Port level policy isolation in overlay networks

1. A method for managing communication over one or more networks using one or more network computers, wherein execution of instructions by the one or more network computers perform the method comprising:

providing an underlay network that communicatively couples a source gateway and a target gateway using one or more underlay protocols, wherein the target gateway includes two or more port groups that are each associated with a separate target node;

providing an overlay network on the underlay network based on policy information, wherein the source gateway and the target gateway are each assigned separate gateway identifiers (GIDs) that are associated with the overlay network; and

in response to the source gateway authorizing a source node to employ the overlay network to communicate one or more encrypted payloads to a target node, performing further actions, including:

providing a virtual device address for the target gateway to the source gateway, wherein the virtual device address is based on the GID assigned to the target gateway, and wherein the virtual device address is employed as a device address of the target gateway on the underlay network;

employing the underlay network and the virtual device address to communicate network traffic from the source node to the target gateway, wherein the network traffic includes a protocol address of the target node and the one or more encrypted payloads;

determining a device address of a port group on the target gateway associated with the target node based on the protocol address of the target node and the policy information; and

employing the device address of the port group to provide the one or more encrypted payloads to the target node, wherein each encrypted payload is decrypted by the target node.

2. The method of claim 1 , wherein providing the overlay network, further comprises:

enabling encrypted payloads to be exchanged between one or more source nodes associated with the source gateway and the two or more target nodes using an overlay protocol that is separate from the one or more underlay protocols.

3. The method of claim 1 , further comprising:

providing the policy information to the target gateway and the source gateway;

determining one or more access rules that enable the source node to provide network traffic to the target node over the overlay network based on the policy information; and

associating the target node with the port group on the target gateway.

4. The method of claim 1 , wherein providing the virtual device address for the target gateway, further comprises:

employing the underlay network to request a device address of the target gateway based on a protocol address that corresponds to the target gateway, wherein the protocol address of the target gateway is based on the GID assigned to the target gateway;

determining the virtual device address of the target gateway based on the protocol address associated with the target gateway; and

employing the one or more underlay protocols to communicate the virtual device address to the source gateway.

5. The method of claim 1 , further comprising:

employing the underlay network to provide a device address of the source gateway to the source node; and

employing the underlay network and the device address of the source gateway to communicate the one or more encrypted packets to the source gateway.

6. The method of claim 1 , further comprising:

employing the underlay network to communicate one or more other encrypted packets from the source node to another target node, wherein the other target node is associated with another port group on the source gateway, wherein the other port group is separate from a port group associated with the source node;

determining another device address of the other port group based on another protocol address associated with the other target node; and

employing the underlay network and the other device address of the other port group to communicate the one or more other encrypted packets from the source gateway to the other target via the other port group.

7. A system for managing communication over one or more networks, comprising:

one or more gateway computers, comprising:

a transceiver that communicates over the network;

a memory that stores at least instructions; and

one or more processors that execute instructions that perform actions, including:

providing an underlay network that communicatively couples a source gateway and a target gateway using one or more underlay protocols, wherein the target gateway includes two or more port groups that are each associated with a separate target node;

providing an overlay network on the underlay network based on policy information, wherein the source gateway and the target gateway are each assigned separate gateway identifiers (GIDs) that are associated with the overlay network; and

in response to the source gateway authorizing a source node to employ the overlay network to communicate one or more encrypted payloads to a target node, performing further actions, including:

providing a virtual device address for the target gateway to the source gateway, wherein the virtual device address is based on the GID assigned to the target gateway, and wherein the virtual device address is employed as a device address of the target gateway on the underlay network;

employing the underlay network and the virtual device address to communicate network traffic from the source node to the target gateway, wherein the network traffic includes a protocol address of the target node and the one or more encrypted payloads;

determining a device address of a port group on the target gateway associated with the target node based on the protocol address of the target node and the policy information; and

employing the device address of the port group to provide the one or more encrypted payloads to the target node, wherein each encrypted payload is decrypted by the target node; and

one or more node computers, comprising:

a transceiver that communicates over the network;

a memory that stores at least instructions; and

one or more processors that execute instructions that perform actions, including: providing a portion of the one or more encrypted payloads.

8. The system of claim 7 , wherein providing the overlay network, further comprises:

enabling encrypted payloads to be exchanged between one or more source nodes associated with the source gateway and the two or more target nodes using an overlay protocol that is separate from the one or more underlay protocols.

9. The system of claim 7 , further comprising:

providing the policy information to the target gateway and the source gateway;

determining one or more access rules that enable the source node to provide network traffic to the target node over the overlay network based on the policy information; and

associating the target node with the port group on the target gateway.

10. The system of claim 7 , wherein providing the virtual device address for the target gateway, further comprises:

employing the underlay network to request a device address of the target gateway based on a protocol address that corresponds to the target gateway, wherein the protocol address of the target gateway is based on the GID assigned to the target gateway;

determining the virtual device address of the target gateway based on the protocol address associated with the target gateway; and

employing the one or more underlay protocols to communicate the virtual device address to the source gateway.

11. The system of claim 7 , further comprising:

employing the underlay network to provide a device address of the source gateway to the source node; and

employing the underlay network and the device address of the source gateway to communicate the one or more encrypted packets to the source gateway.

12. The system of claim 7 , further comprising:

employing the underlay network to communicate one or more other encrypted packets from the source node to another target node, wherein the other target node is associated with another port group on the source gateway, wherein the other port group is separate from a port group associated with the source node;

determining another device address of the other port group based on another protocol address associated with the other target node; and

employing the underlay network and the other device address of the other port group to communicate the one or more other encrypted packets from the source gateway to the other target via the other port group.

