Cisco APIC Layer 3 Networking Configuration Guide, Release 6.2(x)

PDF

Cisco APIC Layer 3 Networking Configuration Guide, Release 6.2(x)

Create an external subnet selector

Updated: April 17, 2026

Want to summarize with AI?

Log in

Classify EVPN Type-5 prefixes received from remote Cisco NX-OS border gateways into an endpoint security group.

Use this procedure to classify specific EVPN Type-5 prefixes, including internal subnets and external resources, received from policy-unaware VXLAN EVPN domains.

In a policy-unaware VXLAN EVPN environment, an external subnet selector enables an endpoint security group (ESG) to identify and classify prefixes received from remote Cisco NX-OS border gateways.

Procedure

  1. On the menu bar, click Tenants and choose the applicable tenant.

  2. In the navigation pane, expand tenant_name > Application Profiles > application_profile_name > Endpoint Security Groups > esg_name > Selectors.

  3. Right-click External Subnet Selectors and choose Create a External Subnet Selector.

  4. In the Create a External Subnet Selector dialog box, configure the selector:

    1. In the IP field, enter the IP prefix to match.
    2. Optional: In the Description field, enter a description of the selector.
    3. Check the Shared check box to share the external subnet across VRFs.

      To enable shared security, configure the external EPGs and the subnets that you want to share with the shared security flags.

    4. Click Submit.
    Note

    Use exact matches for remote prefixes that represent bridge domain subnets.

    VXLAN external subnet selector prefixes do not need to exactly match EVPN prefixes received from VXLAN EVPN fabrics when the prefixes represent resources external to the fabric. You can use a supernet to match these remote prefixes.

    To match all IPv4 prefixes when you cannot use 0.0.0.0/0 , configure both 0.0.0.0/1 and 128.0.0.0/1 .

The external subnet selector appears under External Subnet Selectors and classifies the specified IP prefixes into the ESG.