Dynamically defining encryption spaces across multiple data centers

A computer system:

• one or more non-transitory computer readable media;
• a processing system operatively coupled to the one or more non-transitory computer readable media;
• and
• program instructions stored on the one or more non-transitory computer readable storage media to maintain an access control list (ACL) at the first edge gateway of a first computing site that, when read and executed by the processing system, direct the processing system to at least:
• obtain, via border gateway protocol (BGP), one or more internet protocol (IP) address prefixes from a second edge gateway of a second computing site;
• update an ACL at the first edge gateway based on the one or more IP address prefixes, wherein the ACL provides permissions for Internet Protocol Security (IPSec) communications between a plurality of virtual nodes at the first computing site that use one or more first IP address prefixes and a plurality of virtual nodes at the second computing site that use one or more second IP address prefixes, and wherein each entry in the ACL associates an IP address prefix of the first one or more IP address prefixes with an IP address prefix of the one or more second IP address prefixes;
• identify a communication from a virtual node at the first computing site;
• determine whether the communication qualifies for an IPSec communication with the second edge gateway based on the ACL and at least a destination IP address for the communication;
• and
• when the communication does qualify for an IPSec communication, transfer the communication to the second edge gateway via IPSec protocol.

A system comprising:

• a first computing system to provide a first edge gateway of at a first computing site, the first computing site comprising a plurality of virtual nodes, and the first computing system configured to:
• transfer, via border gateway protocol (BGP), one or more internet protocol (IP) address prefixes corresponding to virtual nodes executing at the first computing site to a second edge gateway of a second computing site;
• a second computing system to provide the second edge gateway of at the second computing site, the second computing site comprising a plurality of virtual nodes, and the second computing system configured to:
• obtain the one or more IP address prefixes from the first edge gateway;
• update an access control list (ACL) at the second edge gateway based on the one or more IP address prefixes, wherein the ACL provides permissions for Internet Protocol Security (IPSec) communications between the plurality of virtual nodes at the first computing site that use one or more first IP address prefixes and the plurality of virtual nodes at the second computing site that use one or more second IP address prefixes, and wherein each entry in the ACL associates an IP address prefix of the first one or more IP address prefixes with an IP address prefix of the one or more second IP address prefixes;
• identify a communication from a virtual node at the second computing site;
• determine whether the communication qualifies for an IPSec communication with the first edge gateway based on the ACL and at least a destination IP address for the communication;
• and
• when the communication does qualify for an IPSec communication, transfer the communication to the first edge gateway via IPSec protocol.