Introduction
Cisco ACI contracts are used to control communication between Endpoint Groups (EPGs). They provide application-centric security by defining which EPGs can communicate and what traffic is permitted.
In large-scale environments, a single contract may be consumed by many EPGs. However, there are situations where certain EPGs must be excluded from using that contract without creating multiple duplicate contracts.
To solve this challenge, Cisco introduced Contract Exceptions and Subject Exceptions in APIC Release 3.2(1).
These features allow administrators to selectively deny contract participation while maintaining a clean, scalable, and easy-to-manage policy model.
Why Contract Exceptions and Subject Exceptions Are Needed
Consider a production application environment with the following EPGs:
Consumer EPGs:
- Web-EPG
- App-EPG
- Reporting-EPG
- Test-EPG
Provider EPG:
- Database-EPG
Contract:
- DB-Access
Normally all consumer EPGs can access the database through the contract.
Web-EPG → Database-EPG
App-EPG → Database-EPG
Reporting-EPG → Database-EPG
Test-EPG → Database-EPG
Now assume the security team decides that Test-EPG should not access the production database.
Without Contract Exceptions, you would need to create additional contracts and duplicate policies.
With Contract Exceptions, you can simply exclude Test-EPG from participating in the contract.
What is a Contract Exception?
A Contract Exception selectively excludes an EPG from participating in a contract.
The key point is that the exception applies to ALL subjects within the contract.
For example:
Contract Name: DB-Access
Subjects:
- SQL
- Backup
- Monitoring
If Test-EPG is configured as a Contract Exception, it will be denied access to every subject under the contract.
Result:
- Web-EPG = Allowed
- App-EPG = Allowed
- Reporting-EPG = Allowed
- Test-EPG = Denied
This is useful when an EPG should be completely excluded from the contract.
What is a Subject Exception?
A Subject Exception applies only to a specific subject inside a contract.
Instead of blocking an entire contract, it blocks access only to a particular service.
For example:
Contract Name: Shared-Services
Subjects:
- HTTP
- HTTPS
- SQL
- DNS
Requirement:
- HTTP = Allowed
- HTTPS = Allowed
- DNS = Allowed
- SQL = Denied
In this scenario, a Subject Exception is the ideal solution because only the SQL subject needs to be restricted.
Contract Exception vs Subject Exception
Contract Exception affects the entire contract.
Subject Exception affects only a single subject.
Contract Exception is used when an EPG must be excluded completely.
Subject Exception is used when only specific services must be denied.
Contract Exception provides broader control.
Subject Exception provides finer granular control.
Real-World Production Example
Consider a banking environment.
Consumer EPGs:
- Internet-Web
- Mobile-App
- ATM-Services
- Audit-Tools
Provider EPG:
- Database-EPG
Contract:
- Database-Access
Business Requirement:
- Internet-Web = Allowed
- Mobile-App = Allowed
- ATM-Services = Allowed
- Audit-Tools = Denied
Without Contract Exceptions, multiple contracts would be required.
Database-Access
Database-Access-NoAudit
Database-Access-ATM
Database-Access-Web
This creates unnecessary complexity.
A better design is:
One shared Database-Access contract plus a Contract Exception for Audit-Tools.
This reduces contract sprawl and simplifies management.
Cisco ACI Contract Exception Configuration
Objective
Allow:
- Web-EPG
- App-EPG
- Reporting-EPG
Deny:
- Test-EPG
For the DB-Access contract.
Step 1: Create the Contract
Navigate to:
Tenant → Contracts → Standard → Create Contract
Configure:
Contract Name: DB-Access
Scope: Tenant
Step 2: Create a Subject
Open the DB-Access contract.
Navigate to:
Subjects → Create Subject
Configure:
Subject Name: SQL
Step 3: Create a Filter
Create a filter with:
Protocol: TCP
Destination Port: 1433
Action: Permit
Attach the filter to the SQL subject.
Step 4: Provide the Contract
Navigate to Database-EPG.
Under Provided Contracts, attach DB-Access.
Step 5: Consume the Contract
Navigate to:
- Web-EPG
- App-EPG
- Reporting-EPG
- Test-EPG
Attach DB-Access as a Consumed Contract.
At this stage all EPGs can access the database.
Step 6: Create Contract Exception
Navigate to:
Tenant → Contracts → DB-Access → Exceptions
Click Create Exception.
Configure:
Exception Name: Block-Test-EPG
Consumer EPG: Test-EPG
Save and Deploy.
Final Result
- Web-EPG → Allowed
- App-EPG → Allowed
- Reporting-EPG → Allowed
- Test-EPG → Denied
Because the exception is configured at the contract level, all subjects are affected.
Cisco ACI Subject Exception Configuration
Objective
Allow Web-EPG to access:
- HTTP
- HTTPS
- DNS
Deny access to:
- SQL
Step 1: Create Contract
Create a contract called Shared-Services.
