Alias domains for accessing ZTNA applications
A cloud computing platform provides zero trust network access as a service to customers that maintain applications on-premises. In this context, the cloud computing platform may associate customers and/or applications with specific service proxies, and add an abstraction layer for network access that maps an alias domain for each customer and/or application to a network load balancer associated with the specific service proxies associated with the corresponding application(s). This approach advantageously simplifies the configuration of service proxies at the cloud computing platform by permitting dedicated relationships among network load balancers, specific service proxies, and specific applications, while concurrently reducing or avoiding the administrative burden on customers of updating network pointers when the clusters of service proxies are periodically reconfigured to adjust to varying user traffic.
1. A computer program product comprising computer executable code embodied in non-transitory computer executable code that, when executing on one or more computing devices, causes the one or more computing devices to perform the steps of:
creating a cluster of service proxies on a cloud computing platform, the cluster of service proxies including one or more service proxies configured to provide access to an application on a customer premises;
coupling the one or more service proxies to a network load balancer from a plurality of network load balancers for the cloud computing platform;
creating an alias domain for zero trust network access to the application, the alias domain identified by a fully qualified domain name associated with the application;
providing an abstraction layer for the cloud computing platform that maps requests for the alias domain for the application to the network load balancer coupled to the one or more service proxies configured to provide access to the application on the customer premises;
receiving a request from a client at the cloud computing platform for the application;
connecting the request to the network load balancer with the abstraction layer;
selecting one of the one or more service proxies for the application with the network load balancer;
connecting the request to the selected one of the one or more service proxies with the network load balancer; and
connecting the request to the application with the one of the one or more service proxies.
2. The computer program product of claim 1 , further comprising code that causes the one or more computing devices to authenticate the client for zero trust network access to the application.
3. The computer program product of claim 1 , further comprising code that causes the one or more computing devices to execute a threat management facility hosted remotely from the customer premises, the threat management facility configured to provide security services for the customer premises.
4. The computer program product of claim 3 , wherein the threat management facility is configured to provide a control plane for zero trust network access to the application hosted on the customer premises.
5. The computer program product of claim 3 , wherein creating the alias domain includes creating the alias domain at the threat management facility and transmitting the alias domain to the cloud computing platform.
6. The computer program product of claim 1 , wherein the cloud computing platform is configured to provide a data plane for zero trust network access to the application hosted on the customer premises.
7. The computer program product of claim 1 , wherein the cloud computing platform includes a cloud-based zero trust network access platform configured to provide zero trust network access as a service to a plurality of customers associated with a plurality of customer premises including the customer premises.
8. A method comprising:
hosting a cluster of service proxies on a cloud computing platform, the cluster of service proxies including one or more service proxies configured to provide access to an application on a customer premises;
coupling the one or more service proxies of the cluster of service proxies to a network load balancer from a plurality of network load balancers for the cloud computing platform;
creating an alias domain for the application; and
providing an abstraction layer for the cloud computing platform that maps requests for the alias domain for the application to the network load balancer coupled to the one or more service proxies configured to provide access to the application on the customer premises.
9. The method of claim 8 , further comprising:
receiving a request from a client at the cloud computing platform for the application;
connecting the request to the network load balancer with the abstraction layer; selecting a service proxy from the cluster of service proxies with the network load balancer; and
transmitting the request to the application through the service proxy.
10. The method of claim 9 , wherein the application includes a zero trust network application hosted on the customer premises.
11. The method of claim 9 , wherein transmitting the request to the application includes authenticating the application for zero trust network access to the application.
12. The method of claim 9 , wherein transmitting the request to the application includes transmitting the request through a zero trust network access appliance hosted on the customer premises.
13. The method of claim 12 , wherein transmitting the request to the application includes transmitting the request through a reverse proxy server hosted on the cloud computing platform, the reverse proxy server securely coupled to the zero trust network access appliance hosted on the customer premises.
14. The method of claim 13 , wherein the reverse proxy server is coupled to the zero trust network access appliance through a second network load balancer.
15. The method of claim 13 , wherein the cluster of service proxies is a dedicated cluster servicing one or more predetermined applications.
16. The method of claim 15 , wherein the one or more predetermined applications are associated with at least two customers having different customer premises.
17. A system comprising:
a customer premises hosting an application, the customer premises including a zero trust network access appliance configured to provide zero trust network access to the application through a secure tunnel; and
a cloud computing platform coupled to the zero trust network access appliance through the secure tunnel, the cloud computing platform comprising one or more processors and memory storing code that, when executing on the one or more processors, performs the steps of:
hosting a cluster of service proxies, the cluster of service proxies including one or more service proxies configured to provide access to the application,
providing a network load balancer associated with the one or more service proxies configured to provide access to the application, and
providing an abstraction layer that maps requests for an alias domain name associated with the application to the network load balancer coupled to the one or more service proxies configured to provide access to the application on the customer premises.
18. The system of claim 17 , further comprising a threat management facility configured to provide a control plane for zero trust network access to the application, the threat management facility further configured to manage network security for the customer premises, the threat management facility further configured to generate the alias domain name for the application, and transmit the alias domain name to the cloud computing platform for use as the alias domain name in the abstraction layer.
19. The system of claim 17 , wherein the cloud computing platform hosts a plurality of clusters of proxies, each one of the plurality of clusters of proxies associated with a predetermined number of applications in a group of applications different from each other one of the plurality of clusters of proxies.
20. The system of claim 17 , wherein the cloud computing platform is configured to add a first service proxy to the cluster of service proxies or remove a second service proxy from the cluster of service proxies based on a demand for use of the application.