Data Network Microsegmentation

A system for microsegmentation of data networks comprising:

• a processor;
• and
• a memory coupled to the processor, the memory storing instructions which are executable by the processor to perform a method comprising:
• receiving a high-level declarative policy, the high-level declarative policy based on metadata associated with a plurality of containers from an orchestration layer;
• determining a low-level firewall rule set using the high-level declarative policy;
• and
• configuring, by a plurality of enforcement points, a respective virtual switch of a plurality of virtual switches to process packets in accordance with the low-level firewall ruleset, the virtual switches being collectively communicatively coupled to the plurality of containers, such that network communications between a first group of containers and a second group of containers of the plurality of containers are restricted by a first set of characteristics, and communications between containers of the first group of containers are at least one of permitted and restricted by a second set of characteristics.