Cisco APIC Security Configuration Guide, Release 6.2(x)

PDF

Cisco APIC Security Configuration Guide, Release 6.2(x)

Configure route leaking for external prefixes by using the GUI

Updated: April 17, 2026

Want to summarize with AI?

Log in

Leaks selected external prefixes from a source virtual routing and forwarding (VRF) instance to one or more destination VRF instances.

Before you begin

  • Configure a Layer 3 Outside (L3Out) connection or border gateway (BGW) in the source VRF instance.

  • Verify that the source VRF instance has learned the external prefixes.

  • Configure the destination tenant and VRF instances.

External prefix route leaking uses IP prefix-list-style matching. You can leak a specific prefix or use minimum and maximum prefix lengths to match a range of prefixes.

Route leaking provides routing reachability only. Configure the required ESG or L3Out external EPG contract relationships separately to permit traffic between VRF instances.

Procedure

  1. In the Navigation pane, navigate to Tenants > tenant-name > Networking > VRFs > source-vrf-name > Inter-VRF Leaked Routes for ESG > External Prefixes .

  2. Right-click External Prefixes, and choose Create Leaked External Prefix.

  3. In the Create Leaked External Prefix dialog box, configure the prefix match.

    1. In the IP field, enter the external prefix to leak.
    2. Optional: In the Description field, enter a description of the leaked prefix.
    3. Optional: In the Greater than or Equal (Prefix) field, enter the minimum prefix length to match.

      This value is equivalent to the ge option in an IP prefix list.

    4. Optional: In the Less than or Equal (Prefix) field, enter the maximum prefix length to match.

      This value is equivalent to the le option in an IP prefix list.

  4. In the Tenant and VRF destinations field, click +.

  5. In the Create Tenant and VRF destination dialog box, configure the destination.

    1. In the Tenant and VRF field, choose the destination tenant and VRF instance.
    2. Optional: In the Description field, enter a description of the destination.
    3. Click OK.

  6. Click Submit.

The external prefixes that match the configured prefix criteria are leaked to the selected destination VRF instances.

What to do next

To advertise the leaked prefixes through an L3Out in a destination VRF instance, configure an explicit route map. Leaked external prefixes are not advertised from the destination VRF instance by default.