VZANY and L3out

[nkhawaja1]

Hi, Need to get a quick response on this.

I have 2 tenants

1. For both tenants all the EPG are in preferred group. Which means no need for a contract between EPG.
2. I will enable VZANY which is a contract for all objects in a VRF. I will apply this contract on external EGP all 0.0.0.0/0, so all the hosts in the VRF will talk to every thing outside, including hosts in Tenant B.

So till this point both tenants are talking free among each other, and within the tenant open communication as well.

Now I want to restrict one or more EPG in A to talk to one ore more EPG in B.

Can I do that? if so whats the best way to do it?

thanks

Nadeem

[bmoorewiz]

Using a Taboo Contract. 

https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/1-x/Operating_ACI/guide/b_Cisco_Operating_ACI/b_Cisco_Operating_ACI_chapter_01000.html#concept_4988E5E9E2EC4A16B696D22B36A6174F