To enable communication between the external subnet and internal EPG1, and to allow L3Out traffic

to leak into the VRF named “VF1”, the following configuration set should be used:

External Subnets for External EPG: This configuration defines the subnets that are external to the ACI

fabric but need to be reachable from within the fabric. It is necessary to specify which subnets are to

be considered part of the L3Out1.

Shared Route Control Subnet: This setting allows the subnets to be shared across different VRFs,

enabling communication between EPGs that are in different tenants but within the same VRF1.

Shared Security Import Subnet: This configuration ensures that the security policies (contracts)

associated with the shared subnets are also imported, allowing for the necessary traffic to flow

between the internal and external endpoints1.

By applying this configuration set, the external subnet and internal EPG1 will be able to

communicate, and the L3Out traffic will be properly leaked into the designated VRF, meeting the

specified goals.

Reference:

ACI Inter VRF/Tenant Route Leaking Configuration Example1