A method for operating network devices, the method comprising: storing, in a first endpoint (220-223, 320-323, 620-623, 720-723, 920-923) of a first device (210-213, 310-313, 610-613, 710-713, 910-913), a first list of addresses of other endpoints within a virtual network which the first endpoint is aware of and with which the first endpoint is authorized to communicate; storing, in a second endpoint (220-223, 320-323, 620-623, 720-723, 920-923) of a second device (210-213, 310-313, 610-613, 710-713, 910-913), a second list of addresses of other endpoints within the virtual network with which the second endpoint is authorized to communicate; receiving, at the first device, a request to isolate the first device from the second device; receiving, at the second device, a request to isolate the second device from the first device; determining, at the second device, a first address of the first endpoint corresponding to the first device in the second list; determining, at the first device, a second address of the second endpoint corresponding to the second device in the first list; configuring the first endpoint to prevent communications of the first endpoint with the second endpoint by removing the second address of the second endpoint from the first list of addresses stored in the first endpoint; and configuring the second endpoint to prevent communications of the second endpoint with the first endpoint by removing the first address of the first endpoint from the second list of addresses stored in the second endpoint; wherein: the first endpoint is unaware of any endpoint not on the first list and is restricted to communicating therewith; the second endpoint is unaware of any endpoint not on the second list and is restricted to communicating therewith; and the first device and the second device communicate in the virtual network via the first endpoint and the second endpoint. storing, in a first endpoint (220-223, 320-323, 620-623, 720-723, 920-923) of a first device (210-213, 310-313, 610-613, 710-713, 910-913), a first list of addresses of other endpoints within a virtual network which the first endpoint is aware of and with which the first endpoint is authorized to communicate; storing, in a second endpoint (220-223, 320-323, 620-623, 720-723, 920-923) of a second device (210-213, 310-313, 610-613, 710-713, 910-913), a second list of addresses of other endpoints within the virtual network with which the second endpoint is authorized to communicate; receiving, at the first device, a request to isolate the first device from the second device; receiving, at the second device, a request to isolate the second device from the first device; determining, at the second device, a first address of the first endpoint corresponding to the first device in the second list; determining, at the first device, a second address of the second endpoint corresponding to the second device in the first list; configuring the first endpoint to prevent communications of the first endpoint with the second endpoint by removing the second address of the second endpoint from the first list of addresses stored in the first endpoint; and configuring the second endpoint to prevent communications of the second endpoint with the first endpoint by removing the first address of the first endpoint from the second list of addresses stored in the second endpoint; wherein: the first endpoint is unaware of any endpoint not on the first list and is restricted to communicating therewith; the second endpoint is unaware of any endpoint not on the second list and is restricted to communicating therewith; and the first device and the second device communicate in the virtual network via the first endpoint and the second endpoint. the first endpoint is unaware of any endpoint not on the first list and is restricted to communicating therewith; the second endpoint is unaware of any endpoint not on the second list and is restricted to communicating therewith; and the first device and the second device communicate in the virtual network via the first endpoint and the second endpoint.