An end controller, comprising: a processing resource; and a memory resource storing machine-readable instructions to cause the processing resource to: receive, using internet protocol security (IPSec) messages, a plurality of subnetworks that form a route to a branch device via a branch gateway; transfer the plurality of subnetworks to a layer-2-layer-3 module; transfer the plurality of subnetworks to an open shortest path first (OSPF) module; and publish the plurality of subnetworks that form the route to the branch device to a core router using OSPF link state advertisements (LSAs).