Patent ID: 8146148

Claim:
A network device comprising: a processor; a first memory, wherein said processor and said first memory are coupled to one another, said processor is configured to dynamically set up a tunnel comprising detecting that no tunnel exists between a first ingress router and an egress router specified by a packet, and said processor is configured to create the tunnel in response to the detecting, wherein all network traffic received via the tunnel is associated with the security group; a tunnel classification stage, wherein said processor is coupled to control said tunnel classification stage, said tunnel classification stage comprises a packet processing section comprising at least one processor, a security group identifier identification unit, coupled to said packet processing section, and a tunnel classification unit, coupled to said packet processing section and said security group identifier identification unit, said security group identifier is configured to identify a security group of a sender of said packet, said security group comprises a plurality of senders, said plurality of senders comprises said sender, and said packet processing section is configured to classify said packet, wherein said classifying comprises selecting a network layer of a plurality of network layers at which said packet is to be classified, and said classifying is based, at least in part, on a destination of said packet and a security group identifier (SGI) assigned to said packet, said SGI identifies a security group of a sender of said packet, determine a routing of said packet based on a result of said classifying, wherein said packet processing section is configured to determine said routing by virtue of being configured to identify a tunnel using said destination address; identifying a tunnel identifier of said tunnel based on said routing of said packet, wherein said tunnel identifier uniquely identifies said runnel; determine whether forwarding said packet via said runnel is permitted, wherein said packet processing section is configured to determine whether said forwarding is permitted based, by selecting an entry of an access control list (ACL) using at least said SGI and said tunnel identifier, and forward said packet via said tunnel, if said forwarding said packet via said tunnel is permitted.