Question

A network engineer is deploying a new three-tier application in Cisco ACI. The Web, App, and DB endpoints are each placed in their own EPG within a single bridge domain and VRF. By default, no traffic flows between the EPGs. The engineer wants Web endpoints to reach App endpoints on TCP 8080, but must NOT permit any other inter-EPG traffic. Which configuration correctly achieves this requirement?

Accepted Answer

Create a contract with a subject filtering TCP 8080, provide it from the App EPG and consume it from the Web EPG.

Answer

Enable 'Unenforced' mode on the VRF so the EPGs can communicate freely over TCP 8080.

Answer

Apply a vzAny contract on the VRF permitting TCP 8080 so all EPGs in the VRF can use the service.

Answer

Place all three EPGs into a single ESG and rely on intra-ESG forwarding for TCP 8080.