Creating network isolation between virtual machines

A computer system for creating network isolation comprising a memory, a processing unit communicatively coupled to the memory, and a management module communicatively coupled to the memory and processing unit, wherein the management module is configured to perform the steps of a method comprising:

• receiving, by a security virtual machine (SVM) agent in a virtual I/O server (VIOS) of a managed system, an outgoing network packet from a virtual machine (VM),
• wherein the SVM agent maintains one or more zone identifier tables, each zone identifier table in the SVM agent is associated with a logical zone in the managed system,
• wherein the VM is contained within the logical zone and is associated with a specific company, organization or business membership, and
• wherein the managed system is managed by a SVM manager;
• extracting, by the SVM agent, source data and destination data from the outgoing network packet, wherein the source data includes at least a source internet protocol (IP) address and a source media access control (MAC) address, and wherein the destination data includes at least a destination IP address and a destination MAC address;
• searching, by the SVM agent, a zone identifier table associated with a source entry matching the source data from the outgoing network packet, and extracting a source zone identifier (id) from the source entry;
• searching, by the SVM agent, a zone identifier table associated with a destination entry matching the destination data from the outgoing network packet, and extracting a destination zone identifier (id) from the destination entry, based on the destination data being located in the zone identifier table associated with the source entry;
• routing, by the SVM agent, the outgoing network packet to a first physical Ethernet adapter connected to an internal switch, based on the source zone id matching the destination zone id;
• and
• routing, by the SVM agent, the outgoing network packet to a second physical Ethernet adapter connected to an external switch, based on the destination data not being located in the zone identifier table associated with the source entry, and the source zone id not matching the destination zone id,
• wherein the external switch is connected to an external network, the internal switch is connected to an internal network, and an outgoing network packet routed to the internal switch is segregated from an outgoing network packet routed to the external switch.