In most networks everything can talk unless something blocks it. ACI starts the other way: EPGs cannot talk until a contract allows it. PC1 is in EPG WEB and PC2 in EPG APP, and each reaches its own gateway. Allow WEB to reach APP with a contract: a filter says what traffic, a subject groups filters, and one EPG provides the contract while the other consumes it.
