbp/gbp.c
deleted file mode 100644
index 0b87d0b4d89..00000000000
--- a/src/plugins/gbp/gbp.c
+++ /dev/null
@@ -1,782 +0,0 @@
-/*
- * gbp.h : Group Based Policy
- *
- * Copyright (c) 2013 Cisco and/or its affiliates.
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at:
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#include <plugins/gbp/gbp.h>
-
-/**
- * IP4 destintion address to destination EPG mapping table
- */
-typedef struct gbp_ip4_to_epg_db_t_
-{
-  /**
-   * use a simple hash table
-   */
-  uword *g4ie_hash;
-} gbp_ip4_to_epg_db_t;
-
-static gbp_ip4_to_epg_db_t gbp_ip4_to_epg_db;
-
-/**
- * IP6 destintion address to destination EPG mapping table
- */
-typedef struct gbp_ip6_to_epg_db_t_
-{
-  /**
-   * use a memroy hash table
-   */
-  uword *g6ie_hash;
-} gbp_ip6_to_epg_db_t;
-
-static gbp_ip6_to_epg_db_t gbp_ip6_to_epg_db;
-
-/**
- * Result of a interface to EPG mapping.
- * multiple Endpoints can occur on the same interface, so this
- * mapping needs to be reference counted.
- */
-typedef struct gbp_itf_t_
-{
-  epg_id_t gi_epg;
-  u32 gi_ref_count;
-} gbp_itf_t;
-
-const static gbp_itf_t ITF_INVALID = {
-  .gi_epg = EPG_INVALID,
-  .gi_ref_count = 0,
-};
-
-/**
- * Interface to source EPG DB - a per-interface vector
- */
-typedef struct gbp_itf_to_epg_db_t_
-{
-  gbp_itf_t *gte_vec;
-} gbp_itf_to_epg_db_t;
-
-static gbp_itf_to_epg_db_t gbp_itf_to_epg_db;
-
-/**
- * Pool of GBP endpoints
- */
-static gbp_endpoint_t *gbp_endpoint_pool;
-
-/**
- * DB of endpoints
- */
-static uword *gbp_endpoint_db;
-
-/**
- * EPG src,dst pair to ACL mapping table, aka contract DB
- */
-typedef struct gbp_contract_db_t_
-{
-  /**
-   * We can form a u64 key from the pair, so use a simple hash table
-   */
-  uword *gc_hash;
-} gbp_contract_db_t;
-
-/**
- * Since contract DB instance
- */
-static gbp_contract_db_t gbp_contract_db;
-
-static void
-gbp_ip_epg_update (const ip46_address_t * ip, epg_id_t epg_id)
-{
-  /*
-   * we are dealing only with addresses here so this limited
-   * is_ip4 check is ok
-   */
-  if (ip46_address_is_ip4 (ip))
-    {
-      hash_set (gbp_ip4_to_epg_db.g4ie_hash, ip->ip4.as_u32, epg_id);
-    }
-  else
-    {
-      hash_set_mem (gbp_ip6_to_epg_db.g6ie_hash, &ip->ip6, epg_id);
-    }
-}
-
-static void
-gbp_ip_epg_delete (const ip46_address_t * ip)
-{
-  if (ip46_address_is_ip4 (ip))
-    {
-      hash_unset (gbp_ip4_to_epg_db.g4ie_hash, ip->ip4.as_u32);
-    }
-  else
-    {
-      hash_unset_mem (gbp_ip6_to_epg_db.g6ie_hash, &ip->ip6);
-    }
-}
-
-static void
-gbp_itf_epg_update (u32 sw_if_index, epg_id_t src_epg)
-{
-  vec_validate_init_empty (gbp_itf_to_epg_db.gte_vec,
-			   sw_if_index, ITF_INVALID);
-
-  if (0 == gbp_itf_to_epg_db.gte_vec[sw_if_index].gi_ref_count)
-    {
-      vnet_feature_enable_disable ("ip4-unicast", "gbp4",
-				   sw_if_index, 1, NULL, 0);
-      vnet_feature_enable_disable ("ip6-unicast", "gbp6",
-				   sw_if_index, 1, NULL, 0);
-    }
-  gbp_itf_to_epg_db.gte_vec[sw_if_index].gi_epg = src_epg;
-  gbp_itf_to_epg_db.gte_vec[sw_if_index].gi_ref_count++;
-}
-
-static void
-gbp_itf_epg_delete (u32 sw_if_index)
-{
-  if (vec_len (gbp_itf_to_epg_db.gte_vec) <= sw_if_index)
-    return;
-
-  if (1 == gbp_itf_to_epg_db.gte_vec[sw_if_index].gi_ref_count)
-    {
-      gbp_itf_to_epg_db.gte_vec[sw_if_index].gi_epg = EPG_INVALID;
-
-      vnet_feature_enable_disable ("ip4-unicast", "gbp4",
-				   sw_if_index, 0, NULL, 0);
-      vnet_feature_enable_disable ("ip6-unicast", "gbp6",
-				   sw_if_index, 0, NULL, 0);
-    }
-  gbp_itf_to_epg_db.gte_vec[sw_if_index].gi_ref_count--;
-}
-
-void
-gbp_endpoint_update (u32 sw_if_index,
-		     const ip46_address_t * ip, epg_id_t epg_id)
-{
-  gbp_endpoint_key_t key = {
-    .gek_ip = *ip,
-    .gek_sw_if_index = sw_if_index,
-  };
-  gbp_endpoint_t *gbpe;
-  uword *p;
-
-  p = hash_get_mem (gbp_endpoint_db, &key);
-
-  if (p)
-    {
-      gbpe = pool_elt_at_index (gbp_endpoint_pool, p[0]);
-    }
-  else
-    {
-      pool_get (gbp_endpoint_pool, gbpe);
-
-      gbpe->ge_key = clib_mem_alloc (sizeof (gbp_endpoint_key_t));
-      clib_memcpy (gbpe->ge_key, &key, sizeof (gbp_endpoint_key_t));
-
-      hash_set_mem (gbp_endpoint_db, gbpe->ge_key, gbpe - gbp_endpoint_pool);
-    }
-
-  gbpe->ge_epg_id = epg_id;
-
-  gbp_itf_epg_update (gbpe->ge_key->gek_sw_if_index, gbpe->ge_epg_id);
-  gbp_ip_epg_update (&gbpe->ge_key->gek_ip, gbpe->ge_epg_id);
-}
-
-void
-gbp_endpoint_delete (u32 sw_if_index, const ip46_address_t * ip)
-{
-  gbp_endpoint_key_t key = {
-    .gek_ip = *ip,
-    .gek_sw_if_index = sw_if_index,
-  };
-  gbp_endpoint_t *gbpe;
-  uword *p;
-
-  p = hash_get_mem (gbp_endpoint_db, &key);
-
-  if (p)
-    {
-      gbpe = pool_elt_at_index (gbp_endpoint_pool, p[0]);
-
-      hash_unset_mem (gbp_endpoint_db, gbpe->ge_key);
-
-      gbp_itf_epg_delete (gbpe->ge_key->gek_sw_if_index);
-      gbp_ip_epg_delete (&gbpe->ge_key->gek_ip);
-
-      clib_mem_free (gbpe->ge_key);
-
-      pool_put (gbp_endpoint_pool, gbpe);
-    }
-}
-
-void
-gbp_endpoint_walk (gbp_endpoint_cb_t cb, void *ctx)
-{
-  gbp_endpoint_t *gbpe;
-
-  /* *INDENT-OFF* */
-  pool_foreach(gbpe, gbp_endpoint_pool,
-  {
-    if (!cb(gbpe, ctx))
-      break;
-  });
-  /* *INDENT-ON* */
-}
-
-void
-gbp_contract_update (epg_id_t src_epg, epg_id_t dst_epg, u32 acl_index)
-{
-  gbp_contract_key_t key = {
-    .gck_src = src_epg,
-    .gck_dst = dst_epg,
-  };
-
-  hash_set (gbp_contract_db.gc_hash, key.as_u64, acl_index);
-}
-
-void
-gbp_contract_delete (epg_id_t src_epg, epg_id_t dst_epg)
-{
-  gbp_contract_key_t key = {
-    .gck_src = src_epg,
-    .gck_dst = dst_epg,
-  };
-
-  hash_unset (gbp_contract_db.gc_hash, key.as_u64);
-}
-
-void
-gbp_contract_walk (gbp_contract_cb_t cb, void *ctx)
-{
-  gbp_contract_key_t key;
-  u32 acl_index;
-
-  /* *INDENT-OFF* */
-  hash_foreach(key.as_u64, acl_index, gbp_contract_db.gc_hash,
-  ({
-    gbp_contract_t gbpc = {
-      .gc_key = key,
-      .gc_acl_index = acl_index,
-    };
-
-    if (!cb(&gbpc, ctx))
-      break;
-  }));
-  /* *INDENT-ON* */
-}
-
-static clib_error_t *
-gbp_endpoint_cli (vlib_main_t * vm,
-		  unformat_input_t * input, vlib_cli_command_t * cmd)
-{
-  vnet_main_t *vnm = vnet_get_main ();
-  epg_id_t epg_id = EPG_INVALID;
-  ip46_address_t ip = { };
-  u32 sw_if_index = ~0;
-  u8 add = 1;
-
-  while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
-    {
-      if (unformat (input, "%U", unformat_vnet_sw_interface,
-		    vnm, &sw_if_index))
-	;
-      else if (unformat (input, "add"))
-	add = 1;
-      else if (unformat (input, "del"))
-	add = 0;
-      else if (unformat (input, "epg %d", &epg_id))
-	;
-      else if (unformat (input, "ip %U", unformat_ip4_address, &ip.ip4))
-	;
-      else if (unformat (input, "ip %U", unformat_ip6_address, &ip.ip6))
-	;
-      else
-	break;
-    }
-
-  if (~0 == sw_if_index)
-    return clib_error_return (0, "interface must be specified");
-  if (EPG_INVALID == epg_id)
-    return clib_error_return (0, "EPG-ID must be specified");
-  if (ip46_address_is_zero (&ip))
-    return clib_error_return (0, "IP address must be specified");
-
-  if (add)
-    gbp_endpoint_update (sw_if_index, &ip, epg_id);
-  else
-    gbp_endpoint_delete (sw_if_index, &ip);
-
-  return (NULL);
-}
-
-static clib_error_t *
-gbp_contract_cli (vlib_main_t * vm,
-		  unformat_input_t * input, vlib_cli_command_t * cmd)
-{
-  epg_id_t src_epg_id = EPG_INVALID, dst_epg_id = EPG_INVALID;
-  u32 acl_index = ~0;
-  u8 add = 1;
-
-  while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
-    {
-      if (unformat (input, "add"))
-	add = 1;
-      else if (unformat (input, "del"))
-	add = 0;
-      else if (unformat (input, "src-epg %d", &src_epg_id))
-	;
-      else if (unformat (input, "dst-epg %d", &dst_epg_id))
-	;
-      else if (unformat (input, "acl-index %d", &acl_index))
-	;
-      else
-	break;
-    }
-
-  if (EPG_INVALID == src_epg_id)
-    return clib_error_return (0, "Source EPG-ID must be specified");
-  if (EPG_INVALID == dst_epg_id)
-    return clib_error_return (0, "Destination EPG-ID must be specified");
-
-  if (add)
-    {
-      gbp_contract_update (src_epg_id, dst_epg_id, acl_index);
-    }
-  else
-    {
-      gbp_contract_delete (src_epg_id, dst_epg_id);
-    }
-
-  return (NULL);
-}
-
-/*?
- * Configure a GBP Endpoint
- *
- * @cliexpar
- * @cliexstart{set gbp endpoint [del] <interface> epg <ID> ip <IP>}
- * @cliexend
- ?*/
-/* *INDENT-OFF* */
-VLIB_CLI_COMMAND (gbp_endpoint_cli_node, static) = {
-  .path = "gbp endpoint",
-  .short_help = "gbp endpoint [del] <interface> epg <ID> ip <IP>",
-  .function = gbp_endpoint_cli,
-};
-
-/*?
- * Configure a GBP Contract
- *
- * @cliexpar
- * @cliexstart{set gbp contract [del] src-epg <ID> dst-epg <ID> acl-index <ACL>}
- * @cliexend
- ?*/
-VLIB_CLI_COMMAND (gbp_contract_cli_node, static) = {
-  .path = "gbp contract",
-  .short_help = "gbp contract [del] src-epg <ID> dst-epg <ID> acl-index <ACL>",
-  .function = gbp_contract_cli,
-};
-/* *INDENT-ON* */
-
-static int
-gbp_endpoint_show_one (gbp_endpoint_t * gbpe, void *ctx)
-{
-  vnet_main_t *vnm = vnet_get_main ();
-  vlib_main_t *vm;
-
-  vm = ctx;
-  vlib_cli_output (vm, "  {%U, %U} -> %d",
-		   format_vnet_sw_if_index_name, vnm,
-		   gbpe->ge_key->gek_sw_if_index,
-		   format_ip46_address, &gbpe->ge_key->gek_ip, IP46_TYPE_ANY,
-		   gbpe->ge_epg_id);
-
-  return (1);
-}
-
-static clib_error_t *
-gbp_endpoint_show (vlib_main_t * vm,
-		   unformat_input_t * input, vlib_cli_command_t * cmd)
-{
-  vnet_main_t *vnm = vnet_get_main ();
-  ip46_address_t ip, *ipp;
-  epg_id_t epg_id;
-  u32 sw_if_index;
-
-  vlib_cli_output (vm, "Endpoints:");
-  gbp_endpoint_walk (gbp_endpoint_show_one, vm);
-
-  vlib_cli_output (vm, "\nSource interface to EPG:");
-
-  vec_foreach_index (sw_if_index, gbp_itf_to_epg_db.gte_vec)
-  {
-    if (EPG_INVALID != gbp_itf_to_epg_db.gte_vec[sw_if_index].gi_epg)
-      {
-	vlib_cli_output (vm, "  %U -> %d",
-			 format_vnet_sw_if_index_name, vnm, sw_if_index,
-			 gbp_itf_to_epg_db.gte_vec[sw_if_index].gi_epg);
-      }
-  }
-
-  vlib_cli_output (vm, "\nDestination IP4 to EPG:");
-
-  /* *INDENT-OFF* */
-  hash_foreach (ip.ip4.as_u32, epg_id, gbp_ip4_to_epg_db.g4ie_hash,
-  {
-    vlib_cli_output (vm, "  %U -> %d", format_ip46_address, &ip,
-                     IP46_TYPE_IP4, epg_id);
-  });
-  /* *INDENT-ON* */
-
-  vlib_cli_output (vm, "\nDestination IP6 to EPG:");
-
-  /* *INDENT-OFF* */
-  hash_foreach_mem (ipp, epg_id, gbp_ip6_to_epg_db.g6ie_hash,
-  {
-    vlib_cli_output (vm, "  %U -> %d", format_ip46_address, ipp,
-                     IP46_TYPE_IP6, epg_id);
-  });
-  /* *INDENT-ON* */
-
-  return (NULL);
-}
-
-static clib_error_t *
-gbp_contract_show (vlib_main_t * vm,
-		   unformat_input_t * input, vlib_cli_command_t * cmd)
-{
-  gbp_contract_key_t key;
-  epg_id_t epg_id;
-
-  vlib_cli_output (vm, "Contracts:");
-
-  /* *INDENT-OFF* */
-  hash_foreach (key.as_u64, epg_id, gbp_contract_db.gc_hash,
-  {
-    vlib_cli_output (vm, "  {%d,%d} -> %d", key.gck_src,
-                     key.gck_dst, epg_id);
-  });
-  /* *INDENT-ON* */
-
-  return (NULL);
-}
-
-/*?
- * Show Group Based Policy Endpoints and derived information
- *
- * @cliexpar
- * @cliexstart{show gbp endpoint}
- * @cliexend
- ?*/
-/* *INDENT-OFF* */
-VLIB_CLI_COMMAND (gbp_endpoint_show_node, static) = {
-  .path = "show gbp endpoint",
-  .short_help = "show gbp endpoint\n",
-  .function = gbp_endpoint_show,
-};
-/* *INDENT-ON* */
-
-/*?
- * Show Group Based Policy Contracts
- *
- * @cliexpar
- * @cliexstart{show gbp contract}
- * @cliexend
- ?*/
-/* *INDENT-OFF* */
-VLIB_CLI_COMMAND (gbp_contract_show_node, static) = {
-  .path = "show gbp contract",
-  .short_help = "show gbp contract\n",
-  .function = gbp_contract_show,
-};
-/* *INDENT-ON* */
-
-#define foreach_gbp                    \
-  _(DENY,    "deny")
-
-typedef enum
-{
-#define _(sym,str) GBP_ERROR_##sym,
-  foreach_gbp
-#undef _
-    GBP_N_ERROR,
-} gbp_error_t;
-
-static char *gbp_error_strings[] = {
-#define _(sym,string) string,
-  foreach_gbp
-#undef _
-};
-
-typedef enum
-{
-#define _(sym,str) GBP_NEXT_##sym,
-  foreach_gbp
-#undef _
-    GBP_N_NEXT,
-} gbp_next_t;
-
-/**
- * per-packet trace data
- */
-typedef struct gbp_trace_t_
-{
-  /* per-pkt trace data */
-  epg_id_t src_epg;
-  epg_id_t dst_epg;
-  u32 acl_index;
-} gbp_trace_t;
-
-static inline uword
-gbp_inline (vlib_main_t * vm,
-	    vlib_node_runtime_t * node, vlib_frame_t * frame, int is_ip6)
-{
-  u32 n_left_from, *from, *to_next;
-  gbp_next_t next_index;
-
-  next_index = 0;
-  n_left_from = frame->n_vectors;
-  from = vlib_frame_vector_args (frame);
-
-  while (n_left_from > 0)
-    {
-      u32 n_left_to_next;
-
-      vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
-
-      while (n_left_from > 0 && n_left_to_next > 0)
-	{
-	  vlib_buffer_t *b0;
-	  u32 sw_if_index0;
-	  gbp_next_t next0;
-	  u32 bi0;
-	  ip4_header_t *ip4_0;
-	  ip6_header_t *ip6_0;
-	  gbp_contract_key_t key0;
-	  u32 acl_index0;
-	  uword *p;
-
-	  bi0 = from[0];
-	  to_next[0] = bi0;
-	  from += 1;
-	  to_next += 1;
-	  n_left_from -= 1;
-	  n_left_to_next -= 1;
-
-	  /* deny by default */
-	  next0 = GBP_NEXT_DENY;
-
-	  b0 = vlib_get_buffer (vm, bi0);
-	  if (is_ip6)
-	    ip6_0 = vlib_buffer_get_current (b0);
-	  else
-	    ip4_0 = vlib_buffer_get_current (b0);
-	  sw_if_index0 = vnet_buffer (b0)->sw_if_index[VLIB_RX];
-
-	  /*
-	   * determine the src and dst EPG
-	   */
-	  key0.gck_src = gbp_itf_to_epg_db.gte_vec[sw_if_index0].gi_epg;
-
-	  if (is_ip6)
-	    p = hash_get_mem (gbp_ip6_to_epg_db.g6ie_hash,
-			      &ip6_0->dst_address);
-	  else
-	    p = hash_get (gbp_ip4_to_epg_db.g4ie_hash,
-			  ip4_0->dst_address.as_u32);
-
-	  if (NULL != p)
-	    {
-	      key0.gck_dst = p[0];
-
-	      /*
-	       * If the src and dst are the same, then let it through
-	       */
-	      if (key0.gck_dst == key0.gck_src)
-		{
-		  vnet_feature_next (sw_if_index0, &next0, b0);
-		  acl_index0 = ~0;
-		}
-	      else
-		{
-		  /*
-		   * find this src,dst pair in the egp->acl DB
-		   */
-		  p = hash_get (gbp_contract_db.gc_hash, key0.as_u64);
-
-		  if (NULL != p)
-		    {
-		      acl_index0 = p[0];
-
-		      /*
-		       * the ACL index stored is NULL, this means any-any so let it pass
-		       */
-		      if (~0 == acl_index0)
-			{
-			  vnet_feature_next (sw_if_index0, &next0, b0);
-			}
-		      else
-			{
-			  /*
-			   * TODO tests against the ACL
-			   */
-			  /*
-			   * ACL tables are not available outside of ACL plugin
-			   * until then bypass the ACL to next node
-			   */
-			  vnet_feature_next (sw_if_index0, &next0, b0);
-			}
-		    }
-		  else
-		    {
-		      /*
-		       * no ACL to apply for packets between these two EPGs.
-		       * GBP is a whitelist model, so no ACL implies deny, which
-		       * is the default result
-		       */
-		      acl_index0 = ~0;
-		    }
-		}
-	    }
-	  else
-	    {
-	      /*
-	       * cannot determine the destinaiotn EPG, so we cannot enforce policy
-	       * on this node. permit.
-	       */
-	      vnet_feature_next (sw_if_index0, &next0, b0);
-
-	      key0.gck_dst = ~0;
-	      acl_index0 = ~0;
-	    }
-
-	  if (PREDICT_FALSE ((node->flags & VLIB_NODE_FLAG_TRACE) &&
-			     (b0->flags & VLIB_BUFFER_IS_TRACED)))
-	    {
-	      gbp_trace_t *t = vlib_add_trace (vm, node, b0, sizeof (*t));
-	      t->src_epg = key0.gck_src;
-	      t->dst_epg = key0.gck_dst;
-	      t->acl_index = acl_index0;
-	    }
-
-	  /* verify speculative enqueue, maybe switch current next frame */
-	  vlib_validate_buffer_enqueue_x1 (vm, node, next_index,
-					   to_next, n_left_to_next,
-					   bi0, next0);
-	}
-
-      vlib_put_next_frame (vm, node, next_index, n_left_to_next);
-    }
-
-  return frame->n_vectors;
-}
-
-/* packet trace format function */
-static u8 *
-format_gbp_trace (u8 * s, va_list * args)
-{
-  CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
-  CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
-  gbp_trace_t *t = va_arg (*args, gbp_trace_t *);
-
-  s = format (s, "gbp: src:%d dst:%d acl:%d",
-	      t->src_epg, t->dst_epg, t->acl_index);
-
-  return s;
-}
-
-static inline uword
-gbp_4 (vlib_main_t * vm, vlib_node_runtime_t * node, vlib_frame_t * frame)
-{
-  return (gbp_inline (vm, node, frame, 0));
-}
-
-static inline uword
-gbp_6 (vlib_main_t * vm, vlib_node_runtime_t * node, vlib_frame_t * frame)
-{
-  return (gbp_inline (vm, node, frame, 1));
-}
-
-/* *INDENT-OFF* */
-VLIB_REGISTER_NODE (gbp_4_node) = {
-  .function = gbp_4,
-  .name = "gbp4",
-  .vector_size = sizeof (u32),
-  .format_trace = format_gbp_trace,
-  .type = VLIB_NODE_TYPE_INTERNAL,
-
-  .n_errors = ARRAY_LEN(gbp_error_strings),
-  .error_strings = gbp_error_strings,
-
-  .n_next_nodes = GBP_N_NEXT,
-
-  .next_nodes = {
-    [GBP_NEXT_DENY] = "ip4-drop",
-  },
-};
-
-VLIB_NODE_FUNCTION_MULTIARCH (gbp_4_node, gbp_4);
-
-VNET_FEATURE_INIT (gbp_4_node, static) = {
-    .arc_name = "ip4-unicast",
-    .node_name = "gbp4",
-    .runs_after = VNET_FEATURES ("acl-plugin-in-ip4-fa"),
-};
-
-VLIB_REGISTER_NODE (gbp_6_node) = {
-  .function = gbp_6,
-  .name = "gbp6",
-  .vector_size = sizeof (u32),
-  .format_trace = format_gbp_trace,
-  .type = VLIB_NODE_TYPE_INTERNAL,
-
-  .n_errors = ARRAY_LEN(gbp_error_strings),
-  .error_strings = gbp_error_strings,
-
-  .n_next_nodes = GBP_N_NEXT,
-
-  .next_nodes = {
-    [GBP_NEXT_DENY] = "ip6-drop",
-  },
-};
-
-VLIB_NODE_FUNCTION_MULTIARCH (gbp_6_node, gbp_6);
-
-VNET_FEATURE_INIT (gbp_6_node, static) = {
-    .arc_name = "ip6-unicast",
-    .node_name = "gbp6",
-    .runs_after = VNET_FEATURES ("acl-plugin-in-ip6-fa"),
-};
-/* *INDENT-ON* */
-
-static clib_error_t *
-gbp_init (vlib_main_t * vm)
-{
-  gbp_endpoint_db = hash_create_mem (0,
-				     sizeof (gbp_endpoint_key_t),
-				     sizeof (u32));
-  gbp_ip6_to_epg_db.g6ie_hash =
-    hash_create_mem (0, sizeof (ip6_address_t), sizeof (u32));
-  return 0;
-}
-
-VLIB_INIT_FUNCTION (gbp_init);
-
-/*
- * fd.io coding-style-patch-verification: ON
- *
- * Local Variables:
- * eval: (c-set-style "gnu")
- * End:
- */
diff --git a/src/plugins/gbp/gbp.h b/src/plugins/gbp/gbp.h
index 334a7438f53..8672fd3b092 100644
--- a/src/plugins/gbp/gbp.h
+++ b/src/plugins/gbp/gbp.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013 Cisco and/or its affiliates.
+ * Copyright (c) 2018 Cisco and/or its affiliates.
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at:
@@ -28,101 +28,15 @@
  *
  */
 
-#ifndef included_vnet_gbp_h
-#define included_vnet_gbp_h
+#ifndef __GBP_H__
+#define __GBP_H__
 
-#include <vlib/vlib.h>
-#include <vnet/vnet.h>
-#include <vnet/ip/ip.h>
-
-typedef u32 epg_id_t;
-#define EPG_INVALID (~0)
-
-/**
- * The key for an Endpoint
- */
-typedef struct gbp_endpoint_key_t_
-{
-  /**
-   * The interface on which the EP is connected
-   */
-  u32 gek_sw_if_index;
-
-  /**
-   * The IP[46] address of the endpoint
-   */
-  ip46_address_t gek_ip;
-} gbp_endpoint_key_t;
-
-/**
- * A Group Based Policy Endpoint.
- * This is typcially a VM on the local compute node for which policy must be
- * locally applied
- */
-typedef struct gbp_endpoint_t_
-{
-  /**
-   * The endpoint's interface and IP address
-   */
-  gbp_endpoint_key_t *ge_key;
-
-  /**
-   * The endpoint's designated EPG
-   */
-  epg_id_t ge_epg_id;
-} gbp_endpoint_t;
-
-extern void gbp_endpoint_update (u32 sw_if_index,
-				 const ip46_address_t * ip, epg_id_t epg_id);
-extern void gbp_endpoint_delete (u32 sw_if_index, const ip46_address_t * ip);
-
-typedef int (*gbp_endpoint_cb_t) (gbp_endpoint_t * gbpe, void *ctx);
-extern void gbp_endpoint_walk (gbp_endpoint_cb_t bgpe, void *ctx);
-
-
-/**
- * The key for an Contract
- */
-typedef struct gbp_contract_key_t_
-{
-  union
-  {
-    struct
-    {
-      /**
-       * source and destination EPGs for which the ACL applies
-       */
-      epg_id_t gck_src;
-      epg_id_t gck_dst;
-    };
-    u64 as_u64;
-  };
-} gbp_contract_key_t;
-
-/**
- * A Group Based Policy Contract.
- *  Determines the ACL that applies to traffic pass between two endpoint groups
- */
-typedef struct gbp_contract_t_
-{
-  /**
-   * source and destination EPGs
-   */
-  gbp_contract_key_t gc_key;
-
-  /**
-   * The ACL to apply for packets from the source to the destination EPG
-   */
-  u32 gc_acl_index;;
-} gbp_contract_t;
-
-
-extern void gbp_contract_update (epg_id_t src_epg,
-				 epg_id_t dst_epg, u32 acl_index);
-extern void gbp_contract_delete (epg_id_t src_epg, epg_id_t dst_epg);
-
-typedef int (*gbp_contract_cb_t) (gbp_contract_t * gbpe, void *ctx);
-extern void gbp_contract_walk (gbp_contract_cb_t bgpe, void *ctx);
+#include <plugins/gbp/gbp_types.h>
+#include <plugins/gbp/gbp_endpoint.h>
+#include <plugins/gbp/gbp_endpoint_group.h>
+#include <plugins/gbp/gbp_contract.h>
+#include <plugins/gbp/gbp_subnet.h>
+#include <plugins/gbp/gbp_recirc.h>
 
 #endif
 
diff --git a/src/plugins/gbp/gbp_all_api_h.h b/src/plugins/gbp/gbp_all_api_h.h
index a65d9fcd164..3093309e80f 100644
--- a/src/plugins/gbp/gbp_all_api_h.h
+++ b/src/plugins/gbp/gbp_all_api_h.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2016 Cisco and/or its affiliates.
+ * Copyright (c) 2018 Cisco and/or its affiliates.
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at:
diff --git a/src/plugins/gbp/gbp_api.c b/src/plugins/gbp/gbp_api.c
index 998d5d9bdbb..88b2cd1cea9 100644
--- a/src/plugins/gbp/gbp_api.c
+++ b/src/plugins/gbp/gbp_api.c
@@ -1,8 +1,6 @@
 /*
  *------------------------------------------------------------------
- * gbp_api.c - layer 2 emulation api
- *
- * Copyright (c) 2016 Cisco and/or its affiliates.
+ * Copyright (c) 2018 Cisco and/or its affiliates.
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at:
@@ -56,6 +54,12 @@
 #define foreach_gbp_api_msg                                 \
   _(GBP_ENDPOINT_ADD_DEL, gbp_endpoint_add_del)             \
   _(GBP_ENDPOINT_DUMP, gbp_endpoint_dump)                   \
+  _(GBP_SUBNET_ADD_DEL, gbp_subnet_add_del)                 \
+  _(GBP_SUBNET_DUMP, gbp_subnet_dump)                       \
+  _(GBP_ENDPOINT_GROUP_ADD_DEL, gbp_endpoint_group_add_del) \
+  _(GBP_ENDPOINT_GROUP_DUMP, gbp_endpoint_group_dump)       \
+  _(GBP_RECIRC_ADD_DEL, gbp_recirc_add_del)                 \
+  _(GBP_RECIRC_DUMP, gbp_recirc_dump)                       \
   _(GBP_CONTRACT_ADD_DEL, gbp_contract_add_del)             \
   _(GBP_CONTRACT_DUMP, gbp_contract_dump)
 
@@ -94,7 +98,8 @@ vl_api_gbp_endpoint_add_del_t_handler (vl_api_gbp_endpoint_add_del_t * mp)
 
   if (mp->is_add)
     {
-      gbp_endpoint_update (sw_if_index, &ip, ntohl (mp->endpoint.epg_id));
+      rv =
+	gbp_endpoint_update (sw_if_index, &ip, ntohl (mp->endpoint.epg_id));
     }
   else
     {
@@ -163,6 +168,223 @@ vl_api_gbp_endpoint_dump_t_handler (vl_api_gbp_endpoint_dump_t * mp)
 }
 
