Intra-EPG contracts control communication between endpoints in the same endpoint group by permitting selected traffic and blocking other traffic.
An intra-EPG contract is a policy that provides granular control over traffic between endpoints in the same endpoint group (EPG).
-
Filters selected traffic within an EPG.
-
Supports application EPGs and microsegmented EPGs (uSeg EPGs).
-
Requires Cisco APIC release 3.0(1) or later.
Intra-EPG communication modes
The following configuration modes control communication between endpoints in an EPG:
-
By default, all endpoints in the EPG can communicate without restriction.
-
Intra-EPG isolation blocks all communication between endpoints in the EPG.
-
An intra-EPG contract permits traffic that matches the contract filters and blocks all other communication between endpoints in the EPG.
Intra-EPG contract scenarios
You can use an intra-EPG contract to permit web traffic while blocking all other traffic. You can also permit all Internet Control Message Protocol (ICMP) traffic and TCP traffic on port 22 while blocking all other communication.