Adding metadata associated with a composite network policy

1. A method comprising:

combining, by a system comprising a processor, input network policies to form a composite network policy, each input network policy of the input network policies specifying at least one characteristic of communications allowed between endpoint groups in a network;

adding, by the system, metadata associated with the composite network policy, the metadata including information regarding a reason for disallowance of one of the communications between endpoint groups;

receiving a query regarding an issue regarding the one of the communications;

in response to the query, determining, based on the metadata, a cause of the issue regarding the one of the communications; and

modifying the composite network policy in response to the determining.

2. The method of claim 1 , wherein adding the metadata comprises adding information regarding a given input network policy of the input network policies, the given input network policy governing communications allowed by the composite network policy between endpoint groups.

3. The method of claim 1 , wherein adding the metadata comprises adding information regarding a composition rule that led to inclusion of a service function box.

4. The method of claim 1 , wherein adding the metadata comprises adding information regarding a reason for exclusion of a service function box.

5. The method of claim 1 , wherein adding the metadata comprises adding information regarding a reason for a specific ordering of service function boxes.

6. The method of claim 1 , wherein adding the metadata comprises adding information selected from among:

information regarding a given endpoint group of one of the input network policies, the given endpoint group overlapping with an endpoint group of the composite network policy,

information regarding each communication flow of the input network policies that overlaps with a communication flow of the composite network policy, and

information regarding an input network policy that includes a service function box of the composite network policy.

7. The method of claim 1 , wherein the modifying is based on at least one selected from among modifying an input network policy of the input network policies, modifying a composition rule of an input network policy governing the combining of the input network policies, or modifying a conflict resolution decision previously made by a user or the system.

8. An article comprising at least one non-transitory machine-readable storage medium storing instructions that upon execution cause a system to:

retrieve metadata associated with a composite network policy produced by combining a plurality of input network policies, each input network policy of the input network policies specifying at least one characteristic of communications allowed between endpoint groups;

receive a query regarding an issue in one of the communications in a network governed by the composite network policy;

in response to the query, provide information relating to the issue, and determine, based on the metadata, a cause of the issue; and

modify the composite network policy in response to the determining.

9. The article of claim 8 , wherein the retrieved metadata comprises information regarding why a communication between endpoint groups is disallowed.

10. The article of claim 8 , wherein the retrieved metadata comprises information regarding a reason for exclusion of a service function box.

11. The article of claim 8 , wherein the retrieved metadata comprises information regarding a reasons for a specific ordering of service function boxes.

12. A system comprising:

at least one computer processor to:

combine input network policies to form a composite network policy governing communications within a network, each input network policy of the input network policies specifying at least one characteristic of communications allowed between endpoint groups in the network, the combining being, according to a composition rule comprising a composition constraint included in the input network policies, the composition constraint selected from among a composition constraint specifying that communications between respective endpoint groups must be allowed, and a composition constraint specifying that communications between respective endpoint groups are to be blocked;

add metadata for association with the composite network policy, the metadata including information regarding a reason for disallowance of one of the communications between endpoint groups;

receive a query regarding an issue regarding the one of the communications;

in response to the query, determine, based on the metadata, a cause of the issue regarding the one of the communications; and

modify the composite network policy in response to the determining.

13. The system of claim 12 , wherein the metadata further comprises information regarding a reason for exclusion of a service function box, or information regarding a reason for a specific ordering of service function boxes.