Subnet scope and aggregate controls manage route advertisement, security enforcement, and traffic between external and internal endpoint groups.
Subnet controls define how the fabric advertises routing information and enforces security policies for traffic entering or leaving the fabric.
-
Route-control options manage the advertisement of transit and internal routes.
-
Security-import options control data-plane traffic between external and internal endpoint groups (EPGs).
-
Aggregation options summarize prefixes to simplify routing tables.
Subnet control and aggregation options
The following scope and aggregate options are available when you create a subnet:
Export Route Control Subnet—Advertises specific transit routes out of the fabric. This control applies only to transit routes. It does not control internal routes or default gateways configured on a bridge domain (BD).
Import Route Control Subnet—Allows Border Gateway Protocol (BGP) and Open Shortest Path First (OSPF) routes to be advertised into the fabric when Import Route Control Enforcement is configured.
External Subnets for the External EPG, also called Security Import Subnet—Does not control the advertisement of routing information into or out of the fabric. To allow traffic between external EPGs or between an external EPG and an internal EPG, mark the subnet with this control. If you do not mark the subnet, routes learned from one EPG are advertised to the other external EPG, but the fabric drops the packets. The Cisco APIC uses an allow-list model that drops data-plane traffic between EPGs by default unless a contract explicitly permits the traffic. This model applies to external and application EPGs. When you use a security policy with this option, configure a contract and a security prefix.
Shared Route Control Subnet—Subnets learned from shared Layer 3 Outside (L3Out) connections through inter-VRF route leaking must be marked with this control before they can be advertised to other virtual routing and forwarding (VRF) instances. Beginning with Cisco APIC Release 2.2(2e), shared L3Outs in different VRF instances can communicate through a contract. For more information about communication between shared L3Outs in different VRF instances, see the Cisco APIC Layer 3 Networking Configuration Guide.
Shared Security Import Subnet—Provides the same control as External Subnets for the External EPG for routes learned from a shared L3Out. To allow traffic between external EPGs or between an external EPG and an internal EPG, mark the subnet with this control. If you do not mark the subnet, routes learned from one EPG are advertised to the other external EPG, but the fabric drops the packets. When you use a security policy with this option, configure a contract and a security prefix.
Aggregate Export, Aggregate Import, and Aggregate Shared Routes—Adds 32 before the 0.0.0.0/0 prefix. You can aggregate only the 0.0.0.0/0 prefix for an import or export route-control subnet. If the 0.0.0.0/0 prefix is aggregated, you cannot apply a route-control profile to the 0.0.0.0/0 network.
Aggregate Shared Route—Available for any prefix marked as Shared Route Control Subnet.
Route Control Profile—Supports route map set clauses for routes advertised into and out of the fabric. Configure the route map set rules by using Route Control Profile policies and Action Rule Profiles.