Network service chain construction

A non-transitory computer readable medium storing instructions for constructing network service chain based on network policies and executable by a processing resource to cause a computer to:

• detect a plurality of active network policies with overlapping applicability among a plurality of network policies directing network traffic to corresponding network services, wherein a portion of a first network policy and a portion of a third network policy direct the network traffic to a common service, and wherein the active network policies with overlapping applicability comprises multiple active network policies that apply to a single network packet;
• specify a network policy priority that defines an order that the multiple active network policies are applied;
• generate a set of orthogonal network policies based, in part on the first network policy and the second network policy, wherein the set of orthogonal network policies perform the functions of the overlapping active network policies in a non-overlapping manner;
• and
• construct a network service chain utilizing the set of orthogonal network policies corresponding to the subset of packets to provide the first service and the second service in a non-overlapping manner, wherein conflicts between actions within the orthogonal network policies are resolved based on a network policy priority, wherein the priority assigned to the first network policy and the priority assigned to the second network policy are associated with a corresponding application, wherein the first network policy and the second network policy are ordered according to the network policy priority, wherein the construction of the network service chain includes constructing a substitute network service chain, in response to a determination that the constructed network service chain is not executable, wherein the substitute network service chain is constructed based a network policy priority that is the lowest priority relative to the other network services and wherein the construction of the substitute network service chain includes iterative series of attempts to successfully construct the substitute network service chain until no further network service corresponding to the overlapping policy remain to be placed in the network service chain.

A method of constructing network service chain based on network policies, the method comprising:

• detecting a plurality of active network policies with overlapping applicability, wherein each of the plurality of active network policies directs a portion of network traffic to a designated service of a plurality of services, wherein a portion of a first network policy and a portion of a third network policy direct a subset of packets to a common service, and wherein active network policies with overlapping applicability comprises multiple active network policies that apply to a single network packet;
• specify a network policy priority that defines an order that the multiple active network policies are applied;
• generating a set of orthogonal network policies based in part on the first network policy and a second network policy, wherein the set of orthogonal network policies perform the functions of the overlapping active network policies in a non-overlapping manner;
• and
• constructing a network service chain utilizing the set of orthogonal network policies corresponding to the subset of packets to provide the first service and the second service in a non-overlapping manner, wherein conflicts between actions within the orthogonal network policies are resolved based on a network policy priority;
• detecting a modification to at least one of the designated services;
• and
• performing a pre-determined action in response to the detection of the modification, wherein the priority assigned to the first network policy and the priority assigned to the second network policy are associated with a corresponding application, and wherein the first network policy and the second network policy are ordered according to the network policy priority, wherein the pre-determined action in response to the detection of the modification includes constructing a substitute network service chain, in response to a determination that the constructed network service chain is not executable, wherein the substitute network service chain is constructed based the network policy priority that is the lowest priority relative to the other network services and wherein the construction of the substitute network service chain includes iterative series of attempts to successfully construct the substitute network service chain until no further network service corresponding to the overlapping policy remain to be placed in the network service chain.