Efficient implementation of complex network segmentation

A network device comprising:

• an interface configured to receive a plurality of packets from sources disposed in a network for forwarding to destinations disposed in the network, the sources and the destinations being assigned to a plurality of groups, each packet of the plurality of packets including a source identifier and a destination identifier;
• a memory configured to store:
• a source-group mapping table that maps source identifiers to source-groups;
• a destination-group mapping table that maps destination identifiers to destination-groups;
• and an intergroup access-control list that maps source-destination-group pairs to forwarding rules;
• and
• a single Integrated Circuit (IC) chip configured, for each packet received through the interface, to:
• find a source-group for the source identifier in the source-group mapping table;
• find a destination-group for the destination identifier in the destination-group mapping table;
• find a forwarding rule for a source-destination pair including the found source-group and the found destination-group in the intergroup access-control list;
• and
• forward the packet through the interface or drop the packet according to the found forwarding rule.