PDF

Domains, attachable access entity profiles, and VLAN for EPG deployment

Updated: April 15, 2026

Want to summarize with AI?

Log in

Explains how domains, Attachable Access Entity Profiles (AEPs), and VLANs work together to deploy an EPG on a specific port.

Domains, Attachable Access Entity Profiles, and VLANs for EPG deployment are network configuration components that

  • provide the mandatory infrastructure elements required to deploy an endpoint group (EPG) on a specific port

  • establish the association between EPGs and domains to validate ports and VLANs usage, and

  • ensure proper configuration validation through APIC checks for EPG-domain associations.

EPG domain types and validation requirements

All endpoint groups (EPGs) require a domain. Interface policy groups must also be associated with Attachable Access Entity Profile (AEP), and the AEP must be associated with a domain, if the AEP and EPG have to be in same domain. Based on the association of EPGs to domains and of interface policy groups to domains, the ports and VLANs that the EPG uses are validated.

The following domain types associate with EPGs:

  • Application EPGs

  • Layer 3 external outside network instance EPGs

  • Layer 2 external outside network instance EPGs

  • Management EPGs for out-of-band and in-band access

The APIC checks if an EPG is associated with one or more of these types of domains. If the EPG is not associated, the system accepts the configuration but raises a fault. The deployed configuration may not function properly if the domain association is not valid. For example, if the VLAN encapsulation is not valid for use with the EPG, the deployed configuration may not function properly.

Note

EPG association with the AEP without static binding does not work in a scenario when you configure the EPG as Trunk under the AEP with one end point under the same EPG supporting Tagging and the other end point in the same EPG does not support VLAN tagging. While associating AEP under the EPG, you can configure it as Trunk, Access (Tagged) or Access (Untagged).

Create domains and VLANS to deploy an EPG on a specific port using the GUI

Before you begin

  • The tenant where you deploy the EPG is already created.

  • An EPG is statically deployed on a specific port.

Procedure

  1. On the menu bar, choose Fabric > Access Policies.

  2. In the Navigation pane, choose Quick Start.

  3. In the Work pane, click Configure Interfaces.

  4. In the Configure Interfaces dialog, perform these actions:

    1. For Node Type, click Leaf.
    2. For Port Type, click Access.
    3. For Interface Type, choose the desired type.
    4. For Interface Aggregation Type, choose Individual.
    5. For Node, click Select Node, put a check in the box for the desired node, then click OK. You can select multiple nodes.
    6. For Interfaces For All Switches, enter the range of desired interfaces.
    7. For Leaf Access Port Policy Group, click Select Leaf Access Port Policy Group.
    8. In the Select Leaf Access Port Policy Group dialog, click Create Leaf Access Port Policy Group.
    9. In the Create Leaf Access Port Policy Group dialog, for Link Level Policy, click Select Link Level Policy.
    10. Choose a link level policy and click Select, or click Create Link Level Policy, fill out the fields as desired, and click Save.

  5. Create a domain and VLAN pool by performing the following actions:

    1. In the Navigation pane, expand Physical and External Domains.
    2. Right-click Physical Domains and choose the appropriate Create Physical Domain.
    3. For Name, enter a name for the domain.
    4. For VLAN Pool, choose Create VLAN Pool, fill out the fields as desired, then click Submit.
    5. Fill out the remaining fields as desired.
    6. Click Submit.

  6. On the menu bar, choose Tenants > All Tenants.

  7. In the Work pane, double click the desired tenant.

  8. In the Navigation pane, expand Tenant_name > Application Profiles > profile_name > Application EPGs > EPG_name.

  9. Right-click Static Ports and choose Deploy to Port.

    1. In the Deploy EPG to Port dialog, from the Pod drop-down list, choose the desired pod.
    2. From the Leaf drop-down list, choose the desired leaf.
    3. From the Port drop-down list, choose the desired port.
    4. From the VLAN drop-down list, choose the desired VLAN.
    5. Fill out the remaining fields as desired.
    6. Click Submit.
      The EPG is deployed on the specified port.

  10. In the Navigation pane, expand Fabric > Access Policies > Global Policies > Attachable Access Entity Profiles.

    1. Right-click Attachable Access Entity Profiles and choose Create Attachable Access Entity Profile.
    2. In the Create Attachable Access Entity Profile dialog, enter a name in the Name field.
    3. In the Domains area, click the + icon.
    4. In the Add Physical Domain Association dialog, from the Physical Domain Profile drop-down list, choose the domain that you created.
    5. Click Submit.
      The AEP is associated with a specific port on a node and with a domain. The physical domain is associated with the VLAN pool and the tenant is associated with this physical domain.

    The switch profile and the interface profile are created. The policy group is created in the port block under the interface profile. The AEP is automatically created, and it is associated with the port block and with the domain. The domain is associated with the VLAN pool and the tenant is associated with the domain.