Enforcing a segmentation policy in co-existence with a system firewall

A non-transitory computer-readable storage medium storing instructions for generating firewall rules of a segmentation firewall that enforces a segmentation policy and that co-exists with a system firewall, the instructions when executed by a computing system causing the computing system to perform operations comprising:

• configuring the segmentation firewall in a co-existence mode;
• receiving a first input packet at a host device;
• responsive to the segmentation firewall determining that the first input packet should be accepted, passing control of the first input packet to the system firewall of the host device to enable the system firewall to determine whether to drop or accept the first input packet;
• switching operation of the segmentation firewall to an exclusive mode;
• receiving a second input packet with the segmentation firewall operating in the exclusive mode;
• applying the segmentation firewall rules of the segmentation firewall to determine whether to drop or accept the second input packet, wherein accepting the second input packet provides the second input packet to its destination by bypassing the system firewall;
• and
• dropping or accepting the second input packet dependent on application of the segmentation firewall rules.

A system for generating firewall rules of a segmentation firewall that enforces a segmentation policy and that co-exists with a system firewall, the system comprising:

• one or more processors;
• and
• a memory storing instructions that, when executed by the one or more processors, cause the one or more processors to perform operations including:
• configuring the segmentation firewall in a co-existence mode;
• receiving a first input packet at a host device;
• responsive to the segmentation firewall determining that the first input packet should be accepted, passing control of the first input packet to the system firewall of the host device to enable the system firewall to determine whether to drop or accept the first input packet;
• switching operation of the segmentation firewall to an exclusive mode;
• receiving a second input packet with the segmentation firewall operating in the exclusive mode;
• applying the segmentation firewall rules of the segmentation firewall to determine whether to drop or accept the second input packet, wherein accepting the second input packet provides the second input packet to its destination by bypassing the system firewall;
• and
• dropping or accepting the second input packet dependent on application of the segmentation firewall rules.