Tunneled security groups

1. A method comprising:

receiving a packet, wherein

the packet is received at an egress device,

the egress device is configured to receive the packet from an ingress device via a tunnel,

the tunnel comprises a path from the ingress device to the egress device,

the packet comprises a tunnel identifier and a destination address, and

the destination address corresponds to a destination of the packet;

identifying a security group identifier (SGI) based, at least in part, on a tunnel identifier of the tunnel, wherein

the tunnel is associated with only a single security group, and

the SGI is configured to identify the single security group;

assigning the SGI to the packet, wherein the assigning comprises storing the SGI in a memory, and

overriding a default SGI assigned to the packet, wherein the overriding comprises

determining at which network layer the default SGI is to be overridden, and

replacing the default SGI with a replacement SGI in response to the determining, wherein

the replacement SGI is assigned to the packet based on a source address of the packet; and

determining whether forwarding the packet to the destination is permissible based, at least in part, on the SGI.

2. The method of claim 1 , further comprising:

receiving an advertisement, wherein

the advertisement indicates that a virtual port is available,

the advertisement is sent from the egress device,

the egress device comprises the virtual port, and

the advertisement is received at a client;

detecting whether any tunnel exists from the client to the virtual port; and

creating a second tunnel between the client and the egress device in response to receiving the advertisement and detecting that no tunnel exists to the virtual port.

3. The method of claim 1 , further comprising:

recirculating the packet, wherein

a first level of decryption is applied to the packet on a first pass, wherein the first level of decryption relates to link-level decryption, and

a second level of decryption is applied to the packet on a second pass, wherein

the second level of decryption relates to tunnel-level decryption.

4. The method of claim 1 , further comprising:

identifying at least one access control entry (ACE) of a plurality of ACEs,

wherein

the identifying comprises

determining whether the at least one ACE is applicable to the tunnel, and

adding the at least one ACE to a subset of ACEs in response to determining that the at least one ACE is applicable to the tunnel, wherein

each ACE in the subset of ACEs is applicable to the tunnel; and

transmitting the subset of ACEs from the egress device to the ingress device.

5. The method of claim 1 , further comprising:

classifying the packet based on the SGI and at least one access control entry (ACE);

detecting whether the packet is allowed in the tunnel; and

dropping the packet in response to detecting that the packet is not allowed in the tunnel.

6. The method of claim 1 , further comprising:

detecting whether any users of a group are connected to the ingress device; and

terminating the tunnel in response to detecting no users of the group are connected to the ingress device.

7. The method of claim 1 , wherein

identifying the SGI comprises performing a lookup in an access control list (ACL).

8. The method of claim 1 , wherein

the tunnel is associated with the single security group by virtue of being configured to convey only packets associated with the single security group.

9. The method of claim 1 , wherein

the egress device is a router, wherein

said router is operably coupled to one or more servers.

10. The method of claim 1 , further comprising:

forwarding the packet to the destination in response to determining that said forwarding is permissible, wherein

the packet is forwarded to the destination based, at least in part, on the destination address corresponding to the destination.

11. A network device comprising:

a processor; and

a first memory, wherein

the processor and the first memory are coupled to one another, and

the processor is configured to

receive a packet, wherein

the packet is received at an egress device,

the egress device is configured to receive the packet from an ingress device via a tunnel,

the tunnel comprises a path from the ingress device to the egress device,

the packet comprises a tunnel identifier and a destination address, and

the destination address corresponds to a destination of the packet;

identify a security group identifier (SGI) based, at least in part, on a tunnel identifier of the tunnel, wherein

the tunnel is associated with only a single security group, and

the SGI is configured to identify the single security group;

assign the SGI to the packet, wherein

the processor is configured to assign by storing the SGI in the first memory, and

the processor is configured to override a default SGI assigned to the packet, wherein

overriding the default SGI comprises

determining at which network layer the default SGI is to be overridden, and

replacing the default SGI with a replacement SGI in response to the determining, wherein

 the replacement SGI is assigned to the packet based on a source address of the packet; and

determine whether forwarding the packet to the destination is permissible based, at least in part, on the SGI.

