An engineer is implementing an out-of-band (OOB) management access for the Cisco ACI fabric. The secure access must meet these requirements: - Only GUI and secure shell must be allowed to access the…

An OOB contract is the ACI mechanism used to define permissible communication between the out-of-band management network and the ACI fabric's management interfaces. By implementing HTTPS and SSH protocol filters within this contract, and associating the required IP ranges as external EPG subnets, both the protocol and source IP requirements are met.

Setting static IPs on the management interfaces defines the fabric's own management addresses, but does not control which source IP ranges are permitted to connect or what protocols they can use.

Creating an out-of-band EPG is a necessary step for OOB management but by itself does not specify the allowed protocols or the permitted source IP ranges for access.

While an OOB EPG is required, it is created within the 'mgmt' tenant, not the 'common' tenant, and this action alone does not define the access policies.