 static void
+  vl_api_gbp_endpoint_group_add_del_t_handler
+  (vl_api_gbp_endpoint_group_add_del_t * mp)
+{
+  vl_api_gbp_endpoint_group_add_del_reply_t *rmp;
+  u32 uplink_sw_if_index;
+  int rv = 0;
+
+  uplink_sw_if_index = ntohl (mp->epg.uplink_sw_if_index);
+  if (!vnet_sw_if_index_is_api_valid (uplink_sw_if_index))
+    goto bad_sw_if_index;
+
+  if (mp->is_add)
+    {
+      rv = gbp_endpoint_group_add (ntohl (mp->epg.epg_id),
+				   ntohl (mp->epg.bd_id),
+				   ntohl (mp->epg.ip4_table_id),
+				   ntohl (mp->epg.ip6_table_id),
+				   uplink_sw_if_index);
+    }
+  else
+    {
+      gbp_endpoint_group_delete (ntohl (mp->epg.epg_id));
+    }
+
+  BAD_SW_IF_INDEX_LABEL;
+
+  REPLY_MACRO (VL_API_GBP_ENDPOINT_GROUP_ADD_DEL_REPLY + GBP_MSG_BASE);
+}
+
+static void
+vl_api_gbp_subnet_add_del_t_handler (vl_api_gbp_subnet_add_del_t * mp)
+{
+  vl_api_gbp_subnet_add_del_reply_t *rmp;
+  int rv = 0;
+  fib_prefix_t pfx = {
+    .fp_len = mp->subnet.address_length,
+    .fp_proto = (mp->subnet.is_ip6 ? FIB_PROTOCOL_IP6 : FIB_PROTOCOL_IP4),
+  };
+
+  if (mp->subnet.is_ip6)
+    clib_memcpy (&pfx.fp_addr.ip6, mp->subnet.address,
+		 sizeof (pfx.fp_addr.ip6));
+  else
+    clib_memcpy (&pfx.fp_addr.ip4, mp->subnet.address,
+		 sizeof (pfx.fp_addr.ip4));
+
+  rv = gbp_subnet_add_del (ntohl (mp->subnet.table_id),
+			   &pfx,
+			   ntohl (mp->subnet.sw_if_index),
+			   ntohl (mp->subnet.epg_id),
+			   mp->is_add, mp->subnet.is_internal);
+
+  REPLY_MACRO (VL_API_GBP_SUBNET_ADD_DEL_REPLY + GBP_MSG_BASE);
+}
+
+static int
+gbp_subnet_send_details (u32 table_id,
+			 const fib_prefix_t * pfx,
+			 u32 sw_if_index,
+			 epg_id_t epg, u8 is_internal, void *args)
+{
+  vl_api_gbp_subnet_details_t *mp;
+  gbp_walk_ctx_t *ctx;
+
+  ctx = args;
+  mp = vl_msg_api_alloc (sizeof (*mp));
+  if (!mp)
+    return 1;
+
+  memset (mp, 0, sizeof (*mp));
+  mp->_vl_msg_id = ntohs (VL_API_GBP_SUBNET_DETAILS + GBP_MSG_BASE);
+  mp->context = ctx->context;
+
+  mp->subnet.is_internal = is_internal;
+  mp->subnet.sw_if_index = ntohl (sw_if_index);
+  mp->subnet.epg_id = ntohl (epg);
+  mp->subnet.is_ip6 = (pfx->fp_proto == FIB_PROTOCOL_IP6);
+  mp->subnet.address_length = pfx->fp_len;
+  mp->subnet.table_id = ntohl (table_id);
+  if (mp->subnet.is_ip6)
+    clib_memcpy (&mp->subnet.address,
+		 &pfx->fp_addr.ip6, sizeof (pfx->fp_addr.ip6));
+  else
+    clib_memcpy (&mp->subnet.address,
+		 &pfx->fp_addr.ip4, sizeof (pfx->fp_addr.ip4));
+
+
+  vl_api_send_msg (ctx->reg, (u8 *) mp);
+
+  return (1);
+}
+
+static void
+vl_api_gbp_subnet_dump_t_handler (vl_api_gbp_subnet_dump_t * mp)
+{
+  vl_api_registration_t *reg;
+
+  reg = vl_api_client_index_to_registration (mp->client_index);
+  if (!reg)
+    return;
+
+  gbp_walk_ctx_t ctx = {
+    .reg = reg,
+    .context = mp->context,
+  };
+
+  gbp_subnet_walk (gbp_subnet_send_details, &ctx);
+}
+
+static int
+gbp_endpoint_group_send_details (gbp_endpoint_group_t * gepg, void *args)
+{
+  vl_api_gbp_endpoint_group_details_t *mp;
+  gbp_walk_ctx_t *ctx;
+
+  ctx = args;
+  mp = vl_msg_api_alloc (sizeof (*mp));
+  if (!mp)
+    return 1;
+
+  memset (mp, 0, sizeof (*mp));
+  mp->_vl_msg_id = ntohs (VL_API_GBP_ENDPOINT_GROUP_DETAILS + GBP_MSG_BASE);
+  mp->context = ctx->context;
+
+  mp->epg.uplink_sw_if_index = ntohl (gepg->gepg_uplink_sw_if_index);
+  mp->epg.epg_id = ntohl (gepg->gepg_id);
+  mp->epg.bd_id = ntohl (gepg->gepg_bd);
+  mp->epg.ip4_table_id = ntohl (gepg->gepg_rd[FIB_PROTOCOL_IP4]);
+  mp->epg.ip6_table_id = ntohl (gepg->gepg_rd[FIB_PROTOCOL_IP6]);
+
+  vl_api_send_msg (ctx->reg, (u8 *) mp);
+
+  return (1);
+}
+
+static void
+vl_api_gbp_endpoint_group_dump_t_handler (vl_api_gbp_endpoint_group_dump_t *
+					  mp)
+{
+  vl_api_registration_t *reg;
+
+  reg = vl_api_client_index_to_registration (mp->client_index);
+  if (!reg)
+    return;
+
+  gbp_walk_ctx_t ctx = {
+    .reg = reg,
+    .context = mp->context,
+  };
+
+  gbp_endpoint_group_walk (gbp_endpoint_group_send_details, &ctx);
+}
+
+static void
+vl_api_gbp_recirc_add_del_t_handler (vl_api_gbp_recirc_add_del_t * mp)
+{
+  vl_api_gbp_recirc_add_del_reply_t *rmp;
+  u32 sw_if_index;
+  int rv = 0;
+
+  sw_if_index = ntohl (mp->recirc.sw_if_index);
+  if (!vnet_sw_if_index_is_api_valid (sw_if_index))
+    goto bad_sw_if_index;
+
+  if (mp->is_add)
+    gbp_recirc_add (sw_if_index,
+		    ntohl (mp->recirc.epg_id), mp->recirc.is_ext);
+  else
+    gbp_recirc_delete (sw_if_index);
+
+  BAD_SW_IF_INDEX_LABEL;
+
+  REPLY_MACRO (VL_API_GBP_RECIRC_ADD_DEL_REPLY + GBP_MSG_BASE);
+}
+
+static int
+gbp_recirc_send_details (gbp_recirc_t * gr, void *args)
+{
+  vl_api_gbp_recirc_details_t *mp;
+  gbp_walk_ctx_t *ctx;
+
+  ctx = args;
+  mp = vl_msg_api_alloc (sizeof (*mp));
+  if (!mp)
+    return 1;
+
+  memset (mp, 0, sizeof (*mp));
+  mp->_vl_msg_id = ntohs (VL_API_GBP_RECIRC_DETAILS + GBP_MSG_BASE);
+  mp->context = ctx->context;
+
+  mp->recirc.epg_id = ntohl (gr->gr_epg);
+  mp->recirc.sw_if_index = ntohl (gr->gr_sw_if_index);
+  mp->recirc.is_ext = ntohl (gr->gr_is_ext);
+
+  vl_api_send_msg (ctx->reg, (u8 *) mp);
+
+  return (1);
+}
+
+static void
+vl_api_gbp_recirc_dump_t_handler (vl_api_gbp_recirc_dump_t * mp)
+{
+  vl_api_registration_t *reg;
+
+  reg = vl_api_client_index_to_registration (mp->client_index);
+  if (!reg)
+    return;
+
+  gbp_walk_ctx_t ctx = {
+    .reg = reg,
+    .context = mp->context,
+  };
+
+  gbp_recirc_walk (gbp_recirc_send_details, &ctx);
+}
+
+static void
 vl_api_gbp_contract_add_del_t_handler (vl_api_gbp_contract_add_del_t * mp)
 {
   vl_api_gbp_contract_add_del_reply_t *rmp;
diff --git a/src/plugins/gbp/gbp_classify.c b/src/plugins/gbp/gbp_classify.c
new file mode 100644
index 00000000000..859d4f95173
--- /dev/null
+++ b/src/plugins/gbp/gbp_classify.c
@@ -0,0 +1,276 @@
+/*
+ * gbp.h : Group Based Policy
+ *
+ * Copyright (c) 2018 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <plugins/gbp/gbp.h>
+
+typedef enum gbp_src_classify_type_t_
+{
+  GBP_SRC_CLASSIFY_NULL,
+  GBP_SRC_CLASSIFY_PORT,
+} gbp_src_classify_type_t;
+
+#define GBP_SRC_N_CLASSIFY (GBP_SRC_CLASSIFY_PORT + 1)
+
+/**
+ * Grouping of global data for the GBP source EPG classification feature
+ */
+typedef struct gbp_src_classify_main_t_
+{
+  /**
+   * Next nodes for L2 output features
+   */
+  u32 l2_input_feat_next[GBP_SRC_N_CLASSIFY][32];
+} gbp_src_classify_main_t;
+
+static gbp_src_classify_main_t gbp_src_classify_main;
+
+/**
+ * per-packet trace data
+ */
+typedef struct gbp_classify_trace_t_
+{
+  /* per-pkt trace data */
+  epg_id_t src_epg;
+} gbp_classify_trace_t;
+
+/*
+ * determine the SRC EPG form the input port
+ */
+always_inline uword
+gbp_classify_inline (vlib_main_t * vm,
+		     vlib_node_runtime_t * node,
+		     vlib_frame_t * frame,
+		     gbp_src_classify_type_t type, u8 is_l3)
+{
+  gbp_src_classify_main_t *gscm = &gbp_src_classify_main;
+  u32 n_left_from, *from, *to_next;
+  u32 next_index;
+
+  next_index = 0;
+  n_left_from = frame->n_vectors;
+  from = vlib_frame_vector_args (frame);
+
+  while (n_left_from > 0)
+    {
+      u32 n_left_to_next;
+
+      vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
+
+      while (n_left_from > 0 && n_left_to_next > 0)
+	{
+	  u32 next0, bi0, src_epg, sw_if_index0;
+	  vlib_buffer_t *b0;
+
+	  bi0 = from[0];
+	  to_next[0] = bi0;
+	  from += 1;
+	  to_next += 1;
+	  n_left_from -= 1;
+	  n_left_to_next -= 1;
+
+	  b0 = vlib_get_buffer (vm, bi0);
+
+	  sw_if_index0 = vnet_buffer (b0)->sw_if_index[VLIB_RX];
+
+	  if (GBP_SRC_CLASSIFY_NULL == type)
+	    {
+	      src_epg = ~0;
+	      next0 =
+		vnet_l2_feature_next (b0, gscm->l2_input_feat_next[type],
+				      L2INPUT_FEAT_GBP_NULL_CLASSIFY);
+	    }
+	  else
+	    {
+	      src_epg = gbp_port_to_epg (sw_if_index0);
+	      if (is_l3)
+		{
+		  /*
+		   * Go straight to looukp, do not pass go, do not collect $200
+		   */
+		  next0 = 0;
+		}
+	      else
+		{
+		  next0 =
+		    vnet_l2_feature_next (b0, gscm->l2_input_feat_next[type],
+					  L2INPUT_FEAT_GBP_SRC_CLASSIFY);
+		}
+	    }
+
+	  vnet_buffer2 (b0)->gbp.src_epg = src_epg;
+
+	  if (PREDICT_FALSE ((b0->flags & VLIB_BUFFER_IS_TRACED)))
+	    {
+	      gbp_classify_trace_t *t =
+		vlib_add_trace (vm, node, b0, sizeof (*t));
+	      t->src_epg = src_epg;
+	    }
+
+	  vlib_validate_buffer_enqueue_x1 (vm, node, next_index,
+					   to_next, n_left_to_next,
+					   bi0, next0);
+	}
+
+      vlib_put_next_frame (vm, node, next_index, n_left_to_next);
+    }
+
+  return frame->n_vectors;
+}
+
+static uword
+gbp_src_classify (vlib_main_t * vm,
+		  vlib_node_runtime_t * node, vlib_frame_t * frame)
+{
+  return (gbp_classify_inline (vm, node, frame, GBP_SRC_CLASSIFY_PORT, 0));
+}
+
+static uword
+gbp_null_classify (vlib_main_t * vm,
+		   vlib_node_runtime_t * node, vlib_frame_t * frame)
+{
+  return (gbp_classify_inline (vm, node, frame, GBP_SRC_CLASSIFY_NULL, 0));
+}
+
+static uword
+gbp_ip4_src_classify (vlib_main_t * vm,
+		      vlib_node_runtime_t * node, vlib_frame_t * frame)
+{
+  return (gbp_classify_inline (vm, node, frame, 0, 1));
+}
+
+static uword
+gbp_ip6_src_classify (vlib_main_t * vm,
+		      vlib_node_runtime_t * node, vlib_frame_t * frame)
+{
+  return (gbp_classify_inline (vm, node, frame, 0, 1));
+}
+
+
+/* packet trace format function */
+static u8 *
+format_gbp_classify_trace (u8 * s, va_list * args)
+{
+  CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
+  CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
+  gbp_classify_trace_t *t = va_arg (*args, gbp_classify_trace_t *);
+
+  s = format (s, "src-epg:%d", t->src_epg);
+
+  return s;
+}
+
+/* *INDENT-OFF* */
+VLIB_REGISTER_NODE (gbp_null_classify_node) = {
+  .function = gbp_null_classify,
+  .name = "gbp-null-classify",
+  .vector_size = sizeof (u32),
+  .format_trace = format_gbp_classify_trace,
+  .type = VLIB_NODE_TYPE_INTERNAL,
+
+  .n_errors = 0,
+  .n_next_nodes = 0,
+};
+
+VLIB_NODE_FUNCTION_MULTIARCH (gbp_null_classify_node, gbp_null_classify);
+
+VLIB_REGISTER_NODE (gbp_src_classify_node) = {
+  .function = gbp_src_classify,
+  .name = "gbp-src-classify",
+  .vector_size = sizeof (u32),
+  .format_trace = format_gbp_classify_trace,
+  .type = VLIB_NODE_TYPE_INTERNAL,
+
+  .n_errors = 0,
+  .n_next_nodes = 0,
+};
+
+VLIB_NODE_FUNCTION_MULTIARCH (gbp_src_classify_node, gbp_src_classify);
+
+VLIB_REGISTER_NODE (gbp_ip4_src_classify_node) = {
+  .function = gbp_ip4_src_classify,
+  .name = "ip4-gbp-src-classify",
+  .vector_size = sizeof (u32),
+  .format_trace = format_gbp_classify_trace,
+  .type = VLIB_NODE_TYPE_INTERNAL,
+
+  .n_errors = 0,
+  .n_next_nodes = 1,
+  .next_nodes = {
+    [0] = "ip4-lookup"
+  },
+};
+
+VLIB_NODE_FUNCTION_MULTIARCH (gbp_ip4_src_classify_node, gbp_ip4_src_classify);
+
+VLIB_REGISTER_NODE (gbp_ip6_src_classify_node) = {
+  .function = gbp_ip6_src_classify,
+  .name = "ip6-gbp-src-classify",
+  .vector_size = sizeof (u32),
+  .format_trace = format_gbp_classify_trace,
+  .type = VLIB_NODE_TYPE_INTERNAL,
+
+  .n_errors = 0,
+  .n_next_nodes = 1,
+  .next_nodes = {
+    [0] = "ip6-lookup"
+  },
+};
+
+VLIB_NODE_FUNCTION_MULTIARCH (gbp_ip6_src_classify_node, gbp_ip6_src_classify);
+
+VNET_FEATURE_INIT (gbp_ip4_src_classify_feat_node, static) =
+{
+  .arc_name = "ip4-unicast",
+  .node_name = "ip4-gbp-src-classify",
+  .runs_before = VNET_FEATURES ("nat44-out2in"),
+};
+VNET_FEATURE_INIT (gbp_ip6_src_classify_feat_node, static) =
+{
+  .arc_name = "ip6-unicast",
+  .node_name = "ip6-gbp-src-classify",
+  .runs_before = VNET_FEATURES ("nat66-out2in"),
+};
+
+static clib_error_t *
+gbp_src_classify_init (vlib_main_t * vm)
+{
+  gbp_src_classify_main_t *em = &gbp_src_classify_main;
+
+  /* Initialize the feature next-node indexes */
+  feat_bitmap_init_next_nodes (vm,
+			       gbp_src_classify_node.index,
+			       L2INPUT_N_FEAT,
+			       l2input_get_feat_names (),
+			       em->l2_input_feat_next[GBP_SRC_CLASSIFY_NULL]);
+  feat_bitmap_init_next_nodes (vm,
+			       gbp_null_classify_node.index,
+			       L2INPUT_N_FEAT,
+			       l2input_get_feat_names (),
+			       em->l2_input_feat_next[GBP_SRC_CLASSIFY_PORT]);
+
+  return 0;
+}
+
+VLIB_INIT_FUNCTION (gbp_src_classify_init);
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
diff --git a/src/plugins/gbp/gbp_contract.c b/src/plugins/gbp/gbp_contract.c
new file mode 100644
index 00000000000..71d8bcf4671
--- /dev/null
+++ b/src/plugins/gbp/gbp_contract.c
@@ -0,0 +1,163 @@
+/*
+ * gbp.h : Group Based Policy
+ *
+ * Copyright (c) 2018 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <plugins/gbp/gbp.h>
+
+/**
+ * Single contract DB instance
+ */
+gbp_contract_db_t gbp_contract_db;
+
+void
+gbp_contract_update (epg_id_t src_epg, epg_id_t dst_epg, u32 acl_index)
+{
+  gbp_contract_key_t key = {
+    .gck_src = src_epg,
+    .gck_dst = dst_epg,
+  };
+
+  hash_set (gbp_contract_db.gc_hash, key.as_u64, acl_index);
+}
+
+void
+gbp_contract_delete (epg_id_t src_epg, epg_id_t dst_epg)
+{
+  gbp_contract_key_t key = {
+    .gck_src = src_epg,
+    .gck_dst = dst_epg,
+  };
+
+  hash_unset (gbp_contract_db.gc_hash, key.as_u64);
+}
+
+void
+gbp_contract_walk (gbp_contract_cb_t cb, void *ctx)
+{
+  gbp_contract_key_t key;
+  u32 acl_index;
+
+  /* *INDENT-OFF* */
+  hash_foreach(key.as_u64, acl_index, gbp_contract_db.gc_hash,
+  ({
+    gbp_contract_t gbpc = {
+      .gc_key = key,
+      .gc_acl_index = acl_index,
+    };
+
+    if (!cb(&gbpc, ctx))
+      break;
+  }));
+  /* *INDENT-ON* */
+}
+
+static clib_error_t *
+gbp_contract_cli (vlib_main_t * vm,
+		  unformat_input_t * input, vlib_cli_command_t * cmd)
+{
+  epg_id_t src_epg_id = EPG_INVALID, dst_epg_id = EPG_INVALID;
+  u32 acl_index = ~0;
+  u8 add = 1;
+
+  while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
+    {
+      if (unformat (input, "add"))
+	add = 1;
+      else if (unformat (input, "del"))
+	add = 0;
+      else if (unformat (input, "src-epg %d", &src_epg_id))
+	;
+      else if (unformat (input, "dst-epg %d", &dst_epg_id))
+	;
+      else if (unformat (input, "acl-index %d", &acl_index))
+	;
+      else
+	break;
+    }
+
+  if (EPG_INVALID == src_epg_id)
+    return clib_error_return (0, "Source EPG-ID must be specified");
+  if (EPG_INVALID == dst_epg_id)
+    return clib_error_return (0, "Destination EPG-ID must be specified");
+
+  if (add)
+    {
+      gbp_contract_update (src_epg_id, dst_epg_id, acl_index);
+    }
+  else
+    {
+      gbp_contract_delete (src_epg_id, dst_epg_id);
+    }
+
+  return (NULL);
+}
+
+/*?
+ * Configure a GBP Contract
+ *
+ * @cliexpar
+ * @cliexstart{set gbp contract [del] src-epg <ID> dst-epg <ID> acl-index <ACL>}
+ * @cliexend
+ ?*/
+VLIB_CLI_COMMAND (gbp_contract_cli_node, static) =
+{
+.path = "gbp contract",.short_help =
+    "gbp contract [del] src-epg <ID> dst-epg <ID> acl-index <ACL>",.function
+    = gbp_contract_cli,};
+/* *INDENT-ON* */
+
+static clib_error_t *
+gbp_contract_show (vlib_main_t * vm,
+		   unformat_input_t * input, vlib_cli_command_t * cmd)
+{
+  gbp_contract_key_t key;
+  epg_id_t epg_id;
+
+  vlib_cli_output (vm, "Contracts:");
+
+  /* *INDENT-OFF* */
+  hash_foreach (key.as_u64, epg_id, gbp_contract_db.gc_hash,
+  {
+    vlib_cli_output (vm, "  {%d,%d} -> %d", key.gck_src,
+                     key.gck_dst, epg_id);
+  });
+  /* *INDENT-ON* */
+
+  return (NULL);
+}
+
+/*?
+ * Show Group Based Policy Contracts
+ *
+ * @cliexpar
+ * @cliexstart{show gbp contract}
+ * @cliexend
+ ?*/
+/* *INDENT-OFF* */
+VLIB_CLI_COMMAND (gbp_contract_show_node, static) = {
+  .path = "show gbp contract",
+  .short_help = "show gbp contract\n",
+  .function = gbp_contract_show,
+};
+/* *INDENT-ON* */
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
diff --git a/src/plugins/gbp/gbp_contract.h b/src/plugins/gbp/gbp_contract.h
new file mode 100644
index 00000000000..1964098adc3
--- /dev/null
+++ b/src/plugins/gbp/gbp_contract.h
@@ -0,0 +1,102 @@
+/*
+ * Copyright (c) 2018 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef __GBP_CONTRACT_H__
+#define __GBP_CONTRACT_H__
+
+#include <plugins/gbp/gbp_types.h>
+
+/**
+ * The key for an Contract
+ */
+typedef struct gbp_contract_key_t_
+{
+  union
+  {
+    struct
+    {
+      /**
+       * source and destination EPGs for which the ACL applies
+       */
+      epg_id_t gck_src;
+      epg_id_t gck_dst;
+    };
+    u64 as_u64;
+  };
+} gbp_contract_key_t;
+
+/**
+ * A Group Based Policy Contract.
+ *  Determines the ACL that applies to traffic pass between two endpoint groups
+ */
+typedef struct gbp_contract_t_
+{
+  /**
+   * source and destination EPGs
+   */
+  gbp_contract_key_t gc_key;
+
+  /**
+   * The ACL to apply for packets from the source to the destination EPG
+   */
+  u32 gc_acl_index;;
+} gbp_contract_t;
+
+/**
+ * EPG src,dst pair to ACL mapping table, aka contract DB
+ */
+typedef struct gbp_contract_db_t_
+{
+  /**
+   * We can form a u64 key from the pair, so use a simple hash table
+   */
+  uword *gc_hash;
+} gbp_contract_db_t;
+
+extern void gbp_contract_update (epg_id_t src_epg,
+				 epg_id_t dst_epg, u32 acl_index);
+extern void gbp_contract_delete (epg_id_t src_epg, epg_id_t dst_epg);
+
+typedef int (*gbp_contract_cb_t) (gbp_contract_t * gbpe, void *ctx);
+extern void gbp_contract_walk (gbp_contract_cb_t bgpe, void *ctx);
+
+
+/**
+ * DP functions and databases
+ */
+extern gbp_contract_db_t gbp_contract_db;
+
+always_inline u32
+gbp_acl_lookup (gbp_contract_key_t * key)
+{
+  uword *p;
+
+  p = hash_get (gbp_contract_db.gc_hash, key->as_u64);
+
+  if (NULL != p)
+    return (p[0]);
+
+  return (~0);
+}
+
+#endif
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
diff --git a/src/plugins/gbp/gbp_endpoint.c b/src/plugins/gbp/gbp_endpoint.c
new file mode 100644
index 00000000000..91505daee2a
--- /dev/null
+++ b/src/plugins/gbp/gbp_endpoint.c
@@ -0,0 +1,393 @@
+/*
+ * gbp.h : Group Based Policy
+ *
+ * Copyright (c) 2018 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <plugins/gbp/gbp_endpoint.h>
+#include <plugins/gbp/gbp_endpoint_group.h>
+
+#include <vnet/ethernet/arp_packet.h>
+
+/**
+ * IP4 destintion address to destination EPG mapping table
+ */
+typedef struct gbp_ip4_to_epg_db_t_
+{
+  /**
+   * use a simple hash table
+   */
+  uword *g4ie_hash;
+} gbp_ip4_to_epg_db_t;
+
+static gbp_ip4_to_epg_db_t gbp_ip4_to_epg_db;
+
+/**
+ * IP6 destintion address to destination EPG mapping table
+ */
+typedef struct gbp_ip6_to_epg_db_t_
+{
+  /**
+   * use a memroy hash table
+   */
+  uword *g6ie_hash;
+} gbp_ip6_to_epg_db_t;
+
+static gbp_ip6_to_epg_db_t gbp_ip6_to_epg_db;
+
+
+const static gbp_itf_t ITF_INVALID = {
+  .gi_epg = EPG_INVALID,
+  .gi_ref_count = 0,
+};
+
+gbp_itf_to_epg_db_t gbp_itf_to_epg_db;
+
+/**
+ * Pool of GBP endpoints
+ */
+static gbp_endpoint_t *gbp_endpoint_pool;
+
+/**
+ * DB of endpoints
+ */
+static uword *gbp_endpoint_db;
+
+static void
+gbp_ip_epg_update (const ip46_address_t * ip, epg_id_t epg_id)
+{
+  /*
+   * we are dealing only with addresses here so this limited
+   * is_ip4 check is ok
+   */
+  if (ip46_address_is_ip4 (ip))
+    {
+      hash_set (gbp_ip4_to_epg_db.g4ie_hash, ip->ip4.as_u32, epg_id);
+    }
+  else
+    {
+      hash_set_mem (gbp_ip6_to_epg_db.g6ie_hash, &ip->ip6, epg_id);
+    }
+}
+
+static void
+gbp_ip_epg_delete (const ip46_address_t * ip)
+{
+  if (ip46_address_is_ip4 (ip))
+    {
+      hash_unset (gbp_ip4_to_epg_db.g4ie_hash, ip->ip4.as_u32);
+    }
+  else
+    {
+      hash_unset_mem (gbp_ip6_to_epg_db.g6ie_hash, &ip->ip6);
+    }
+}
+
+void
+gbp_itf_epg_update (u32 sw_if_index, epg_id_t src_epg, u8 do_policy)
+{
+  vec_validate_init_empty (gbp_itf_to_epg_db.gte_vec,
+			   sw_if_index, ITF_INVALID);
+
+  if (0 == gbp_itf_to_epg_db.gte_vec[sw_if_index].gi_ref_count)
+    {
+      l2input_intf_bitmap_enable (sw_if_index, L2INPUT_FEAT_GBP_SRC_CLASSIFY,
+				  1);
+      l2input_intf_bitmap_enable (sw_if_index, L2INPUT_FEAT_GBP_FWD, 1);
+      if (do_policy)
+	l2output_intf_bitmap_enable (sw_if_index, L2OUTPUT_FEAT_GBP_POLICY,
+				     1);
+    }
+  gbp_itf_to_epg_db.gte_vec[sw_if_index].gi_epg = src_epg;
+  gbp_itf_to_epg_db.gte_vec[sw_if_index].gi_ref_count++;
+}
+
+void
+gbp_itf_epg_delete (u32 sw_if_index)
+{
+  if (vec_len (gbp_itf_to_epg_db.gte_vec) <= sw_if_index)
+    return;
+
+  if (1 == gbp_itf_to_epg_db.gte_vec[sw_if_index].gi_ref_count)
+    {
+      gbp_itf_to_epg_db.gte_vec[sw_if_index].gi_epg = EPG_INVALID;
+
+      l2input_intf_bitmap_enable (sw_if_index, L2INPUT_FEAT_GBP_SRC_CLASSIFY,
+				  0);
+      l2input_intf_bitmap_enable (sw_if_index, L2INPUT_FEAT_GBP_FWD, 0);
+      l2output_intf_bitmap_enable (sw_if_index, L2OUTPUT_FEAT_GBP_POLICY, 0);
+    }
+  gbp_itf_to_epg_db.gte_vec[sw_if_index].gi_ref_count--;
+}
+
+int
+gbp_endpoint_update (u32 sw_if_index,
+		     const ip46_address_t * ip, epg_id_t epg_id)
+{
+  gbp_endpoint_key_t key = {
+    .gek_ip = *ip,
+    .gek_sw_if_index = sw_if_index,
+  };
+  gbp_endpoint_group_t *gepg;
+  gbp_endpoint_t *gbpe;
+  uword *p;
+
+  gepg = gbp_endpoint_group_find (epg_id);
+
+  if (NULL == gepg)
+    return (VNET_API_ERROR_NO_SUCH_ENTRY);
+
+  p = hash_get_mem (gbp_endpoint_db, &key);
+
+  if (p)
+    {
+      gbpe = pool_elt_at_index (gbp_endpoint_pool, p[0]);
+    }
+  else
+    {
+      pool_get (gbp_endpoint_pool, gbpe);
+
+      gbpe->ge_key = clib_mem_alloc (sizeof (gbp_endpoint_key_t));
+      clib_memcpy (gbpe->ge_key, &key, sizeof (gbp_endpoint_key_t));
+
+      hash_set_mem (gbp_endpoint_db, gbpe->ge_key, gbpe - gbp_endpoint_pool);
+    }
+
+  gbpe->ge_epg_id = epg_id;
+
+  gbp_itf_epg_update (gbpe->ge_key->gek_sw_if_index, gbpe->ge_epg_id, 1);
+
+  if (!ip46_address_is_zero (&gbpe->ge_key->gek_ip))
+    gbp_ip_epg_update (&gbpe->ge_key->gek_ip, gbpe->ge_epg_id);
+
+  /*
+   * send a gratuitous ARP on the EPG's uplink. this is done so that if
+   * this EP has moved from some other place in the 'fabric', upstream
+   * devices are informed
+   */
+  if (ip46_address_is_ip4 (&gbpe->ge_key->gek_ip))
+    send_ip4_garp_w_addr (vlib_get_main (),
+			  &gbpe->ge_key->gek_ip.ip4,
+			  vnet_get_sup_hw_interface
+			  (vnet_get_main (), gepg->gepg_uplink_sw_if_index));
+  else
+    send_ip6_na_w_addr (vlib_get_main (),
+			&gbpe->ge_key->gek_ip.ip6,
+			vnet_get_sup_hw_interface
+			(vnet_get_main (), gepg->gepg_uplink_sw_if_index));
+
+  return (0);
+}
+
+void
+gbp_endpoint_delete (u32 sw_if_index, const ip46_address_t * ip)
+{
+  gbp_endpoint_key_t key = {
+    .gek_ip = *ip,
+    .gek_sw_if_index = sw_if_index,
+  };
+  gbp_endpoint_t *gbpe;
+  uword *p;
+
+  p = hash_get_mem (gbp_endpoint_db, &key);
+
+  if (p)
+    {
+      gbpe = pool_elt_at_index (gbp_endpoint_pool, p[0]);
+
+      hash_unset_mem (gbp_endpoint_db, gbpe->ge_key);
+
+      gbp_itf_epg_delete (gbpe->ge_key->gek_sw_if_index);
+      if (!ip46_address_is_zero (&gbpe->ge_key->gek_ip))
+	gbp_ip_epg_delete (&gbpe->ge_key->gek_ip);
+
+      clib_mem_free (gbpe->ge_key);
+
+      pool_put (gbp_endpoint_pool, gbpe);
+    }
+}
+
+void
+gbp_endpoint_walk (gbp_endpoint_cb_t cb, void *ctx)
+{
+  gbp_endpoint_t *gbpe;
+
+  /* *INDENT-OFF* */
+  pool_foreach(gbpe, gbp_endpoint_pool,
+  {
+    if (!cb(gbpe, ctx))
+      break;
+  });
+  /* *INDENT-ON* */
+}
+
+static clib_error_t *
+gbp_endpoint_cli (vlib_main_t * vm,
+		  unformat_input_t * input, vlib_cli_command_t * cmd)
+{
+  vnet_main_t *vnm = vnet_get_main ();
+  epg_id_t epg_id = EPG_INVALID;
+  ip46_address_t ip = { };
+  u32 sw_if_index = ~0;
+  u8 add = 1;
+
+  while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
+    {
+      if (unformat (input, "%U", unformat_vnet_sw_interface,
+		    vnm, &sw_if_index))
+	;
+      else if (unformat (input, "add"))
+	add = 1;
+      else if (unformat (input, "del"))
+	add = 0;
+      else if (unformat (input, "epg %d", &epg_id))
+	;
+      else if (unformat (input, "ip %U", unformat_ip4_address, &ip.ip4))
+	;
+      else if (unformat (input, "ip %U", unformat_ip6_address, &ip.ip6))
+	;
+      else
+	break;
+    }
+
+  if (~0 == sw_if_index)
+    return clib_error_return (0, "interface must be specified");
+  if (EPG_INVALID == epg_id)
+    return clib_error_return (0, "EPG-ID must be specified");
+  if (ip46_address_is_zero (&ip))
+    return clib_error_return (0, "IP address must be specified");
+
+  if (add)
+    gbp_endpoint_update (sw_if_index, &ip, epg_id);
+  else
+    gbp_endpoint_delete (sw_if_index, &ip);
+
+  return (NULL);
+}
+
+
+/*?
+ * Configure a GBP Endpoint
+ *
+ * @cliexpar
+ * @cliexstart{set gbp endpoint [del] <interface> epg <ID> ip <IP>}
+ * @cliexend
+ ?*/
+/* *INDENT-OFF* */
+VLIB_CLI_COMMAND (gbp_endpoint_cli_node, static) = {
+  .path = "gbp endpoint",
+  .short_help = "gbp endpoint [del] <interface> epg <ID> ip <IP>",
+  .function = gbp_endpoint_cli,
+};
+/* *INDENT-ON* */
+
+static int
+gbp_endpoint_show_one (gbp_endpoint_t * gbpe, void *ctx)
+{
+  vnet_main_t *vnm = vnet_get_main ();
+  vlib_main_t *vm;
+
+  vm = ctx;
+  vlib_cli_output (vm, "  {%U, %U} -> %d",
+		   format_vnet_sw_if_index_name, vnm,
+		   gbpe->ge_key->gek_sw_if_index,
+		   format_ip46_address, &gbpe->ge_key->gek_ip, IP46_TYPE_ANY,
+		   gbpe->ge_epg_id);
+
+  return (1);
+}
+
+static clib_error_t *
+gbp_endpoint_show (vlib_main_t * vm,
+		   unformat_input_t * input, vlib_cli_command_t * cmd)
+{
+  vnet_main_t *vnm = vnet_get_main ();
+  ip46_address_t ip, *ipp;
+  epg_id_t epg_id;
+  u32 sw_if_index;
+
+  vlib_cli_output (vm, "Endpoints:");
+  gbp_endpoint_walk (gbp_endpoint_show_one, vm);
+
+  vlib_cli_output (vm, "\nSource interface to EPG:");
+
+  vec_foreach_index (sw_if_index, gbp_itf_to_epg_db.gte_vec)
+  {
+    if (EPG_INVALID != gbp_itf_to_epg_db.gte_vec[sw_if_index].gi_epg)
+      {
+	vlib_cli_output (vm, "  %U -> %d",
+			 format_vnet_sw_if_index_name, vnm, sw_if_index,
+			 gbp_itf_to_epg_db.gte_vec[sw_if_index].gi_epg);
+      }
+  }
+
+  vlib_cli_output (vm, "\nDestination IP4 to EPG:");
+
+  /* *INDENT-OFF* */
+  hash_foreach (ip.ip4.as_u32, epg_id, gbp_ip4_to_epg_db.g4ie_hash,
+  {
+    vlib_cli_output (vm, "  %U -> %d", format_ip46_address, &ip,
+                     IP46_TYPE_IP4, epg_id);
+  });
+  /* *INDENT-ON* */
+
+  vlib_cli_output (vm, "\nDestination IP6 to EPG:");
+
+  /* *INDENT-OFF* */
+  hash_foreach_mem (ipp, epg_id, gbp_ip6_to_epg_db.g6ie_hash,
+  {
+    vlib_cli_output (vm, "  %U -> %d", format_ip46_address, ipp,
+                     IP46_TYPE_IP6, epg_id);
+  });
+  /* *INDENT-ON* */
+
+  return (NULL);
+}
+
+
+/*?
+ * Show Group Based Policy Endpoints and derived information
+ *
+ * @cliexpar
+ * @cliexstart{show gbp endpoint}
+ * @cliexend
+ ?*/
+/* *INDENT-OFF* */
+VLIB_CLI_COMMAND (gbp_endpoint_show_node, static) = {
+  .path = "show gbp endpoint",
+  .short_help = "show gbp endpoint\n",
+  .function = gbp_endpoint_show,
+};
+/* *INDENT-ON* */
+
+static clib_error_t *
+gbp_endpoint_init (vlib_main_t * vm)
+{
+  gbp_endpoint_db = hash_create_mem (0,
+				     sizeof (gbp_endpoint_key_t),
+				     sizeof (u32));
+  gbp_ip6_to_epg_db.g6ie_hash =
+    hash_create_mem (0, sizeof (ip6_address_t), sizeof (u32));
+  return 0;
+}
+
+VLIB_INIT_FUNCTION (gbp_endpoint_init);
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
diff --git a/src/plugins/gbp/gbp_endpoint.h b/src/plugins/gbp/gbp_endpoint.h
new file mode 100644
index 00000000000..000c211cfa1
--- /dev/null
+++ b/src/plugins/gbp/gbp_endpoint.h
@@ -0,0 +1,111 @@
+/*
+ * Copyright (c) 2018 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef __GBP_ENDPOINT_H__
+#define __GBP_ENDPOINT_H__
+
+#include <plugins/gbp/gbp_types.h>
+#include <vnet/ip/ip.h>
+
+/**
+ * The key for an Endpoint
+ */
+typedef struct gbp_endpoint_key_t_
+{
+  /**
+   * The interface on which the EP is connected
+   */
+  u32 gek_sw_if_index;
+
+  /**
+   * The IP[46] address of the endpoint
+   */
+  ip46_address_t gek_ip;
+} gbp_endpoint_key_t;
+
+/**
+ * A Group Based Policy Endpoint.
+ * This is typcially a VM on the local compute node for which policy must be
+ * locally applied
+ */
+typedef struct gbp_endpoint_t_
+{
+  /**
+   * The endpoint's interface and IP address
+   */
+  gbp_endpoint_key_t *ge_key;
+
+  /**
+   * The endpoint's designated EPG
+   */
+  epg_id_t ge_epg_id;
+} gbp_endpoint_t;
+
+/**
+ * Result of a interface to EPG mapping.
+ * multiple Endpoints can occur on the same interface, so this
+ * mapping needs to be reference counted.
+ */
+typedef struct gbp_itf_t_
+{
+  epg_id_t gi_epg;
+  u32 gi_ref_count;
+} gbp_itf_t;
+
+/**
+ * Interface to source EPG DB - a per-interface vector
+ */
+typedef struct gbp_itf_to_epg_db_t_
+{
+  gbp_itf_t *gte_vec;
+} gbp_itf_to_epg_db_t;
+
+extern int gbp_endpoint_update (u32 sw_if_index,
+				const ip46_address_t * ip, epg_id_t epg_id);
+extern void gbp_endpoint_delete (u32 sw_if_index, const ip46_address_t * ip);
+
+typedef int (*gbp_endpoint_cb_t) (gbp_endpoint_t * gbpe, void *ctx);
+extern void gbp_endpoint_walk (gbp_endpoint_cb_t cb, void *ctx);
+
+/**
+ * Port to EPG mapping management
+ */
+extern void gbp_itf_epg_update (u32 sw_if_index, epg_id_t src_epg,
+				u8 do_policy);
+extern void gbp_itf_epg_delete (u32 sw_if_index);
+
+/**
+ * DP functions and databases
+ */
+extern gbp_itf_to_epg_db_t gbp_itf_to_epg_db;
+
+/**
+ * Get the source EPG for a port/interface
+ */
+always_inline u32
+gbp_port_to_epg (u32 sw_if_index)
+{
+  return (gbp_itf_to_epg_db.gte_vec[sw_if_index].gi_epg);
+}
+
+#endif
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
diff --git a/src/plugins/gbp/gbp_endpoint_group.c b/src/plugins/gbp/gbp_endpoint_group.c
new file mode 100644
index 00000000000..ed312d305a1
--- /dev/null
+++ b/src/plugins/gbp/gbp_endpoint_group.c
@@ -0,0 +1,263 @@
+/*
+ * gbp.h : Group Based Policy
+ *
+ * Copyright (c) 2018 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <plugins/gbp/gbp_endpoint_group.h>
+#include <plugins/gbp/gbp_endpoint.h>
+
+#include <vnet/dpo/dvr_dpo.h>
+#include <vnet/fib/fib_table.h>
+
+/**
+ * Pool of GBP endpoint_groups
+ */
+gbp_endpoint_group_t *gbp_endpoint_group_pool;
+
+/**
+ * DB of endpoint_groups
+ */
+gbp_endpoint_group_db_t gbp_endpoint_group_db;
+
+gbp_endpoint_group_t *
+gbp_endpoint_group_find (epg_id_t epg_id)
+{
+  uword *p;
+
+  p = hash_get (gbp_endpoint_group_db.gepg_hash, epg_id);
+
+  if (NULL != p)
+    return (pool_elt_at_index (gbp_endpoint_group_pool, p[0]));
+
+  return (NULL);
+}
+
+int
+gbp_endpoint_group_add (epg_id_t epg_id,
+			u32 bd_id,
+			u32 ip4_table_id,
+			u32 ip6_table_id, u32 uplink_sw_if_index)
+{
+  gbp_endpoint_group_t *gepg;
+
+  gepg = gbp_endpoint_group_find (epg_id);
+
+  if (NULL == gepg)
+    {
+      fib_protocol_t fproto;
+
+      pool_get (gbp_endpoint_group_pool, gepg);
+      memset (gepg, 0, sizeof (*gepg));
+
+      gepg->gepg_id = epg_id;
+      gepg->gepg_bd = bd_id;
+      gepg->gepg_rd[FIB_PROTOCOL_IP4] = ip4_table_id;
+      gepg->gepg_rd[FIB_PROTOCOL_IP6] = ip6_table_id;
+      gepg->gepg_uplink_sw_if_index = uplink_sw_if_index;
+
+      /*
+       * an egress DVR dpo for internal subnets to use when sending
+       * on the uplink interface
+       */
+      FOR_EACH_FIB_IP_PROTOCOL (fproto)
+      {
+	gepg->gepg_fib_index[fproto] =
+	  fib_table_find_or_create_and_lock (fproto,
+					     gepg->gepg_rd[fproto],
+					     FIB_SOURCE_PLUGIN_HI);
+
+	if (~0 == gepg->gepg_fib_index[fproto])
+	  {
+	    return (VNET_API_ERROR_NO_SUCH_FIB);
+	  }
+
+	dvr_dpo_add_or_lock (uplink_sw_if_index,
+			     fib_proto_to_dpo (fproto),
+			     &gepg->gepg_dpo[fproto]);
+      }
+
+      /*
+       * packets direct from the uplink have had policy applied
+       */
+      l2input_intf_bitmap_enable (gepg->gepg_uplink_sw_if_index,
+				  L2INPUT_FEAT_GBP_NULL_CLASSIFY, 1);
+
+      hash_set (gbp_endpoint_group_db.gepg_hash,
+		gepg->gepg_id, gepg - gbp_endpoint_group_pool);
+
+    }
+
+  return (0);
+}
+
+void
+gbp_endpoint_group_delete (epg_id_t epg_id)
+{
+  gbp_endpoint_group_t *gepg;
+  uword *p;
+
+  p = hash_get (gbp_endpoint_group_db.gepg_hash, epg_id);
+
+  if (NULL != p)
+    {
+      fib_protocol_t fproto;
+
+      gepg = pool_elt_at_index (gbp_endpoint_group_pool, p[0]);
+
+      l2input_intf_bitmap_enable (gepg->gepg_uplink_sw_if_index,
+				  L2INPUT_FEAT_GBP_NULL_CLASSIFY, 0);
+
+      FOR_EACH_FIB_IP_PROTOCOL (fproto)
+      {
+	dpo_reset (&gepg->gepg_dpo[fproto]);
+	fib_table_unlock (gepg->gepg_fib_index[fproto],
+			  fproto, FIB_SOURCE_PLUGIN_HI);
+      }
+
+      hash_unset (gbp_endpoint_group_db.gepg_hash, epg_id);
+
+      pool_put (gbp_endpoint_group_pool, gepg);
+    }
+}
+
+void
+gbp_endpoint_group_walk (gbp_endpoint_group_cb_t cb, void *ctx)
+{
+  gbp_endpoint_group_t *gbpe;
+
+  /* *INDENT-OFF* */
+  pool_foreach(gbpe, gbp_endpoint_group_pool,
+  {
+    if (!cb(gbpe, ctx))
+      break;
+  });
+  /* *INDENT-ON* */
+}
+
+static clib_error_t *
+gbp_endpoint_group_cli (vlib_main_t * vm,
+			unformat_input_t * input, vlib_cli_command_t * cmd)
+{
+  vnet_main_t *vnm = vnet_get_main ();
+  epg_id_t epg_id = EPG_INVALID;
+  u32 uplink_sw_if_index = ~0;
+  u32 bd_id = ~0;
+  u32 rd_id = ~0;
+  u8 add = 1;
+
+  while (unformat_check_input (input) != UNFORMAT_END_OF_INPUT)
+    {
+      if (unformat (input, "%U", unformat_vnet_sw_interface,
+		    vnm, &uplink_sw_if_index))
+	;
+      else if (unformat (input, "add"))
+	add = 1;
+      else if (unformat (input, "del"))
+	add = 0;
+      else if (unformat (input, "epg %d", &epg_id))
+	;
+      else if (unformat (input, "bd %d", &bd_id))
+	;
+      else if (unformat (input, "rd %d", &rd_id))
+	;
+      else
+	break;
+    }
+
+  if (EPG_INVALID == epg_id)
+    return clib_error_return (0, "EPG-ID must be specified");
+
+  if (add)
+    {
+      if (~0 == uplink_sw_if_index)
+	return clib_error_return (0, "interface must be specified");
+      if (~0 == bd_id)
+	return clib_error_return (0, "Bridge-domain must be specified");
+      if (~0 == rd_id)
+	return clib_error_return (0, "route-domain must be specified");
+
+      gbp_endpoint_group_add (epg_id, bd_id, rd_id, rd_id,
+			      uplink_sw_if_index);
+    }
+  else
+    gbp_endpoint_group_delete (epg_id);
+
+  return (NULL);
+}
+
+/*?
+ * Configure a GBP Endpoint Group
+ *
+ * @cliexpar
+ * @cliexstart{set gbp endpoint-group [del] epg <ID> bd <ID> <interface>}
+ * @cliexend
+ ?*/
+/* *INDENT-OFF* */
+VLIB_CLI_COMMAND (gbp_endpoint_group_cli_node, static) = {
+  .path = "gbp endpoint-group",
+  .short_help = "gbp endpoint-group [del] epg <ID> bd <ID> <interface>",
+  .function = gbp_endpoint_group_cli,
+};
+
+static int
+gbp_endpoint_group_show_one (gbp_endpoint_group_t *gepg, void *ctx)
+{
+  vnet_main_t *vnm = vnet_get_main ();
+  vlib_main_t *vm;
+
+  vm = ctx;
+  vlib_cli_output (vm, "  %d, bd:%d, ip4:%d ip6:%d uplink:%U",
+                   gepg->gepg_id,
+                   gepg->gepg_bd,
+                   gepg->gepg_rd[FIB_PROTOCOL_IP4],
+                   gepg->gepg_rd[FIB_PROTOCOL_IP6],
+		   format_vnet_sw_if_index_name, vnm, gepg->gepg_uplink_sw_if_index);
+
+  return (1);
+}
+
+static clib_error_t *
+gbp_endpoint_group_show (vlib_main_t * vm,
+		   unformat_input_t * input, vlib_cli_command_t * cmd)
+{
+  vlib_cli_output (vm, "Endpoint-Groups:");
+  gbp_endpoint_group_walk (gbp_endpoint_group_show_one, vm);
+
+  return (NULL);
+}
+
+
+/*?
+ * Show Group Based Policy Endpoint_Groups and derived information
+ *
+ * @cliexpar
+ * @cliexstart{show gbp endpoint_group}
+ * @cliexend
+ ?*/
+/* *INDENT-OFF* */
+VLIB_CLI_COMMAND (gbp_endpoint_group_show_node, static) = {
+  .path = "show gbp endpoint-group",
+  .short_help = "show gbp endpoint-group\n",
+  .function = gbp_endpoint_group_show,
+};
+/* *INDENT-ON* */
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
diff --git a/src/plugins/gbp/gbp_endpoint_group.h b/src/plugins/gbp/gbp_endpoint_group.h
new file mode 100644
index 00000000000..f71e5f5d70b
--- /dev/null
+++ b/src/plugins/gbp/gbp_endpoint_group.h
@@ -0,0 +1,132 @@
+/*
+ * Copyright (c) 2018 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef __GBP_ENDPOINT_GROUP_H__
+#define __GBP_ENDPOINT_GROUP_H__
+
+#include <plugins/gbp/gbp_types.h>
+
+#include <vnet/fib/fib_types.h>
+
+/**
+ * An Endpoint Group representation
+ */
+typedef struct gpb_endpoint_group_t_
+{
+  /**
+   * ID
+   */
+  epg_id_t gepg_id;
+
+  /**
+   * Bridge-domain ID the EPG is in
+   */
+  u32 gepg_bd;
+
+  /**
+   * route-domain/IP-table ID the EPG is in
+   */
+  u32 gepg_rd[FIB_PROTOCOL_IP_MAX];
+
+  /**
+   * resulting FIB indices
+   */
+  u32 gepg_fib_index[FIB_PROTOCOL_IP_MAX];
+
+  /**
+   * Is the EPG an external/NAT
+   */
+  u8 gepg_is_ext;
+
+  /**
+   * the uplink interface dedicated to the EPG
+   */
+  u32 gepg_uplink_sw_if_index;
+
+  /**
+   * The DPO used in the L3 path for forwarding internal subnets
+   */
+  dpo_id_t gepg_dpo[FIB_PROTOCOL_IP_MAX];
+} gbp_endpoint_group_t;
+
+/**
+ * EPG DB, key'd on EGP-ID
+ */
+typedef struct gbp_endpoint_group_db_t_
+{
+  uword *gepg_hash;
+} gbp_endpoint_group_db_t;
+
+extern int gbp_endpoint_group_add (epg_id_t epg_id,
+				   u32 bd_id,
+				   u32 ip4_table_id,
+				   u32 ip6_table_id, u32 uplink_sw_if_index);
+extern void gbp_endpoint_group_delete (epg_id_t epg_id);
+
+typedef int (*gbp_endpoint_group_cb_t) (gbp_endpoint_group_t * gbpe,
+					void *ctx);
+extern void gbp_endpoint_group_walk (gbp_endpoint_group_cb_t bgpe, void *ctx);
+
+extern gbp_endpoint_group_t *gbp_endpoint_group_find (epg_id_t epg_id);
+
+/**
+ * DP functions and databases
+ */
+extern gbp_endpoint_group_db_t gbp_endpoint_group_db;
+extern gbp_endpoint_group_t *gbp_endpoint_group_pool;
+
+always_inline u32
+gbp_epg_itf_lookup (epg_id_t epg)
+{
+  uword *p;
+
+  p = hash_get (gbp_endpoint_group_db.gepg_hash, epg);
+
+  if (NULL != p)
+    {
+      gbp_endpoint_group_t *gepg;
+
+      gepg = pool_elt_at_index (gbp_endpoint_group_pool, p[0]);
+      return (gepg->gepg_uplink_sw_if_index);
+    }
+  return (~0);
+}
+
+always_inline const dpo_id_t *
+gbp_epg_dpo_lookup (epg_id_t epg, fib_protocol_t fproto)
+{
+  uword *p;
+
+  p = hash_get (gbp_endpoint_group_db.gepg_hash, epg);
+
+  if (NULL != p)
+    {
+      gbp_endpoint_group_t *gepg;
+
+      gepg = pool_elt_at_index (gbp_endpoint_group_pool, p[0]);
+      return (&gepg->gepg_dpo[fproto]);
+    }
+  return (NULL);
+}
+
+#endif
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
diff --git a/src/plugins/gbp/gbp_fwd.c b/src/plugins/gbp/gbp_fwd.c
new file mode 100644
index 00000000000..fec5703d014
--- /dev/null
+++ b/src/plugins/gbp/gbp_fwd.c
@@ -0,0 +1,195 @@
+/*
+ * Copyright (c) 2018 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <plugins/gbp/gbp.h>
+
+/**
+ * Grouping of global data for the GBP source EPG classification feature
+ */
+typedef struct gbp_fwd_main_t_
+{
+  /**
+   * Next nodes for L2 output features
+   */
+  u32 l2_input_feat_next[32];
+} gbp_fwd_main_t;
+
+static gbp_fwd_main_t gbp_fwd_main;
+
+#define foreach_gbp_fwd                      \
+  _(DROP,    "drop")                         \
+  _(OUTPUT,  "output")
+
+typedef enum
+{
+#define _(sym,str) GBP_FWD_ERROR_##sym,
+  foreach_gbp_fwd
+#undef _
+    GBP_FWD_N_ERROR,
+} gbp_fwd_error_t;
+
+static char *gbp_fwd_error_strings[] = {
+#define _(sym,string) string,
+  foreach_gbp_fwd
+#undef _
+};
+
+typedef enum
+{
+#define _(sym,str) GBP_FWD_NEXT_##sym,
+  foreach_gbp_fwd
+#undef _
+    GBP_FWD_N_NEXT,
+} gbp_fwd_next_t;
+
+/**
+ * per-packet trace data
+ */
+typedef struct gbp_fwd_trace_t_
+{
+  /* per-pkt trace data */
+  epg_id_t src_epg;
+  u32 sw_if_index;
+} gbp_fwd_trace_t;
+
+static uword
+gbp_fwd (vlib_main_t * vm, vlib_node_runtime_t * node, vlib_frame_t * frame)
+{
+  u32 n_left_from, *from, *to_next;
+  u32 next_index;
+
+  next_index = 0;
+  n_left_from = frame->n_vectors;
+  from = vlib_frame_vector_args (frame);
+
+  while (n_left_from > 0)
+    {
+      u32 n_left_to_next;
+
+      vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
+
+      while (n_left_from > 0 && n_left_to_next > 0)
+	{
+	  u32 bi0, sw_if_index0, src_epg;
+	  gbp_fwd_next_t next0;
+	  vlib_buffer_t *b0;
+
+	  next0 = GBP_FWD_NEXT_DROP;
+	  bi0 = from[0];
+	  to_next[0] = bi0;
+	  from += 1;
+	  to_next += 1;
+	  n_left_from -= 1;
+	  n_left_to_next -= 1;
+
+	  b0 = vlib_get_buffer (vm, bi0);
+
+	  /*
+	   * lookup the uplink based on src EPG
+	   */
+	  src_epg = vnet_buffer2 (b0)->gbp.src_epg;
+
+	  sw_if_index0 = gbp_epg_itf_lookup (src_epg);
+
+	  if (~0 != sw_if_index0)
+	    {
+	      vnet_buffer (b0)->sw_if_index[VLIB_TX] = sw_if_index0;
+
+	      next0 = GBP_FWD_NEXT_OUTPUT;
+	    }
+	  /*
+	   * else
+	   *  don't know the uplink interface for this EPG => drop
+	   */
+
+	  if (PREDICT_FALSE ((b0->flags & VLIB_BUFFER_IS_TRACED)))
+	    {
+	      gbp_fwd_trace_t *t = vlib_add_trace (vm, node, b0, sizeof (*t));
+	      t->src_epg = src_epg;
+	      t->sw_if_index = sw_if_index0;
+	    }
+
+	  /* verify speculative enqueue, maybe switch current next frame */
+	  vlib_validate_buffer_enqueue_x1 (vm, node, next_index,
+					   to_next, n_left_to_next,
+					   bi0, next0);
+	}
+
+      vlib_put_next_frame (vm, node, next_index, n_left_to_next);
+    }
+
+  return frame->n_vectors;
+}
+
+/* packet trace format function */
