Amazon Technologies, Inc.

Anoop Dawani

Bashuman Deb

Omer Hashmi

Baihu Qian

Thomas Nguyen Spendley

Nick Matthews

Joseph Elmar Magerramov

Shridhar Kulkarni

Richard Hazen Galliher, Iii

Nishant Kanaiyalal Mehta

Ramin Ali Dousti

Lee Spencer Dillard

Indira Radhika Pulla

Steve Ge

Justin Lin Hsieh

Nicholas Ryan Lombardi

Paul John Tillotson

Daniel William Dacosta

Viktor Heorhiadi

Andrew Bruce Dickinson

Brandon Michael LaRue

Guru Kannan

Lalith Kumar Ramamoorthi

Colm MacCarthaigh

David James Goodell

Alok Mishra

Jaywant U Kapadnis

Bharadwaj Avva

Fahed Hijazi

Xiyuan Gou

Steven Bruce Richards

Yuxin Ren

David Jonathan Adams

Aaron Scott DeBruin

Zachary Brandes

Apoorv Mittal

Ryan James Schaefer

Kiran Venkat Sayeeram Karpurapu

Ajay Jha

Nishant Mehta

Systems and methods are provided for obtaining policy data associated with a private network implemented at least partly within a cloud provider network; establishing, based on the policy data, a first segment within the private network, wherein in a first geographic region of the cloud provider network, traffic associated with the first segment is isolated from traffic associated with a second segment of the private network, and wherein in a second geographic region of the cloud provider network, traffic associated with the first segment is isolated from traffic associated with a third segment of the private network; obtaining metadata indicating an isolated network of the cloud provider network is associated with the first segment; and enabling the isolated network to communicate, over the first segment, across the first geographic region and the second geographic region.

Network configuration analysis and management

Techniques are described that enable users to configure the mirroring of network traffic sent to or received by computing resources associated with a virtual network of computing resources at a service provider network. The mirrored network traffic can be used for many different purposes including, for example, network traffic content inspection, forensic and threat analysis, network troubleshooting, data loss prevention, and the like. Users can configure such network traffic mirroring without the need to manually install and manage network capture agents or other such processes on each computing resource for which network traffic mirroring is desired. Users can cause mirrored network traffic to be stored at a storage service in the form of packet capture (or 'pcap') files, which can be used by any number of available out-of-band security and monitoring appliances including other user-specific monitoring tools and/or other services of the service provider network.

Mirroring network traffic of virtual networks at a service provider network

A message indicating an auxiliary task associated with traffic transmitted via a virtual router between a pair of isolated networks is received at an offloading device. A stack multiplexer at the offloading device selects a protocol stack instance to process the message. A result of the auxiliary task is obtained by the multiplexer from the selected protocol stack instance and transmitted to the virtual router, where it is used to transmit a packet between the isolated networks.

Multi-tenant offloaded protocol processing for virtual routers

Systems and methods are provided for evaluation of communication paths through networks to determine whether communication is permitted across one or more internal network boundaries. The analysis may be used to determine whether a node in one isolated network (e.g., VPC, VPN, client on-premise network, etc.) is able to communicate with a node in another isolated network across region and/or segment boundaries. The automated analysis can allow users (e.g., network administrators) to see what high-level policies (e.g., Cloud WAN policies written in a declarative language) are interfering with or permitting communication between the nodes.

Systems and methods are provided for evaluation of networks and changes thereto using automated analysis of network models. The automated analysis can be used to determine how to implement and mutate networks efficiently and effectively, to determine whether and why network resources are unable to communicate with each other, and the like. Automated analysis can allow users (e.g., network administrators) to define networks and pose changes to networks using high-level policies (e.g., written in a declarative language), have those polices automatically translated to lower-level implementation operations for analysis, and in some cases have results of the analysis presented back to the users in an easy-to-understand form.

