Step 1

On the menu bar, choose Tenants > Add Tenant.

Step 2

In the Create Tenant dialog box, perform the following tasks:

1. In the Name field, enter a name.

2. In the Security Domains section, click the + to open the Create Security Domain dialog box.

3. In the Name field, enter a name for the security domain, then click Submit.

4. In the Create Tenant dialog box, click Update for the security domain that you created.

5. Fill in the other fields as necessary.

6. Click Submit.

   The tenant_name > Networking screen displays.

Step 3

In the Work pane, drag the VRF icon to the canvas to open the Create VRF dialog box, and perform the following tasks:

1. In the Name field, enter a name.

2. Fill in the other fields as necessary.

3. Click Submit to complete the VRF instance configuration.

Step 4

In the Work pane, drag the Brdige Domain icon to the canvas within the circle around the VRF instance to connect the two. In the Create Bridge Domain dialog box that displays, perform the following tasks:

1. In the Name field, enter a name.

2. Fill in the other fields as necessary.

3. Click Next.

4. In the Subnets section, click the + to open the Create Subnet dialog box.

5. In the Gateway IP field, enter the IP address and subnet mask.

6. Fill in the other fields as necessary.

7. Click OK.

8. Back in the Create Bridge Domain dialog box, fill in the other fields as necessary.

9. Click Next.

10. Fill in the fields as necessary.

11. Click OK to complete bridge domain configuration.

Step 5

In the Work pane, drag the L3 icon to the canvas within the circle around the VRF instance to connect the two. In the Create Routed Outside dialog box that displays, perform the following tasks:

1. In the Name field, enter a name.

2. In the Nodes field, click the + button.

3. In the Create Node Profile dialog box, fill in the other fields as necessary.

4. Click OK.

5. Put a check in the BGP, OSPF, or EIGRP check boxes if desired.

6. Fill in the other fields and Create static route as necessary.

7. Click Next.

8. Fill in the fields as necessary.

9. Click OK to complete the Layer 3 configuration.

Step 1

On the menu bar, choose Tenants. In the Navigation pane, expand the tenant, right-click Application Profiles, and choose Create Application Profile.

Step 2

In the Name field, enter a name for the application profile, such as OnlineStore.

Step 3

Click Submit.

Step 1

On the menu bar, choose Tenants, and then choose the tenant in which you want to create an endpoint group (EPG).

Step 2

In the Navigation pane, expand tenant_name > Application Profiles > application_profile_name .

Step 3

Right-click Application EPGs, choose Create Application EPG, and configure the EPG.

1. In the Create Application EPG dialog, enter an EPG name, such as db, in the Name field.

2. From the Bridge Domain drop-down list, choose a bridge domain, such as bd1.

3. Check the Associate to VM Domain Profiles check box, and then click Next.

4. In the STEP 2 > Domains area, expand Associate VM Domain Profiles, and then choose the virtual machine manager (VMM) domain from the drop-down list.

5. From the Deployment Immediacy drop-down list, retain the default value or choose when the Cisco APIC deploys policies to the physical leaf switch.

6. From the Resolution Immediacy drop-down list, choose when the physical leaf switch deploys policies to the virtual leaf switch.

   For Cisco AVS, choose Immediate or On Demand. For Cisco ACI Virtual Edge or VMware VDS, choose Immediate, On Demand, or Pre-provision.

7. (Optional) In the Delimiter field, enter |, ~, !, @, ^, +, or =.

   If you do not specify a delimiter, the system uses | in the VMware port group name.

8. If you use Cisco ACI Virtual Edge or Cisco AVS, choose an encapsulation mode from the Encap Mode drop-down list.

   The following encapsulation modes are available:

   • VXLAN: Overrides the VLAN configuration of the domain and configures the EPG to use VXLAN encapsulation. The system raises a fault for the EPG if the domain does not have a multicast pool.

   • VLAN: Overrides the VXLAN configuration of the domain and configures the EPG to use VLAN encapsulation. The system raises a fault for the EPG if the domain does not have a VLAN pool.

   • Auto: Configures the EPG to use the encapsulation mode of the VMM domain. This option is the default.

9. If you use Cisco ACI Virtual Edge, choose native or AVE from the Switching Mode drop-down list.

   If you choose native, the VMware VDS switches the EPG. If you choose AVE, the Cisco ACI Virtual Edge switches the EPG. The default is native.

10. Click Update, and then click Finish.

Step 4

Repeat the preceding step to create the app and web EPGs. Configure the db, app, and web EPGs in the same bridge domain and data center.

Step 1

On the menu bar, choose Tenants.

Step 2

In the Navigation pane, expand tenant-name > Contracts, right-click Filters, and choose Create Filter.

Step 3

In the Create Filter dialog, create the HTTP filter and its first entry.

1. In the Name field, enter http.

2. In the Entries table, click +. In the Name field, enter Dport-80.

3. From the EtherType drop-down list, choose IP.

4. From the IP Protocol drop-down list, choose tcp.

5. Under Destination Port/Range, choose http in the From and To fields.

6. Click Update, and then click Submit.

   The new filter appears in the Navigation and Work panes.

