Just to add onto Manuel:
"Import-Route Control Enforcement" is disabled by default when you create an L3 out. When this box is enabled(checked off) everything is denied. As Manuel, said you have to specify the prefixes under the L3 External EPG subnets you want to permit by checking the "import route control subnet" flag on the subnet and it will cause it to be learned. Without that box checked the prefix would not be imported. If you want to deny specific inbound routes, deny rules do not work with import route-control. Deny rules only work for export route-control.
OR
You can create an inbound route map. This way you don't have to use the import route control flag under every ext EPG subnet you want to permit. Basically in the route map you would specify what you want to permit and everything else is implicitly denied. You would then tie this route map to the "Route Control Profile" under the external EPG subnet as an Import Route Policy.
*Note even with the route-map mechanism, import route control enforcement under the main L3 out panel has to be checked for this to work*
So, in summary there are actually two different ways you can accomplish route filtering in the import direction.
Thank you for participating in the Cisco Support Forum for ACI! If you have other questions related to this post, please let us know. If this response answers your questions, please mark this post "answered" and assign a rating to the response(s) provided. This will help notify other viewers that your question(s) is answered and this helps us provide better responses for this and future questions.
Regards,
