Inside the PoP

From SNI to QUIC stream in five steps

Inside the PoP From SNI to QUIC stream in five steps 01 / Edge frontend 02 / Tunnel registry 03 / Connector link Decrypt Route Client hello · SNI app.example.com · Edge frontend › Decrypt Client hello SNI app.example.com Terminate TLS · Universal SSL cert · Edge frontend › Decrypt Terminate TLS Universal SSL cert Find tunnel · hostname to UUID · Tunnel registry › Route Find tunnel hostname to UUID Pick connection · healthy connector · Tunnel registry › Route Pick connection healthy connector Send on stream · QUIC stream N · Connector link › Route Send on stream QUIC stream N Legend User UI Agent logic Policy Tool action Context / trace

Route inside

  • • SNI hostname picks the tunnel
  • • Only healthy connector links get traffic