Traffic load balancing between a plurality of points of presence of a cloud computing infrastructure

1. A method of load balancing traffic between a plurality of Points of Presence (PoPs) of a cloud computing infrastructure that provides a cloud computing service to one or more users, the method comprising:

receiving, at a first PoP of the plurality of PoPs, a first packet that includes as a first destination address an anycast address advertised by the first PoP for reaching the cloud computing service;

determining, based on a first forwarding table entry in a forwarding table and a first identifier for a first flow of the first packet, a network address of a second PoP of the plurality of PoPs that is different from the first PoP by:

identifying an IP address of the second PoP as the network address and a first inter-PoP indicator value indicating that the first packet is to be forwarded to the second PoP that is different from the first PoP, wherein the forwarding table is generated based on forwarding policies defining an amount of traffic to forward between the first PoP and the plurality of PoPs;

encapsulating the first packet into a first encapsulated packet that includes the network address of the second PoP as a destination address of the first encapsulated packet; and

transmitting the first encapsulated packet to the second PoP.

2. The method of claim 1 , wherein encapsulating the first packet into the first encapsulated packet further comprises:

including the network address of the second PoP in a field of a first encapsulation header of the first encapsulated packet.

3. The method of claim 1 , further comprising:

receiving at the first PoP of the plurality of PoPs a second packet that includes as a second destination address the anycast address advertised by the first PoP for reaching the cloud computing service;

determining that the second packet is a security threat; and

responsive to determining that the second packet is the security threat, dropping the second packet.

4. The method of claim 1 , wherein determining the network address of the second PoP of the plurality of PoPs that is different from the first PoP further comprises:

determining the first identifier of the first packet; and

accessing the first forwarding table entry.

5. The method of claim 1 , wherein transmitting the first encapsulated packet to the second PoP further comprises:

transmitting the first encapsulated packet through an encapsulation tunnel.

6. The method of claim 1 , further comprising:

receiving at the first PoP of the plurality of PoPs a second packet that includes as a second destination address the anycast address advertised by the first PoP for reaching the cloud computing service;

determining that inter-PoP forwarding is not enabled based on a second inter-PoP indicator value; and

processing the second packet locally at the first PoP.

7. The method of claim 1 , wherein the first packet is received from a client device, and the first packet includes a request for the cloud computing service, wherein the request is for a network resource that is hosted on an origin server and the cloud computing service is a proxy service for the network resource.

8. A non-transitory machine-readable storage medium that provides instructions that, if executed by a processor of a first Pop of Presence (PoP) of a plurality of PoPs of a cloud computing infrastructure that provides a cloud computing service to one or more users, will cause said processor to perform the following operations:

receiving, at a first PoP of the plurality of PoPs, a first packet that includes as a first destination address an anycast address advertised by the first PoP for reaching the cloud computing service;

determining, based on a first forwarding table entry in a forwarding table and a first identifier for a first flow of the first packet, a network address of a second PoP of the plurality of PoPs that is different from the first PoP by:

identifying an IP address of the second PoP as the network address and a first inter-PoP indicator value indicating that the first packet is to be forwarded to the second PoP that is different from the first PoP, wherein the forwarding table is generated based on forwarding policies defining an amount of traffic to forward between the first PoP and the plurality of PoPs;

encapsulating the first packet into a first encapsulated packet that includes the network address of the second PoP as a destination address of the first encapsulated packet; and

transmitting the first encapsulated packet to the second PoP.

9. The non-transitory machine-readable storage medium of claim 8 , wherein encapsulating the first packet into the first encapsulated packet further causes the processor to perform the following operations:

including the network address of the second PoP in a field of a first encapsulation header of the first encapsulated packet.

10. The non-transitory machine-readable storage medium of claim 8 , wherein the instructions further cause the processor to perform the following operations:

receiving at the first PoP of the plurality of PoPs a second packet that includes as a second destination address the anycast address advertised by the first PoP for reaching the cloud computing service;

determining that the second packet is a security threat; and

responsive to determining that the second packet is the security threat, dropping the second packet.

