Selective enforcement of a segmentation policy

A non-transitory computer-readable storage medium storing instructions for managing enforcement of a segmentation policy, the instructions when executed causing one or more processors to perform steps including:

• storing, at a policy management server, a segmentation policy comprising a set of segmentation rules that specify a white list of permissible connections between workloads providing or consuming network-based services;
• storing, at the policy management server, an enforcement policy that specifies at least a first group of services for operating in a test state and at least a second group of services for operating in an enforced state;
• generating, based on the segmentation policy, segmentation policy instructions for causing an enforcement module to configure one or more traffic filters with a first set of filtering rules that allow traffic associated with the first or second group of services meeting the segmentation rules of the segmentation policy;
• generating, based on the enforcement policy, enforcement policy instructions for causing the enforcement module to configure the one or more traffic filter with a first default filtering rule to allow traffic associated with the first group of services that fails to meet any of the first set of filtering rules, and a second default filtering rule to block traffic associated with the second group of services that fails to meet any of the first set of filtering rules;
• distributing over a network, the segmentation policy instructions and the enforcement policy instructions to the enforcement module executing remotely from the policy management server;
• receiving over the network from the enforcement module, first traffic data meeting the first set of filtering rules as allowed traffic;
• receiving over the network from the enforcement module, second traffic data meeting the first default filtering rule as unenforced impermissible traffic;
• receiving, over the network from the enforcement module, third traffic data meeting the second default filtering rule as blocked traffic;
• and
• generating a traffic flow graph representing the allowed traffic, the unenforced impermissible traffic, and the blocked traffic as visually distinguishable lines.

A computer system comprising:

• one or more processors;
• and
• a non-transitory computer-readable storage medium storing instructions for managing enforcement of a segmentation policy, the instructions when executed causing the one or more processors to perform steps including:
• storing, at a policy management server, a segmentation policy comprising a set of segmentation rules that specify a white list of permissible connections between workloads providing or consuming network-based services;
• storing, at the policy management server, an enforcement policy that specifies at least a first group of services for operating in a test state and at least a second group of services for operating in an enforced state;
• generating, based on the segmentation policy, segmentation policy instructions for causing an enforcement module to configure one or more traffic filters with a first set of filtering rules that allow traffic associated with the first or second group of services meeting the segmentation rules of the segmentation policy;
• generating, based on the enforcement policy, enforcement policy instructions for causing the enforcement module to configure the one or more traffic filter with a first default filtering rule to allow traffic associated with the first group of services that fails to meet any of the first set of filtering rules, and a second default filtering rule to block traffic associated with the second group of services that fails to meet any of the first set of filtering rules;
• distributing over a network, the segmentation policy instructions and the enforcement policy instructions to the enforcement module executing remotely from the policy management server;
• receiving over the network from the enforcement module, first traffic data meeting the first set of filtering rules as allowed traffic;
• receiving over the network from the enforcement module, second traffic data meeting the first default filtering rule as unenforced impermissible traffic;
• receiving, over the network from the enforcement module, third traffic data meeting the second default filtering rule as blocked traffic;
• and
• generating a traffic flow graph representing the allowed traffic, the unenforced impermissible traffic, and the blocked traffic as visually distinguishable lines.