Unified network service that connects multiple disparate private networks and end user client devices operating on separate networks
A unified network service that connects multiple disparate private networks and end user client devices operating on separate networks is described. The multiple disparate private networks and end user client devices connect to a distributed cloud computing network that provides routing services, security services, and performance services, and that can be controlled consistently regardless of the connection type. The unified network service provides uniform access control at the L3 layer (e.g., at the IP layer) or at a higher layer using user identity information (e.g., a zero-trust model). The disparate private networks are run on top of the distributed cloud computing network. The virtual routing layer of the distributed cloud computing network allows customers of the service to have private resources visible only to client devices (e.g., user devices of the customer and/or server devices of the customer) of the organization while using address space that potentially overlaps with other customers of the distributed cloud computing network.
1. A method, comprising:
receiving first traffic at a first traffic interface at a first compute server of a distributed cloud computing network, wherein the received first traffic is destined for a private application or service running on a server of a customer of a unified network service provided through the distributed cloud computing network, wherein the server is outside of the distributed cloud computing network, wherein the first traffic interface is an IPsec tunnel interface that interfaces with an IPsec tunnel from a router of the customer, wherein the IPsec tunnel interface is assigned an IP address that is an anycast IP address that is shared among the first compute server and a plurality of other compute servers of the distributed cloud computing network, and wherein a different one of the other compute servers of the distributed cloud computing network performed a handshake with the router including generating a set of one or more security associations for encrypting and decrypting;
receiving the generated set of one or more security associations for encrypting and decrypting traffic on the IPsec tunnel interface, wherein the received first traffic is encrypted;
decrypting the encrypted received first traffic using the set of one or more security associations;
determining identity information associated with the received first traffic including that the received first traffic is attributable to the customer including identifying the customer based on the IPsec tunnel being associated with an account of the customer;
determining, using one or more policies configured for the customer and the determined identity information associated with the received first traffic, whether the received first traffic is allowed to be transmitted to the private application or service including determining whether traffic received over the IPsec tunnel is allowed to access the private application or service;
responsive to determining that the received first traffic is allowed to be transmitted to the private application or service, determining a second traffic interface that interfaces with the server of the customer, wherein the second traffic interface is a layer 7 traffic interface, and wherein the determined second traffic interface is on a second compute server of the distributed cloud computing network;
transmitting the received first traffic from the first compute server to the determined second traffic interface on the second compute server; and
transmitting, from the determined second traffic interface on the second compute server to the server of the customer, the received first traffic.
2. The method of claim 1 , further comprising:
receiving second traffic at a third traffic interface at a first compute server of a distributed cloud computing network, wherein the third traffic interface is a generic routing encapsulation (GRE) interface that interfaces with a GRE tunnel from the router of the customer, and wherein the received second traffic is destined for the private application or service running on the server of the customer;
determining identity information associated with the received second traffic including that the received second traffic is attributable to the customer based based on the GRE tunnel being associated with an account of the customer;
determining, using one or more policies configured for the customer and the determined identity information associated with the received second traffic, whether the received second traffic is allowed to be transmitted to the private application or service including determining whether traffic received over the GRE tunnel is allowed to access the private application or service;
responsive to determining that the received second traffic is allowed to be transmitted to the private application or service, determining the second traffic interface that interfaces with the server of the customer; and
transmitting the received second traffic from the first compute server to the determined second traffic interface on the second compute server for transmitting the received second traffic to the private application or service.
3. The method of claim 2 , wherein determining the identity information associated with the received second traffic further includes identifying a user of the customer transmitting the second traffic over the GRE tunnel, and wherein determining whether the received second traffic at the GRE interface is allowed to be transmitted to the private application or service further includes determining whether the identified user is allowed to access the private application or service.
4. The method of claim 1 , further comprising:
receiving second traffic at a third traffic interface at a first compute server of a distributed cloud computing network, wherein the third traffic interface is a virtual private network (VPN) interface that interfaces with a VPN tunnel connected to a VPN client, and wherein the received second traffic is destined for the private application or service running on the server of the customer;
determining identity information associated with the received second traffic including determining a user of the VPN client;
determining, using one or more policies configured for the customer and the determined identity information associated with the received second traffic, whether the received second traffic is allowed to be transmitted to the private application or service including determining whether the determined user is allowed to access the private application or service;
responsive to determining that the received second traffic is allowed to be transmitted to the private application or service, determining the second traffic interface that interfaces with the server of the customer; and
transmitting the received second traffic from the first compute server to the determined second traffic interface on the second compute server for transmitting the received second traffic to the private application or service.
