Cisco APIC Security Configuration Guide, Release 6.2(x)

ESG shared services and VRF route leaking

Updated: April 17, 2026

Want to summarize with AI?

Endpoint security group (ESG) shared services enable communication between endpoints in different virtual routing and forwarding (VRF) instances by separating routing reachability from security policy enforcement.

An ESG shared service enables endpoints in different VRF instances to communicate by using separate configurations for route leaking and security permissions.

Route leaking is configured at the VRF level independently of ESG contracts.
Contracts between ESGs control the permitted traffic.
Unlike EPG shared services, ESG shared services do not require subnet configuration under the ESG.

Configuration requirements

Configure routing reachability and security permissions separately to enable communication between endpoints in different VRF instances.

Configure route leaking at the VRF level for the required bridge domain subnets and external prefixes learned from external routers.
Configure a contract between two ESGs or between an ESG and a Layer 3 Outside (L3Out) external EPG.
Assign the contract a scope that extends beyond a single VRF instance, such as the global scope.

Note

VRF-level route-leaking configuration is supported only for ESGs.

Route leaking for internal bridge domain subnets

Route leaking for internal bridge domain subnets exports a specified subnet from one VRF instance to another.

Configure the subnet to leak and the target VRF instance at the VRF level.
The specified subnet must match or be contained within a configured bridge domain subnet.
Only the prefix with the specified subnet mask is leaked. You cannot specify a range of subnets in one configuration.

ESG communication requirements

Routing reachability and security permissions are configured separately for ESGs in different VRF instances.

Configure VRF-level route leaking for the required bridge domain subnet.
Configure a contract between the ESGs to permit the required traffic.

The subnet in the VRF-level route-leaking configuration can also match a subnet used by an EPG. This capability supports migration from EPG-based security policies to ESG-based security policies.

Subnet configuration

The Advertised Externally subnet scope is not required for ESG route leaking configured at the VRF level.
The Shared between VRFs subnet scope is not required for ESG route leaking configured at the VRF level.
Set Allow L3Out Advertisement to True in the VRF-level route-leaking configuration. For each L3Out that must advertise the leaked subnet, configure an L3Out route map or an L3Out subnet with the Export Route Control Subnet scope.

Note

For leaking a subnet to the specified target VRF instance, the VRF-level route-leaking configuration takes precedence over the subnet scopes configured on the bridge domain. The bridge domain subnet scopes continue to apply to other functions, such as L3Out advertisement within the source VRF instance and EPG contract behavior.

Note

In traditional route leaking that uses endpoint group (EPG) contracts, every leaked bridge domain subnet with the Advertise Externally scope is advertised through each L3Out in the destination VRF whose external EPG contains a subnet with the Shared Route Control Subnet scope. Although this scope normally leaks external prefixes into another VRF routing table, it also causes border leaf switches to advertise the leaked bridge domain subnets.

Endpoint security group (ESG) route leaking configures external prefix leaking at the VRF level and does not require external EPG subnets with the Shared Route Control Subnet scope. Set Allow L3Out Advertisement to True on the destination VRF. For each L3Out that must advertise a leaked bridge domain subnet, configure an L3Out route map or an L3Out subnet with the Export Route Control Subnet scope. This configuration controls which L3Outs advertise each leaked subnet.

The Allow L3Out Advertisement setting permits L3Out advertisement but does not initiate it. The bridge domain subnet Advertise Externally scope determines whether the subnet can be advertised externally.

Route leaking between ESGs

In the following example, VRF-level route leaking provides routing reachability between ESG1 in VRF A and ESG2 in VRF B. A contract between ESG1 and ESG2 permits the required traffic.

Route leaking for external prefixes

Route leaking for external prefixes exports routes from an L3Out in one VRF instance to another VRF instance. This configuration is referred to as an ESG shared L3Out to distinguish it from an EPG shared L3Out.

Route leaking is configured at the VRF level independently of ESG contracts.
An IP prefix-list-style configuration identifies the external prefixes to leak.
The configuration identifies the target VRF instance and the policy object that supplies the security classification.

External prefix matching

You can specify an individual external prefix or a range of external prefixes.

Use the le or ge option to match a range of prefix lengths.
External prefix matching does not impose restrictions on the prefix size.
Unlike route leaking for bridge domain subnets, one external prefix configuration can match and leak multiple prefixes.

L3Out security options

Select one of the following methods to provide security classification for the leaked external prefixes:


Security method	Required configuration	Contract relationship
Use the L3Out external EPG without assigning its subnets to an ESG.	Configure the applicable L3Out subnets with the External Subnets for the External EPG and Shared Security Import Subnet scopes.	Configure a contract between the L3Out external EPG in one VRF instance and the ESG in the other VRF instance.
Use an ESG with an External EPG Selector that matches the L3Out external EPG.	Configure the applicable L3Out subnets with the External Subnets for the External EPG and Shared Security Import Subnet scopes.	Configure a contract between the ESGs in the two VRF instances.
Use an ESG with a Tag Selector that matches specific L3Out subnets under the external EPG.	Configure the applicable L3Out subnets with the External Subnets for the External EPG and Shared Security Import Subnet scopes.	Configure a contract between the ESGs in the two VRF instances.
Use an ESG with an External Subnet Selector that matches specific external prefixes.	Enable the Shared option on the External Subnet Selector. L3Out subnet configuration under the external EPG is not required for security classification.	Configure a contract between the ESGs in the two VRF instances.

Advertisement from the target VRF instance

Before Cisco APIC Release 6.1(4), the Shared Route Control Subnet option was required to advertise a leaked route through another L3Out.

Beginning with Cisco APIC Release 6.1(4), the Shared Route Control Subnet option is not used for ESGs. External prefix configuration controls route leaking.

Note

Leaked external prefixes are not advertised through an L3Out in the target VRF instance by default. Configure an explicit route map to advertise them.

For configuration instructions, see Configure route leaking for external prefixes by using the GUI .

Route leaking for internal prefixes

Route leaking for internal prefixes exports bridge domain subnet routes learned through a Cisco ACI border gateway (BGW) to another VRF instance.

Applies to subnets that are internal to another fabric but are not stretched to the local fabric.
Uses the same IP prefix-list-style matching method as route leaking for external prefixes.
Can be used with route leaking for local bridge domain subnets.

Route-leaking method selection

Select the route-leaking method based on where the bridge domain subnet is configured.

Use route leaking for internal bridge domain subnets when the subnet is configured on a bridge domain in the local Cisco ACI fabric.
Use route leaking for internal prefixes when the subnet is learned through a BGW and is not configured on a local bridge domain.
Use both methods when the target VRF instance requires routes for local bridge domain subnets and internal prefixes learned from another fabric.

Note

You cannot use the internal bridge domain subnet method to leak a prefix that is not part of a local bridge domain subnet.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.