13. A processor readable non-transitory storage media that includes instructions for managing communication over one or more networks, wherein execution of the instructions by the one or more network computers perform the method comprising:

providing an underlay network that communicatively couples a source gateway and a target gateway using one or more underlay protocols, wherein the target gateway includes two or more port groups that are each associated with a separate target node;

providing an overlay network on the underlay network based on policy information, wherein the source gateway and the target gateway are each assigned separate gateway identifiers (GIDs) that are associated with the overlay network; and

in response to the source gateway authorizing a source node to employ the overlay network to communicate one or more encrypted payloads to a target node, performing further actions, including:

providing a virtual device address for the target gateway to the source gateway, wherein the virtual device address is based on the GID assigned to the target gateway, and wherein the virtual device address is employed as a device address of the target gateway on the underlay network;

employing the underlay network and the virtual device address to communicate network traffic from the source node to the target gateway, wherein the network traffic includes a protocol address of the target node and the one or more encrypted payloads;

determining a device address of a port group on the target gateway associated with the target node based on the protocol address of the target node and the policy information; and

employing the device address of the port group to provide the one or more encrypted payloads to the target node, wherein each encrypted payload is decrypted by the target node.

14. The media of claim 13 , wherein providing the overlay network, further comprises:

enabling encrypted payloads to be exchanged between one or more source nodes associated with the source gateway and the two or more target nodes using an overlay protocol that is separate from the one or more underlay protocols.

15. The media of claim 13 , further comprising:

providing the policy information to the target gateway and the source gateway;

determining one or more access rules that enable the source node to provide network traffic to the target node over the overlay network based on the policy information; and

associating the target node with the port group on the target gateway.

16. The media of claim 13 , wherein providing the virtual device address for the target gateway, further comprises:

employing the underlay network to request a device address of the target gateway based on a protocol address that corresponds to the target gateway, wherein the protocol address of the target gateway is based on the GID assigned to the target gateway;

determining the virtual device address of the target gateway based on the protocol address associated with the target gateway; and

employing the one or more underlay protocols to communicate the virtual device address to the source gateway.

17. The media of claim 13 , further comprising:

employing the underlay network to provide a device address of the source gateway to the source node; and

employing the underlay network and the device address of the source gateway to communicate the one or more encrypted packets to the source gateway.

18. The media of claim 13 , further comprising:

employing the underlay network to communicate one or more other encrypted packets from the source node to another target node, wherein the other target node is associated with another port group on the source gateway, wherein the other port group is separate from a port group associated with the source node;

determining another device address of the other port group based on another protocol address associated with the other target node; and

employing the underlay network and the other device address of the other port group to communicate the one or more other encrypted packets from the source gateway to the other target via the other port group.

19. A network computer for managing communication over one or more networks, comprising:

a transceiver that communicates over the network;

a memory that stores at least instructions; and

one or more processors that execute instructions that perform actions, including:

providing an underlay network that communicatively couples a source gateway and a target gateway using one or more underlay protocols, wherein the target gateway includes two or more port groups that are each associated with a separate target node;

providing an overlay network on the underlay network based on policy information, wherein the source gateway and the target gateway are each assigned separate gateway identifiers (GIDs) that are associated with the overlay network; and

in response to the source gateway authorizing a source node to employ the overlay network to communicate one or more encrypted payloads to a target node, performing further actions, including:

providing a virtual device address for the target gateway to the source gateway, wherein the virtual device address is based on the GID assigned to the target gateway, and wherein the virtual device address is employed as a device address of the target gateway on the underlay network;

employing the underlay network and the virtual device address to communicate network traffic from the source node to the target gateway, wherein the network traffic includes a protocol address of the target node and the one or more encrypted payloads;

determining a device address of a port group on the target gateway associated with the target node based on the protocol address of the target node and the policy information; and

employing the device address of the port group to provide the one or more encrypted payloads to the target node, wherein each encrypted payload is decrypted by the target node.

20. The network computer of claim 19 :

wherein providing the overlay network, further comprises, enabling encrypted payloads to be exchanged between one or more source nodes associated with the source gateway and the two or more target nodes using an overlay protocol that is separate from the one or more underlay protocols.

21. The network computer of claim 19 , further comprising:

providing the policy information to the target gateway and the source gateway;

determining one or more access rules that enable the source node to provide network traffic to the target node over the overlay network based on the policy information; and

associating the target node with the port group on the target gateway.

22. The network computer of claim 19 , wherein providing the virtual device address for the target gateway, further comprises:

employing the underlay network to request a device address of the target gateway based on a protocol address that corresponds to the target gateway, wherein the protocol address of the target gateway is based on the GID assigned to the target gateway;

determining the virtual device address of the target gateway based on the protocol address associated with the target gateway; and

employing the one or more underlay protocols to communicate the virtual device address to the source gateway.

23. The network computer of claim 19 , further comprising:

employing the underlay network to provide a device address of the source gateway to the source node; and

employing the underlay network and the device address of the source gateway to communicate the one or more encrypted packets to the source gateway.

24. The network computer of claim 19 , further comprising:

employing the underlay network to communicate one or more other encrypted packets from the source node to another target node, wherein the other target node is associated with another port group on the source gateway, wherein the other port group is separate from a port group associated with the source node;

determining another device address of the other port group based on another protocol address associated with the other target node; and

employing the underlay network and the other device address of the other port group to communicate the one or more other encrypted packets from the source gateway to the other target via the other port group.