Contract inheritance enables an endpoint group to inherit all provided and consumed contracts from another endpoint group in the same tenant.
Contract inheritance is a policy configuration in which an inheritor endpoint group (EPG) uses the provided and consumed contracts associated with a contract master EPG.
-
Supports application, microsegmented, L2Out, and L3Out EPGs.
-
Propagates contract changes from the contract master EPG to all inheritor EPGs.
-
Allows an EPG to inherit contracts from multiple contract master EPGs.
Contract inheritance guidelines and support
The following guidelines and requirements apply to contract inheritance:
-
Configure inheritance relationships only between EPGs of the same type.
-
The contract master EPG and inheritor EPGs must belong to the same tenant.
-
Contract inheritance supports only one level. You cannot chain inheritance relationships, and a contract master EPG cannot inherit contracts.
-
Labels are supported. For inherited contracts, the APIC uses the label configured on the contract master EPG.
-
Directly associated and inherited contracts both consume ternary content-addressable memory (TCAM) resources.
-
vzAnysecurity contracts and taboo contracts are not supported. -
Contract inheritance with a service graph is supported in Cisco APIC releases 4.2(6), 5.0(1), and later, when the contract and EPGs belong to the same tenant.
The following figure shows EPG A inheriting contracts from EPG B:
Configuration methods
You can configure contract inheritance by using the APIC GUI, the NX-OS-style CLI, or the REST API.