Step 4

Add an HTTPS entry to the HTTP filter.

1. Select the http filter, and then click + in the Entries table.

2. In the Name field, enter Dport-443.

3. From the EtherType drop-down list, choose IP.

4. From the IP Protocol drop-down list, choose tcp.

5. Under Destination Port/Range, choose https in the From and To fields.

6. Click Update, and then click Submit.

Step 5

Use the same process to create the rmi and sql filters. Use the parameters in Parameters for RMI and SQL filters.

Step 1

On the menu bar, choose Tenants, and then choose the tenant in which you want to create the contract. In the Navigation pane, expand tenant-name > Contracts.

Step 2

Right-click Standard, and then choose Create Contract.

Step 3

Create the contract and associate a filter with its subject.

1. In the Name field, enter a contract name, such as web.

2. Next to Subjects, click +.

   The Create Contract Subject dialog appears.

3. In the Name field, enter a subject name, such as web.

4. In the Filter Chain area, click + next to Filters.

   This action associates a previously created filter with the contract subject.

5. From the drop-down list, choose the filter, such as http, and then click Update.

Step 4

In the Create Contract Subject dialog, click OK.

Step 5

In the Create Contract dialog, click Submit.

Step 6

Repeat this procedure to create the rmi and sql contracts. Associate the rmi filter with the rmi contract subject and the sql filter with the sql contract subject.

Step 1

In the APIC GUI, drag from the db EPG icon to the app EPG icon.

Step 2

From the Name drop-down list, choose the sql contract, and then click OK.

Step 3

Drag from the app EPG icon to the web EPG icon.

Step 4

From the Name drop-down list, choose the rmi contract, and then click OK.

Step 5

Click the web EPG icon, and then click + in the Provided Contracts area.

Step 6

From the Name drop-down list, choose the web contract, and then click OK.

Step 7

Click Submit.

Step 8

In the Navigation pane, expand Application Profiles, and then click OnlineStore.

Step 9

In the Work pane, choose Operational > Contracts.

Step 1

On the menu bar, choose Tenants, and then choose the tenant in which you want to create the contract. In the Navigation pane, expand tenant-name > Contracts.

Step 2

Right-click Standard, and then choose Create Contract.

Step 3

Create the contract and configure policy compression on its subject.

1. In the Name field, enter a name for the contract.

2. Next to Subjects, click +.

   The Create Contract Subject dialog appears.

3. In the Name field, enter a name for the contract subject.

4. Ensure that Apply Both Directions and Reverse Filter Ports are enabled.

5. Next to Filters, click +.

6. Choose a default filter or a previously configured filter from the drop-down list, or choose Create Filter.

   This action associates the filter with the contract subject.

7. In the Directives field, choose Enable Policy Compression.

8. In the Action field, choose Permit.

   Note	Policy compression does not support the Deny action. Optimization occurs only when the action is Permit.

9. (Optional) In the Priority field, choose the priority level.

10. Click Update.

Step 4

In the Create Contract Subject dialog, click OK.

Step 5

In the Create Contract dialog, click Submit.

Step 1

On the menu bar, choose Tenants > All Tenants.

Step 2

Double-click the tenant in which you want to create the contract.

Step 3

In the Navigation pane, expand Contracts, right-click Filters, and choose Create Filter.

Step 4

Enter a name for the filter, add the criteria that identify the traffic to permit or deny, and then click Submit.

Step 5

Right-click Standard, and then choose Create Contract.

Step 6

Enter a name for the contract, configure its scope, and click + to add a subject.

Step 7

(Optional) Repeat the preceding step to add another subject.

Step 8

Click Submit.

Step 9

To configure an exception that applies to every subject in the contract, complete the following substeps:

1. Click the contract, and then click Contract Exception.

2. Configure the subjects and specify whether to permit or deny their matching traffic.

3. Click + to add a contract exception.

4. Enter a name for the exception and choose the exception criterion.

5. In the Consumer Regex and Provider Regex fields, enter regular expressions that identify the EPGs to exclude from every subject in the contract.

Step 10

To configure an exception that applies to one subject in the contract, complete the following substeps:

1. Click the subject, and then click Subject Exception.

2. Click + to add a subject exception.

3. Enter a name for the exception and choose the exception criterion.

4. In the Consumer Regex and Provider Regex fields, enter regular expressions that identify the EPGs to exclude from the selected subject.

Step 1

On the menu bar, choose Tenants > All Tenants.

Step 2

In the Work pane, double-click the tenant name.

Step 3

Complete the steps for the type of EPG to which you want to add the contract.

• For an application EPG:

  1. In the Navigation pane, expand tenant_name > Application Profiles > application_profile_name > Application EPGs > epg_name .

