Single whitelisted ingress endpoint on 1 and 2 way TLS connections
Disclosed herein are methods, systems, and processes for implementing a single whitelisted ingress endpoint on both one-way and two-way Transport Layer Security (TLS) connections and performing load balancing. Both two-way TLS agent-based traffic and one-way TLS non-agent-based traffic is routed through a single whitelisted internet protocol (IP) endpoint. A TLS connection is transmitted from a network load balancer and to a platform gateway service that operates as a Server Name Indication (SNI) reverse proxy server. The platform gateway service separates out the one-way TLS non-agent-based traffic that is part of the TLS connection based on a TLS header of the TLS connection. The one-way TLS non-agent-based traffic is then selectively terminated on an elastic load balancer.
1. A computer-implemented method, comprising:
routing agent-based network traffic and non-agent-based network traffic from a network through a single whitelisted internet protocol (IP) endpoint,
wherein
the IP endpoint is implemented by a platform gateway service of a cloud-based cybersecurity platform monitoring the network;
performing, by the platform gateway service:
separating the agent-based network traffic and the non-agent-based network traffic;
terminating the non-agent-based network traffic on an elastic load balancer of the cybersecurity platform; and
terminating the agent-based network traffic on one or more server instances of the cybersecurity platform that implements an ingress API for the agent-based network traffic.
2. The computer-implemented method of claim 1 , wherein
the agent-based network traffic represents two-way transport layer security (TLS) traffic associated with a TLS connection.
3. The computer-implemented method of claim 2 , wherein
the non-agent-based network traffic represents one-way TLS traffic associated with the TLS connection.
4. The computer-implemented method of claim 3 , wherein
separating out the one-way TLS traffic comprises:
tunneling the TLS connection from a network load balancer to a reverse proxy based on one or more server name indication (SNI) fields in a TLS header of the TLS connection.
5. The computer-implemented method of claim 4 , further comprising:
determining whether a service routed to the network load balancer is the one-way TLS traffic or the two-way TLS traffic based on the TLS header.
6. The computer-implemented method of claim of claim 5 , wherein
the TLS connection is a multiplexed TLS connection,
the multiplexed TLS connection comprises the one-way TLS traffic and the two-way TLS traffic, and
the one-way TLS traffic and the two-way TLS traffic share the TLS header.
7. The computer-implemented method of claim 6 , further comprising:
terminating the two-way TLS traffic on the one or more server instances; and
terminating the one-way TLS traffic on the elastic load balancer.
8. The computer-implemented method of claim 6 , further comprising:
decrypting a request for the service; and
forwarding the decrypted request for the service to the one or more server instances.
9. A non-transitory computer readable storage medium comprising program instructions executable to implement a platform gateway service of a cloud-based cybersecurity platform and cause the platform gateway service to:
receive agent-based network traffic and non-agent-based network traffic routed from a network through a single whitelisted internet protocol (IP) endpoint implemented by the platform gateway service;
separate the agent-based network traffic and the non-agent-based network traffic;
terminate the non-agent-based network traffic on an elastic load balancer of the cybersecurity platform; and
terminate the agent-based network traffic on one or more server instances of the cybersecurity platform that implements an ingress API for the agent-based network traffic.
10. The non-transitory computer readable storage medium of claim 9 , wherein
the agent-based network traffic represents two-way transport layer security (TLS) traffic associated with a TLS connection, and
the non-agent-based network traffic represents one-way TLS traffic associated with the TLS connection.
11. The non-transitory computer readable storage medium of claim 10 , wherein
separating out the one-way TLS traffic comprises:
tunneling the TLS connection from a network load balancer to a reverse proxy based on one or more server name indication (SM) fields in a TLS header of the TLS connection.
12. The non-transitory computer readable storage medium of claim 11 , further comprising:
determining whether a service routed to the network load balancer is the one-way TLS traffic or the two-way TLS traffic based on the TLS header.
13. The non-transitory computer readable storage medium of claim 12 , wherein
the TLS connection is a multiplexed TLS connection,
the multiplexed TLS connection comprises the one-way TLS traffic and the two-way TLS traffic, and
the one-way TLS traffic and the two-way TLS traffic share the TLS header.
14. The non-transitory computer readable storage medium of claim 13 , further comprising:
terminating the two-way TLS traffic on the one or more server instances,
terminating the one-way TLS traffic on the elastic load balancer;
decrypting a request for the service; and
forwarding the decrypted request for the service to the one or more server instances.
15. A system comprising:
one or more processors; and
a memory coupled to the one or more processors, wherein the memory stores program instructions executable by the one or more processors to:
receive agent-based network traffic and non-agent-based network traffic routed from a network through a single whitelisted internet protocol (IP) endpoint implemented by a platform gateway service of a cloud-based cybersecurity platform monitoring the network;
cause the platform gateway service to:
separate the agent-based network traffic and the non-agent-based network traffic;
terminate the non-agent-based network traffic on an elastic load balancer of the cybersecurity platform; and
terminate the agent-based network traffic on one or more server instances of the cybersecurity platform that implements an ingress API for the agent-based network traffic.
16. The system of claim 15 , wherein
the agent-based network traffic represents two-way transport layer security (TLS) traffic associated with a TLS connection, and
the non-agent-based network traffic represents one-way TLS traffic associated with the TLS connection.
17. The system of claim 16 , wherein
separating out the one-way TLS traffic comprises tunneling the TLS connection from a network load balancer to a reverse proxy based on one or more server name indication (SNI) fields in a TLS header of the TLS connection.
18. The system of claim 17 , further comprising:
determining whether a service routed to the network load balancer is the one-way TLS traffic or the two-way TLS traffic based on the TLS header.
19. The system of claim 18 , wherein
the TLS connection is a multiplexed TLS connection,
the multiplexed TLS connection comprises the one-way TLS traffic and the two-way TLS traffic, and
the one-way TLS traffic and the two-way TLS traffic share the TLS header.
20. The system of claim 19 , further comprising:
terminating the two-way TLS traffic on the one or more server instances,
terminating the one-way TLS traffic on the elastic load balancer;
decrypting a request for the service; and
forwarding the decrypted request for the service to the one or more server instances.