PDF

Configure an intra-EPG contract by using the REST API

Updated: April 15, 2026

Want to summarize with AI?

Log in

Use XML POST requests to configure the fabric access policies, tenant objects, and contract associations required for intra-EPG enforcement.

Before you begin

  • Configure an endpoint group (EPG).

  • Configure a contract with the required filters.

Procedure

  1. Configure the fabric access policies required by the example by sending an XML POST request with a payload similar to the following example:

    Example:

    <?xml version="1.0" encoding="UTF-8"?>
            <polUni>
            <infraInfra>
            <infraAccPortP name="Ports-1-12" status="deleted"/>
            <!-- VMM VLAN range -->
            <fvnsVlanInstP name="test" allocMode="dynamic">
            <fvnsEncapBlk name="encap" from="vlan-10" to="vlan-100"/>
            </fvnsVlanInstP>
            <!-- Static VLAN range -->
            <fvnsVlanInstP name="test" allocMode="static">
            <fvnsEncapBlk name="default" from="vlan-101" to="vlan-4095"/>
            </fvnsVlanInstP>
            <infraAttEntityP name="test">
            <infraRsDomP tDn="uni/phys-test"/>
            <infraRsDomP tDn="uni/l3dom-test"/>
            <infraRsDomP tDn="uni/vmmp-VMware/dom-test"/>
            </infraAttEntityP>
            <!-- Node profile -->
            <infraNodeP name="test">
            <infraLeafS name="test" type="range">
            <infraNodeBlk name="default" from_="101" to_="102"/>
            </infraLeafS>
            <infraRsAccPortP tDn="uni/infra/accportprof-test"/>
            </infraNodeP>
            <!-- Port profile -->
            <infraAccPortP name="test">
            <!-- 12 regular ports -->
            <infraHPortS name="ports1Through12" type="range">
            <infraPortBlk name="default" fromCard="1" toCard="1" fromPort="1" toPort="12"/>
            <infraRsAccBaseGrp tDn="uni/infra/funcprof/accportgrp-test"/>
            </infraHPortS>
            <!-- Two ports in a port channel -->
            <infraHPortS name="portsForPc1" type="range">
            <infraPortBlk name="default" fromCard="1" toCard="1" fromPort="13" toPort="14"/>
            <infraRsAccBaseGrp tDn="uni/infra/funcprof/accbundle-testPc"/>
            </infraHPortS>
            <!-- Two ports in a port channel -->
            <infraHPortS name="portsForPc2" type="range">
            <infraPortBlk name="blk1" fromCard="1" toCard="1" fromPort="15" toPort="16"/>
            <infraRsAccBaseGrp tDn="uni/infra/funcprof/accbundle-pc"/>
            </infraHPortS>
            <!-- Two ports in a port channel for a FEX -->
            <infraHPortS name="portsForFex" type="range">
            <infraPortBlk name="blk1" fromCard="1" toCard="1" fromPort="17" toPort="18"/>
            <infraRsAccBaseGrp tDn="uni/infra/fexprof-default/fexbundle-test" fexId="111"/>
            </infraHPortS>
            <!-- Two ports in a vPC -->
            <infraHPortS name="portsForVpc" type="range">
            <infraPortBlk name="blk1" fromCard="1" toCard="1" fromPort="19" toPort="20"/>
            <infraRsAccBaseGrp tDn="uni/infra/funcprof/accbundle-testVpc"/>
            </infraHPortS>
