Distributed computer network zone based security architecture

A network device for use in a distributed network environment having a plurality of network devices, the network device comprising:

• a memory;
• a network interface to receive IP packets;
• and
• a processor, coupled to the memory and the network interface, operable to
• determine an ingress security zone associated with an ingress of a first network device based on a first key and a media access control (MAC) address of a source of a packet;
• determine an egress security zone of a second network device based on a MAC address of a destination for the packet and a second key;
• perform a policy lookup based on the ingress security zone and the egress security zone to identify a policy to apply to the packet;
• and
• apply the policy to the packet.

A computer-readable non-transitory storage medium having instructions stored therein, which when executed by a network device, cause the network device to perform a method, the method comprising:

• determining an ingress security zone associated with an ingress of a first network device based on a first key and a media access control (MAC) address of a source of a packet;
• determining an egress security zone of a second network device based on a MAC address of a destination for the packet and a second key;
• performing a policy lookup based on the ingress security zone and the egress security zone to identify a policy to apply to the packet;
• and
• applying the policy to the packet.