In Cisco ACI, contracts are used to define the policies that govern communication between End Point Groups (EPGs). A contract specifies which types of traffic are permitted or denied between EPGs. To allow all IP traffic except SSH, you would configure the contract to permit all IP traffic and then deny SSH specifically.
This is typically done by defining filters within the contract that match on the SSH protocol and setting the action to deny.
References:
* Implementing Cisco Application Centric Infrastructure - Advanced (DCACIA) course materials and official certification guide can provide more detailed information on this topic12.
* Cisco's official documentation and training materials are also a good resource for understanding the configuration and management of contracts in ACI