load object and allows for policy controls that can protect the external access to all logical objects in the workgroup independent of network and system topology location of the objects. This extends the east-west protections as well as provides a strong higher-level north-south protection for the entire workgroup. The workgroup protections enable policy controls that are not as effec- tively implemented at the workload object level. The next security ring completes the protection model by adding perimeter protection. Firewall Intrusion Protection FIGURE 9.20 Conceptual view of microperimeter on VM2 (two rings). Building the Network of the Future Workgroup Security Perimeter Workgroup Employee Directory FIGURE 9.21 Conceptual view of workgroup/tenant-level perimeter. 9.5.3.4 Network Perimeter (Classic Network Protection) As mentioned previously, the classic perimeter protection strategies are by themselves not capable of completely protecting today's enterprise and especially cloud-computing environments. However, used in conjunction with a multilayered protection strategy, the network perimeter is still an important capa- bility to help protect today's enterprise data center environments. This gatekeeper function provided by traditional perimeter security technologies can still establish highly scalable and effective first level of defense capabilities when used in conjunction with intelligent and dynamic policy provisioning and orchestration. This is depicted for a single site in Figure 9.22, and collectively across multiple data cen- ter sites as shown in Figure 9.23, which extends the perimeter protection to the entire enterprise. Compute Center Classic Security Perimeter FIGURE 9.22 Conceptual view of classis security perimeter-single site. Network Security Compute Center A Compute Center B Internet FIGURE 9.23 Conceptual view of classis security perimeter-multiple sites. The combination of these security protection layers provides a comprehensive protection strat- egy ranging from the smallest work object,