5. The method of claim 1 , wherein transmitting the received first traffic from the first compute server to the determined second traffic interface on the second compute server is proxied over an HTTP/2 proxy.
6. The method of claim 1 , further comprising:
marking the received first traffic with the determined identity information.
7. A non-transitory machine-readable storage medium that provides instructions that, if executed by a processor, will cause said processor to carry out operations comprising:
receiving first traffic at a first traffic interface at a first compute server of a distributed cloud computing network, wherein the received first traffic is destined for a private application or service running on a server of a customer of a unified network service provided through the distributed cloud computing network, wherein the server is outside of the distributed cloud computing network, wherein the first traffic interface is an IPsec tunnel interface that interfaces with an IPsec tunnel from a router of the customer, wherein the IPsec tunnel interface is assigned an IP address that is an anycast IP address that is shared among the first compute server and a plurality of other compute servers of the distributed cloud computing network, and wherein a different one of the other compute servers of the distributed cloud computing network performed a handshake with the router including generating a set of one or more security associations for encrypting and decrypting;
receiving the generated set of one or more security associations for encrypting and decrypting traffic on the IPsec tunnel interface, wherein the received first traffic is encrypted;
decrypting the encrypted received first traffic using the set of one or more security associations;
determining identity information associated with the received first traffic including that the received first traffic is attributable to the customer including identifying the customer based on the IPsec tunnel being associated with an account of the customer;
determining, using one or more policies configured for the customer and the determined identity information associated with the received first traffic, whether the received first traffic is allowed to be transmitted to the private application or service including determining whether traffic received over the IPsec tunnel is allowed to access the private application or service;
responsive to determining that the received first traffic is allowed to be transmitted to the private application or service, determining a second traffic interface that interfaces with the server of the customer, wherein the second traffic interface is a layer 7 traffic interface, and wherein the determined second traffic interface is on a second compute server of the distributed cloud computing network;
transmitting the received first traffic from the first compute server to the determined second traffic interface on the second compute server; and
transmitting, from the determined second traffic interface on the second compute server to the server of the customer, the received first traffic.
8. The non-transitory machine-readable storage medium of claim 7 , wherein the operations further comprise:
receiving second traffic at a third traffic interface at a first compute server of a distributed cloud computing network, wherein the third traffic interface is a generic routing encapsulation (GRE) interface that interfaces with a GRE tunnel from the router of the customer, and wherein the received second traffic is destined for the private application or service running on the server of the customer;
determining identity information associated with the received second traffic including that the received second traffic is attributable to the customer based based on the GRE tunnel being associated with an account of the customer;
determining, using one or more policies configured for the customer and the determined identity information associated with the received second traffic, whether the received second traffic is allowed to be transmitted to the private application or service including determining whether traffic received over the GRE tunnel is allowed to access the private application or service;
responsive to determining that the received second traffic is allowed to be transmitted to the private application or service, determining the second traffic interface that interfaces with the server of the customer; and
transmitting the received second traffic from the first compute server to the determined second traffic interface on the second compute server for transmitting the received second traffic to the private application or service.
9. The non-transitory machine-readable storage medium of claim 8 , wherein determining the identity information associated with the received second traffic further includes identifying a user of the customer transmitting the second traffic over the GRE tunnel, and wherein determining whether the received second traffic at the GRE interface is allowed to be transmitted to the private application or service further includes determining whether the identified user is allowed to access the private application or service.
10. The non-transitory machine-readable storage medium of claim 7 , wherein the operations further comprise:
receiving second traffic at a third traffic interface at a first compute server of a distributed cloud computing network, wherein the third traffic interface is a virtual private network (VPN) interface that interfaces with a VPN tunnel connected to a VPN client, and wherein the received second traffic is destined for the private application or service running on the server of the customer;
determining identity information associated with the received second traffic including determining a user of the VPN client;
determining, using one or more policies configured for the customer and the determined identity information associated with the received second traffic, whether the received second traffic is allowed to be transmitted to the private application or service including determining whether the determined user is allowed to access the private application or service;
responsive to determining that the received second traffic is allowed to be transmitted to the private application or service, determining the second traffic interface that interfaces with the server of the customer; and
transmitting the received second traffic from the first compute server to the determined second traffic interface on the second compute server for transmitting the received second traffic to the private application or service.
