Enforcing micro-segmentation policies for physical and virtual application components in data centers

A non-transitory computer-readable medium storing instructions, the instructions comprising:

• one or more instructions that, when executed by one or more processors, cause the one or more processors to:
• receive network topology information associated with a network,
• wherein the network topology information includes information that identifies connections between devices and whether respective application components of the network are virtual or physical;
• identify a first application component, of the respective application components, as a physical application component of the network based on the network topology information;
• identify a second application component, of the respective application components, as a virtual application component of the network based on the network topology information;
• provide, to a virtual network device of the network, a first policy to permit the virtual network device to implement the first policy in association with network traffic transferred using the virtual application component,
• the first policy being provided to the virtual network device based on the virtual network device being a virtual device type and being connected to the virtual application component, and
• the first policy being provided based on the virtual network device being included in a logical group of virtual application components,
• the logical group of virtual application components generated to include a first set of application components, of the respective application components, of the virtual device type based on the network topology information;
• and
• provide, to a physical network device of the network, a second policy to permit the physical network device to implement the second policy in association with network traffic transferred using the physical application component,
• the second policy being provided to the physical network device based on the physical network device being a physical device type and being connected to the physical application component, and
• the second policy being provided based on the virtual network device being included in a logical group of physical application components,
• the logical group of physical application components generated to include a second set of application components, of the respective application components, of the physical device type based on the network topology information.

A method, comprising:

• receiving, by a device, network topology information associated with a network,
• wherein the network topology information includes information that identifies connections between devices and whether respective application components of the network are virtual or physical;
• identifying, by the device, a first application component, of the respective application components, as a physical application component of the network based on the network topology information;
• identifying, by the device, a second application component, of the respective application components, as a virtual application component of the network based on the network topology information;
• providing, by the device and to a virtual network device of the network, a first policy to permit the virtual network device to implement the first policy in association with network traffic transferred using the virtual application component,
• the first policy being provided to the virtual network device based on the virtual network device being a virtual device type and being connected to the virtual application component, and
• the first policy being provided based on the virtual network device being included in a logical group of virtual application components,
• the logical group of virtual application components generated to include a first set of application components, of the respective application components, of the virtual device type based on the network topology information;
• and
• providing, by the device and to a physical network device of the network, a second policy to permit the physical network device to implement the second policy in association with network traffic transferred using the physical application component,
• the second policy being provided to the physical network device based on the physical network device being a physical device type and being connected to the physical application component, and
• the second policy being provided based on the virtual network device being included in a logical group of physical application components,
• the logical group of physical application components generated to include a second set of application components, of the respective application components, of the physical device type based on the network topology information.