Isolation and segmentation in multi-cloud interconnects

A system comprising:

• one or more processors;
• and
• one or more non-transitory computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to:
• assign a first data plane router to first data plane traffic associated with first endpoints included in a first private virtual network of a cloud-based network, wherein the first private virtual network is associated with a first address space for the first endpoints that is associated with a first virtual routing and forwarding (VRF) routing table stored in the first data plane router, the cloud-based network being included in a multi-cloud fabric that further includes an on-premises network of on-premises endpoints;
• assign the first data plane router to second data plane traffic associated with second endpoints included in a second private virtual network of the cloud-based network, wherein the second private virtual network is associated with a second address space for the second endpoints that is associated with a second VRF routing table stored in the first data plane router;
• cause the first data plane router and a control plane router in the cloud-based network to establish a first virtual private network (VPN) connection, wherein the control plane router has a second VPN connection with a second data plane router and a third VPN connection with the on-premises network;
• store, at the control plane router, mapping data indicating associations between VPN connections, source addresses for endpoints, and VRF routing tables;
• receive, at the control plane router, from the first data plane router, a data packet over the first VPN connection, the data packet originating from a particular first endpoint of the first endpoints;
• determine, at the control plane router and using the mapping data, that the first VPN connection and a particular source address of the data packet are associated with the first VRF routing table;
• and
• determine, at the control plane router and using the first VRF routing table stored at the control plane router, a next hop for the data packet.

One or more non-transitory computer-readable media storing computer-executable instructions that, when executed by one or more processors, cause the one or more processors to:

• assign a first data plane router to first data plane traffic associated with first endpoints included in a first private virtual network of a cloud-based network, wherein the first private virtual network is associated with a first address space for the first endpoints that is associated with a first virtual routing and forwarding (VRF) routing table stored in the first data plane router, the cloud-based network being included in a multi-cloud fabric that further includes an on-premises network of on-premises endpoints;
• assign the first data plane router to second data plane traffic associated with second endpoints included in a second private virtual network of the cloud-based network, wherein the second private virtual network is associated with a second address space for the second endpoints that is associated with a second VRF routing table stored in the first data plane router;
• cause the first data plane router and a control plane router in the cloud-based network to establish a first virtual private network (VPN) connection, wherein the control plane router has a second VPN connection with a second data plane router and a third VPN connection with the on-premises network;
• store, at the control plane router, mapping data indicating associations between VPN connections, source addresses for endpoints, and VRF routing tables;
• receive, at the control plane router, from the first data plane router, a data packet over the first VPN connection, the data packet originating from a particular first endpoint of the first endpoints;
• determine, at the control plane router and using the mapping data, that the first VPN connection and a particular source address of the data packet are associated with the first VRF routing table;
• and
• determine, at the control plane router and using the first VRF routing table stored at the control plane router, a next hop for the data packet.