PDF

Contract preferred groups

Updated: April 15, 2026

Want to summarize with AI?

Log in

A contract preferred group controls communication among endpoint groups in a VRF through included and excluded membership types.

A contract preferred group is a policy enforcement mechanism that controls communication among endpoint groups (EPGs) in a VRF according to their membership status.

  • Included EPGs can communicate with each other without contracts because of a default permit rule.

  • Excluded EPGs require contracts to communicate because of a default deny rule.

Contract preferred group operation

A contract preferred group provides granular control over communication among EPGs in a VRF. If most EPGs require unrestricted communication but some require limited communication, include the unrestricted EPGs in the preferred group and use contracts with filters to control communication with the excluded EPGs.

An EPG that is excluded from the preferred group can communicate with another EPG only when a contract overrides the default source-any, destination-any deny rule.

Figure 1. Contract preferred group

Service graph support

Beginning with Cisco APIC release 4.0(1), EPGs that service graphs create can be included in contract preferred groups. The Service EPG Policy defines whether the EPG is included in or excluded from the preferred group. You can apply the policy through a device selection policy or a service graph template.

Shadow EPGs can also be configured as included or excluded members of contract preferred groups.

Limitations

The following limitations apply to contract preferred groups:

  • If an L3Out EPG and an application EPG are included in a contract preferred group, and the application EPG is deployed only on a virtual port channel (vPC), only one leaf switch in the vPC might contain the L3Out prefix entry. The other leaf switch does not contain the entry and drops the traffic.

  • If the provider or consumer EPG in a service graph contract is included in a contract preferred group, the shadow EPG cannot be excluded from the group.

    The shadow EPG is permitted in the contract preferred group but does not trigger deployment of the preferred group policy on its node. To deploy the policy on that node, deploy a dummy EPG that belongs to the contract preferred group.

  • Because of CSCvm63145, an EPG in a contract preferred group can consume a shared-service contract but cannot provide a shared-service contract when an L3Out EPG is the consumer.

To work around the L3Out vPC issue, perform one of the following actions:

  • Disable and reenable the contract preferred group in the VRF.

  • Delete and recreate the prefix entries for the L3Out EPG.