+static u8 *
+format_gbp_fwd_trace (u8 * s, va_list * args)
+{
+  CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
+  CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
+  gbp_fwd_trace_t *t = va_arg (*args, gbp_fwd_trace_t *);
+
+  s = format (s, "src-epg:%d", t->src_epg);
+
+  return s;
+}
+
+/* *INDENT-OFF* */
+VLIB_REGISTER_NODE (gbp_fwd_node) = {
+  .function = gbp_fwd,
+  .name = "gbp-fwd",
+  .vector_size = sizeof (u32),
+  .format_trace = format_gbp_fwd_trace,
+  .type = VLIB_NODE_TYPE_INTERNAL,
+
+  .n_errors = ARRAY_LEN(gbp_fwd_error_strings),
+  .error_strings = gbp_fwd_error_strings,
+
+  .n_next_nodes = GBP_FWD_N_NEXT,
+
+  .next_nodes = {
+    [GBP_FWD_NEXT_DROP] = "error-drop",
+    [GBP_FWD_NEXT_OUTPUT] = "l2-output",
+  },
+};
+
+VLIB_NODE_FUNCTION_MULTIARCH (gbp_fwd_node, gbp_fwd);
+
+/* *INDENT-ON* */
+
+static clib_error_t *
+gbp_fwd_init (vlib_main_t * vm)
+{
+  gbp_fwd_main_t *gpm = &gbp_fwd_main;
+
+  /* Initialize the feature next-node indices */
+  feat_bitmap_init_next_nodes (vm,
+			       gbp_fwd_node.index,
+			       L2INPUT_N_FEAT,
+			       l2input_get_feat_names (),
+			       gpm->l2_input_feat_next);
+
+  return 0;
+}
+
+VLIB_INIT_FUNCTION (gbp_fwd_init);
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
diff --git a/src/plugins/gbp/gbp_fwd_dpo.c b/src/plugins/gbp/gbp_fwd_dpo.c
new file mode 100644
index 00000000000..e3dba5fa527
--- /dev/null
+++ b/src/plugins/gbp/gbp_fwd_dpo.c
@@ -0,0 +1,308 @@
+/*
+ * Copyright (c) 2018 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <plugins/gbp/gbp.h>
+#include <plugins/gbp/gbp_fwd_dpo.h>
+
+#include <vnet/ethernet/ethernet.h>
+
+/**
+ * The 'DB' of GBP FWD DPOs.
+ * There is one per-proto
+ */
+static index_t gbp_fwd_dpo_db[DPO_PROTO_NUM] = { INDEX_INVALID };
+
+/**
+ * DPO type registered for these GBP FWD
+ */
+static dpo_type_t gbp_fwd_dpo_type;
+
+/**
+ * @brief pool of all interface DPOs
+ */
+gbp_fwd_dpo_t *gbp_fwd_dpo_pool;
+
+static gbp_fwd_dpo_t *
+gbp_fwd_dpo_alloc (void)
+{
+  gbp_fwd_dpo_t *gfd;
+
+  pool_get (gbp_fwd_dpo_pool, gfd);
+
+  return (gfd);
+}
+
+static inline gbp_fwd_dpo_t *
+gbp_fwd_dpo_get_from_dpo (const dpo_id_t * dpo)
+{
+  ASSERT (gbp_fwd_dpo_type == dpo->dpoi_type);
+
+  return (gbp_fwd_dpo_get (dpo->dpoi_index));
+}
+
+static inline index_t
+gbp_fwd_dpo_get_index (gbp_fwd_dpo_t * gfd)
+{
+  return (gfd - gbp_fwd_dpo_pool);
+}
+
+static void
+gbp_fwd_dpo_lock (dpo_id_t * dpo)
+{
+  gbp_fwd_dpo_t *gfd;
+
+  gfd = gbp_fwd_dpo_get_from_dpo (dpo);
+  gfd->gfd_locks++;
+}
+
+static void
+gbp_fwd_dpo_unlock (dpo_id_t * dpo)
+{
+  gbp_fwd_dpo_t *gfd;
+
+  gfd = gbp_fwd_dpo_get_from_dpo (dpo);
+  gfd->gfd_locks--;
+
+  if (0 == gfd->gfd_locks)
+    {
+      gbp_fwd_dpo_db[gfd->gfd_proto] = INDEX_INVALID;
+      pool_put (gbp_fwd_dpo_pool, gfd);
+    }
+}
+
+void
+gbp_fwd_dpo_add_or_lock (dpo_proto_t dproto, dpo_id_t * dpo)
+{
+  gbp_fwd_dpo_t *gfd;
+
+  if (INDEX_INVALID == gbp_fwd_dpo_db[dproto])
+    {
+      gfd = gbp_fwd_dpo_alloc ();
+
+      gfd->gfd_proto = dproto;
+
+      gbp_fwd_dpo_db[dproto] = gbp_fwd_dpo_get_index (gfd);
+    }
+  else
+    {
+      gfd = gbp_fwd_dpo_get (gbp_fwd_dpo_db[dproto]);
+    }
+
+  dpo_set (dpo, gbp_fwd_dpo_type, dproto, gbp_fwd_dpo_get_index (gfd));
+}
+
+u8 *
+format_gbp_fwd_dpo (u8 * s, va_list * ap)
+{
+  index_t index = va_arg (*ap, index_t);
+  CLIB_UNUSED (u32 indent) = va_arg (*ap, u32);
+  gbp_fwd_dpo_t *gfd = gbp_fwd_dpo_get (index);
+
+  return (format (s, "gbp-fwd-dpo: %U", format_dpo_proto, gfd->gfd_proto));
+}
+
+const static dpo_vft_t gbp_fwd_dpo_vft = {
+  .dv_lock = gbp_fwd_dpo_lock,
+  .dv_unlock = gbp_fwd_dpo_unlock,
+  .dv_format = format_gbp_fwd_dpo,
+};
+
+/**
+ * @brief The per-protocol VLIB graph nodes that are assigned to a glean
+ *        object.
+ *
+ * this means that these graph nodes are ones from which a glean is the
+ * parent object in the DPO-graph.
+ */
+const static char *const gbp_fwd_dpo_ip4_nodes[] = {
+  "ip4-gbp-fwd-dpo",
+  NULL,
+};
+
+const static char *const gbp_fwd_dpo_ip6_nodes[] = {
+  "ip6-gbp-fwd-dpo",
+  NULL,
+};
+
+const static char *const *const gbp_fwd_dpo_nodes[DPO_PROTO_NUM] = {
+  [DPO_PROTO_IP4] = gbp_fwd_dpo_ip4_nodes,
+  [DPO_PROTO_IP6] = gbp_fwd_dpo_ip6_nodes,
+};
+
+dpo_type_t
+gbp_fwd_dpo_get_type (void)
+{
+  return (gbp_fwd_dpo_type);
+}
+
+static clib_error_t *
+gbp_fwd_dpo_module_init (vlib_main_t * vm)
+{
+  dpo_proto_t dproto;
+
+  FOR_EACH_DPO_PROTO (dproto)
+  {
+    gbp_fwd_dpo_db[dproto] = INDEX_INVALID;
+  }
+
+  gbp_fwd_dpo_type = dpo_register_new_type (&gbp_fwd_dpo_vft,
+					    gbp_fwd_dpo_nodes);
+
+  return (NULL);
+}
+
+VLIB_INIT_FUNCTION (gbp_fwd_dpo_module_init);
+
+typedef struct gbp_fwd_dpo_trace_t_
+{
+  u32 src_epg;
+  u32 dpo_index;
+} gbp_fwd_dpo_trace_t;
+
+typedef enum
+{
+  GBP_FWD_DROP,
+  GBP_FWD_FWD,
+  GBP_FWD_N_NEXT,
+} gbp_fwd_next_t;
+
+always_inline uword
+gbp_fwd_dpo_inline (vlib_main_t * vm,
+		    vlib_node_runtime_t * node,
+		    vlib_frame_t * from_frame, fib_protocol_t fproto)
+{
+  u32 n_left_from, next_index, *from, *to_next;
+
+  from = vlib_frame_vector_args (from_frame);
+  n_left_from = from_frame->n_vectors;
+
+  next_index = node->cached_next_index;
+
+  while (n_left_from > 0)
+    {
+      u32 n_left_to_next;
+
+      vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
+
+      while (n_left_from > 0 && n_left_to_next > 0)
+	{
+	  const dpo_id_t *next_dpo0;
+	  vlib_buffer_t *b0;
+	  epg_id_t src_epg0;
+	  u32 bi0, next0;
+
+	  bi0 = from[0];
+	  to_next[0] = bi0;
+	  from += 1;
+	  to_next += 1;
+	  n_left_from -= 1;
+	  n_left_to_next -= 1;
+
+	  b0 = vlib_get_buffer (vm, bi0);
+
+	  src_epg0 = vnet_buffer2 (b0)->gbp.src_epg;
+	  next_dpo0 = gbp_epg_dpo_lookup (src_epg0, fproto);
+
+	  if (PREDICT_TRUE (NULL != next_dpo0))
+	    {
+	      vnet_buffer (b0)->ip.adj_index[VLIB_TX] = next_dpo0->dpoi_index;
+	      next0 = GBP_FWD_FWD;
+	    }
+	  else
+	    {
+	      next0 = GBP_FWD_DROP;
+	    }
+
+	  if (PREDICT_FALSE (b0->flags & VLIB_BUFFER_IS_TRACED))
+	    {
+	      gbp_fwd_dpo_trace_t *tr;
+
+	      tr = vlib_add_trace (vm, node, b0, sizeof (*tr));
+	      tr->src_epg = src_epg0;
+	      tr->dpo_index = (NULL != next_dpo0 ?
+			       next_dpo0->dpoi_index : ~0);
+	    }
+
+	  vlib_validate_buffer_enqueue_x1 (vm, node, next_index, to_next,
+					   n_left_to_next, bi0, next0);
+	}
+      vlib_put_next_frame (vm, node, next_index, n_left_to_next);
+    }
+  return from_frame->n_vectors;
+}
+
+static u8 *
+format_gbp_fwd_dpo_trace (u8 * s, va_list * args)
+{
+  CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
+  CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
+  gbp_fwd_dpo_trace_t *t = va_arg (*args, gbp_fwd_dpo_trace_t *);
+
+  s = format (s, " epg:%d dpo:%d", t->src_epg, t->dpo_index);
+
+  return s;
+}
+
+static uword
+ip4_gbp_fwd_dpo (vlib_main_t * vm,
+		 vlib_node_runtime_t * node, vlib_frame_t * from_frame)
+{
+  return (gbp_fwd_dpo_inline (vm, node, from_frame, FIB_PROTOCOL_IP4));
+}
+
+static uword
+ip6_gbp_fwd_dpo (vlib_main_t * vm,
+		 vlib_node_runtime_t * node, vlib_frame_t * from_frame)
+{
+  return (gbp_fwd_dpo_inline (vm, node, from_frame, FIB_PROTOCOL_IP6));
+}
+
+/* *INDENT-OFF* */
+VLIB_REGISTER_NODE (ip4_gbp_fwd_dpo_node) = {
+    .function = ip4_gbp_fwd_dpo,
+    .name = "ip4-gbp-fwd-dpo",
+    .vector_size = sizeof (u32),
+    .format_trace = format_gbp_fwd_dpo_trace,
+    .n_next_nodes = GBP_FWD_N_NEXT,
+    .next_nodes =
+    {
+        [GBP_FWD_DROP] = "ip4-drop",
+        [GBP_FWD_FWD] = "ip4-dvr-dpo",
+    }
+};
+VLIB_REGISTER_NODE (ip6_gbp_fwd_dpo_node) = {
+    .function = ip6_gbp_fwd_dpo,
+    .name = "ip6-gbp-fwd-dpo",
+    .vector_size = sizeof (u32),
+    .format_trace = format_gbp_fwd_dpo_trace,
+    .n_next_nodes = GBP_FWD_N_NEXT,
+    .next_nodes =
+    {
+        [GBP_FWD_DROP] = "ip6-drop",
+        [GBP_FWD_FWD] = "ip6-dvr-dpo",
+    }
+};
+
+VLIB_NODE_FUNCTION_MULTIARCH (ip4_gbp_fwd_dpo_node, ip4_gbp_fwd_dpo)
+VLIB_NODE_FUNCTION_MULTIARCH (ip6_gbp_fwd_dpo_node, ip6_gbp_fwd_dpo)
+/* *INDENT-ON* */
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
diff --git a/src/plugins/gbp/gbp_fwd_dpo.h b/src/plugins/gbp/gbp_fwd_dpo.h
new file mode 100644
index 00000000000..6092d6241b5
--- /dev/null
+++ b/src/plugins/gbp/gbp_fwd_dpo.h
@@ -0,0 +1,62 @@
+/*
+ * Copyright (c) 2018 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef __GBP_FWD_DPO_H__
+#define __GBP_FWD_DPO_H__
+
+#include <vnet/dpo/dpo.h>
+
+/**
+ * @brief
+ * The GBP FWD DPO. Used in the L3 path to select the correct EPG uplink
+ * based on the source EPG.
+ */
+typedef struct gbp_fwd_dpo_t_
+{
+  /**
+   * The protocol of packets using this DPO
+   */
+  dpo_proto_t gfd_proto;
+
+  /**
+   * number of locks.
+   */
+  u16 gfd_locks;
+} gbp_fwd_dpo_t;
+
+extern void gbp_fwd_dpo_add_or_lock (dpo_proto_t dproto, dpo_id_t * dpo);
+
+extern dpo_type_t gbp_fwd_dpo_get_type (void);
+
+/**
+ * @brief pool of all interface DPOs
+ */
+extern gbp_fwd_dpo_t *gbp_fwd_dpo_pool;
+
+static inline gbp_fwd_dpo_t *
+gbp_fwd_dpo_get (index_t index)
+{
+  return (pool_elt_at_index (gbp_fwd_dpo_pool, index));
+}
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
+
+#endif
diff --git a/src/plugins/gbp/gbp_msg_enum.h b/src/plugins/gbp/gbp_msg_enum.h
index 6f134a84027..c6f34f92005 100644
--- a/src/plugins/gbp/gbp_msg_enum.h
+++ b/src/plugins/gbp/gbp_msg_enum.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2016 Cisco and/or its affiliates.
+ * Copyright (c) 2018 Cisco and/or its affiliates.
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at:
diff --git a/src/plugins/gbp/gbp_policy.c b/src/plugins/gbp/gbp_policy.c
new file mode 100644
index 00000000000..8f3fc76a019
--- /dev/null
+++ b/src/plugins/gbp/gbp_policy.c
@@ -0,0 +1,231 @@
+/*
+ * Copyright (c) 2018 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <plugins/gbp/gbp.h>
+
+/**
+ * Grouping of global data for the GBP source EPG classification feature
+ */
+typedef struct gbp_policy_main_t_
+{
+  /**
+   * Next nodes for L2 output features
+   */
+  u32 l2_output_feat_next[32];
+} gbp_policy_main_t;
+
+static gbp_policy_main_t gbp_policy_main;
+
+#define foreach_gbp_policy                      \
+  _(DENY,    "deny")
+
+typedef enum
+{
+#define _(sym,str) GBP_ERROR_##sym,
+  foreach_gbp_policy
+#undef _
+    GBP_POLICY_N_ERROR,
+} gbp_policy_error_t;
+
+static char *gbp_policy_error_strings[] = {
+#define _(sym,string) string,
+  foreach_gbp_policy
+#undef _
+};
+
+typedef enum
+{
+#define _(sym,str) GBP_POLICY_NEXT_##sym,
+  foreach_gbp_policy
+#undef _
+    GBP_POLICY_N_NEXT,
+} gbp_policy_next_t;
+
+/**
+ * per-packet trace data
+ */
+typedef struct gbp_policy_trace_t_
+{
+  /* per-pkt trace data */
+  epg_id_t src_epg;
+  epg_id_t dst_epg;
+  u32 acl_index;
+} gbp_policy_trace_t;
+
+static uword
+gbp_policy (vlib_main_t * vm,
+	    vlib_node_runtime_t * node, vlib_frame_t * frame)
+{
+  gbp_policy_main_t *gpm = &gbp_policy_main;
+  u32 n_left_from, *from, *to_next;
+  u32 next_index;
+
+  next_index = 0;
+  n_left_from = frame->n_vectors;
+  from = vlib_frame_vector_args (frame);
+
+  while (n_left_from > 0)
+    {
+      u32 n_left_to_next;
+
+      vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
+
+      while (n_left_from > 0 && n_left_to_next > 0)
+	{
+	  gbp_policy_next_t next0;
+	  gbp_contract_key_t key0;
+	  u32 bi0, sw_if_index0;
+	  vlib_buffer_t *b0;
+	  u32 acl_index0;
+
+	  next0 = GBP_POLICY_NEXT_DENY;
+	  bi0 = from[0];
+	  to_next[0] = bi0;
+	  from += 1;
+	  to_next += 1;
+	  n_left_from -= 1;
+	  n_left_to_next -= 1;
+
+	  b0 = vlib_get_buffer (vm, bi0);
+
+	  /*
+	   * determine the src and dst EPG
+	   */
+	  sw_if_index0 = vnet_buffer (b0)->sw_if_index[VLIB_TX];
+	  key0.gck_dst = gbp_port_to_epg (sw_if_index0);
+	  key0.gck_src = vnet_buffer2 (b0)->gbp.src_epg;
+	  acl_index0 = ~0;
+
+	  if (~0 != key0.gck_src)
+	    {
+	      if (PREDICT_FALSE (key0.gck_src == key0.gck_dst))
+		{
+		  /*
+		   * intra-epg allowed
+		   */
+		  next0 = vnet_l2_feature_next (b0, gpm->l2_output_feat_next,
+						L2OUTPUT_FEAT_GBP_POLICY);
+		}
+	      else
+		{
+		  acl_index0 = gbp_acl_lookup (&key0);
+
+		  if (~0 != acl_index0)
+		    {
+		      /*
+		       * TODO tests against the ACL
+		       */
+		      /*
+		       * ACL tables are not available outside of ACL plugin
+		       * until then bypass the ACL to next node
+		       */
+		      next0 =
+			vnet_l2_feature_next (b0, gpm->l2_output_feat_next,
+					      L2OUTPUT_FEAT_GBP_POLICY);
+		    }
+		}
+	    }
+	  else
+	    {
+	      /*
+	       * the src EPG is not set when the packet arrives on an EPG
+	       * uplink interface and we do not need to apply policy
+	       */
+	      next0 = vnet_l2_feature_next (b0, gpm->l2_output_feat_next,
+					    L2OUTPUT_FEAT_GBP_POLICY);
+	    }
+
+	  if (PREDICT_FALSE ((b0->flags & VLIB_BUFFER_IS_TRACED)))
+	    {
+	      gbp_policy_trace_t *t =
+		vlib_add_trace (vm, node, b0, sizeof (*t));
+	      t->src_epg = key0.gck_src;
+	      t->dst_epg = key0.gck_dst;
+	      t->acl_index = acl_index0;
+	    }
+
+	  /* verify speculative enqueue, maybe switch current next frame */
+	  vlib_validate_buffer_enqueue_x1 (vm, node, next_index,
+					   to_next, n_left_to_next,
+					   bi0, next0);
+	}
+
+      vlib_put_next_frame (vm, node, next_index, n_left_to_next);
+    }
+
+  return frame->n_vectors;
+}
+
+/* packet trace format function */
+static u8 *
+format_gbp_policy_trace (u8 * s, va_list * args)
+{
+  CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
+  CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
+  gbp_policy_trace_t *t = va_arg (*args, gbp_policy_trace_t *);
+
+  s =
+    format (s, "src:%d, dst:%d, acl:%d", t->src_epg, t->dst_epg,
+	    t->acl_index);
+
+  return s;
+}
+
+/* *INDENT-OFF* */
+VLIB_REGISTER_NODE (gbp_policy_node) = {
+  .function = gbp_policy,
+  .name = "gbp-policy",
+  .vector_size = sizeof (u32),
+  .format_trace = format_gbp_policy_trace,
+  .type = VLIB_NODE_TYPE_INTERNAL,
+
+  .n_errors = ARRAY_LEN(gbp_policy_error_strings),
+  .error_strings = gbp_policy_error_strings,
+
+  .n_next_nodes = GBP_POLICY_N_NEXT,
+
+  .next_nodes = {
+    [GBP_POLICY_NEXT_DENY] = "error-drop",
+  },
+};
+
+VLIB_NODE_FUNCTION_MULTIARCH (gbp_policy_node, gbp_policy);
+
+/* *INDENT-ON* */
+
+static clib_error_t *
+gbp_policy_init (vlib_main_t * vm)
+{
+  gbp_policy_main_t *gpm = &gbp_policy_main;
+
+  /* Initialize the feature next-node indexes */
+  feat_bitmap_init_next_nodes (vm,
+			       gbp_policy_node.index,
+			       L2OUTPUT_N_FEAT,
+			       l2output_get_feat_names (),
+			       gpm->l2_output_feat_next);
+
+  return 0;
+}
+
+VLIB_INIT_FUNCTION (gbp_policy_init);
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
diff --git a/src/plugins/gbp/gbp_policy_dpo.c b/src/plugins/gbp/gbp_policy_dpo.c
new file mode 100644
index 00000000000..bfe5974f807
--- /dev/null
+++ b/src/plugins/gbp/gbp_policy_dpo.c
@@ -0,0 +1,537 @@
+/*
+ * Copyright (c) 2018 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <plugins/gbp/gbp.h>
+#include <plugins/gbp/gbp_policy_dpo.h>
+#include <plugins/gbp/gbp_recirc.h>
+
+#include <vnet/dpo/dvr_dpo.h>
+#include <vnet/fib/ip4_fib.h>
+#include <vnet/fib/ip6_fib.h>
+#include <vnet/dpo/load_balance.h>
+
+/**
+ * DPO pool
+ */
+static gbp_policy_dpo_t *gbp_policy_dpo_pool;
+
+/**
+ * DPO type registered for these GBP FWD
+ */
+static dpo_type_t gbp_policy_dpo_type;
+
+static inline gbp_policy_dpo_t *
+gbp_policy_dpo_get_i (index_t index)
+{
+  return (pool_elt_at_index (gbp_policy_dpo_pool, index));
+}
+
+gbp_policy_dpo_t *
+gbp_policy_dpo_get (index_t index)
+{
+  return (gbp_policy_dpo_get_i (index));
+}
+
+static gbp_policy_dpo_t *
+gbp_policy_dpo_alloc (void)
+{
+  gbp_policy_dpo_t *gpd;
+
+  pool_get (gbp_policy_dpo_pool, gpd);
+
+  return (gpd);
+}
+
+static inline gbp_policy_dpo_t *
+gbp_policy_dpo_get_from_dpo (const dpo_id_t * dpo)
+{
+  ASSERT (gbp_policy_dpo_type == dpo->dpoi_type);
+
+  return (gbp_policy_dpo_get_i (dpo->dpoi_index));
+}
+
+static inline index_t
+gbp_policy_dpo_get_index (gbp_policy_dpo_t * gpd)
+{
+  return (gpd - gbp_policy_dpo_pool);
+}
+
+static void
+gbp_policy_dpo_lock (dpo_id_t * dpo)
+{
+  gbp_policy_dpo_t *gpd;
+
+  gpd = gbp_policy_dpo_get_from_dpo (dpo);
+  gpd->gpd_locks++;
+}
+
+static void
+gbp_policy_dpo_unlock (dpo_id_t * dpo)
+{
+  gbp_policy_dpo_t *gpd;
+
+  gpd = gbp_policy_dpo_get_from_dpo (dpo);
+  gpd->gpd_locks--;
+
+  if (0 == gpd->gpd_locks)
+    {
+      dpo_reset (&gpd->gpd_dpo);
+      pool_put (gbp_policy_dpo_pool, gpd);
+    }
+}
+
+void
+gbp_policy_dpo_add_or_lock (dpo_proto_t dproto,
+			    epg_id_t epg, u32 sw_if_index, dpo_id_t * dpo)
+{
+  gbp_policy_dpo_t *gpd;
+  dpo_id_t parent = DPO_INVALID;
+
+  gpd = gbp_policy_dpo_alloc ();
+  memset (gpd, 0, sizeof (*gpd));
+
+  gpd->gpd_proto = dproto;
+  gpd->gpd_sw_if_index = sw_if_index;
+  gpd->gpd_epg = epg;
+
+  /*
+   * stack on the DVR DPO for the output interface
+   */
+  dvr_dpo_add_or_lock (sw_if_index, dproto, &parent);
+
+  dpo_stack (gbp_policy_dpo_type, dproto, &gpd->gpd_dpo, &parent);
+
+  dpo_set (dpo, gbp_policy_dpo_type, dproto, gbp_policy_dpo_get_index (gpd));
+}
+
+u8 *
+format_gbp_policy_dpo (u8 * s, va_list * ap)
+{
+  index_t index = va_arg (*ap, index_t);
+  u32 indent = va_arg (*ap, u32);
+  gbp_policy_dpo_t *gpd = gbp_policy_dpo_get_i (index);
+  vnet_main_t *vnm = vnet_get_main ();
+
+  s = format (s, "gbp-policy-dpo: %U, epg:%d out:%U",
+	      format_dpo_proto, gpd->gpd_proto,
+	      gpd->gpd_epg,
+	      format_vnet_sw_if_index_name, vnm, gpd->gpd_sw_if_index);
+  s = format (s, "\n%U", format_white_space, indent + 2);
+  s = format (s, "%U", format_dpo_id, &gpd->gpd_dpo, indent + 4);
+
+  return (s);
+}
+
+const static dpo_vft_t gbp_policy_dpo_vft = {
+  .dv_lock = gbp_policy_dpo_lock,
+  .dv_unlock = gbp_policy_dpo_unlock,
+  .dv_format = format_gbp_policy_dpo,
+};
+
+/**
+ * @brief The per-protocol VLIB graph nodes that are assigned to a glean
+ *        object.
+ *
+ * this means that these graph nodes are ones from which a glean is the
+ * parent object in the DPO-graph.
+ */
+const static char *const gbp_policy_dpo_ip4_nodes[] = {
+  "ip4-gbp-policy-dpo",
+  NULL,
+};
+
+const static char *const gbp_policy_dpo_ip6_nodes[] = {
+  "ip6-gbp-policy-dpo",
+  NULL,
+};
+
+const static char *const *const gbp_policy_dpo_nodes[DPO_PROTO_NUM] = {
+  [DPO_PROTO_IP4] = gbp_policy_dpo_ip4_nodes,
+  [DPO_PROTO_IP6] = gbp_policy_dpo_ip6_nodes,
+};
+
+dpo_type_t
+gbp_policy_dpo_get_type (void)
+{
+  return (gbp_policy_dpo_type);
+}
+
+static clib_error_t *
+gbp_policy_dpo_module_init (vlib_main_t * vm)
+{
+  gbp_policy_dpo_type = dpo_register_new_type (&gbp_policy_dpo_vft,
+					       gbp_policy_dpo_nodes);
+
+  return (NULL);
+}
+
+VLIB_INIT_FUNCTION (gbp_policy_dpo_module_init);
+
+typedef struct gbp_policy_dpo_trace_t_
+{
+  u32 src_epg;
+  u32 dst_epg;
+  u32 acl_index;
+} gbp_policy_dpo_trace_t;
+
+typedef enum
+{
+  GBP_POLICY_DROP,
+  GBP_POLICY_N_NEXT,
+} gbp_policy_next_t;
+
+always_inline uword
+gbp_policy_dpo_inline (vlib_main_t * vm,
+		       vlib_node_runtime_t * node,
+		       vlib_frame_t * from_frame, fib_protocol_t fproto)
+{
+  u32 n_left_from, next_index, *from, *to_next;
+
+  from = vlib_frame_vector_args (from_frame);
+  n_left_from = from_frame->n_vectors;
+
+  next_index = node->cached_next_index;
+
+  while (n_left_from > 0)
+    {
+      u32 n_left_to_next;
+
+      vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
+
+      while (n_left_from > 0 && n_left_to_next > 0)
+	{
+	  const gbp_policy_dpo_t *gpd0;
+	  u32 bi0, next0, acl_index0;
+	  gbp_contract_key_t key0;
+	  vlib_buffer_t *b0;
+
+	  bi0 = from[0];
+	  to_next[0] = bi0;
+	  from += 1;
+	  to_next += 1;
+	  n_left_from -= 1;
+	  n_left_to_next -= 1;
+	  next0 = GBP_POLICY_DROP;
+	  acl_index0 = ~0;
+
+	  b0 = vlib_get_buffer (vm, bi0);
+	  gpd0 =
+	    gbp_policy_dpo_get_i (vnet_buffer (b0)->ip.adj_index[VLIB_TX]);
+	  vnet_buffer (b0)->ip.adj_index[VLIB_TX] = gpd0->gpd_dpo.dpoi_index;
+
+	  key0.gck_src = vnet_buffer2 (b0)->gbp.src_epg;
+	  key0.gck_dst = gpd0->gpd_epg;
+
+	  if (~0 != key0.gck_src)
+	    {
+	      if (PREDICT_FALSE (key0.gck_src == key0.gck_dst))
+		{
+		  /*
+		   * intra-epg allowed
+		   */
+		  next0 = gpd0->gpd_dpo.dpoi_next_node;
+		}
+	      else
+		{
+		  acl_index0 = gbp_acl_lookup (&key0);
+
+		  if (~0 != acl_index0)
+		    {
+		      /*
+		       * TODO tests against the ACL
+		       */
+		      /*
+		       * ACL tables are not available outside of ACL plugin
+		       * until then bypass the ACL to next node
+		       */
+		      next0 = gpd0->gpd_dpo.dpoi_next_node;
+		    }
+		}
+	    }
+	  else
+	    {
+	      /*
+	       * the src EPG is not set when the packet arrives on an EPG
+	       * uplink interface and we do not need to apply policy
+	       */
+	      next0 = gpd0->gpd_dpo.dpoi_next_node;
+	    }
+
+	  if (PREDICT_FALSE (b0->flags & VLIB_BUFFER_IS_TRACED))
+	    {
+	      gbp_policy_dpo_trace_t *tr;
+
+	      tr = vlib_add_trace (vm, node, b0, sizeof (*tr));
+	      tr->src_epg = key0.gck_src;
+	      tr->dst_epg = key0.gck_dst;
+	      tr->acl_index = acl_index0;
+	    }
+
+	  vlib_validate_buffer_enqueue_x1 (vm, node, next_index, to_next,
+					   n_left_to_next, bi0, next0);
+	}
+      vlib_put_next_frame (vm, node, next_index, n_left_to_next);
+    }
+  return from_frame->n_vectors;
+}
+
+static u8 *
+format_gbp_policy_dpo_trace (u8 * s, va_list * args)
+{
+  CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
+  CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
+  gbp_policy_dpo_trace_t *t = va_arg (*args, gbp_policy_dpo_trace_t *);
+
+  s = format (s, " src-epg:%d dst-epg:%d acl-index:%d",
+	      t->src_epg, t->dst_epg, t->acl_index);
+
+  return s;
+}
+
+static uword
+ip4_gbp_policy_dpo (vlib_main_t * vm,
+		    vlib_node_runtime_t * node, vlib_frame_t * from_frame)
+{
+  return (gbp_policy_dpo_inline (vm, node, from_frame, FIB_PROTOCOL_IP4));
+}
+
+static uword
+ip6_gbp_policy_dpo (vlib_main_t * vm,
+		    vlib_node_runtime_t * node, vlib_frame_t * from_frame)
+{
+  return (gbp_policy_dpo_inline (vm, node, from_frame, FIB_PROTOCOL_IP6));
+}
+
+/* *INDENT-OFF* */
+VLIB_REGISTER_NODE (ip4_gbp_policy_dpo_node) = {
+    .function = ip4_gbp_policy_dpo,
+    .name = "ip4-gbp-policy-dpo",
+    .vector_size = sizeof (u32),
+    .format_trace = format_gbp_policy_dpo_trace,
+    .n_next_nodes = GBP_POLICY_N_NEXT,
+    .next_nodes =
+    {
+        [GBP_POLICY_DROP] = "ip4-drop",
+    }
+};
+VLIB_REGISTER_NODE (ip6_gbp_policy_dpo_node) = {
+    .function = ip6_gbp_policy_dpo,
+    .name = "ip6-gbp-policy-dpo",
+    .vector_size = sizeof (u32),
+    .format_trace = format_gbp_policy_dpo_trace,
+    .n_next_nodes = GBP_POLICY_N_NEXT,
+    .next_nodes =
+    {
+        [GBP_POLICY_DROP] = "ip6-drop",
+    }
+};
+
+VLIB_NODE_FUNCTION_MULTIARCH (ip4_gbp_policy_dpo_node, ip4_gbp_policy_dpo)
+VLIB_NODE_FUNCTION_MULTIARCH (ip6_gbp_policy_dpo_node, ip6_gbp_policy_dpo)
+/* *INDENT-ON* */
+
+ /**
+ * per-packet trace data
+ */
+typedef struct gbp_classify_trace_t_
+{
+  /* per-pkt trace data */
+  epg_id_t src_epg;
+} gbp_classify_trace_t;
+
+typedef enum gbp_lpm_classify_next_t_
+{
+  GPB_LPM_CLASSIFY_DROP,
+} gbp_lpm_classify_next_t;
+
+/*
+ * Determine the SRC EPG from a LPM
+ */
+always_inline uword
+gbp_lpm_classify_inline (vlib_main_t * vm,
+			 vlib_node_runtime_t * node,
+			 vlib_frame_t * frame, fib_protocol_t fproto)
+{
+  u32 n_left_from, *from, *to_next;
+  u32 next_index;
+
+  next_index = 0;
+  n_left_from = frame->n_vectors;
+  from = vlib_frame_vector_args (frame);
+
+  while (n_left_from > 0)
+    {
+      u32 n_left_to_next;
+
+      vlib_get_next_frame (vm, node, next_index, to_next, n_left_to_next);
+
+      while (n_left_from > 0 && n_left_to_next > 0)
+	{
+	  u32 bi0, sw_if_index0, fib_index0, lbi0;
+	  gbp_lpm_classify_next_t next0;
+	  const gbp_policy_dpo_t *gpd0;
+	  const gbp_recirc_t *gr0;
+	  const dpo_id_t *dpo0;
+	  load_balance_t *lb0;
+	  ip4_header_t *ip4_0;
+	  ip6_header_t *ip6_0;
+	  vlib_buffer_t *b0;
+	  epg_id_t src_epg0;
+
+	  bi0 = from[0];
+	  to_next[0] = bi0;
+	  from += 1;
+	  to_next += 1;
+	  n_left_from -= 1;
+	  n_left_to_next -= 1;
+	  next0 = GPB_LPM_CLASSIFY_DROP;
+
+	  b0 = vlib_get_buffer (vm, bi0);
+
+	  sw_if_index0 = vnet_buffer (b0)->sw_if_index[VLIB_RX];
+	  gr0 = gbp_recirc_get (sw_if_index0);
+	  fib_index0 = gr0->gr_fib_index[fproto];
+
+	  if (FIB_PROTOCOL_IP4 == fproto)
+	    {
+	      ip4_0 = vlib_buffer_get_current (b0);
+	      lbi0 = ip4_fib_forwarding_lookup (fib_index0,
+						&ip4_0->src_address);
+	    }
+	  else
+	    {
+	      ip6_0 = vlib_buffer_get_current (b0);
+	      lbi0 = ip6_fib_table_fwding_lookup (&ip6_main, fib_index0,
+						  &ip6_0->src_address);
+	    }
+
+	  lb0 = load_balance_get (lbi0);
+	  dpo0 = load_balance_get_bucket_i (lb0, 0);
+
+	  if (gbp_policy_dpo_type == dpo0->dpoi_type)
+	    {
+	      gpd0 = gbp_policy_dpo_get_i (dpo0->dpoi_index);
+	      src_epg0 = gpd0->gpd_epg;
+	      vnet_feature_next (vnet_buffer (b0)->sw_if_index[VLIB_RX],
+				 &next0, b0);
+	    }
+	  else
+	    {
+	      /* could not classify => drop */
+	      src_epg0 = 0;
+	    }
+
+	  vnet_buffer2 (b0)->gbp.src_epg = src_epg0;
+
+	  if (PREDICT_FALSE ((b0->flags & VLIB_BUFFER_IS_TRACED)))
+	    {
+	      gbp_classify_trace_t *t =
+		vlib_add_trace (vm, node, b0, sizeof (*t));
+	      t->src_epg = src_epg0;
+	    }
+
+	  vlib_validate_buffer_enqueue_x1 (vm, node, next_index,
+					   to_next, n_left_to_next,
+					   bi0, next0);
+	}
+
+      vlib_put_next_frame (vm, node, next_index, n_left_to_next);
+    }
+
+  return frame->n_vectors;
+}
+
+static uword
+gbp_ip4_lpm_classify (vlib_main_t * vm,
+		      vlib_node_runtime_t * node, vlib_frame_t * frame)
+{
+  return (gbp_lpm_classify_inline (vm, node, frame, FIB_PROTOCOL_IP4));
+}
+
+static uword
+gbp_ip6_lpm_classify (vlib_main_t * vm,
+		      vlib_node_runtime_t * node, vlib_frame_t * frame)
+{
+  return (gbp_lpm_classify_inline (vm, node, frame, FIB_PROTOCOL_IP6));
+}
+
+ /* packet trace format function */
+static u8 *
+format_gbp_classify_trace (u8 * s, va_list * args)
+{
+  CLIB_UNUSED (vlib_main_t * vm) = va_arg (*args, vlib_main_t *);
+  CLIB_UNUSED (vlib_node_t * node) = va_arg (*args, vlib_node_t *);
+  gbp_classify_trace_t *t = va_arg (*args, gbp_classify_trace_t *);
+
+  s = format (s, "src-epg:%d", t->src_epg);
+
+  return s;
+}
+
+/* *INDENT-OFF* */
+VLIB_REGISTER_NODE (gbp_ip4_lpm_classify_node) = {
+  .function = gbp_ip4_lpm_classify,
+  .name = "ip4-gbp-lpm-classify",
+  .vector_size = sizeof (u32),
+  .format_trace = format_gbp_classify_trace,
+  .type = VLIB_NODE_TYPE_INTERNAL,
+
+  .n_errors = 0,
+  .n_next_nodes = 1,
+  .next_nodes = {
+    [GPB_LPM_CLASSIFY_DROP] = "ip4-drop"
+  },
+};
+
+VLIB_NODE_FUNCTION_MULTIARCH (gbp_ip4_lpm_classify_node, gbp_ip4_lpm_classify);
+
+VLIB_REGISTER_NODE (gbp_ip6_lpm_classify_node) = {
+  .function = gbp_ip6_lpm_classify,
+  .name = "ip6-gpb-lpm-classify",
+  .vector_size = sizeof (u32),
+  .format_trace = format_gbp_classify_trace,
+  .type = VLIB_NODE_TYPE_INTERNAL,
+
+  .n_errors = 0,
+  .n_next_nodes = 1,
+  .next_nodes = {
+    [GPB_LPM_CLASSIFY_DROP] = "ip6-drop"
+  },
+};
+
+VLIB_NODE_FUNCTION_MULTIARCH (gbp_ip6_lpm_classify_node, gbp_ip6_lpm_classify);
+
+VNET_FEATURE_INIT (gbp_ip4_lpm_classify_feat_node, static) =
+{
+  .arc_name = "ip4-unicast",
+  .node_name = "ip4-gbp-lpm-classify",
+  .runs_before = VNET_FEATURES ("nat44-out2in"),
+};
+VNET_FEATURE_INIT (gbp_ip6_lpm_classify_feat_node, static) =
+{
+  .arc_name = "ip6-unicast",
+  .node_name = "ip6-gbp-lpm-classify",
+  .runs_before = VNET_FEATURES ("nat66-out2in"),
+};
+
+/* *INDENT-ON* */
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
diff --git a/src/plugins/gbp/gbp_policy_dpo.h b/src/plugins/gbp/gbp_policy_dpo.h
new file mode 100644
index 00000000000..d6a8986d622
--- /dev/null
+++ b/src/plugins/gbp/gbp_policy_dpo.h
@@ -0,0 +1,70 @@
+/*
+ * Copyright (c) 2018 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef __GBP_POLICY_DPO_H__
+#define __GBP_POLICY_DPO_H__
+
+#include <vnet/dpo/dpo.h>
+
+/**
+ * @brief
+ * The GBP FWD DPO. Used in the L3 path to select the correct EPG uplink
+ * based on the source EPG.
+ */
+typedef struct gbp_policy_dpo_t_
+{
+  /**
+   * The protocol of packets using this DPO
+   */
+  dpo_proto_t gpd_proto;
+
+  /**
+   * EPG
+   */
+  epg_id_t gpd_epg;
+
+  /**
+   * output sw_if_index
+   */
+  u32 gpd_sw_if_index;
+
+  /**
+   * number of locks.
+   */
+  u16 gpd_locks;
+
+  /**
+   * Stacked DPO on DVR of output interface
+   */
+  dpo_id_t gpd_dpo;
+} gbp_policy_dpo_t;
+
+extern void gbp_policy_dpo_add_or_lock (dpo_proto_t dproto,
+					epg_id_t epg,
+					u32 sw_if_index, dpo_id_t * dpo);
+
+extern gbp_policy_dpo_t *gbp_policy_dpo_get (index_t index);
+
+extern dpo_type_t gbp_policy_dpo_get_type (void);
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
+
+#endif
diff --git a/src/plugins/gbp/gbp_recirc.c b/src/plugins/gbp/gbp_recirc.c
new file mode 100644
index 00000000000..1debbe406f3
--- /dev/null
+++ b/src/plugins/gbp/gbp_recirc.c
@@ -0,0 +1,217 @@
+/*
+ * Copyright (c) 2018 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <plugins/gbp/gbp_recirc.h>
+#include <plugins/gbp/gbp_endpoint_group.h>
+#include <plugins/gbp/gbp_endpoint.h>
+
+#include <vnet/dpo/dvr_dpo.h>
+#include <vnet/fib/fib_table.h>
+
+/**
+ * Pool of GBP recircs
+ */
+gbp_recirc_t *gbp_recirc_pool;
+
+/**
+ * Recirc configs keyed by sw_if_index
+ */
+index_t *gbp_recirc_db;
+
+int
+gbp_recirc_add (u32 sw_if_index, epg_id_t epg_id, u8 is_ext)
+{
+  gbp_recirc_t *gr;
+  index_t gri;
+
+  vec_validate_init_empty (gbp_recirc_db, sw_if_index, INDEX_INVALID);
+
+  gri = gbp_recirc_db[sw_if_index];
+
+  if (INDEX_INVALID == gri)
+    {
+      gbp_endpoint_group_t *gepg;
+      fib_protocol_t fproto;
+
+      pool_get (gbp_recirc_pool, gr);
+      memset (gr, 0, sizeof (*gr));
+      gri = gr - gbp_recirc_pool;
+
+      gr->gr_epg = epg_id;
+      gr->gr_is_ext = is_ext;
+      gr->gr_sw_if_index = sw_if_index;
+
+      /*
+       * IP enable the recirc interface
+       */
+      ip4_sw_interface_enable_disable (gr->gr_sw_if_index, 1);
+      ip6_sw_interface_enable_disable (gr->gr_sw_if_index, 1);
+
+      /*
+       * cache the FIB indicies of the EPG
+       */
+      gepg = gbp_endpoint_group_find (gr->gr_epg);
+
+      if (NULL == gepg)
+	return (VNET_API_ERROR_NO_SUCH_ENTRY);
+
+      FOR_EACH_FIB_IP_PROTOCOL (fproto)
+      {
+	gr->gr_fib_index[fproto] = gepg->gepg_fib_index[fproto];
+      }
+
+      /*
+       * Packets on the recirculation interface are subjet to src-EPG
+       * classification. Recirc interfaces are L2-emulation mode.
+       *   for internal EPGs this is via an LPM on all external subnets.
+       *   for external EPGs this is via a port mapping.
+       */
+      if (gr->gr_is_ext)
+	{
+	  /*
+	   * recirc is for post-NAT translation packets going into
+	   * the external EPG, these are classified to the NAT EPG
+	   * based on its port
+	   */
+	  gbp_itf_epg_update (gr->gr_sw_if_index, gr->gr_epg, 0);
+	  vnet_feature_enable_disable ("ip4-unicast",
+				       "ip4-gbp-src-classify",
+				       gr->gr_sw_if_index, 1, 0, 0);
+	  vnet_feature_enable_disable ("ip6-unicast",
+				       "ip6-gbp-src-classify",
+				       gr->gr_sw_if_index, 1, 0, 0);
+	}
+      else
+	{
+	  /*
+	   * recirc is for pre-NAT translation packets coming from
+	   * the external EPG, these are classified based on a LPM
+	   * in the EPG's route-domain
+	   */
+	  vnet_feature_enable_disable ("ip4-unicast",
+				       "ip4-gbp-lpm-classify",
+				       gr->gr_sw_if_index, 1, 0, 0);
+	  vnet_feature_enable_disable ("ip6-unicast",
+				       "ip6-gbp-lpm-classify",
+				       gr->gr_sw_if_index, 1, 0, 0);
+	}
+
+      gbp_recirc_db[sw_if_index] = gri;
+    }
+
+  return (0);
+}
+
+void
+gbp_recirc_delete (u32 sw_if_index)
+{
+  gbp_recirc_t *gr;
+  index_t gri;
+
+  gri = gbp_recirc_db[sw_if_index];
+
+  if (INDEX_INVALID != gri)
+    {
+      gr = pool_elt_at_index (gbp_recirc_pool, gri);
+
+      if (gr->gr_is_ext)
+	{
+	  gbp_itf_epg_delete (gr->gr_sw_if_index);
+	  vnet_feature_enable_disable ("ip4-unicast",
+				       "ip4-gbp-src-classify",
+				       gr->gr_sw_if_index, 0, 0, 0);
+	  vnet_feature_enable_disable ("ip6-unicast",
+				       "ip6-gbp-src-classify",
+				       gr->gr_sw_if_index, 0, 0, 0);
+	}
+      else
+	{
+	  vnet_feature_enable_disable ("ip4-unicast",
+				       "ip4-gbp-lpm-classify",
+				       gr->gr_sw_if_index, 0, 0, 0);
+	  vnet_feature_enable_disable ("ip6-unicast",
+				       "ip6-gbp-lpm-classify",
+				       gr->gr_sw_if_index, 0, 0, 0);
+	}
+
+      ip4_sw_interface_enable_disable (gr->gr_sw_if_index, 0);
+      ip6_sw_interface_enable_disable (gr->gr_sw_if_index, 0);
+
+      gbp_recirc_db[sw_if_index] = INDEX_INVALID;
+      pool_put (gbp_recirc_pool, gr);
+    }
+}
+
+void
+gbp_recirc_walk (gbp_recirc_cb_t cb, void *ctx)
+{
+  gbp_recirc_t *gbpe;
+
+  /* *INDENT-OFF* */
+  pool_foreach(gbpe, gbp_recirc_pool,
+  {
+    if (!cb(gbpe, ctx))
+      break;
+  });
+  /* *INDENT-ON* */
+}
+
+static int
+gbp_recirc_show_one (gbp_recirc_t * gr, void *ctx)
+{
+  vnet_main_t *vnm = vnet_get_main ();
+  vlib_main_t *vm;
+
+  vm = ctx;
+  vlib_cli_output (vm, "  %U, epg:%d, ext:%d",
+		   format_vnet_sw_if_index_name, vnm,
+		   gr->gr_sw_if_index, gr->gr_epg, gr->gr_is_ext);
+
+  return (1);
+}
+
+static clib_error_t *
+gbp_recirc_show (vlib_main_t * vm,
+		 unformat_input_t * input, vlib_cli_command_t * cmd)
+{
+  vlib_cli_output (vm, "Recirculation-Interfaces:");
+  gbp_recirc_walk (gbp_recirc_show_one, vm);
+
+  return (NULL);
+}
+
+
+/*?
+ * Show Group Based Policy Recircs and derived information
+ *
+ * @cliexpar
+ * @cliexstart{show gbp recirc}
+ * @cliexend
+ ?*/
+/* *INDENT-OFF* */
+VLIB_CLI_COMMAND (gbp_recirc_show_node, static) = {
+  .path = "show gbp recirc",
+  .short_help = "show gbp recirc\n",
+  .function = gbp_recirc_show,
+};
+/* *INDENT-ON* */
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
diff --git a/src/plugins/gbp/gbp_recirc.h b/src/plugins/gbp/gbp_recirc.h
new file mode 100644
index 00000000000..10f3da631c1
--- /dev/null
+++ b/src/plugins/gbp/gbp_recirc.h
@@ -0,0 +1,74 @@
+/*
+ * Copyright (c) 2018 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef __GBP_RECIRC_H__
+#define __GBP_RECIRC_H__
+
+#include <plugins/gbp/gbp_types.h>
+#include <vnet/fib/fib_types.h>
+
+/**
+ * An Endpoint Group representation
+ */
+typedef struct gpb_recirc_t_
+{
+  /**
+   * EPG ID that packets will classify to when they arrive on this recirc
+   */
+  epg_id_t gr_epg;
+
+  /**
+   * FIB indices the EPG is mapped to
+   */
+  u32 gr_fib_index[FIB_PROTOCOL_IP_MAX];
+
+  /**
+   * Is the interface for packets post-NAT translatoin (i.e. ext)
+   * or pre-NAT ranslation (i.e. internal)
+   */
+  u8 gr_is_ext;
+
+  /**
+   */
+  u32 gr_sw_if_index;
+
+} gbp_recirc_t;
+
+extern int gbp_recirc_add (u32 sw_if_index, epg_id_t epg_id, u8 is_ext);
+extern void gbp_recirc_delete (u32 sw_if_index);
+
+typedef int (*gbp_recirc_cb_t) (gbp_recirc_t * gbpe, void *ctx);
+extern void gbp_recirc_walk (gbp_recirc_cb_t bgpe, void *ctx);
+
+/**
+ * Data plane functions
+ */
+extern gbp_recirc_t *gbp_recirc_pool;
+extern index_t *gbp_recirc_db;
+
+always_inline const gbp_recirc_t *
+gbp_recirc_get (u32 sw_if_index)
+{
+  return (pool_elt_at_index (gbp_recirc_pool, gbp_recirc_db[sw_if_index]));
+}
+#endif
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
diff --git a/src/plugins/gbp/gbp_subnet.c b/src/plugins/gbp/gbp_subnet.c
new file mode 100644
index 00000000000..b6990844cd3
--- /dev/null
+++ b/src/plugins/gbp/gbp_subnet.c
@@ -0,0 +1,176 @@
+/*
+ * Copyright (c) 2018 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <plugins/gbp/gbp.h>
+#include <plugins/gbp/gbp_fwd_dpo.h>
+#include <plugins/gbp/gbp_policy_dpo.h>
+
+#include <vnet/fib/fib_table.h>
+#include <vnet/dpo/load_balance.h>
+
+static int
+gbp_internal_subnet_add (u32 fib_index, const fib_prefix_t * pfx)
+{
+  dpo_id_t gfd = DPO_INVALID;
+
+  gbp_fwd_dpo_add_or_lock (fib_proto_to_dpo (pfx->fp_proto), &gfd);
+
+  fib_table_entry_special_dpo_update (fib_index,
+				      pfx,
+				      FIB_SOURCE_PLUGIN_HI,
+				      FIB_ENTRY_FLAG_EXCLUSIVE, &gfd);
+
+  dpo_reset (&gfd);
+
+  return (0);
+}
+
+static int
+gbp_external_subnet_add (u32 fib_index,
+			 const fib_prefix_t * pfx,
+			 u32 sw_if_index, epg_id_t epg)
+{
+  dpo_id_t gpd = DPO_INVALID;
+
+  gbp_policy_dpo_add_or_lock (fib_proto_to_dpo (pfx->fp_proto),
+			      epg, sw_if_index, &gpd);
+
+  fib_table_entry_special_dpo_update (fib_index,
+				      pfx,
+				      FIB_SOURCE_PLUGIN_HI,
+				      (FIB_ENTRY_FLAG_EXCLUSIVE |
+				       FIB_ENTRY_FLAG_LOOSE_URPF_EXEMPT),
+				      &gpd);
+
+  dpo_reset (&gpd);
+
+  return (0);
+}
+
+static int
+gbp_subnet_del (u32 fib_index, const fib_prefix_t * pfx)
+{
+  fib_table_entry_delete (fib_index, pfx, FIB_SOURCE_PLUGIN_HI);
+
+  return (0);
+}
+
+int
+gbp_subnet_add_del (u32 table_id,
+		    const fib_prefix_t * pfx,
+		    u32 sw_if_index, epg_id_t epg, u8 is_add, u8 is_internal)
+{
+  u32 fib_index;
+
+  fib_index = fib_table_find (pfx->fp_proto, table_id);
+
+  if (~0 == fib_index)
+    return (VNET_API_ERROR_NO_SUCH_FIB);
+
+  if (is_internal && is_add)
+    return (gbp_internal_subnet_add (fib_index, pfx));
+  else if (!is_internal && is_add)
+    return (gbp_external_subnet_add (fib_index, pfx, sw_if_index, epg));
+
+  return (gbp_subnet_del (fib_index, pfx));
+}
+
+typedef struct gbp_subnet_fib_table_walk_ctx_t_
+{
+  gbp_subnet_cb_t cb;
+  void *ctx;
+} gbp_subnet_fib_table_walk_ctx_t;
+
+static fib_table_walk_rc_t
+gbp_subnet_fib_table_walk (fib_node_index_t fei, void *arg)
+{
+  gbp_subnet_fib_table_walk_ctx_t *ctx = arg;
+  const dpo_id_t *dpo;
+  fib_prefix_t pfx;
+  u32 table_id;
+
+  fib_entry_get_prefix (fei, &pfx);
+  table_id = fib_table_get_table_id (fib_entry_get_fib_index (fei),
+				     pfx.fp_proto);
+  dpo = fib_entry_contribute_ip_forwarding (fei);
+
+  if (DPO_LOAD_BALANCE == dpo->dpoi_type)
+    {
+      dpo = load_balance_get_bucket (dpo->dpoi_index, 0);
+
+      if (dpo->dpoi_type == gbp_policy_dpo_get_type ())
+	{
+	  gbp_policy_dpo_t *gpd;
+
+	  gpd = gbp_policy_dpo_get (dpo->dpoi_index);
+
+          /* *INDENT-OFF* */
+          ctx->cb (table_id, &pfx,
+                   gpd->gpd_sw_if_index,
+                   gpd->gpd_epg,
+                   0,	// is_internal
+                   ctx->ctx);
+          /* *INDENT-ON* */
+	}
+      else if (dpo->dpoi_type == gbp_fwd_dpo_get_type ())
+	{
+          /* *INDENT-OFF* */
+          ctx->cb (table_id, &pfx,
+                   ~0,	// sw_if_index
+                   ~0,  // epg
+                   1,   // is_internal
+                   ctx->ctx);
+          /* *INDENT-ON* */
+	}
+    }
+
+  return (FIB_TABLE_WALK_CONTINUE);
+}
+
+void
+gbp_subnet_walk (gbp_subnet_cb_t cb, void *ctx)
+{
+  fib_table_t *fib_table;
+
+  gbp_subnet_fib_table_walk_ctx_t wctx = {
+    .cb = cb,
+    .ctx = ctx,
+  };
+
+  /* *INDENT-OFF* */
+  pool_foreach (fib_table, ip4_main.fibs,
+  ({
+    fib_table_walk(fib_table->ft_index,
+                   FIB_PROTOCOL_IP4,
+                   gbp_subnet_fib_table_walk,
+                   &wctx);
+  }));
+  pool_foreach (fib_table, ip6_main.fibs,
+  ({
+    fib_table_walk(fib_table->ft_index,
+                   FIB_PROTOCOL_IP6,
+                   gbp_subnet_fib_table_walk,
+                   &wctx);
+  }));
+  /* *INDENT-ON* */
+}
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
diff --git a/src/plugins/gbp/gbp_subnet.h b/src/plugins/gbp/gbp_subnet.h
new file mode 100644
index 00000000000..24b4f3a5816
--- /dev/null
+++ b/src/plugins/gbp/gbp_subnet.h
@@ -0,0 +1,41 @@
+/*
+ * Copyright (c) 2018 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef __GBP_SUBNET_H__
+#define __GBP_SUBNET_H__
+
+#include <plugins/gbp/gbp_types.h>
+
+extern int gbp_subnet_add_del (u32 table_id,
+			       const fib_prefix_t * pfx,
+			       u32 sw_if_index,
+			       epg_id_t epg, u8 is_add, u8 is_internal);
+
+
+typedef int (*gbp_subnet_cb_t) (u32 table_id,
+				const fib_prefix_t * pfx,
+				u32 sw_if_index,
+				epg_id_t epg, u8 is_internal, void *ctx);
+extern void gbp_subnet_walk (gbp_subnet_cb_t cb, void *ctx);
+
+#endif
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
diff --git a/src/plugins/gbp/gbp_types.h b/src/plugins/gbp/gbp_types.h
new file mode 100644
index 00000000000..fa337451028
--- /dev/null
+++ b/src/plugins/gbp/gbp_types.h
@@ -0,0 +1,32 @@
+/*
+ * Copyright (c) 2018 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef __GBP_TYPES_H__
+#define __GBP_TYPES_H__
+
+#include <vnet/vnet.h>
+
+typedef u32 epg_id_t;
+#define EPG_INVALID (~0)
+
+#endif
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "gnu")
+ * End:
+ */
diff --git a/src/vnet/buffer.h b/src/vnet/buffer.h
index 02688e26530..86f75389d70 100644
--- a/src/vnet/buffer.h
+++ b/src/vnet/buffer.h
@@ -387,6 +387,12 @@ typedef struct
 