            </infraAccPortP>
            <!-- FEX profile -->
            <infraFexP name="default">
            <infraFexBndlGrp name="default"/>
            <!-- 12 FEX ports -->
            <infraHPortS name="ports1Through12" type="range">
            <infraPortBlk name="default" fromCard="1" toCard="1" fromPort="1" toPort="12"/>
            <infraRsAccBaseGrp tDn="uni/infra/funcprof/accportgrp-test"/>
            </infraHPortS>
            <!-- Three ports in a FEX port channel -->
            <infraHPortS name="portsForPc" type="range">
            <infraPortBlk name="blk1" fromCard="1" toCard="1" fromPort="13" toPort="16"/>
            <infraRsAccBaseGrp tDn="uni/infra/funcprof/accbundle-testPcOnFex"/>
            </infraHPortS>
            <!-- Three ports in a FEX vPC -->
            <infraHPortS name="portsForVpc" type="range">
            <infraPortBlk name="blk1" fromCard="1" toCard="1" fromPort="17" toPort="19"/>
            <infraRsAccBaseGrp tDn="uni/infra/funcprof/accbundle-testVpcOnFex"/>
            </infraHPortS>
            </infraFexP>
            <!-- Functional profile -->
            <infraFuncP>
            <!-- Regular port group -->
            <infraAccPortGrp name="test">
            <infraRsAttEntP tDn="uni/infra/attentp-test"/>
            </infraAccPortGrp>
            <!-- Port channel -->
            <infraAccBndlGrp name="testPc" lagT="link">
            <infraRsLacpPol tnLacpLagPolName="testPc"/>
            <infraRsAttEntP tDn="uni/infra/attentp-test"/>
            </infraAccBndlGrp>
            <!-- vPC -->
            <infraAccBndlGrp name="testVpc" lagT="node">
            <infraRsLacpPol tnLacpLagPolName="testVpc"/>
            <infraRsAttEntP tDn="uni/infra/attentp-test"/>
            </infraAccBndlGrp>
            <!-- Port channel on a FEX -->
            <infraAccBndlGrp name="testPcOnFex" lagT="link">
            <infraRsLacpPol tnLacpLagPolName="testPcOnFex"/>
            <infraRsAttEntP tDn="uni/infra/attentp-test"/>
            </infraAccBndlGrp>
            <!-- vPC on a FEX -->
            <infraAccBndlGrp name="testVpcOnFex" lagT="node">
            <infraRsLacpPol tnLacpLagPolName="testVpcOnFex"/>
            <infraRsAttEntP tDn="uni/infra/attentp-test"/>
            </infraAccBndlGrp>
            </infraFuncP>
            <!-- Link aggregation policies -->
            <lacpLagPol name="testPc" minLinks="1" maxLinks="10"/>
            <lacpLagPol name="testVpc" minLinks="1" maxLinks="10"/>
            <lacpLagPol name="testPcOnFex" minLinks="2" maxLinks="5"/>
            <lacpLagPol name="testVpcOnFex" minLinks="2" maxLinks="10"/>
            </infraInfra>
            <fabricInst>
            <fabricProtPol name="testVpc">
            <fabricExplicitGEp name="testVpc" id="101">
            <fabricNodePEp id="101"/>
            <fabricNodePEp id="102"/>
            </fabricExplicitGEp>
            </fabricProtPol>
            </fabricInst>
            <physDomP name="test">
            <infraRsVlanNs tDn="uni/infra/vlanns-test-static"/>
            </physDomP>
            <l3extDomP name="test">
            <infraRsVlanNs tDn="uni/infra/vlanns-test-static"/>
            </l3extDomP>
            </polUni>

