Group based policy for non-virtual extensible local area network deployments
A network device may receive, from a server device, a first tag assigned to a first host device, and may generate a first filter based on the first tag. The network device may receive a second filter generated based on a second tag assigned to a second host device, and may generate a policy based on the first filter and the second filter. The network device may propagate the first filter and the second filter to one or more other network devices, and may receive a packet. The network device may derive a source tag and a destination tag associated with the packet, and may determine an action for the packet based on the policy, the source tag, and the destination tag. The network device may perform the action.
1 . A method, comprising:
receiving, by a network device and from a server device, a first tag assigned to a first host device;
generating, by the network device, a first filter based on the first tag;
receiving, by the network device, a second filter generated based on a second tag assigned to a second host device;
generating, by the network device, a policy based on the first filter and the second filter; and
propagating, by the network device, the first filter and the second filter to one or more other network devices using a BGP update message, wherein an extended communities field within the BGP update message is set to indicate the first tag or the second tag, and one or more actions associated with the policy.
2 . The method of claim 1 , further comprising:
receiving a packet;
deriving a source tag and a destination tag associated with the packet;
determining an action of the one or more actions for the packet based on the policy, the source tag, and the destination tag; and
performing the action.
3 . The method of claim 2 ,
wherein performing the action comprises dropping the packet.
4 . The method of claim 2 ,
wherein performing the action comprises causing the packet to be provided to a destination based on the destination tag and via the one or more other network devices.
5 . The method of claim 2 ,
wherein the source tag corresponds to the first tag and the destination tag corresponds to the second tag.
6 . The method of claim 1 ,
wherein the server device is to authenticate the first host device and assign the first tag to the first host device.
7 . The method of claim 1 ,
wherein the server device is to authenticate the second host device and assign the second tag to the second host device.
8 . A network device, comprising:
one or more memories; and
one or more processors to:
receive, from a server device, a first tag assigned to a first host device;
generate a first filter based on the first tag;
receive a second filter generated based on a second tag assigned to a second host device;
generate a policy based on the first filter and the second filter;
propagate the first filter and the second filter to one or more other network devices using a BGP update message, wherein an extended communities field within the BGP update message is set to indicate the first tag or the second tag, and one or more actions associated with the policy;
receive a packet;
derive a source tag and a destination tag associated with the packet;
determine an action of the one or more actions for the packet based on the policy, the source tag, and the destination tag; and
perform the action.
9 . The network device of claim 8 ,
wherein the network device and the one or more other network devices are associated with a non-virtual extensible local area network.
10 . The network device of claim 8 ,
wherein each of the first filter and the second filter is a border gateway protocol flow specification filter.
11 . The network device of claim 8 ,
wherein the one or more processors, to propagate the first filter and the second filter to the one or more other network devices, are to:
generate border gateway protocol (BGP) network layer reachability information (NLRI) that includes the first filter and the second filter; and
propagate the BGP NLRI to the one or more other network devices.
12 . The network device of claim 8 ,
wherein each of the first tag and the second tag is a group based policy tag.
13 . The network device of claim 8 ,
wherein the network device is an ingress device for the first host device.
14 . The network device of claim 8 ,
wherein one of the one or more other network devices is an egress device for the second host device.
15 . A non-transitory computer-readable medium storing a set of instructions, the set of instructions comprising:
one or more instructions that, when executed by one or more processors of a network device, cause the network device to:
receive, from a server device, a first tag assigned to a first host device;
generate a first filter based on the first tag;
receive a second filter generated based on a second tag assigned to a second host device;
generate a policy based on the first filter and the second filter;
propagate the first filter and the second filter to one or more other network devices using a BGP update message, wherein an extended communities field within the BGP update message is set to indicate the first tag or the second tag, and one or more actions associated with the policy;
receive a packet;
derive a source tag and a destination tag associated with the packet; and
determine an action of the one or more actions for the packet based on the policy, the source tag, and the destination tag.
16 . The non-transitory computer-readable medium of claim 15 ,
wherein the one or more instructions further cause the network device to one of:
drop the packet based on the action; or
cause, based on the action, the packet to be provided to a destination based on the destination tag and via the one or more other network devices.
17 . The non-transitory computer-readable medium of claim 15 ,
wherein the source tag corresponds to the first tag and the destination tag corresponds to the second tag.
18 . The non-transitory computer-readable medium of claim 15 ,
wherein the network device and the one or more other network devices are associated with a non-virtual extensible local area network.
19 . The non-transitory computer-readable medium of claim 15 ,
wherein each of the first filter and the second filter is a border gateway protocol flow specification filter.
20 . The non-transitory computer-readable medium of claim 15 ,
wherein the one or more instructions, that cause the network device to propagate the first filter and the second filter to the one or more other network devices, cause the network device to:
generate border gateway protocol (BGP) network layer reachability information (NLRI) that includes the first filter and the second filter; and
propagate the BGP NLRI to the one or more other network devices.