   u8 __unused[2];
 
+  /* Group Based Policy */
+  struct
+  {
+    u32 src_epg;
+  } gbp;
+
   union
   {
     struct
@@ -396,7 +402,7 @@ typedef struct
       u16 *trajectory_trace;
 #endif
     };
-    u32 unused[11];
+    u32 unused[10];
   };
 } vnet_buffer_opaque2_t;
 
diff --git a/src/vnet/ethernet/arp.c b/src/vnet/ethernet/arp.c
index 925fb2cc6ac..9114d7a90f3 100644
--- a/src/vnet/ethernet/arp.c
+++ b/src/vnet/ethernet/arp.c
@@ -2498,11 +2498,22 @@ ethernet_arp_change_mac (u32 sw_if_index)
 }
 
 void
-send_ip4_garp (vlib_main_t * vm, vnet_hw_interface_t * hi)
+send_ip4_garp (vlib_main_t * vm, const vnet_hw_interface_t * hi)
+{
+  ip4_main_t *i4m = &ip4_main;
+  ip4_address_t *ip4_addr =
+    ip4_interface_first_address (i4m, hi->sw_if_index, 0);
+
+  send_ip4_garp_w_addr (vm, ip4_addr, hi);
+}
+
+void
+send_ip4_garp_w_addr (vlib_main_t * vm,
+		      const ip4_address_t * ip4_addr,
+		      const vnet_hw_interface_t * hi)
 {
   ip4_main_t *i4m = &ip4_main;
   u32 sw_if_index = hi->sw_if_index;
-  ip4_address_t *ip4_addr = ip4_interface_first_address (i4m, sw_if_index, 0);
 
   if (ip4_addr)
     {
diff --git a/src/vnet/ethernet/arp_packet.h b/src/vnet/ethernet/arp_packet.h
index 661f33f93af..4b7b0482fb7 100644
--- a/src/vnet/ethernet/arp_packet.h
+++ b/src/vnet/ethernet/arp_packet.h
@@ -167,7 +167,10 @@ typedef struct
 ethernet_arp_ip4_entry_t *ip4_neighbor_entries (u32 sw_if_index);
 u8 *format_ethernet_arp_ip4_entry (u8 * s, va_list * va);
 
-void send_ip4_garp (vlib_main_t * vm, vnet_hw_interface_t * hi);
+void send_ip4_garp (vlib_main_t * vm, const vnet_hw_interface_t * hi);
+void send_ip4_garp_w_addr (vlib_main_t * vm,
+			   const ip4_address_t * ip4_addr,
+			   const vnet_hw_interface_t * hi);
 
 #endif /* included_ethernet_arp_packet_h */
 
diff --git a/src/vnet/fib/fib_table.c b/src/vnet/fib/fib_table.c
index 324a35fe1e8..d0bc33639b9 100644
--- a/src/vnet/fib/fib_table.c
+++ b/src/vnet/fib/fib_table.c
@@ -1034,6 +1034,17 @@ fib_table_get_table_id_for_sw_if_index (fib_protocol_t proto,
 }
 
 u32
+fib_table_get_table_id (u32 fib_index,
+                        fib_protocol_t proto)
+{
+    fib_table_t *fib_table;
+
+    fib_table = fib_table_get(fib_index, proto);
+
+    return ((NULL != fib_table ? fib_table->ft_table_id : ~0));
+}
+
+u32
 fib_table_find (fib_protocol_t proto,
 		u32 table_id)
 {
diff --git a/src/vnet/fib/fib_table.h b/src/vnet/fib/fib_table.h
index ffad3c43d3e..8b86f8d6dd9 100644
--- a/src/vnet/fib/fib_table.h
+++ b/src/vnet/fib/fib_table.h
@@ -645,6 +645,21 @@ extern u32 fib_table_get_table_id_for_sw_if_index(fib_protocol_t proto,
 
 /**
  * @brief
+ *  Get the Table-ID of the FIB from protocol and index
+ *
+ * @param fib_index
+ *  The FIB index
+ *
+ * @paran proto
+ *  The protocol of the FIB (and thus the entries therein)
+ *
+ * @return fib_index
+ *  The tableID of the FIB
+ */
+extern u32 fib_table_get_table_id(u32 fib_index, fib_protocol_t proto);
+
+/**
+ * @brief
  *  Get the index of the FIB for a Table-ID. This DOES NOT create the
  * FIB if it does not exist.
  *
diff --git a/src/vnet/ip/ip6.h b/src/vnet/ip/ip6.h
index 959d72c0fad..359c461d1e0 100644
--- a/src/vnet/ip/ip6.h
+++ b/src/vnet/ip/ip6.h
@@ -404,7 +404,10 @@ int vnet_ip6_nd_term (vlib_main_t * vm,
 		      ethernet_header_t * eth,
 		      ip6_header_t * ip, u32 sw_if_index, u16 bd_index);
 
-void send_ip6_na (vlib_main_t * vm, vnet_hw_interface_t * hi);
+void send_ip6_na (vlib_main_t * vm, const vnet_hw_interface_t * hi);
+void send_ip6_na_w_addr (vlib_main_t * vm,
+			 const ip6_address_t * addr,
+			 const vnet_hw_interface_t * hi);
 
 u8 *format_ip6_forward_next_trace (u8 * s, va_list * args);
 
diff --git a/src/vnet/ip/ip6_neighbor.c b/src/vnet/ip/ip6_neighbor.c
index 0df29c6bc02..fee4356f5e0 100644
--- a/src/vnet/ip/ip6_neighbor.c
+++ b/src/vnet/ip/ip6_neighbor.c
@@ -4670,11 +4670,23 @@ ethernet_ndp_change_mac (u32 sw_if_index)
 }
 
 void
-send_ip6_na (vlib_main_t * vm, vnet_hw_interface_t * hi)
+send_ip6_na (vlib_main_t * vm, const vnet_hw_interface_t * hi)
 {
   ip6_main_t *i6m = &ip6_main;
   u32 sw_if_index = hi->sw_if_index;
   ip6_address_t *ip6_addr = ip6_interface_first_address (i6m, sw_if_index);
+
+  send_ip6_na_w_addr (vm, ip6_addr, hi);
+}
+
+void
+send_ip6_na_w_addr (vlib_main_t * vm,
+		    const ip6_address_t * ip6_addr,
+		    const vnet_hw_interface_t * hi)
+{
+  ip6_main_t *i6m = &ip6_main;
+  u32 sw_if_index = hi->sw_if_index;
+
   if (ip6_addr)
     {
       clib_warning
diff --git a/src/vnet/l2/l2_input.c b/src/vnet/l2/l2_input.c
index d8a0a6bd798..69de2815536 100644
--- a/src/vnet/l2/l2_input.c
+++ b/src/vnet/l2/l2_input.c
@@ -176,7 +176,8 @@ classify_and_dispatch (l2input_main_t * msm, vlib_buffer_t * b0, u32 * next0)
       u8 protocol = ((ip6_header_t *) l3h0)->protocol;
 
       /* Disable bridge forwarding (flooding will execute instead if not xconnect) */
-      feat_mask &= ~(L2INPUT_FEAT_FWD | L2INPUT_FEAT_UU_FLOOD);
+      feat_mask &= ~(L2INPUT_FEAT_FWD |
+		     L2INPUT_FEAT_UU_FLOOD | L2INPUT_FEAT_GBP_FWD);
 
       /* Disable ARP-term for non-ARP and non-ICMP6 packet */
       if (ethertype != ETHERNET_TYPE_ARP &&
diff --git a/src/vnet/l2/l2_input.h b/src/vnet/l2/l2_input.h
index dc9d95484ee..5d67f257e46 100644
--- a/src/vnet/l2/l2_input.h
+++ b/src/vnet/l2/l2_input.h
@@ -109,10 +109,13 @@ l2input_bd_config (u32 bd_index)
  _(FLOOD,         "l2-flood")                   \
  _(ARP_TERM,      "arp-term-l2bd")              \
  _(UU_FLOOD,      "l2-flood")                   \
+ _(GBP_FWD,       "gbp-fwd")                    \
  _(FWD,           "l2-fwd")                     \
  _(RW,            "l2-rw")                      \
  _(LEARN,         "l2-learn")                   \
  _(L2_EMULATION,  "l2-emulation")               \
+ _(GBP_NULL_CLASSIFY, "gbp-null-classify")      \
+ _(GBP_SRC_CLASSIFY,  "gbp-src-classify")       \
  _(VTR,           "l2-input-vtr")               \
  _(VPATH,         "vpath-input-l2")             \
  _(ACL,           "l2-input-acl")               \
diff --git a/src/vnet/l2/l2_output.h b/src/vnet/l2/l2_output.h
index 3b6e480d1dc..6b00d01655c 100644
--- a/src/vnet/l2/l2_output.h
+++ b/src/vnet/l2/l2_output.h
@@ -85,6 +85,7 @@ extern vlib_node_registration_t l2output_node;
 #define foreach_l2output_feat \
  _(OUTPUT,            "interface-output")           \
  _(SPAN,              "span-l2-output")             \
+ _(GBP_POLICY,        "gbp-policy")                 \
  _(CFM,               "feature-bitmap-drop")        \
  _(QOS,               "feature-bitmap-drop")        \
  _(ACL,               "l2-output-acl")              \
diff --git a/src/vpp-api/vom/Makefile.am b/src/vpp-api/vom/Makefile.am
index dad4863c17c..f802849d758 100644
--- a/src/vpp-api/vom/Makefile.am
+++ b/src/vpp-api/vom/Makefile.am
@@ -66,8 +66,14 @@ endif
 GBP_SOURCES =
 if ENABLE_GBP_PLUGIN
 GBP_SOURCES += 				\
+	gbp_recirc_cmds.cpp		\
+	gbp_recirc.cpp			\
+	gbp_subnet_cmds.cpp		\
+	gbp_subnet.cpp			\
 	gbp_endpoint_cmds.cpp		\
 	gbp_endpoint.cpp		\
+	gbp_endpoint_group_cmds.cpp	\
+	gbp_endpoint_group.cpp		\
 	gbp_contract_cmds.cpp		\
 	gbp_contract.cpp
 endif
@@ -142,7 +148,7 @@ vomincludedir = $(includedir)/vom
 
