PDF

Contracts with permit and deny rules

Updated: April 15, 2026

Want to summarize with AI?

Log in

Contracts can contain permit and deny rules with different priorities to provide granular traffic control in the Cisco APIC environment.

A contract can use permit and deny rules to explicitly allow or block traffic between endpoints.

  • Supports permit and deny actions.

  • Supports default, highest, medium, and lowest priorities for deny rules.

  • Resolves matching rule conflicts according to rule priority and contract scope.

Rule priority and conflict resolution

The system uses the following priority hierarchy to resolve rule conflicts:

  • The implicit deny rule has the lowest priority.

  • Contract rules between vzAny objects have a higher priority than the implicit deny rule.

  • Contract rules between specific EPG pairs have a higher priority than rules between vzAny objects.

  • For a contract between a specific EPG pair, a deny rule with the default priority has the same priority as a permit rule for that EPG pair. If traffic matches both rules, the deny rule takes precedence.

  • For a contract between vzAny objects, a deny rule with the default priority has the same priority as a permit rule for that pair. If traffic matches both rules, the deny rule takes precedence.

  • Deny rules with the highest priority are evaluated at the same priority level as EPG-to-EPG contract rules.

  • Deny rules with medium priority are evaluated at the same priority level as vzAny-to-EPG contract rules.

  • Deny rules with the lowest priority are evaluated at the same priority level as vzAny-to-vzAny contract rules.

  • If you lower the priority of a deny rule in a contract between EPGs, a matching permit rule with a higher priority takes precedence.