Efficient resource management for role-based traffic segmentation in an overlay network

A non-transitory computer-readable storage medium storing instructions, the instructions comprising:

• one or more instructions that, when executed by one or more processors of a first network device to:
• send, in a network, a first packet of a first data flow to a second network device in the network, wherein a source of the first data flow is associated with a first role and a destination of the first data flow is associated with a second role;
• receive, from the second network device, a control packet indicating that the second role is precluded from receiving traffic from the first role,
• wherein a payload of the control packet includes a source protocol port identifier and a destination protocol port identifier of the first data flow;
• identify an entry from a flow data structure associated with the first data flow based on the payload of the control packet,
• wherein the flow data structure is maintained in forwarding hardware of the first network device, and
• wherein the entry comprises the source protocol port identifier of the first data flow;
• and
• remove the entry from the flow data structure.

A computer system, comprising:

• one or more processing resources,
• wherein instructions executed by the one or more processing resources cause a first network device to:
• send, by a first network device in a network, a first packet of a first data flow to a second network device via a network,
• wherein a source of the first data flow is associated with a first role and a destination of the first data flow is associated with a second role;
• receive, from the second network device, a control packet indicating that the second role is precluded from receiving traffic from the first role,
• wherein a payload of the control packet includes a source protocol port identifier and a destination protocol port identifier of the first data flow;
• identify an entry from a flow data structure associate with the first data flow based on the payload of the control packet,
• wherein the flow data structure is maintained in forwarding hardware of the first network device, and
• wherein the entry comprises the source protocol port identifier of the first data flow;
• and
• remove the entry from the flow data structure.