tenant.contract

A contract is a logical container for the subjects which relate to the filters that govern the rules for communication between endpoint groups (EPGs). Without a contract, the default forwarding policy is to not allow any communication between EPGs but all communication within an EPG is allowed.

ACI class	vzBrCP
RN	brc-{name}
Cursor	ContractCursor
Parent	tenant
Atomic	—

Attributes

Accepted as keyword arguments of .contract(name) and of .set(**attrs) on this cursor. Enum parameters also accept the plain string.

parameter	wire	type	values	default	description
name (positional)	name	str	—	—	Name of a contract to apply between two or more EPGs under the Application Profile.
az_network_security_group_rule	azNetworkSecurityGroupRule	str	—	—	A Contract can depend on a subject exposed by another contract. Example: An application contract can depened on a Web/DB subject exposed by another contract. A contract consuming entity, consumes all the dependencies as well. TODO: How to detect dependency loops?
description	descr	str	—	—	Specifies a description of the policy definition.
intent	intent	VzIntent	estimate_add, estimate_delete, install	install	—
owner_key	ownerKey	str	—	—	The key for enabling clients to own their data for entity correlation.
owner_tag	ownerTag	str	—	—	A tag for enabling clients to add their own data. For example, to indicate who created this object.
qos_class_id	prio	QosTenantPrio	level1, level2, level3, level4, level5, level6, unspecified	unspecified	—
scope	scope	VzScope	application-profile, context, global, tenant	context	Represents the scope of this contract. If the scope is set as application-profile, the epg can only communicate with epgs in the same application-profile
contract_level_dscp	targetDscp	int	—	unspecified	contract level dscp value

Children

maker	creates	position
.subject(name, **attrs)	vzSubj	tenant.contract.subject
.exception(name, **attrs)	vzException	tenant.contract.exception

Bind aliases

Lazy references, resolved closed-world at push time.

alias	target	flavor	relation
service_graph=	vnsAbsGraph	name	vzRsGraphAtt

APIC diagnostics

States the APIC can flag on this class — it accepts the configuration and reports the inconsistency afterwards.

Config issues

code	meaning
any-to-prov-shared-service	Private Network Cannot be a Provider in Shared Service Scenario
filter-not-present	Filter Not Present
subject-not-in-use-due-to-label	No EPG Has Label For This Subject
taboo-has-no-filter	Taboo Not associated to Any Filter