Cisco APIC Security Configuration Guide, Release 6.2(x)

PDF

Cisco APIC Security Configuration Guide, Release 6.2(x)

Create an endpoint security group by using the GUI

Updated: April 17, 2026

Want to summarize with AI?

Log in

Creates an endpoint security group (ESG) and configures its selectors, policy settings, deployment behavior, and contract inheritance.

Before you begin

Configure the tenant, application profile, and virtual routing and forwarding (VRF) instance for the ESG.

Beginning with Cisco APIC Release 5.2(1), ESG selectors can use policy tags, endpoint groups (EPGs), and IP subnets. Earlier releases support only IP subnet selectors.

Procedure

  1. On the menu bar, choose Tenants.

  2. In the Navigation pane, navigate to tenant-name > Application Profiles > application-profile-name > Endpoint Security Groups .

  3. Right-click Endpoint Security Groups, and choose Create Endpoint Security Group.

  4. On the STEP 1 > Identity page of the Create Endpoint Security Group dialog box, configure the ESG identity.

    1. In the Name field, enter a name for the ESG.
    2. Optional: In the Description field, enter a description.
    3. In the VRF field, choose the VRF instance to associate with the ESG.
    4. For ESG Admin State, retain Admin Up or choose Admin Shut to administratively disable the ESG.

      The default value is Admin Up. The ESG Admin State field is available beginning with Cisco APIC Release 5.2(3).

    5. Click Next.

      The STEP 2 > Selectors page opens.

      Note

      You can skip selector configuration and configure selectors later.

  5. To classify endpoints by policy tag, click + in the Tag Selectors bar.

    The Create a Tag Selector dialog box opens. Configure the selector as described in Create a tag selector by using the GUI .

  6. To classify an EPG or external EPG, click + in the EPG/External EPG Selectors bar.

    The Create an EPG/External EPG Selector dialog box opens. Configure the selector as described in Create an EPG/External EPG selector by using the GUI .

  7. To classify endpoints by IP address or subnet, click + in the IP Subnet Selectors bar.

    The Create an IP Subnet Selector dialog box opens. Configure the selector as described in Create an IP subnet selector by using the GUI .

  8. To classify external prefixes, click + in the External Subnet Selectors bar.

    An external subnet selector can match prefixes learned through a Layer 3 Outside (L3Out) connection or Ethernet VPN (EVPN) Type 5 routes learned through a border gateway (BGW).

    The Create an External Subnet Selector dialog box opens. Configure the selector as described in Create an External Subnet Selector .

  9. On the STEP 2 > Selectors page, click Next.

    The STEP 3 > VXLAN BGW (Optional) page opens.

  10. On the STEP 3 > VXLAN BGW (Optional) page, enter the normalized Security Group Tag (SGT) value in the Normalized pcTag field.

    Beginning with Cisco APIC Release 6.1(4), Cisco ACI can advertise normalized policy control tag (pcTag) and SGT information through Border Gateway Protocol (BGP) EVPN across BGWs.

    The normalized pcTag translates the fabric-local pcTag to a common SGT value. Fabrics connected through BGWs can use this value to identify the same security group even when their local pcTag values differ.

  11. Click Next.

    The STEP 4 > Advanced (Optional) page opens.

  12. On the STEP 4 > Advanced (Optional) page, configure the required advanced settings.

    1. Optional: To block unrestricted communication between endpoints in the ESG, choose Enforced in the Intra ESG Isolation field.

      The default value, Unenforced, permits unrestricted communication between endpoints in the same ESG.

      To permit only selected traffic within the ESG, configure an intra-ESG contract as described in Apply a contract to an endpoint security group by using the GUI .

    2. Optional: To include the ESG in the preferred group, choose Include in the Preferred Group Member field.

      The default value is Exclude. Before choosing Include, enable the preferred group on the associated VRF instance.

      For more information, see the Cisco APIC Basic Configuration Guide.

    3. Optional: In the Deployment Immediacy field, choose On Demand or Immediate.

      The deployment-immediacy setting is available beginning with Cisco APIC Release 6.1(4).

      Cisco APIC automatically enforces Immediate deployment when the ESG contains an External Subnet Selector, an External EPG Selector, or a Tag Selector that matches an L3Out external subnet.

    4. Optional: To inherit contracts from another ESG, click + in the ESG Contract Master bar, and choose one or more contract-master ESGs.

      The new ESG inherits all contracts associated with each selected contract-master ESG.

  13. Click Finish.

The ESG is created with the selected VRF association, selectors, advanced settings, and inherited contracts.