PDF

Microsegmentation with network-based attributes for bare-metal endpoints

Updated: April 15, 2026

Want to summarize with AI?

Log in

Network-based attributes provide microsegmentation for physical endpoints by using IP or MAC address filters to create security zones within the Cisco ACI fabric.

Microsegmentation with network-based attributes uses attribute-based endpoint groups (EPGs) to isolate bare-metal endpoints according to their network identifiers.

  • MAC address filters isolate one or more servers.

  • IP address filters isolate individual addresses, subnets, or noncontiguous address ranges.

  • Physical endpoints can be isolated within one base EPG or across different base EPGs.

Network-based attribute types

You can implement microsegmentation by using the following network-based attributes:

  • An IP-based attribute isolates an individual IP address, a subnet, or multiple noncontiguous IP addresses to create a security zone similar to a firewall security zone.

  • A MAC-based attribute isolates one or more MAC addresses and can contain servers that are sending malicious traffic.

Configure network-based microsegmented EPGs for bare-metal endpoints by using the GUI

Use the Cisco APIC GUI to create a microsegmented EPG (uSeg EPG) that classifies physical endpoints by their IP or MAC addresses.

Procedure

  1. Log in to the Cisco APIC GUI.

  2. On the menu bar, choose Tenants, and then choose the tenant in which you want to create the uSeg EPG.

  3. In the Navigation pane, expand tenant-name > Application Profiles > application-profile-name > Application EPGs.

  4. Select a base EPG that contains endpoints for the new uSeg EPG.

    • To classify physical endpoints from the same base EPG, select that base EPG.
    • To classify physical endpoints from different base EPGs, select one of those base EPGs.

    The properties of the base EPG appear in the Work pane.

  5. In the Work pane, click the Operational tab.

  6. Ensure that the Client End-Points tab is active.

    The Work pane displays the physical endpoints that belong to the base EPG.

  7. Record the IP or MAC addresses of the endpoints that you want to add to the new uSeg EPG.

  8. If the new uSeg EPG will contain endpoints from different base EPGs, repeat the preceding four steps for each additional base EPG.

  9. In the Navigation pane, right-click uSeg EPGs, and then choose Create uSeg EPG.

  10. In the Create uSeg EPG dialog, configure the uSeg EPG.

    1. In the Name field, enter a name.

      Use a name that identifies the EPG as a microsegment.

    2. For Intra-EPG Isolation, choose enforced or unenforced.

      If you choose enforced, ACI prevents communication between endpoints in the uSeg EPG.

    3. From the Bridge Domain drop-down list, choose a bridge domain.
    4. In the uSeg Attributes area, choose IP Address Filter or MAC Address Filter from the + drop-down list.

  11. Configure the selected address filter.

    If you selected...

    Then...

    IP Address Filter

    1. In the Create IP Attribute dialog, enter a name in the Name field.

      Use a name that identifies the function of the filter.

    2. In the IP Address field, enter an IP address or a subnet with the appropriate subnet mask.

    3. Click OK.

    4. To include noncontiguous IP addresses in the uSeg EPG, create additional IP address filters as needed.

    5. In the Create uSeg EPG dialog, click Submit.

    MAC Address Filter

    1. In the Create MAC Attribute dialog, enter a name in the Name field.

      Use a name that identifies the function of the filter.

    2. In the MAC Address field, enter a MAC address.

    3. Click OK.

    4. In the Create uSeg EPG dialog, click Submit.

  12. Associate the uSeg EPG with a physical domain.

    1. In the Navigation pane, expand uSeg EPGs, and then expand the uSeg EPG that you created.
    2. Click Domains (VMs and Bare-Metals).
    3. In the Work pane, choose Actions > Add Physical Domain Association.
    4. In the Add Physical Domain Association dialog, choose a profile from the Physical Domain Profile drop-down list.
    5. For Deploy Immediacy, retain the default value, On Demand.
    6. For Resolution Immediacy, retain the default value, Immediate.
    7. Click Submit.

  13. Associate the uSeg EPG with the appropriate leaf switch.

    1. In the Navigation pane, expand the uSeg EPG, and then click Static Leafs.
    2. In the Static Leafs window, choose Actions > Statically Link with Node.
    3. In the Statically Link With Node dialog, select the leaf node and deployment mode.
    4. Click Submit.

  14. Repeat the uSeg EPG creation and association steps for each additional network attribute-based EPG that you want to create.

What to do next

Verify that the attribute-based EPG was created correctly.

For an IP-based or MAC-based attribute, generate traffic from the endpoints in the new microsegment and verify that the endpoints are classified correctly.