Flow parser and per flow data center utilization in a cloud-based secure access service environment
The present disclosure is directed to network traffic management and load balancing at a cloud-based secure access service accessible to remotely connected user devices. In one example, a cloud-based secure service system includes a network controller configured to receive network traffic from one or more user devices remotely connected to the controller; parse the network traffic into flow data and contextual information associated with the network traffic; determine that the network traffic is to be serviced by a target firewall service at the cloud-based secure service system based on the flow data and the contextual information; and direct the network traffic to the target firewall service to be serviced.
1. A cloud-based secure service system comprising:
a network controller configured to:
receive network traffic from one or more user devices remotely connected to the network controller;
parse the network traffic into flow data and contextual information associated with the network traffic;
determine a location of a target firewall service at the cloud-based secure service system for servicing the network traffic based on the flow data and the contextual information; and
direct the network traffic to the target firewall service to be serviced.
2. The cloud-based secure service system of claim 1 , wherein the network controller is configured to determine the location of the target firewall service based on available processing capacity of a plurality of firewall services.
3. The cloud-based secure service system of claim 1 , wherein the flow data includes a source IP address, a source port, a destination IP address, a destination port, and a protocol type associated with the network traffic.
4. The cloud-based secure service system of claim 1 , wherein the contextual information includes a class of services, an origin of packets in the network traffic, and
a tunnel ID associated with the network traffic.
5. The cloud-based secure service system of claim 1 , wherein the target firewall service is at a backup data center that is different than a data center in which the network controller is located.
6. The cloud-based secure service system of claim 5 , wherein the network controller is further configured to transmit a message including the flow data and the contextual information to a corresponding one of the one or more user devices to redirect associated outgoing traffic to the backup data center for processing.
7. The cloud-based secure service system of claim 1 , wherein the network controller comprises a headend component that is configured to receive the network traffic.
8. The cloud-based secure service system of claim 7 , wherein the headend component comprises a flow parser module configured to parse the network traffic, the flow parser being inside the headend component and between an encryption/decryption module and a routing component of the cloud-based secure service system.
9. A method comprising:
receiving, at a network controller of a cloud-based secure service system, network traffic from one or more user devices remotely connected to the network controller;
parsing, by the network controller, the network traffic into flow data and contextual information associated with the network traffic;
determining, by the network controller, a location of a target firewall service at the cloud-based secure service system for servicing the network traffic based on the flow data and the contextual information; and
directing, by the network controller, the network traffic to the target firewall service to be serviced.
10. The method of claim 9 , wherein the location of the target firewall service is determined based on available processing capacity of a plurality of firewall services.
11. The method of claim 9 , wherein the flow data includes a source IP address, a source port, a destination IP address, a destination port, and a protocol type associated with the network traffic.
12. The method of claim 9 , wherein the contextual information includes a class of services, an origin of packets in the network traffic, and a tunnel ID associated with the network traffic.
13. The method of claim 9 , wherein the target firewall service is at a backup data center that is different than a data center in which the network controller is located.
14. The method of claim 13 , further comprising:
transmitting, by the network controller, a message including the flow data and the contextual information to a corresponding one of the one or more user devices to redirect associated outgoing traffic to the backup data center for processing.
15. The method of claim 9 , wherein the network controller comprises a headend component for receiving the network traffic.
16. The method of claim 15 , wherein the headend component comprises a flow parser for parsing the network traffic, the flow parser being inside the headend component and between an encryption/decryption module and a routing component of the cloud-based secure service system.
17. One or more non-transitory computer-readable media comprising computer-readable instructions, which when executed by one or more processors at a network controller of a cloud-based secure service system, cause the network controller to:
receive network traffic from one or more user devices remotely connected to the network controller;
parse the network traffic into flow data and contextual information associated with the network traffic;
determine a location of a target firewall service at the cloud-based secure service system for servicing the network traffic based on the flow data and the contextual information; and
direct the network traffic to the target firewall service to be serviced.
18. The one or more non-transitory computer-readable media of claim 17 , wherein
the flow data includes a source IP address, a source port, a destination IP address, a destination port, and a protocol type associated with the network traffic; and
the contextual information includes a class of services, an origin of packets in the network traffic, and a tunnel ID associated with the network traffic.
19. The one or more non-transitory computer-readable media of claim 17 , wherein the network controller comprises a headend component that is configured to receive the network traffic.
20. The one or more non-transitory computer-readable media of claim 19 , wherein the headend component comprises a flow parser module configured to parse the network traffic, the flow parser being inside the headend component and between an encryption/decryption module and a routing component of the cloud-based secure service system.