Nicira, Inc.

Vmware, Inc.

Ganesan Chandrashekhar

Vivek Agarwal

Ram Dular Singh

Rahul Korivi Subramaniyam

Howard Wang

Mukesh Hira

Pankaj Thakkar

Abhishek Goliya

Alexander Tessmer

Akshay Katrekar

Su Wang

Nithin Bangalore Raju

Ronghua Zhang

Hongwei Zhu

Jayant Jain

Bin Qian

Sreeram Kumar Ravinoothala

Sanal Pillai

Sami Boutros

Amarnath Palavalli

Pavlush Margarian

Ankur Kumar Sharma

Gang Xu

Dileep Kumar Devireddy

Subin Cyriac Mathew

Rahul Jain

Ankur Dubey

Vaibhav Diwakar Kulkarni

Anirban Sengupta

Donghai Han

Jianjun Shen

Chidambareswaran Raman

Jia Yu

Igor Ganichev

Kai-Wei Fan

Josh Dorr

Bin Zan

Sreenivas Duvvuri

Sandeep Siroya

Feng Gu

Xiaohu Wang

Frank Pan

Sujatha Sundararaman

Hua Wang

Anupam Chanda

W Andrew Lambeth

Caixia Jiang

Da Wan

James Joseph Stabile

Peter J Balland, Iii

Suresh Babu Muppala

Yin Lin

Calvin Qian

Vicky Liu

Shashank Ram

Sairam Venugopal

Anand Kumar

Jinqiang Yang

Sonia Jahid

Azeem Feroz

Amit Chopra

Medhavi Dhawan

Sri Mohana Singamsetty

Alexander Rogozinsky

Teemu Koponen

Yong Wang

Xinhua Hong

Boon Seong Ang

Dexiang Wang

Wenyi Jiang

Sachin Mohan Vaidya

Chen Li

Jingchun Jason Jiang

Rajeev Nair

Rishi Mehta

Anuprem Chalvadi

Amit Vasant Patil

Minjal Agarwal

Ayyappan Veeraiyan

Yashika Narang

Nilesh Ramchandra Nipane

ChiHsiang Su

Samuel Jacob

Tony Ganchev

Aditya Anil Gokhale

Aayush Saxena

Hitesh Patel

Aravinda Kidambi Srinivasan

Aditya Krishna Sonthy

Saurabh Shah

Bhagyashree Gujar

Ujwala Kawalay

Santhosh Sundararaman

Gopakumar Pillai

Mark Pariente

Sukhdev Singh

Janani Natarajan

Lakshman Krishnamoorthy

Some embodiments provide a method for a first data compute node (DCN) operating in a public datacenter. The method receives an encryption rule from a centralized network controller. The method determines that the network encryption rule requires encryption of packets between second and third DCNs operating in the public datacenter. The method requests a first key from a secure key storage. Upon receipt of the first key, the method uses the first key and additional parameters to generate second and third keys. The method distributes the second key to the second DCN and the third key to the third DCN in the public datacenter.

Extension of network control system into public cloud

Some embodiments provide a method for distributing a service rule that is to be enforced across a first set of sites and that is defined by reference to a group identifier that identifies a group of machines. The method distributes the service rule to each site in the first set of sites. The method identifies at least one site in the first set of sites that is not in a second set of sites that has already received a definition of the group. The method distributes the group definition to each identified site in the first set of sites that has not already received the definition of the group.

Parsing logical network definition for different sites

Described herein are systems, methods, and software to enhance network traffic management. In one implementation, a first host identifies a packet to be transferred from a first virtual machine on the first host to a second virtual machine on a second host. In response to identifying the packet, the first host identifies a source logical port for the first virtual machine, and transferring a communication to the second host, wherein the communication encapsulates the data packet and the source logical port. Once the packet is received by the second host, the second host may use the source logical port to determine a forwarding action for the packet.

Managing network traffic in virtual switches based on logical port identifiers

A logical routing element (LRE) having multiple designated instances for routing packets from physical hosts (PH) to a logical network is provided. A PH in a network segment with multiple designated instances can choose among the multiple designated instances for sending network traffic to other network nodes in the logical network according to a load balancing algorithm. Each logical interface (LIF) of an LRE is defined to be addressable by multiple identifiers or addresses, and each LIF identifier or address is assigned to a different designated instance.

Address resolution using multiple designated instances of a logical router

A LRE (logical routing element) that have LIFs that are active in all host machines spanned by the LRE as well as LIFs that are active in only a subset of those spanned host machines is provided. A host machine having an active LIF for a particular L2 segment would perform the L3 routing operations for network traffic related to that L2 segment. A host machine having an inactive LIF for the particular L2 segment would not perform L3 routing operations for the network traffic of the L2 segment.

