ACI Contract Blocks a Valid TCP/80 Session
A three-node APIC cluster manages a fabric with two spines and four leafs on release 5.2(8). Tenant PROD contains VRF PROD-VRF, BD-WEB (10.10.10.1/24), and BD-APP (10.20.20.1/24); both BDs have unicast routing enabled. Web servers sit in EPG WEB on leaf-101 and app servers in EPG APP on leaf-102. Contract WEB-TO-APP has one subject and one filter, TCP-80, with a single entry: EtherType IP, protocol TCP, source port 80, destination port unspecified, and Apply Both Directions checked. APP provides the contract and WEB consumes it. Endpoint learning shows both servers, each can ping its own default gateway, but a TCP SYN from a web server to an app server on port 80 never arrives, and the leaf interface counters show no drops. The contract is the only policy between the EPGs.
1. Explain the failure and the show commands that would confirm it.
Read the worked answer
An ACI filter entry with source port 80 matches TCP segments whose source port is 80. The web server's SYN has an ephemeral source port and destination port 80, so it does not match the entry and hits the contract's implicit deny. Because Apply Both Directions is checked, ACI also installs the reverse entry, which permits traffic sourced from port 80 toward the web server; that would cover return traffic, not the request.
Confirm with show zoning-rule on leaf-101 (the rule should show sport 80, dport any) and with the contract/filter configuration in APIC. show endpoint should show both servers learned in the expected EPGs, ruling out endpoint learning or VLAN-to-EPG mapping problems.
Interface counters are not the place to look: policy drops occur in the leaf's zoning/TCAM path and are not counted as interface errors, so clean counters do not mean the packet was permitted.
2. How do you correct the filter, and why does ACI contract statefulness matter here?
Read the worked answer
Edit the filter entry so that destination port is 80 and source port is unspecified, and leave Apply Both Directions checked so the reverse entry is generated for return traffic.
ACI contracts are not stateful by default: return traffic is allowed because the filter entry is applied in both directions, not because a session table exists. Removing that option would break the return path even after the forward fix. If server-initiated connections to the web tier are also required, add a separate entry rather than broadening the existing one.
After submitting the change, verify show zoning-rule shows the corrected rule and repeat the SYN test from the web server. Also confirm no other contract or taboo policy applies between these EPGs.
3. Why does pinging the default gateway succeed while the SYN fails?
Read the worked answer
Traffic to the default gateway terminates on the leaf's distributed anycast gateway SVI for BD-WEB. It never crosses from one EPG to another, so it is not evaluated against the WEB-TO-APP contract; that is why the ping works while the SYN fails.
The successful ping also proves the server's IP/mask/gateway, the EPG/BD binding, and the local VLAN encapsulation are correct, narrowing the fault to inter-EPG policy. For inter-EPG traffic, the leaf redirects the packet to the policy enforcement function and applies zoning rules derived from the contract; a mismatch in those rules causes a silent drop. This local-gateway-versus-remote-EPG split is a useful first diagnostic step in ACI.