Cisco APIC Security Configuration Guide, Release 6.2(x)

PDF

Cisco APIC Security Configuration Guide, Release 6.2(x)

Route leaking for internal bridge domain subnets in the REST API

Updated: April 17, 2026

Want to summarize with AI?

Log in

A REST API payload can leak an internal bridge domain subnet from a source virtual routing and forwarding (VRF) instance to a destination tenant and VRF instance.

Route leaking for an internal bridge domain (BD) subnet provides routing reachability for a specified prefix in another VRF instance.

  • The leaked prefix must match or be contained within an existing BD subnet.

  • The configuration identifies the source VRF instance and one or more destination tenant and VRF pairs.

  • The source and destination scope settings control whether Layer 3 Outside (L3Out) connections can advertise the leaked prefix.

REST API objects

Object

Purpose

leakRoutes

Contains the route-leaking configuration for the source VRF instance.

leakInternalSubnet

Specifies the internal BD prefix to leak and its default L3Out advertisement scope.

leakTo

Identifies a destination tenant and VRF instance and optionally overrides the parent advertisement scope.
Note

Route leaking provides routing reachability only. Configure the required contract relationships separately to permit traffic between endpoint security groups (ESGs) in different VRF instances.

XML payload

The following payload leaks 192.168.1.0/24 from VRFA in tenant t0 to VRFB in tenant t1:

<polUni>
        <fvTenant name="t0">
        <fvCtx name="VRFA">
        <leakRoutes>
        <!-- Disable L3Out advertisement for the leaked prefix. -->
        <leakInternalSubnet ip="192.168.1.0/24" scope="private">
        <!-- Inherit the advertisement scope from the parent. -->
        <leakTo ctxName="VRFB" tenantName="t1"
        scope="inherit"/>
        </leakInternalSubnet>
        </leakRoutes>
        </fvCtx>
        </fvTenant>
        </polUni>

In this example, scope="private" disables L3Out advertisement for the leaked prefix. The destination uses scope="inherit" and therefore retains the scope configured on leakInternalSubnet.

Note

The source BD subnet and the source and destination VRF instances must exist before you submit the payload.