Segmentation using infrastructure policy feedback

A non-transitory computer-readable medium comprising instructions for managing a segmentation policy, the instructions, when executed by a computing system, causing the computing system to perform operations including:

• obtaining a segmentation policy comprising a first set of allow-only rules for controlling network traffic between workloads;
• receiving a third-party infrastructure policy comprising a set of allow/deny rules for controlling network traffic between the workloads associated with a third-party network infrastructure;
• converting the third-party infrastructure policy into a second set of allow-only rules for controlling network traffic between the workloads, wherein converting the third-party infrastructure policy into a second set of allow-only rules comprising converting an initial allow rule in the set of allow/deny rules into one or more new allow rules that cover a range allowed by the initial allow rule subtracting a range denied by a deny rule in the set of allow/deny rules;
• comparing the first set of allow-only rules to the second set of allow-only rules to identify a discrepancy between the segmentation policy and the third-party infrastructure policy;
• and
• triggering a corrective action in response to identifying the discrepancy.

A computer system comprising:

• one or more processors;
• and
• a non-transitory computer-readable medium comprising instructions for managing a segmentation policy, the instructions when executed by one or more processors causing the computer system to perform operations including:
• obtaining a segmentation policy comprising a first set of allow-only rules for controlling network traffic between workloads;
• receiving a third-party infrastructure policy comprising a set of allow/deny rules for controlling network traffic between the workloads associated with a third-party network infrastructure;
• converting the third-party infrastructure policy into a second set of allow-only rules for controlling network traffic between the workloads, wherein converting the third-party infrastructure policy into a second set of allow-only rules comprising converting an initial allow rule in the set of allow/deny rules into one or more new allow rules that cover a range allowed by the initial allow rule subtracting a range denied by a deny rule in the set of allow/deny rules;
• comparing the first set of allow-only rules to the second set of allow-only rules to identify a discrepancy between the segmentation policy and the third-party infrastructure policy;
• and
• triggering a corrective action in response to identifying the discrepancy.