11. The non-transitory machine-readable storage medium of claim 7 , wherein transmitting the received first traffic from the first compute server to the determined second traffic interface on the second compute server is proxied over an HTTP/2 proxy.
12. The non-transitory machine-readable storage medium of claim 7 , wherein the operations further comprise:
marking the received first traffic with the determined identity information.
13. A server, comprising:
a processor; and
a non-transitory machine-readable storage medium that provides instructions that, if executed by the processor, will cause the server to carry out operations comprising:
receiving first traffic at a first traffic interface at a first compute server of a distributed cloud computing network, wherein the received first traffic is destined for a private application or service running on a server of a customer of a unified network service provided through the distributed cloud computing network, wherein the server is outside of the distributed cloud computing network, wherein the first traffic interface is an IPsec tunnel interface that interfaces with an IPsec tunnel from a router of the customer, wherein the IPsec tunnel interface is assigned an IP address that is an anycast IP address that is shared among the first compute server and a plurality of other compute servers of the distributed cloud computing network, and wherein a different one of the other compute servers of the distributed cloud computing network performed a handshake with the router including generating a set of one or more security associations for encrypting and decrypting;
receiving the generated set of one or more security associations for encrypting and decrypting traffic on the IPsec tunnel interface, wherein the received first traffic is encrypted;
decrypting the encrypted received first traffic using the set of one or more security associations;
determining identity information associated with the received first traffic including that the received first traffic is attributable to the customer including identifying the customer based on the IPsec tunnel being associated with an account of the customer;
determining, using one or more policies configured for the customer and the determined identity information associated with the received first traffic, whether the received first traffic is allowed to be transmitted to the private application or service including determining whether traffic received over the IPsec tunnel is allowed to access the private application or service;
responsive to determining that the received first traffic is allowed to be transmitted to the private application or service, determining a second traffic interface that interfaces with the server of the customer, wherein the second traffic interface is a layer 7 traffic interface, and wherein the determined second traffic interface is on a second compute server of the distributed cloud computing network;
transmitting the received first traffic from the first compute server to the determined second traffic interface on the second compute server; and
transmitting, from the determined second traffic interface on the second compute server to the server of the customer, the received first traffic.
14. The server of claim 13 , wherein the operations further comprise:
receiving second traffic at a third traffic interface at a first compute server of a distributed cloud computing network, wherein the third traffic interface is a generic routing encapsulation (GRE) interface that interfaces with a GRE tunnel from the router of the customer, and wherein the received second traffic is destined for the private application or service running on the server of the customer;
determining identity information associated with the received second traffic including that the received second traffic is attributable to the customer based based on the GRE tunnel being associated with an account of the customer;
determining, using one or more policies configured for the customer and the determined identity information associated with the received second traffic, whether the received second traffic is allowed to be transmitted to the private application or service including determining whether traffic received over the GRE tunnel is allowed to access the private application or service;
responsive to determining that the received second traffic is allowed to be transmitted to the private application or service, determining the second traffic interface that interfaces with the server of the customer; and
transmitting the received second traffic from the first compute server to the determined second traffic interface on the second compute server for transmitting the received second traffic to the private application or service.
15. The server of claim 14 , wherein determining the identity information associated with the received second traffic further includes identifying a user of the customer transmitting the second traffic over the GRE tunnel, and wherein determining whether the received second traffic at the GRE interface is allowed to be transmitted to the private application or service further includes determining whether the identified user is allowed to access the private application or service.
16. The server of claim 13 , wherein the operations further comprise:
receiving second traffic at a third traffic interface at a first compute server of a distributed cloud computing network, wherein the first third traffic interface is a virtual private network (VPN) interface that interfaces with a VPN tunnel connected to a VPN client, and wherein the received second traffic is destined for the private application or service running on the server of the customer;
determining identity information associated with the received second traffic including determining a user of the VPN client;
determining, using one or more policies configured for the customer and the determined identity information associated with the received second traffic, whether the received second traffic is allowed to be transmitted to the private application or service including determining whether the determined user is allowed to access the private application or service;
responsive to determining that the received second traffic is allowed to be transmitted to the private application or service, determining the second traffic interface that interfaces with the server of the customer; and
transmitting the received second traffic from the first compute server to the determined second traffic interface on the second compute server for transmitting the received second traffic to the private application or service.
17. The server of claim 13 , wherein transmitting the received first traffic from the first compute server to the determined second traffic interface on the second compute server is proxied over an HTTP/2 proxy.
18. The server of claim 13 , wherein the operations further comprise:
marking the received first traffic with the determined identity information.