  2. Right-click Contracts, and then choose Add Intra-EPG Contract.

  3. In the Add Intra Ext-EPG Contract dialog, choose an existing contract from the Contract drop-down list or create a contract.

  4. Click Submit.

• For a uSeg EPG:

  1. In the Navigation pane, expand tenant_name > Application Profiles > application_profile_name > uSeg EPGs > epg_name .

  2. Right-click Contracts, and then choose Add Intra-EPG Contract.

  3. In the Add Intra Ext-EPG Contract dialog, choose an existing contract from the Contract drop-down list or create a contract.

  4. Click Submit.

• For an L3Out EPG:

  1. In the Navigation pane, choose tenant_name > Networking > L3Outs > l3out_name > External EPGs > external_epg_name .

  2. In the Work pane, set Intra Ext-EPG Isolation to Enforced.

  3. Click Submit.

  4. In the Work pane, choose Policy > Contracts.

  5. From the Actions menu, choose Add Intra Ext-EPG Contract.

  6. In the Add Intra Ext-EPG Contract dialog, choose an existing contract from the Contract drop-down list or create a contract.

  7. Click Submit.

Step 1

Enter global configuration mode.

apic1# configure

Step 2

Create or select the tenant.

apic1(config)# tenant Tenant-l3out

Step 3

Create or select the external Layer 3 EPG.

apic1(config-tenant)# external-l3 epg ext-epg

Step 4

Associate the external Layer 3 EPG with the VRF.

apic1(config-tenant-l3ext-epg)# vrf member vrf1

Step 5

Enable intra-EPG isolation.

apic1(config-tenant-l3ext-epg)# isolation enforce

Step 6

Associate the intra-EPG contract with the external Layer 3 EPG.

apic1(config-tenant-l3ext-epg)# contract intra-epg contr-intra

Step 1

Configure the fabric access policies required by the example by sending an XML POST request with a payload similar to the following example:

<?xml version="1.0" encoding="UTF-8"?>
            <polUni>
            <infraInfra>
            <infraAccPortP name="Ports-1-12" status="deleted"/>
            <!-- VMM VLAN range -->
            <fvnsVlanInstP name="test" allocMode="dynamic">
            <fvnsEncapBlk name="encap" from="vlan-10" to="vlan-100"/>
            </fvnsVlanInstP>
            <!-- Static VLAN range -->
            <fvnsVlanInstP name="test" allocMode="static">
            <fvnsEncapBlk name="default" from="vlan-101" to="vlan-4095"/>
            </fvnsVlanInstP>
            <infraAttEntityP name="test">
            <infraRsDomP tDn="uni/phys-test"/>
            <infraRsDomP tDn="uni/l3dom-test"/>
            <infraRsDomP tDn="uni/vmmp-VMware/dom-test"/>
            </infraAttEntityP>
            <!-- Node profile -->
            <infraNodeP name="test">
            <infraLeafS name="test" type="range">
            <infraNodeBlk name="default" from_="101" to_="102"/>
            </infraLeafS>
            <infraRsAccPortP tDn="uni/infra/accportprof-test"/>
            </infraNodeP>
            <!-- Port profile -->
            <infraAccPortP name="test">
            <!-- 12 regular ports -->
            <infraHPortS name="ports1Through12" type="range">
            <infraPortBlk name="default" fromCard="1" toCard="1" fromPort="1" toPort="12"/>
            <infraRsAccBaseGrp tDn="uni/infra/funcprof/accportgrp-test"/>
            </infraHPortS>
            <!-- Two ports in a port channel -->
            <infraHPortS name="portsForPc1" type="range">
            <infraPortBlk name="default" fromCard="1" toCard="1" fromPort="13" toPort="14"/>
            <infraRsAccBaseGrp tDn="uni/infra/funcprof/accbundle-testPc"/>
            </infraHPortS>
            <!-- Two ports in a port channel -->
            <infraHPortS name="portsForPc2" type="range">
            <infraPortBlk name="blk1" fromCard="1" toCard="1" fromPort="15" toPort="16"/>
            <infraRsAccBaseGrp tDn="uni/infra/funcprof/accbundle-pc"/>
            </infraHPortS>
            <!-- Two ports in a port channel for a FEX -->
            <infraHPortS name="portsForFex" type="range">
            <infraPortBlk name="blk1" fromCard="1" toCard="1" fromPort="17" toPort="18"/>
            <infraRsAccBaseGrp tDn="uni/infra/fexprof-default/fexbundle-test" fexId="111"/>
            </infraHPortS>
            <!-- Two ports in a vPC -->
            <infraHPortS name="portsForVpc" type="range">
            <infraPortBlk name="blk1" fromCard="1" toCard="1" fromPort="19" toPort="20"/>
            <infraRsAccBaseGrp tDn="uni/infra/funcprof/accbundle-testVpc"/>
            </infraHPortS>
            </infraAccPortP>
            <!-- FEX profile -->
            <infraFexP name="default">
            <infraFexBndlGrp name="default"/>
            <!-- 12 FEX ports -->
            <infraHPortS name="ports1Through12" type="range">
            <infraPortBlk name="default" fromCard="1" toCard="1" fromPort="1" toPort="12"/>
            <infraRsAccBaseGrp tDn="uni/infra/funcprof/accportgrp-test"/>
            </infraHPortS>
            <!-- Three ports in a FEX port channel -->
            <infraHPortS name="portsForPc" type="range">
            <infraPortBlk name="blk1" fromCard="1" toCard="1" fromPort="13" toPort="16"/>
            <infraRsAccBaseGrp tDn="uni/infra/funcprof/accbundle-testPcOnFex"/>
            </infraHPortS>
            <!-- Three ports in a FEX vPC -->
            <infraHPortS name="portsForVpc" type="range">
            <infraPortBlk name="blk1" fromCard="1" toCard="1" fromPort="17" toPort="19"/>
            <infraRsAccBaseGrp tDn="uni/infra/funcprof/accbundle-testVpcOnFex"/>
            </infraHPortS>
            </infraFexP>
            <!-- Functional profile -->
            <infraFuncP>
            <!-- Regular port group -->
            <infraAccPortGrp name="test">
            <infraRsAttEntP tDn="uni/infra/attentp-test"/>
            </infraAccPortGrp>
            <!-- Port channel -->
            <infraAccBndlGrp name="testPc" lagT="link">
            <infraRsLacpPol tnLacpLagPolName="testPc"/>
            <infraRsAttEntP tDn="uni/infra/attentp-test"/>
            </infraAccBndlGrp>
            <!-- vPC -->
            <infraAccBndlGrp name="testVpc" lagT="node">
            <infraRsLacpPol tnLacpLagPolName="testVpc"/>
            <infraRsAttEntP tDn="uni/infra/attentp-test"/>
            </infraAccBndlGrp>
            <!-- Port channel on a FEX -->
            <infraAccBndlGrp name="testPcOnFex" lagT="link">
            <infraRsLacpPol tnLacpLagPolName="testPcOnFex"/>
            <infraRsAttEntP tDn="uni/infra/attentp-test"/>
            </infraAccBndlGrp>
            <!-- vPC on a FEX -->
            <infraAccBndlGrp name="testVpcOnFex" lagT="node">
            <infraRsLacpPol tnLacpLagPolName="testVpcOnFex"/>
            <infraRsAttEntP tDn="uni/infra/attentp-test"/>
            </infraAccBndlGrp>
            </infraFuncP>
            <!-- Link aggregation policies -->
            <lacpLagPol name="testPc" minLinks="1" maxLinks="10"/>
            <lacpLagPol name="testVpc" minLinks="1" maxLinks="10"/>
            <lacpLagPol name="testPcOnFex" minLinks="2" maxLinks="5"/>
            <lacpLagPol name="testVpcOnFex" minLinks="2" maxLinks="10"/>
            </infraInfra>
            <fabricInst>
            <fabricProtPol name="testVpc">
            <fabricExplicitGEp name="testVpc" id="101">
            <fabricNodePEp id="101"/>
            <fabricNodePEp id="102"/>
            </fabricExplicitGEp>
            </fabricProtPol>
            </fabricInst>
            <physDomP name="test">
            <infraRsVlanNs tDn="uni/infra/vlanns-test-static"/>
            </physDomP>
            <l3extDomP name="test">
            <infraRsVlanNs tDn="uni/infra/vlanns-test-static"/>
            </l3extDomP>
            </polUni>

Step 2

Configure the tenant and intra-EPG contract associations by sending an XML POST request with a payload similar to the following example:

