PDF

Add an intra-EPG contract to an L3Out EPG by using the NX-OS-style CLI

Updated: April 15, 2026

Want to summarize with AI?

Log in

Configure an intra-EPG contract on an external Layer 3 EPG to control traffic between endpoints in that EPG.

After you configure a contract, you can associate it with an external Layer 3 EPG as an intra-EPG contract. Enable intra-EPG isolation to block traffic that the contract does not permit.

Before you begin

  • Configure an L3Out EPG.

  • Configure a contract with the required filters.

Procedure

  1. Enter global configuration mode.

    Example:

    apic1# configure

  2. Create or select the tenant.

    Example:

    apic1(config)# tenant Tenant-l3out

  3. Create or select the external Layer 3 EPG.

    Example:

    apic1(config-tenant)# external-l3 epg ext-epg

  4. Associate the external Layer 3 EPG with the VRF.

    Example:

    apic1(config-tenant-l3ext-epg)# vrf member vrf1

  5. Enable intra-EPG isolation.

    Example:

    apic1(config-tenant-l3ext-epg)# isolation enforce

    To disable intra-EPG isolation later, enter no isolation enforce.

  6. Associate the intra-EPG contract with the external Layer 3 EPG.

    Example:

    apic1(config-tenant-l3ext-epg)# contract intra-epg contr-intra

    The contract permits matching traffic between endpoints in the external Layer 3 EPG. Intra-EPG isolation blocks other traffic.