Which feature in ACI permits the user to specify that HTTP and HTTPS traffic between an L3out EPG and an internal EPG is sent to a firewall , and SSH and Telnet traffic between the L3Out and the internal EPG bypasses the firewall?

Which feature in ACI permits the user to specify that HTTP and HTTPS traffic between an L3out EPG and an internal EPG is sent to a firewall , and SSH and Telnet traffic between the L3Out and the internal EPG bypasses the firewall?
A. policy-based redirect
B. Layer 4 – Layer 7 function profile
C. vzAny contract
D. contracts and filters