Cisco APIC Security Configuration Guide, Release 6.2(x)

PDF

Cisco APIC Security Configuration Guide, Release 6.2(x)

Selector precedence

Updated: April 17, 2026

Want to summarize with AI?

Log in

Selector precedence determines which endpoint security group (ESG) classification applies when multiple selectors match the same object.

The fabric evaluates selectors in a defined order based on whether the matched traffic is switched, routed, or associated with an external subnet.

  • Different precedence rules apply to MAC addresses, IP addresses, and external prefixes.

  • A lower precedence number represents a higher-priority match.

  • Conflicting tag selector matches can generate faults and prevent classification until the conflict is resolved.

Switching and routing traffic

Table 1. Selector precedence for switched and routed traffic

Precedence

Switched traffic

Routed traffic

1

Tag selector for an endpoint MAC tag or static endpoint

Tag selector for an endpoint IP tag or IP subnet selector for a host IP address

2

Tag selector for an endpoint virtual machine manager (VMM) MAC tag

Tag selector for a bridge domain (BD) subnet or IP subnet selector for a subnet

3

Endpoint group (EPG) selector or Virtual Extensible LAN (VXLAN) BD selector

Tag selector for an endpoint MAC tag or static endpoint

4

--

Tag selector for an endpoint VMM MAC tag

5

--

EPG selector

External subnets

Table 2. Selector precedence for external subnets

Precedence

Selector or classification

Behavior

1

Dynamic L3Out EPG/ESG Classification (DEC)

Dynamically classifies external prefixes learned through a Layer 3 Outside (L3Out) connection.

2

External subnet selector

Explicitly matches an external prefix.

3

Tag selector

Matches an external subnet through its policy tag.

4

External EPG selector

Classifies prefixes through membership in an external EPG.

5

Unselected subnets under the external EPG

Provides fallback classification for subnets that are not explicitly selected.

For more information, see Dynamic ESG/L3Out EPG classification .

Conflicting tag selector matches

The fabric handles multiple tag selector matches as follows:

  • If one tag selector has already matched an object, that first match remains active and subsequent tag selector matches are ignored.

  • If multiple tag selectors match an object before any one selector becomes active, none of the matching selectors takes effect until the conflict is resolved.

  • For a simultaneous conflict, the fabric raises a fault under each affected ESG and under the matched object.