An engineer must configure a Layer 3 connection to the WAN router. The hosts in production VRF must access WAN subnets. The engineer associates EPGs in the production VRF with the external routed…

The 'Export Route Control Subnet' scope is used to control which internal prefixes are advertised from the ACI fabric to the external routed network, which is the opposite direction of the requirement.

To allow internal EPGs within a VRF to access specific external WAN subnets, these external subnets must be configured under the external EPG's 'External Subnets for the External EPG' scope. This explicitly tells ACI which external prefixes are reachable through the external routed network, enabling routing from internal VRFs to the WAN.

The 'Import Route Control Subnet' scope is used to control which external routes are accepted and imported into the ACI fabric, typically for filtering or policy enforcement, but does not define the actual external subnets for reachability.

The 'Shared Route Control Subnet' scope is used for inter-VRF route leaking or sharing routes between different VRFs within the ACI fabric, not for defining external subnets for WAN access.