PDF

Guidelines and limitations for intra-EPG contracts

Updated: April 15, 2026

Want to summarize with AI?

Log in

Intra-EPG contracts have domain, hardware, service graph, L3Out, and policy enforcement requirements.

Observe the following guidelines and limitations when you deploy intra-EPG contracts on application EPGs, microsegmented EPGs, and L3Out EPGs.

The following guidelines and limitations apply to intra-EPG contracts:

  • Intra-EPG contracts are supported for application EPGs and microsegmented EPGs (uSeg EPGs) on VMware VDS, Open vSwitch (OVS), and bare-metal servers.

    OVS is available with Kubernetes integration for Cisco Application Centric Infrastructure ( ACI ). In Kubernetes, you can create EPGs and assign namespaces to them. You can then use the Cisco Application Policy Infrastructure Controller ( APIC ) to apply intra-EPG policies to the EPGs as you would for VMware VDS or bare-metal servers.

  • Intra-EPG contracts require leaf switches that support proxy Address Resolution Protocol (ARP).

    Intra-EPG contracts are supported on Cisco Nexus 9000 Series switches with an -EX or -FX suffix and on later models.

  • Intra-EPG contracts are not supported in Cisco Application Virtual Switch, Cisco ACI Virtual Edge, or Microsoft domains. Attempting to enforce an intra-EPG contract in these domains can cause ports to enter a blocked state.

  • A service graph cannot be associated with a subject of an intra-EPG contract that has a deny action.

  • Service graph support for intra-EPG contracts is limited to single-node, one-arm mode policy-based redirect and copy services.

  • Beginning with Cisco APIC release 5.2(1), intra-EPG contracts are supported on L3Out EPGs.

  • An intra-EPG contract on an L3Out EPG supports the permit, deny, and redirect actions. The redirect action requires a service graph with policy-based redirect (PBR).

  • An L3Out EPG with the prefix 0.0.0.0/0 or ::/0 cannot use an intra-EPG contract or intra-EPG isolation. The Cisco APIC raises a fault for either configuration.

    To match all IPv4 traffic, you can instead configure the 0.0.0.0/1 and 128.0.0.0/1 prefixes for the L3Out EPG.

  • Unlike an intra-EPG contract on an application EPG, an intra-EPG contract on an L3Out EPG does not automatically include an implicit deny rule. Enable intra-EPG isolation to deny traffic that the contract does not permit.

  • Intra-EPG isolation on an L3Out EPG operates only when the VRF is in enforced mode.

  • Cisco ACI cannot control how traffic reaches the Cisco ACI border leaf switch for intra-L3Out enforcement.