Enforcing Intra-EPG Isolation with an Intra-EPG Contract in Cisco ACI
Apply network security
AnswerCorrect answer: DE — Mark intra EPG isolation as enforced and configure an intra EPG contract under Web_EPG.
Refer to the exhibit. Three operational endpoints are deployed under the same application EPG. Only the ICMP traffic must be permitted within the Web_EPG. Which two actions must be taken to accomplish this goal? (Choose two.) -
Check box of forward control proxy ARP.
Set VRF policy control preference to unenforced.
Add Taboo contract on the Web_EPG.
Configure intra EPG contract under Web_EPG. Correct Answer
Mark intra EPG isolation as enforced. Correct Answer
Community Votes
DE
83%
CE
17%
83% of anonymous learners picked answer DE.
Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
Intra-EPG isolation blocks all communication between endpoints in the same EPG. To allow specific traffic (ICMP), you add an Intra-EPG Contract under that EPG. A taboo contract denies traffic and is not used here.
To permit only ICMP within an EPG while blocking all other intra-EPG traffic, enable Intra-EPG Isolation (Enforced) on the EPG and then configure an Intra-EPG Contract that allows ICMP. Isolation denies all intra-EPG traffic by default; the contract selectively permits ICMP.
Picking a taboo contract (C) — taboo contracts deny traffic even if otherwise allowed; with isolation you want a permit contract (D). Or enforcing isolation (E) alone without the contract would block ALL intra-EPG traffic including ICMP.
Community Discussion (4 comments)
bizzar7774👍 1Selected: DE
I choose D & E. I exclude C (taboo contract) because while regular contracts define permitted traffic, taboo contracts are used to specify traffic that should be denied, even if it would otherwise be allowed by a regular contract. So with intra EPG isolation, in my opinion a taboo contract does not make sense
xxbofh👍 3Selected: DE
By enabling intra-EPG isolation, ACI blocks all communication between endpoints within the same EPG by default. After enabling isolation, you can create contracts to selectively allow certain types of traffic between specific endpoints or classes of traffic.
Sarauman👍 1Selected: CE
Contrat under EPg is called Taboo. A think is C and E.
Mr_Myself👍 1Selected: DE
D. Configure intra EPG contract under Web_EPG. E. Mark intra EPG isolation as enforced.
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Log in to comment, report an error, or add a note about this question.
Expert Analysis
Why the Answer Is Correct
Enabling Intra-EPG Isolation (set to Enforced) on Web_EPG blocks all intra-EPG communication by default. To allow only ICMP, you configure an Intra-EPG Contract under Web_EPG that permits ICMP. Together (D + E) they achieve "only ICMP permitted within Web_EPG." A taboo contract is for denying, not the right tool.
Why the Other Options Are Wrong
A. Forward control proxy ARP is unrelated to permitting ICMP within an EPG. B. VRF policy control set to unenforced changes inter-EPG enforcement, not intra-EPG isolation. C. A taboo contract denies traffic and is the opposite of what is needed to permit ICMP.
Community Comment Notes
Community: "By enabling intra-EPG isolation, ACI blocks all communication between endpoints within the same EPG by default. After enabling isolation, you can create contracts to selectively allow certain types of traffic"; "D & E." Votes DE 83 / CE 17.