Intermediate logical interfaces in a virtual distributed router environment

Exemplary methods, apparatuses, and systems include a central controller receiving a request to generate a new encryption key for a security group to replace a current encryption key for the security group. The security group includes a plurality of hosts that each encrypt and decrypt communications using the current encryption key. In response to receiving the request, the central controller determines that a threshold period following generation of the current encryption key has not expired. In response to determining that the threshold period has not expired, the central controller delays execution of the request until the expiration of the threshold period. In response to the expiration of the threshold period, the central controller executes the request by generating the new encryption key, storing a time of creation of the new encryption key, and transmitting the new encryption key to the plurality of hosts.

Minimizing traffic drop when rekeying in a distributed security group

Some embodiments provide a method of operating several logical networks over a network virtualization infrastructure. The method defines a managed physical switching element (MPSE) that includes several ports for forwarding packets to and from a plurality of virtual machines. Each port is associated with a unique media access control (MAC) address. The metho defines several managed physical routing elements (MPREs) for the several different logical networks. Each MPRE is for receiving data packets from a same port of the MPSE. Each MPRE is defined for a different logical network and for routing data packets between different segments of the logical network. The method provides the defined MPSE and the defined plurality of MPREs to a plurality of host machines as configuration data.

Configuration of logical router

Some embodiments provide a centralized overlay-network cloud gateway and a set of centralized services in a transit virtual cloud network (VCN) connected to multiple other compute VCNs hosting compute nodes (VMs, containers, etc.) that are part of (belong to) the overlay network. The centralized overlay-network cloud gateway provides connectivity between compute nodes of the overlay network (e.g., a logical network spanning multiple VCNs) and compute nodes in external networks. Some embodiments use the centralized overlay-network cloud gateway to provide transitive routing (e.g., routing through a transit VCN) in the absence of direct peering between source and destination VCNs. The overlay network, of some embodiments, uses the same subnetting and default gateway address for each compute node as the cloud provider network provided by the virtual private cloud provider.

Transitive routing in public cloud

Exemplary methods, apparatuses, and systems maintain network membership information for a host when it is disconnected from a controller. When the host detects a loss of connectivity with the network controller, the host identifies and selects one or more hosts that are members of a control logical network. The control logical network includes hosts configured to run data compute nodes that are members of the overlay network, regardless of whether or not each of the hosts is currently running a data compute node that is a member of the overlay network. The host then sends any broadcast, unknown destination, or multicast (BUM) data packet(s) to the selected one or more hosts.

Maintaining network membership when disconnected from a controller

In some embodiments, a method adds a specific route for an IP address that is associated with a first workload into a routing table for a first network device in a first site in response to the first workload being migrated from a second site to the first site. The first network device receives a packet from a second workload for the first workload and determines that a destination of the packet matches the specific route in the routing table. The method routes the packet from the second workload to the first workload using the specific route in the routing table without sending the packet to the second site.

Routing using specific routes

In some embodiments, a method for selecting an egress point for accessing an external network associated with a distributed logical router that is distributed across at least a first computing device and a second computing device is provided. The method receives, by an instance of the logical router at the first computing device, first identification information and a first preference value. The method compares the first preference value to a second preference value. The second preference value is associated with second identification information corresponding to a current computing device that is identified as a current preferred egress point for the logical router. The method determines whether to set the egress point connected to the instance of the logical router in the second computing device as a new preferred egress point for the logical router.

Using an attribute value to set a preferred egress point in multi-site logical routers

Some embodiments provide a network management system for managing a logical network that spans multiple physical sites. The network management system includes a global network manager for receiving global logical network configuration data for the multiple physical sites. The network management system includes, at each of the physical sites, (i) a local network manager for receiving a logical network configuration for the physical site from the global network manager and (ii) a set of central controllers for distributing logical network configuration data to computing devices that implement the logical network at the physical site.

Network management system for federated multi-site logical network

Some embodiments provide a method for implementing a logical router that spans multiple datacenters. The method receives a configuration for a set of logical switches and a logical router (LR) that (i) handles data traffic between data compute nodes (DCNs) connected to the logical switches and endpoints not connected to the set of logical switches and (ii) performs stateful services on the traffic. The DCNs include at least one DCN operating in each datacenter. For each datacenter, the method defines a centralized routing component (SR) for the LR for handling the traffic between the DCNs in the datacenter and the endpoints not connected to the set of logical switches. The method designates one of the SRs as a primary SR and the other SRs as secondary SRs. The secondary SRs forward traffic, received from DCNs in their respective datacenters and for which stateful services are required, to the primary SR.

Primary datacenter for logical router

A system and method for using private native security groups and private native firewall policy rules for a private cloud computing environment and a public cloud computing environment uses a public cloud gateway for routing data traffic between at least a cloud network created in the public cloud computing environment and the private cloud computing environment. For each of some private native firewall policy rules that has any of newly created private native security groups as one of source and destination, a cloud native security group (CNSG) rule object with an CNSG outbound rule object and an CNSG inbound rule object for the public cloud is created and at least one of the CNSG outbound rule object and the CNSG inbound rule object is updated so that the private native firewall policy rule can be used in the cloud network.

System and method for using private native security groups and private native firewall policy rules in a public cloud

Growing community of inventors

Campbell, CA, United States of America

Ganesan Chandrashekhar