A tenant is a container for policies that enable an administrator to exercise domain-based access control so that qualified users can access privileges, such as tenant administration and networking administration. You must configure a tenant before you can deploy any Layer 4 to Layer 7 services.

A security domain is a concept that allows you to scope which tenant is accessible by which user. For example, if you create Tenant1, Tenant2, and Tenant3, you can create three security domains—securitydomain1, securitydomain2, and securitydomain3—and the administrators of each tenant would be associated with the respective security domain.

Layer 3 is the network layer of the Open Systems Interconnection (OSI) communication model. An Layer 3 network configuration refers to the configuration of how traffic forwarding works to the outside of the fabric. Layer 3 is used to discover the address of other nodes, select routes, select quality of service, and forward incoming messages for local host domains to the transport layer. The Layer 3 network is used by all of the application endpoint groups (EPGs) that are used by the tenant.

A bridge domain (BD) represents a Layer 2 forwarding construct within the fabric. One or more endpoint groups (EPGs) can be associated with one bridge domain or subnet. A bridge domain can have one or more subnets that are associated with it. One or more bridge domains together form a tenant network. When you insert a service function between two EPGs, those EPGs must be in separate BDs. To use a service function between two EPGs, those EPGs must be isolated; this follows legacy service insertion based on Layer 2 and Layer 3 lookups.

An application profile defines the policies, services and relationships between endpoint groups (EPGs). Each application profile contains one or more EPGs that can communicate with the other EPGs in the same application profile and with EPGs in other application profiles according to the contract rules.

A contract contains all of the filters that will be applied between endpoint groups (EPGs) that produce and consume the contract. A contract involves EPGs that are called providers and consumers. A contract defines the protocols and ports on which a provider and consumer are allowed to communicate.

Filters are Layer 2 to Layer 4 fields, TCP/IP header fields such as Layer 3 protocol type, Layer 4 ports, and so forth. According to its related contract, an EPG provider dictates the protocols and ports in both the in and out directions. Contract subjects contain associations to the filters (and their directions) that are applied between EPGs that produce and consume the contract.

Subjects are contained in contracts. One or more subjects within a contract use filters to specify the type of traffic that can be communicated and how it occurs. For example, for HTTPS messages, the subject specifies the direction and the filters that specify the IP address type (for example, IPv4), the HTTP protocol, and the ports allowed. Subjects determine if filters are unidirectional or bidirectional. A unidirectional filter is used in one direction. Unidirectional filters define in or out communications but not the same for both. Bidirectional filters are the same for both; they define both in and out communications.