Distributed policy enforcement proxy with dynamic epg sharding

An apparatus comprising:

• a network interface configured to communicate with a plurality of network elements;
• and
• a processor configured to:
• configure a first network element among the plurality of network elements to apply a network policy for traffic associated with a first endpoint group, the first network element connected to one or more first endpoints in the first endpoint group;
• detect whether policy entries associated with the first endpoint group are overloading policy resources at the first network element;
• responsive to a determination that the policy entries associated with the first endpoint group are overloading policy resources at the first network element, select a plurality of policy proxy network elements among the plurality of network elements;
• assign a range of endpoint groups to each policy proxy network element among the selected plurality of policy proxy network elements, each policy proxy network element assigned to handle policy processing for traffic with destination endpoints belonging to a corresponding assigned range of endpoint groups, wherein the range of endpoint groups assigned to each particular policy proxy network element is exclusive to the particular policy proxy network element;
• cause the network interface to provide instructions to the selected plurality of policy proxy network elements to enable each policy proxy network element to apply the network policy for the corresponding assigned range of endpoint groups;
• and
• cause the network interface to provide instructions to the first network element to redirect a packet from the one or more first endpoints in the first endpoint group to a first policy proxy network element among the selected plurality of policy proxy network elements based on a destination of the packet.

A system comprising:

• a plurality of network elements including a first network element connected to one or more first endpoints in a first endpoint group;
• and
• a network controller coupled to the plurality of network elements, the network controller configured to:
• configure the first network element to apply a network policy for traffic associated with the first endpoint group;
• detect whether policy entries associated with the first endpoint group are overloading policy resources at the first network element;
• responsive to a determination that the policy entries associated with the first endpoint group are overloading policy resources at the first network element, select a plurality of policy proxy network elements among the plurality of network elements;
• assign a range of endpoint groups to each policy proxy network element among the selected plurality of policy proxy network elements, each policy proxy network element assigned to handle policy processing for traffic with destination endpoints belonging to a corresponding assigned range of endpoint groups, wherein the range of endpoint groups assigned to each particular policy proxy network element is exclusive to the particular policy proxy network element;
• provide instructions to the selected plurality of policy proxy network elements to enable each policy proxy network element to apply the network policy for the corresponding assigned range of endpoint groups;
• and
• provide instructions to the first network element to redirect a packet from the one or more first endpoints in the first endpoint group to a first policy proxy network element among the selected plurality of policy proxy network elements based on a destination of the packet.