Group-based policies for inter-domain traffic

An edge router that is configured to operate at a first site of a software-defined network (SDN) comprising:

• one or more processors;
• and
• one or more computer-readable non-transitory storage media coupled to one or more of the processors and comprising instructions operable when executed by one or more of the processors to cause the edge router to:
• receive, from a first host located in the first site, a data packet destined to a second host located in a second site, wherein the first site and the second site are different, and wherein the data packet from the first host comprises an identifier of a first group that is added by a switch having a port connected to the first host that determines the identifier of the first group based on a message from a first authentication server configuring the first host to be associated with the first group;
• send, to a network apparatus, a request for an identifier of a second group that a second authentication server configured the second host to be associated with, wherein the request comprises an address of the second host;
• in response to sending the request for the identifier of the second group, receive, from the network apparatus, a response comprising the identifier of the second group;
• determine, based on the received identifier, that the second group is a destination group;
• apply, to the data packet, one or more policies associated with the destination group;
• and
• cause the data packet to be routed to the second host.

One or more computer-readable non-transitory storage media embodying software that is operable on an edge router configured to operate at a first site of a software-defined network (SDN) when executed to:

• receive, from a first host located in the first site, a data packet destined to a second host located in a second site, wherein the first site and the second site are different, and wherein the data packet from the first host comprises an identifier of a first group that is added by a switch having a port connected to the first host that determines the identifier of the first group based on a message from a first authentication server configuring the first host to be associated with the first group;
• send, to a network apparatus, a request for an identifier of a second group that a second authentication server configured the second host to be associated with, wherein the request comprises an address of the second host;
• in response to sending the request for the identifier of the second group, receive, from the network apparatus, a response comprising the identifier of the second group;
• determine, based on the received identifier, that the second group is a destination group;
• apply, to the data packet, one or more policies associated with the destination group;
• and
• cause the data packet to be routed to the second host.