Enforcing Intra-EPG Isolation with an Intra-EPG Contract in Cisco ACI
Short answer
DE Mark intra EPG isolation as enforced and configure an intra EPG contract under Web_EPG.
Question
Key Takeaways
Intra-EPG isolation blocks all communication between endpoints in the same EPG. To allow specific traffic (ICMP), you add an Intra-EPG Contract under that EPG. A taboo contract denies traffic and is not used here.
To permit only ICMP within an EPG while blocking all other intra-EPG traffic, enable Intra-EPG Isolation (Enforced) on the EPG and then configure an Intra-EPG Contract that allows ICMP. Isolation denies all intra-EPG traffic by default; the contract selectively permits ICMP.
Common mistake: Picking a taboo contract (C) — taboo contracts deny traffic even if otherwise allowed; with isolation you want a permit contract (D). Or enforcing isolation (E) alone without the contract would block ALL intra-EPG traffic including ICMP.
Expert Analysis
Why the Answer Is Correct
Enabling Intra-EPG Isolation (set to Enforced) on Web_EPG blocks all intra-EPG communication by default. To allow only ICMP, you configure an Intra-EPG Contract under Web_EPG that permits ICMP. Together (D + E) they achieve "only ICMP permitted within Web_EPG." A taboo contract is for denying, not the right tool.
Why the Other Options Are Wrong
A. Forward control proxy ARP is unrelated to permitting ICMP within an EPG. B. VRF policy control set to unenforced changes inter-EPG enforcement, not intra-EPG isolation. C. A taboo contract denies traffic and is the opposite of what is needed to permit ICMP.
Community Comment Notes
Community: "By enabling intra-EPG isolation, ACI blocks all communication between endpoints within the same EPG by default. After enabling isolation, you can create contracts to selectively allow certain types of traffic"; "D & E." Votes DE 83 / CE 17.
Official Reference
This link opens the official vendor documentation in a new tab.
Community Votes
83% of anonymous learners picked answer DE. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 4 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 4
-
xxbofh 👍 3By enabling intra-EPG isolation, ACI blocks all communication between endpoints within the same EPG by default. After enabling isolation, you can create contracts to selectively allow certain types of traffic between specific endpoints or classes of traffic.
-
bizzar7774 👍 1I choose D & E. I exclude C (taboo contract) because while regular contracts define permitted traffic, taboo contracts are used to specify traffic that should be denied, even if it would otherwise be allowed by a regular contract. So with intra EPG isolation, in my opinion a taboo contract does not make sense
-
Mr_Myself 👍 1D. Configure intra EPG contract under Web_EPG. E. Mark intra EPG isolation as enforced.
-
Sarauman 👍 1Contrat under EPg is called Taboo. A think is C and E.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.