Policy homomorphic network extension

1. A method of connecting a remote endpoint node that is outside a local local area network (LAN) to a virtual network within a network, the method comprising:

establishing a proxy device for the remote endpoint node, wherein the proxy device is local to a group of endpoint devices associated with the virtual network,

wherein the local proxy device is connected to the local LAN through a local router and the remote endpoint node is connected to the local LAN through a remote switch, and

wherein there is a local policy device on the local LAN which enforces policies for differing types of network traffic on the local LAN;

establishing a first connection between the proxy device and a local network device on the local LAN associated with the virtual network, wherein the local network device is local to the group of endpoint devices associated with the virtual network;

configuring the local network device such that the first connection belongs to the virtual network on the local network device, whereby the local network device is configured to:

forward, to the proxy device via the first connection, a first subset of received packets based on the first subset of received packets being associated with the virtual network, and

forward a second subset of received packets to respective destinations of the second subset of packets, wherein the second subset of received packets comprises packets received from the proxy device via the first connection; and

configuring the proxy device such that the first connection belongs to the virtual network on the proxy device, whereby the proxy device is configured to:

forward packets associated with the virtual network and received from the local network device via the first connection toward the remote endpoint node, and

forward packets associated with the virtual network and received from the remote endpoint node to the local network device via the first connection.

2. The method of claim 1 , wherein the first connection is a logical connection.

3. The method of claim 1 , further comprising:

establishing a second connection between the proxy device and a remote network device;

wherein the step of configuring the proxy device comprises configuring the proxy device to:

forward packets received from the local network device via the first connection toward the remote endpoint node via the second connection, and

forward packets received from the remote endpoint node via the second connection toward the local network device via the first connection.

4. The method of claim 3 , wherein the second connection is a logical connection.

5. The method of claim 1 , wherein:

the network further comprises a traffic management device that processes packets originating outside the virtual network and forwards the packets to the network device; and

packets received at the network device from the proxy device and destined for outside nodes are forwarded to the traffic management device.

6. The method of claim 1 , wherein the second subset of received packets comprises all packets destined for any node belonging to the virtual network.

7. The method of claim 1 , wherein the virtual network is a virtual local area network (ULAN).

8. The method of claim 1 , wherein the local network device and proxy device belong to the same local area network (LAN).

9. The method of claim 1 , wherein the remote endpoint node belongs to a cloud computing system.

10. The method of claim 1 , wherein the proxy device and local network device are connected to the Internet via another network device.

11. A non-transitory machine-readable storage medium encoded with instructions for execution by a network configuration device, the non-transitory machine-readable storage medium comprising:

instructions for establishing a proxy device for a remote endpoint node that is outside a local local area network (LAN), wherein the proxy device is local to a group of endpoint devices associated with a virtual network,

wherein the local proxy device is connected to the local LAN through a local router and the remote endpoint node is connected to the local LAN through a remote switch, and

wherein there is a local policy device on the local LAN which enforces policies for differing types of network traffic on the local LAN;

instructions establishing a first connection between the proxy device and a local network device on the local LAN associated with the virtual network, wherein the local network device is local to the group of endpoint devices associated with the virtual network;

instructions configuring the local network device such that the first connection belongs to the virtual network on the local network device, whereby the local network device is configured to:

forward, to the proxy device via the first connection, a first subset of received packets based on the first subset of received packets being associated with the virtual network, and

forward a second subset of received packets to respective destinations of the second subset of, wherein the second subset of received packets comprises packets received from the proxy device via the first connection; and

instructions configuring the proxy device such that the first connection belongs to the virtual network on the proxy device, whereby the proxy device is configured to:

forward packets associated with the virtual network and received from the local network device via the first connection toward the remote endpoint node, and

forward packets associated with the virtual network and received from the remote endpoint node to the local network device via the first connection.

12. The non-transitory machine-readable storage medium of claim 11 , wherein the first connection is a logical connection.

13. The non-transitory machine-readable storage medium of claim 11 , further comprising:

instructions for establishing a second connection between the proxy device and a remote network device;

wherein the instructions for of configuring the proxy device comprise instructions for configuring the proxy device to:

forward packets received from the local network device via the first connection toward the remote endpoint node via the second connection, and

forward packets received from the remote endpoint node via the second connection toward the local network device via the first connection.

14. The non-transitory machine-readable storage medium of claim 13 , wherein the second connection is a logical connection.

15. The non-transitory machine-readable storage medium of claim 12 , further comprising instructions for establishing a tunnel connection between the proxy device and one of: the remote endpoint node and a remote switch attached to the remote endpoint node.

16. The non-transitory machine-readable storage medium of claim 11 , wherein:

the network further comprises a traffic management device that processes packets originating outside the virtual network and forwards the packets to the network device; and

packets received at the network device from the proxy device and destined for outside nodes are forwarded to the traffic management device.

17. The non-transitory machine-readable storage medium of claim 11 , wherein the second subset of received packets comprises all packets destined for any node belonging to the virtual network.

18. The non-transitory machine-readable storage medium of claim 11 , wherein the virtual network is a virtual local area network (ULAN).

19. The non-transitory machine-readable storage medium of claim 11 , wherein the local network device and proxy device belong to the same local area network (LAN).

20. The non-transitory machine-readable storage medium of claim 11 , wherein the remote endpoint node belongs to a cloud computing system.