Vmware, Inc.

Nicira, Inc.

Israel Cidon

Eyal Zohar

Aran Bergman

Chen Dar

Prashanth Venugopal

Alex Markuze

Igor Golikov

Avishay Yanai

Lior Gal

Sami Boutros

Ankur Dubey

Mike Parsa

Guy Golan Gueta

Some embodiments of the invention provide a method for WAN (wide area network) optimization for a WAN that connects multiple sites, each of which has at least one router. At a gateway router deployed to a public cloud, the method receives from at least two routers at least two sites, multiple data streams destined for a particular centralized datacenter. The method performs a WAN optimization operation to aggregate the multiple streams into one outbound stream that is WAN optimized for forwarding to the particular centralized datacenter. The method then forwards the WAN-optimized data stream to the particular centralized datacenter.

WAN optimization in the public cloud

The method of some embodiment provides DNS service for an SD-WAN. The method receives a DNS request for a domain name (e.g., a FQDN) from one of the compute nodes connected to the SD-WAN (e.g., from a branch site or datacenter site, or a machine of a remote user). The method selects a particular network address (e.g., a particular IP address) from several network addresses (e.g., several IP addresses) of several different sets of servers that are associated with the domain name based on measurements taken by agents deployed in the SD-WAN and based on SD-WAN DNS-resolution selection criteria. The method provides the particular network address in response to the DNS request to the machine that sent the DNS request (e.g., to the branch site or datacenter that sent the DNS request, or to the machine of the remote user that sent the request).

Providing DNS service in an SD-WAN

In a novel tunnel-less SD-WAN, when an ingress node of the SD-WAN receives a new packet flow, it identifies the path of the flow through the SD-WAN, and sends an initial prepended set of SD-WAN header values before the first packet for the flow to the next hop along this identified path, rather than encapsulating each packet of the flow with encapsulating tunnel headers that store SD-WAN next hop data for the flow. The prepended set of SD-WAN header values are then used to not only forward the first packet through the SD-WAN, but also to create records at each subsequent hop, which are then used to forward subsequent packets of the flow through the SD-WAN.

Tunnel-less SD-WAN

WAN optimization for encrypted data traffic using fully homomorphic encryption

Wan optimization for encrypted data traffic using fully homomorphic encryption

Some embodiments of the invention provide a WAN optimization method for optimizing traffic flows through a WAN connecting multiple sites each having at least one router. The method is performed in a kernel space of a first router at a first site. From a second router at a second site, the method receives, in an optimized data stream originating from a source device at the second site and destined to a destination device at the first site, a file including compressed segments not yet stored in a database of the first router. The method copies the compressed segments to a shared memory used with a decompression program operating in the first router's user space. For each compressed segment, the method receives, from the decompression program, a decompressed segment obtained by decompressing the compressed segment, and stores the decompressed segment in a kernel space memory for use in processing the file.

Advanced storage operations for wan optimization

Some embodiments of the invention provide a WAN optimization method for optimizing traffic flows through a WAN. The method is performed in a kernel space of a first router at a first site. From a second router at a second site, the method receives, in an optimized data stream from a second site source device to a first site destination device, a file including compressed segments not yet stored by the first router, and copies the compressed segments to a memory shared with a decompression program in the first router's user space. For each compressed segment, the method receives a notification that a decompressed segment obtained by decompressing the compressed segment has been written to a disk storage of the first router, the notification including a block address for the decompressed segment, and updates a cache of the first router with an entry mapping the decompressed segment to the block address.

Advanced storage operations for WAN optimization

WAN optimization using probabilistic data filters

Some embodiments provide a method of reducing network congestion in a virtual network. The method, at a first CFE of the virtual network, receives multiple encapsulated data packets of a data stream. The encapsulated data packets having been encapsulated by a second CFE, operating on a server of the virtual network. The second CFE identifies a load percentage of the server, sets explicit congestion notification (ECN) bits on a percentage of the data packets based on the load percentage of the server, and encapsulates each data packet. The first CFE determines whether to forward a new connection to the second CFE based at least on the percentage of data packets from the first CFE with the ECN bits set.

Explicit congestion notification in a virtual environment

Some embodiments provide a novel method for deploying different virtual networks over several public cloud datacenters for different entities. For each entity, the method (1) identifies a set of public cloud datacenters of one or more public cloud providers to connect a set of machines of the entity, (2) deploys managed forwarding nodes (MFNs) for the entity in the identified set of public cloud datacenters, and then (3) configures the MFNs to implement a virtual network that connects the entity's set of machines across its identified set of public cloud datacenters. In some embodiments, the method identifies the set of public cloud datacenters for an entity by receiving input from the entity's network administrator. In some embodiments, this input specifies the public cloud providers to use and/or the public cloud regions in which the virtual network should be defined. Conjunctively, or alternatively, this input in some embodiments specifies actual public cloud datacenters to use.

Providing recommendations for implementing virtual networks

Some embodiments provide a method for providing a resource to a particular virtual private cloud that is deployed in a set of datacenters that host multiple virtual private clouds. At a resource issuer, the method receives a resource request from a particular machine deployed in the particular virtual private cloud, the resource request including a first set of cloud-specific data. The method obtains a cloud identifier for the particular machine from a registry service of the particular virtual private cloud that interacts with a datacenter-set cloud service that deploys machines in the datacenter set for different virtual private clouds. The method uses the obtained cloud identifier to obtain a second set of cloud-specific data for the particular machine from the datacenter-set cloud service. Upon determining that the first and second sets of cloud-specific data match, the method authenticates the particular machine and issues the resource for the particular machine.

Method of distributing client certificates to machines with shared cloud account access

Some embodiments establish for an entity a virtual network over several public clouds of several public cloud providers and/or in several regions. In some embodiments, the virtual network is an overlay network that spans across several public clouds to interconnect one or more private networks (e.g., networks within branches, divisions, departments of the entity or their associated datacenters), mobile users, and SaaS (Software as a Service) provider machines, and other web applications of the entity. The virtual network in some embodiments can be configured to optimize the routing of the entity's data messages to their destinations for best end-to-end performance, reliability and security, while trying to minimize the routing of this traffic through the Internet. Also, the virtual network in some embodiments can be configured to optimize the layer 4 processing of the data message flows passing through the network.

Growing community of inventors

San Francisco, CA, United States of America

Israel Cidon