11. The non-transitory machine-readable storage medium of claim 8 , wherein determining the network address of the second PoP of the plurality of PoPs that is different from the first PoP further causes the processor to perform the following operations:

determining the first identifier of the first packet; and

accessing the first forwarding table entry.

12. The non-transitory machine-readable storage medium of claim 8 , wherein transmitting the first encapsulated packet to the second PoP further causes the processor to perform the following operations:

transmitting the first encapsulated packet through an encapsulation tunnel.

13. The non-transitory machine-readable storage medium of claim 8 , wherein the instructions further cause the processor to perform the following operations:

receiving at the first PoP of the plurality of PoPs a second packet that includes as a second destination address the anycast address advertised by the first PoP for reaching the cloud computing service;

determining that inter-PoP forwarding is not enabled based on a second inter-PoP indicator value; and

processing the second packet locally at the first PoP.

14. The non-transitory machine-readable storage medium of claim 8 , wherein the first packet is received from a client device, and the first packet includes a request for the cloud computing service, wherein the request is for a network resource that is hosted on an origin server and the cloud computing service is a proxy service for the network resource.

15. A first Point of Presence (PoP) of a plurality of PoPs of a cloud computing infrastructure that provides a cloud computing service to one or more users, the first PoP comprising:

a non-transitory machine-readable storage medium that provides instructions that, if executed by a processor, will cause the first PoP to perform operations comprising:

receiving, at the first PoP of the plurality of PoPs, a first packet that includes as a first destination address an anycast address advertised by the first PoP for reaching the cloud computing service;

determining, based on a first forwarding table entry in a forwarding table and a first identifier for a first flow of the first packet, a network address of a second PoP of the plurality of PoPs that is different from the first PoP by:

identifying an IP address of the second PoP as the network address and a first inter-PoP indicator value indicating that the first packet is to be forwarded to the second PoP that is different from the first PoP, wherein the forwarding table is generated based on forwarding policies defining an amount of traffic to forward between the first PoP and the plurality of PoPs;

encapsulating the first packet into a first encapsulated packet that includes the network address of the second PoP as a destination address of the first encapsulated packet; and

transmitting the first encapsulated packet to the second PoP.

16. The first PoP of claim 15 , wherein encapsulating the first packet into the first encapsulated packet causes the first PoP to perform operations comprising:

including the network address of the second PoP in a field of a first encapsulation header of the first encapsulated packet.

17. The first PoP of claim 15 , wherein the operations further comprise:

receiving at the first PoP of the plurality of PoPs a second packet that includes as a second destination address the anycast address advertised by the first PoP for reaching the cloud computing service;

determining that the second packet is a security threat; and

responsive to determining that the second packet is the security threat, dropping the second packet.

18. The first PoP of claim 15 , wherein determining the second network address of the second PoP of the plurality of PoPs that is different from the first PoP causes the first PoP to perform operations comprising:

determining the first identifier of the first packet; and

accessing the first forwarding table entry.

19. The first PoP of claim 15 , wherein transmitting the first encapsulated packet to the second PoP causes the first PoP to perform operations comprising:

transmitting the first encapsulated packet through an encapsulation tunnel.

20. The first PoP of claim 15 , wherein the operations further comprise:

receiving at the first PoP of the plurality of PoPs a second packet that includes as a second destination address the anycast address advertised by the first PoP for reaching the cloud computing service;

determining that inter-PoP forwarding is not enabled based on a second inter-PoP indicator value; and

processing the second packet locally at the first PoP.

21. The first PoP of claim 15 , wherein the first packet is received from a client device, and the first packet includes a request for the cloud computing service, wherein the request is for a network resource that is hosted on an origin server and the cloud computing service is a proxy service for the network resource.