Cisco APIC Layer 3 Networking Configuration Guide, Release 6.2(x)

PDF

Cisco APIC Layer 3 Networking Configuration Guide, Release 6.2(x)

Inter-VRF route leaking between Layer 3 Outs

Updated: April 17, 2026

Want to summarize with AI?

Log in

Describes how contracts enable Layer 3 Outs in different VRFs to exchange connected, transit, static, and dynamic routes across VRF boundaries.

Inter-VRF route leaking between Layer 3 Outs is a configuration capability that

  • requires a contract between the Layer 3 Outs,

  • uses contract enforcement to leak connected, transit, static, or dynamic routes, and

  • supports shared Layer 3 Outs in different VRFs.

Configuration requirements and behavior

The following requirements and behaviors apply to inter-VRF route leaking between Layer 3 Outs:

  • Connected and transit routes: Contracts between Layer 3 Outs or between a Layer 3 Out and an EPG can leak connected and transit routes without leaking dynamic or static routes between VRFs.

  • Dynamic and static routes: Contracts between Layer 3 Outs or between a Layer 3 Out and an EPG can leak dynamic and static routes without advertising directly connected or transit routes between VRFs.

  • Bridge domain association: An inter-VRF shared Layer 3 Out does not require the bridge domain to be associated with a Layer 3 Out. User-tenant bridge domains do not have to be associated with the Layer 3 Out in the common tenant. Continue to associate a tenant-specific Layer 3 Out with the bridge domains in that tenant.

  • VRF placement: The two Layer 3 Outs can belong to different VRFs and exchange routes.

  • Contract placement: This communication model uses the same contract enforcement as inter-VRF communication between an application EPG and a Layer 3 Out. However, the contract is between two Layer 3 Outs.

The following figure shows two Layer 3 Outs with a shared subnet and a contract between the Layer 3 external instance profiles (l3extInstP) in both VRFs.

Figure 1. Shared Layer 3 Outs communicating between two VRFs

Configure shared Layer 3 Out inter-VRF route leaking using the advanced GUI

Before you begin

Create the contract label that the provider and consumer L3Outs use.

Procedure

  1. From the menu bar, choose Tenants > Add Tenant .

  2. In the Create Tenant dialog box, enter a name for the provider tenant.

  3. In the VRF Name field, enter a name for the provider VRF, and then click Submit.

  4. In the Navigation pane, under the provider tenant, select L3Outs.

  5. Right-click L3Outs, and choose Create L3Out.

    The Create L3Out wizard opens.

  6. In the Create L3Out wizard, configure the provider L3Out:

    1. In the Name field, enter a name for the L3Out.
    2. From the VRF field, select the provider VRF.
    3. From the L3 Domain field, select a Layer 3 domain.
    4. Select the required routing protocols, and then click Next.

  7. Complete the protocol-specific pages, and click Next until the External EPG page appears.

    Depending on the protocol that you selected on the Identity page, the wizard displays the Nodes and Interfaces and Protocols pages. The External EPG page is the final page.

  8. On the External EPG page, configure the provider external EPG:

    1. In the Name field, enter the external network name.
    2. Clear the Default EPG for all external networks check box.

      The Subnets fields appear.

    3. Click + to open the Create Subnet dialog box.
    4. In the IP Address field, enter the matching IP address, and then click OK.
    5. In the Create L3Out wizard, click Finish.

  9. In the Navigation pane, choose L3Out_name > External EPGs > ExternalEPG_name .

  10. In the Work pane, under Properties, verify that the Resolved VRF field displays the provider VRF.

  11. Double-click the external subnet IP address to open the Subnet dialog box.

  12. In the Scope field, select the required check boxes, and then click Submit.

    For this configuration, select the following check boxes:

    • External Subnets for the External EPG

    • Shared Route Control Subnet

    • Shared Security Import Subnet

  13. Select the provider L3Out.

  14. In the Provider Label field, enter the contract label from the prerequisite, and then click Submit.

  15. From the menu bar, choose Tenants > Add Tenant .

  16. In the Create Tenant dialog box, enter a name for the consumer tenant.

  17. In the VRF Name field, enter a name for the consumer VRF, and then click Submit.

  18. In the Navigation pane, under the consumer tenant, select L3Outs.

  19. Right-click L3Outs, and choose Create L3Out.

    The Create L3Out wizard opens.

  20. In the Create L3Out wizard, configure the consumer L3Out:

    1. In the Name field, enter a name for the L3Out.
    2. From the VRF field, select the consumer VRF.
    3. In the Consumer Label field, enter the contract label from the prerequisite.
    4. From the L3 Domain field, select a Layer 3 domain.
    5. Select the required routing protocols, and then click Next.

  21. Complete the protocol-specific pages, and click Next until the External EPG page appears.

    Depending on the protocol that you selected on the Identity page, the wizard displays the Nodes and Interfaces and Protocols pages. The External EPG page is the final page.

  22. On the External EPG page, configure the consumer external EPG:

    1. In the Name field, enter the external network name.
    2. Clear the Default EPG for all external networks check box.

      The Subnets fields appear.

    3. Click + to open the Create Subnet dialog box.
    4. In the IP Address field, enter the matching IP address.
    5. In the Scope field, select Shared Route Control Subnet and Shared Security Import Subnet, and then click OK.
    6. In the Create L3Out wizard, click Finish.

The provider and consumer L3Outs use the matching contract label and subnet scopes to leak routes between their VRFs.