Access control and routing optimization at a cloud headend in a cloud-based secure access service environment

1. A method comprising:

receiving, at an edge component of a cloud-based secure access service, a corresponding access designation for each of a plurality of endpoints, each access designation specifying a type of access a corresponding endpoint has to remaining ones of the plurality of endpoints and other accessible network resources, the plurality of endpoints being remotely connected to the cloud-based secure access service via the edge component and using a corresponding virtual private network connection;

based on the corresponding access designation of each of the plurality of endpoints, updating a routing table at the edge component, to include routing information for a subset of the plurality of endpoints having access to at least one other endpoint of the plurality of endpoints or to the other accessible network resources; and

enabling routing of network traffic, via the cloud-based secure access service, between any number of the plurality of endpoints based at least in part on the routing table.

2. The method of claim 1 , wherein the corresponding access designation is one of:

a public access allowing a corresponding endpoint full access to the remaining ones of the plurality of endpoints and the other accessible network resources;

a private access allowing access to one or more of the plurality of endpoints having a public access designation;

a shared access allowing access to one or more of the plurality of endpoints having the private access designation; and

an isolated designation allowing access only to the internet only.

3. The method of claim 2 , wherein updating the routing table includes deleting at least one entry in the table identifying a route between two of the plurality of endpoints having the isolated designation.

4. The method of claim 1 , wherein the edge component is at a first data center of the cloud-based secure access service.

5. The method of claim 4 , further comprising:

sending the updated routing table to at least one other edge component at a second data center of the cloud-based secure access service.

6. The method of claim 1 , further comprising:

sending the corresponding access designation of each of the plurality of endpoints to one or more components at the cloud-based secure access service for servicing associated network traffic, the one or more components applying network and security policies to the associated network traffic based on a corresponding access designation of a given one of the plurality of endpoints.

7. An edge component of a cloud-based secure access service, comprising:

one or more memories having computer-readable instructions stored thereon; and

one or more processors configured to execute the computer-readable instructions to:

receive a corresponding access designation for each of a plurality of endpoints, each access designation specifying a type of access a corresponding endpoint has to remaining ones of the plurality of endpoints and other accessible network resources, the plurality of endpoints being remotely connected to the cloud-based secure access service via the edge component and using a corresponding virtual private network connection;

based on the corresponding access designation of each of the plurality of endpoints, update a routing table at the edge component, to include routing information for a subset of the plurality of endpoints having access to at least one other endpoint of the plurality of endpoints or to the other accessible network resources; and

enable routing of network traffic, via the cloud-based secure access service, between any number of the plurality of endpoints based at least in part on the routing table.

8. The edge component of claim 7 , wherein the corresponding access designation is one of:

a public access allowing a corresponding endpoint full access to the remaining ones of the plurality of endpoints and the other accessible network resources;

a private access allowing access to one or more of the plurality of endpoints having a public access designation;

a shared access allowing access to one or more of the plurality of endpoints having the private access designation; and

an isolated designation allowing access only to the internet only.

9. The edge component of claim 8 , wherein the one or more processors are configured to update the routing table by deleting at least one entry in the table identifying a route between two of the plurality of endpoints having the isolated designation.

10. The edge component of claim 7 , wherein the edge component is at a first data center of the cloud-based secure access service.

11. The edge component of claim 10 , wherein the one or more processors are further configured to execute the computer-readable instructions to send the updated routing table to at least one other edge component at a second data center of the cloud-based secure access service.

12. The edge component of claim 7 , wherein the one or more processors are further configured to execute the computer-readable instructions to send the corresponding access designation of each of the plurality of endpoints to one or more components at the cloud-based secure access service for servicing associated network traffic, the one or more components applying network and security policies to the associated network traffic based on a corresponding access designation of a given one of the plurality of endpoints.

13. The edge component of claim 7 , wherein the edge component comprises a number of data nodes and each data node has a corresponding routing table.

14. The edge component of claim 13 , wherein the one or more processors are configured to update the corresponding routing table for each of the data nodes.

15. One or more non-transitory computer-readable media comprising computer-readable instructions, which when executed by one or more processors of an edge component of a cloud-based secure access service, cause the edge component to:

receive a corresponding access designation for each of a plurality of endpoints, each access designation specifying a type of access a corresponding endpoint has to remaining ones of the plurality of endpoints and other accessible network resources, the plurality of endpoints being remotely connected to the cloud-based secure access service via the edge component and using a corresponding virtual private network connection;

based on the corresponding access designation of each of the plurality of endpoints, update a routing table at the edge component, to include routing information for a subset of the plurality of endpoints having access to at least one other endpoint of the plurality of endpoints or to the other accessible network resources; and

enable routing of network traffic, via the cloud-based secure access service, between any number of the plurality of endpoints based at least in part on the routing table.

16. The one or more non-transitory computer-readable media of claim 15 , wherein the corresponding access designation is one of:

a public access allowing a corresponding endpoint full access to the remaining ones of the plurality of endpoints and the other accessible network resources;

a private access allowing access to one or more of the plurality of endpoints having a public access designation;

a shared access allowing access to one or more of the plurality of endpoints having the private access designation; and

an isolated designation allowing access only to the internet.

17. The one or more non-transitory computer-readable media of claim 15 , wherein the edge component is at a first data center of the cloud-based secure access service.

18. The one or more non-transitory computer-readable media of claim 17 , wherein the execution of the computer-readable instructions cause the edge component to send the updated routing table to at least one other edge component at a second data center of the cloud-based secure access service.

19. The one or more non-transitory computer-readable media of claim 15 , wherein the execution of the computer-readable instructions cause the edge component to send the corresponding access designation of each of the plurality of endpoints to one or more components at the cloud-based secure access service for servicing associated network traffic, the one or more components applying network and security policies to the associated network traffic based on a corresponding access designation of a given one of the plurality of endpoints.

20. The one or more non-transitory computer-readable media of claim 15 , wherein

the edge component comprises a number of data nodes and each data node has a corresponding routing table, and

the execution of the computer-readable instructions cause the edge component to update the corresponding routing table for each of the data nodes.