 ACL_INCLUDES =
 if ENABLE_ACL_PLUGIN
-ACL_INCLUDES += 				\
+ACL_INCLUDES += 			\
 	acl_binding.hpp			\
 	acl_ethertype.hpp		\
 	acl_l2_rule.hpp			\
@@ -153,7 +159,7 @@ endif
 
 NAT_INCLUDES =
 if ENABLE_NAT_PLUGIN
-NAT_INCLUDES += 				\
+NAT_INCLUDES += 			\
 	nat_static.hpp			\
 	nat_binding.hpp
 endif
@@ -166,8 +172,11 @@ endif
 
 GBP_INCLUDES =
 if ENABLE_GBP_PLUGIN
-GBP_INCLUDES += 				\
+GBP_INCLUDES += 			\
 	gbp_endpoint.hpp		\
+	gbp_endpoint_group.hpp		\
+	gbp_subnet.hpp			\
+	gbp_recirc.hpp			\
 	gbp_contract.hpp
 endif
 
diff --git a/src/vpp-api/vom/acl_l2_rule.cpp b/src/vpp-api/vom/acl_l2_rule.cpp
index 1fb06e29b81..2b12e68c184 100644
--- a/src/vpp-api/vom/acl_l2_rule.cpp
+++ b/src/vpp-api/vom/acl_l2_rule.cpp
@@ -65,7 +65,7 @@ l2_rule::priority() const
   return m_priority;
 }
 
-action_t
+const action_t&
 l2_rule::action() const
 {
   return m_action;
diff --git a/src/vpp-api/vom/acl_l2_rule.hpp b/src/vpp-api/vom/acl_l2_rule.hpp
index 4faa628ca11..8c094aef5f4 100644
--- a/src/vpp-api/vom/acl_l2_rule.hpp
+++ b/src/vpp-api/vom/acl_l2_rule.hpp
@@ -69,7 +69,7 @@ public:
    * Getters
    */
   uint32_t priority() const;
-  action_t action() const;
+  const action_t& action() const;
   const route::prefix_t& src_ip() const;
   const mac_address_t& mac() const;
   const mac_address_t& mac_mask() const;
diff --git a/src/vpp-api/vom/acl_l3_rule.cpp b/src/vpp-api/vom/acl_l3_rule.cpp
index 4b96cae6c50..417dc5f2eb7 100644
--- a/src/vpp-api/vom/acl_l3_rule.cpp
+++ b/src/vpp-api/vom/acl_l3_rule.cpp
@@ -147,7 +147,7 @@ l3_rule::priority() const
   return m_priority;
 }
 
-action_t
+const action_t&
 l3_rule::action() const
 {
   return m_action;
diff --git a/src/vpp-api/vom/acl_l3_rule.hpp b/src/vpp-api/vom/acl_l3_rule.hpp
index 25a2a471d24..c1f1ceea5a1 100644
--- a/src/vpp-api/vom/acl_l3_rule.hpp
+++ b/src/vpp-api/vom/acl_l3_rule.hpp
@@ -121,7 +121,7 @@ public:
    */
   const route::prefix_t& src() const;
   uint32_t priority() const;
-  action_t action() const;
+  const action_t& action() const;
   const route::prefix_t& dst() const;
   uint8_t proto() const;
   uint16_t srcport_or_icmptype_first() const;
diff --git a/src/vpp-api/vom/acl_types.hpp b/src/vpp-api/vom/acl_types.hpp
index ccf0a1c0231..cf5bee3e478 100644
--- a/src/vpp-api/vom/acl_types.hpp
+++ b/src/vpp-api/vom/acl_types.hpp
@@ -26,16 +26,6 @@ namespace ACL {
 struct action_t : public enum_base<action_t>
 {
   /**
-   * Constructor
-   */
-  action_t(int v, const std::string s);
-
-  /**
-   * Destructor
-   */
-  ~action_t() = default;
-
-  /**
    * Permit and Reflexive
    */
   const static action_t PERMITANDREFLEX;
@@ -60,6 +50,9 @@ struct action_t : public enum_base<action_t>
    *which implements the connection tracking ....
    */
   static const action_t& from_bool(bool b, uint8_t c);
+
+private:
+  action_t(int v, const std::string s);
 };
 };
 };
diff --git a/src/vpp-api/vom/bridge_domain.cpp b/src/vpp-api/vom/bridge_domain.cpp
index be520f5ee45..b8c89e10bd9 100644
--- a/src/vpp-api/vom/bridge_domain.cpp
+++ b/src/vpp-api/vom/bridge_domain.cpp
@@ -31,6 +31,33 @@ bridge_domain::learning_mode_t::learning_mode_t(int v, const std::string& s)
 {
 }
 
+const bridge_domain::flood_mode_t bridge_domain::flood_mode_t::ON(1, "on");
+const bridge_domain::flood_mode_t bridge_domain::flood_mode_t::OFF(0, "off");
+
+bridge_domain::flood_mode_t::flood_mode_t(int v, const std::string& s)
+  : enum_base<bridge_domain::flood_mode_t>(v, s)
+{
+}
+
+const bridge_domain::mac_age_mode_t bridge_domain::mac_age_mode_t::ON(1, "on");
+const bridge_domain::mac_age_mode_t bridge_domain::mac_age_mode_t::OFF(0,
+                                                                       "off");
+
+bridge_domain::mac_age_mode_t::mac_age_mode_t(int v, const std::string& s)
+  : enum_base<bridge_domain::mac_age_mode_t>(v, s)
+{
+}
+
+const bridge_domain::arp_term_mode_t bridge_domain::arp_term_mode_t::ON(1,
+                                                                        "on");
+const bridge_domain::arp_term_mode_t bridge_domain::arp_term_mode_t::OFF(0,
+                                                                         "off");
+
+bridge_domain::arp_term_mode_t::arp_term_mode_t(int v, const std::string& s)
+  : enum_base<bridge_domain::arp_term_mode_t>(v, s)
+{
+}
+
 /**
  * A DB of al the interfaces, key on the name
  */
@@ -41,15 +68,25 @@ bridge_domain::event_handler bridge_domain::m_evh;
 /**
  * Construct a new object matching the desried state
  */
-bridge_domain::bridge_domain(uint32_t id, const learning_mode_t& lmode)
+bridge_domain::bridge_domain(uint32_t id,
+                             const learning_mode_t& lmode,
+                             const arp_term_mode_t& amode,
+                             const flood_mode_t& fmode,
+                             const mac_age_mode_t& mmode)
   : m_id(id)
   , m_learning_mode(lmode)
+  , m_arp_term_mode(amode)
+  , m_flood_mode(fmode)
+  , m_mac_age_mode(mmode)
 {
 }
 
 bridge_domain::bridge_domain(const bridge_domain& o)
   : m_id(o.m_id)
   , m_learning_mode(o.m_learning_mode)
+  , m_arp_term_mode(o.m_arp_term_mode)
+  , m_flood_mode(o.m_flood_mode)
+  , m_mac_age_mode(o.m_mac_age_mode)
 {
 }
 
@@ -68,7 +105,10 @@ bridge_domain::id() const
 bool
 bridge_domain::operator==(const bridge_domain& b) const
 {
-  return ((m_learning_mode == b.m_learning_mode) && id() == b.id());
+  return ((m_learning_mode == b.m_learning_mode) &&
+          (m_flood_mode == b.m_flood_mode) &&
+          (m_mac_age_mode == b.m_mac_age_mode) &&
+          (m_arp_term_mode == b.m_arp_term_mode) && id() == b.id());
 }
 
 void
@@ -84,7 +124,8 @@ void
 bridge_domain::replay()
 {
   if (rc_t::OK == m_id.rc()) {
-    HW::enqueue(new bridge_domain_cmds::create_cmd(m_id, m_learning_mode));
+    HW::enqueue(new bridge_domain_cmds::create_cmd(
+      m_id, m_learning_mode, m_arp_term_mode, m_flood_mode, m_mac_age_mode));
   }
 }
 
@@ -119,7 +160,8 @@ bridge_domain::update(const bridge_domain& desired)
    * the desired state is always that the interface should be created
    */
   if (rc_t::OK != m_id.rc()) {
-    HW::enqueue(new bridge_domain_cmds::create_cmd(m_id, m_learning_mode));
+    HW::enqueue(new bridge_domain_cmds::create_cmd(
+      m_id, m_learning_mode, m_arp_term_mode, m_flood_mode, m_mac_age_mode));
   }
 }
 
@@ -173,8 +215,10 @@ bridge_domain::event_handler::handle_populate(const client_db::key_t& key)
     for (unsigned int ii = 0; ii < payload.n_sw_ifs; ii++) {
       std::shared_ptr<interface> itf =
         interface::find(payload.sw_if_details[ii].sw_if_index);
-      l2_binding l2(*itf, bd);
-      OM::commit(key, l2);
+      if (itf) {
+        l2_binding l2(*itf, bd);
+        OM::commit(key, l2);
+      }
     }
   }
 }
diff --git a/src/vpp-api/vom/bridge_domain.hpp b/src/vpp-api/vom/bridge_domain.hpp
index c7f84e9ec3f..d345da238ca 100644
--- a/src/vpp-api/vom/bridge_domain.hpp
+++ b/src/vpp-api/vom/bridge_domain.hpp
@@ -52,6 +52,51 @@ public:
   };
 
   /**
+   * Bridge Domain ARP termination mode
+   */
+  struct arp_term_mode_t : enum_base<arp_term_mode_t>
+  {
+    const static arp_term_mode_t ON;
+    const static arp_term_mode_t OFF;
+
+  private:
+    /**
+     * Private constructor taking the value and the string name
+     */
+    arp_term_mode_t(int v, const std::string& s);
+  };
+
+  /**
+   * Bridge Domain MAC aging mode
+   */
+  struct mac_age_mode_t : enum_base<mac_age_mode_t>
+  {
+    const static mac_age_mode_t ON;
+    const static mac_age_mode_t OFF;
+
+  private:
+    /**
+     * Private constructor taking the value and the string name
+     */
+    mac_age_mode_t(int v, const std::string& s);
+  };
+
+  /**
+   * Bridge Domain Learning mode
+   */
+  struct flood_mode_t : enum_base<flood_mode_t>
+  {
+    const static flood_mode_t ON;
+    const static flood_mode_t OFF;
+
+  private:
+    /**
+     * Private constructor taking the value and the string name
+     */
+    flood_mode_t(int v, const std::string& s);
+  };
+
+  /**
    * The value of the defaultbridge domain
    */
   const static uint32_t DEFAULT_TABLE = 0;
@@ -60,7 +105,10 @@ public:
    * Construct a new object matching the desried state
    */
   bridge_domain(uint32_t id,
-                const learning_mode_t& lmode = learning_mode_t::ON);
+                const learning_mode_t& lmode = learning_mode_t::ON,
+                const arp_term_mode_t& amode = arp_term_mode_t::ON,
+                const flood_mode_t& fmode = flood_mode_t::ON,
+                const mac_age_mode_t& mmode = mac_age_mode_t::OFF);
 
   /**
    * Copy Constructor
@@ -179,11 +227,26 @@ private:
   HW::item<uint32_t> m_id;
 
   /**
-   * The leanring mode of the bridge
+   * The learning mode of the bridge
    */
   learning_mode_t m_learning_mode;
 
   /**
+   * The ARP termination mode of the bridge
+   */
+  arp_term_mode_t m_arp_term_mode;
+
+  /**
+   * The flood mode of the bridge
+   */
+  flood_mode_t m_flood_mode;
+
+  /**
+   * The MAC aging mode of the bridge
+   */
+  mac_age_mode_t m_mac_age_mode;
+
+  /**
    * A map of all interfaces key against the interface's name
    */
   static singular_db<key_t, bridge_domain> m_db;
diff --git a/src/vpp-api/vom/bridge_domain_cmds.cpp b/src/vpp-api/vom/bridge_domain_cmds.cpp
index 498569f9fab..d1d536f6d39 100644
--- a/src/vpp-api/vom/bridge_domain_cmds.cpp
+++ b/src/vpp-api/vom/bridge_domain_cmds.cpp
@@ -20,9 +20,15 @@ DEFINE_VAPI_MSG_IDS_L2_API_JSON;
 namespace VOM {
 namespace bridge_domain_cmds {
 create_cmd::create_cmd(HW::item<uint32_t>& item,
-                       const bridge_domain::learning_mode_t& lmode)
+                       const bridge_domain::learning_mode_t& lmode,
+                       const bridge_domain::arp_term_mode_t& amode,
+                       const bridge_domain::flood_mode_t& fmode,
+                       const bridge_domain::mac_age_mode_t& mmode)
   : rpc_cmd(item)
   , m_learning_mode(lmode)
+  , m_arp_term_mode(amode)
+  , m_flood_mode(fmode)
+  , m_mac_age_mode(mmode)
 {
 }
 
@@ -39,12 +45,12 @@ create_cmd::issue(connection& con)
 
   auto& payload = req.get_request().get_payload();
   payload.bd_id = m_hw_item.data();
-  payload.flood = 1;
-  payload.uu_flood = 1;
+  payload.flood = m_flood_mode.value();
+  payload.uu_flood = m_flood_mode.value();
   payload.forward = 1;
   payload.learn = m_learning_mode.value();
-  payload.arp_term = 1;
-  payload.mac_age = 0;
+  payload.arp_term = m_arp_term_mode.value();
+  payload.mac_age = m_mac_age_mode.value();
   payload.is_add = 1;
 
   VAPI_CALL(req.execute());
diff --git a/src/vpp-api/vom/bridge_domain_cmds.hpp b/src/vpp-api/vom/bridge_domain_cmds.hpp
index f263b323e41..0216236d42c 100644
--- a/src/vpp-api/vom/bridge_domain_cmds.hpp
+++ b/src/vpp-api/vom/bridge_domain_cmds.hpp
@@ -35,7 +35,10 @@ public:
    * Constructor
    */
   create_cmd(HW::item<uint32_t>& item,
-             const bridge_domain::learning_mode_t& lmode);
+             const bridge_domain::learning_mode_t& lmode,
+             const bridge_domain::arp_term_mode_t& amode,
+             const bridge_domain::flood_mode_t& fmode,
+             const bridge_domain::mac_age_mode_t& mmode);
 
   /**
    * Issue the command to VPP/HW
@@ -56,6 +59,18 @@ private:
    * the learning mode for the bridge
    */
   bridge_domain::learning_mode_t m_learning_mode;
+  /**
+   * the learning mode for the bridge
+   */
+  bridge_domain::arp_term_mode_t m_arp_term_mode;
+  /**
+   * the flood mode for the bridge
+   */
+  bridge_domain::flood_mode_t m_flood_mode;
+  /**
+   * the flood mode for the bridge
+   */
+  bridge_domain::mac_age_mode_t m_mac_age_mode;
 };
 
 /**
diff --git a/src/vpp-api/vom/gbp_endpoint.cpp b/src/vpp-api/vom/gbp_endpoint.cpp
index cd5d7e11ad6..9762a91429a 100644
--- a/src/vpp-api/vom/gbp_endpoint.cpp
+++ b/src/vpp-api/vom/gbp_endpoint.cpp
@@ -25,48 +25,48 @@ gbp_endpoint::event_handler gbp_endpoint::m_evh;
 
 gbp_endpoint::gbp_endpoint(const interface& itf,
                            const boost::asio::ip::address& ip_addr,
-                           epg_id_t epg_id)
+                           const mac_address_t& mac,
+                           const gbp_endpoint_group& epg)
   : m_hw(false)
   , m_itf(itf.singular())
-  , m_ip_addr(ip_addr)
-  , m_epg_id(epg_id)
+  , m_ip(ip_addr)
+  , m_mac(mac)
+  , m_epg(epg.singular())
 {
 }
 
 gbp_endpoint::gbp_endpoint(const gbp_endpoint& gbpe)
   : m_hw(gbpe.m_hw)
   , m_itf(gbpe.m_itf)
-  , m_ip_addr(gbpe.m_ip_addr)
-  , m_epg_id(gbpe.m_epg_id)
+  , m_ip(gbpe.m_ip)
+  , m_mac(gbpe.m_mac)
+  , m_epg(gbpe.m_epg)
 {
 }
 
 gbp_endpoint::~gbp_endpoint()
 {
   sweep();
-
-  // not in the DB anymore.
   m_db.release(key(), this);
 }
 
 const gbp_endpoint::key_t
 gbp_endpoint::key() const
 {
-  return (std::make_pair(m_itf->key(), m_ip_addr));
+  return (std::make_pair(m_itf->key(), m_ip));
 }
 
 bool
 gbp_endpoint::operator==(const gbp_endpoint& gbpe) const
 {
-  return ((key() == gbpe.key()) && (m_epg_id == gbpe.m_epg_id));
+  return ((key() == gbpe.key()) && (m_epg == gbpe.m_epg));
 }
 
 void
 gbp_endpoint::sweep()
 {
   if (m_hw) {
-    HW::enqueue(
-      new gbp_endpoint_cmds::delete_cmd(m_hw, m_itf->handle(), m_ip_addr));
+    HW::enqueue(new gbp_endpoint_cmds::delete_cmd(m_hw, m_itf->handle(), m_ip));
   }
   HW::write();
 }
@@ -75,8 +75,8 @@ void
 gbp_endpoint::replay()
 {
   if (m_hw) {
-    HW::enqueue(new gbp_endpoint_cmds::create_cmd(m_hw, m_itf->handle(),
-                                                  m_ip_addr, m_epg_id));
+    HW::enqueue(new gbp_endpoint_cmds::create_cmd(m_hw, m_itf->handle(), m_ip,
+                                                  m_mac, m_epg->id()));
   }
 }
 
@@ -84,8 +84,8 @@ std::string
 gbp_endpoint::to_string() const
 {
   std::ostringstream s;
-  s << "gbp-endpoint:[" << m_itf->to_string() << ", " << m_ip_addr.to_string()
-    << ", epg-id:" << m_epg_id << "]";
+  s << "gbp-endpoint:[" << m_itf->to_string() << ", " << m_ip.to_string()
+    << ", " << m_mac.to_string() << ", epg:" << m_epg->to_string() << "]";
 
   return (s.str());
 }
@@ -93,12 +93,9 @@ gbp_endpoint::to_string() const
 void
 gbp_endpoint::update(const gbp_endpoint& r)
 {
-  /*
- * create the table if it is not yet created
- */
   if (rc_t::OK != m_hw.rc()) {
-    HW::enqueue(new gbp_endpoint_cmds::create_cmd(m_hw, m_itf->handle(),
-                                                  m_ip_addr, m_epg_id));
+    HW::enqueue(new gbp_endpoint_cmds::create_cmd(m_hw, m_itf->handle(), m_ip,
+                                                  m_mac, m_epg->id()));
   }
 }
 
@@ -154,11 +151,14 @@ gbp_endpoint::event_handler::handle_populate(const client_db::key_t& key)
       from_bytes(payload.endpoint.is_ip6, payload.endpoint.address);
     std::shared_ptr<interface> itf =
       interface::find(payload.endpoint.sw_if_index);
+    std::shared_ptr<gbp_endpoint_group> epg =
+      gbp_endpoint_group::find(payload.endpoint.epg_id);
+    mac_address_t mac(payload.endpoint.mac);
 
     VOM_LOG(log_level_t::DEBUG) << "data: " << payload.endpoint.sw_if_index;
 
-    if (itf) {
-      gbp_endpoint gbpe(*itf, address, payload.endpoint.epg_id);
+    if (itf && epg) {
+      gbp_endpoint gbpe(*itf, address, mac, *epg);
       OM::commit(key, gbpe);
 
       VOM_LOG(log_level_t::DEBUG) << "read: " << gbpe.to_string();
diff --git a/src/vpp-api/vom/gbp_endpoint.hpp b/src/vpp-api/vom/gbp_endpoint.hpp
index 6ece4fa5431..f6466a6077d 100644
--- a/src/vpp-api/vom/gbp_endpoint.hpp
+++ b/src/vpp-api/vom/gbp_endpoint.hpp
@@ -18,19 +18,13 @@
 
 #include <ostream>
 
+#include "vom/gbp_endpoint_group.hpp"
 #include "vom/interface.hpp"
 #include "vom/singular_db.hpp"
-#include "vom/types.hpp"
 
 namespace VOM {
-
-/**
- * EPG IDs are 32 bit integers
- */
-typedef uint32_t epg_id_t;
-
 /**
- * A entry in the ARP termination table of a Bridge Domain
+ * A GBP Enpoint (i.e. a VM)
  */
 class gbp_endpoint : public object_base
 {
@@ -45,7 +39,8 @@ public:
    */
   gbp_endpoint(const interface& itf,
                const boost::asio::ip::address& ip_addr,
-               epg_id_t epg_id);
+               const mac_address_t& mac,
+               const gbp_endpoint_group& epg);
 
   /**
    * Copy Construct
@@ -166,12 +161,17 @@ private:
   /**
    * The IP address of the endpoint
    */
-  boost::asio::ip::address m_ip_addr;
+  boost::asio::ip::address m_ip;
+
+  /**
+   * The MAC address of the endpoint
+   */
+  mac_address_t m_mac;
 
   /**
-   * The EPG ID
+   * The EPG the endpoint is in
    */
-  epg_id_t m_epg_id;
+  std::shared_ptr<gbp_endpoint_group> m_epg;
 
   /**
    * A map of all bridge_domains
diff --git a/src/vpp-api/vom/gbp_endpoint_cmds.cpp b/src/vpp-api/vom/gbp_endpoint_cmds.cpp
index 4f85b7eff4e..88d2f377bc7 100644
--- a/src/vpp-api/vom/gbp_endpoint_cmds.cpp
+++ b/src/vpp-api/vom/gbp_endpoint_cmds.cpp
@@ -23,10 +23,12 @@ namespace gbp_endpoint_cmds {
 create_cmd::create_cmd(HW::item<bool>& item,
                        const handle_t& itf,
                        const boost::asio::ip::address& ip_addr,
+                       const mac_address_t& mac,
                        epg_id_t epg_id)
   : rpc_cmd(item)
   , m_itf(itf)
   , m_ip_addr(ip_addr)
+  , m_mac(mac)
   , m_epg_id(epg_id)
 {
 }
@@ -35,7 +37,7 @@ bool
 create_cmd::operator==(const create_cmd& other) const
 {
   return ((m_itf == other.m_itf) && (m_ip_addr == other.m_ip_addr) &&
-          (m_epg_id == other.m_epg_id));
+          (m_mac == other.m_mac) && (m_epg_id == other.m_epg_id));
 }
 
 rc_t
@@ -48,6 +50,7 @@ create_cmd::issue(connection& con)
   payload.endpoint.sw_if_index = m_itf.value();
   payload.endpoint.epg_id = m_epg_id;
   to_bytes(m_ip_addr, &payload.endpoint.is_ip6, payload.endpoint.address);
+  m_mac.to_bytes(payload.endpoint.mac, 6);
 
   VAPI_CALL(req.execute());
 
diff --git a/src/vpp-api/vom/gbp_endpoint_cmds.hpp b/src/vpp-api/vom/gbp_endpoint_cmds.hpp
index cc7884979e8..2893ef51eec 100644
--- a/src/vpp-api/vom/gbp_endpoint_cmds.hpp
+++ b/src/vpp-api/vom/gbp_endpoint_cmds.hpp
@@ -37,6 +37,7 @@ public:
   create_cmd(HW::item<bool>& item,
              const handle_t& itf,
              const boost::asio::ip::address& ip_addr,
+             const mac_address_t& mac,
              epg_id_t epg_id);
 
   /**
@@ -57,6 +58,7 @@ public:
 private:
   const handle_t m_itf;
   const boost::asio::ip::address m_ip_addr;
+  const mac_address_t m_mac;
   const epg_id_t m_epg_id;
 };
 
