Global Edge Deployment Overview

Cloud Secure Edge’s Global Edge Network contains Points of Presence (PoPs), which are hosted and managed Access Tiers provisioned in various selected geographic locations. Points of Presence can be distinguished from Access Tiers in a Private Edge deployment, which are self-hosted and self-managed.

A high-level architecture diagram is shown below.

%%{init: {"themeVariables": {"fontSize": "13px", "lineColor": "#BDBDBD", "edgeLabelBackground": "transparent", "primaryColor": "#F2F2F2", "primaryTextColor": "#1F2933", "primaryBorderColor": "#BDBDBD"}}}%%
flowchart LR
    U1([End User - NYC])
    U2([End User - SFO])
    U3([End User - BLR])
    CC["<img src='/img/intro/cse-icon.svg' width='16' style='vertical-align:-2px;margin-right:5px'/>CSE Command Center"]

    subgraph EDGE [Cloud Secure Edge Global Edge Network]
        direction TB
        POP1["<img src='/img/intro/cse-icon.svg' width='16' style='vertical-align:-2px;margin-right:5px'/>Edge - Ashburn, VA"]
        POP2["<img src='/img/intro/cse-icon.svg' width='16' style='vertical-align:-2px;margin-right:5px'/>Edge - Los Angeles, CA"]
        POP3["<img src='/img/intro/cse-icon.svg' width='16' style='vertical-align:-2px;margin-right:5px'/>Edge - Mumbai"]
        POP1 --- POP2
        POP2 --- POP3
    end

    subgraph DCNY [Customer Network - Data Center New York, NY]
        direction TB
        CONN1["<img src='/img/intro/cse-icon.svg' width='16' style='vertical-align:-2px;margin-right:5px'/>Connector"]
        S1["erp.corp.example.com (Web)"]
        S2["ssh-nyj.corp.example.com (infra)"]
        S3["10.2.1.8 (Tunnel)"]
        CONN1 --> S1
        CONN1 --> S2
        CONN1 --> S3
    end

    subgraph DCLV [Customer Network - Data Center Las Vegas, NV]
        direction TB
        CONN2["<img src='/img/intro/cse-icon.svg' width='16' style='vertical-align:-2px;margin-right:5px'/>Connector"]
        S4["jira.dev.example.com (Web)"]
        S5["rdp-aws.dev.example.com (Infra)"]
        S6["172.31.8.9 (Tunnel)"]
        CONN2 --> S4
        CONN2 --> S5
        CONN2 --> S6
    end

    U1 --> POP1
    U2 --> POP2
    U3 --> POP3
    POP1 --> CONN1
    POP2 --> CONN1
    POP2 --> CONN2
    POP3 --> CONN2
    CC -.->|Device check| CONN1
    CC -.->|Device check| CONN2

    classDef user fill:#F2F2F2,stroke:#BDBDBD,color:#1F2933;
    classDef cse fill:#E7F1FC,stroke:#0087F7,color:#1F2933;
    classDef resource fill:#EEF6E7,stroke:#89C765,color:#1F2933;

    class U1,U2,U3 user;
    class POP1,POP2,POP3,CONN1,CONN2,CC cse;
    class S1,S2,S3,S4,S5,S6 resource;

The diagram highlights the following concepts:

1. Points of Presence are provisioned in locations around the world, using our edge infrastructure provider; the specific number of locations varies based on your organization’s needs.

2. A Connector is deployed in the customer network, and it dials out to establish a secure encrypted tunnel with one or more PoPs in the Global Edge Network.

3. CSE allocates a unique Org Domain - of the form {orgname}.banyanops.com - for every organization that is provisioned in the Global Edge Network. The Org Domain resolves via Public DNS (which is configured using geo-proximity routing) to your organization’s PoPs in the Global Edge Network.

4. Admins publish CSE services for their end users; service domain names will resolve to the network IP address of the nearest PoP.

5. A user or program running on a device will make a request to a service by using its fully qualified domain name, e.g., wiki.exampleorg.sonicwallcse.com.

6. The PoPs in the Global Edge Network can address the upstream (i.e., backend) service instance by IP address or by name, via the encrypted tunnel that has been set up with the Connector.

7. The PoPs in the Global Edge Network are connected to the Cloud Command Center to receive the security policy it needs to enforce and to report on access events.