  2. Configure the tenant and intra-EPG contract associations by sending an XML POST request with a payload similar to the following example:

    Example:

    <?xml version="1.0" encoding="UTF-8"?>
            <polUni>
            <fvTenant name="Tenant-l3out">
            <vzBrCP intent="install" name="contr-intra" scope="context">
            <vzSubj consMatchT="AtleastOne" name="subj" revFltPorts="yes">
            <vzRsSubjFiltAtt action="permit" priorityOverride="default"
            tnVzFilterName="flt-ssh"/>
            </vzSubj>
            </vzBrCP>
            <vzBrCP intent="install" name="contr2" scope="context">
            <vzSubj consMatchT="AtleastOne" name="contr2-subj" revFltPorts="yes">
            <vzRsSubjFiltAtt action="permit" priorityOverride="default"
            tnVzFilterName="flt-ftp"/>
            </vzSubj>
            </vzBrCP>
            <vzBrCP intent="install" name="contr1" scope="context">
            <vzSubj consMatchT="AtleastOne" name="subj-http" revFltPorts="yes">
            <vzRsSubjFiltAtt action="deny" priorityOverride="default"
            tnVzFilterName="flt-http"/>
            </vzSubj>
            </vzBrCP>
            <l3extOut enforceRtctrl="export" mplsEnabled="no" name="l3out1">
            <l3extRsL3DomAtt tDn="uni/l3dom-test"/>
            <l3extRsEctx tnFvCtxName="vrf1"/>
            <l3extLNodeP name="l3out1_nodeProfile" tag="yellow-green">
            <l3extRsNodeL3OutAtt rtrId="172.16.0.1" rtrIdLoopBack="yes"
            tDn="topology/pod-1/node-101"/>
            <l3extLIfP name="l3out1_interfaceProfile" tag="yellow-green">
            <l3extRsPathL3OutAtt addr="192.168.15.1/24" autostate="disabled"
            encap="unknown" encapScope="local" ifInstT="l3-port" ipv6Dad="enabled"
            isMultiPodDirect="no" llAddr="::" mac="00:22:BD:F8:19:FF"
            mode="regular" mtu="inherit"
            tDn="topology/pod-1/paths-101/pathep-[eth1/10]"/>
            </l3extLIfP>
            </l3extLNodeP>
            <!--
            Set pcEnfPref to "enforced" to enable intra-Ext-EPG isolation.
            Set pcEnfPref to "unenforced" to disable intra-Ext-EPG isolation.
            -->
            <l3extInstP floodOnEncap="disabled" matchT="AtleastOne"
            name="l3epg1" pcEnfPref="unenforced" prefGrMemb="exclude">
            <l3extSubnet ip="172.16.0.0/16" scope="import-security"/>
            <fvRsCons tnVzBrCPName="contr2"/>
            <fvRsIntraEpg tnVzBrCPName="contr-intra"/>
            </l3extInstP>
            </l3extOut>
            <fvCtx bdEnforcedEnable="no" ipDataPlaneLearning="enabled" knwMcastAct="permit"
            name="vrf1" pcEnfDir="egress" pcEnfPref="unenforced" vrfIndex="0">
            <fvRsVrfValidationPol/>
            <vzAny matchT="AtleastOne" prefGrMemb="disabled"/>
            </fvCtx>
            <fvBD OptimizeWanBandwidth="no" arpFlood="yes" epClear="no" hostBasedRouting="no"
            intersiteBumTrafficAllow="no" intersiteL2Stretch="no" ipLearning="yes"
            ipv6McastAllow="no" limitIpLearnToSubnets="yes" llAddr="::"
            mac="00:22:BD:F8:19:FF" mcastAllow="no" multiDstPktAct="bd-flood" name="bd-web"
            type="regular" unicastRoute="yes" unkMacUcastAct="proxy" unkMcastAct="flood"
            v6unkMcastAct="flood" vmac="not-applicable">
            <fvSubnet ip="192.168.1.254/24" ipDPLearning="enabled" preferred="no"
            scope="private" virtual="no"/>
            <fvRsCtx tnFvCtxName="vrf1"/>
            <fvRsBdToEpRet resolveAct="resolve"/>
            </fvBD>
            <fvBD OptimizeWanBandwidth="no" arpFlood="yes" epClear="no" hostBasedRouting="no"
            intersiteBumTrafficAllow="no" intersiteL2Stretch="no" ipLearning="yes"