diff --git a/src/vpp-api/vom/gbp_endpoint_group.cpp b/src/vpp-api/vom/gbp_endpoint_group.cpp
new file mode 100644
index 00000000000..d9f0d38d594
--- /dev/null
+++ b/src/vpp-api/vom/gbp_endpoint_group.cpp
@@ -0,0 +1,198 @@
+/*
+ * Copyright (c) 2018 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "vom/gbp_endpoint_group.hpp"
+#include "vom/gbp_endpoint_group_cmds.hpp"
+#include "vom/singular_db_funcs.hpp"
+
+namespace VOM {
+
+singular_db<gbp_endpoint_group::key_t, gbp_endpoint_group>
+  gbp_endpoint_group::m_db;
+
+gbp_endpoint_group::event_handler gbp_endpoint_group::m_evh;
+
+gbp_endpoint_group::gbp_endpoint_group(epg_id_t epg_id,
+                                       const interface& itf,
+                                       const route_domain& rd,
+                                       const bridge_domain& bd)
+  : m_hw(false)
+  , m_epg_id(epg_id)
+  , m_itf(itf.singular())
+  , m_rd(rd.singular())
+  , m_bd(bd.singular())
+{
+}
+
+gbp_endpoint_group::gbp_endpoint_group(const gbp_endpoint_group& epg)
+  : m_hw(epg.m_hw)
+  , m_epg_id(epg.m_epg_id)
+  , m_itf(epg.m_itf)
+  , m_rd(epg.m_rd)
+  , m_bd(epg.m_bd)
+{
+}
+
+gbp_endpoint_group::~gbp_endpoint_group()
+{
+  sweep();
+  m_db.release(key(), this);
+}
+
+const gbp_endpoint_group::key_t
+gbp_endpoint_group::key() const
+{
+  return (m_epg_id);
+}
+
+epg_id_t
+gbp_endpoint_group::id() const
+{
+  return (m_epg_id);
+}
+
+bool
+gbp_endpoint_group::operator==(const gbp_endpoint_group& gbpe) const
+{
+  return (key() == gbpe.key() && (m_itf == gbpe.m_itf) && (m_rd == gbpe.m_rd) &&
+          (m_bd == gbpe.m_bd));
+}
+
+void
+gbp_endpoint_group::sweep()
+{
+  if (m_hw) {
+    HW::enqueue(new gbp_endpoint_group_cmds::delete_cmd(m_hw, m_epg_id));
+  }
+  HW::write();
+}
+
+void
+gbp_endpoint_group::replay()
+{
+  if (m_hw) {
+    HW::enqueue(new gbp_endpoint_group_cmds::create_cmd(
+      m_hw, m_epg_id, m_bd->id(), m_rd->table_id(), m_itf->handle()));
+  }
+}
+
+std::string
+gbp_endpoint_group::to_string() const
+{
+  std::ostringstream s;
+  s << "gbp-endpoint-group:["
+    << "epg:" << m_epg_id << ", " << m_itf->to_string() << ", "
+    << m_bd->to_string() << ", " << m_rd->to_string() << "]";
+
+  return (s.str());
+}
+
+void
+gbp_endpoint_group::update(const gbp_endpoint_group& r)
+{
+  if (rc_t::OK != m_hw.rc()) {
+    HW::enqueue(new gbp_endpoint_group_cmds::create_cmd(
+      m_hw, m_epg_id, m_bd->id(), m_rd->table_id(), m_itf->handle()));
+  }
+}
+
+std::shared_ptr<gbp_endpoint_group>
+gbp_endpoint_group::find_or_add(const gbp_endpoint_group& temp)
+{
+  return (m_db.find_or_add(temp.key(), temp));
+}
+
+std::shared_ptr<gbp_endpoint_group>
+gbp_endpoint_group::find(const key_t& k)
+{
+  return (m_db.find(k));
+}
+
+std::shared_ptr<gbp_endpoint_group>
+gbp_endpoint_group::singular() const
+{
+  return find_or_add(*this);
+}
+
+void
+gbp_endpoint_group::dump(std::ostream& os)
+{
+  db_dump(m_db, os);
+}
+
+gbp_endpoint_group::event_handler::event_handler()
+{
+  OM::register_listener(this);
+  inspect::register_handler({ "gbp-endpoint-group" }, "GBP Endpoint_Groups",
+                            this);
+}
+
+void
+gbp_endpoint_group::event_handler::handle_replay()
+{
+  m_db.replay();
+}
+
+void
+gbp_endpoint_group::event_handler::handle_populate(const client_db::key_t& key)
+{
+  std::shared_ptr<gbp_endpoint_group_cmds::dump_cmd> cmd =
+    std::make_shared<gbp_endpoint_group_cmds::dump_cmd>();
+
+  HW::enqueue(cmd);
+  HW::write();
+
+  for (auto& record : *cmd) {
+    auto& payload = record.get_payload();
+
+    std::shared_ptr<interface> itf =
+      interface::find(payload.epg.uplink_sw_if_index);
+    std::shared_ptr<route_domain> rd =
+      route_domain::find(payload.epg.ip4_table_id);
+    std::shared_ptr<bridge_domain> bd = bridge_domain::find(payload.epg.bd_id);
+
+    VOM_LOG(log_level_t::DEBUG) << "data: [" << payload.epg.uplink_sw_if_index
+                                << ", " << payload.epg.ip4_table_id << ", "
+                                << payload.epg.bd_id << "]";
+
+    if (itf && bd && rd) {
+      gbp_endpoint_group gbpe(payload.epg.epg_id, *itf, *rd, *bd);
+      OM::commit(key, gbpe);
+
+      VOM_LOG(log_level_t::DEBUG) << "read: " << gbpe.to_string();
+    }
+  }
+}
+
+dependency_t
+gbp_endpoint_group::event_handler::order() const
+{
+  return (dependency_t::ACL);
+}
+
+void
+gbp_endpoint_group::event_handler::show(std::ostream& os)
+{
+  db_dump(m_db, os);
+}
+} // namespace VOM
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "mozilla")
+ * End:
+ */
diff --git a/src/vpp-api/vom/gbp_endpoint_group.hpp b/src/vpp-api/vom/gbp_endpoint_group.hpp
new file mode 100644
index 00000000000..f7c900f20be
--- /dev/null
+++ b/src/vpp-api/vom/gbp_endpoint_group.hpp
@@ -0,0 +1,205 @@
+/*
+ * Copyright (c) 2017 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef __VOM_GBP_ENDPOINT_GROUP_H__
+#define __VOM_GBP_ENDPOINT_GROUP_H__
+
+#include "vom/interface.hpp"
+#include "vom/singular_db.hpp"
+#include "vom/types.hpp"
+
+#include "vom/bridge_domain.hpp"
+#include "vom/route_domain.hpp"
+
+namespace VOM {
+
+/**
+ * EPG IDs are 32 bit integers
+ */
+typedef uint32_t epg_id_t;
+
+/**
+ * A entry in the ARP termination table of a Bridge Domain
+ */
+class gbp_endpoint_group : public object_base
+{
+public:
+  /**
+   * The key for a GBP endpoint group is its ID
+   */
+  typedef epg_id_t key_t;
+
+  /**
+   * Construct a GBP endpoint_group
+   */
+  gbp_endpoint_group(epg_id_t epg_id,
+                     const interface& itf,
+                     const route_domain& rd,
+                     const bridge_domain& bd);
+
+  /**
+   * Copy Construct
+   */
+  gbp_endpoint_group(const gbp_endpoint_group& r);
+
+  /**
+   * Destructor
+   */
+  ~gbp_endpoint_group();
+
+  /**
+   * Return the object's key
+   */
+  const key_t key() const;
+
+  /**
+   * comparison operator
+   */
+  bool operator==(const gbp_endpoint_group& bdae) const;
+
+  /**
+   * Return the matching 'singular instance'
+   */
+  std::shared_ptr<gbp_endpoint_group> singular() const;
+
+  /**
+   * Find the instnace of the bridge_domain domain in the OM
+   */
+  static std::shared_ptr<gbp_endpoint_group> find(const key_t& k);
+
+  /**
+   * Dump all bridge_domain-doamin into the stream provided
+   */
+  static void dump(std::ostream& os);
+
+  /**
+   * replay the object to create it in hardware
+   */
+  void replay(void);
+
+  /**
+   * Convert to string for debugging
+   */
+  std::string to_string() const;
+
+  /**
+   * Get the ID of the EPG
+   */
+  epg_id_t id() const;
+
+private:
+  /**
+   * Class definition for listeners to OM events
+   */
+  class event_handler : public OM::listener, public inspect::command_handler
+  {
+  public:
+    event_handler();
+    virtual ~event_handler() = default;
+
+    /**
+     * Handle a populate event
+     */
+    void handle_populate(const client_db::key_t& key);
+
+    /**
+     * Handle a replay event
+     */
+    void handle_replay();
+
+    /**
+     * Show the object in the Singular DB
+     */
+    void show(std::ostream& os);
+
+    /**
+     * Get the sortable Id of the listener
+     */
+    dependency_t order() const;
+  };
+
+  /**
+   * event_handler to register with OM
+   */
+  static event_handler m_evh;
+
+  /**
+   * Commit the acculmulated changes into VPP. i.e. to a 'HW" write.
+   */
+  void update(const gbp_endpoint_group& obj);
+
+  /**
+   * Find or add the instnace of the bridge_domain domain in the OM
+   */
+  static std::shared_ptr<gbp_endpoint_group> find_or_add(
+    const gbp_endpoint_group& temp);
+
+  /*
+   * It's the VPPHW class that updates the objects in HW
+   */
+  friend class OM;
+
+  /**
+   * It's the singular_db class that calls replay()
+   */
+  friend class singular_db<key_t, gbp_endpoint_group>;
+
+  /**
+   * Sweep/reap the object if still stale
+   */
+  void sweep(void);
+
+  /**
+   * HW configuration for the result of creating the endpoint_group
+   */
+  HW::item<bool> m_hw;
+
+  /**
+   * The EPG ID
+   */
+  epg_id_t m_epg_id;
+
+  /**
+   * The uplink interface for the endpoint group
+   */
+  std::shared_ptr<interface> m_itf;
+
+  /**
+   * The route-domain the EPG uses
+   */
+  std::shared_ptr<route_domain> m_rd;
+
+  /**
+   * The bridge-domain the EPG uses
+   */
+  std::shared_ptr<bridge_domain> m_bd;
+
+  /**
+   * A map of all bridge_domains
+   */
+  static singular_db<key_t, gbp_endpoint_group> m_db;
+};
+
+}; // namespace
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "mozilla")
+ * End:
+ */
+
+#endif
diff --git a/src/vpp-api/vom/gbp_endpoint_group_cmds.cpp b/src/vpp-api/vom/gbp_endpoint_group_cmds.cpp
new file mode 100644
index 00000000000..55e81d3a528
--- /dev/null
+++ b/src/vpp-api/vom/gbp_endpoint_group_cmds.cpp
@@ -0,0 +1,147 @@
+/*
+ * Copyright (c) 2018 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "vom/gbp_endpoint_group_cmds.hpp"
+
+namespace VOM {
+namespace gbp_endpoint_group_cmds {
+
+create_cmd::create_cmd(HW::item<bool>& item,
+                       epg_id_t epg_id,
+                       uint32_t bd_id,
+                       route::table_id_t rd_id,
+                       const handle_t& itf)
+  : rpc_cmd(item)
+  , m_epg_id(epg_id)
+  , m_bd_id(bd_id)
+  , m_rd_id(rd_id)
+  , m_itf(itf)
+{
+}
+
+bool
+create_cmd::operator==(const create_cmd& other) const
+{
+  return ((m_itf == other.m_itf) && (m_bd_id == other.m_bd_id) &&
+          (m_rd_id == other.m_rd_id) && (m_epg_id == other.m_epg_id));
+}
+
+rc_t
+create_cmd::issue(connection& con)
+{
+  msg_t req(con.ctx(), std::ref(*this));
+
+  auto& payload = req.get_request().get_payload();
+  payload.is_add = 1;
+  payload.epg.uplink_sw_if_index = m_itf.value();
+  payload.epg.epg_id = m_epg_id;
+  payload.epg.bd_id = m_bd_id;
+  payload.epg.ip4_table_id = m_rd_id;
+  payload.epg.ip6_table_id = m_rd_id;
+
+  VAPI_CALL(req.execute());
+
+  m_hw_item.set(wait());
+
+  return rc_t::OK;
+}
+
+std::string
+create_cmd::to_string() const
+{
+  std::ostringstream s;
+  s << "gbp-endpoint-group-create: " << m_hw_item.to_string()
+    << " epg-id:" << m_epg_id << " bd-id:" << m_bd_id << " rd-id:" << m_rd_id
+    << " itf:" << m_itf;
+
+  return (s.str());
+}
+
+delete_cmd::delete_cmd(HW::item<bool>& item, epg_id_t epg_id)
+  : rpc_cmd(item)
+  , m_epg_id(epg_id)
+{
+}
+
+bool
+delete_cmd::operator==(const delete_cmd& other) const
+{
+  return (m_epg_id == other.m_epg_id);
+}
+
+rc_t
+delete_cmd::issue(connection& con)
+{
+  msg_t req(con.ctx(), std::ref(*this));
+
+  auto& payload = req.get_request().get_payload();
+  payload.is_add = 0;
+  payload.epg.epg_id = m_epg_id;
+
+  VAPI_CALL(req.execute());
+
+  m_hw_item.set(wait());
+
+  return rc_t::OK;
+}
+
+std::string
+delete_cmd::to_string() const
+{
+  std::ostringstream s;
+  s << "gbp-endpoint-group-delete: " << m_hw_item.to_string()
+    << " epg:" << m_epg_id;
+
+  return (s.str());
+}
+
+dump_cmd::dump_cmd()
+{
+}
+
+bool
+dump_cmd::operator==(const dump_cmd& other) const
+{
+  return (true);
+}
+
+rc_t
+dump_cmd::issue(connection& con)
+{
+  m_dump.reset(new msg_t(con.ctx(), std::ref(*this)));
+
+  VAPI_CALL(m_dump->execute());
+
+  wait();
+
+  return rc_t::OK;
+}
+
+std::string
+dump_cmd::to_string() const
+{
+  return ("gbp-endpoint-group-dump");
+}
+
+}; // namespace gbp_endpoint_group_cmds
+}; // namespace VOM
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "mozilla")
+ * End:
+ */
diff --git a/src/vpp-api/vom/gbp_endpoint_group_cmds.hpp b/src/vpp-api/vom/gbp_endpoint_group_cmds.hpp
new file mode 100644
index 00000000000..4da3a4247b4
--- /dev/null
+++ b/src/vpp-api/vom/gbp_endpoint_group_cmds.hpp
@@ -0,0 +1,139 @@
+/*
+ * Copyright (c) 2018 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef __VOM_GBP_ENDPOINT_GROUP_CMDS_H__
+#define __VOM_GBP_ENDPOINT_GROUP_CMDS_H__
+
+#include "vom/dump_cmd.hpp"
+#include "vom/gbp_endpoint_group.hpp"
+
+#include <vapi/gbp.api.vapi.hpp>
+
+namespace VOM {
+namespace gbp_endpoint_group_cmds {
+
+/**
+* A command class that creates or updates the GBP endpoint_group
+*/
+class create_cmd
+  : public rpc_cmd<HW::item<bool>, rc_t, vapi::Gbp_endpoint_group_add_del>
+{
+public:
+  /**
+   * Constructor
+   */
+  create_cmd(HW::item<bool>& item,
+             epg_id_t epg_id,
+             uint32_t bd_id,
+             route::table_id_t rd_id,
+             const handle_t& itf);
+
+  /**
+   * Issue the command to VPP/HW
+   */
+  rc_t issue(connection& con);
+
+  /**
+   * convert to string format for debug purposes
+   */
+  std::string to_string() const;
+
+  /**
+   * Comparison operator - only used for UT
+   */
+  bool operator==(const create_cmd& i) const;
+
+private:
+  const epg_id_t m_epg_id;
+  const uint32_t m_bd_id;
+  const route::table_id_t m_rd_id;
+  const handle_t m_itf;
+};
+
+/**
+ * A cmd class that deletes a GBP endpoint_group
+ */
+class delete_cmd
+  : public rpc_cmd<HW::item<bool>, rc_t, vapi::Gbp_endpoint_group_add_del>
+{
+public:
+  /**
+   * Constructor
+   */
+  delete_cmd(HW::item<bool>& item, epg_id_t epg_id);
+
+  /**
+   * Issue the command to VPP/HW
+   */
+  rc_t issue(connection& con);
+
+  /**
+   * convert to string format for debug purposes
+   */
+  std::string to_string() const;
+
+  /**
+   * Comparison operator - only used for UT
+   */
+  bool operator==(const delete_cmd& i) const;
+
+private:
+  const epg_id_t m_epg_id;
+};
+
+/**
+ * A cmd class that Dumps all the GBP endpoint_groups
+ */
+class dump_cmd : public VOM::dump_cmd<vapi::Gbp_endpoint_group_dump>
+{
+public:
+  /**
+   * Constructor
+   */
+  dump_cmd();
+  dump_cmd(const dump_cmd& d);
+
+  /**
+   * Issue the command to VPP/HW
+   */
+  rc_t issue(connection& con);
+  /**
+   * convert to string format for debug purposes
+   */
+  std::string to_string() const;
+
+  /**
+   * Comparison operator - only used for UT
+   */
+  bool operator==(const dump_cmd& i) const;
+
+private:
+  /**
+   * HW reutrn code
+   */
+  HW::item<bool> item;
+};
+}; // namespace gbp_enpoint_cms
+}; // namespace VOM
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "mozilla")
+ * End:
+ */
+
+#endif
diff --git a/src/vpp-api/vom/gbp_recirc.cpp b/src/vpp-api/vom/gbp_recirc.cpp
new file mode 100644
index 00000000000..250e3048f8a
--- /dev/null
+++ b/src/vpp-api/vom/gbp_recirc.cpp
@@ -0,0 +1,200 @@
+/*
+ * Copyright (c) 2018 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "vom/gbp_recirc.hpp"
+#include "vom/gbp_recirc_cmds.hpp"
+#include "vom/singular_db_funcs.hpp"
+
+namespace VOM {
+
+gbp_recirc::type_t::type_t(int v, const std::string s)
+  : enum_base<gbp_recirc::type_t>(v, s)
+{
+}
+
+const gbp_recirc::type_t gbp_recirc::type_t::INTERNAL(0, "internal");
+const gbp_recirc::type_t gbp_recirc::type_t::EXTERNAL(1, "external");
+
+singular_db<gbp_recirc::key_t, gbp_recirc> gbp_recirc::m_db;
+
+gbp_recirc::event_handler gbp_recirc::m_evh;
+
+gbp_recirc::gbp_recirc(const interface& itf,
+                       const type_t& type,
+                       const gbp_endpoint_group& epg)
+  : m_hw(false)
+  , m_itf(itf.singular())
+  , m_type(type)
+  , m_epg(epg.singular())
+{
+}
+
+gbp_recirc::gbp_recirc(const gbp_recirc& gbpe)
+  : m_hw(gbpe.m_hw)
+  , m_itf(gbpe.m_itf)
+  , m_type(gbpe.m_type)
+  , m_epg(gbpe.m_epg)
+{
+}
+
+gbp_recirc::~gbp_recirc()
+{
+  sweep();
+  m_db.release(key(), this);
+}
+
+const gbp_recirc::key_t
+gbp_recirc::key() const
+{
+  return (m_itf->key());
+}
+
+const handle_t&
+gbp_recirc::handle() const
+{
+  return m_itf->handle();
+}
+
+bool
+gbp_recirc::operator==(const gbp_recirc& gbpe) const
+{
+  return ((key() == gbpe.key()) && (m_type == gbpe.m_type) &&
+          (m_itf == gbpe.m_itf) && (m_epg == gbpe.m_epg));
+}
+
+void
+gbp_recirc::sweep()
+{
+  if (m_hw) {
+    HW::enqueue(new gbp_recirc_cmds::delete_cmd(m_hw, m_itf->handle()));
+  }
+  HW::write();
+}
+
+void
+gbp_recirc::replay()
+{
+  if (m_hw) {
+    HW::enqueue(new gbp_recirc_cmds::create_cmd(
+      m_hw, m_itf->handle(), (m_type == type_t::EXTERNAL), m_epg->id()));
+  }
+}
+
+std::string
+gbp_recirc::to_string() const
+{
+  std::ostringstream s;
+  s << "gbp-recirc:[" << m_itf->to_string() << ", type:" << m_type.to_string()
+    << ", " << m_epg->to_string() << "]";
+
+  return (s.str());
+}
+
+void
+gbp_recirc::update(const gbp_recirc& r)
+{
+  if (rc_t::OK != m_hw.rc()) {
+    HW::enqueue(new gbp_recirc_cmds::create_cmd(
+      m_hw, m_itf->handle(), (m_type == type_t::EXTERNAL), m_epg->id()));
+  }
+}
+
+std::shared_ptr<gbp_recirc>
+gbp_recirc::find_or_add(const gbp_recirc& temp)
+{
+  return (m_db.find_or_add(temp.key(), temp));
+}
+
+std::shared_ptr<gbp_recirc>
+gbp_recirc::find(const key_t& k)
+{
+  return (m_db.find(k));
+}
+
+std::shared_ptr<gbp_recirc>
+gbp_recirc::singular() const
+{
+  return find_or_add(*this);
+}
+
+void
+gbp_recirc::dump(std::ostream& os)
+{
+  db_dump(m_db, os);
+}
+
+gbp_recirc::event_handler::event_handler()
+{
+  OM::register_listener(this);
+  inspect::register_handler({ "gbp-recirc" }, "GBP Recircs", this);
+}
+
+void
+gbp_recirc::event_handler::handle_replay()
+{
+  m_db.replay();
+}
+
+void
+gbp_recirc::event_handler::handle_populate(const client_db::key_t& key)
+{
+  std::shared_ptr<gbp_recirc_cmds::dump_cmd> cmd =
+    std::make_shared<gbp_recirc_cmds::dump_cmd>();
+
+  HW::enqueue(cmd);
+  HW::write();
+
+  for (auto& record : *cmd) {
+    auto& payload = record.get_payload();
+
+    std::shared_ptr<interface> itf =
+      interface::find(payload.recirc.sw_if_index);
+    std::shared_ptr<gbp_endpoint_group> epg =
+      gbp_endpoint_group::find(payload.recirc.epg_id);
+
+    VOM_LOG(log_level_t::DEBUG) << "data: [" << payload.recirc.sw_if_index
+                                << ", " << payload.recirc.epg_id << "]";
+
+    if (itf && epg) {
+      gbp_recirc recirc(
+        *itf, (payload.recirc.is_ext ? type_t::EXTERNAL : type_t::INTERNAL),
+        *epg);
+      OM::commit(key, recirc);
+
+      VOM_LOG(log_level_t::DEBUG) << "read: " << recirc.to_string();
+    }
+  }
+}
+
+dependency_t
+gbp_recirc::event_handler::order() const
+{
+  return (dependency_t::BINDING);
+}
+
+void
+gbp_recirc::event_handler::show(std::ostream& os)
+{
+  db_dump(m_db, os);
+}
+} // namespace VOM
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "mozilla")
+ * End:
+ */
diff --git a/src/vpp-api/vom/gbp_recirc.hpp b/src/vpp-api/vom/gbp_recirc.hpp
new file mode 100644
index 00000000000..fee4f6c2502
--- /dev/null
+++ b/src/vpp-api/vom/gbp_recirc.hpp
@@ -0,0 +1,209 @@
+/*
+ * Copyright (c) 2018 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef __VOM_GBP_RECIRC_H__
+#define __VOM_GBP_RECIRC_H__
+
+#include "vom/gbp_endpoint_group.hpp"
+#include "vom/interface.hpp"
+#include "vom/singular_db.hpp"
+
+namespace VOM {
+/**
+ * A recirculation interface for GBP use pre/post NAT
+ */
+class gbp_recirc : public object_base
+{
+public:
+  /**
+   * The key for a GBP recirc interface
+   */
+  typedef interface::key_t key_t;
+
+  struct type_t : public enum_base<type_t>
+  {
+    /**
+     * Internal recirclation interfaces accept per-NAT translation
+     * traffic from the external/NAT EPG and inject into the
+     * private/NAT-inside EPG
+     */
+    const static type_t INTERNAL;
+
+    /**
+     * External recirculation interfaces accept post-NAT translation
+     * traffic from the internal EPG and inject into the
+     * NAT EPG
+     */
+    const static type_t EXTERNAL;
+
+  private:
+    type_t(int v, const std::string s);
+  };
+
+  /**
+   * Construct a GBP recirc
+   */
+  gbp_recirc(const interface& itf,
+             const type_t& type,
+             const gbp_endpoint_group& epg);
+
+  /**
+   * Copy Construct
+   */
+  gbp_recirc(const gbp_recirc& r);
+
+  /**
+   * Destructor
+   */
+  ~gbp_recirc();
+
+  /**
+   * Return the object's key
+   */
+  const key_t key() const;
+
+  /**
+   * comparison operator
+   */
+  bool operator==(const gbp_recirc& bdae) const;
+
+  /**
+   * Return the matching 'singular instance'
+   */
+  std::shared_ptr<gbp_recirc> singular() const;
+
+  /**
+   * Find the instnace of the recirc interface in the OM
+   */
+  static std::shared_ptr<gbp_recirc> find(const key_t& k);
+
+  /**
+   * Dump all bridge_domain-doamin into the stream provided
+   */
+  static void dump(std::ostream& os);
+
+  /**
+   * replay the object to create it in hardware
+   */
+  void replay(void);
+
+  /**
+   * Convert to string for debugging
+   */
+  std::string to_string() const;
+
+  /**
+   * return the recirculation interface's handle
+   */
+  const handle_t& handle() const;
+
+private:
+  /**
+   * Class definition for listeners to OM events
+   */
+  class event_handler : public OM::listener, public inspect::command_handler
+  {
+  public:
+    event_handler();
+    virtual ~event_handler() = default;
+
+    /**
+     * Handle a populate event
+     */
+    void handle_populate(const client_db::key_t& key);
+
+    /**
+     * Handle a replay event
+     */
+    void handle_replay();
+
+    /**
+     * Show the object in the Singular DB
+     */
+    void show(std::ostream& os);
+
+    /**
+     * Get the sortable Id of the listener
+     */
+    dependency_t order() const;
+  };
+
+  /**
+   * event_handler to register with OM
+   */
+  static event_handler m_evh;
+
+  /**
+   * Commit the acculmulated changes into VPP. i.e. to a 'HW" write.
+   */
+  void update(const gbp_recirc& obj);
+
+  /**
+   * Find or add the instnace of the bridge_domain domain in the OM
+   */
+  static std::shared_ptr<gbp_recirc> find_or_add(const gbp_recirc& temp);
+
+  /*
+   * It's the VPPHW class that updates the objects in HW
+   */
+  friend class OM;
+
+  /**
+   * It's the singular_db class that calls replay()
+   */
+  friend class singular_db<key_t, gbp_recirc>;
+
+  /**
+   * Sweep/reap the object if still stale
+   */
+  void sweep(void);
+
+  /**
+   * HW configuration for the result of creating the recirc
+   */
+  HW::item<bool> m_hw;
+
+  /**
+   * The interface the recirc is attached to.
+   */
+  std::shared_ptr<interface> m_itf;
+
+  /**
+   * Is the reicrc for the external (i.e. post-NAT) or internal
+   */
+  type_t m_type;
+
+  /**
+   * The EPG the recirc is in
+   */
+  std::shared_ptr<gbp_endpoint_group> m_epg;
+
+  /**
+   * A map of all bridge_domains
+   */
+  static singular_db<key_t, gbp_recirc> m_db;
+};
+
+}; // namespace VOM
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "mozilla")
+ * End:
+ */
+
+#endif
diff --git a/src/vpp-api/vom/gbp_recirc_cmds.cpp b/src/vpp-api/vom/gbp_recirc_cmds.cpp
new file mode 100644
index 00000000000..757fcb99065
--- /dev/null
+++ b/src/vpp-api/vom/gbp_recirc_cmds.cpp
@@ -0,0 +1,142 @@
+/*
+ * Copyright (c) 2018 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "vom/gbp_recirc_cmds.hpp"
+
+namespace VOM {
+namespace gbp_recirc_cmds {
+
+create_cmd::create_cmd(HW::item<bool>& item,
+                       const handle_t& itf,
+                       bool is_ext,
+                       epg_id_t epg_id)
+  : rpc_cmd(item)
+  , m_itf(itf)
+  , m_is_ext(is_ext)
+  , m_epg_id(epg_id)
+{
+}
+
+bool
+create_cmd::operator==(const create_cmd& other) const
+{
+  return ((m_itf == other.m_itf) && (m_is_ext == other.m_is_ext) &&
+          (m_epg_id == other.m_epg_id));
+}
+
+rc_t
+create_cmd::issue(connection& con)
+{
+  msg_t req(con.ctx(), std::ref(*this));
+
+  auto& payload = req.get_request().get_payload();
+  payload.is_add = 1;
+  payload.recirc.sw_if_index = m_itf.value();
+  payload.recirc.epg_id = m_epg_id;
+  payload.recirc.is_ext = m_is_ext;
+
+  VAPI_CALL(req.execute());
+
+  m_hw_item.set(wait());
+
+  return rc_t::OK;
+}
+
+std::string
+create_cmd::to_string() const
+{
+  std::ostringstream s;
+  s << "gbp-recirc-create: " << m_hw_item.to_string() << " itf:" << m_itf
+    << " ext:" << m_is_ext << " epg-id:" << m_epg_id;
+
+  return (s.str());
+}
+
+delete_cmd::delete_cmd(HW::item<bool>& item, const handle_t& itf)
+  : rpc_cmd(item)
+  , m_itf(itf)
+{
+}
+
+bool
+delete_cmd::operator==(const delete_cmd& other) const
+{
+  return (m_itf == other.m_itf);
+}
+
+rc_t
+delete_cmd::issue(connection& con)
+{
+  msg_t req(con.ctx(), std::ref(*this));
+
+  auto& payload = req.get_request().get_payload();
+  payload.is_add = 0;
+  payload.recirc.sw_if_index = m_itf.value();
+  payload.recirc.epg_id = ~0;
+
+  VAPI_CALL(req.execute());
+
+  m_hw_item.set(wait());
+
+  return rc_t::OK;
+}
+
+std::string
+delete_cmd::to_string() const
+{
+  std::ostringstream s;
+  s << "gbp-recirc-delete: " << m_hw_item.to_string() << " itf:" << m_itf;
+
+  return (s.str());
+}
+
+dump_cmd::dump_cmd()
+{
+}
+
+bool
+dump_cmd::operator==(const dump_cmd& other) const
+{
+  return (true);
+}
+
+rc_t
+dump_cmd::issue(connection& con)
+{
+  m_dump.reset(new msg_t(con.ctx(), std::ref(*this)));
+
+  VAPI_CALL(m_dump->execute());
+
+  wait();
+
+  return rc_t::OK;
+}
+
+std::string
+dump_cmd::to_string() const
+{
+  return ("gbp-recirc-dump");
+}
+
+}; // namespace gbp_recirc_cmds
+}; // namespace VOM
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "mozilla")
+ * End:
+ */
diff --git a/src/vpp-api/vom/gbp_recirc_cmds.hpp b/src/vpp-api/vom/gbp_recirc_cmds.hpp
new file mode 100644
index 00000000000..fe17834ebf5
--- /dev/null
+++ b/src/vpp-api/vom/gbp_recirc_cmds.hpp
@@ -0,0 +1,137 @@
+/*
+ * Copyright (c) 2017 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef __VOM_GBP_RECIRC_CMDS_H__
+#define __VOM_GBP_RECIRC_CMDS_H__
+
+#include "vom/dump_cmd.hpp"
+#include "vom/gbp_recirc.hpp"
+
+#include <vapi/gbp.api.vapi.hpp>
+
+namespace VOM {
+namespace gbp_recirc_cmds {
+
+/**
+* A command class that creates or updates the GBP recirc
+*/
+class create_cmd
+  : public rpc_cmd<HW::item<bool>, rc_t, vapi::Gbp_recirc_add_del>
+{
+public:
+  /**
+   * Constructor
+   */
+  create_cmd(HW::item<bool>& item,
+             const handle_t& itf,
+             bool is_ext,
+             epg_id_t epg_id);
+
+  /**
+   * Issue the command to VPP/HW
+   */
+  rc_t issue(connection& con);
+
+  /**
+   * convert to string format for debug purposes
+   */
+  std::string to_string() const;
+
+  /**
+   * Comparison operator - only used for UT
+   */
+  bool operator==(const create_cmd& i) const;
+
+private:
+  const handle_t m_itf;
+  bool m_is_ext;
+  const epg_id_t m_epg_id;
+};
+
+/**
+ * A cmd class that deletes a GBP recirc
+ */
+class delete_cmd
+  : public rpc_cmd<HW::item<bool>, rc_t, vapi::Gbp_recirc_add_del>
+{
+public:
+  /**
+   * Constructor
+   */
+  delete_cmd(HW::item<bool>& item, const handle_t& itf);
+
+  /**
+   * Issue the command to VPP/HW
+   */
+  rc_t issue(connection& con);
+
+  /**
+   * convert to string format for debug purposes
+   */
+  std::string to_string() const;
+
+  /**
+   * Comparison operator - only used for UT
+   */
+  bool operator==(const delete_cmd& i) const;
+
+private:
+  const handle_t m_itf;
+};
+
+/**
+ * A cmd class that Dumps all the GBP recircs
+ */
+class dump_cmd : public VOM::dump_cmd<vapi::Gbp_recirc_dump>
+{
+public:
+  /**
+   * Constructor
+   */
+  dump_cmd();
+  dump_cmd(const dump_cmd& d);
+
+  /**
+   * Issue the command to VPP/HW
+   */
+  rc_t issue(connection& con);
+  /**
+   * convert to string format for debug purposes
+   */
+  std::string to_string() const;
+
+  /**
+   * Comparison operator - only used for UT
+   */
+  bool operator==(const dump_cmd& i) const;
+
+private:
+  /**
+   * HW reutrn code
+   */
+  HW::item<bool> item;
+};
+}; // namespace gbp_enpoint_cms
+}; // namespace VOM
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "mozilla")
+ * End:
+ */
+
+#endif
diff --git a/src/vpp-api/vom/gbp_subnet.cpp b/src/vpp-api/vom/gbp_subnet.cpp
new file mode 100644
index 00000000000..84dbd227ed9
--- /dev/null
+++ b/src/vpp-api/vom/gbp_subnet.cpp
@@ -0,0 +1,231 @@
+/*
+ * Copyright (c) 2018 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "vom/gbp_subnet.hpp"
+#include "vom/gbp_subnet_cmds.hpp"
+#include "vom/singular_db_funcs.hpp"
+
+namespace VOM {
+
+gbp_subnet::type_t::type_t(int v, const std::string s)
+  : enum_base<gbp_subnet::type_t>(v, s)
+{
+}
+
+const gbp_subnet::type_t gbp_subnet::type_t::INTERNAL(0, "internal");
+const gbp_subnet::type_t gbp_subnet::type_t::EXTERNAL(1, "external");
+
+singular_db<gbp_subnet::key_t, gbp_subnet> gbp_subnet::m_db;
+
+gbp_subnet::event_handler gbp_subnet::m_evh;
+
+gbp_subnet::gbp_subnet(const route_domain& rd, const route::prefix_t& prefix)
+  : m_hw(false)
+  , m_rd(rd.singular())
+  , m_prefix(prefix)
+  , m_type(type_t::INTERNAL)
+  , m_recirc(nullptr)
+  , m_epg(nullptr)
+{
+}
+
+gbp_subnet::gbp_subnet(const route_domain& rd,
+                       const route::prefix_t& prefix,
+                       const gbp_recirc& recirc,
+                       const gbp_endpoint_group& epg)
+  : m_hw(false)
+  , m_rd(rd.singular())
+  , m_prefix(prefix)
+  , m_type(type_t::EXTERNAL)
+  , m_recirc(recirc.singular())
+  , m_epg(epg.singular())
+{
+}
+
+gbp_subnet::gbp_subnet(const gbp_subnet& o)
+  : m_hw(o.m_hw)
+  , m_rd(o.m_rd)
+  , m_prefix(o.m_prefix)
+  , m_type(o.m_type)
+  , m_recirc(o.m_recirc)
+  , m_epg(o.m_epg)
+{
+}
+
+gbp_subnet::~gbp_subnet()
+{
+  sweep();
+  m_db.release(key(), this);
+}
+
+const gbp_subnet::key_t
+gbp_subnet::key() const
+{
+  return (std::make_pair(m_rd->key(), m_prefix));
+}
+
+bool
+gbp_subnet::operator==(const gbp_subnet& gbpe) const
+{
+  return ((key() == gbpe.key()) && (m_recirc == gbpe.m_recirc) &&
+          (m_epg == gbpe.m_epg));
+}
+
+void
+gbp_subnet::sweep()
+{
+  if (m_hw) {
+    HW::enqueue(
+      new gbp_subnet_cmds::delete_cmd(m_hw, m_rd->table_id(), m_prefix));
+  }
+  HW::write();
+}
+
+void
+gbp_subnet::replay()
+{
+  if (m_hw) {
+    HW::enqueue(new gbp_subnet_cmds::create_cmd(
+      m_hw, m_rd->table_id(), m_prefix, (m_type == type_t::INTERNAL),
+      (m_recirc ? m_recirc->handle() : handle_t::INVALID),
+      (m_epg ? m_epg->id() : ~0)));
+  }
+}
+
+std::string
+gbp_subnet::to_string() const
+{
+  std::ostringstream s;
+  s << "gbp-subnet:[" << m_type.to_string() << ", " << m_rd->to_string() << ":"
+    << m_prefix.to_string();
+  if (m_recirc)
+    s << ", " << m_recirc->to_string();
+  if (m_epg)
+    s << ", " << m_epg->to_string();
+
+  s << "]";
+
+  return (s.str());
+}
+
+void
+gbp_subnet::update(const gbp_subnet& r)
+{
+  if (rc_t::OK != m_hw.rc()) {
+    HW::enqueue(new gbp_subnet_cmds::create_cmd(
+      m_hw, m_rd->table_id(), m_prefix, (m_type == type_t::INTERNAL),
+      (m_recirc ? m_recirc->handle() : handle_t::INVALID),
+      (m_epg ? m_epg->id() : ~0)));
+  }
+}
+
+std::shared_ptr<gbp_subnet>
+gbp_subnet::find_or_add(const gbp_subnet& temp)
+{
+  return (m_db.find_or_add(temp.key(), temp));
+}
+
+std::shared_ptr<gbp_subnet>
+gbp_subnet::find(const key_t& k)
+{
+  return (m_db.find(k));
+}
+
+std::shared_ptr<gbp_subnet>
+gbp_subnet::singular() const
+{
+  return find_or_add(*this);
+}
+
+void
+gbp_subnet::dump(std::ostream& os)
+{
+  db_dump(m_db, os);
+}
+
+gbp_subnet::event_handler::event_handler()
+{
+  OM::register_listener(this);
+  inspect::register_handler({ "gbp-subnet" }, "GBP Subnets", this);
+}
+
+void
+gbp_subnet::event_handler::handle_replay()
+{
+  m_db.replay();
+}
+
+void
+gbp_subnet::event_handler::handle_populate(const client_db::key_t& key)
+{
+  std::shared_ptr<gbp_subnet_cmds::dump_cmd> cmd =
+    std::make_shared<gbp_subnet_cmds::dump_cmd>();
+
+  HW::enqueue(cmd);
+  HW::write();
+
+  for (auto& record : *cmd) {
+    auto& payload = record.get_payload();
+
+    route::prefix_t pfx(payload.subnet.is_ip6, payload.subnet.address,
+                        payload.subnet.address_length);
+    std::shared_ptr<route_domain> rd =
+      route_domain::find(payload.subnet.table_id);
+
+    if (rd) {
+      if (payload.subnet.is_internal) {
+        gbp_subnet gs(*rd, pfx);
+        OM::commit(key, gs);
+        VOM_LOG(log_level_t::DEBUG) << "read: " << gs.to_string();
+      } else {
+        std::shared_ptr<interface> itf =
+          interface::find(payload.subnet.sw_if_index);
+        std::shared_ptr<gbp_endpoint_group> epg =
+          gbp_endpoint_group::find(payload.subnet.epg_id);
+
+        if (itf && epg) {
+          std::shared_ptr<gbp_recirc> recirc = gbp_recirc::find(itf->key());
+
+          if (recirc) {
+            gbp_subnet gs(*rd, pfx, *recirc, *epg);
+            OM::commit(key, gs);
+            VOM_LOG(log_level_t::DEBUG) << "read: " << gs.to_string();
+          }
+        }
+      }
+    }
+  }
+}
+
+dependency_t
+gbp_subnet::event_handler::order() const
+{
+  return (dependency_t::ENTRY);
+}
+
+void
+gbp_subnet::event_handler::show(std::ostream& os)
+{
+  db_dump(m_db, os);
+}
+} // namespace VOM
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "mozilla")
+ * End:
+ */
diff --git a/src/vpp-api/vom/gbp_subnet.hpp b/src/vpp-api/vom/gbp_subnet.hpp
new file mode 100644
index 00000000000..9c9166ec018
--- /dev/null
+++ b/src/vpp-api/vom/gbp_subnet.hpp
@@ -0,0 +1,218 @@
+/*
+ * Copyright (c) 2017 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef __VOM_GBP_SUBNET_H__
+#define __VOM_GBP_SUBNET_H__
+
+#include "vom/gbp_endpoint_group.hpp"
+#include "vom/gbp_recirc.hpp"
+#include "vom/route.hpp"
+#include "vom/singular_db.hpp"
+
+namespace VOM {
+/**
+ * A GBP Enpoint (i.e. a VM)
+ */
+class gbp_subnet : public object_base
+{
+public:
+  /**
+   * The key for a GBP subnet; table and prefix
+   */
+  typedef std::pair<route_domain::key_t, route::prefix_t> key_t;
+
+  /**
+    * Construct an internal GBP subnet
+    */
+  gbp_subnet(const route_domain& rd, const route::prefix_t& prefix);
+
+  /**
+   * Construct an external GBP subnet
+   */
+  gbp_subnet(const route_domain& rd,
+             const route::prefix_t& prefix,
+             const gbp_recirc& recirc,
+             const gbp_endpoint_group& epg);
+
+  /**
+   * Copy Construct
+   */
+  gbp_subnet(const gbp_subnet& r);
+
+  /**
+   * Destructor
+   */
+  ~gbp_subnet();
+
+  /**
+   * Return the object's key
+   */
+  const key_t key() const;
+
+  /**
+   * comparison operator
+   */
+  bool operator==(const gbp_subnet& bdae) const;
+
+  /**
+   * Return the matching 'singular instance'
+   */
+  std::shared_ptr<gbp_subnet> singular() const;
+
+  /**
+   * Find the instnace of the bridge_domain domain in the OM
+   */
+  static std::shared_ptr<gbp_subnet> find(const key_t& k);
+
+  /**
+   * Dump all bridge_domain-doamin into the stream provided
+   */
+  static void dump(std::ostream& os);
+
+  /**
+   * replay the object to create it in hardware
+   */
+  void replay(void);
+
+  /**
+   * Convert to string for debugging
+   */
+  std::string to_string() const;
+
+private:
+  struct type_t : public enum_base<type_t>
+  {
+    /**
+     * Internal subnet is reachable through the source EPG's
+     * uplink interface.
+     */
+    const static type_t INTERNAL;
+
+    /**
+     * External subnet requires NAT translation before egress.
+     */
+    const static type_t EXTERNAL;
+
+  private:
+    type_t(int v, const std::string s);
+  };
+
+  /**
+   * Class definition for listeners to OM events
+   */
+  class event_handler : public OM::listener, public inspect::command_handler
+  {
+  public:
+    event_handler();
+    virtual ~event_handler() = default;
+
+    /**
+     * Handle a populate event
+     */
+    void handle_populate(const client_db::key_t& key);
+
+    /**
+     * Handle a replay event
+     */
+    void handle_replay();
+
+    /**
+     * Show the object in the Singular DB
+     */
+    void show(std::ostream& os);
+
+    /**
+     * Get the sortable Id of the listener
+     */
+    dependency_t order() const;
+  };
+
+  /**
+   * event_handler to register with OM
+   */
+  static event_handler m_evh;
+
+  /**
+   * Commit the acculmulated changes into VPP. i.e. to a 'HW" write.
+   */
+  void update(const gbp_subnet& obj);
+
+  /**
+   * Find or add the instnace of the bridge_domain domain in the OM
+   */
+  static std::shared_ptr<gbp_subnet> find_or_add(const gbp_subnet& temp);
+
+  /*
+   * It's the VPPHW class that updates the objects in HW
+   */
+  friend class OM;
+
+  /**
+   * It's the singular_db class that calls replay()
+   */
+  friend class singular_db<key_t, gbp_subnet>;
+
+  /**
+   * Sweep/reap the object if still stale
+   */
+  void sweep(void);
+
+  /**
+   * HW configuration for the result of creating the subnet
+   */
+  HW::item<bool> m_hw;
+
+  /**
+   * the route domain the prefix is in
+   */
+  std::shared_ptr<route_domain> m_rd;
+
+  /**
+   * prefix to match
+   */
+  const route::prefix_t m_prefix;
+
+  /*
+   * Subnet type
+   */
+  const type_t m_type;
+
+  /**
+   * The interface the prefix is reachable through
+   */
+  std::shared_ptr<gbp_recirc> m_recirc;
+
+  /**
+   * The EPG the subnet is in
+   */
+  std::shared_ptr<gbp_endpoint_group> m_epg;
+
+  /**
+   * A map of all bridge_domains
+   */
+  static singular_db<key_t, gbp_subnet> m_db;
+};
+
+}; // namespace
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "mozilla")
+ * End:
+ */
+
+#endif
diff --git a/src/vpp-api/vom/gbp_subnet_cmds.cpp b/src/vpp-api/vom/gbp_subnet_cmds.cpp
new file mode 100644
index 00000000000..d087e5c67d8
--- /dev/null
+++ b/src/vpp-api/vom/gbp_subnet_cmds.cpp
@@ -0,0 +1,160 @@
+/*
+ * Copyright (c) 2018 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "vom/gbp_subnet_cmds.hpp"
+
+namespace VOM {
+namespace gbp_subnet_cmds {
+
+create_cmd::create_cmd(HW::item<bool>& item,
+                       route::table_id_t rd,
+                       const route::prefix_t& prefix,
+                       bool internal,
+                       const handle_t& itf,
+                       epg_id_t epg_id)
+  : rpc_cmd(item)
+  , m_rd(rd)
+  , m_prefix(prefix)
+  , m_internal(internal)
+  , m_itf(itf)
+  , m_epg_id(epg_id)
+{
+}
+
+bool
+create_cmd::operator==(const create_cmd& other) const
+{
+  return ((m_itf == other.m_itf) && (m_rd == other.m_rd) &&
+          (m_prefix == other.m_prefix) && (m_itf == other.m_itf) &&
+          (m_epg_id == other.m_epg_id));
+}
+
+rc_t
+create_cmd::issue(connection& con)
+{
+  msg_t req(con.ctx(), std::ref(*this));
+
+  auto& payload = req.get_request().get_payload();
+  payload.is_add = 1;
+  payload.subnet.is_internal = m_internal;
+  payload.subnet.table_id = m_rd;
+  payload.subnet.sw_if_index = m_itf.value();
+  payload.subnet.epg_id = m_epg_id;
+  m_prefix.to_vpp(&payload.subnet.is_ip6, payload.subnet.address,
+                  &payload.subnet.address_length);
+
+  VAPI_CALL(req.execute());
+
+  m_hw_item.set(wait());
+
+  return rc_t::OK;
+}
+
+std::string
+create_cmd::to_string() const
+{
+  std::ostringstream s;
+  s << "gbp-subnet-create: " << m_hw_item.to_string()
+    << "internal:" << m_internal << ", " << m_rd << ":" << m_prefix.to_string()
+    << " itf:" << m_itf << " epg-id:" << m_epg_id;
+
+  return (s.str());
+}
+
+delete_cmd::delete_cmd(HW::item<bool>& item,
+                       route::table_id_t rd,
+                       const route::prefix_t& prefix)
+  : rpc_cmd(item)
+  , m_rd(rd)
+  , m_prefix(prefix)
+{
+}
+
+bool
+delete_cmd::operator==(const delete_cmd& other) const
+{
+  return ((m_rd == other.m_rd) && (m_prefix == other.m_prefix));
+}
+
+rc_t
+delete_cmd::issue(connection& con)
+{
+  msg_t req(con.ctx(), std::ref(*this));
+
+  auto& payload = req.get_request().get_payload();
+  payload.is_add = 0;
+  payload.subnet.table_id = m_rd;
+  m_prefix.to_vpp(&payload.subnet.is_ip6, payload.subnet.address,
+                  &payload.subnet.address_length);
+
+  payload.subnet.is_internal = 0;
+  payload.subnet.sw_if_index = ~0;
+  payload.subnet.epg_id = ~0;
+
+  VAPI_CALL(req.execute());
+
+  m_hw_item.set(wait());
+
+  return rc_t::OK;
+}
+
+std::string
+delete_cmd::to_string() const
+{
+  std::ostringstream s;
+  s << "gbp-subnet-delete: " << m_hw_item.to_string() << ", " << m_rd << ":"
+    << m_prefix.to_string();
+
+  return (s.str());
+}
+
+dump_cmd::dump_cmd()
+{
+}
+
+bool
+dump_cmd::operator==(const dump_cmd& other) const
+{
+  return (true);
+}
+
+rc_t
+dump_cmd::issue(connection& con)
+{
+  m_dump.reset(new msg_t(con.ctx(), std::ref(*this)));
+
+  VAPI_CALL(m_dump->execute());
+
+  wait();
+
+  return rc_t::OK;
+}
+
+std::string
+dump_cmd::to_string() const
+{
+  return ("gbp-subnet-dump");
+}
+
+}; // namespace gbp_subnet_cmds
+}; // namespace VOM
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "mozilla")
+ * End:
+ */
diff --git a/src/vpp-api/vom/gbp_subnet_cmds.hpp b/src/vpp-api/vom/gbp_subnet_cmds.hpp
new file mode 100644
index 00000000000..3dbc8db2359
--- /dev/null
+++ b/src/vpp-api/vom/gbp_subnet_cmds.hpp
@@ -0,0 +1,144 @@
+/*
+ * Copyright (c) 2018 Cisco and/or its affiliates.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef __VOM_GBP_SUBNET_CMDS_H__
+#define __VOM_GBP_SUBNET_CMDS_H__
+
+#include "vom/dump_cmd.hpp"
+#include "vom/gbp_subnet.hpp"
+
+#include <vapi/gbp.api.vapi.hpp>
+
+namespace VOM {
+namespace gbp_subnet_cmds {
+
+/**
+* A command class that creates or updates the GBP subnet
+*/
+class create_cmd
+  : public rpc_cmd<HW::item<bool>, rc_t, vapi::Gbp_subnet_add_del>
+{
+public:
+  /**
+   * Constructor
+   */
+  create_cmd(HW::item<bool>& item,
+             route::table_id_t rd,
+             const route::prefix_t& prefix,
+             bool internal,
+             const handle_t& itf,
+             epg_id_t epg_id);
+
+  /**
+   * Issue the command to VPP/HW
+   */
+  rc_t issue(connection& con);
+
+  /**
+   * convert to string format for debug purposes
+   */
+  std::string to_string() const;
+
+  /**
+   * Comparison operator - only used for UT
+   */
+  bool operator==(const create_cmd& i) const;
+
+private:
+  const route::table_id_t m_rd;
+  const route::prefix_t m_prefix;
+  const bool m_internal;
+  const handle_t m_itf;
+  const epg_id_t m_epg_id;
+};
+
+/**
+ * A cmd class that deletes a GBP subnet
+ */
+class delete_cmd
+  : public rpc_cmd<HW::item<bool>, rc_t, vapi::Gbp_subnet_add_del>
+{
+public:
+  /**
+   * Constructor
+   */
+  delete_cmd(HW::item<bool>& item,
+             route::table_id_t rd,
+             const route::prefix_t& prefix);
+
+  /**
+   * Issue the command to VPP/HW
+   */
+  rc_t issue(connection& con);
+
+  /**
+   * convert to string format for debug purposes
+   */
+  std::string to_string() const;
+
+  /**
+   * Comparison operator - only used for UT
+   */
+  bool operator==(const delete_cmd& i) const;
+
+private:
+  const route::table_id_t m_rd;
+  const route::prefix_t m_prefix;
+};
+
+/**
+ * A cmd class that Dumps all the GBP subnets
+ */
+class dump_cmd : public VOM::dump_cmd<vapi::Gbp_subnet_dump>
+{
+public:
+  /**
+   * Constructor
+   */
+  dump_cmd();
+  dump_cmd(const dump_cmd& d);
+
+  /**
+   * Issue the command to VPP/HW
+   */
+  rc_t issue(connection& con);
+  /**
+   * convert to string format for debug purposes
+   */
+  std::string to_string() const;
+
+  /**
+   * Comparison operator - only used for UT
+   */
+  bool operator==(const dump_cmd& i) const;
+
+private:
+  /**
+   * HW reutrn code
+   */
+  HW::item<bool> item;
+};
+}; // namespace gbp_enpoint_cms
+}; // namespace VOM
+
+/*
+ * fd.io coding-style-patch-verification: ON
+ *
+ * Local Variables:
+ * eval: (c-set-style "mozilla")
+ * End:
+ */
+
+#endif
diff --git a/src/vpp-api/vom/interface.cpp b/src/vpp-api/vom/interface.cpp
index e9b7a1a1f9b..6faf3491e6f 100644
--- a/src/vpp-api/vom/interface.cpp
+++ b/src/vpp-api/vom/interface.cpp
@@ -275,9 +275,7 @@ interface::key() const
 std::queue<cmd*>&
 interface::mk_create_cmd(std::queue<cmd*>& q)
 {
-  if (type_t::LOOPBACK == m_type) {
-    q.push(new interface_cmds::loopback_create_cmd(m_hdl, m_name));
-  } else if (type_t::BVI == m_type) {
+  if ((type_t::LOOPBACK == m_type) || (type_t::BVI == m_type)) {
     q.push(new interface_cmds::loopback_create_cmd(m_hdl, m_name));
     q.push(new interface_cmds::set_tag(m_hdl, m_name));
     /*
@@ -516,8 +514,12 @@ interface::event_handler::handle_populate(const client_db::key_t& key)
   HW::write();
 
   for (auto& itf_record : *cmd) {
-    std::shared_ptr<interface> itf =
-      interface_factory::new_interface(itf_record.get_payload());
+    auto payload = itf_record.get_payload();
+    VOM_LOG(log_level_t::DEBUG) << "dump: [" << payload.sw_if_index
+                                << " name:" << (char*)payload.interface_name
+                                << " tag:" << (char*)payload.tag << "]";
+
+    std::shared_ptr<interface> itf = interface_factory::new_interface(payload);
 
     if (itf && interface::type_t::LOCAL != itf->type()) {
       VOM_LOG(log_level_t::DEBUG) << "dump: " << itf->to_string();
diff --git a/src/vpp-api/vom/interface_types.cpp b/src/vpp-api/vom/interface_types.cpp
index 911282d51b1..139bdd52f9b 100644
--- a/src/vpp-api/vom/interface_types.cpp
+++ b/src/vpp-api/vom/interface_types.cpp
@@ -51,7 +51,8 @@ interface::type_t::from_string(const std::string& str)
     return interface::type_t::ETHERNET;
   } else if (str.find("vxlan") != std::string::npos) {
     return interface::type_t::VXLAN;
-  } else if (str.find("loop") != std::string::npos) {
+  } else if ((str.find("loop") != std::string::npos) ||
+             (str.find("recirc") != std::string::npos)) {
     return interface::type_t::LOOPBACK;
   } else if (str.find("host-") != std::string::npos) {
     return interface::type_t::AFPACKET;
diff --git a/src/vpp-api/vom/nat_binding_cmds.hpp b/src/vpp-api/vom/nat_binding_cmds.hpp
index bb9404872eb..1b51192a73c 100644
--- a/src/vpp-api/vom/nat_binding_cmds.hpp
+++ b/src/vpp-api/vom/nat_binding_cmds.hpp
@@ -255,6 +255,238 @@ private:
   HW::item<bool> item;
 };
 
