IP-based selectors classify endpoint IP addresses but do not classify MAC addresses used for Layer 2 forwarding and policy enforcement.
Cisco Application Centric Infrastructure (ACI) uses IP addresses for routed lookups and MAC addresses for switched lookups, including switched packets that contain IP headers.
-
IP-based selectors classify IP addresses and affect routed traffic.
-
MAC-based selectors classify MAC addresses and affect switched and routed traffic.
-
A MAC-based classification also applies to an IP address associated with that MAC address unless an IP-based selector assigns the IP address to a different endpoint security group (ESG).
Endpoint classification
Consider endpoint EP_A, which belongs to endpoint group (EPG) EPG_A. Its MAC address is MAC_A, and its IP address is IP_A.
|
MAC selector |
IP selector |
MAC classification |
IP classification |
|---|---|---|---|
|
|
No match |
|
|
|
|
|
|
|
|
No match |
|
|
|
Effect on switched traffic
IP subnet selectors and tag selectors that match IP addresses do not change the MAC classification used for switched traffic. As a result, Layer 2 traffic can bypass contracts between ESGs even when the source and destination IP addresses belong to different ESGs.
Proxy ARP options
Proxy Address Resolution Protocol (ARP) causes same-subnet endpoint traffic to use routed forwarding so that the fabric can enforce contracts based on the IP classifications.
Use one of the following methods on each EPG that provides VLAN-to-interface bindings for ESG endpoints:
-
Enable intra-EPG isolation and proxy ARP.
-
Configure an intra-EPG contract with a permit-all filter, such as the default contract in the
commontenant. An intra-EPG contract enables proxy ARP automatically. The permit-all filter allows endpoints that are not classified into an ESG to communicate within the EPG. -
For a virtual machine manager (VMM) integration, enable Allow Micro-Segmentation when associating the VMM domain with the EPG. This option enables proxy ARP automatically.
When proxy ARP is enabled on a VLAN, the fabric drops flooded traffic other than ARP requests, including Layer 2 multicast traffic received from that VLAN.
Intermediate switch considerations
If non-ACI switches exist between endpoints and the ACI leaf switches, endpoints in the same subnet or VLAN might be locally switched before the ACI fabric can enforce ESG contracts.
Use a private VLAN (PVLAN) configuration when required to prevent the intermediate switches from locally bridging traffic between endpoints in different ESGs. The traffic is then forwarded to the ACI fabric for policy enforcement.