Cisco APIC Layer 3 Networking Configuration Guide, Release 6.2(x)

PDF

Cisco APIC Layer 3 Networking Configuration Guide, Release 6.2(x)

Configure dynamic ESG and L3Out EPG classification by using the GUI

Updated: April 17, 2026

Want to summarize with AI?

Log in

Configure Dynamic Endpoint Security Group (ESG) Classification and Dynamic L3Out Endpoint Group (EPG) Classification by creating an import route map and assigning an external EPG or ESG based on route matches.

Before you begin

  • Create the tenant, private network, and bridge domain.

  • Create the Layer 3 Outside (L3Out) connection for the tenant network.

This procedure assumes that the L3Out uses Border Gateway Protocol (BGP). You can also use this procedure for an L3Out that uses Open Shortest Path First (OSPF).

Import route control is not enforced by default. You must explicitly enable import route-control enforcement.

Procedure

  1. On the menu bar, choose Tenants > All Tenants .

  2. In the Work pane, double-click the tenant name.

  3. In the Navigation pane, choose tenant_name > Networking > L3Outs > l3out_name .

  4. Right-click l3out_name and choose Create Route map for import and export route control .

  5. In the Create Route map for import and export route control dialog box, configure the route map:

    1. From the Name drop-down list, choose default-import .

      The routes advertised on the selected L3Out are used automatically.

    2. In the Type field, choose Match Routing Policy Only .
    3. In the Contexts area, click + .

      The Create Route Control Context dialog box appears.

  6. In the Create Route Control Context dialog box, configure the route-control context:

    1. In the Order field, enter the order number.
    2. In the Name field, enter a name for the route-control context.
    3. In the Associated Matched Rules table, click + .
    4. From the Rule Name drop-down list, choose Create Match Rule for a Route Map .
    5. In the Create Match Rule for a Route Map dialog box, enter a name for the route-match rule in the Name field.
    6. Configure the match-community regular expression and match-community terms.

      For each match-community factor, specify the name, community, and scope.

    7. Click Submit .
    8. From the Set Rule drop-down list, choose Create Set Rules for a Route Map .
    9. In the Create Set Rules for a Route Map dialog box, enter a name for the rule in the Name field.
    10. For Cisco APIC Release 6.1(3) and earlier, configure the external EPG:

      Check the Set External EPG check box, choose an EPG from the External EPG drop-down list, and click Finish .

      The policy is created and associated with the action rule.

    11. For Cisco APIC Release 6.1(4) and later, configure the pcTag:

      In the Set PcTag field, choose External EPG and select an external EPG from the External EPG drop-down list, choose ESG and select an ESG from the ESG drop-down list, or choose None if you do not want to set a pcTag. Click Finish .

      The policy is created and associated with the action rule.

    12. In the Create Route Control Context window, click OK .
    13. In the Create Route map for import and export route control dialog box, click Submit .

  7. In the Work pane, choose the Policy > Main tabs.

    The Properties appear in the Work pane.

  8. Next to Route Control Enforcement , check the Import check box, and click Submit .

    Import route-control enforcement is disabled by default. It is supported for BGP and OSPF but not for Enhanced Interior Gateway Routing Protocol (EIGRP). If you enable import route-control enforcement for an unsupported protocol, the policy is ignored for that protocol. Export route control is supported for BGP, EIGRP, and OSPF. You do not need to check the Import check box when you configure a BGP per-neighbor import route map.

    Note

    If BGP is established over OSPF, the import route-control policy applies only to BGP and is ignored for OSPF.