Patent ID: 8295168

Claim:
A method comprising: receiving at an egress network device a packet that includes a security group tag identifying a security group designation classifying the packet, the security group designation corresponding to a group of source nodes, and the security group designation providing a mechanism for associating the group of source nodes to a group of destination nodes that the group of source nodes is destinations and a set of sources authorized to access, wherein the group of source nodes and the group of destination nodes are members of a same private network, wherein the egress network device is located at a first edge of a cloud of network devices and an ingress network device is located at a second edge of such cloud, and wherein the security group tag was applied to said packet at the ingress network device; determining at the egress network device, based at least in part on the security group tag, to forward the packet to a destination device; and forwarding the packet to the destination device based on the determination to forward such packet based at least in part on the security group tag.