Build and verify ACI tenant connectivity

Open ACI Fabrics from the lab canvas and select the workbench for this fabric.

In Fabric, check the controller, spine, and leaf switches against the lab topology.

Create the tenant, the routing instance, the bridge domain, and the two endpoint groups.

In Visore, query the tenant class, then open the new tenant by its distinguished name.

Set up the access policy, then bind each endpoint group to its leaf port and VLAN.

Correct the out-of-range VLAN to clear the path fault shown in the dashboard.

With no contract between these endpoint groups, the ping is blocked.

Create a contract with a filter for ICMP traffic.

Apply the contract between the provider and consumer endpoint groups.

Repeat the ping in both directions to verify that the contract permits the traffic.

Remove the consumer binding and verify that the ping is blocked again.

Reapply the contract and check that pings succeed in both directions.

The REST client can query the existing tenants and add a new one by distinguished name.

A mismatched distinguished name is rejected, and the tenant list stays the same.

Reopen the lab and verify that the saved policy still permits traffic.