Policy enforcement on multi-destination packets in a distributed tunnel fabric

A non-transitory computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method, the method comprising:

• generating, from a first policy defined for a switch, a second policy, wherein the first policy indicates whether a type of traffic is allowed from a source role to a destination role via an overlay tunnel, wherein the second policy indicates a plurality of destination roles that are allowed to receive multi-destination packets of the type of traffic from the source role via the overlay tunnel;
• in response to identifying a host associated with a role at a port of the switch, determining whether the role belongs to the plurality of destination roles based on the second policy;
• and
• in response to the role belonging to the plurality of allowed destination roles, allowing the port to forward a multi-destination packet associated with the type of traffic, wherein the multi-destination packet is received at the switch via the overlay tunnel.

A computer system, comprising:

• a processor;
• a non-transitory computer-readable storage medium storing instructions, which when executed by the processor causes the processor to perform a method, the method comprising:
• generating, from a first policy defined for the computer system, a second policy, wherein the first policy indicates whether a type of traffic is allowed from a source role to a destination role via an overlay tunnel, wherein the second policy indicates a plurality of destination roles that are allowed to receive multi-destination packets of the type of traffic from the source role via the overlay tunnel;
• in response to identifying a host associated with a role at a port of the computer system, determining whether the role belongs to the plurality of destination roles based on the second policy;
• and
• in response to the role belonging to the plurality of allowed destination roles, allowing the port to forward a multi-destination packet associated with the type of traffic, wherein the multi-destination packet is received at the computer system via the overlay tunnel.