12. The network device of claim 11 , wherein the processor is further configured to:

receive an advertisement, wherein

the advertisement indicates that a virtual port is available,

the advertisement is sent from the egress device,

the egress device comprises the virtual port, and

the advertisement is received at a client;

detect whether any tunnel exists from the client to the virtual port; and

create a second tunnel between the client and the egress device in response to receiving the advertisement and detecting that no tunnel exists to the virtual port.

13. The network device of claim 11 , wherein the processor is further configured to:

recirculate the packet, wherein

a first level of decryption is applied to the packet on a first pass, wherein the first level of decryption relates to link-level decryption, and

a second level of decryption is applied to the packet on a second pass, wherein the second level of decryption relates to tunnel-level decryption.

14. The network device of claim 11 , wherein the processor is further configured to:

identify at least one access control entry (ACE) of a plurality of ACEs, wherein identifying the at least one ACE comprises

determining whether the at least one ACE is applicable to the tunnel, and

adding the at least one ACE to a subset of ACEs in response to determining that the at least one ACE is applicable to the tunnel, wherein

each ACE in the subset of ACEs is applicable to the tunnel; and

transmit the subset of ACEs from the egress device to the ingress device.

15. The network device of claim 11 , wherein the processor is further configured to:

classify the packet based on the SGI and at least one access control entry (ACE);

detect whether the packet is allowed in the tunnel; and

drop the packet in response to detecting that the packet is not allowed in the tunnel.

16. The network device of claim 11 , wherein the processor is further configured to:

detect whether any users of a group are connected to the ingress device; and

terminate the tunnel in response to detecting no users of the group are connected to the ingress device.

17. The network device of claim 11 , wherein

identifying the SGI comprises performing a lookup in an access control list (ACL).

18. A computer system comprising:

a processor;

a non-transitory computer readable storage medium coupled to said processor; and

computer code, encoded in said non-transitory computer readable storage medium, configured to cause said processor to:

receive a packet, wherein

the packet is received at an egress device,

the egress device is configured to receive the packet from an ingress device via a tunnel,

the tunnel comprises a path from the ingress device to the egress device,

the packet comprises a tunnel identifier and a destination address, and

the destination address corresponds to a destination of the packet;

identify a security group identifier (SGI) based, at least in part, on a tunnel identifier of the tunnel, wherein

the tunnel is associated with only a single security group, and

the SGI is configured to identify the single security group;

assign the SGI to the packet, wherein

the computer code configured to cause said processor to assign comprises

storing the SGI in a memory, and

overriding a default SGI assigned to the packet, wherein the overriding comprises

determining at which network layer the default SGI is to be overridden, and

replacing the default SGI with a replacement SGI in response to the determining, wherein

 the replacement SGI is assigned to the packet based on a source address of the packet; and

determine whether forwarding the packet to the destination is permissible based, at least in part, on the SGI.

19. The computer system of claim 18 , wherein the computer code is further configured to:

receive an advertisement, wherein

the advertisement indicates that a virtual port is available,

the advertisement is sent from the egress device,

the egress device comprises the virtual port, and

the advertisement is received at a client;

detect whether any tunnel exists from the client to the virtual port; and

create a second tunnel between the client and the egress device in response to receiving the advertisement and detecting that no tunnel exists to the virtual port.

20. The computer system of claim 18 , wherein the computer code is further configured to:

identify at least one access control entry (ACE) of a plurality of ACEs, wherein identifying the at least one ACE comprises

determining whether the at least one ACE is applicable to the tunnel, and

adding the at least one ACE to a subset of ACEs in response to determining that the at least one ACE is applicable to the tunnel, wherein

each ACE in the subset of ACEs is applicable to the tunnel; and

transmit the subset of ACEs from the egress device to the ingress device.

21. The computer system of claim 18 , wherein the computer code is further configured to:

classify the packet based on the SGI and at least one access control entry (ACE);

detect whether the packet is allowed in the tunnel; and

drop the packet in response to detecting that the packet is not allowed in the tunnel.

22. The computer system of claim 18 , wherein the computer code is further configured to:

detect whether any users of a group are connected to the ingress device; and

terminate the tunnel in response to detecting no users of the group are connected to the ingress device.

23. The computer system of claim 18 , wherein

identifying the SGI comprises performing a lookup in an access control list (ACL).