Cisco APIC Layer 3 Networking Configuration Guide, Release 6.2(x)

PDF

Cisco APIC Layer 3 Networking Configuration Guide, Release 6.2(x)

Route filtering and aggregation at the VRF level

Updated: April 17, 2026

Want to summarize with AI?

Log in

Explains how administrators can selectively control route advertisement and reduce fabric scale requirements through VRF-level route control policies.

Route filtering and aggregation at the VRF level is a network control mechanism that

  • enables administrators to selectively import prefixes of a VRF into LPM table or export prefixes of a VRF to MP-BGP or L3Out peers

  • provides options to summarize or filter routes that are advertised in a fabric to reduce the scale requirements of the fabric, and

  • adds route control policies under VRF beginning in the Cisco APIC 5.2(4) release.

Route control behavior

By default, border leaf nodes receive many prefixes from the directly connected, static route, and routing protocols and these prefixes gets redistributed in MP-BGP and these prefixes are advertised to all leaf and spine switches. Leaf switches programs all the prefixes of configured VRFs in the LPM.

BGP route summarization policies

A BGP route summarization policy is a network policy that

  • aggregates prefixes to a larger subnet irrespective of whether the subnet is learned directly from an external router or not

  • allows you to specify whether to advertise only the aggregated subnets or to advertise all prefixes within the subnet, and

  • controls aggregation for L3Out peers and MP-BGP.

Configuration options

These configurations are available in this policy:

  • Nodes: A list of border leaf nodes on which the route profile needs to be applied.

    • At least one border leaf must be configured for the policy to be deployed.

    • Spine switches are not supported in this policy.

    • You can configure multiple policies for each VRF instance, border leaf node pair.

    • This policy is vPC unaware. Therefore, you can configure different policies between nodes in a vPC pair.

    • This policy is applicable only for the unicast address family.

  • Subnets: A list of subnets with each subnet pointing to the BGP route summarization policy configured under tenant.

    • You must configure at least one subnet to deploy the policy.

    • There should be no overlap between subnets that are associated with different route summarization policies for the same node.

  • BGP route summarization policy: Using the route summarization policy control state options, you can either enable advertisement of only the aggregate prefixes to peers, or you can allow advertisement of both the aggregate as well as specific prefixes to peers.

    • When you configure route summarization for the same subnet on a VRF instance as well as l3extSubnet, Cisco APIC the raises a fault. Clear this fault before performing a fabric upgrade or switch reload.

    • To configure a BGP route summarization policy, see Configure route control policy in VRF using the GUI.

Intra-VRF import route control policy

This policy allows you to control the prefixes to be registered in the routing table.

The following configurations are available in this policy:

  • Nodes: A list of leaf nodes on which the route profile needs to be applied.

    • At least one leaf must be configured for the policy to be deployed.

    • Spine switches are not supported in this policy.

    • If there is no import route control policy that is configured for the VRF, leaf node, then all prefixes of the VRF from MP-BGP will be registered in the node’s routing table.

    • This policy is vPC unaware. Therefore, you can configure different policies between nodes in a vPC pair.

Route Map: Configure the same way that you configure an existing route profile configuration for a tenant. Following route-map match and set clauses are applicable in the Import Route Control configuration:

  • Match Clauses: IP Prefix List, Community, Extended Community (match on color extended community is not supported), Regex Community, Regex Extended Community, and Regex AS-Path.

  • Set Clauses: Community, Extended Community, Tag, Weight, Preference, and Metric.

If route summarization or fabric export control is configured to suppress a prefix in MP-BGP, then this policy will not be updated in the receiver leaf’s routing table even if it is allowed by the import route control policy for the leaf.

The procedures for configuring an inter-VRF import route control policy is provided in Configure route control policy in VRF using the GUI .

VRF export route control policy

This policy allows you to control the prefixes to be advertised to a fabric.

Summary

The policy relies on the following key components:

  • Nodes: A list of border leaf nodes on which the route profile is applied.

  • Route Map: A configuration mechanism similar to existing tenant route profiles, supporting specific match and set clauses.

Workflow

These stages describe the configuration requirements for the policy.

  1. Node configuration requirements:

    • At least one border leaf must be configured for the policy to be deployed.

    • Spine switches are not supported in this policy.

    • If no export route control policy is configured for the VRF and border leaf pair, all VRF prefixes from border leaves to MP-BPG are advertised.

    • This policy is vPC unaware, allowing different configurations between nodes in a vPC pair.

  2. Route map configuration requirements:

    Match Clauses:

    • IP Prefix List

    • Community

    • Extended Community (match on color extended community is not supported)

    • Regex Community

    • Regex Extended Community

    Set Clauses:

    • Community

    • Extended Community (except setting extended community to None )

    • Weight

    • Preference

    • Metric

What’s next

The procedures for configuring a VRF export route control policy is provided in Configure route control policy in VRF using the GUI.