Stretched EPG and micro-segmentation in multisite fabrics

A system comprising:

• a first switching fabric at a first site including a first plurality of endpoints, communicatively coupled via a network to a second switching fabric at a second site including a second plurality of endpoints, wherein the first site is at a different geographic location than the second site,
• a multi-site controller communicably connected with the first site and the second site;
• wherein the multi-site controller is configured to:
• define, using a first VRF domain, a first group of endpoints including multiple endpoints at the first site and multiple endpoints at the second site;
• identify a first subset of endpoints within the first group of endpoints using one or more filtering criteria, wherein the first subset of endpoints includes at least one endpoint at the first site and at least one endpoint at the second site;
• apply a first shared security policy to the first subset of endpoints;
• and
• define, using a second VRF domain, a second group of endpoints including at least one endpoint at the first site and at least one endpoint at the second site, wherein the system selectively allows communication between endpoints connected via the first VRF domain and endpoints connected via the second VRF domain.

A system comprising:

• a first switching fabric at a first site including a first plurality of endpoints, communicatively coupled via a network to a second switching fabric at a second site including a second plurality of endpoints, wherein the first site is at a different geographic location than the second site;
• an identified first group of endpoints including multiple endpoints at the first site and multiple endpoints at the second site, wherein a first VRF domain enables communication between the identified first group of endpoints;
• a first filter that identifies a first microsegment of the identified first group of endpoints based on host or application markers,
• wherein the first microsegment includes at least one endpoint at the first site and at least one endpoint at the second site;
• a first security policy that applies to communication to and from endpoints within the first microsegment;
• and
• an identified second group of endpoints including multiple endpoints at the first site and multiple endpoints at the second site, wherein a second VRF domain enables communication between the identified second group of endpoints, wherein the system selectively allows communication between endpoints connected via the first VRF domain and endpoints connected via the second VRF domain.