ACI EPG and Contracts

[rohandec1980]

Hi

I have 2 EPGs,

EPG A has a single host(virtual appliance) with IP of 10.1.1.1, BD Subnet 10.1.1.0/24.

EPG B has 50 hosts in the IP range 10.2.2.0/24 configured on BD subnet.

How can i use contracts to limit communication from EPG A to only 4 hosts in EPG B [10.2.2.5, 10.2.2.6,10.2.2.7,10.2.2.8].

Is that possible?

Regards

Rohan 

[Francesco Molino]

Hi

Yes you can create a contract between EPGs and then filter the traffic you to allow.
Here a link showing you how that works:
https://www.cisco.com/c/m/en_us/products/data-center/software-demos/aci/creating-a-contract-between-epgs.html

Hope I understood your question correctly and answered it.

[rohandec1980]

Hi Francesco

My query is how can i use contracts to limit communication from EPG A to only 4 hosts in EPG B [10.2.2.5, 10.2.2.6,10.2.2.7,10.2.2.8] and not the whole EPG B.

Is that possible, or would i have to break up EPG B into smaller EPGs to do that?

Regards

Rohan

[Francesco Molino]

Ok now i got it right.
You can do this different ways, for example use a pbr if you have firewall to filter traffic but the most simple way is to redefine your EPGs in a more granular way do you'll be able to apply a contract between them. So your EPG should be split in 2 EPGs (1 for the whole subnet and 1 for the few endpoints you want to filter).

[Sergiu.Daniluk]

Hi @rohandec1980 

You can create a uEPG containing 10.2.2.5, 10.2.2.6,10.2.2.7,10.2.2.8, and you can apply the contract between the uEPG and EPG-A.

For everything else regarding policy enforcement on uEPG, you can inherit the contracts from EPG-B.

For more details about micro-segmentation, have a look on the config guide and ciscolive presos:

• Config guide:

https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/4-x/virtualization/Cisco-ACI-Virtualization-Guide-42x/Cisco-ACI-Virtualization-Guide-421_chapter_0100.html 

• Ciscolive lab:

https://aci-lab.ciscolive.com/lab/pod21/segmentation/mseg 

Stay safe,

Sergiu

[rohandec1980]

Hi Sergiu

In case of micro segmentation the 4 hosts in epg b which are part of the uEPG will not be able to communicate with rest of EPGB members. Is that right?

My requirement is to make sure EPGA can only talk to some members of EPG B. The only possible solution seems splitting up EPGB into smaller epgs.

Regards

Rohan 

[Francesco Molino]

I will personally go with smaller epg as i said before. Easier in that specific case.

[Sergiu.Daniluk]

Hi,

That is correct. You will need contracts if you need communication between uEPG and base EPG.

Stay safe,

Sergiu