Networking and security split architecture

1. A system comprising:

a processor configured to:

receive a flow at a security service;

process the flow at a network layer of the security service to perform one or more networking functions, wherein the network layer performs one or more of the following: IPSEC termination, routing, and/or network address translation (NAT), and wherein the processing of the flow at the network layer comprises to:

determine whether the flow matches a policy-based forwarding rule; and

in response to a determination that the flow matches the policy-based forwarding rule:

determine whether the policy-based forwarding rule only matches client to server (c2s) traffic; and

in response to a determination that the policy-based forwarding rule only matches the c2s traffic:

 determine whether a plurality of active next hops are defined based on the policy-based forwarding rule; and

 in response to a determination that the plurality of active next hops are defined:

 select an active next hop of the plurality of active next hops; and

 forward the flow to the selected active next hop, wherein the selected active next hop includes a security layer of the security service; and

offload the flow to the security layer of the security service to perform security enforcement based on a policy, wherein the security layer includes a plurality of security instances for distinct micro services of security functions including one or more of the following: antivirus, antispam, DNS security, intrusion detection/prevention security (IDS/IPS), and data exfiltration security; and

a memory coupled to the processor and configured to provide the processor with instructions.

2. The system recited in claim 1 , wherein the flow is determined to be a new flow at the security service, and wherein meta information is extracted from the flow during processing of the flow at the network layer of the security service, and wherein the meta information includes an application identification associated with the flow.

3. The system recited in claim 1 , wherein processing the flow at the network layer includes using deep packet inspection.

4. The system recited in claim 1 , wherein the security layer includes a plurality of security instances.

5. The system recited in claim 1 , wherein the security layer includes a security instance of a firewall.

6. The system recited in claim 1 , wherein the network layer includes a network router.

7. The system recited in claim 1 , wherein the network layer includes a virtual private network (VPN) gateway.

8. The system recited in claim 1 , wherein the network layer includes a load balancer.

9. The system recited in claim 1 , wherein the network layer includes a load balancer, and wherein the load balancer sends a first session of the flow to a first security instance of the security layer and sends a child of the first session of the flow to the first security instance of the security layer.

10. The system recited in claim 1 , wherein the network layer includes a network anchor instance.

11. The system recited in claim 1 , wherein the security service is a cloud-based security service.

12. The system recited in claim 1 , wherein the security service is a cloud-based security service that is provided using a public cloud service provider.

13. The system recited in claim 1 , wherein the security service is a cloud-based security service that is provided using a plurality of public cloud service providers.

14. The system recited in claim 1 , wherein the processor is further configured to:

close the flow; and

receive session statistics associated with the flow from the security layer.

15. A method, comprising:

receiving a flow at a security service;

processing the flow at a network layer of the security service to perform one or more networking functions, wherein the network layer performs one or more of the following: IPSEC termination, routing, and/or network address translation (NAT), and wherein the processing of the flow at the network layer comprises:

determining whether the flow matches a policy-based forwarding rule; and

in response to a determination that the flow matches the policy-based forwarding rule:

determining whether the policy-based forwarding rule only matches client to server (c2s) traffic; and

in response to a determination that the policy-based forwarding rule only matches the c2s traffic:

determining whether a plurality of active next hops are defined based on the policy-based forwarding rule; and

in response to a determination that the plurality of active next hops are defined:

 selecting an active next hop of the plurality of active next hops; and

 forwarding the flow to the selected active next hop, wherein the selected active next hop includes a security layer of the security service; and

offloading the flow to the security layer of the security service to perform security enforcement based on a policy, wherein the security layer includes a plurality of security instances for distinct micro services of security functions including one or more of the following: antivirus, antispam, DNS security, intrusion detection/prevention security (IDS/IPS), and data exfiltration security.

16. A computer program product, the computer program product being embodied in a non-transitory tangible computer readable storage medium and comprising computer instructions for:

receiving a flow at a security service;

processing the flow at a network layer of the security service to perform one or more networking functions, wherein the network layer performs one or more of the following: IPSEC termination, routing, and/or network address translation (NAT), and wherein the processing of the flow at the network layer comprises:

determining whether the flow matches a policy-based forwarding rule; and

in response to a determination that the flow matches the policy-based forwarding rule:

determining whether the policy-based forwarding rule only matches client to server (c2s) traffic; and

in response to a determination that the policy-based forwarding rule only matches the c2s traffic:

determining whether a plurality of active next hops are defined based on the policy-based forwarding rule; and

in response to a determination that the plurality of active next hops are defined:

 selecting an active next hop of the plurality of active next hops; and

 forwarding the flow to the selected active next hop, wherein the selected active next hop includes a security layer of the security service; and

offloading the flow to the security layer of the security service to perform security enforcement based on a policy, wherein the security layer includes a plurality of security instances for distinct micro services of security functions including one or more of the following: antivirus, antispam, DNS security, intrusion detection/prevention security (IDS/IPS), and data exfiltration security.