Nicira, Inc.

Vmware, Inc.

Other

David J Leroy

Ronghua Zhang

Yong Wang

Jia Yu

Kai-Wei Fan

Xinhua Hong

Serge Maskalik

Rajiv Ramanathan

Srinivas Neginhal

Benjamin C Basler

Ansis Atteka

Ariel Tubaltsev

Liwen Wu

Some embodiments provide a network system. The network system includes a first set of host machines for hosting virtual machines that connect to each other through a logical network. The first set of host machines includes managed forwarding elements for forwarding data between the host machines. The network system includes a second set of host machines for hosting virtualized containers that operate as gateways for forwarding data between the virtual machines and an external network. At least one of the virtualized containers peers with at least one physical router in the external network in order to advertise addresses of the virtual machines to the physical router.

Route advertisement by managed gateways

In an embodiment, a computer-implemented method for using virtual tunnel interface teaming to achieve load balance and redundancy in virtual private networks ('VPNs') is disclosed. In an embodiment, a method comprises: receiving, by a gateway, configuration data from a control plane; based on the configuration data, configuring on the gateway a bonded virtual tunnel interface (“bonded VTI”) having a plurality of slave virtual tunnel interfaces (“slave VTIs”); configuring a plurality of VPN tunnels between the plurality of slave VTIs configured on the gateway and a plurality of slave VTIs configured on a remote gateway; configuring an IPsec VPN tunnel between the bonded VTI configured on the gateway and a corresponding bonded VTI configured on the remote gateway; logically combining the plurality of VPN tunnels into the IPsec VPN tunnel; and enabling communications of IPsec VPN traffic via the IPsec VPN tunnel.

Using VTI teaming to achieve load balance and redundancy

Example methods are provided for a first routing component to handle failure at a logical router in a first network. One method may comprise learning first path information associated with a first path provided by an active second routing component, and second path information associated with a second path provided by a standby second routing component. The method may also comprise in response to detecting a first egress packet destined for a second network, sending the first egress packet to the active second routing component based on the first path information. The method may further comprise in response to detecting a failure at the active second routing component and detecting a second egress packet destined for the second network, sending the second egress packet to a new active second routing component based on the second path information.

Handling failure at logical routers

In an embodiment, a computer-implemented method for using virtual tunnel interface teaming to achieve load balance and redundancy in virtual private networks ('VPNs') is disclosed. In an embodiment, a method comprises: receiving, by a gateway, configuration data from a control plane; based on the configuration data, configuring on the gateway a bonded virtual tunnel interface ('bonded VTI') having a plurality of slave virtual tunnel interfaces (&#x201c;slave VTIs&#x201d;); configuring a plurality of VPN tunnels between the plurality of slave VTIs configured on the gateway and a plurality of slave VTIs configured on a remote gateway; configuring an IPsec VPN tunnel between the bonded VTI configured on the gateway and a corresponding bonded VTI configured on the remote gateway; logically combining the plurality of VPN tunnels into the IPsec VPN tunnel; and enabling communications of IPsec VPN traffic via the IPsec VPN tunnel.

A novel method for troubleshooting a logical network is provided. The logical network has logical forwarding elements operating inside virtual network forwarding engines. The method receives a source identifier and a destination identifier that correspond to nodes in the logical network. The method then retrieves a set of network data from a virtual network forwarding engine and identifies a path in the logical network by traversing the logical network according to the retrieved set of network data. This traversal starts at an initial network node that is identified by the source identifier and continues through a set of next-hop network nodes that are each identified based on the destination identifier. At least some of the network nodes are logical ports associated with logical forwarding elements implemented by the virtual network forwarding engine. The method then reports the set of traversed logical nodes.

Troubleshooting virtual network reachability

Some embodiments provide a method for configuring a gateway datapath that processes data messages between a logical network implemented in a datacenter and an external network. The method receives configuration data including security policy rules for a logical router implemented by the datapath that indicate whether to apply a security protocol to certain data messages transmitted from a particular interface of the logical router. The method identifies a particular security policy rule that applies to data messages that (i) have a destination address in a set of destination addresses and (ii) meet at least one additional criteria. The method generates a static route, for a routing table used by the datapath to implement the logical router, that routes data messages with destination addresses in the set of destination addresses to the particular interface. The datapath applies the security policy rules for data messages transmitted from the particular interface.

Static routes for policy-based VPN

The technology disclosed herein enables network traffic routing using a hybrid routing table. In a particular embodiment, a method provides adding a first portion of a network prefix to one or more tiers of one or more tries in the hybrid routing table. Upon reaching a lowest node of the one or more tries when adding the first portion of the network prefix, the method provides adding key information to the lowest node. The key information and at least a second portion of the network prefix comprise a key to locate a value in a hash table of the hybrid routing table. The value indicates routing information for the network prefix. Additionally, the method provides routing packets using the hybrid routing table.

Hybrid routing table for routing network traffic

Some embodiments provide a network system. The network system includes a first set of host machines hosting virtual machines that connect to each other through a logical network. The network system includes a second set of host machines hosting virtualized containers that operate as gateways to process packets entering the logical network from external sources. Each of the virtualized containers advertises itself to an external router as a next hop for packets entering the logical network such that the external router uses equal-cost multi-path forwarding to distribute the packets across the virtualized containers on the second set of host machines.

Managed gateways peering with external router to attract ingress packets

A system and method are provided for monitoring and analyzing audience response to a broadcast promotion. The specific embodiment for fund-raising campaigns for public television stations is addressed, wherein the taking of pledges over the telephone is automated, the response data entered directly into a computer with the use of scripted screens. The effectiveness of segments of the campaign is calculated by correlating the response data, including the number of telephone calls received, with each promotion segment. Additional methods of manipulating and displaying response data are also disclosed, including the use of demographic and audience ratings to provide an indication of the effectiveness of a promotion segment.

Growing community of inventors

Saratoga, CA, United States of America

David J Leroy