Reverse filter and apply in both directions is default. If a filter allows traffic from any consumer port to a provider port (e.g. 8888), if reverse port filtering is enabled and the contract is applied both directions (say for TCP traffic), either the consumer or the provider can initiate communication. The provider could open up a TCP socket to the consumer using port 8888, whether the provider or consumer sent traffic first. https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/1- x/Operating_ACI/guide/b_Cisco_Operating_ACI/b_Cisco_Operating_ACI_chapter_01000.html