Data sovereignty and service insertion in multisite network fabric

One or more non-transitory computer-readable media storing instructions executable by a processor, wherein the instructions, when executed, cause the processor to perform operations comprising:

• receiving, at a Software-Defined-Networking (SDN) controller configured to implement jurisdictional data sovereignty policies to route network traffic between user sites and destination services over one or more provider sites, site-specific data sovereignty policies for individual ones of the provider sites indicating how to route network traffic based on the destination services associated with the network traffic and geographic regions in which the provider sites are located;
• defining, using the site-specific data sovereignty policies, destination group tags (DGTs) that indicate how the provider sites are to route the network traffic based at least in part on the geographic regions in which the provider sites are located and the destination services to which the network traffic is destined;
• obtaining source group tags (SGTs) indicating how to route the network traffic sent from different sources in the user sites and toward the destination services;
• receiving, at a border router associated with a user site of the user sites, a network traffic flow originating from a user device in the user site;
• communicating, from the border router and to the SDN controller, an indication of the network traffic flow;
• receiving, at the border router and from the SDN controller, a DGT associated with a destination service of the network traffic flow and an SGT associated with the user device in the user site;
• determining, based at least in part on the DGT and the SGT, a routing operation to perform associated with the network traffic flow;
• and
• performing the routing operation associated with the network traffic flow.

A method comprising:

• receiving, at a Software-Defined-Networking (SDN) controller configured to implement jurisdictional data sovereignty policies to route network traffic between user sites and destination services over one or more provider sites, site-specific data sovereignty policies for individual ones of the provider sites indicating how to route the network traffic based on destination services associated with the network traffic and geographic regions in which the provider sites are located;
• defining, by the SDN controller and using the site-specific data sovereignty policies, destination group tags (DGTs) that indicate how the provider sites are to route the network traffic based at least in part on the geographic regions in which the provider sites are located and the destination services to which the network traffic is destined;
• obtaining source group tags (SGTs) indicating how to route the network traffic sent from different sources in the user sites and toward the destination services;
• receiving, at the SDN controller and from a border router associated with a user site of the user sites, an indication of a network traffic flow originating from a user device in the user site;
• sending, to the border router and from the SDN controller, a DGT associated with a destination service of the network traffic flow and an SGT associated with the user device in the user site;
• receiving, from the border router and at the SDN controller, an indication of a routing operation to perform associated with the network traffic flow, wherein the routing operation is based at least in part on the DGT and the SGT;
• and
• performing the routing operation associated with the network traffic flow.