• Multi-Region Datacenter
• Hybrid & Multi-Cloud

Many IT organizations today have to manage distributed infrastructures that span multiple on-premises, data centers and cloud IaaS locations. Since Access Tiers can be deployed independent of the underlying network and managed via the Cloud Command Center, they can be used to simplify access controls management and improve security for even the most complex environments.

Multi-Region Datacenter

An organization may have office and datacenter locations that are spread across multiple geographies. A common deployment model is to have 1 Access Tier per location, similar to the Isolated VPCs deployment for IaaS.

flowchart TB
    DNS["<img src='/img/icons/globe.svg' width='16'/>Public DNS - Simple Routing"]
    USW["<img src='/img/icons/user.svg' width='16'/>Users in US-West"]
    USE["<img src='/img/icons/user.svg' width='16'/>Users in US-East"]

    subgraph DCW [Datacenter US-West]
        direction TB
        subgraph DCWPUB [Public subnet]
            ATW["<img src='/img/intro/cse-icon.svg' width='16'/>Access Tier"]
        end
        subgraph DCWPRIV [Private subnet]
            APPW["<img src='/img/icons/server.svg' width='16'/>Corporate Application"]
        end
    end

    subgraph DCE [Datacenter US-East]
        direction TB
        subgraph DCEPUB [Public subnet]
            ATE["<img src='/img/intro/cse-icon.svg' width='16'/>Access Tier"]
        end
    end

    USW -. DNS lookup .-> DNS
    USE -. DNS lookup .-> DNS
    USW --> ATW
    USE --> ATW
    ATW --> APPW
    USE ~~~ ATE

    style DCW fill:transparent,stroke:#BDBDBD,stroke-width:1.5px,stroke-dasharray:5 4;
    style DCE fill:transparent,stroke:#BDBDBD,stroke-width:1.5px,stroke-dasharray:5 4;
    classDef svc fill:#F2F2F2,stroke:#BDBDBD,color:#1F2933;
    classDef cse fill:#E7F1FC,stroke:#0087F7,color:#1F2933;
    classDef resource fill:#EEF6E7,stroke:#89C765,color:#1F2933;
    class DNS,USW,USE svc;
    class ATW,ATE cse;
    class APPW resource;

In an Multi-Region Datacenter deployment, we typically have:

1. 1 Access Tier per location; each Access Tier is assigned a unique descriptive wildcard site domain name (such as *.myapp.corp.example.com) that is used in the fully qualified domain name (FQDN) for services in that location. You can create specific DNS entries for services that cannot follow this FQDN convention.
2. Individual locations are responsible for managing their Access Tiers and services. Administrative access and Policy/Role/Service management can be controlled and audited via Admin Profiles and Audit Logs API.

A key security benefit of this style of deployment is that we can eliminate almost all East-West lateral movement. Even if an attacker were to establish a foothold inside a location, they could not move laterally into another location.

Hybrid & Multi-Cloud

In more complex deployments that involve multi-cloud or datacenter-cloud connectivity, organizations often choose to use dedicated links - such as AWS DirectConnect or Azure ExpressRoute Gateway - to enable connectivity.

flowchart TB
    USERS["<img src='/img/icons/user.svg' width='16'/>Users"]

    subgraph AWS [AWS Cloud]
        direction TB
        ATAWS["<img src='/img/intro/cse-icon.svg' width='16'/>Access Tier<br/><span style='font-size:11px;color:#5F5E5A'>Ingress VPC &middot; Public subnet</span>"]
        SRVAWS["<img src='/img/icons/server.svg' width='16'/>Application<br/><span style='font-size:11px;color:#5F5E5A'>Applications VPC &middot; Private subnet</span>"]
    end

    subgraph AZ [Azure Cloud]
        direction TB
        ATAZ["<img src='/img/intro/cse-icon.svg' width='16'/>Access Tier<br/><span style='font-size:11px;color:#5F5E5A'>Ingress VPC &middot; Public subnet</span>"]
        SRVAZ["<img src='/img/icons/server.svg' width='16'/>Application<br/><span style='font-size:11px;color:#5F5E5A'>Applications VPC &middot; Private subnet</span>"]
    end

    subgraph DC [Corporate Datacenter]
        direction LR
        SRVDC1["<img src='/img/icons/server.svg' width='16'/>Application"]
        SRVDC2["<img src='/img/icons/server.svg' width='16'/>Application"]
    end

    USERS --> ATAWS
    USERS --> ATAZ
    ATAWS --> SRVAWS
    ATAZ --> SRVAZ
    ATAWS -. AWS DirectConnect .-> SRVDC1
    ATAZ -. Azure ExpressRoute .-> SRVDC2

    linkStyle 4,5 stroke:#5B54A4,stroke-width:2.5px;
    style AWS fill:transparent,stroke:#BDBDBD,stroke-width:1.5px,stroke-dasharray:5 4;
    style AZ fill:transparent,stroke:#BDBDBD,stroke-width:1.5px,stroke-dasharray:5 4;
    style DC fill:transparent,stroke:#BDBDBD,stroke-width:1.5px,stroke-dasharray:5 4;
    classDef user fill:#F2F2F2,stroke:#BDBDBD,color:#1F2933;
    classDef cse fill:#E7F1FC,stroke:#0087F7,color:#1F2933;
    classDef resource fill:#EEF6E7,stroke:#89C765,color:#1F2933;
    class USERS user;
    class ATAWS,ATAZ cse;
    class SRVAWS,SRVAZ,SRVDC1,SRVDC2 resource;

Access Tiers can be integrated seamlessly into these types of complex network topologies as well, because they run independent of the underlying network.