<?xml version="1.0" encoding="UTF-8"?>
            <polUni>
            <fvTenant name="Tenant-l3out">
            <vzBrCP intent="install" name="contr-intra" scope="context">
            <vzSubj consMatchT="AtleastOne" name="subj" revFltPorts="yes">
            <vzRsSubjFiltAtt action="permit" priorityOverride="default"
            tnVzFilterName="flt-ssh"/>
            </vzSubj>
            </vzBrCP>
            <vzBrCP intent="install" name="contr2" scope="context">
            <vzSubj consMatchT="AtleastOne" name="contr2-subj" revFltPorts="yes">
            <vzRsSubjFiltAtt action="permit" priorityOverride="default"
            tnVzFilterName="flt-ftp"/>
            </vzSubj>
            </vzBrCP>
            <vzBrCP intent="install" name="contr1" scope="context">
            <vzSubj consMatchT="AtleastOne" name="subj-http" revFltPorts="yes">
            <vzRsSubjFiltAtt action="deny" priorityOverride="default"
            tnVzFilterName="flt-http"/>
            </vzSubj>
            </vzBrCP>
            <l3extOut enforceRtctrl="export" mplsEnabled="no" name="l3out1">
            <l3extRsL3DomAtt tDn="uni/l3dom-test"/>
            <l3extRsEctx tnFvCtxName="vrf1"/>
            <l3extLNodeP name="l3out1_nodeProfile" tag="yellow-green">
            <l3extRsNodeL3OutAtt rtrId="172.16.0.1" rtrIdLoopBack="yes"
            tDn="topology/pod-1/node-101"/>
            <l3extLIfP name="l3out1_interfaceProfile" tag="yellow-green">
            <l3extRsPathL3OutAtt addr="192.168.15.1/24" autostate="disabled"
            encap="unknown" encapScope="local" ifInstT="l3-port" ipv6Dad="enabled"
            isMultiPodDirect="no" llAddr="::" mac="00:22:BD:F8:19:FF"
            mode="regular" mtu="inherit"
            tDn="topology/pod-1/paths-101/pathep-[eth1/10]"/>
            </l3extLIfP>
            </l3extLNodeP>
            <!--
            Set pcEnfPref to "enforced" to enable intra-Ext-EPG isolation.
            Set pcEnfPref to "unenforced" to disable intra-Ext-EPG isolation.
            -->
            <l3extInstP floodOnEncap="disabled" matchT="AtleastOne"
            name="l3epg1" pcEnfPref="unenforced" prefGrMemb="exclude">
            <l3extSubnet ip="172.16.0.0/16" scope="import-security"/>
            <fvRsCons tnVzBrCPName="contr2"/>
            <fvRsIntraEpg tnVzBrCPName="contr-intra"/>
            </l3extInstP>
            </l3extOut>
            <fvCtx bdEnforcedEnable="no" ipDataPlaneLearning="enabled" knwMcastAct="permit"
            name="vrf1" pcEnfDir="egress" pcEnfPref="unenforced" vrfIndex="0">
            <fvRsVrfValidationPol/>
            <vzAny matchT="AtleastOne" prefGrMemb="disabled"/>
            </fvCtx>
            <fvBD OptimizeWanBandwidth="no" arpFlood="yes" epClear="no" hostBasedRouting="no"
            intersiteBumTrafficAllow="no" intersiteL2Stretch="no" ipLearning="yes"
            ipv6McastAllow="no" limitIpLearnToSubnets="yes" llAddr="::"
            mac="00:22:BD:F8:19:FF" mcastAllow="no" multiDstPktAct="bd-flood" name="bd-web"
            type="regular" unicastRoute="yes" unkMacUcastAct="proxy" unkMcastAct="flood"
            v6unkMcastAct="flood" vmac="not-applicable">
            <fvSubnet ip="192.168.1.254/24" ipDPLearning="enabled" preferred="no"
            scope="private" virtual="no"/>
            <fvRsCtx tnFvCtxName="vrf1"/>
            <fvRsBdToEpRet resolveAct="resolve"/>
            </fvBD>
            <fvBD OptimizeWanBandwidth="no" arpFlood="yes" epClear="no" hostBasedRouting="no"
            intersiteBumTrafficAllow="no" intersiteL2Stretch="no" ipLearning="yes"
            ipv6McastAllow="no" limitIpLearnToSubnets="yes" llAddr="::"
            mac="00:22:BD:F8:19:FF" mcastAllow="no" multiDstPktAct="bd-flood" name="bd-app"
            type="regular" unicastRoute="yes" unkMacUcastAct="proxy" unkMcastAct="flood"
            v6unkMcastAct="flood" vmac="not-applicable">
            <fvSubnet ip="192.168.2.254/24" ipDPLearning="enabled" preferred="no"
            scope="private" virtual="no"/>
            <fvRsCtx tnFvCtxName="vrf1"/>
            <fvRsBdToEpRet resolveAct="resolve"/>
            </fvBD>
            <vzFilter name="flt-ftp">
            <vzEntry applyToFrag="no" arpOpc="unspecified" dFromPort="ftpData"
            dToPort="ftpData" etherT="ipv4" icmpv4T="unspecified" icmpv6T="unspecified"
            matchDscp="unspecified" name="ftp" prot="tcp" sFromPort="unspecified"
            sToPort="unspecified" stateful="no"/>
            </vzFilter>
            <vzFilter name="flt-ssh">
            <vzEntry applyToFrag="no" arpOpc="unspecified" dFromPort="ssh" dToPort="ssh"
            etherT="ipv4" icmpv4T="unspecified" icmpv6T="unspecified"
            matchDscp="unspecified" name="ssh" prot="tcp" sFromPort="unspecified"
            sToPort="unspecified" stateful="no"/>
            </vzFilter>
            <vzFilter name="flt-http">
            <vzEntry applyToFrag="no" arpOpc="unspecified" dFromPort="http" dToPort="http"
            etherT="ipv4" icmpv4T="unspecified" icmpv6T="unspecified"
            matchDscp="unspecified" name="flt1" prot="tcp" sFromPort="unspecified"
            sToPort="unspecified" stateful="no"/>
            </vzFilter>
            <fvAp name="ap-app1">
            <fvAEPg floodOnEncap="disabled" hasMcastSource="no" isAttrBasedEPg="no"
            matchT="AtleastOne" name="epg-app" pcEnfPref="unenforced"
            prefGrMemb="exclude" shutdown="no">
            <fvRsProv intent="install" matchT="AtleastOne" tnVzBrCPName="contr2"/>
            <fvRsProv intent="install" matchT="AtleastOne" tnVzBrCPName="contr1"/>
            <fvRsPathAtt encap="vlan-103" instrImedcy="immediate" mode="native"
            primaryEncap="unknown" tDn="topology/pod-1/paths-101/pathep-[eth1/3]"/>
            <fvRsDomAtt bindingType="none" classPref="encap" encap="unknown"
            encapMode="auto" epgCos="Cos0" epgCosPref="disabled" instrImedcy="lazy"
            netflowDir="both" netflowPref="disabled" numPorts="0" portAllocation="none"
            primaryEncap="unknown" primaryEncapInner="unknown" resImedcy="immediate"
            secondaryEncapInner="unknown" switchingMode="native" tDn="uni/phys-test"
            untagged="no" vnetOnly="no"/>
            <fvRsBd tnFvBDName="bd-app"/>
            </fvAEPg>
            <fvAEPg floodOnEncap="disabled" hasMcastSource="no"
            isAttrBasedEPg="no" matchT="AtleastOne" name="epg-web" pcEnfPref="unenforced"
            prefGrMemb="exclude" shutdown="no">
            <fvRsPathAtt encap="vlan-104" instrImedcy="immediate" mode="native"
            primaryEncap="unknown" tDn="topology/pod-1/paths-101/pathep-[eth1/4]"/>
            <fvRsDomAtt bindingType="none" classPref="encap" encap="unknown"
            encapMode="auto" epgCos="Cos0" epgCosPref="disabled" instrImedcy="lazy"
            netflowDir="both" netflowPref="disabled" numPorts="0" portAllocation="none"
            primaryEncap="unknown" primaryEncapInner="unknown" resImedcy="immediate"
            secondaryEncapInner="unknown" switchingMode="native" tDn="uni/phys-test"
            untagged="no" vnetOnly="no"/>
            <fvRsCons intent="install" tnVzBrCPName="contr1"/>
            <fvRsBd tnFvBDName="bd-web"/>
            </fvAEPg>
            </fvAp>
            </fvTenant>
            </polUni>

