Vmware, Inc.

Gaurav Jindal

Neeraj Mantri

Rasik Jesadiya

Chandan Ghosh

Hussaina Begum Nandyala

Anantha Mohan Raj

Bhargav Puvvada

Saurabh Garg

Siddhant Verma

Aditya Vikram Mukherjee

Dibakar Swain

Rajesh Sahu

The disclosure provides an approach for gateway optimization. Embodiments include receiving, at a first gateway associated with a first tenant within a data center, a packet directed to a first public network address of an endpoint associated with a second tenant within the data center. Embodiments include performing, by the first gateway, network address translation (NAT) to translate the first public network address to a private network address of the endpoint. Embodiments include forwarding, by the first gateway, the packet to an edge gateway of the data center. Embodiments include forwarding, by the edge gateway, the packet to a second gateway associated with the second tenant within the data center without sending the packet to a public interface of the edge gateway. Embodiments include forwarding, by the second gateway, the packet to the endpoint.

Offloading network address translation and firewall rules to tier-1 routers for gateway optimization

The disclosure provides an approach for processing inter-network communications. Embodiments include configuring, by a management component of a data center, a first virtual private network (VPN) session between a first endpoint outside of the data center and a first gateway of the data center. Embodiments include configuring, by the management component, a second VPN session between a second endpoint outside of the data center and a second gateway of the data center. Embodiments include programming, by the management component, one or more network address translation (NAT) tables of the data center such that, for the first VPN session and the second VPN session, a single public network address of the data center is exposed to the first endpoint and the second endpoint.

Dynamic on-demand virtual private network (VPN) session distribution for gateways

Some embodiments provide a novel method for dynamically deploying gateways for a first network connecting machines. The first network includes segments, routers, and a first gateway that connects to an external network. The method identifies a set of two or more segments that consumes more than a threshold amount of bandwidth of the first gateway. The identified set includes at least first and second segments. The method identifies one or more segment groups by aggregating two or more segments in the identified set. A first segment group includes the first and second segments and a third segment that is not in the identified set of two or more segments. The method configures a second gateway to process flows associated with each identified group including the first group. The method configures a set of routers to forward flows from machines of each segment of each identified group to the second gateway.

Dynamic grouping of network segments for forwarding data message flows from machines of network segment groups to an external network through different edge forwarding elements

Example methods and systems for health check as a service are described. One example may involve a computer system receiving a request to perform a health check for a network environment that includes a set of multiple flows. The computer system may select a subset that includes (a) a first flow between a first pair of endpoints and (b) a second flow between a second pair of endpoints. The health check may be initiated for the first flow and the second flow by generating and sending (a) a first instruction to cause injection of a first health check packet, and (b) a second instruction to cause injection of a second health check packet. The computer system may determine health status information associated with the subset based on (a) first observation information triggered by the first health check packet, and (b) second observation information triggered by the second health check packet.

Health check as a service

Some embodiments provide a method for automatically configuring VPN gateways. The method receives a first configuration for a first VPN gateway located at a first datacenter. The configuration includes configuration data for a first set of VPNs connecting a first set of networks at the first datacenter to other networks at other datacenters. The method automatically modifies the configuration data to generate a second configuration for a second VPN gateway. The method configures the second VPN gateway using the second configuration to setup a second set of VPNs connecting a second set of networks to the other networks at the other datacenters.

Replication of VPN configuration

The disclosure provides an approach for processing communications between connected data centers. Embodiments include receiving, at a first gateway of a first data center from a second gateway of a second data center, one or more policies associated with traffic attributes. Embodiments include programming priority routes between the first gateway and the second gateway over a virtual private network (VPN) tunnel based on the one or more policies, wherein each of the priority routes is associated with a traffic attribute of the traffic attributes. Embodiments include providing the one or more policies to a central controller of the first data center and programming, by the central controller, one or more tables associated with a centrally-managed virtual switch based on the one or more policies. Embodiments include updating a database associated with each of a plurality of hosts based on the programming of the one or more tables.

Dynamic traffic prioritization across data centers

An example method of identifying an equal cost multipath (ECMP)-enabled route-based virtual private networks (RBVPN) in a virtualized computing system, comprises: obtaining, at a telemetry agent executing in an edge server of a data center, learned routes; identifying, by the telemetry agent from the routes, a destination network and a plurality of next hops associated therewith and a plurality of virtual tunnel interfaces (VTIs); identifying, by the telemetry agent for each of the plurality of VTIs, an associated VPN session; grouping, by the telemetry agent, the VPN sessions identified as associated with the plurality of VTIs into an ECMP-enabled RBVPN; adding, by the telemetry agent, a description of the ECMP-enabled RBVPN to telemetry data; and sending, by the telemetry agent, the telemetry data to a telemetry service.

Grouping route-based virtual private network interfaces in a virtualized computing system

A method for direct communication between a source endpoint executing in a first datacenter and a destination endpoint executing in a second datacenter. The method receives, at a gateway of the second datacenter, a packet sent by the source endpoint, the packet having a header that includes a source IP address corresponding to a public IP address of the first datacenter, a destination IP address corresponding to a public IP address of the second datacenter, and source and destination port numbers. The method performs a DNAT process on the packet to replace at least the destination IP address in the header with a private IP address of the destination endpoint. The DNAT process identifies the private IP address by mapping the source and destination port numbers to the private IP address of the destination endpoint. The method then transmits the packet to the destination endpoint in the second datacenter.

Direct communication between endpoints across remote sites

The disclosure provides an approach for service provisioning. Embodiments include receiving first configuration data related to a first network endpoint and second configuration data related to a second network endpoint. Embodiments include generating a service map based on the first configuration data and the second configuration data. Embodiments include receiving a request to provision a service between the first network endpoint and the second network endpoint. Embodiments include determining in response to the request and based on the service map, first service configuration data for the first network endpoint and second service configuration data for the second network endpoint. Embodiments include provisioning the service between the first network endpoint and the second network endpoint by pushing the first service configuration data to the first network endpoint and pushing the second service configuration data to the second network endpoint.

Growing community of inventors

Pune, India

Gaurav Jindal