Dynamic evaluation and implementation of network mutations

Systems and methods are provided for management of network segments that cross geographic regions and/or other types of network divisions in a cloud-based network environment. A cloud-based network provider's geographically-dispersed network infrastructure may serve as the core of a client's private wide area network, and the client may define isolated segments to which other networks (virtual private clouds, virtual private networks, etc.) may be attached. The various segments may remain logically isolated from each other even when implemented across some or all of the same regions—and using the same physical and/or virtual routing components—as other segments of the same client and/or other clients.

Tag-based cross-region segment management

A pair of virtual routers is configured. In response to programmatic requests, dynamic transfer of routing information between the routers in accordance with configuration settings indicated by a client is enabled. The routing information is associated with a set of isolated networks to which the virtual routers are attached. A network packet originating at an address in a first isolated network is transmitted to an address in a second isolated network using a route determined from routing information transmitted between the virtual routers according to the configuration settings.

Dynamic routing for peered virtual routers

Systems and methods are provided for management of network segments that cross geographic regions and/or other types of network divisions in a cloud-based network environment. Gateway may manage traffic across regions using routing metadata that includes a segment identifier. The gateways may also signal their routes across regions based on segment data, and implement the signaled routes using segment-based routing policies. Route selection may be performed using optimization data.

Metadata-based cross-region segment routing

Disclosed are various embodiments of a stateful network router. In one embodiment, a network data connection is intercepted between a first host and a second host on a network. First data packets from the network data connection sent by the first host to the second host are routed to a target network appliance. Second data packets from the network data connection sent by the second host to the first host are also to the target network appliance.

Stateful network router for managing network appliances

An indication of a set of premises between which network traffic is to be routed via a private fiber backbone of a provider network is obtained. Respective virtual routers are configured for a first premise and a second premise, and connectivity is established between the virtual routers and routing information sources at the premises. Contents of at least one network packet originating at the first premise are transmitted to the second premise via the private fiber backbone using routing information obtained at the virtual routers from the routing information source at the second premise.

Wide area networking service using provider network backbone network

Technologies are disclosed for monitoring network traffic using traffic mirroring. According to some examples, traffic mirroring allows customers to monitor traffic at different sources within a VPC. For example, a source may be any Elastic Network Interface (ENI) in their VPC, including elastic network interfaces (ENIs) on virtual machine instances, Network Address Translation (NAT) Gateways, Load Balancers, VPC endpoints, Internal Gateways, Transit Gateways, and more. Filters can be utilized to determine the network traffic to mirror. A customer may also configure to monitor real-time traffic with a monitoring appliance of their choice. With traffic mirroring, data traffic may be identified and sent to one or more target devices. Customers may monitor traffic within a VPC for content inspection, forensic analysis, troubleshooting, record keeping, and the like. Using traffic mirroring, customers can replicate VPC traffic, along with full payload data, without installing and managing agents on virtual machine instances.

Monitoring network traffic using traffic mirroring

Techniques for networking in provider network substrate extensions are described. A compute instance of an isolated virtual network is hosted by an extension of a provider network that is in communication with the provider network via a secure tunnel through a customer network. A request to establish communications between the isolated virtual network and the customer network is received at an interface to the provider network. A message to cause a gateway of the extension to route traffic between the isolated virtual network and the customer network is sent via the secure tunnel.

Networking in provider network substrate extensions

Managed multicast communications may be implemented across isolated networks. A virtual traffic hub may be implemented that connects different isolated networks. A control plane for the virtual traffic hub may accept requests to enable a multicast group between different isolated networks connected to the virtual traffic hub. The multicast group may then be enabled at the virtual traffic hub so that requests to add members to the multicast group and data packets directed to the multicast group can be handled according to multicast protocols by the virtual traffic hub.

Managed multicast communications across isolated networks

Disclosed are various embodiments of a stateful network router. In one embodiment, a stateful network router intercepts a network data connection between a first host and a second host on a network. The stateful network router routes first data packets from the network data connection sent by the first host to the second host to a target. The stateful network router also routes second data packets from the network data connection sent by the second host to the first host to the target.

Growing community of inventors

Kirkland, WA, United States of America

Anoop Dawani