Propagating policy changes in a network using distributed policy enforcement

A network element, comprising:

• a processor;
• a non-transitory computer readable medium, comprising instructions for:
• receiving a first offload message specifying a flow and a first enforcement action at a first time, wherein the first enforcement action was determined at a firewall in association with a policy;
• determining that the flow as received in the first offload message should be installed;
• storing the flow in association with the first enforcement action;
• determining first received traffic is associated with the flow received at the first time;
• applying the first enforcement action to the first received traffic at the network element without forwarding traffic to the firewall;
• receiving a second offload message specifying the flow and a second enforcement action at a second time, wherein the second enforcement action was determined at the firewall in association with an update to the policy;
• determining that the flow as received in the second offload message should be installed;
• replacing the flow in association with the first enforcement action with the flow in association with the second enforcement action at the network element;
• determining second received traffic is associated with the flow received at the second time;
• and
• applying the second enforcement action to the second received traffic at the network element without forwarding traffic to the firewall.

A non-transitory computer readable medium, comprising instructions for:

• installing a flow associated with a first enforcement action at a firewall based on a policy;
• offloading the flow associated with the policy to a network element in association with the first enforcement action at a first time, wherein the flow is installed at the network element with the first enforcement action and the network element is adapted to control traffic associated with the flow according to the first enforcement action;
• selecting the flow for offloading at a second time based on an update to the policy comprising a second enforcement action, where the flow is selected for offloading based on an indication associated with the installed flow that the policy was updated, wherein the indication was set based on a heartbeat message associated with the flow received from the network element;
• offloading the flow associated with the policy to the network element with the second enforcement action at a second time, wherein the flow is installed at the network element with the second enforcement action and the network element controls traffic associated with the flow according to the second enforcement action without forwarding traffic to the firewall.