Cisco APIC Security Configuration Guide, Release 6.2(x)

PDF

Cisco APIC Security Configuration Guide, Release 6.2(x)

Route leaking for external prefixes in the REST API

Want to summarize with AI?

Log in

A REST API payload can leak external prefixes from a source virtual routing and forwarding (VRF) instance to a destination tenant and VRF instance.


Route leaking for external prefixes exports selected external routes learned in one VRF instance to another VRF instance.

  • The source VRF instance must learn the external prefixes through a Layer 3 Outside (L3Out) connection or border gateway (BGW).

  • A base prefix identifies the address range from which routes can be leaked.

  • The ge and le attributes define the minimum and maximum prefix lengths to match.

REST API objects

Object

Purpose

leakRoutes

Contains the route-leaking configuration for the source VRF instance.

leakExternalPrefix

Specifies the base prefix and optional minimum and maximum prefix lengths to match.

leakTo

Identifies the destination tenant and VRF instance.

Note

Route leaking provides routing reachability only. Configure the required endpoint security group (ESG) or L3Out external EPG contract relationships separately to permit traffic between VRF instances.

Note

Leaked external prefixes are not advertised through an L3Out in the destination VRF instance by default. Configure an explicit route map if the destination L3Out must advertise them.

XML payload

The following payload leaks external prefixes within 10.20.0.0/16 that have prefix lengths from /17 through /30. The routes are leaked from VRFA in tenant t0 to VRFB in tenant t1.

<polUni>
        <fvTenant name="t0">
        <fvCtx name="VRFA">
        <leakRoutes>
        <leakExternalPrefix ip="10.20.0.0/16" ge="17" le="30">
        <leakTo ctxName="VRFB" tenantName="t1"/>
        </leakExternalPrefix>
        </leakRoutes>
        </fvCtx>
        </fvTenant>
        </polUni>
Note

The source L3Out or BGW and the source and destination VRF instances must exist before you submit the payload.