Patent ID: 8301882

Claim:
A computer-implemented method comprising: receiving a packet at an ingress node of a network, wherein said network comprises a plurality of nodes, said ingress node is one of said plurality of nodes, said packet is received from a source node communicatively coupled to said network at said ingress node, said packet comprises source security group information, and a destination address, said destination address is an address of a network node communicatively coupled to said network, said source security group information identifies a source security group, said source node is a member of said source security group, and said network node is a destination of said packet; extracting said destination address from said packet, using a processor of said ingress node; determining destination security group information, using said processor, wherein said destination security group information is determined using said destination address; and performing access control processing on said packet, using said processor, wherein said access control processing comprises comparing said destination security group information and said source security group information.