Dynamic routing of application traffic to ZTNA connectors

1 . A system for routing zero trust network access to a customer application, the system comprising:

a customer premises including:

an application, and

a zero trust network access appliance configured to authenticate users for access to the application, the zero trust network access appliance including a reverse proxy client;

a cloud computing platform remote from the customer premises, the cloud computing platform including:

a plurality of service proxies providing a network access point for the application,

a network load balancer for distributing access requests to the plurality of service proxies,

and

a reverse proxy server configured to establish a secure tunnel, wherein the plurality of service proxies is configured to couple an incoming request for the application to the reverse proxy server to the reverse proxy client of the zero trust network access appliance;

a threat management facility remote from the customer premises and the cloud computing platform, the threat management facility configured to provide security services for the customer premises and a control plane for zero trust network access to the application through the cloud computing platform, the threat management facility configured by computer executable code to provide a cloud-based data plane that connects a client to the application through the cloud computing platform by performing the steps of:

receiving configuration information for the application from the cloud computing platform, the configuration information including a name of the application and a port of the reverse proxy server for the secure tunnel;

configuring one or more of the plurality of service proxies to forward the incoming request from the client for the application to the reverse proxy server and the port for the secure tunnel, and

in response to detecting a degradation in performance of the application:

configuring a second zero trust network access appliance at the customer premises, connecting the second zero trust network access appliance to the cloud computing platform through a second secure tunnel, and

configuring the one or more of the plurality of service proxies to forward the request from the client for the application to either of the secure tunnel or the second secure tunnel, further wherein the cloud computing platform includes a second network load balancer for managing traffic relating to the application between the secure tunnel and the second secure tunnel; and

an abstraction layer in the cloud computing platform, the abstraction layer configurable from the threat management facility to assign each of the plurality of service proxies in the cloud computing platform to a predetermined subset of applications hosted on one or more customer premises, and to assign the network load balancer to a predetermined subset of service proxies.

2 . The system of claim 1 , wherein the plurality of service proxies includes a cluster of service proxies accessed through the network load balancer.

3 . The system of claim 1 , wherein the configuration information for the application includes a certificate for the application.

4 . The system of claim 1 , wherein the configuration information for the application includes a fully qualified domain name for accessing the application.

5 . The system of claim 1 , wherein the configuration information for the application includes a name of a customer associated with the customer premises hosting the application.

6 . The system of claim 1 , wherein the configuration information for the application includes a name of the zero trust network access appliance providing access to the application.

7 . The system of claim 1 , wherein the reverse proxy client of the zero trust network access appliance is configured to create the secure tunnel by authenticating the zero trust network access appliance to the reverse proxy server on the cloud computing platform.

8 . The system of claim 1 , wherein the threat management facility includes an administrative console for configuring the zero trust network access appliance.

9 . A computer program product comprising computer executable code embodied in non-transitory computer executable code that, when executing on one or more computing devices, causes the one or more computing devices to perform the steps of:

receiving, at an administrative console of a threat management facility, a request to provide access to an application hosted on a customer premises through a zero trust network access appliance, wherein the threat management facility is configured to provide a cloud-based data plane that connects a client to the application through a cloud computing platform;

configuring the zero trust network access appliance at the customer premises by specifying first configuration information including at least:

a name of the application,

a certificate for authenticated access to the application, and

a fully qualified domain name for accessing the application on a network;

receiving second configuration information for the application from the cloud computing platform, the second configuration information including at least a port of a reverse proxy server at the cloud computing platform connected to a reverse proxy client of the zero trust network access appliance through a secure tunnel;

configuring a service proxy at the cloud computing platform to provide access to the application based on the first configuration information and the second configuration information;

providing an abstraction layer in the cloud computing platform, the abstraction layer configurable from the threat management facility to assign the service proxy in the cloud computing platform to a predetermined subset of applications hosted on one or more customer premises, and to assign a network load balancer to a predetermined subset of service proxies; and

in response to detecting a degradation in performance of the application with the threat management facility:

configuring a second zero trust network access appliance at the customer premises, connecting the second zero trust network access appliance to the cloud computing platform through a second secure tunnel, and

configuring the service proxy to forward the request from the client for the application to either of the secure tunnel or the second secure tunnel,

further wherein the cloud computing platform includes a second network load balancer for managing traffic relating to the application between the secure tunnel and the second secure tunnel.

10 . The computer program product of claim 9 , further comprising code that causes the one or more computing devices to balance a load to the application by performing the steps of:

instantiating a plurality of zero trust network access appliances for the application on the customer premises,

configuring a cluster of service proxies at the cloud computing platform to provide access to the application, and

causing the network load balancer to manage demand for the application among a plurality of secure tunnels for the plurality of zero trust network access appliances.

11 . The computer program product of claim 10 , further comprising code that performs the step of causing a second network load balancer to manage network traffic between a public data network and the cluster of service proxies configured to provide access to the application.

12 . The computer program product of claim 9 , wherein the threat management facility provides a control plane for zero trust network access to the application through the cloud computing platform.

13 . The computer program product of claim 9 , wherein the zero trust network access appliance is configured to provide access to a plurality of applications hosted at the customer premises.

14 . A method comprising:

receiving a request to provide zero trust network access to an application hosted on a customer premises;

providing a cloud-based data plane that connects a client to the application through a cloud computing platform;

configuring a zero trust network access appliance at the customer premises by specifying first configuration information for the application;

receiving second configuration information for the application from the cloud computing platform that hosts a zero trust network access service for the application remotely from the customer premises;

configuring a service proxy at the cloud computing platform to provide access to the application through a secure tunnel based on the first configuration information and the second configuration information;

providing an abstraction layer in the cloud computing platform, the abstraction layer configurable to assign the service proxy in the cloud computing platform to a predetermined subset of applications hosted on one or more customer premises, and to assign a network load balancer to a predetermined subset of service proxies; and

in response to detecting a degradation in performance of the application with a threat management facility for the customer premises:

configuring a second zero trust network access appliance at the customer premises,

connecting the second zero trust network access appliance to the cloud computing platform through a second secure tunnel, and

configuring the service proxy to forward the request from the client for the application to either of the secure tunnel or the second secure tunnel,

further wherein the cloud computing platform includes a second network load balancer for managing traffic relating to the application between the secure tunnel and the second secure tunnel.

15 . The method of claim 14 , further comprising configuring a cluster of service proxies at the cloud computing platform to provide access to the application.

16 . The method of claim 15 , further comprising configuring a plurality of zero trust network access appliances at the customer premises for the application.

17 . The method of claim 16 , further comprising dynamically routing requests for the application among the plurality of zero trust network access appliances at the cloud computing platform to balance a load associated with use of the application among the plurality of zero trust network access appliances.

18 . The method of claim 14 , wherein the threat management facility is a cloud resource external to the customer premises.

19 . The method of claim 14 , wherein the first configuration information includes at least:

a name of the application,

a certificate for authenticated access to the application, and

a fully qualified domain name for accessing the application on a network.

20 . The method of claim 14 , wherein the second configuration information includes at least a port of a reverse proxy server at the cloud computing platform connected to a reverse proxy client of the zero trust network access appliance through the secure tunnel.