End-to-end transactional microsegmentation
Techniques for microsegmenting network communication transactions from end-to-end over an entire network communication path between a client device and a workload. The techniques may include determining that a first layer of a packet traversing the communication path includes a first metadata tag associated with a first segmentation ecosystem applying a microsegmentation policy along a first portion of the communication path. Based at least in part on the first metadata tag, a second metadata tag may be determined that is associated with a second segmentation ecosystem applying the microsegmentation policy along a second portion of the communication path. The second metadata tag may then be embedded within a second layer of the packet such that the second segmentation ecosystem is capable of applying the microsegmentation policy to the packet along the second portion of the communication path.
1 . A method comprising:
receiving a protocol data unit that is traversing a communication path through a network between a client device and a workload, the protocol data unit associated with a communication transaction between the client device and the workload;
determining that the protocol data unit includes a first metadata tag associated with a first layer in a communication reference model, the first metadata tag associated with a first segmentation ecosystem applying a microsegmentation policy along a first portion of the communication path; and
converting the first metadata tag into a second metadata tag associated with a second layer in the communication reference model, the first and second layers being different layers in the communication reference model, the converting including embedding the second metadata tag within a second layer of the protocol data unit to enable a second segmentation ecosystem to apply the microsegmentation policy to the protocol data unit along a second portion of the communication path.
2 . The method of claim 1 , wherein the second segmentation ecosystem is incapable of accessing a first layer of the protocol data unit to utilize the first metadata tag to apply the microsegmentation policy along the second portion of the communication path.
3 . The method of claim 1 , wherein the first portion of the communication path is at least one of a virtual private network (VPN) session, a zero-trust network access (ZTNA) session, or a secure shell (SSH) session between the client device and the workload and the second portion of the communication path is an application-level session between the client device and the workload.
4 . The method of claim 1 , wherein the first layer is an application layer and the second layer is a network layer.
5 . The method of claim 1 , wherein the first segmentation ecosystem is an application-level microsegmentation ecosystem and the second segmentation ecosystem is a network-level segmentation ecosystem.
6 . The method of claim 1 , wherein applying the microsegmentation policy along the second portion of the communication path comprises segmenting the protocol data unit from other protocol data units associated with other communication transactions that are traversing at least one of the communication path or the network.
7 . The method of claim 1 , wherein the protocol data unit is one of multiple protocol data units associated with the communication transaction, and wherein embedding the second metadata tag within the second layer of the protocol data unit comprises embedding the second metadata tag within the second layer of each of the multiple protocol data units associated with the communication transaction such that the second segmentation ecosystem is capable of applying the microsegmentation policy to the multiple protocol data units to segment the communication transaction from other traffic traversing the network.
8 . A system comprising:
one or more processors; and
one or more non-transitory computer-readable media storing instructions that, when executed, caused the one or more processors to perform operations comprising:
receiving a protocol data unit that is traversing a communication path through a network between a client device and a workload, the protocol data unit associated with a communication transaction between the client device and the workload;
determining that the protocol data unit includes a first metadata tag associated with a first layer in a communication reference model, the first metadata tag associated with a first segmentation ecosystem applying a microsegmentation policy along a first portion of the communication path; and
converting the first metadata tag into a second metadata tag associated with a second layer in the communication reference model, the first and second layers being different layers in the communication reference model, the converting including embedding the second metadata tag within a second layer of the protocol data unit to enable a second segmentation ecosystem to apply the microsegmentation policy to the protocol data unit along a second portion of the communication path.
9 . The method of claim 1 , wherein the second segmentation ecosystem is incapable of accessing a first layer of the protocol data unit to utilize the first metadata tag to apply the microsegmentation policy along the second portion of the communication path.
10 . The system of claim 8 , wherein the first portion of the communication path is at least one of a virtual private network (VPN) session, a zero-trust network access (ZTNA) session, or a secure shell (SSH) session between the client device and the workload and the second portion of the communication path is an application-level session between the client device and the workload.
11 . The system of claim 8 , wherein the first layer is an application layer and the second layer is a network layer.
12 . The system of claim 8 , wherein the first segmentation ecosystem is an application-level microsegmentation ecosystem and the second segmentation ecosystem is a network-level segmentation ecosystem.
13 . The system of claim 8 , wherein applying the microsegmentation policy along the second portion of the communication path comprises segmenting the protocol data unit from other protocol data units associated with other communication transactions that are traversing at least one of the communication path or the network.
14 . The system of claim 8 , wherein the protocol data unit is one of multiple protocol data units associated with the communication transaction, and wherein embedding the second metadata tag within the second layer of the protocol data unit comprises embedding the second metadata tag within the second layer of each of the multiple protocol data units associated with the communication transaction such that the second segmentation ecosystem is capable of applying the microsegmentation policy to the multiple protocol data units to segment the communication transaction from other traffic traversing the network.
15 . A non-transitory computer-readable medium storing instructions that, when executed, cause one or more processors to perform operations comprising:
receiving a protocol data unit that is traversing a communication path through a network between a client device and a workload, the protocol data unit associated with a communication transaction between the client device and the workload;
determining that the protocol data unit includes a first metadata tag associated with a first layer in a communication reference model, the first metadata tag associated with a first segmentation ecosystem applying a microsegmentation policy along a first portion of the communication path; and
converting the first metadata tag into a second metadata tag associated with a second layer in the communication reference model, the first and second layers being different layers in the communication reference model, the converting including embedding the second metadata tag within a second layer of the protocol data unit to enable a second segmentation ecosystem to apply the microsegmentation policy to the protocol data unit along a second portion of the communication path.
16 . The method of claim 1 , wherein the second segmentation ecosystem is incapable of accessing a first layer of the protocol data unit to utilize the first metadata tag to apply the microsegmentation policy along the second portion of the communication path.
17 . The non-transitory computer-readable medium of claim 15 , wherein the first portion of the communication path is at least one of a virtual private network (VPN) session, a zero-trust network access (ZTNA) session, or a secure shell (SSH) session between the client device and the workload and the second portion of the communication path is an application-level session between the client device and the workload.
18 . The non-transitory computer-readable medium of claim 15 , wherein the first layer is an application layer and the second layer is a network layer.
19 . The non-transitory computer-readable medium of claim 15 , wherein the first segmentation ecosystem is an application-level microsegmentation ecosystem and the second segmentation ecosystem is a network-level segmentation ecosystem.
20 . The non-transitory computer-readable medium of claim 15 , wherein applying the microsegmentation policy along the second portion of the communication path comprises segmenting the protocol data unit from other protocol data units associated with other communication transactions that are traversing at least one of the communication path or the network.