Cisco APIC Layer 3 Networking Configuration Guide, Release 6.2(x)

PDF

Cisco APIC Layer 3 Networking Configuration Guide, Release 6.2(x)

Configure a remote security group tag for an endpoint security group

Updated: April 17, 2026

Want to summarize with AI?

Log in

Assign a remote security group tag to an endpoint security group for policy-aware communication between Cisco ACI and a Cisco NX-OS site.

Use this procedure to create an endpoint security group (ESG) and assign the remote policy control tag (pcTag) used as its remote security group tag (SGT).

The remote pcTag identifies the ESG to the remote Cisco NX-OS fabric and enables security group information to be exchanged between the Cisco ACI and Cisco NX-OS domains.

Procedure

  1. On the menu bar, click Tenants and choose the applicable tenant.

  2. In the navigation pane, choose tenant_name > Application Profiles > application_profile_name > Endpoint Security Groups.

  3. Right-click Endpoint Security Groups and choose Create Endpoint Security Group.

  4. On the STEP 1 > Identity page of the Create Endpoint Security Group dialog box, configure the ESG identity:

    1. In the Name field, enter a name for the ESG.
    2. Optional: In the Description field, enter a description of the ESG.
    3. From the VRF drop-down list, choose the VRF to associate with the ESG.
    4. Check the Set Remote pcTag check box.
    5. In the Remote pcTag field, enter the remote pcTag value to use as the SGT between the Cisco ACI fabric and the Cisco NX-OS site.
    6. From the ESG Admin State drop-down list, choose Admin Shut to shut down the ESG, or retain the default value of Admin Up.

      The ESG Admin State field is available beginning with Cisco APIC Release 5.2(3).

    7. From the Deployment Immediacy drop-down list, choose On Demand or Immediate.

      By default, Cisco ACI deploys an ESG with On Demand deployment immediacy. Cisco ACI programs the associated contract rules only after the leaf node learns an endpoint that matches the ESG selectors. Beginning with Cisco ACI Release 6.1(4), you can choose Immediate to deploy the ESG immediately.

      If the ESG contains an External Subnet selector, External EPG selector, or Tag selector that matches an external prefix or subnet, Cisco ACI automatically enforces the Immediate option.

    8. Click Next.

      The STEP 2 > Selectors page of the Create Endpoint Security Group dialog box appears.

The ESG identity settings include the remote security group tag. You can now configure the ESG selectors.