Group-based policies for inter-domain traffic

A first edge router that is configured to operate at a first site of a software-defined network (SDN) comprising:

• one or more processors;
• and
• one or more computer-readable non-transitory storage media coupled to one or more of the processors and comprising instructions operable when executed by one or more of the processors to cause the first edge router to:
• receive, from a second edge router configured to operate at a second site of the SDN, a request control message requesting a first identifier of a first group associated with a first host located within the first site, wherein the second site is different from the first site, and wherein the control message comprises a first Internet Protocol (IP) address of the first host;
• determine the first identifier of the first group based on the first IP address;
• send, to the second edge router, a response control message including the first identifier of the first group associated with the first host;
• receive, from the second edge router, a data packet destined to the first host, wherein the data packet is sent from a second host located within the second site, wherein the data packet includes the first IP address of the first host as a destination IP address, wherein the data packet includes a second identifier of a second group associated with the second host;
• determine that the second group is a source group of the data packet based on the second identifier of the second group in the data packet;
• determine that the first group is a destination group of the data packet based on the first IP address in the data packet;
• apply, to the data packet, one or more policies associated with a combination of the source group and the destination group;
• and
• cause the data packet to be routed to the first host within the first site.

One or more computer-readable non-transitory storage media embodying software that is operable on a first edge router configured to operate at a first site of a software-defined network (SDN) when executed to:

• receive, from a second edge router configured to operate at a second site of the SDN, a request control message requesting a first identifier of a first group associated with a first host located within the first site, wherein the second site is different from the first site, and wherein the control message comprises a first Internet Protocol (IP) address of the first host;
• determine the first identifier of the first group based on the first IP address;
• send, to the second edge router, a response control message including the first identifier of the first group associated with the first host;
• receive, from the second edge router, a data packet destined to the first host, wherein the data packet is sent from a second host located within the second site, wherein the data packet includes the first IP address of the first host as a destination IP address, wherein the data packet includes a second identifier of a second group associated with the second host;
• determine that the second group is a source group of the data packet based on the second identifier of the second group in the data packet;
• determine that the first group is a destination group of the data packet based on the first IP address in the data packet;
• apply, to the data packet, one or more policies associated with a combination of the source group and the destination group;
• and
• cause the data packet to be routed to the first host within the first site.