Distributed computer network zone based security architecture

1. A method comprising:

binding individual ports of a first network device to a security zone;

determining an ingress security zone associated with a packet received at an ingress port of the first network device based on a first key that identifies the first network device and a media access control (MAC) address of a source of a packet, wherein the ingress port of the first network device is bound to a first security zone prior to receipt of the packet at the ingress port, wherein the first security zone for the ingress port is defined by a first security level and the first key;

determining, from a MAC address for a destination of the packet, a second key that identifies a second network device that has an egress port for communicating the packet to the destination, wherein a software defined network (SDN) protocol is queried to determine the destination for the packet;

determining an egress security zone associated with the egress port of the second network device based on the egress port and the second key, wherein the egress port of the second network device is bound to a second security zone prior to transmission of the packet at the egress port, wherein the second security zone for the egress port is defined by a second security level and the second key;

performing a policy lookup based on the first security level and the first key of the ingress security zone and the second security level and the second key of the egress security zone in a policy table, wherein the policy lookup identifies a policy to apply to the packet when first security level and the second security level are different security levels, and wherein the policy lookup identifies a second policy allowing the forwarding of the packet when first security level of the first security zone and the second security level of the second security zone are at a same security level regardless of values of the first key and the second key;

applying the policy to the packet based on the first security level and the second security level when the ingress security zone and the egress security zone are different security zones; and

sending the packet to the destination based on the second key and an identifier of the destination, wherein layer 2 (L2) processing is performed at the destination to determine a final physical egress port for the packet, and wherein the L2 processing comprises a MAC lookup operation.

2. The method defined in claim 1 wherein the first network device is a security gateway device.

3. A network device for use in a distributed network environment having a plurality of network devices, the network device comprising:

a memory;

a network interface to receive IP packets; and

a processor, coupled to the memory and the network interface, operable to bind individual ports of a first network device to a security zone;

determine an ingress security zone associated with a packet received at an ingress port of the first network device based on a first key that identifies the first network device and a media access control (MAC) address of a source of a packet, wherein the ingress port of the first network device is bound to a first security zone prior to receipt of the packet at the ingress port, wherein the first security zone for the ingress port is defined by a first security level and the first key;

determine, from a MAC address for a destination of the packet, a second key that identifies a second network device that has an egress port for communicating the packet to the destination, wherein a software defined network (SDN) protocol is queried to determine the destination for the packet;

determine an egress security zone associated with the egress port of the second network device based on the egress port and the second key, wherein the egress port of the second network device is bound to a second security zone prior to transmission of the packet at the egress port, wherein the second security zone for the egress port is defined by a second security level and the second key;

perform a policy lookup based on the first security level and the first key of the ingress security zone and the second security level and the second key of the egress security zone in a policy table, wherein the policy lookup identifies a policy to apply to the packet when first security level and the second security level are different security levels, and wherein the policy lookup identifies a second policy allowing the forwarding of the packet when first security level of the first security zone and the second security level of the second security zone are at a same security level regardless of values of the first key and the second key;

apply the policy to the packet based on the first security level and the second security level when the ingress security zone and the egress security zone are different security zones; and

send the packet to the destination based on the second key and an identifier of the destination, wherein layer 2 (L2) processing is performed at the destination to determine a final physical egress port for the packet, and wherein the L2 processing comprises a MAC lookup operation.

4. The network device defined in claim 3 wherein the processor performs one or more security processing operations to the packet.

5. A computer-readable non-transitory storage medium having instructions stored therein, which when executed by a network device, cause the network device to perform a method, the method comprising:

binding individual ports of a first network device to a security zone;

determining an ingress security zone associated with a packet received at an ingress port of the first network device based on a first key that identifies the first network device and a media access control (MAC) address of a source of a packet, wherein the ingress port of the first network device is bound to a first security zone prior to receipt of the packet at the ingress port, wherein the first security zone for the ingress port is defined by a first security level and the first key;

determining, from a MAC address for a destination of the packet, a second key that identifies a second network device that has an egress port for communicating the packet to the destination, wherein a software defined network (SDN) protocol is queried to determine the destination for the packet;

determining an egress security zone of a second network device based on the egress port and the second key, wherein the egress port of the second network device is bound to a second security zone prior to transmission of the packet at the egress port, wherein the second security zone for the egress port is defined by a second security level and the second key;

performing a policy lookup based on the first security level and the first key of the ingress security zone and the second security level and the second key of the egress security zone in a policy table, wherein the policy lookup identifies a policy to apply to the packet when first security level and the second security level are different security levels, and wherein the policy lookup identifies a second policy allowing the forwarding of the packet when first security level of the first security zone and the second security level of the second security zone are at a same security level regardless of values of the first key and the second key;

applying the policy to the packet based on the first security level and the second security level when the ingress security zone and the egress security zone are different security zones; and

sending the packet to the destination based on the second key and an identifier of the destination, wherein layer 2 (L2) processing is performed at the destination to determine a final physical egress port for the packet, and wherein the L2 processing comprises a MAC lookup operation.