Fine-grained role-based segmentation in overlay network

1 . A method comprising:

receiving, by a first switch of an overlay tunnel fabric, a route update packet, wherein the route update packet comprises a first media access control (MAC) address learned at a second switch and a first role identifier of a first role associated with the first MAC address, wherein the first role indicates a level of access granted to a first device associated with the first MAC address in the overlay tunnel fabric, and wherein the route update packet is based on a control plane that allows exchange of route information via a tunnel;

storing, by the first switch, the first MAC address and the first role identifier in a local address data structure;

receiving, by the first switch, a packet from the first device, wherein the packet is destined to a local device; and

determining, based on the first role identifier and a first segmentation policy, whether the local device is allowed to receive the packet from the first device, wherein the first segmentation policy is associated with respective roles of the first and local devices.

2 . The method of claim 1 , wherein the route update packet further comprises an Internet Protocol (IP) address of the first device and a virtual network identifier (VNI) associated with a virtual local area network (VLAN) of the first device.

3 . The method of claim 2 , further comprising storing the IP address, the VNI, and an address of a remote tunnel endpoint of the tunnel in association with the first MAC address in the local address data structure.

4 . The method of claim 1 , wherein the local address data structure comprises a MAC address learning table stored in forwarding hardware of the first switch.

5 . The method of claim 1 , further comprising:

learning, by the second switch, the first MAC address via a local port connected to the first device;

discovering, by the second switch, the first role associated with the first MAC address;

adding, by the second switch, the first MAC address and the first role identifier to the route update packet; and

sending, by the second switch, the route update packet through a network for receipt by one or more other switches.

6 . The method of claim 1 , further comprising:

learning, by the first switch, a second MAC address and a second role identifier of a second device via a local port connected to the second device;

determining, by the first switch, whether a second segmentation policy associated with the second role identifier is locally configured at the first switch; and

in response to determining that the second segmentation policy is not locally configured at the first switch, performing a corrective action for the second device.

7 . The method of claim 6 , wherein the corrective action for the second device comprises one of:

retrieving, by the first switch, the second segmentation policy from a policy repository and locally configuring the second segmentation policy at the first switch; or

preventing the second device from communicating with the overlay tunnel fabric via the first switch.

8 . The method of claim 1 , wherein the control plane is based on an Ethernet virtual private network (EVPN), and wherein the route update packet is one of: an EVPN route type 2 or an EVPN Network Layer reachability information (NLRI) of a new type for sharing information associated with a role.

9 . The method of claim 1 , wherein the route update packet comprises:

a plurality of MAC addresses that includes the first MAC addresses; and

respective role identifiers associated with the plurality of MAC addresses.

10 . The method of claim 1 , wherein the overlay tunnel fabric is a first overlay tunnel fabric, and the first switch receives the packet from the first device after the first device has migrated from a second overlay tunnel fabric comprising the second switch to the first overlay tunnel fabric.

11 . The method of claim 10 , wherein the route update packet is received at the first switch over the tunnel between a tunnel endpoint in the second overlay tunnel fabric and a tunnel endpoint in the first overlay tunnel fabric.

12 . A non-transitory computer-readable storage medium storing instructions that when executed by a processor of a first switch cause the first switch to:

receive, at the first switch of an overlay tunnel fabric, a route update packet, wherein the route update packet comprises a first media access control (MAC) address learned at a second switch and a first role identifier of a first role associated with the first MAC address, wherein the first role indicates a level of access granted to a first device associated with the first MAC address in the overlay tunnel fabric;

store the first MAC address and the first role identifier in an address data structure of the first switch;

receive, at the first switch, a packet from the first device, wherein the packet is destined to a local device in the overlay tunnel fabric; and

determine, based on the first role identifier and a first segmentation policy, whether the local device is allowed to receive the packet from the first device, wherein the first segmentation policy is associated with the first role of the first device and a role of the local device.

13 . The non-transitory computer-readable storage medium of claim 12 , wherein the route update packet further comprises an Internet Protocol (IP) address of the first device and a virtual network identifier (VNI) associated with a virtual local area network (VLAN) to which the first device is connected, and wherein the instructions when executed cause the first switch to:

store the IP address, the VNI, and an address of a remote tunnel endpoint of a tunnel in association with the first MAC address in the address data structure.

14 . The non-transitory computer-readable storage medium of claim 13 , wherein the overlay tunnel fabric is a first overlay tunnel fabric, and the packet is received at the first switch from the first device after the first device has migrated from a second overlay tunnel fabric comprising the second switch to the first overlay tunnel fabric.

15 . The non-transitory computer-readable storage medium of claim 14 , wherein the route update packet is received at the first switch over a tunnel between a tunnel endpoint in the second overlay tunnel fabric and a tunnel endpoint in the first overlay tunnel fabric.

16 . The non-transitory computer-readable storage medium of claim 12 , wherein the instructions when executed cause the first switch to:

learn a second MAC address and a second role identifier of a second device via a local port connected to the second device;

determine whether a second segmentation policy associated with the second role identifier is locally configured at the first switch; and

in response to determining that the second segmentation policy is not locally configured at the first switch, perform a corrective action for the second device.

17 . The non-transitory computer-readable storage medium of claim 16 , wherein the corrective action for the second device comprises one of:

retrieving, by the first switch, the second segmentation policy from a policy repository and locally configuring the second segmentation policy at the first switch; or

preventing the second device from communicating with the overlay tunnel fabric via the first switch.

18 . The non-transitory computer-readable storage medium of claim 14 , wherein the first role identifier for the first device being stored in the address data structure allows the first device to communicate with the overlay tunnel fabric via the first switch without the first device first having to perform reauthentication.

19 . A first switch, comprising:

a processor; and

a communication port to receive a route update packet in an overlay tunnel fabric, wherein the route update packet comprises a first media access control (MAC) address learned at a second switch and a first role identifier of a first role associated with the first MAC address, wherein the first role indicates a level of access granted to a first device associated with the first MAC address in the overlay tunnel fabric;

wherein the processor is to:

store the first MAC address and the first role identifier in an address data structure of the first switch;

identify a packet received from the first device, wherein the packet is destined to a local device in the overlay tunnel fabric; and

determine, based on the first role identifier and a first segmentation policy, whether the local device is allowed to receive the packet from the first device, wherein the first segmentation policy is associated with the first role of the first device and a role of the local device.

20 . The first switch of claim 19 , wherein the overlay tunnel fabric is a first overlay tunnel fabric, and the packet is received at the first switch from the first device after the first device has migrated from a second overlay tunnel fabric comprising the second switch to the first overlay tunnel fabric.