Patent ID: 7567510

Claim:
A method of implementing a security group within a network, the method comprising: receiving a packet at an ingress port of a first router that forms a first edge of a cloud of routers in an enterprise network; classifying the packet at the ingress port as having a security group designation selected from a plurality of security group designations, the security group designation associating a set of destinations and a set of sources authorized to access the set of destinations; applying a security group tag to the packet at the ingress port, the security group tag identifying the security group designation and the security group tag being applied in a field not reserved for virtual local area network information; transmitting the packet from the ingress port to the egress port of a second router only via routers in the cloud of routers of the enterprise network, the second router forming a second edge of the cloud of routers; and determining, based at least in part on the security group tag and at the egress port, whether the packet should be transmitted to a device.