Configure an exception that prevents selected endpoint groups from participating in an entire contract or an individual contract subject.
In this procedure, you configure a contract that permits communication among most endpoint groups (EPGs) but excludes a specified subset of consumer and provider EPGs.
Before you begin
Configure the tenant, VRF, application profile, and EPGs that will provide and consume the contract.
Procedure
-
On the menu bar, choose .
-
Double-click the tenant in which you want to create the contract.
-
In the Navigation pane, expand Contracts, right-click Filters, and choose Create Filter.
A filter functions as an access control list (ACL) that classifies the traffic to permit or deny through a contract. You can create multiple filters to classify different types of traffic.
-
Enter a name for the filter, add the criteria that identify the traffic to permit or deny, and then click Submit.
-
Right-click Standard, and then choose Create Contract.
-
Enter a name for the contract, configure its scope, and click + to add a subject.
-
Repeat the preceding step to add another subject.
-
Click Submit.
-
To configure an exception that applies to every subject in the contract, complete the following substeps:
- Click the contract, and then click Contract Exception.
- Configure the subjects and specify whether to permit or deny their matching traffic.
- Click + to add a contract exception.
- Enter a name for the exception and choose the exception criterion.
- In the Consumer Regex and Provider Regex fields, enter regular expressions that identify the EPGs to exclude from every subject in the contract.
-
To configure an exception that applies to one subject in the contract, complete the following substeps:
- Click the subject, and then click Subject Exception.
- Click + to add a subject exception.
- Enter a name for the exception and choose the exception criterion.
- In the Consumer Regex and Provider Regex fields, enter regular expressions that identify the EPGs to exclude from the selected subject.