Contracts control communication between endpoint groups by defining permitted traffic, traffic direction, and actions to apply to the traffic.
A contract is a policy construct that controls communication between endpoint groups (EPGs) by specifying allowed protocols, traffic direction, and service-level actions.
-
Uses a hierarchical structure of subjects, filters, and filter entries.
-
Defines directional relationships in which EPGs provide or consume services.
-
Is enforced on leaf switches to support high availability and performance.
Contract components and communication
A contract can contain the following components:
-
A name uniquely identifies each contract that a tenant consumes.
-
Subjects group filters for a specific application or service.
-
Filters classify traffic according to Layer 2 through Layer 4 attributes.
-
Filter entries define the traffic-matching criteria within a filter.
-
Actions specify how to handle filtered traffic. Available actions include permit, mark, redirect, copy, block, and log.
-
Aliases provide optional names that you can change for contract objects.
Web service contract
For example, you can define an HTTP filter for TCP ports 80 and 8080 and an HTTPS filter for TCP port 443.
You can then create a webCtrct contract with two sets of subjects. The openProv and openCons subjects contain the HTTP filter. The secureProv and secureCons subjects contain the HTTPS filter.
The webCtrct contract allows secure and nonsecure web traffic between EPGs that provide the web service and EPGs that contain endpoints that consume the service.