Methods and apparatus for implementing access control at a network switch

A non-transitory processor-readable medium storing code representing instructions to be executed by a processor, the code comprising code to cause the processor to:

• receive, at a switch device and from a first virtual port from a first set of virtual ports, a first data unit, the first data unit having a destination identifier associated with a second virtual port from the first set of virtual ports;
• prohibit the first data unit from being sent to the second virtual port from the first set of virtual ports in response to each virtual port from the first set of virtual ports being associated with a first access group, the first access group being associated with an access set;
• receive at the switch device and from the first virtual port from the first set of virtual ports, a second data unit, the second data unit having a destination identifier associated with a virtual port from a second set of virtual ports associated with a second access group, the second set of virtual ports is mutually exclusive from the first set of virtual ports;
• and
• send the second data unit to the virtual port from the second set of virtual ports when the second access group is associated with the access set.

An apparatus, comprising:

• a switch module implemented in a memory or a processing device, the switch module configured to be operatively coupled to a plurality of virtual ports;
• and
• an access set table accessible to the switch module, the access set table configured to associate an identifier of each virtual port from the plurality of virtual ports with an identifier of an access group from a plurality of access groups, the access set table configured to associate an identifier of each access group from the plurality of access groups with an identifier of at least one access set, the switch module configured to implement a plurality of filter rules based on the access set table, the plurality of virtual ports including a first virtual port that is associated with a first access group (1) from the plurality of access groups and (2) associated with an access set from the at least one access set, the plurality of virtual ports including a second virtual port associated with a second access group from the plurality of access groups,
• the switch module configured to prohibit a first data unit received from the first virtual port from being sent to a third virtual port from the plurality of virtual ports based on a first filter rule (1) from the plurality of filter rules and (2) indicating that the third virtual port is associated with the first access group,
• the switch module configured to allow a second data unit received from the first virtual port to be sent to the second virtual port based on a second filter rule (1) from the plurality of filter rules and (2) indicating that the second access group is associated with the access set from the at least one access set.