Cisco ACI Contract Priorities Explained & Example
Note: This post is based on Cisco ACI Contract white paper document.
Contents
Cisco ACI Contract priorities
When using contracts that include a combination of EPG-to-EPG contracts, with EPGs that may be part of preferred groups or vzAny contracts, it is necessary to understand the relative priority of the rules that are programmed in the TCAM in order to understand the policy enforcement behavior.
Cisco ACI Contract Priorities General Rules
The following list provides a summary of the high-level rules of priority used when filtering traffic:
● More specific EPGs win over vzAny and preferred groups.
- EPG-to-EPG (priority 7 or 9) wins over EPG-to-vzAny (priority 13 or 15) and vzAny-to-EPG (priority 14 or 16), which wins over vzAny-to-vzAny (priority 17 or 20)
- Specific source wins over specific destination (for example, EPG-to-vzAny wins over vzAny-to-EPG).
● More-specific L4 rules win.
- Specific filters win over the “any” filter (for example, an EPG-to-EPG contract with a specific filter wins over one with a default filter).
- Specific destination wins over specific source (for example, sport-any-to-dport-80 wins over sport-80-to-dport-any).
● Deny actions win. Specific protocol wins.
- Within the same zoning-rule priority, deny + log wins over deny, which wins over redirect or permit action.
- Between redirect and permit actions, a more specific protocol and a specific L4 port win.
- Between redirect and permit, if the filters are the same, redirect wins over the permit.
Note
The lower the number of the priority, the higher the priority.
Cisco ACI Contract Priorities Summary Table
The following table provides a brief (common use cases) of contract priority used when filtering traffic:
When it is used | Source class id | Destination class id | Filter ID | Action | Note | Priority* |
Intra-EPG contract | EPG1 | EPG1 | Specific | Permit, deny, redirect, copy | class-eq-filter(1) | |
Taboo contract | 0 | EPG1 | Specific/default | Deny | Deny
traffic destined to an EPG that has a taboo contract | Black_list(5) |
inter-VRF EPG-to-vzAny Consumer VRF Intra-VRF ESG-to-vzAny | EPG1 /ESG1(global) | 0 | Specific | Permit, deny, redirect, copy | In the case of contract between an ESG
and vzAny (*) | shsrc_any_filt_perm |
EPG-to-EPG | EPG1 | EPG2 | Specific | Permit,
deny, redirect, copy | Intra-VRF
contract with nondefault filter between EPGs | fully_qual(7) |
EPG1 | EPG2 | Default (permit any) | Permit, deny, redirect, copy | Intra-VRF contract with default filter
between EPGs | src_dst_any(9) | |
EPG-to-vzAny | EPG1 | 0 | Specific (Default
priority is 15) | Permit,
deny, redirect, copy | src_any_filter(13) | |
vzAny-to-EPG | 0 | EPG1 | Specific (Default priority is 16) | Permit, deny, redirect, copy | any_dest_filter(14) | |
vzAny-to-vzAny | 0 | 0 | Specific | Permit,
deny, redirect, copy | any_any_filter(17) |
Cisco ACI Contract Priority Illustration Example
The figure below illustrates an example of a priority comparison between a specific EPG and vzAny.
If a vzAny-to-vzAny contract uses the SSH filter with the permit action (priority 17) and the EPG-to-EPG contract uses an SSH filter with a deny action (priority 7), all SSH traffic within the VRF is permitted except for SSH traffic from Web EPG to App EPG.
We can verify the rule priority from the command “show zoning-rule”
Pod1-Leaf1# show zoning-rule scope 2850817
+---------+--------+--------+----------+----------------+---------+---------+-------------------+----------+----------------------+
| Rule ID | SrcEPG | DstEPG | FilterID | Dir | operSt | Scope | Name | Action | Priority |
+---------+--------+--------+----------+----------------+---------+---------+-------------------+----------+----------------------+
| 4208 | 0 | 15 | implicit | uni-dir | enabled | 2850817 | | deny,log | any_vrf_any_deny(22) |
| 4247 | 0 | 32777 | implicit | uni-dir | enabled | 2850817 | | permit | any_dest_any(16) |
| 4207 | 0 | 0 | 67 | uni-dir-ignore | enabled | 2850817 | tenant1:Contract1 | permit | any_any_filter(17) |
| 4253 | 0 | 0 | 68 | bi-dir | enabled | 2850817 | tenant1:Contract1 | permit | any_any_filter(17) |
| 4249 | 32774 | 32775 | 68 | uni-dir-ignore | enabled | 2850817 | tenant1:Contract2 | deny | fully_qual(7) |
| 4211 | 32775 | 32774 | 67 | bi-dir | enabled | 2850817 | tenant1:Contract2 | deny | fully_qual(7) |
