Network policy implementation in a tag-based policy architecture

A method comprising:

• implementing a network policy of a virtualized computing environment by associating the network policy to a global firewall at a control plane coupled to a network of the virtualized computing environment;
• apportioning the global firewall into one or more individual firewalls;
• translating the network policy associated with the global firewall into rules of an individual firewall;
• receiving the rules from the control plane at a module executed on a first computer node coupled to the network;
• and
• implementing the individual firewall at the module to enforce the network policy on packets of network traffic as a respective portion of the global firewall, wherein the first computer node is configured to execute a hypervisor and a virtual machine instance (VMI), wherein the VMI is managed by the hypervisor, wherein a guest operating system and an intermediary manager run in the VMI, wherein the module is a component of the intermediary manager, wherein the module is configured to enforce the network policy on the packets when passed between the hypervisor and the guest operating system.

A non-transitory computer readable media containing instructions for execution on a processor for a method comprising:

• implementing a network policy of a virtualized computing environment by associating the network policy to a global firewall at a control plane coupled to a network of the virtualized computing environment;
• apportioning the global firewall into one or more individual firewalls;
• translating the network policy associated with the global firewall into rules of an individual firewall;
• receiving the rules from the control plane at a module executed on a first computer node coupled to the network;
• and
• implementing the individual firewall at the module to enforce the network policy on packets of network traffic as a respective portion of the global firewall, wherein the first computer node is configured to execute a hypervisor and a virtual machine instance (VMI), wherein the VMI is managed by the hypervisor, wherein a guest operating system and an intermediary manager run in the VMI, wherein the module is a component of the intermediary manager, wherein the module is configured to enforce the network policy on the packets when passed between the hypervisor and the guest operating system.