IP Address and Routing Schemes for Overlay Network

A system, comprising:

• multiple Point-of-Presence (POP) interfaces, which are distributed in a Wide-Area Network (WAN);
• and
• one or more processors, which are coupled to the POP interfaces and are configured to:
• assign, to an initiator in the system, a client Internet Protocol (IP) address having a first plurality of bits, including embedding in one or more of the bits of the client IP address:
• an Initiator Meta-Group ID (MGI) value, and
• a Tenant ID (TID), different than the MGI value;
• assign, to a responder in the system, a service IP address having a second plurality of bits, including embedding in one or more of the bits of the service IP address a Responder Meta Group ID (MGR) value, different than the TID;
• receive a packet, which is exchanged between the initiator and the responder and which comprises the client IP address and the service IP address;
• and
• enforce a security policy on the packet depending on MGI value, the TID, and the MGR value, wherein enforcing the security policy comprises applying one or more stateless logical operations to the MGI of the initiator and to the MGR, as embedded in the packet.

A method, comprising:

• using one or more processors that are coupled to multiple Point-of-Presence (POP) interfaces distributed in a Wide-Area Network (WAN):
• assigning, to an initiator, a client Internet Protocol (IP) address having a first plurality of bits, including embedding in one or more of the bits of the client IP address:
• an Initiator Meta-Group ID (MGI) value, and
• a Tenant ID (TID), different than the MGI value;
• assigning, to a responder, a service IP address having a second plurality of bits, including embedding in one or more of the bits of the service IP address a Responder Meta Group ID (MGR) value, different than the TID;
• recieving a packet, which is exchanged between the initiator and the responder and which comprises the client IP address and the service IP address;
• and
• enforcing a security policy on the packet depending on MGI value, the TID, and the MGR value, wherein enforcing the security policy comprises applying one or more stateless logical operations to the MGI of the initiator and to the MGR, as embedded in the packet.