Refer to the exhibit. A company decided to decrease its routing footprint and remove RT-2 and RT-3 devices from its data center. Because of that, the exit point must be created from all the tenants by

Moving subnets to the EPG level and marking them "Shared" is not a standard or correct practice for enabling a shared L3Out across tenants and VRFs; subnets are typically defined at the Bridge Domain (BD) level.

To allow an L3Out in a common tenant to advertise routes to other VRFs and tenants, the subnet defined under the L3Out's external EPG (ExtEPG) must be configured with the "Shared Route Control Subnet" flag. This flag indicates that the subnet is intended for route advertisement and control across different routing contexts.

While marking subnets with "Shared between VRFs" is crucial for inter-VRF communication, attaching contract Ctr-3 as a provider to all EPGs without explicitly defining its scope to be Global or ensuring appropriate consumer relationships across tenants will not fully achieve the objective.

For EPGs in different tenants and VRFs to access a shared L3Out in a common tenant, the contract that governs this access must have its scope set to "Global". This allows EPGs from any tenant to consume the contract, and the relevant subnets in the bridge domains must be marked with the "Shared between VRFs" flag to enable inter-VRF routing.

Exporting a contract (Ctr-2) into a specific tenant (TN-1) only allows that specific tenant to consume it, which contradicts the requirement for "all the tenants" to use the common tenant's L3Out.