Assurance of security rules in a network

A system comprising:

• one or more processors;
• and
• at least one computer-readable storage medium having stored therein instructions which, when executed by the one or more processors, cause the system to:
• receive, via a graphical user interface, endpoint group (EPG) inclusion rules defining which EPGs on a network should be included in each of a plurality of EPG selectors, the plurality of EPG selectors representing respective sets of EPGs that satisfy the EPG inclusion rules;
• select the respective sets of EPGs that satisfy the EPG inclusion rules for inclusion in the plurality of EPG selectors, each respective set of EPGs being selected based on a respective portion of the EPG inclusion rules that is associated with the respective set of EPGs;
• create the plurality of EPG selectors based on the respective sets of EPGs, each of the plurality of EPG selectors including one of the respective sets of EPGs;
• create a traffic selector comprising traffic parameters received via the graphical user interface, the traffic parameters identifying traffic corresponding to the traffic selector;
• create a security compliance requirement for the network based on configuration data received via the graphical user interface, the configuration data comprising a first EPG selector from the plurality of EPG selectors, a second EPG selector from the plurality of EPG selectors, the traffic selector, and a communication operator defining a communication condition for traffic associated with the first EPG selector, the second EPG selector, and the traffic selector;
• determine whether security policies configured on the network comply with the security compliance requirement;
• and
• generate one or more compliance assurance events indicating whether the security policies configured on the network comply with the security compliance requirement.

A non-transitory computer-readable storage medium comprising:

• instructions stored therein instructions which, when executed by one or more processors, cause the one or more processors to:
• receive, via a graphical user interface, endpoint group (EPG) inclusion rules defining which EPGs on a network should be included in each of a plurality of EPG selectors, the plurality of EPG selectors representing respective sets of EPGs that satisfy the EPG inclusion rules;
• select the respective sets of EPGs that satisfy the EPG inclusion rules for inclusion in the plurality of EPG selectors, each respective set of EPGs being selected based on a respective portion of the EPG inclusion rules that is associated with the respective set of EPGs;
• create the plurality of EPG selectors based on the respective sets of EPGs, each of the plurality of EPG selectors including one of the respective sets of EPGs;
• create a traffic selector comprising traffic parameters received via the graphical user interface, the traffic parameters identifying traffic corresponding to the traffic selector;
• create a security compliance requirement for the network based on configuration data received via the graphical user interface, the configuration data comprising a first EPG selector from the plurality of EPG selectors, a second EPG selector from the plurality of EPG selectors, the traffic selector, and a communication operator defining a communication condition for traffic associated with the first EPG selector, the second EPG selector, and the traffic selector;
• determine whether security policies configured on the network comply with the security compliance requirement;
• and
• generate one or more compliance assurance events indicating whether the security policies configured on the network comply with the security compliance requirement.