Step 1

In the Navigation pane, choose Tenants > tenant-name > Application Profiles > application-profile-name .

Step 2

Right-click Application EPGs, and then choose Create Application EPG.

Step 3

In the Name field, enter a name for the EPG that will inherit the contracts.

Step 4

From the Bridge Domain drop-down list, choose the common or default bridge domain, choose an existing bridge domain, or create a bridge domain for the EPG.

Step 5

For EPG Contract Master, click +, choose the application profile and EPG that will serve as the contract master, and then click Update.

Step 6

Click Finish.

Step 7

(Optional) To verify the contract master, choose Tenants > tenant-name > Application Profiles > application-profile-name > Application EPGs > epg-name > General, and then verify the EPG Contract Master value.

Step 8

(Optional) To view the inherited contracts, expand epg-name , and then click Contracts.

Step 1

In the Navigation pane, choose Tenants > tenant-name > Application Profiles > application-profile-name .

Step 2

Right-click uSeg EPGs, and then choose Create uSeg EPG.

Step 3

In the Name field, enter a name for the uSeg EPG that will inherit the contracts.

Step 4

From the Bridge Domain drop-down list, choose the common or default bridge domain, choose an existing bridge domain, or create a bridge domain for the uSeg EPG.

Step 5

For EPG Contract Master, click +, choose the application profile and uSeg EPG that will serve as the contract master, and then click Update.

Step 6

Click Finish.

Step 7

(Optional) To view the inherited contracts, choose Tenants > tenant-name > Application Profiles > application-profile-name > uSeg EPGs > useg-epg-name > Contracts.

Step 1

In the Navigation pane, choose Tenants > tenant-name > Networking > L2Outs.

Step 2

Expand l2out-name .

Step 3

Right-click External EPGs, and then choose Create External EPG.

Step 4

Enter a name for the external EPG and configure the other attributes as required.

Step 5

Click Submit.

Step 6

Expand External EPGs.

Step 7

Click external-epg-name .

Step 8

In the External EPG pane, click + for L2Out Contract Masters.

Step 9

Select the L2Out and external L2Out EPG that will serve as the contract master.

Step 10

Click Update.

Step 11

(Optional) To view the inherited contracts, click the external EPG name, and then choose Contracts > Inherited Contracts.

Step 1

In the Navigation pane, choose Tenants > tenant-name > Networking > L3Outs.

Step 2

Expand l3out-name .

Step 3

Right-click External EPGs, and then choose Create External EPG.

Step 4

Enter a name for the external EPG and configure subnets and other attributes as required.

Step 5

Click Submit.

Step 6

Expand Networks.

Step 7

Click network-name .