+/////
+/**
+* A functor class that binds a NAT configuration to an input interface
+*/
+class bind_66_input_cmd
+  : public rpc_cmd<HW::item<bool>, rc_t, vapi::Nat66_add_del_interface>
+{
+public:
+  /**
+   * Constructor
+   */
+  bind_66_input_cmd(HW::item<bool>& item,
+                    const handle_t& itf,
+                    const nat_binding::zone_t& zone);
+
+  /**
+   * Issue the command to VPP/HW
+   */
+  rc_t issue(connection& con);
+  /**
+   * convert to string format for debug purposes
+   */
+  std::string to_string() const;
+
+  /**
+   * Comparison operator - only used for UT
+   */
+  bool operator==(const bind_66_input_cmd& i) const;
+
+private:
+  /**
+   * The interface to bind
+   */
+  const handle_t m_itf;
+
+  /**
+   * The zone the interface is in
+   */
+  const nat_binding::zone_t m_zone;
+};
+
+/**
+ * A cmd class that unbinds a NAT configuration from an input interface
+ */
+class unbind_66_input_cmd
+  : public rpc_cmd<HW::item<bool>, rc_t, vapi::Nat66_add_del_interface>
+{
+public:
+  /**
+   * Constructor
+   */
+  unbind_66_input_cmd(HW::item<bool>& item,
+                      const handle_t& itf,
+                      const nat_binding::zone_t& zone);
+
+  /**
+   * Issue the command to VPP/HW
+   */
+  rc_t issue(connection& con);
+  /**
+   * convert to string format for debug purposes
+   */
+  std::string to_string() const;
+
+  /**
+   * Comparison operator - only used for UT
+   */
+  bool operator==(const unbind_66_input_cmd& i) const;
+
+private:
+  /**
+   * The interface to bind
+   */
+  const handle_t m_itf;
+
+  /**
+   * The zone the interface is in
+   */
+  const nat_binding::zone_t m_zone;
+};
+
+/**
+ * A functor class that binds a NAT configuration to an output interface
+ */
+/* class bind_66_output_cmd */
+/*   : public rpc_cmd<HW::item<bool>, */
+/*                    rc_t, */
+/*                    vapi::Nat66_interface_add_del_output_feature> */
+/* { */
+/* public: */
+/*   /\** */
+/*    * Constructor */
+/*    *\/ */
+/*   bind_66_output_cmd(HW::item<bool>& item, */
+/*                      const handle_t& itf, */
+/*                      const nat_binding::zone_t& zone); */
+
+/*   /\** */
+/*    * Issue the command to VPP/HW */
+/*    *\/ */
+/*   rc_t issue(connection& con); */
+/*   /\** */
+/*    * convert to string format for debug purposes */
+/*    *\/ */
+/*   std::string to_string() const; */
+
+/*   /\** */
+/*    * Comparison operator - only used for UT */
+/*    *\/ */
+/*   bool operator==(const bind_66_output_cmd& i) const; */
+
+/* private: */
+/*   /\** */
+/*    * The interface to bind */
+/*    *\/ */
+/*   const handle_t m_itf; */
+
+/*   /\** */
+/*    * The zone the interface is in */
+/*    *\/ */
+/*   const nat_binding::zone_t m_zone; */
+/* }; */
+
+/* /\** */
+/*  * A cmd class that unbinds a NAT configuration from an output interface */
+/*  *\/ */
+/* class unbind_66_output_cmd */
+/*   : public rpc_cmd<HW::item<bool>, */
+/*                    rc_t, */
+/*                    vapi::Nat66_interface_add_del_output_feature> */
+/* { */
+/* public: */
+/*   /\** */
+/*    * Constructor */
+/*    *\/ */
+/*   unbind_66_output_cmd(HW::item<bool>& item, */
+/*                        const handle_t& itf, */
+/*                        const nat_binding::zone_t& zone); */
+
+/*   /\** */
+/*    * Issue the command to VPP/HW */
+/*    *\/ */
+/*   rc_t issue(connection& con); */
+/*   /\** */
+/*    * convert to string format for debug purposes */
+/*    *\/ */
+/*   std::string to_string() const; */
+
+/*   /\** */
+/*    * Comparison operator - only used for UT */
+/*    *\/ */
+/*   bool operator==(const unbind_66_output_cmd& i) const; */
+
+/* private: */
+/*   /\** */
+/*    * The interface to bind */
+/*    *\/ */
+/*   const handle_t m_itf; */
+
+/*   /\** */
+/*    * The zone the interface is in */
+/*    *\/ */
+/*   const nat_binding::zone_t m_zone; */
+/* }; */
+
+/**
+ * A cmd class that Dumps all the nat_statics
+ */
+class dump_input_66_cmd : public dump_cmd<vapi::Nat66_interface_dump>
+{
+public:
+  /**
+   * Constructor
+   */
+  dump_input_66_cmd();
+  dump_input_66_cmd(const dump_input_66_cmd& d);
+
+  /**
+   * Issue the command to VPP/HW
+   */
+  rc_t issue(connection& con);
+  /**
+   * convert to string format for debug purposes
+   */
+  std::string to_string() const;
+
+  /**
+   * Comparison operator - only used for UT
+   */
+  bool operator==(const dump_input_66_cmd& i) const;
+
+private:
+  /**
+   * HW reutrn code
+   */
+  HW::item<bool> item;
+};
+
+/**
+ * A cmd class that Dumps all the nat_statics
+ */
+/* class dump_output_66_cmd */
+/*   : public dump_cmd<vapi::Nat66_interface_output_feature_dump> */
+/* { */
+/* public: */
+/*   /\** */
+/*    * Constructor */
+/*    *\/ */
+/*   dump_output_66_cmd(); */
+/*   dump_output_66_cmd(const dump_output_66_cmd& d); */
+
+/*   /\** */
+/*    * Issue the command to VPP/HW */
+/*    *\/ */
+/*   rc_t issue(connection& con); */
+/*   /\** */
+/*    * convert to string format for debug purposes */
+/*    *\/ */
+/*   std::string to_string() const; */
+
+/*   /\** */
+/*    * Comparison operator - only used for UT */
+/*    *\/ */
+/*   bool operator==(const dump_output_66_cmd& i) const; */
+
+/* private: */
+/*   /\** */
+/*    * HW reutrn code */
+/*    *\/ */
+/*   HW::item<bool> item; */
+/* }; */
+
 }; // namespace nat_binding_cmds
 }; // namespace VOM
 
diff --git a/src/vpp-api/vom/nat_static.cpp b/src/vpp-api/vom/nat_static.cpp
index 3185b56e228..bf8573d333e 100644
--- a/src/vpp-api/vom/nat_static.cpp
+++ b/src/vpp-api/vom/nat_static.cpp
@@ -22,7 +22,7 @@ singular_db<nat_static::key_t, nat_static> nat_static::m_db;
 nat_static::event_handler nat_static::m_evh;
 
 nat_static::nat_static(const boost::asio::ip::address& inside,
-                       const boost::asio::ip::address_v4& outside)
+                       const boost::asio::ip::address& outside)
   : m_hw(false)
   , m_rd(route_domain::get_default())
   , m_inside(inside)
@@ -32,7 +32,7 @@ nat_static::nat_static(const boost::asio::ip::address& inside,
 
 nat_static::nat_static(const route_domain& rd,
                        const boost::asio::ip::address& inside,
-                       const boost::asio::ip::address_v4& outside)
+                       const boost::asio::ip::address& outside)
   : m_hw(false)
   , m_rd(rd.singular())
   , m_inside(inside)
@@ -74,7 +74,10 @@ nat_static::sweep()
   if (m_hw) {
     if (m_inside.is_v4()) {
       HW::enqueue(new nat_static_cmds::delete_44_cmd(
-        m_hw, m_rd->table_id(), m_inside.to_v4(), m_outside));
+        m_hw, m_rd->table_id(), m_inside.to_v4(), m_outside.to_v4()));
+    } else {
+      HW::enqueue(new nat_static_cmds::delete_66_cmd(
+        m_hw, m_rd->table_id(), m_inside.to_v6(), m_outside.to_v6()));
     }
   }
   HW::write();
@@ -86,7 +89,10 @@ nat_static::replay()
   if (m_hw) {
     if (m_inside.is_v4()) {
       HW::enqueue(new nat_static_cmds::create_44_cmd(
-        m_hw, m_rd->table_id(), m_inside.to_v4(), m_outside));
+        m_hw, m_rd->table_id(), m_inside.to_v4(), m_outside.to_v4()));
+    } else {
+      HW::enqueue(new nat_static_cmds::create_66_cmd(
+        m_hw, m_rd->table_id(), m_inside.to_v6(), m_outside.to_v6()));
     }
   }
 }
@@ -100,7 +106,10 @@ nat_static::update(const nat_static& r)
   if (rc_t::OK != m_hw.rc()) {
     if (m_inside.is_v4()) {
       HW::enqueue(new nat_static_cmds::create_44_cmd(
-        m_hw, m_rd->table_id(), m_inside.to_v4(), m_outside));
+        m_hw, m_rd->table_id(), m_inside.to_v4(), m_outside.to_v4()));
+    } else {
+      HW::enqueue(new nat_static_cmds::create_66_cmd(
+        m_hw, m_rd->table_id(), m_inside.to_v6(), m_outside.to_v6()));
     }
   }
 }
@@ -158,20 +167,43 @@ nat_static::event_handler::handle_populate(const client_db::key_t& key)
   /*
    * dump VPP current states
    */
-  std::shared_ptr<nat_static_cmds::dump_44_cmd> cmd =
+  std::shared_ptr<nat_static_cmds::dump_44_cmd> cmd44 =
     std::make_shared<nat_static_cmds::dump_44_cmd>();
 
-  HW::enqueue(cmd);
+  HW::enqueue(cmd44);
   HW::write();
 
-  for (auto& record : *cmd) {
+  for (auto& record : *cmd44) {
 
     auto& payload = record.get_payload();
 
     boost::asio::ip::address inside = from_bytes(0, payload.local_ip_address);
     boost::asio::ip::address outside =
       from_bytes(0, payload.external_ip_address);
-    nat_static n(route_domain(payload.vrf_id), inside, outside.to_v4());
+    nat_static n(route_domain(payload.vrf_id), inside, outside);
+
+    /*
+     * Write each of the discovered mappings into the OM,
+     * but disable the HW Command q whilst we do, so that no
+     * commands are sent to VPP
+     */
+    OM::commit(key, n);
+  }
+
+  std::shared_ptr<nat_static_cmds::dump_66_cmd> cmd66 =
+    std::make_shared<nat_static_cmds::dump_66_cmd>();
+
+  HW::enqueue(cmd66);
+  HW::write();
+
+  for (auto& record : *cmd66) {
+
+    auto& payload = record.get_payload();
+
+    boost::asio::ip::address inside = from_bytes(1, payload.local_ip_address);
+    boost::asio::ip::address outside =
+      from_bytes(1, payload.external_ip_address);
+    nat_static n(route_domain(payload.vrf_id), inside, outside);
 
     /*
      * Write each of the discovered mappings into the OM,
diff --git a/src/vpp-api/vom/nat_static.hpp b/src/vpp-api/vom/nat_static.hpp
index 3b0d2d06ccc..2dcadb3c904 100644
--- a/src/vpp-api/vom/nat_static.hpp
+++ b/src/vpp-api/vom/nat_static.hpp
@@ -39,7 +39,7 @@ public:
    * table
    */
   nat_static(const boost::asio::ip::address& inside,
-             const boost::asio::ip::address_v4& outside);
+             const boost::asio::ip::address& outside);
 
   /**
    * Construct an NAT Static binding with the outside address in
@@ -47,7 +47,7 @@ public:
    */
   nat_static(const route_domain& rd,
              const boost::asio::ip::address& inside,
-             const boost::asio::ip::address_v4& outside);
+             const boost::asio::ip::address& outside);
 
   /**
    * Copy Construct
@@ -171,9 +171,9 @@ private:
   const boost::asio::ip::address m_inside;
 
   /**
-   * The 'outside' IP address - always v4
+   * The 'outside' IP address
    */
-  const boost::asio::ip::address_v4 m_outside;
+  const boost::asio::ip::address m_outside;
 
   /**
    * A map of all NAT statics
diff --git a/src/vpp-api/vom/nat_static_cmds.cpp b/src/vpp-api/vom/nat_static_cmds.cpp
index facc7c6db8b..a80e47416ea 100644
--- a/src/vpp-api/vom/nat_static_cmds.cpp
+++ b/src/vpp-api/vom/nat_static_cmds.cpp
@@ -144,6 +144,125 @@ dump_44_cmd::issue(connection& con)
 std::string
 dump_44_cmd::to_string() const
 {
+  return ("nat-44-static-dump");
+}
+
+create_66_cmd::create_66_cmd(HW::item<bool>& item,
+                             route::table_id_t id,
+                             const boost::asio::ip::address_v6& inside,
+                             const boost::asio::ip::address_v6& outside)
+  : rpc_cmd(item)
+  , m_id(id)
+  , m_inside(inside)
+  , m_outside(outside)
+{
+}
+
+bool
+create_66_cmd::operator==(const create_66_cmd& other) const
+{
+  return ((m_id == other.m_id) && (m_inside == other.m_inside) &&
+          (m_outside == other.m_outside));
+}
+
+rc_t
+create_66_cmd::issue(connection& con)
+{
+  msg_t req(con.ctx(), std::ref(*this));
+
+  auto& payload = req.get_request().get_payload();
+  payload.is_add = 1;
+  payload.vrf_id = m_id;
+  to_bytes(m_inside, payload.local_ip_address);
+  to_bytes(m_outside, payload.external_ip_address);
+
+  VAPI_CALL(req.execute());
+
+  m_hw_item.set(wait());
+
+  return rc_t::OK;
+}
+
+std::string
+create_66_cmd::to_string() const
+{
+  std::ostringstream s;
+  s << "nat-66-static-create: " << m_hw_item.to_string() << " table:" << m_id
+    << " inside:" << m_inside.to_string()
+    << " outside:" << m_outside.to_string();
+
+  return (s.str());
+}
+
+delete_66_cmd::delete_66_cmd(HW::item<bool>& item,
+                             route::table_id_t id,
+                             const boost::asio::ip::address_v6& inside,
+                             const boost::asio::ip::address_v6& outside)
+  : rpc_cmd(item)
+  , m_id(id)
+  , m_inside(inside)
+  , m_outside(outside)
+{
+}
+
+bool
+delete_66_cmd::operator==(const delete_66_cmd& other) const
+{
+  return ((m_id == other.m_id) && (m_inside == other.m_inside) &&
+          (m_outside == other.m_outside));
+}
+
+rc_t
+delete_66_cmd::issue(connection& con)
+{
+  msg_t req(con.ctx(), std::ref(*this));
+
+  auto& payload = req.get_request().get_payload();
+  payload.is_add = 0;
+  payload.vrf_id = m_id;
+  to_bytes(m_inside, payload.local_ip_address);
+  to_bytes(m_outside, payload.external_ip_address);
+
+  VAPI_CALL(req.execute());
+
+  wait();
+  m_hw_item.set(rc_t::NOOP);
+
+  return rc_t::OK;
+}
+
+std::string
+delete_66_cmd::to_string() const
+{
+  std::ostringstream s;
+  s << "nat-66-static-delete: " << m_hw_item.to_string() << " table:" << m_id
+    << " inside:" << m_inside.to_string()
+    << " outside:" << m_outside.to_string();
+
+  return (s.str());
+}
+
+bool
+dump_66_cmd::operator==(const dump_66_cmd& other) const
+{
+  return (true);
+}
+
+rc_t
+dump_66_cmd::issue(connection& con)
+{
+  m_dump.reset(new msg_t(con.ctx(), std::ref(*this)));
+
+  VAPI_CALL(m_dump->execute());
+
+  wait();
+
+  return rc_t::OK;
+}
+
+std::string
+dump_66_cmd::to_string() const
+{
   return ("nat-static-dump");
 }
 
diff --git a/src/vpp-api/vom/nat_static_cmds.hpp b/src/vpp-api/vom/nat_static_cmds.hpp
index a4adcef19b5..95061cae1ad 100644
--- a/src/vpp-api/vom/nat_static_cmds.hpp
+++ b/src/vpp-api/vom/nat_static_cmds.hpp
@@ -129,6 +129,111 @@ private:
   HW::item<bool> item;
 };
 
+/**
+ * A command class that creates NAT 66 static mapping
+ */
+class create_66_cmd
+  : public rpc_cmd<HW::item<bool>, rc_t, vapi::Nat66_add_del_static_mapping>
+{
+public:
+  /**
+   * Constructor
+   */
+  create_66_cmd(HW::item<bool>& item,
+                route::table_id_t id,
+                const boost::asio::ip::address_v6& inside,
+                const boost::asio::ip::address_v6& outside);
+
+  /**
+   * Issue the command to VPP/HW
+   */
+  rc_t issue(connection& con);
+
+  /**
+   * convert to string format for debug purposes
+   */
+  std::string to_string() const;
+
+  /**
+   * Comparison operator - only used for UT
+   */
+  bool operator==(const create_66_cmd& i) const;
+
+private:
+  route::table_id_t m_id;
+  const boost::asio::ip::address_v6 m_inside;
+  const boost::asio::ip::address_v6 m_outside;
+};
+
+/**
+ * A cmd class that deletes a NAT 66 static mapping
+ */
+class delete_66_cmd
+  : public rpc_cmd<HW::item<bool>, rc_t, vapi::Nat66_add_del_static_mapping>
+{
+public:
+  /**
+   * Constructor
+   */
+  delete_66_cmd(HW::item<bool>& item,
+                route::table_id_t id,
+                const boost::asio::ip::address_v6& inside,
+                const boost::asio::ip::address_v6& outside);
+
+  /**
+   * Issue the command to VPP/HW
+   */
+  rc_t issue(connection& con);
+
+  /**
+   * convert to string format for debug purposes
+   */
+  std::string to_string() const;
+
+  /**
+   * Comparison operator - only used for UT
+   */
+  bool operator==(const delete_66_cmd& i) const;
+
+private:
+  route::table_id_t m_id;
+  const boost::asio::ip::address_v6 m_inside;
+  const boost::asio::ip::address_v6 m_outside;
+};
+
+/**
+ * A cmd class that Dumps all the nat_statics
+ */
+class dump_66_cmd : public dump_cmd<vapi::Nat66_static_mapping_dump>
+{
+public:
+  /**
+   * Constructor
+   */
+  dump_66_cmd() = default;
+  ~dump_66_cmd() = default;
+
+  /**
+   * Issue the command to VPP/HW
+   */
+  rc_t issue(connection& con);
+  /**
+   * convert to string format for debug purposes
+   */
+  std::string to_string() const;
+
+  /**
+   * Comparison operator - only used for UT
+   */
+  bool operator==(const dump_66_cmd& i) const;
+
+private:
+  /**
+   * HW reutrn code
+   */
+  HW::item<bool> item;
+};
+
 }; // namespace nat_static_cmds
 }; // namespace vom
 
diff --git a/src/vpp-api/vom/route.cpp b/src/vpp-api/vom/route.cpp
index 247afa008a7..ec56c44a0d7 100644
--- a/src/vpp-api/vom/route.cpp
+++ b/src/vpp-api/vom/route.cpp
@@ -508,7 +508,7 @@ ip_route::event_handler::handle_populate(const client_db::key_t& key)
 dependency_t
 ip_route::event_handler::order() const
 {
-  return (dependency_t::ENTRY);
+  return (dependency_t::TABLE);
 }
 
 void
diff --git a/src/vpp-api/vom/types.cpp b/src/vpp-api/vom/types.cpp
index 44e0dd08f98..c6093ebd15d 100644
--- a/src/vpp-api/vom/types.cpp
+++ b/src/vpp-api/vom/types.cpp
@@ -28,9 +28,6 @@ rc_t::rc_t(int v, const std::string s)
   : enum_base<rc_t>(v, s)
 {
 }
-rc_t::~rc_t()
-{
-}
 
 const rc_t&
 rc_t::from_vpp_retval(int32_t rv)
diff --git a/src/vpp-api/vom/types.hpp b/src/vpp-api/vom/types.hpp
index 302e5ee47b1..53654c51ac5 100644
--- a/src/vpp-api/vom/types.hpp
+++ b/src/vpp-api/vom/types.hpp
@@ -94,7 +94,7 @@ struct rc_t : public enum_base<rc_t>
   /**
    * Destructor
    */
-  ~rc_t();
+  ~rc_t() = default;
 
   /**
    * The value un-set
diff --git a/test/ext/vom_test.cpp b/test/ext/vom_test.cpp
index 29738e2437e..6958eb117a4 100644
--- a/test/ext/vom_test.cpp
+++ b/test/ext/vom_test.cpp
@@ -892,7 +892,11 @@ BOOST_AUTO_TEST_CASE(test_bridge) {
     bridge_domain bd1(33);
 
     HW::item<uint32_t> hw_bd(33, rc_t::OK);
-    ADD_EXPECT(bridge_domain_cmds::create_cmd(hw_bd, bridge_domain::learning_mode_t::ON));
+    ADD_EXPECT(bridge_domain_cmds::create_cmd(hw_bd,
+                                              bridge_domain::learning_mode_t::ON,
+                                              bridge_domain::arp_term_mode_t::ON,
+                                              bridge_domain::flood_mode_t::ON,
+                                              bridge_domain::mac_age_mode_t::OFF));
 
     TRY_CHECK_RC(OM::write(franz, bd1));
 
@@ -973,7 +977,11 @@ BOOST_AUTO_TEST_CASE(test_bridge) {
     bridge_domain bd2(99);
 
     HW::item<uint32_t> hw_bd2(99, rc_t::OK);
-    ADD_EXPECT(bridge_domain_cmds::create_cmd(hw_bd2, bridge_domain::learning_mode_t::ON));
+    ADD_EXPECT(bridge_domain_cmds::create_cmd(hw_bd2,
+                                              bridge_domain::learning_mode_t::ON,
+                                              bridge_domain::arp_term_mode_t::ON,
+                                              bridge_domain::flood_mode_t::ON,
+                                              bridge_domain::mac_age_mode_t::OFF));
 
     TRY_CHECK_RC(OM::write(jkr, bd2));
 
@@ -1020,8 +1028,8 @@ BOOST_AUTO_TEST_CASE(test_vxlan) {
 
     // VXLAN create
     vxlan_tunnel::endpoint_t ep(boost::asio::ip::address::from_string("10.10.10.10"),
-                               boost::asio::ip::address::from_string("10.10.10.11"),
-                               322);
+                                boost::asio::ip::address::from_string("10.10.10.11"),
+                                322);
 
     vxlan_tunnel vxt(ep.src, ep.dst, ep.vni);
 
@@ -1031,10 +1039,17 @@ BOOST_AUTO_TEST_CASE(test_vxlan) {
     TRY_CHECK_RC(OM::write(franz, vxt));
 
     // bridge-domain create
-    bridge_domain bd1(33, bridge_domain::learning_mode_t::OFF);
+    bridge_domain bd1(33, bridge_domain::learning_mode_t::OFF,
+                      bridge_domain::arp_term_mode_t::OFF,
+                      bridge_domain::flood_mode_t::OFF,
+                      bridge_domain::mac_age_mode_t::ON);
 
     HW::item<uint32_t> hw_bd(33, rc_t::OK);
-    ADD_EXPECT(bridge_domain_cmds::create_cmd(hw_bd, bridge_domain::learning_mode_t::OFF));
+    ADD_EXPECT(bridge_domain_cmds::create_cmd(hw_bd,
+                                              bridge_domain::learning_mode_t::OFF,
+                                              bridge_domain::arp_term_mode_t::OFF,
+                                              bridge_domain::flood_mode_t::OFF,
+                                              bridge_domain::mac_age_mode_t::ON));
 
     TRY_CHECK_RC(OM::write(franz, bd1));
 
diff --git a/test/test_gbp.py b/test/test_gbp.py
index 427b14de506..805f2610ea3 100644
--- a/test/test_gbp.py
+++ b/test/test_gbp.py
@@ -6,14 +6,19 @@ import struct
 
 from framework import VppTestCase, VppTestRunner
 from vpp_object import VppObject
+from vpp_neighbor import VppNeighbor
+from vpp_ip_route import VppIpRoute, VppRoutePath, VppIpTable, DpoProto
 
 from scapy.packet import Raw
-from scapy.layers.l2 import Ether
+from scapy.layers.l2 import Ether, ARP
 from scapy.layers.inet import IP, UDP
-from scapy.layers.inet6 import IPv6
+from scapy.layers.inet6 import IPv6, ICMPv6ND_NS,  ICMPv6NDOptSrcLLAddr, \
+    ICMPv6NDOptDstLLAddr, ICMPv6ND_NA
+from scapy.utils6 import in6_getnsma, in6_getnsmac
 
 from socket import AF_INET, AF_INET6
-from scapy.utils import inet_pton
+from scapy.utils import inet_pton, inet_ntop
+from util import Host, mactobinary
 
 
 class VppGbpEndpoint(VppObject):
@@ -21,47 +26,221 @@ class VppGbpEndpoint(VppObject):
     GDB Endpoint
     """
 
-    def __init__(self, test, sw_if_index, addr, epg, is_ip6=0):
+    @property
+    def bin_mac(self):
+        return mactobinary(self.itf.remote_mac)
+
+    @property
+    def mac(self):
+        return self.itf.remote_mac
+
+    def __init__(self, test, itf, epg, recirc, ip, fip, is_ip6=False):
         self._test = test
-        self.sw_if_index = sw_if_index
+        self.itf = itf
         self.epg = epg
-        self.addr_p = addr
+        self.recirc = recirc
+        self.ip = ip
+        self.floating_ip = fip
         self.is_ip6 = is_ip6
         if is_ip6:
-            self.addr = inet_pton(AF_INET6, addr)
+            self.proto = DpoProto.DPO_PROTO_IP6
+            self.af = AF_INET6
         else:
-            self.addr = inet_pton(AF_INET, addr)
+            self.proto = DpoProto.DPO_PROTO_IP4
+            self.af = AF_INET
+        self.ip_n = inet_pton(self.af, ip)
+        self.floating_ip_n = inet_pton(self.af, fip)
 
     def add_vpp_config(self):
         self._test.vapi.gbp_endpoint_add_del(
             1,
-            self.sw_if_index,
-            self.addr,
+            self.itf.sw_if_index,
+            self.ip_n,
             self.is_ip6,
-            self.epg)
+            self.epg.epg)
         self._test.registry.register(self, self._test.logger)
 
     def remove_vpp_config(self):
         self._test.vapi.gbp_endpoint_add_del(
             0,
-            self.sw_if_index,
-            self.addr,
+            self.itf.sw_if_index,
+            self.ip_n,
             self.is_ip6,
-            self.epg)
+            self.epg.epg)
 
     def __str__(self):
         return self.object_id()
 
     def object_id(self):
-        return "gbp-endpoint;[%d:%s:%d]" % (self.sw_if_index,
-                                            self.addr_p,
-                                            self.epg)
+        return "gbp-endpoint;[%d:%s:%d]" % (self.itf.sw_if_index,
+                                            self.ip,
+                                            self.epg.epg)
 
     def query_vpp_config(self):
         eps = self._test.vapi.gbp_endpoint_dump()
         for ep in eps:
-            if ep.endpoint.address == self.addr \
-               and ep.endpoint.sw_if_index == self.sw_if_index:
+            if self.is_ip6:
+                if ep.endpoint.address == self.ip_n \
+                   and ep.endpoint.sw_if_index == self.itf.sw_if_index:
+                    return True
+            else:
+                if ep.endpoint.address[:4] == self.ip_n \
+                   and ep.endpoint.sw_if_index == self.itf.sw_if_index:
+                    return True
+        return False
+
+
+class VppGbpRecirc(VppObject):
+    """
+    GDB Recirculation Interface
+    """
+
+    def __init__(self, test, epg, recirc, is_ext=False):
+        self._test = test
+        self.recirc = recirc
+        self.epg = epg
+        self.is_ext = is_ext
+
+    def add_vpp_config(self):
+        self._test.vapi.gbp_recirc_add_del(
+            1,
+            self.recirc.sw_if_index,
+            self.epg.epg,
+            self.is_ext)
+        self._test.registry.register(self, self._test.logger)
+
+    def remove_vpp_config(self):
+        self._test.vapi.gbp_recirc_add_del(
+            0,
+            self.recirc.sw_if_index,
+            self.epg.epg,
+            self.is_ext)
+
+    def __str__(self):
+        return self.object_id()
+
+    def object_id(self):
+        return "gbp-recirc;[%d]" % (self.recirc.sw_if_index)
+
+    def query_vpp_config(self):
+        rs = self._test.vapi.gbp_recirc_dump()
+        for r in rs:
+            if r.recirc.sw_if_index == self.recirc.sw_if_index:
+                return True
+        return False
+
+
+class VppGbpSubnet(VppObject):
+    """
+    GDB Subnet
+    """
+
+    def __init__(self, test, table_id, address, address_len,
+                 is_internal=True, is_ip6=False,
+                 sw_if_index=None, epg=None):
+        self._test = test
+        self.table_id = table_id
+        self.address = address
+        self.address_len = address_len
+        self.is_ip6 = is_ip6
+        if is_ip6:
+            self.address_n = inet_pton(AF_INET6, address)
+        else:
+            self.address_n = inet_pton(AF_INET, address)
+        self.is_internal = is_internal
+        self.sw_if_index = sw_if_index
+        self.epg = epg
+
+    def add_vpp_config(self):
+        self._test.vapi.gbp_subnet_add_del(
+            1,
+            self.table_id,
+            self.is_internal,
+            self.address_n,
+            self.address_len,
+            sw_if_index=self.sw_if_index if self.sw_if_index else 0xffffffff,
+            epg_id=self.epg if self.epg else 0xffffffff,
+            is_ip6=self.is_ip6)
+        self._test.registry.register(self, self._test.logger)
+
+    def remove_vpp_config(self):
+        self._test.vapi.gbp_subnet_add_del(
+            0,
+            self.table_id,
+            self.is_internal,
+            self.address_n,
+            self.address_len,
+            is_ip6=self.is_ip6)
+
+    def __str__(self):
+        return self.object_id()
+
+    def object_id(self):
+        return "gbp-subnet;[%d:%s/%d]" % (self.table_id,
+                                          self.address,
+                                          self.address_len)
+
+    def query_vpp_config(self):
+        ss = self._test.vapi.gbp_subnet_dump()
+        for s in ss:
+            if s.subnet.table_id == self.table_id and \
+               s.subnet.address_length == self.address_len:
+                if self.is_ip6:
+                    if s.subnet.address == self.address_n:
+                        return True
+                else:
+                    if s.subnet.address[:4] == self.address_n:
+                        return True
+        return False
+
+
+class VppGbpEndpointGroup(VppObject):
+    """
+    GDB Endpoint Group
+    """
+
+    def __init__(self, test, epg, rd, bd, uplink,
+                 bvi, bvi_ip4, bvi_ip6=None):
+        self._test = test
+        self.uplink = uplink
+        self.bvi = bvi
+        self.bvi_ip4 = bvi_ip4
+        self.bvi_ip4_n = inet_pton(AF_INET, bvi_ip4)
+        self.bvi_ip6 = bvi_ip6
+        self.bvi_ip6_n = inet_pton(AF_INET6, bvi_ip6)
+        self.epg = epg
+        self.bd = bd
+        self.rd = rd
+
+    def add_vpp_config(self):
+        self._test.vapi.gbp_endpoint_group_add_del(
+            1,
+            self.epg,
+            self.bd,
+            self.rd,
+            self.rd,
+            self.uplink.sw_if_index)
+        self._test.registry.register(self, self._test.logger)
+
+    def remove_vpp_config(self):
+        self._test.vapi.gbp_endpoint_group_add_del(
+            0,
+            self.epg,
+            self.bd,
+            self.rd,
+            self.rd,
+            self.uplink.sw_if_index)
+
+    def __str__(self):
+        return self.object_id()
+
+    def object_id(self):
+        return "gbp-endpoint-group;[%d]" % (self.epg)
+
+    def query_vpp_config(self):
+        epgs = self._test.vapi.gbp_endpoint_group_dump()
+        for epg in epgs:
+            if epg.epg.epg_id == self.epg:
                 return True
         return False
 
@@ -101,10 +280,10 @@ class VppGbpContract(VppObject):
                                             self.acl_index)
 
     def query_vpp_config(self):
-        eps = self._test.vapi.gbp_contract_dump()
-        for ep in eps:
-            if ep.contract.src_epg == self.src_epg \
-               and ep.contract.dst_epg == self.dst_epg:
+        cs = self._test.vapi.gbp_contract_dump()
+        for c in cs:
+            if c.contract.src_epg == self.src_epg \
+               and c.contract.dst_epg == self.dst_epg:
                 return True
         return False
 
@@ -115,233 +294,579 @@ class TestGBP(VppTestCase):
     def setUp(self):
         super(TestGBP, self).setUp()
 
-        # create 6 pg interfaces for pg0 to pg5
-        self.create_pg_interfaces(range(6))
+        self.create_pg_interfaces(range(9))
+        self.create_loopback_interfaces(range(9))
+
+        self.router_mac = "00:11:22:33:44:55"
 
         for i in self.pg_interfaces:
             i.admin_up()
-            i.config_ip4()
-            i.resolve_arp()
-            i.config_ip6()
-            i.resolve_ndp()
+        for i in self.lo_interfaces:
+            i.admin_up()
+            self.vapi.sw_interface_set_mac_address(
+                i.sw_if_index,
+                mactobinary(self.router_mac))
 
     def tearDown(self):
         for i in self.pg_interfaces:
-            i.unconfig_ip4()
-            i.unconfig_ip6()
+            i.admin_down()
 
         super(TestGBP, self).tearDown()
 
-    def test_gbp4(self):
-        """ Group Based Policy v4 """
-
-        ep1 = VppGbpEndpoint(self,
-                             self.pg0.sw_if_index,
-                             self.pg0.remote_ip4,
-                             220)
-        ep1.add_vpp_config()
-        ep2 = VppGbpEndpoint(self,
-                             self.pg1.sw_if_index,
-                             self.pg1.remote_ip4,
-                             220)
-        ep2.add_vpp_config()
-
-        ep3 = VppGbpEndpoint(self,
-                             self.pg2.sw_if_index,
-                             self.pg2.remote_ip4,
-                             221)
-        ep3.add_vpp_config()
-        ep4 = VppGbpEndpoint(self,
-                             self.pg3.sw_if_index,
-                             self.pg3.remote_ip4,
-                             222)
-        ep4.add_vpp_config()
+    def send_and_expect_bridged(self, src, tx, dst):
+        rx = self.send_and_expect(src, tx, dst)
 
