For all the EPGs (EPG
collection) within a VRF to send traffic to an external destination,
each internal EPG must contract with the external EPG. Typically,
you would need to create a separate contract between each internal
EPG and the external EPG. However, using a vzAny object you can
apply the same contract to all EPGs dynamically. The EPG collection
consumes the contract and the external EPG provides the contract.
You can configure specific traffic profiles in the contract or send
all traffic to the firewall and allow it to control the traffic leaving
the datacenter. Additionally, any new EPG that joins the VRF will
automatically has the contract applied to it.