Dynamic routing of application traffic to ZTNA connectors

A computer program product comprising computer executable code embodied in non-transitory computer executable code that, when executing on one or more computing devices, causes the one or more computing devices to perform the steps of:

• receiving, at an administrative console of a threat management facility, a request to provide access to an application hosted on a customer premises through a zero trust network access appliance, wherein the threat management facility is configured to provide a cloud-based data plane that connects a client to the application through a cloud computing platform;
• configuring the zero trust network access appliance at the customer premises by specifying first configuration information including at least:
• a name of the application,
• a certificate for authenticated access to the application, and
• a fully qualified domain name for accessing the application on a network;
• receiving second configuration information for the application from the cloud computing platform, the second configuration information including at least a port of a reverse proxy server at the cloud computing platform connected to a reverse proxy client of the zero trust network access appliance through a secure tunnel;
• configuring a service proxy at the cloud computing platform to provide access to the application based on the first configuration information and the second configuration information;
• providing an abstraction layer in the cloud computing platform, the abstraction layer configurable from the threat management facility to assign the service proxy in the cloud computing platform to a predetermined subset of applications hosted on one or more customer premises, and to assign a network load balancer to a predetermined subset of service proxies;
• and
• in response to detecting a degradation in performance of the application with the threat management facility:
• configuring a second zero trust network access appliance at the customer premises, connecting the second zero trust network access appliance to the cloud computing platform through a second secure tunnel, and
• configuring the service proxy to forward the request from the client for the application to either of the secure tunnel or the second secure tunnel,
• further wherein the cloud computing platform includes a second network load balancer for managing traffic relating to the application between the secure tunnel and the second secure tunnel.

A method comprising:

• receiving a request to provide zero trust network access to an application hosted on a customer premises;
• providing a cloud-based data plane that connects a client to the application through a cloud computing platform;
• configuring a zero trust network access appliance at the customer premises by specifying first configuration information for the application;
• receiving second configuration information for the application from the cloud computing platform that hosts a zero trust network access service for the application remotely from the customer premises;
• configuring a service proxy at the cloud computing platform to provide access to the application through a secure tunnel based on the first configuration information and the second configuration information;
• providing an abstraction layer in the cloud computing platform, the abstraction layer configurable to assign the service proxy in the cloud computing platform to a predetermined subset of applications hosted on one or more customer premises, and to assign a network load balancer to a predetermined subset of service proxies;
• and
• in response to detecting a degradation in performance of the application with a threat management facility for the customer premises:
• configuring a second zero trust network access appliance at the customer premises,
• connecting the second zero trust network access appliance to the cloud computing platform through a second secure tunnel, and
• configuring the service proxy to forward the request from the client for the application to either of the secure tunnel or the second secure tunnel,
• further wherein the cloud computing platform includes a second network load balancer for managing traffic relating to the application between the secure tunnel and the second secure tunnel.