            ipv6McastAllow="no" limitIpLearnToSubnets="yes" llAddr="::"
            mac="00:22:BD:F8:19:FF" mcastAllow="no" multiDstPktAct="bd-flood" name="bd-app"
            type="regular" unicastRoute="yes" unkMacUcastAct="proxy" unkMcastAct="flood"
            v6unkMcastAct="flood" vmac="not-applicable">
            <fvSubnet ip="192.168.2.254/24" ipDPLearning="enabled" preferred="no"
            scope="private" virtual="no"/>
            <fvRsCtx tnFvCtxName="vrf1"/>
            <fvRsBdToEpRet resolveAct="resolve"/>
            </fvBD>
            <vzFilter name="flt-ftp">
            <vzEntry applyToFrag="no" arpOpc="unspecified" dFromPort="ftpData"
            dToPort="ftpData" etherT="ipv4" icmpv4T="unspecified" icmpv6T="unspecified"
            matchDscp="unspecified" name="ftp" prot="tcp" sFromPort="unspecified"
            sToPort="unspecified" stateful="no"/>
            </vzFilter>
            <vzFilter name="flt-ssh">
            <vzEntry applyToFrag="no" arpOpc="unspecified" dFromPort="ssh" dToPort="ssh"
            etherT="ipv4" icmpv4T="unspecified" icmpv6T="unspecified"
            matchDscp="unspecified" name="ssh" prot="tcp" sFromPort="unspecified"
            sToPort="unspecified" stateful="no"/>
            </vzFilter>
            <vzFilter name="flt-http">
            <vzEntry applyToFrag="no" arpOpc="unspecified" dFromPort="http" dToPort="http"
            etherT="ipv4" icmpv4T="unspecified" icmpv6T="unspecified"
            matchDscp="unspecified" name="flt1" prot="tcp" sFromPort="unspecified"
            sToPort="unspecified" stateful="no"/>
            </vzFilter>
            <fvAp name="ap-app1">
            <fvAEPg floodOnEncap="disabled" hasMcastSource="no" isAttrBasedEPg="no"
            matchT="AtleastOne" name="epg-app" pcEnfPref="unenforced"
            prefGrMemb="exclude" shutdown="no">
            <fvRsProv intent="install" matchT="AtleastOne" tnVzBrCPName="contr2"/>
            <fvRsProv intent="install" matchT="AtleastOne" tnVzBrCPName="contr1"/>
            <fvRsPathAtt encap="vlan-103" instrImedcy="immediate" mode="native"
            primaryEncap="unknown" tDn="topology/pod-1/paths-101/pathep-[eth1/3]"/>
            <fvRsDomAtt bindingType="none" classPref="encap" encap="unknown"
            encapMode="auto" epgCos="Cos0" epgCosPref="disabled" instrImedcy="lazy"
            netflowDir="both" netflowPref="disabled" numPorts="0" portAllocation="none"
            primaryEncap="unknown" primaryEncapInner="unknown" resImedcy="immediate"
            secondaryEncapInner="unknown" switchingMode="native" tDn="uni/phys-test"
            untagged="no" vnetOnly="no"/>
            <fvRsBd tnFvBDName="bd-app"/>
            </fvAEPg>
            <fvAEPg floodOnEncap="disabled" hasMcastSource="no"
            isAttrBasedEPg="no" matchT="AtleastOne" name="epg-web" pcEnfPref="unenforced"
            prefGrMemb="exclude" shutdown="no">
            <fvRsPathAtt encap="vlan-104" instrImedcy="immediate" mode="native"
            primaryEncap="unknown" tDn="topology/pod-1/paths-101/pathep-[eth1/4]"/>
            <fvRsDomAtt bindingType="none" classPref="encap" encap="unknown"
            encapMode="auto" epgCos="Cos0" epgCosPref="disabled" instrImedcy="lazy"
            netflowDir="both" netflowPref="disabled" numPorts="0" portAllocation="none"
            primaryEncap="unknown" primaryEncapInner="unknown" resImedcy="immediate"
            secondaryEncapInner="unknown" switchingMode="native" tDn="uni/phys-test"
            untagged="no" vnetOnly="no"/>
            <fvRsCons intent="install" tnVzBrCPName="contr1"/>
            <fvRsBd tnFvBDName="bd-web"/>
            </fvAEPg>
            </fvAp>
            </fvTenant>
            </polUni>