EPG to ESG migration and contract enforcement

[AntonioMacia]

Hi,

Let's say I have two ESG with a contract inherited from the EPGs due to the EGP-to-ESG selector. Then I create a new contract with the same ports than the inherited and I provide/consume it in the same way the inherited contract is. When does this new contract start enforcing the traffic? Immediately after I apply it between both ESGs or when I remove the old legacy contract?

My assumption is that it will start enforcing traffic as soon as I apply it, but I'd like a second opinion.

Thanks,

[Sergiu.Daniluk · Accepted solution]

Hi @AntonioMacia 

What happens is this:

1. first step in your migration is to you use the contract inheritance (through EPG Selector). Under the hood, what happens is the pcTag of the EPG will be replaced with pcTag of ESG. In other words, EPG1 will become ESG1 and EPG2 will become ESG2. Translating this in zoning rules, you will see pcTag ESG1 -> pcTag ESG2 using original contract with original filter, let's call it C1.

2. When you create a new contract, with the same filters (C2), and consume/provide it by ESG1/ESG2, this should be translated to same zoning rule as C1 from above. But since the rule is already there, nothing is pushed to the Leaf.

3. In the moment when you disassociate the C1 from one EPG, that will be the moment when C2 will be pushed to hardware.  The only change you see in zoning-rules output is the contract name. Everything else remains the same.

So to answer your question, C2 will be enforced between ESGs only in the moment when you delete C1 from one of the EPGs.

Take care,

Sergiu

[AntonioMacia]

Thanks a lot for the clarifications Sergiu!