I have an ESG and External EPG (SR-MPLS L3out based). I created a 'ICMP' contract with 'icmp' filter in it. I attached this contract as 'consumer' on the ESG and 'provided' on the EEPG. I can then ping EEPG endpoint from ESG endpoint. But I am also able to initiate ping from EEPG endpoint to ESG endpoint. Is this normal?
I replaced the 'ICMP' contract with SSH contract (TCP port 22 in the filter) and I do not see this behavior. I can only initiate SSH traffic from ESG endpoint to EEPG endpoint. I cannot ssh from EEPG endpoint to ESG endpoint.
