Question

A network engineer is designing an ACI application profile for a three-tier application (web, app, database). The security team requires that web servers can only reach app servers on TCP 8080, and app servers can only reach database servers on TCP 1521. All three tiers reside in the same bridge domain and VRF. Which approach correctly enforces this policy in ACI?

Accepted Answer

Create three EPGs (web, app, db) and define contracts where the app EPG provides a contract with TCP 8080 consumed by web, and the db EPG provides a contract with TCP 1521 consumed by app

Answer

Place all three tiers in a single EPG and apply an intra-EPG contract permitting TCP 8080 and TCP 1521

Answer

Create three EPGs and rely on the default ACI behavior, which permits all traffic between EPGs in the same bridge domain

Answer

Create three bridge domains, one per tier, and use subnet-based ACLs on each bridge domain to restrict the ports