Enabling restriction on transmission of data packets at ingress network device

A system comprising:

• a processor;
• a memory coupled to the processor, the memory storing instructions executable by the processor to:
• receive, by a first network device in a network, data packets directed to a first entity from a second entity, wherein the second entity is connected to a second network device in a network, and wherein each data packet includes a source role tag corresponding to the second entity;
• drop, by the first network device, the data packets received from the second entity based on enforcement of an egress access policy between the source role tag and a destination role tag corresponding to the first entity;
• determine, by the first network device, whether a number of the data packets that are dropped is greater than a pre-defined threshold;
• and
• in response to determining that the number of the data packets that are dropped is greater than the pre-defined threshold,
• communicate, by the first network device, a command to the second network device instructing the second network device to create a restriction on transmission of subsequent data packets originating from the second entity that is directed towards the first entity.

A non-transitory machine-readable medium comprising instructions executable by a processor, the instructions comprising:

• instructions to receive, at a first network device in a network, data packets directed to a first entity from a second entity, wherein the second entity is connected to a second network device in the network, and wherein each data packet includes a source role tag corresponding to the second entity;
• instructions to drop, by the first network device, the data packets received from the second entity based on enforcement of an egress access policy between the source role tag and a destination role tag corresponding to the first entity;
• instructions to determine, by the first network device, whether a number of the data packets that are dropped is greater than a pre-defined threshold;
• and
• in response to determining that the number of the data packets that are dropped is greater than the pre-defined threshold,
• instructions to communicate, by the first network device, a command to the second network device instructing the second network device to create a restriction on transmission of subsequent data packets originating from the second entity that is directed towards the first entity, wherein the first network device is an egress network device and the second network device is an ingress network device.