-        self.logger.info(self.vapi.cli("sh gbp endpoint"))
+        for r in rx:
+            self.assertEqual(r[Ether].src, tx[0][Ether].src)
+            self.assertEqual(r[Ether].dst, tx[0][Ether].dst)
+            self.assertEqual(r[IP].src, tx[0][IP].src)
+            self.assertEqual(r[IP].dst, tx[0][IP].dst)
+        return rx
+
+    def send_and_expect_bridged6(self, src, tx, dst):
+        rx = self.send_and_expect(src, tx, dst)
+
+        for r in rx:
+            self.assertEqual(r[Ether].src, tx[0][Ether].src)
+            self.assertEqual(r[Ether].dst, tx[0][Ether].dst)
+            self.assertEqual(r[IPv6].src, tx[0][IPv6].src)
+            self.assertEqual(r[IPv6].dst, tx[0][IPv6].dst)
+        return rx
+
+    def send_and_expect_routed(self, src, tx, dst, src_mac):
+        rx = self.send_and_expect(src, tx, dst)
+
+        for r in rx:
+            self.assertEqual(r[Ether].src, src_mac)
+            self.assertEqual(r[Ether].dst, dst.remote_mac)
+            self.assertEqual(r[IP].src, tx[0][IP].src)
+            self.assertEqual(r[IP].dst, tx[0][IP].dst)
+        return rx
+
+    def send_and_expect_natted(self, src, tx, dst, src_ip):
+        rx = self.send_and_expect(src, tx, dst)
+
+        for r in rx:
+            self.assertEqual(r[Ether].src, tx[0][Ether].src)
+            self.assertEqual(r[Ether].dst, tx[0][Ether].dst)
+            self.assertEqual(r[IP].src, src_ip)
+            self.assertEqual(r[IP].dst, tx[0][IP].dst)
+        return rx
+
+    def send_and_expect_unnatted(self, src, tx, dst, dst_ip):
+        rx = self.send_and_expect(src, tx, dst)
+
+        for r in rx:
+            self.assertEqual(r[Ether].src, tx[0][Ether].src)
+            self.assertEqual(r[Ether].dst, tx[0][Ether].dst)
+            self.assertEqual(r[IP].dst, dst_ip)
+            self.assertEqual(r[IP].src, tx[0][IP].src)
+        return rx
+
+    def send_and_expect_double_natted(self, src, tx, dst, src_ip, dst_ip):
+        rx = self.send_and_expect(src, tx, dst)
+
+        for r in rx:
+            self.assertEqual(r[Ether].src, self.router_mac)
+            self.assertEqual(r[Ether].dst, dst.remote_mac)
+            self.assertEqual(r[IP].dst, dst_ip)
+            self.assertEqual(r[IP].src, src_ip)
+        return rx
+
+    def test_gbp(self):
+        """ Group Based Policy """
+
+        nat_table = VppIpTable(self, 20)
+        nat_table.add_vpp_config()
 
         #
-        # in the abscense of policy, endpoints in the same EPG
-        # can communicate
+        # Bridge Domains
         #
-        pkt_intra_epg = (Ether(src=self.pg0.remote_mac,
-                               dst=self.pg0.local_mac) /
-                         IP(src=self.pg0.remote_ip4,
-                            dst=self.pg1.remote_ip4) /
-                         UDP(sport=1234, dport=1234) /
-                         Raw('\xa5' * 100))
+        self.vapi.bridge_domain_add_del(1, flood=1, uu_flood=1, forward=1,
+                                        learn=0, arp_term=1, is_add=1)
+        self.vapi.bridge_domain_add_del(2, flood=1, uu_flood=1, forward=1,
+                                        learn=0, arp_term=1, is_add=1)
+        self.vapi.bridge_domain_add_del(20, flood=1, uu_flood=1, forward=1,
+                                        learn=0, arp_term=1, is_add=1)
 
-        self.send_and_expect(self.pg0, pkt_intra_epg * 65, self.pg1)
+        #
+        # 3 EPGs, 2 of which share a BD.
+        #
+        epgs = []
+        recircs = []
+        epgs.append(VppGbpEndpointGroup(self, 220, 0, 1, self.pg4,
+                                        self.loop0,
+                                        "10.0.0.128",
+                                        "2001:10::128"))
+        recircs.append(VppGbpRecirc(self, epgs[0],
+                                    self.loop3))
+        epgs.append(VppGbpEndpointGroup(self, 221, 0, 1, self.pg5,
+                                        self.loop0,
+                                        "10.0.1.128",
+                                        "2001:10:1::128"))
+        recircs.append(VppGbpRecirc(self, epgs[1],
+                                    self.loop4))
+        epgs.append(VppGbpEndpointGroup(self, 222, 0, 2, self.pg6,
+                                        self.loop1,
+                                        "10.0.2.128",
+                                        "2001:10:2::128"))
+        recircs.append(VppGbpRecirc(self, epgs[2],
+                                    self.loop5))
 
         #
-        # in the abscense of policy, endpoints in the different EPG
-        # cannot communicate
+        # 2 NAT EPGs, one for floating-IP subnets, the other for internet
         #
-        pkt_inter_epg_220_to_221 = (Ether(src=self.pg0.remote_mac,
-                                          dst=self.pg0.local_mac) /
-                                    IP(src=self.pg0.remote_ip4,
-                                       dst=self.pg2.remote_ip4) /
-                                    UDP(sport=1234, dport=1234) /
-                                    Raw('\xa5' * 100))
-        pkt_inter_epg_220_to_222 = (Ether(src=self.pg0.remote_mac,
-                                          dst=self.pg0.local_mac) /
-                                    IP(src=self.pg0.remote_ip4,
-                                       dst=self.pg3.remote_ip4) /
-                                    UDP(sport=1234, dport=1234) /
-                                    Raw('\xa5' * 100))
-        pkt_inter_epg_221_to_220 = (Ether(src=self.pg2.remote_mac,
-                                          dst=self.pg2.local_mac) /
-                                    IP(src=self.pg2.remote_ip4,
-                                       dst=self.pg0.remote_ip4) /
-                                    UDP(sport=1234, dport=1234) /
-                                    Raw('\xa5' * 100))
+        epgs.append(VppGbpEndpointGroup(self, 333, 20, 20, self.pg7,
+                                        self.loop2,
+                                        "11.0.0.128",
+                                        "3001::128"))
+        recircs.append(VppGbpRecirc(self, epgs[3],
+                                    self.loop6, is_ext=True))
+        epgs.append(VppGbpEndpointGroup(self, 444, 20, 20, self.pg8,
+                                        self.loop2,
+                                        "11.0.0.129",
+                                        "3001::129"))
+        recircs.append(VppGbpRecirc(self, epgs[4],
+                                    self.loop8, is_ext=True))
 
-        self.send_and_assert_no_replies(self.pg0,
-                                        pkt_inter_epg_220_to_221 * 65)
-        self.send_and_assert_no_replies(self.pg0,
-                                        pkt_inter_epg_221_to_220 * 65)
+        epg_nat = epgs[3]
+        recirc_nat = recircs[3]
 
         #
-        # A uni-directional contract from EPG 220 -> 221
+        # 4 end-points, 2 in the same subnet, 3 in the same BD
         #
-        c1 = VppGbpContract(self, 220, 221, 0xffffffff)
-        c1.add_vpp_config()
+        eps = []
+        eps.append(VppGbpEndpoint(self, self.pg0,
+                                  epgs[0], recircs[0],
+                                  "10.0.0.1",
+                                  "11.0.0.1"))
+        eps.append(VppGbpEndpoint(self, self.pg1,
+                                  epgs[0], recircs[0],
+                                  "10.0.0.2",
+                                  "11.0.0.2"))
+        eps.append(VppGbpEndpoint(self, self.pg2,
+                                  epgs[1], recircs[1],
+                                  "10.0.1.1",
+                                  "11.0.0.3"))
+        eps.append(VppGbpEndpoint(self, self.pg3,
+                                  epgs[2], recircs[2],
+                                  "10.0.2.1",
+                                  "11.0.0.4"))
+        eps.append(VppGbpEndpoint(self, self.pg0,
+                                  epgs[0], recircs[0],
+                                  "2001:10::1",
+                                  "3001::1",
+                                  is_ip6=True))
+        eps.append(VppGbpEndpoint(self, self.pg1,
+                                  epgs[0], recircs[0],
+                                  "2001:10::2",
+                                  "3001::2",
+                                  is_ip6=True))
+        eps.append(VppGbpEndpoint(self, self.pg2,
+                                  epgs[1], recircs[1],
+                                  "2001:10:1::1",
+                                  "3001::3",
+                                  is_ip6=True))
+        eps.append(VppGbpEndpoint(self, self.pg3,
+                                  epgs[2], recircs[2],
+                                  "2001:10:2::1",
+                                  "3001::4",
+                                  is_ip6=True))
 
-        self.send_and_expect(self.pg0,
-                             pkt_inter_epg_220_to_221 * 65,
-                             self.pg2)
-        self.send_and_assert_no_replies(self.pg2,
-                                        pkt_inter_epg_221_to_220 * 65)
+        #
+        # Config related to each of the EPGs
+        #
+        for epg in epgs:
+            # IP config on the BVI interfaces
+            if epg != epgs[1] and epg != epgs[4]:
+                epg.bvi.set_table_ip4(epg.rd)
+                epg.bvi.set_table_ip6(epg.rd)
+
+                # The BVIs are NAT inside interfaces
+                self.vapi.nat44_interface_add_del_feature(epg.bvi.sw_if_index,
+                                                          is_inside=1,
+                                                          is_add=1)
+                # self.vapi.nat66_add_del_interface(epg.bvi.sw_if_index,
+                #                                  is_inside=1,
+                #                                  is_add=1)
+
+            self.vapi.sw_interface_add_del_address(epg.bvi.sw_if_index,
+                                                   epg.bvi_ip4_n,
+                                                   32)
+            self.vapi.sw_interface_add_del_address(epg.bvi.sw_if_index,
+                                                   epg.bvi_ip6_n,
+                                                   128,
+                                                   is_ipv6=1)
+
+            # EPG uplink interfaces in the BD
+            epg.uplink.set_table_ip4(epg.rd)
+            self.vapi.sw_interface_set_l2_bridge(epg.uplink.sw_if_index,
+                                                 epg.bd)
+
+            # add the BD ARP termination entry for BVI IP
+            self.vapi.bd_ip_mac_add_del(bd_id=epg.bd,
+                                        mac=mactobinary(self.router_mac),
+                                        ip=epg.bvi_ip4_n,
+                                        is_ipv6=0,
+                                        is_add=1)
+            self.vapi.bd_ip_mac_add_del(bd_id=epg.bd,
+                                        mac=mactobinary(self.router_mac),
+                                        ip=epg.bvi_ip6_n,
+                                        is_ipv6=1,
+                                        is_add=1)
+
+            # epg[1] shares the same BVI to epg[0]
+            if epg != epgs[1] and epg != epgs[4]:
+                # BVI in BD
+                self.vapi.sw_interface_set_l2_bridge(epg.bvi.sw_if_index,
+                                                     epg.bd,
+                                                     bvi=1)
+                # BVI L2 FIB entry
+                self.vapi.l2fib_add_del(self.router_mac,
+                                        epg.bd,
+                                        epg.bvi.sw_if_index,
+                                        is_add=1, bvi_mac=1)
+
+            # EPG in VPP
+            epg.add_vpp_config()
+
+        for recirc in recircs:
+            # EPG's ingress recirculation interface maps to its RD
+            recirc.recirc.set_table_ip4(recirc.epg.rd)
+
+            # in the bridge to allow DVR. L2 emulation to punt to L3
+            self.vapi.sw_interface_set_l2_bridge(recirc.recirc.sw_if_index,
+                                                 recirc.epg.bd)
+            self.vapi.sw_interface_set_l2_emulation(
+                recirc.recirc.sw_if_index)
+
+            if recirc.is_ext:
+                # recirc interfaces on NAT EPGs are outside and an
+                # output feature
+                self.vapi.nat44_interface_add_del_output_feature(
+                    recirc.recirc.sw_if_index,
+                    is_inside=0,
+                    is_add=1)
+            else:
+                self.vapi.nat44_interface_add_del_feature(
+                    recirc.recirc.sw_if_index,
+                    is_inside=0,
+                    is_add=1)
+                # self.vapi.nat66_add_del_interface(
+                #    recirc.recirc.sw_if_index,
+                #    is_inside=0,
+                #    is_add=1)
+
+            recirc.add_vpp_config()
+
+        ep_routes = []
+        ep_arps = []
+        for ep in eps:
+            self.pg_enable_capture(self.pg_interfaces)
+            self.pg_start()
+            #
+            # routes to the endpoints. We need these since there are no
+            # adj-fibs due to the fact the the BVI address has /32 and
+            # the subnet is not attached.
+            #
+            r = VppIpRoute(self, ep.ip, 32,
+                           [VppRoutePath(ep.ip,
+                                         ep.epg.bvi.sw_if_index,
+                                         proto=ep.proto)],
+                           is_ip6=ep.is_ip6)
+            r.add_vpp_config()
+            ep_routes.append(r)
+
+            #
+            # ARP entries for the endpoints
+            #
+            a = VppNeighbor(self,
+                            ep.epg.bvi.sw_if_index,
+                            ep.itf.remote_mac,
+                            ep.ip, af=ep.af)
+            a.add_vpp_config()
+            ep_arps.append(a)
+
+            # add each EP itf to the its BD
+            self.vapi.sw_interface_set_l2_bridge(ep.itf.sw_if_index,
+                                                 ep.epg.bd)
+
+            # add the BD ARP termination entry
+            self.vapi.bd_ip_mac_add_del(bd_id=ep.epg.bd,
+                                        mac=ep.bin_mac,
+                                        ip=ep.ip_n,
+                                        is_ipv6=0,
+                                        is_add=1)
+
+            # L2 FIB entry
+            self.vapi.l2fib_add_del(ep.mac,
+                                    ep.epg.bd,
+                                    ep.itf.sw_if_index,
+                                    is_add=1)
+
+            # Add static mappings for each EP from the 10/8 to 11/8 network
+            if ep.af == AF_INET:
+                self.vapi.nat44_add_del_static_mapping(ep.ip_n,
+                                                       ep.floating_ip_n,
+                                                       vrf_id=0,
+                                                       addr_only=1)
+            # else:
+            # self.vapi.nat66_add_del_static_mapping(ep.ip_n,
+            #                                       ep.floating_ip_n,
+            #                                       vrf_id=20)
+
+            # VPP EP create ...
+            ep.add_vpp_config()
+
+            # ... results in a Gratuitous ARP/ND on the EPG's uplink
+            rx = ep.epg.uplink.get_capture(1, timeout=0.2)
+
+            if ep.is_ip6:
+                self.assertTrue(rx[0].haslayer(ICMPv6ND_NA))
+                self.assertEqual(rx[0][ICMPv6ND_NA].tgt, ep.ip)
+            else:
+                self.assertTrue(rx[0].haslayer(ARP))
+                self.assertEqual(rx[0][ARP].psrc, ep.ip)
+                self.assertEqual(rx[0][ARP].pdst, ep.ip)
+
+            # add the BD ARP termination entry for floating IP
+            self.vapi.bd_ip_mac_add_del(bd_id=epg_nat.bd,
+                                        mac=ep.bin_mac,
+                                        ip=ep.floating_ip_n,
+                                        is_ipv6=0,
+                                        is_add=1)
+
+            # floating IPs route via EPG recirc
+            r = VppIpRoute(self, ep.floating_ip, 32,
+                           [VppRoutePath(ep.floating_ip,
+                                         ep.recirc.recirc.sw_if_index,
+                                         is_dvr=1,
+                                         proto=ep.proto)],
+                           table_id=20,
+                           is_ip6=ep.is_ip6)
+            r.add_vpp_config()
+            ep_routes.append(r)
+
+            # L2 FIB entries in the NAT EPG BD to bridge the packets from
+            # the outside direct to the internal EPG
+            self.vapi.l2fib_add_del(ep.mac,
+                                    epg_nat.bd,
+                                    ep.recirc.recirc.sw_if_index,
+                                    is_add=1)
 
         #
-        # contract for the return direction
+        # ARP packets for unknown IP are flooded
         #
-        c2 = VppGbpContract(self, 221, 220, 0xffffffff)
-        c2.add_vpp_config()
+        pkt_arp = (Ether(dst="ff:ff:ff:ff:ff:ff",
+                         src=self.pg0.remote_mac) /
+                   ARP(op="who-has",
+                       hwdst="ff:ff:ff:ff:ff:ff",
+                       hwsrc=self.pg0.remote_mac,
+                       pdst=epgs[0].bvi_ip4,
+                       psrc="10.0.0.88"))
 
-        self.send_and_expect(self.pg0,
-                             pkt_inter_epg_220_to_221 * 65,
-                             self.pg2)
-        self.send_and_expect(self.pg2,
-                             pkt_inter_epg_221_to_220 * 65,
-                             self.pg0)
+        self.send_and_expect(self.pg0, [pkt_arp], self.pg0)
 
         #
-        # check that inter group is still disabled for the groups
-        # not in the contract.
+        # ARP/ND packets get a response
         #
-        self.send_and_assert_no_replies(self.pg0,
-                                        pkt_inter_epg_220_to_222 * 65)
+        pkt_arp = (Ether(dst="ff:ff:ff:ff:ff:ff",
+                         src=self.pg0.remote_mac) /
+                   ARP(op="who-has",
+                       hwdst="ff:ff:ff:ff:ff:ff",
+                       hwsrc=self.pg0.remote_mac,
+                       pdst=epgs[0].bvi_ip4,
+                       psrc=eps[0].ip))
 
-        self.logger.info(self.vapi.cli("sh gbp contract"))
+        self.send_and_expect(self.pg0, [pkt_arp], self.pg0)
+
+        nsma = in6_getnsma(inet_pton(AF_INET6, eps[4].ip))
+        d = inet_ntop(AF_INET6, nsma)
+        pkt_nd = (Ether(dst=in6_getnsmac(nsma)) /
+                  IPv6(dst=d, src=eps[4].ip) /
+                  ICMPv6ND_NS(tgt=epgs[0].bvi_ip6) /
+                  ICMPv6NDOptSrcLLAddr(lladdr=self.pg0.remote_mac))
+        self.send_and_expect(self.pg0, [pkt_nd], self.pg0)
 
         #
-        # remove both contracts, traffic stops in both directions
+        # broadcast packets are flooded
         #
-        c2.remove_vpp_config()
-        c1.remove_vpp_config()
+        pkt_bcast = (Ether(dst="ff:ff:ff:ff:ff:ff",
+                           src=self.pg0.remote_mac) /
+                     IP(src=eps[0].ip, dst="232.1.1.1") /
+                     UDP(sport=1234, dport=1234) /
+                     Raw('\xa5' * 100))
 
-        self.send_and_assert_no_replies(self.pg2,
-                                        pkt_inter_epg_221_to_220 * 65)
-        self.send_and_assert_no_replies(self.pg0,
-                                        pkt_inter_epg_220_to_221 * 65)
-        self.send_and_expect(self.pg0, pkt_intra_epg * 65, self.pg1)
-
-    def test_gbp6(self):
-        """ Group Based Policy v6 """
-
-        ep1 = VppGbpEndpoint(self,
-                             self.pg0.sw_if_index,
-                             self.pg0.remote_ip6,
-                             220,
-                             is_ip6=1)
-        ep1.add_vpp_config()
-        ep2 = VppGbpEndpoint(self,
-                             self.pg1.sw_if_index,
-                             self.pg1.remote_ip6,
-                             220,
-                             is_ip6=1)
-        ep2.add_vpp_config()
-
-        ep3 = VppGbpEndpoint(self,
-                             self.pg2.sw_if_index,
-                             self.pg2.remote_ip6,
-                             221,
-                             is_ip6=1)
-        ep3.add_vpp_config()
-        ep4 = VppGbpEndpoint(self,
-                             self.pg3.sw_if_index,
-                             self.pg3.remote_ip6,
-                             222,
-                             is_ip6=1)
-        ep4.add_vpp_config()
+        self.vapi.cli("clear trace")
+        self.pg0.add_stream(pkt_bcast)
 
+        self.pg_enable_capture(self.pg_interfaces)
+        self.pg_start()
+
+        rxd = eps[1].itf.get_capture(1)
+        self.assertEqual(rxd[0][Ether].dst, pkt_bcast[Ether].dst)
+        rxd = epgs[0].uplink.get_capture(1)
+        self.assertEqual(rxd[0][Ether].dst, pkt_bcast[Ether].dst)
+
+        #
+        # packets to non-local L3 destinations dropped
+        #
+        pkt_intra_epg_220_ip4 = (Ether(src=self.pg0.remote_mac,
+                                       dst=self.router_mac) /
+                                 IP(src=eps[0].ip, dst="10.0.0.99") /
+                                 UDP(sport=1234, dport=1234) /
+                                 Raw('\xa5' * 100))
+        pkt_inter_epg_222_ip4 = (Ether(src=self.pg0.remote_mac,
+                                       dst=self.router_mac) /
+                                 IP(src=eps[0].ip, dst="10.0.1.99") /
+                                 UDP(sport=1234, dport=1234) /
+                                 Raw('\xa5' * 100))
+
+        self.send_and_assert_no_replies(self.pg0, pkt_intra_epg_220_ip4 * 65)
+
+        pkt_inter_epg_222_ip6 = (Ether(src=self.pg0.remote_mac,
+                                       dst=self.router_mac) /
+                                 IPv6(src=eps[4].ip, dst="2001:10::99") /
+                                 UDP(sport=1234, dport=1234) /
+                                 Raw('\xa5' * 100))
+        self.send_and_assert_no_replies(self.pg0, pkt_inter_epg_222_ip6 * 65)
+
+        #
+        # Add the subnet routes
+        #
+        s41 = VppGbpSubnet(self, 0, "10.0.0.0", 24)
+        s42 = VppGbpSubnet(self, 0, "10.0.1.0", 24)
+        s43 = VppGbpSubnet(self, 0, "10.0.2.0", 24)
+        s41.add_vpp_config()
+        s42.add_vpp_config()
+        s43.add_vpp_config()
+        s61 = VppGbpSubnet(self, 0, "2001:10::1", 64, is_ip6=True)
+        s62 = VppGbpSubnet(self, 0, "2001:10:1::1", 64, is_ip6=True)
+        s63 = VppGbpSubnet(self, 0, "2001:10:2::1", 64, is_ip6=True)
+        s61.add_vpp_config()
+        s62.add_vpp_config()
+        s63.add_vpp_config()
+
+        self.send_and_expect_bridged(self.pg0,
+                                     pkt_intra_epg_220_ip4 * 65,
+                                     self.pg4)
+        self.send_and_expect_bridged(self.pg3,
+                                     pkt_inter_epg_222_ip4 * 65,
+                                     self.pg6)
+        self.send_and_expect_bridged6(self.pg3,
+                                      pkt_inter_epg_222_ip6 * 65,
+                                      self.pg6)
+
+        self.logger.info(self.vapi.cli("sh ip fib 11.0.0.2"))
+        self.logger.info(self.vapi.cli("sh gbp endpoint-group"))
         self.logger.info(self.vapi.cli("sh gbp endpoint"))
+        self.logger.info(self.vapi.cli("sh gbp recirc"))
+        self.logger.info(self.vapi.cli("sh int"))
+        self.logger.info(self.vapi.cli("sh int addr"))
+        self.logger.info(self.vapi.cli("sh int feat loop6"))
+        self.logger.info(self.vapi.cli("sh vlib graph ip4-gbp-src-classify"))
+        self.logger.info(self.vapi.cli("sh int feat loop3"))
+
+        #
+        # Packet destined to unknown unicast is sent on the epg uplink ...
+        #
+        pkt_intra_epg_220_to_uplink = (Ether(src=self.pg0.remote_mac,
+                                             dst="00:00:00:33:44:55") /
+                                       IP(src=eps[0].ip, dst="10.0.0.99") /
+                                       UDP(sport=1234, dport=1234) /
+                                       Raw('\xa5' * 100))
+
+        self.send_and_expect_bridged(self.pg0,
+                                     pkt_intra_epg_220_to_uplink * 65,
+                                     self.pg4)
+        # ... and nowhere else
+        self.pg1.get_capture(0, timeout=0.1)
+        self.pg1.assert_nothing_captured(remark="Flood onto other VMS")
+
+        pkt_intra_epg_221_to_uplink = (Ether(src=self.pg2.remote_mac,
+                                             dst="00:00:00:33:44:66") /
+                                       IP(src=eps[0].ip, dst="10.0.0.99") /
+                                       UDP(sport=1234, dport=1234) /
+                                       Raw('\xa5' * 100))
 
+        self.send_and_expect_bridged(self.pg2,
+                                     pkt_intra_epg_221_to_uplink * 65,
+                                     self.pg5)
+
+        #
+        # Packets from the uplink are forwarded in the absence of a contract
         #
-        # in the abscense of policy, endpoints in the same EPG
+        pkt_intra_epg_220_from_uplink = (Ether(src="00:00:00:33:44:55",
+                                               dst=self.pg0.remote_mac) /
+                                         IP(src=eps[0].ip, dst="10.0.0.99") /
+                                         UDP(sport=1234, dport=1234) /
+                                         Raw('\xa5' * 100))
+
+        self.send_and_expect_bridged(self.pg4,
+                                     pkt_intra_epg_220_from_uplink * 65,
+                                     self.pg0)
+
+        #
+        # in the absence of policy, endpoints in the same EPG
         # can communicate
         #
         pkt_intra_epg = (Ether(src=self.pg0.remote_mac,
-                               dst=self.pg0.local_mac) /
-                         IPv6(src=self.pg0.remote_ip6,
-                              dst=self.pg1.remote_ip6) /
+                               dst=self.pg1.remote_mac) /
+                         IP(src=eps[0].ip, dst=eps[1].ip) /
                          UDP(sport=1234, dport=1234) /
                          Raw('\xa5' * 100))
 
-        self.send_and_expect(self.pg0, pkt_intra_epg * 65, self.pg1)
+        self.send_and_expect_bridged(self.pg0, pkt_intra_epg * 65, self.pg1)
 
         #
         # in the abscense of policy, endpoints in the different EPG
         # cannot communicate
         #
         pkt_inter_epg_220_to_221 = (Ether(src=self.pg0.remote_mac,
-                                          dst=self.pg0.local_mac) /
-                                    IPv6(src=self.pg0.remote_ip6,
-                                         dst=self.pg2.remote_ip6) /
+                                          dst=self.pg2.remote_mac) /
+                                    IP(src=eps[0].ip, dst=eps[2].ip) /
                                     UDP(sport=1234, dport=1234) /
                                     Raw('\xa5' * 100))
-        pkt_inter_epg_220_to_222 = (Ether(src=self.pg0.remote_mac,
-                                          dst=self.pg0.local_mac) /
-                                    IPv6(src=self.pg0.remote_ip6,
-                                         dst=self.pg3.remote_ip6) /
+        pkt_inter_epg_221_to_220 = (Ether(src=self.pg2.remote_mac,
+                                          dst=self.pg0.remote_mac) /
+                                    IP(src=eps[2].ip, dst=eps[0].ip) /
                                     UDP(sport=1234, dport=1234) /
                                     Raw('\xa5' * 100))
-        pkt_inter_epg_221_to_220 = (Ether(src=self.pg2.remote_mac,
-                                          dst=self.pg2.local_mac) /
-                                    IPv6(src=self.pg2.remote_ip6,
-                                         dst=self.pg0.remote_ip6) /
+        pkt_inter_epg_220_to_222 = (Ether(src=self.pg0.remote_mac,
+                                          dst=self.router_mac) /
+                                    IP(src=eps[0].ip, dst=eps[3].ip) /
                                     UDP(sport=1234, dport=1234) /
                                     Raw('\xa5' * 100))
 
         self.send_and_assert_no_replies(self.pg0,
                                         pkt_inter_epg_220_to_221 * 65)
         self.send_and_assert_no_replies(self.pg0,
-                                        pkt_inter_epg_221_to_220 * 65)
+                                        pkt_inter_epg_220_to_222 * 65)
 
         #
         # A uni-directional contract from EPG 220 -> 221
         #
-        c1 = VppGbpContract(self, 220, 221, 0xffffffff)
+        c1 = VppGbpContract(self, 220, 221, 0)
         c1.add_vpp_config()
 
-        self.send_and_expect(self.pg0,
-                             pkt_inter_epg_220_to_221 * 65,
-                             self.pg2)
-        self.send_and_assert_no_replies(self.pg2,
-                                        pkt_inter_epg_221_to_220 * 65)
+        self.send_and_expect_bridged(self.pg0,
+                                     pkt_inter_epg_220_to_221 * 65,
+                                     self.pg2)
+        self.send_and_assert_no_replies(self.pg0,
+                                        pkt_inter_epg_220_to_222 * 65)
 
         #
         # contract for the return direction
         #
-        c2 = VppGbpContract(self, 221, 220, 0xffffffff)
+        c2 = VppGbpContract(self, 221, 220, 0)
         c2.add_vpp_config()
 
-        self.send_and_expect(self.pg0,
-                             pkt_inter_epg_220_to_221 * 65,
-                             self.pg2)
-        self.send_and_expect(self.pg2,
-                             pkt_inter_epg_221_to_220 * 65,
-                             self.pg0)
+        self.send_and_expect_bridged(self.pg0,
+                                     pkt_inter_epg_220_to_221 * 65,
+                                     self.pg2)
+        self.send_and_expect_bridged(self.pg2,
+                                     pkt_inter_epg_221_to_220 * 65,
+                                     self.pg0)
 
         #
         # check that inter group is still disabled for the groups
@@ -350,19 +875,165 @@ class TestGBP(VppTestCase):
         self.send_and_assert_no_replies(self.pg0,
                                         pkt_inter_epg_220_to_222 * 65)
 
+        #
+        # A uni-directional contract from EPG 220 -> 222 'L3 routed'
+        #
+        c3 = VppGbpContract(self, 220, 222, 0)
+        c3.add_vpp_config()
+
         self.logger.info(self.vapi.cli("sh gbp contract"))
 
+        self.send_and_expect_routed(self.pg0,
+                                    pkt_inter_epg_220_to_222 * 65,
+                                    self.pg3,
+                                    self.router_mac)
+
         #
         # remove both contracts, traffic stops in both directions
         #
         c2.remove_vpp_config()
         c1.remove_vpp_config()
+        c3.remove_vpp_config()
 
         self.send_and_assert_no_replies(self.pg2,
                                         pkt_inter_epg_221_to_220 * 65)
         self.send_and_assert_no_replies(self.pg0,
                                         pkt_inter_epg_220_to_221 * 65)
-        self.send_and_expect(self.pg0, pkt_intra_epg * 65, self.pg1)
+        self.send_and_expect_bridged(self.pg0, pkt_intra_epg * 65, self.pg1)
+
+        #
+        # EPs to the outside world
+        #
+
+        # in the EP's RD an external subnet via the NAT EPG's recirc
+        se1 = VppGbpSubnet(self, 0, "0.0.0.0", 0,
+                           is_internal=False,
+                           sw_if_index=recirc_nat.recirc.sw_if_index,
+                           epg=epg_nat.epg)
+        se1.add_vpp_config()
+        se2 = VppGbpSubnet(self, 0, "11.0.0.0", 8,
+                           is_internal=False,
+                           sw_if_index=recirc_nat.recirc.sw_if_index,
+                           epg=epg_nat.epg)
+        se2.add_vpp_config()
+        # in the NAT RD an external subnet via the NAT EPG's uplink
+        se3 = VppGbpSubnet(self, 20, "0.0.0.0", 0,
+                           is_internal=False,
+                           sw_if_index=epg_nat.uplink.sw_if_index,
+                           epg=epg_nat.epg)
+        se4 = VppGbpSubnet(self, 20, "11.0.0.0", 8,
+                           is_internal=False,
+                           sw_if_index=epg_nat.uplink.sw_if_index,
+                           epg=epg_nat.epg)
+        se3.add_vpp_config()
+        se4.add_vpp_config()
+
+        self.logger.info(self.vapi.cli("sh ip fib 0.0.0.0/0"))
+        self.logger.info(self.vapi.cli("sh ip fib 11.0.0.1"))
+
+        pkt_inter_epg_220_to_global = (Ether(src=self.pg0.remote_mac,
+                                             dst=self.router_mac) /
+                                       IP(src=eps[0].ip, dst="1.1.1.1") /
+                                       UDP(sport=1234, dport=1234) /
+                                       Raw('\xa5' * 100))
+
+        # no policy yet
+        self.send_and_assert_no_replies(self.pg0,
+                                        pkt_inter_epg_220_to_global * 65)
+
+        c4 = VppGbpContract(self, 220, 333, 0)
+        c4.add_vpp_config()
+
+        self.send_and_expect_natted(self.pg0,
+                                    pkt_inter_epg_220_to_global * 65,
+                                    self.pg7,
+                                    "11.0.0.1")
+
+        pkt_inter_epg_220_from_global = (Ether(src=self.router_mac,
+                                               dst=self.pg0.remote_mac) /
+                                         IP(dst=eps[0].floating_ip,
+                                            src="1.1.1.1") /
+                                         UDP(sport=1234, dport=1234) /
+                                         Raw('\xa5' * 100))
+
+        self.send_and_assert_no_replies(self.pg7,
+                                        pkt_inter_epg_220_from_global * 65)
+
+        c5 = VppGbpContract(self, 333, 220, 0)
+        c5.add_vpp_config()
+
+        self.send_and_expect_unnatted(self.pg7,
+                                      pkt_inter_epg_220_from_global * 65,
+                                      self.pg0,
+                                      "10.0.0.1")
+
+        pkt_intra_epg_220_global = (Ether(src=self.pg0.remote_mac,
+                                          dst=self.router_mac) /
+                                    IP(src=eps[0].ip,
+                                       dst=eps[1].floating_ip) /
+                                    UDP(sport=1234, dport=1234) /
+                                    Raw('\xa5' * 100))
+
+        self.send_and_expect_double_natted(self.pg0,
+                                           pkt_intra_epg_220_global * 65,
+                                           self.pg1,
+                                           "11.0.0.1",
+                                           "10.0.0.2")
+
+        #
+        # cleanup
+        #
+        for ep in eps:
+            # del static mappings for each EP from the 10/8 to 11/8 network
+            if ep.af == AF_INET:
+                self.vapi.nat44_add_del_static_mapping(ep.ip_n,
+                                                       ep.floating_ip_n,
+                                                       vrf_id=0,
+                                                       addr_only=1,
+                                                       is_add=0)
+            # else:
+            # self.vapi.nat66_add_del_static_mapping(ep.ip_n,
+            #                                       ep.floating_ip_n,
+            #                                       vrf_id=0,
+            #                                       is_add=0)
+
+        for epg in epgs:
+            # IP config on the BVI interfaces
+            self.vapi.sw_interface_add_del_address(epg.bvi.sw_if_index,
+                                                   epg.bvi_ip4_n,
+                                                   32,
+                                                   is_add=0)
+            self.logger.info(self.vapi.cli("sh int addr"))
+
+            epg.uplink.set_table_ip4(0)
+
+            if epg != epgs[0] and epg != epgs[3]:
+                epg.bvi.set_table_ip4(0)
+
+                self.vapi.nat44_interface_add_del_feature(epg.bvi.sw_if_index,
+                                                          is_inside=1,
+                                                          is_add=0)
+                # self.vapi.nat66_add_del_interface(epg.bvi.sw_if_index,
+                #                                  is_inside=1,
+                #                                  is_add=0)
+
+        for recirc in recircs:
+            recirc.recirc.set_table_ip4(0)
+
+            if recirc.is_ext:
+                self.vapi.nat44_interface_add_del_output_feature(
+                    recirc.recirc.sw_if_index,
+                    is_inside=0,
+                    is_add=0)
+            else:
+                self.vapi.nat44_interface_add_del_feature(
+                    recirc.recirc.sw_if_index,
+                    is_inside=0,
+                    is_add=0)
+                # self.vapi.nat66_add_del_interface(
+                #    recirc.recirc.sw_if_index,
+                #    is_inside=0,
+                #    is_add=0)
 
 
 if __name__ == '__main__':
diff --git a/test/vpp_papi_provider.py b/test/vpp_papi_provider.py
index 24483fe82b8..ad887e8c079 100644
--- a/test/vpp_papi_provider.py
+++ b/test/vpp_papi_provider.py
@@ -668,6 +668,16 @@ class VppPapiProvider(object):
                         {'sw_if_index': sw_if_index,
                          'mtu': mtu})
 
+    def sw_interface_set_promiscuous(self, sw_if_index, enable):
+        """
+        :param sw_if_index:
+        :param enable:
+
+        """
+        return self.api(self.papi.sw_interface_set_promiscuous,
+                        {'sw_if_index': sw_if_index,
+                         'enable': enable})
+
     def sw_interface_set_mac_address(self, sw_if_index, mac):
         return self.api(self.papi.sw_interface_set_mac_address,
                         {'sw_if_index': sw_if_index,
@@ -3238,6 +3248,59 @@ class VppPapiProvider(object):
         """ GBP endpoint Dump """
         return self.api(self.papi.gbp_endpoint_dump, {})
 
+    def gbp_endpoint_group_add_del(self, is_add, epg, bd,
+                                   ip4_rd,
+                                   ip6_rd,
+                                   uplink_sw_if_index):
+        """ GBP endpoint group Add/Del """
+        return self.api(self.papi.gbp_endpoint_group_add_del,
+                        {'is_add': is_add,
+                         'epg': {
+                             'uplink_sw_if_index': uplink_sw_if_index,
+                             'bd_id': bd,
+                             'ip4_table_id': ip4_rd,
+                             'ip6_table_id': ip6_rd,
+                             'epg_id': epg}})
+
+    def gbp_endpoint_group_dump(self):
+        """ GBP endpoint group Dump """
+        return self.api(self.papi.gbp_endpoint_group_dump, {})
+
+    def gbp_recirc_add_del(self, is_add, sw_if_index, epg, is_ext):
+        """ GBP recirc Add/Del """
+        return self.api(self.papi.gbp_recirc_add_del,
+                        {'is_add': is_add,
+                         'recirc': {
+                             'is_ext': is_ext,
+                             'sw_if_index': sw_if_index,
+                             'epg_id': epg}})
+
+    def gbp_recirc_dump(self):
+        """ GBP recirc Dump """
+        return self.api(self.papi.gbp_recirc_dump, {})
+
+    def gbp_subnet_add_del(self, is_add, table_id,
+                           is_internal,
+                           addr, addr_len,
+                           sw_if_index=0xffffffff,
+                           epg_id=0xffffffff,
+                           is_ip6=False):
+        """ GBP Subnet Add/Del """
+        return self.api(self.papi.gbp_subnet_add_del,
+                        {'is_add': is_add,
+                         'subnet': {
+                             'is_internal': is_internal,
+                             'is_ip6': is_ip6,
+                             'sw_if_index': sw_if_index,
+                             'epg_id': epg_id,
+                             'address': addr,
+                             'address_length': addr_len,
+                             'table_id': table_id}})
+
+    def gbp_subnet_dump(self):
+        """ GBP Subnet Dump """
+        return self.api(self.papi.gbp_subnet_dump, {})
+
     def gbp_contract_add_del(self, is_add, src_epg, dst_epg, acl_index):
         """ GBP contract Add/Del """
         return self.api(self.papi.gbp_contract_add_del,