A regional hospital keeps many virtual machines in one ACI EPG because they share a VLAN. Only the imaging VMs should be limited to a single port toward the archive. Those VMs can be identified by a vCenter attribute. What enforces that smaller group?
Select an answer to reveal the explanation.
Short Explanation
The VLAN put every guest in one room, so you need a name tag. A microsegmented EPG matches the imaging attribute and lets a contract speak for that smaller group. Making the VLAN pool larger does not split the room.
Full Explanation
Microsegmentation builds an EPG from attributes such as a VM name, guest OS, or a vCenter tag, instead of from the VLAN alone. The hospital can match the imaging attribute, place those VMs in a microsegmented EPG, and apply a contract that allows only the archive port. The rest of the shared VLAN is no longer stuck with that same contract relationship. Hardware proxy changes unknown-unicast forwarding. It does not classify endpoints or isolate VMs that share a VLAN. A larger VLAN pool adds encapsulations the fabric may use. It does not create a security group inside an EPG. Preferred group permits communication among its members. It does not restrict the imaging VMs to a single port. Caveat: the attribute has to be present in vCenter and collected by the VMM domain, or the microsegmented EPG stays empty and the contract protects nobody. Operational check: confirm the imaging VMs land in the microsegmented EPG, then test that only the archive port succeeds and a different port from the same VM is denied.