ACI Contract

[sqambera]

Hello,

I am trying to restrict communication between endpoints in different EPGs based on the IP addresses. Couldn't find the option to use IP address in the Filter. Can anyone please help to enable it? Thanks.

Qamber

[Francesco Molino · Accepted solution]

Hi

you can’t do that using contracts.

You will need to configure useg EPG with attributes that will be your IP to classify your endpoints and then apply a contract.

A screenshot showing a test useg EPG:

Also a link of a CLUS presentation: https://www.ciscolive.com/c/dam/r/ciscolive/us/docs/2017/pdf/LTRACI-2800.pdf

[sqambera]

Thank you for the help!

[Sergiu.Daniluk · Accepted solution]

Hi @sqambera 

As @Francesco Molino  mentioned, the contracts do not have IP filter. If you want to apply a contract between specific IP addresses, you can try to use normal EPGs, but is quite tedious to design and maintain the design of your EPGs to meet the requirements. However, if you want to group your endpoints based on IP or subnet, you have two alternatives: uEPG and ESG.

ESG starts to be supported in version 5.0 and has the flexibility to group EPs across the VRF, compared with the uEPG which only permits microsegmentation inside the BD.

Comparison:

• ESG (right):

• uEPG:

Reference to uEPG and ESG documentation:

https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/5-x/security/cisco-apic-security-configuration-guide-50x/m-endpoint-security-groups.html 

https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/1-x/virtualization/b_ACI_Virtualization_Guide_2_1_1/b_ACI_Virtualization_Guide_2_1_1_chapter_0100.html 

Stay safe,

Sergiu

[sqambera]

Thank you for the help Sergiu!