Step 8

In the External EPG pane, click + for L3Out Contract Masters.

Step 9

Select the L3Out and external EPG that will serve as the contract master.

Step 10

Click Update.

Step 11

(Optional) To view the inherited contracts, click the external EPG name, and then choose Contracts > Inherited Contracts.

Step 1

On the menu bar, choose Tenants > tenant_name .

Step 2

In the Navigation pane, expand tenant_name > Networking > VRFs.

Step 3

Click the VRF in which you want to enable the contract preferred group.

Step 4

Set Preferred Group to Enabled.

Step 5

Click Submit.

Step 6

In the Navigation pane, expand Application Profiles, and then create or expand an application profile associated with the tenant VRF.

Step 7

Expand Application EPGs, and then click the EPG that you want to include in the contract preferred group.

Step 8

In the Work pane, choose Policy > General.

Step 9

Set Preferred Group Member to Include.

Step 10

Click Submit.

Step 1

On the menu bar, choose Tenants > tenant_name .

Step 2

In the Navigation pane, choose Policies > Protocol > L4-L7 Service EPG Policy.

Step 3

Right-click L4-L7 Service EPG Policy, and then choose Create L4-L7 Service EPG Policy.

Step 4

In the Name field, enter a unique name for the policy.

Step 5

(Optional) In the Description field, enter a description of the policy.

Step 6

In the Preferred Group Member field, choose whether to include or exclude the service EPGs from the contract preferred group.

Step 7

Click Submit.

Step 1

On the menu bar, choose Tenants > tenant_name .

Step 2

In the Navigation pane, expand Contracts , right-click Standard , and choose Create Contract .

Step 3

In the Create Contract dialog box, configure the contract.

1. In the Name field, enter a name for the contract.

2. In the Scope field, choose VRF , Tenant , or Global .

3. (Optional) Configure the target differentiated services code point (DSCP) or quality of service (QoS) class for the contract.

4. Next to Subjects , click + .

Step 4

In the Create Contract Subject dialog box, configure the contract subject.

1. In the Name field, enter a name for the subject.

2. (Optional) In the Description field, enter a description.

3. (Optional) From the Target DSCP drop-down list, choose the DSCP value to apply to the subject.

4. Keep Apply Both Directions selected to apply the contract in both directions. Clear the option to apply the contract only from the consumer to the provider.

5. If Apply Both Directions is selected, keep Reverse Filter Ports selected to exchange the Layer 4 source and destination ports for provider-to-consumer traffic.

6. Next to Filters , click + .

7. From the Name drop-down list, choose a filter, such as arp , default , est , or icmp .

8. From the Directives drop-down list, choose log .

9. For Action , retain the default value of Permit to enable permit logging, or choose Deny to enable deny logging.

   With the log directive enabled, the selected action determines whether the ACL logs record traffic that the subject permits or denies.

10. (Optional) Set the priority for the subject.

11. Click Update .

Step 5

In the Create Contract Subject dialog box, click OK .

Step 6

Click Submit .

Step 1

Enter the following commands to enable permit logging for a contract subject:

configure
                        tenant tenant_name
                        contract contract_name type permit
                        subject subject_name
                        access-group access_list_name direction log
                        end

apic1# configure
                        apic1(config)# tenant BDMode1
                        apic1(config-tenant)# contract Logicmp type permit
                        apic1(config-tenant-contract)# subject icmp
                        apic1(config-tenant-contract-subj)# access-group arp both log
                        apic1(config-tenant-contract-subj)# end

Step 2

(Optional) To disable permit logging later, use the no access-group command in contract-subject configuration mode.

apic1# configure
                        apic1(config)# tenant BDMode1
                        apic1(config-tenant)# contract Logicmp type permit
                        apic1(config-tenant-contract)# subject icmp
                        apic1(config-tenant-contract-subj)# no access-group arp both log
                        apic1(config-tenant-contract-subj)# end

Send a POST request with an XML payload similar to the following example:

<vzBrCP dn="uni/tn-Tenant64/brc-C64" name="C64" scope="context">
                        <vzSubj consMatchT="AtleastOne"
                        name="HTTPSsbj"
                        provMatchT="AtleastOne"
                        revFltPorts="yes"
                        rn="subj-HTTPSsbj">
                        <vzRsSubjFiltAtt action="permit"
                        directives="log"
                        forceResolve="yes"
                        priorityOverride="default"
                        rn="rssubjFiltAtt-PerHTTPS"
                        tDn="uni/tn-Tenant64/flt-PerHTTPS"
                        tRn="flt-PerHTTPS"
                        tnVzFilterName="PerHTTPS"/>
                        </vzSubj>
                        <vzSubj consMatchT="AtleastOne"
                        name="httpSbj"
                        provMatchT="AtleastOne"
                        revFltPorts="yes"
                        rn="subj-httpSbj">
                        <vzRsSubjFiltAtt action="deny"
                        directives="log"
                        forceResolve="yes"
                        priorityOverride="default"
                        rn="rssubjFiltAtt-httpFilter"
                        tDn="uni/tn-Tenant64/flt-httpFilter"
                        tRn="flt-httpFilter"
                        tnVzFilterName="httpFilter"/>
                        </vzSubj>
                        <vzSubj consMatchT="AtleastOne"
                        name="subj64"
                        provMatchT="AtleastOne"
                        revFltPorts="yes"
                        rn="subj-subj64">
                        <vzRsSubjFiltAtt action="permit"
                        directives="log"
                        forceResolve="yes"
                        priorityOverride="default"
                        rn="rssubjFiltAtt-icmp"
                        tDn="uni/tn-common/flt-icmp"
                        tRn="flt-icmp"
                        tnVzFilterName="icmp"/>
                        </vzSubj>
                        </vzBrCP>

