Smart firewall filtering in a label-based network

A network device, comprising:

• one or more memories;
• and
• one or more processors, to:
• receive an input identifying:
• a plurality of conditions associated with traversal of packets through a network,
• wherein the plurality of conditions comprise:
• a first condition that a packet, of the packets, traverses along a path to a destination node through a particular sequence of nodes included in the path, and
• a second condition that the packet is routed to avoid a network segment that includes a particular untrusted network;
• and
• one or more actions, associated with a firewall policy, to be performed if one or more of the plurality of conditions are satisfied;
• transmit, to a path computation element, a request for a label set, that includes one or more subsets of labels, for the plurality of conditions,
• wherein the label set identifies a particular sequence of labels associated with the particular sequence of nodes in the network;
• receive, from the path computation element and based on transmitting the request, the label set;
• identify a label stack of the packet that includes the label set;
• compare the label set and the label stack of the packet to determine if one or more subset of labels in the label set are included in the label stack of the packet;
• determine that the label stack of the packet satisfies the firewall policy based on comparing the label set and the label stack of the packet;
• perform the one or more actions based on determining that the label stack of the packet satisfies the firewall policy, wherein the one or more actions are associated with the packet;
• receive, from the path computation element, an updated label set based on changes in the network;
• and
• automatically update the firewall policy to include the updated label set.

A non-transitory computer-readable medium storing instructions, the instructions comprising:

• one or more instructions that, when executed by one or more processors, cause the one or more processors to:
• receive an input identifying:
• one or more conditions associated with traversal of packets through a network,
• wherein the one or more conditions comprise:
• a first condition that a packet, of the packets, traverses along a path to a destination node through a particular sequence of nodes included in the path, and
• a second condition that the packet is routed to avoid a network segment that includes a particular untrusted network, and
• one or more actions, associated with a firewall policy, to be performed if the one or more conditions are satisfied;
• transmit, to a path computation element, a request for a label set that satisfies the one or more conditions;
• receive, from the path computation element and based on transmitting the request, the label set, that includes one or more subsets of labels,
• wherein the label set identifies a particular sequence of labels associated with the particular sequence of nodes in the network;
• identify a label stack of a packet that includes the label set;
• compare the label set and the label stack of the packet to determine if one or more subset of labels in the label set are included in the label stack of the packet;
• determine that the label stack of the packet satisfies the firewall policy based on comparing the label set and the label stack of the packet;
• perform the one or more actions based on determining that the label stack of the packet satisfies the firewall policy, wherein the one or more actions are associated with the packet;
• receive, from the path computation element, an updated label set based on changes in the network;
• and
• automatically update the firewall policy to include the updated label set.