Reefspan

How Reefspan works

What the gateway does with every connection, and what happens when something fails.

The picture

Three regions, each a complete Reefspan: console, API, gateway and a copy of the database. They keep each other in sync.

PeopleLaptops and phonesOpenConnect · IKEv2Offices & cloudsYour firewall (IPsec)FortiGate, Meraki, Azure…AdministratorsThis consoleany region, one loginReefspan gateway, in every regionFront doorTLS 443 → OpenConnectUDP 443 DTLS · UDP 500/4500IPsec (strongSwan)Gateway agentchecks every login withReefspan (fail closed)assigns your org's addressEnforcement in the kernelonly the destinations your policy allows, each on a 5-minute leaseyour org's own routing table for your site tunnelsno user-to-user or customer-to-customer trafficControl plane (same on all three regions)identity, policy, grants, audit · Postgres replicatedNew Jersey ⇄ Miami ⇄ Mexico City, quorum commitslive bandwidth and health from every gatewayOffice networksthrough your site tunnelonly for allowed peopleCloud & SaaSthe internet destinationsyour policy allowsEverything elseblocked by defaultdropped

What happens when someone connects

The same six steps for OpenConnect today and for built-in IKEv2 clients as they arrive.

  1. 1. You sign in

    Through your organization's identity provider, with multi-factor authentication. Reefspan never sees your password.

  2. 2. Policy decides

    Reefspan checks your role, groups, device and region against your organization's policy. Nothing is allowed unless a rule allows it.

  3. 3. A one-time pass

    If you're allowed, you get an access code that works once, for two minutes, on one specific gateway.

  4. 4. The gateway checks again

    The gateway hands the code back to Reefspan, which re-checks the policy at that moment. Only then does the tunnel open, with an address from your organization's own block.

  5. 5. Only what's allowed

    The gateway programs exactly the destinations your policy allows into the kernel, each with a five-minute lease. Everything else, including other customers and other users, is dropped.

  6. 6. Leases keep renewing

    While you're connected the gateway renews the lease every minute. Revoke a person or device and their traffic stops at once; if the gateway loses contact with Reefspan, access ends when the lease runs out.

In plain words

Reefspan gives your organization one secure place to connect people, devices, offices and cloud networks, without giving anyone unrestricted access to everything.

When someone connects, Reefspan first confirms who they are and which device they are using, including multi-factor authentication. It then checks which applications and networks they may reach, and for how long.

Connections land on a regional gateway in New Jersey, Miami or Mexico City using OpenConnect, or IPsec for site-to-site links from your firewall. Your offices connect with encrypted tunnels that only your own people can use, even when another customer uses the same private addresses.

Reefspan watches gateway health, live bandwidth, sessions, certificate expiry and security events, and records every change in a tamper-evident audit log. If a region becomes unavailable, its name is taken out of service within about half a minute and people reconnect through another region; open connections may need to reconnect.

When a region goes away

What Reefspan Connect and your office tunnel do, second by second.

Your laptopReefspan ConnectNew Jerseyclosest · 18 msMiaminext · 41 ms · holds the tunnelHead officeIPsec · WAN 1 + WAN 2site tunnelyour own link between regionsConnected to the closest regionNew Jersey stops answering……moved to Miami, office still reachable
A 12-second loop. With reduced motion, the picture shows the end state: connected through Miami.
  1. Closest first

    Reefspan Connect measures every region your organization may use and connects to the fastest healthy one.

  2. Region lost

    If that region stops answering, the client asks Reefspan for a fresh one-time code for the next closest region, signed by a key that never leaves your device.

  3. Office still there

    Your office tunnel answers in any region: users in a region without the tunnel reach it over your organization’s own encrypted link between regions, and Reefspan checks your policy again where the tunnel lives.

Built to fail safely

What happens when something breaks.

If this fails……this happens
A whole regionHealth checks remove it from connect.reefspan.byteingine.com after three missed probes; new connections go to the other regions.
The database primaryAnother region is promoted in seconds. Every change is confirmed by a second region before it counts, so nothing approved is lost.
A gateway loses contact with ReefspanNo new connections there (it fails closed). Existing sessions keep working until their five-minute lease ends.
A site tunnel’s primary regionThe second region is already connected and takes over; users in every region follow it. The tunnel never falls back to an unencrypted path.
Your office’s first internet connectionAfter about 30 seconds without it, Reefspan moves the tunnel to your second connection and stays there while it works.
The region a person is connected toReefspan Connect moves them to the next closest region, usually within a minute; their old session is closed once the new one is up.
The link between two regionsUsers in the cut-off region lose the office until it heals; nothing is ever routed through another customer or the open internet.