Step 1

On the menu bar, choose Tenants > tenant_name .

Step 2

In the Navigation pane, expand Contracts .

Step 3

Right-click Taboos and choose Create Taboo Contract .

Step 4

In the Create Taboo Contract dialog box, configure the taboo contract.

1. In the Name field, enter a name for the taboo contract.

2. (Optional) In the Description field, enter a description.

3. Next to Subjects , click + .

Step 5

In the Create Taboo Contract Subject dialog box, configure the subject and select a filter.

1. In the Specify Identity of Subject area, enter a name for the subject.

2. (Optional) Enter a description of the subject.

3. Next to Filters , click + .

4. From the Name drop-down list, choose an existing filter, choose a default filter, or choose Create Filter .

   The default filters include tenant_name /arp , tenant_name /default , tenant_name /est , and tenant_name /icmp .

Step 6

(Optional) If you chose Create Filter , configure the filter.

1. In the Specify Filter Identity area, enter a name and, optionally, a description.

2. Expand Entries , enter a name for the entry, and configure the criteria that identify the traffic to deny.

3. Click Update .

4. Click OK to create the filter and return to the Create Taboo Contract Subject dialog box.

Step 7

For the selected filter, choose log from the Directives drop-down list, and click Update .

Step 8

In the Create Taboo Contract Subject dialog box, click OK .

Step 9

In the Create Taboo Contract dialog box, click Submit .

Step 1

Enter the following commands to enable deny logging for a taboo contract subject:

configure
                        tenant tenant_name
                        contract contract_name type deny
                        subject subject_name
                        access-group access_list_name both log
                        end

apic1# configure
                        apic1(config)# tenant BDMode1
                        apic1(config-tenant)# contract dropFTP type deny
                        apic1(config-tenant-contract)# subject dropftp
                        apic1(config-tenant-contract-subj)# access-group ftp both log
                        apic1(config-tenant-contract-subj)# end

Step 2

(Optional) To disable deny logging later, use the no access-group command in contract-subject configuration mode.

apic1# configure
                        apic1(config)# tenant BDMode1
                        apic1(config-tenant)# contract dropFTP type deny
                        apic1(config-tenant-contract)# subject dropftp
                        apic1(config-tenant-contract-subj)# no access-group ftp both log
                        apic1(config-tenant-contract-subj)# end

Send a POST request with an XML payload similar to the following example:

<vzTaboo dn="uni/tn-Tenant64/taboo-TCtrctPrefix"
                        name="TCtrctPrefix" scope="context">
                        <vzTSubj name="PrefSubj" rn="tsubj-PrefSubj">
                        <vzRsDenyRule directives="log"
                        forceResolve="yes"
                        rn="rsdenyRule-default"
                        tCl="vzFilter"
                        tDn="uni/tn-common/flt-default"
                        tRn="flt-default"/>
                        </vzTSubj>
                        </vzTaboo>

Step 1

On the menu bar, choose Tenants > tenant_name .

Step 2

In the Navigation pane, click the tenant_name root node.

Step 3

In the Work pane, click the Operational tab.

Step 4

Click the Flows tab.

Step 5

To view the required log data, click L2 Permit , L3 Permit , L2 Drop , or L3 Drop .

Step 6

(Optional) Click the Packets tab to view ACL logs for groups of packets that have the same signature, source, and destination.

Send a GET request for the required ACL log MO class.

GET https://apic_ip_address/api/class/acllogDropL3Flow

Step 1

Display detailed Layer 3 deny flow logs for the common tenant and default VRF.

apic1# show acllog deny l3 flow tenant common vrf default detail

Step 2

Display detailed Layer 2 deny flow logs for the common tenant and tsw0connctx0 VRF.

apic1# show acllog deny l2 flow tenant common vrf tsw0connctx0 detail

Step 3

Display detailed Layer 3 permit packet logs for the common tenant and default VRF.

apic1# show acllog permit l3 pkt tenant common vrf default detail

Step 4

Display Layer 2 permit packet logs for the common tenant, default VRF, and port-channel5 source interface.

apic1# show acllog permit l2 pkt tenant common vrf default srcintf port-channel5