Cisco APIC Layer 3 Networking Configuration Guide, Release 6.2(x)

PDF

Cisco APIC Layer 3 Networking Configuration Guide, Release 6.2(x)

Static L3Out EPG

Updated: April 17, 2026

Want to summarize with AI?

Log in

A static Layer 3 Outside (L3Out) endpoint group (EPG) uses security-import subnets and contracts to control transit and tenant traffic.

A static L3Out EPG controls traffic by using an allow-list security model. The fabric drops data-plane traffic by default unless a contract explicitly permits it.

  • Applies to external and tenant EPGs.

  • Requires a contract and security prefix to permit traffic between external EPGs.

  • Uses security-import subnets configured in the L3Out Instance Profile.

Transit and tenant security policies

Transit and tenant security policies have the following characteristics.

Transit security policies:

  • Use prefix filtering.

  • Support EtherType, protocol, Layer 4 (L4) port, and TCP flag filters beginning with Cisco APIC Release 2.0(1m).

  • Use security-import subnets and contracts configured under the external EPG.

Tenant EPG security policies:

  • Do not use prefix filtering.

  • Support EtherType, protocol, L4 port, and TCP flag filters.

  • Support tenant EPG-to-EPG and tenant EPG-to-external EPG traffic.

Note

Security policies drop transit traffic that enters and exits through the same L3Out when the security-import subnet is configured as 0.0.0.0/0. To prevent this behavior, configure more-specific security-import subnets.

L3Out connection contract configuration

The union of prefixes for L3Out connections is programmed on every leaf switch where the L3Out connections are deployed. When more than two L3Out connections are deployed, using the 0.0.0.0/0 aggregate rule can allow traffic between L3Out connections that do not have a contract.

Configure the provider and consumer contract associations and the security-import subnets in the L3Out Instance Profile (instP).

When you configure security-import subnets and use the 0.0.0.0/0 aggregate rule, the security-import subnets follow access control list (ACL) matching rules. For example, the security-import subnet 10.0.0.0/8 matches every address from 10.0.0.0 through 10.255.255.255. You do not need to configure an exact prefix match for prefixes that the route-control subnets permit.

Carefully configure security-import subnets when more than two L3Out connections are in the same virtual routing and forwarding (VRF) instance because the rules are combined.

Security policies drop transit traffic that enters and exits through the same L3Out when the security-import subnet is configured as 0.0.0.0/0. This behavior applies to dynamic and static routing. To prevent this behavior, configure more-specific subnets.