Policy Verification in a Network

An apparatus comprising:

• a network interface configured to send network packets over a network;
• and
• a processor, wherein the processor is configured to:
• determine a network policy to be verified, wherein the network policy is applied to network packets sent to an endpoint within the network, wherein application of the policy to network traffic can result in at least two outcomes;
• determine a switch that is provisionable to host the endpoint;
• provision a simulated endpoint version of the endpoint at the switch;
• send, via the network interface, at least one packet for each of the at least two outcomes of the policy to the simulated endpoint;
• and
• receive, via network interface, at least one response from the simulated endpoint indicating how the policy was applied to each of the packets.

A non-transitory computer readable storage media encoded with instructions, wherein the instructions, when executed by a processor, cause the processor to:

• determine a network policy to be verified, wherein the network policy is applied to network packets sent to an endpoint within a network, wherein application of the policy to network traffic can result in at least two outcomes;
• determine a switch that is provisionable to host the endpoint;
• provision a simulated endpoint version of the endpoint at the switch;
• send, via the network, at least one packet for each of the at least two outcomes of the policy to the simulated endpoint;
• and
• receive, via network, at least one response from the simulated endpoint indicating how the policy was applied to each of the packets.