Policy-based dynamic VPN profile selection using DNS protocol
Techniques for policy-based dynamic VPN profile selection using DNS protocol are provided. In some embodiments, a system/process/computer program product for policy-based dynamic VPN profile selection using DNS protocol includes receiving, at a DNS server for an enterprise network, a Domain Name System (DNS) request for a resource from an endpoint client; determining an IP address and an authentication token for the endpoint client to access the resource using a secure tunnel; and sending a DNS response, from the DNS server, including the IP address and the authentication token to the endpoint client.
1. A system, comprising:
a processor configured to:
receive, at a DNS server for an enterprise network, a Domain Name System (DNS) request for a resource from an endpoint client, wherein the DNS request includes a Fully Qualified Domain Name (FQDN) and a client ID associated with the endpoint client;
determine an Internet Protocol (IP) address and an authentication token for the endpoint client to access the resource using a secure tunnel, wherein the DNS server, via an authentication request including the FQDN and the client ID, requests the authentication token from an endpoint server, wherein the endpoint server identifies a set of authentication tokens based on a first client ID or a second client ID, determines the authentication token from the set of authentication tokens based on the FQDN, and returns the IP address and the authentication token to the DNS server; and
send a DNS response, from the DNS server, including the IP address and the authentication token to the endpoint client; and
a memory coupled to the processor and configured to provide the processor with instructions.
2. The system recited in claim 1 , wherein the authentication token includes an authentication cookie.
3. The system recited in claim 1 , wherein the IP address and the authentication token are determined based on a policy for dynamic Virtual Private Network (VPN) profile selection using DNS protocol.
4. The system recited in claim 1 , wherein the IP address and the authentication token are determined based on a policy for dynamic VPN profile selection using DNS protocol to facilitate DNS-based split tunneling.
5. The system recited in claim 1 , wherein the IP address and the authentication token are determined based on a policy for dynamic VPN profile selection using DNS protocol, and wherein the policy includes a plurality of VPN rules that can be updated at runtime for dynamic VPN gateway allocation for a plurality of endpoint clients associated with the enterprise network.
6. The system recited in claim 1 ,
wherein the authentication token is generated at the endpoint server for each new session associated with the endpoint client.
7. A method, comprising:
receiving, at a DNS server for an enterprise network, a Domain Name System (DNS) request for a resource from an endpoint client, wherein the DNS request includes a Fully Qualified Domain Name (FQDN) and a client ID associated with the endpoint client;
determining an IP address and an authentication token for the endpoint client to access the resource using a secure tunnel, wherein the DNS server, via an authentication request including the FQDN and the client ID, requests the authentication token from an endpoint server, wherein the endpoint server identifies a set of authentication tokens based on a first client ID or a second client ID, determines the authentication token from the set of authentication tokens based on the FQDN, and returns the IP address and the authentication token to the DNS server; and
sending a DNS response, from the DNS server, including the IP address and the authentication token to the endpoint client.
8. The method of claim 7 , wherein the authentication token includes an authentication cookie.
9. The method of claim 7 , wherein the IP address and the authentication token are determined based on a policy for dynamic Virtual Private Network (VPN) profile selection using DNS protocol.
10. The method of claim 7 , wherein the IP address and the authentication token are determined based on a policy for dynamic VPN profile selection using DNS protocol to facilitate DNS-based split tunneling.
11. The method of claim 7 , wherein the IP address and the authentication token are determined based on a policy for dynamic VPN profile selection using DNS protocol, and wherein the policy includes a plurality of VPN rules that can be updated at runtime for dynamic VPN gateway allocation for a plurality of endpoint clients associated with the enterprise network.
12. The method of claim 7 , wherein the authentication token is generated at the endpoint server for each new session associated with the endpoint client.
13. A computer program product embodied in a non-transitory computer readable medium and comprising computer instructions for:
receiving, at a DNS server for an enterprise network, a Domain Name System (DNS) request for a resource from an endpoint client, wherein the DNS request includes a Fully Qualified Domain Name (FQDN) and a client ID associated with the endpoint client;
determining an IP address and an authentication token for the endpoint client to access the resource using a secure tunnel, wherein the DNS server, via an authentication request including the FQDN and the client ID, requests the authentication token from an endpoint server, wherein the endpoint server identifies a set of authentication tokens based on a first client ID or a second client ID, determines the authentication token from the set of authentication tokens based on the FQDN, and returns the IP address and the authentication token to the DNS server; and
sending a DNS response, from the DNS server, including the IP address and the authentication token to the endpoint client.
14. The computer program product of claim 13 , wherein the authentication token includes an authentication cookie.
15. The computer program product of claim 13 , wherein the IP address and the authentication token are determined based on a policy for dynamic Virtual Private Network (VPN) profile selection using DNS protocol.
16. The computer program product of claim 13 , wherein the IP address and the authentication token are determined based on a policy for dynamic VPN profile selection using DNS protocol to facilitate DNS-based split tunneling.
17. The computer program product of claim 13 , wherein the IP address and the authentication token are determined based on a policy for dynamic VPN profile selection using DNS protocol, and wherein the policy includes a plurality of VPN rules that can be updated at runtime for dynamic VPN gateway allocation for a plurality of endpoint clients associated with the enterprise network.