Cloud-based egress filtering system
In one embodiment, a computing platform features a controller in communication with one or more virtual private cloud networks, including a first virtual private cloud network (VPC). The virtual private cloud network includes at least a first egress filtering gateway configured to filter egress traffic data received from a first gateway and route the filtered egress traffic data to a public network in accordance with a first set of filter rules. The first set of filter rules are included as part of a first security policy provided by the controller.
1. A computing platform, comprising:
a controller deployed within a cloud computing platform and maintained within a non-transitory storage medium;
a first virtual private cloud network communicatively coupled to the controller, the first virtual private cloud network includes at least a first egress filtering gateway configured to:
filter egress traffic data received from a first gateway; and
route filtered egress traffic data to a public network in accordance with a first set of filter rules included as part of a first security policy provided by the controller,
wherein the controller is configured to enable a discovery mode of operation to access an audit log maintained by the first egress filtering gateway, the audit log comprising information associated with the egress traffic data that has been accepted or precluded from transmission.
2. The computing platform of claim 1 further comprising a first subnetwork included within the first virtual private cloud network, the first subnetwork comprises one or more cloud software instances being a source of the traffic data filtered by the first egress filtering gateway.
3. The computing platform of claim 2 , wherein the first virtual private cloud network corresponds to a spoke virtual private cloud network and the first gateway corresponds a first spoke gateway interposed to communicate with the one or more cloud instances and a plurality of egress filtering gateways including the first egress filtering gateway.
4. The computing platform of claim 1 further comprising:
a second virtual private cloud network communicatively coupled to the controller, the second virtual private cloud network includes at least a second egress filtering gateway configured to filter messages routed from a second gateway in accordance with a second set of filter rules included as part of a second security policy provided by the controller,
wherein the second set of filter rules being different from the first set of filter rules.
5. The computing platform of claim 4 , operating as a multi-cloud computing platform, wherein the first virtual private cloud network being deployed within a first public cloud network and the second virtual private cloud network being deployed within a second public cloud network that is different from the first public cloud network.
6. The computing platform of claim 1 , wherein the first virtual private cloud network corresponds to a transit virtual private cloud network and the first gateway corresponds a first transit gateway communicatively coupled to a plurality of egress filtering gateways including the first egress filtering gateway.
7. The computing platform of claim 1 , wherein the controller is configured to conduct analytics on the information associated with the egress traffic data to generate analytic results for subsequent display by a management console.
8. The computing platform of claim 1 , wherein the egress filtering gateway corresponds to logic conducting Fully Qualified Domain Name (FQDN) filtering.
9. A non-transitory storage medium including one or more egress filtering gateways being software that, upon execution and operability controlled by a controller, performs operations, comprising:
receiving, by a first egress filtering gateway of the one or more egress filtering gateways, a first security policy including a first set of filter rules;
receiving, by the first egress filtering gateway, egress traffic data for routing over a public network;
conducting, by the first egress filtering gateway, Fully Qualified Domain Name (FQDN) filtering of the egress traffic data in accordance with the first set of filter rules of the first security policy provided by the controller, the egress traffic data being received from a first gateway for routing to the public network; and
enabling, by the controller, a discovery mode of operation to access an audit log maintained by the first egress filtering gateway, the audit log comprising information associated with the egress traffic data that has been accepted or precluded from transmission.
10. The non-transitory storage medium of claim 9 , wherein the received egress traffic data originating from a first subnetwork included within a first virtual private cloud network that includes the one or more egress filtering gateways, the first subnetwork comprises one or more cloud software instances being a source of the traffic data filtered by the first egress filtering gateway.
11. The non-transitory storage medium of claim 9 , further comprising;
collecting information associated with the egress traffic data with an audit log associated with the first egress filtering gateway, the information identifying messages associated with a first set of egress traffic data with acceptable FQDNs and messages associated with a second set of egress traffic data with FQDNs precluded from transmission.
12. The non-transitory storage medium of claim 11 further comprising:
conducting analytics on the information associated with the egress traffic data to generate analytic results for subsequent display by a management console.