Scalable source security group tag (sgt) propagation over third-party wan networks

A system comprising:

• one or more processors;
• and
• one or more non-transitory computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
• operatively coupling a control plane to a first border at a first site and to a second border at a second site:
• operatively coupling the first border of the first site to the second border of the second site:
• subscribing at the first border of the first site, by the control plane, a first security group tag (SGT) mapping associated with a first data packet at the first site for storing the SGT mapping of the first data packet at the control plane:
• transmitting, the first data packet directly from the first border of the first site to the second border of the second site without attaching the first SGT mapping associated with the first data packet while the first data packet is being transmitted;
• and
• in response to a determination by the control plane that the first data packet has reached the second border, identifying by the control plane the SGT mapping associated with the first data packet at the second border of the second site to enable the first SGT mapping to be re-associated with the first data packet at the second site.

One or more non-transitory computer-readable media storing computer-executable instructions that, when executed by one or more processors, cause the one or more processors to perform operations comprising:

• subscribing at a first border of a first site, by a control plane, a first security group tag (SGT) mapping associated with a first data packet at the first site for storing the SGT mapping of the first data packet at the control plane:
• transmitting, the first data packet directly from the first border of the first site to a second border of the second site without attaching the first SGT mapping associated with the first data packet while the first data packet is being transmitted;
• and
• in response to a determination by the control plane that the associated first SGT mapping is lost at the second border, identifying by the control plane the SGT mapping associated with the first data packet at the second border to enable the first SGT mapping to be re-associated with the first data packet at the second site.