Cisco APIC Security Configuration Guide, Release 6.2(x)

PDF

Cisco APIC Security Configuration Guide, Release 6.2(x)

Layer 4 to Layer 7 services for endpoint security groups

Updated: April 17, 2026

Want to summarize with AI?

Log in

Endpoint security groups (ESGs) support the Layer 4 to Layer 7 service graph features available for endpoint groups (EPGs).

Layer 4 to Layer 7 services use service graphs to insert network services into traffic flows governed by contracts between ESGs.

  • ESGs support the same Layer 4 to Layer 7 service graph features as EPGs.

  • A service graph attached to a contract between ESGs causes Cisco APIC to create hidden service EPGs for device attachment.

  • The hidden service EPGs associated with ESG service graphs receive global policy control tags (pcTags).

Service EPG behavior

Cisco APIC creates hidden service EPGs for a service graph between ESGs in the same way that it creates hidden service EPGs for a service graph between EPGs.

Note

Beginning with Cisco APIC Release 5.0(1), all newly created service EPGs for Layer 4 to Layer 7 deployments that use vzAny-to-vzAny contracts receive a global pcTag.

For more information, see the Cisco APIC Layer 4 to Layer 7 Services Deployment Guide .