Step 2: Create Subjects
Create the following subjects:
- HTTP
- HTTPS
- SQL
- DNS
Step 3: Attach Filters
HTTP Subject:
TCP Port 80
Permit
HTTPS Subject:
TCP Port 443
Permit
SQL Subject:
TCP Port 1433
Permit
DNS Subject:
UDP Port 53
Permit
Step 4: Create Subject Exception
Navigate to:
Shared-Services → Subject SQL → Exceptions
Click Create Exception.
Configure:
Exception Name: Web-No-SQL
EPG: Web-EPG
Save and Deploy.
Final Result
For Web-EPG:
- HTTP → Allowed
- HTTPS → Allowed
- DNS → Allowed
- SQL → Denied
Other EPGs continue to access SQL if no Subject Exception exists for them.
How Packet Processing Works
When traffic is initiated:
Step 1: Cisco ACI identifies the source EPG.
Step 2: Cisco ACI identifies the destination EPG.
Step 3: Contract lookup is performed.
Step 4: Subject filters are evaluated.
Step 5: Contract and Subject Exceptions are checked.
Step 6: Traffic is either permitted or denied.
This enables very granular policy enforcement within the ACI fabric.
Logging and Visibility Features
Contract Exceptions and Subject Exceptions support:
Labels
Useful for policy identification.
Examples:
- Production-SQL
- PCI-Restricted
- Database-Security
Counters
Used to track:
- Permit Hits
- Deny Hits
- Bytes
- Packets
Permit and Deny Logging
Helpful during troubleshooting and audits.
Administrators can determine whether traffic was blocked due to:
- Contract Exception
- Subject Exception
- Deny Filter
- Missing Contract
Troubleshooting Tips
Verify zoning rules using:
show zoning-rule scope tenant
Monitor contract counters from:
Tenant → Operations → Counters → Contracts
Review:
- Permit Hits
- Deny Hits
- Packet Counts
- Byte Counts
Check Events and Faults under:
Operations → Events
Operations → Faults
This helps quickly identify policy-related connectivity issues.
Design Best Practices
Use Contract Exceptions when:
- Development EPGs must be blocked completely.
- Test EPGs must be isolated.
- Audit environments should not reach production systems.
- Temporary projects require full exclusion.
Use Subject Exceptions when:
- HTTP should be allowed but SQL denied.
- HTTPS should be allowed but SSH denied.
- DNS should be allowed but ICMP denied.
Avoid creating multiple duplicate contracts.
Instead of:
Web-To-DB
App-To-DB
ATM-To-DB
Audit-To-DB
Use:
Shared Database Contract
Plus
Contract Exception or Subject Exception
This creates a simpler and more scalable design.
Interview Questions
Q1. What is the difference between Contract Exception and Subject Exception?
Contract Exception applies to the entire contract and affects all subjects. Subject Exception applies only to a specific subject within the contract.
Q2 Can Contract Exceptions be configured for both Providers and Consumers?
Yes. Contract Exceptions can exclude both provider and consumer EPGs.
Q3. When should Subject Exceptions be used?
When only specific application services need to be denied while allowing other services within the same contract.
Q4. Which APIC release introduced Contract and Subject Exceptions?
APIC Release 3.2(1).
Q5. What is the main benefit of Contract Exceptions?
They reduce contract sprawl and simplify policy management.
Key Takeaways
- Contract Exceptions apply to the entire contract.
- Subject Exceptions apply to a specific subject only.
- Both features were introduced in APIC 3.2(1).
- They help implement granular micro-segmentation.
- They reduce the need for duplicate contracts.
- Logging, counters, labels, and deny/permit monitoring are fully supported.
- They improve scalability and operational simplicity in large Cisco ACI deployments.
Conclusion
Contract Exceptions and Subject Exceptions are powerful Cisco ACI features that help architects implement flexible micro-segmentation policies without increasing configuration complexity. Contract Exceptions are ideal when an EPG must be excluded from an entire contract, while Subject Exceptions are best suited for restricting access to specific services within a contract. By using these features effectively, organizations can simplify policy management, reduce contract sprawl, improve security, and maintain a cleaner ACI policy model across the fabric.
Recommended for: CCNP Data Center, CCIE Data Center, ACI Administrators, Data Center Engineers, Network Architects, and anyone designing secure Cisco ACI environments.
Summary
Related Links
Useful for verifying contracts, providers/consumers, subjects, filters, and Taboo contracts.
Read the MoQuery guide
Related to ACI contract policy and EPG communication within a VRF.
Read the Contract Preferred Group guide
Provides a broader introduction to ACI contracts, EPGs, filters, and the deny-by-default model.
Read the Cisco ACI guide
Useful for reinforcing contract scope, filter direction, consumer/provider relationships, and
vzAny. Read the ACI MCQs
Useful as a related policy/security topic, particularly for understanding external EPG security import subnets and contract-based traffic control.
Read the L3Out Subnet Scope guide
