Network wide source group tag binding propagation

A method comprising:

• receiving a trace packet comprising an IP (Internet Protocol) to Source Group Tag (SGT) binding at an SGT capable device, the packet received from a non-SGT capable device interposed between a sender of the trace packet and the SGT capable device;
• installing a filter based on said IP to SGT binding at the SGT capable device;
• generating a reply packet in response to the trace packet, the reply packet indicating that said IP to SGT binding was installed at the SGT capable device;
• and
• transmitting the reply packet to the sender.

An apparatus comprising:

• an interface for communication with a Source Group Tag (SGT) capable device via one or more non-SGT capable network devices;
• a processor for generating a trace packet comprising an IP (Internet Protocol) to SGT binding, transmitting the trace packet to the SGT capable device, and processing a reply packet received from the SGT capable device in response to the trace packet, the reply packet indicating that said IP to SGT binding was installed at the SGT capable device;
• and
• memory for storing said IP to SGT binding.

An apparatus comprising logic encoded on one or more non-transitory computer readable media for execution and when executed by a processor operable to:

• generate at a network device, a trace packet comprising an IP (Internet Protocol) to Source Group Tag (SGT) binding;
• transmit the trace packet from the network device to an SGT capable device, wherein at least one non-SGT capable device is interposed in a path between the network device and the SGT capable device;
• and
• process at the network device, a reply packet from the SGT capable device in response to the trace packet, the reply packet indicating that said IP to SGT binding was installed at the SGT capable device.