Skip to main content

Anapaya PathGuard

An Anapaya PathGuard service runs in a hidden SCION AS. This page describes the self-operated hidden AS: the enterprise operates its own SCION AS on Anapaya EDGE appliances and deploys the PathGuard gateways in it.

The self-operated hidden AS​

Self-operated hidden AS
SCION Internet
Hidden Segment Directory
operated by Anapaya
Hidden SCION AS 1-ff00:0:122
operated by the enterprise
SCION ISP
uplink 1
SCION ISP
uplink 2
Anapaya EDGE
appliance 1
Anapaya EDGE
appliance 2
PathGuard
Web Gateway
PathGuard
VPN Gateway
Web server
192.0.2.10
Internal network
198.51.100.0/24
register the hidden segments
Text is not SVG - cannot display

The enterprise operates the hidden AS on two Anapaya EDGE appliances. The PathGuard gateways and the service are behind them. The EDGE appliances register the path segments of the AS only with the HSD.

The self-operated hidden AS has these parts:

  • Anapaya EDGE appliances: They connect the AS to the SCION Internet. They register the path segments of the AS with the Hidden Segment Directory (HSD), not with the public path servers. Use two appliances for high availability. Anapaya EDGE describes the appliance.
  • PathGuard gateways: The PathGuard Web Gateway for web traffic, the PathGuard VPN Gateway for IP traffic, or both.
  • The service: The unchanged web server or internal network behind the gateways.
  • The access policy: It names the users and devices that get the hidden segments of the AS. Hidden paths and access policies explains the access policy.

The enterprise operates all these parts and the identity provider. The table in Two layers of components lists all components and their operators.

Prerequisites​

  • SCION connectivity: A SCION connection from a SCION-enabled ISP to the EDGE appliances. Anapaya EDGE describes the options to connect an EDGE.
  • A sponsored subscription: A subscription from a reseller that pays for the SCION traffic of the users. See Subscriptions and usage.
  • SNAP coverage: SNAPs in the regions where the users are.
  • An identity provider or client credentials: An identity provider that is reachable without hidden paths, in a public SCION AS or on the public Internet. Or client credentials for applications and devices, for example API keys or client certificates.

Who this model fits​

The self-operated hidden AS gives the enterprise full control over the AS, the gateways, and the access policy. No other organization shares the AS. The enterprise needs operational knowledge of SCION and must invest in the appliances and the connectivity. This model fits large organizations that already operate their own networks, for example banks.