Nicira, Inc.

Packeteer, Inc.

Symantec Corporation

James Joseph Stabile

Azeem Feroz

Wei-Lung Lai

Sachin Thakkar

W Andrew Lambeth

Debashis Basak

Amol Subhash Palshikar

Hua Wang

Pankaj Thakkar

Ganesan Chandrashekhar

Jianjun Shen

Kaushal Bansal

Igor Ganichev

Shadab Shah

Peter J Balland, Iii

Xuan Zhang

Roopesh R Varier

Uday Suresh Masurekar

Jon Eric Okholm

Paul Leslie Archard

Steven Peters

Guy G Riddle

Sachin Mohan Vaidya

Scott Andrew Hankins

Farzad Ghannadian

Michael J Quinn

Radha Popuri

David Jacobson

Prayas Gaurav

Prashant Ambardekar

Bhagyashree Gujar

Sameer Kurkure

Peter J Iii Balland

Example methods are provided for a first node to perform identifier (ID) allocation in a virtualized computing environment that includes a cluster formed by the first node and at least one second node. The method may comprise retrieving, from a pool of IDs associated with the cluster, a batch of IDs to a cache associated with the first node. The pool of IDs may be shared within the cluster and the batch of IDs retrieved for subsequent ID allocation by the first node. The method may also comprise, in response to receiving a request for ID allocation from an ID consumer, allocating one or more IDs from the batch of IDs in the cache to respective one or more objects for unique identification of the one or more objects across the cluster; and sending, to the ID consumer, a response that includes the allocated one or more IDs.

Identifier (ID) allocation in a virtualized computing environment

Some embodiments provide a novel method for distributing control-channel communication load between multiple controllers in a network control system. In some embodiments, the controllers manage physical forwarding elements that forward data between several computing devices (also called hosts or host computers), some or all of which execute one or more virtual machines (VMs). The method of some embodiments distributes a controller assignment list to the host computers. The host computers use this list to identify the controllers with which they need to interact to perform some of the forwarding operations of their associated logical forwarding elements. In some embodiments, agents executing on the host computers (1) review the controller assignment list to identify the appropriate controllers, and (2) establish control channel communications with these controllers to obtain the needed data for effectuating the forwarding operations of their associated physical forwarding elements. These agents in some embodiments are responsible for out-of-band control channel communication with the controllers.

Host side method of using a controller assignment list

Some embodiments provide a method for distributing firewall configuration in a datacenter comprising multiple host machines. The method retrieves a rule in the firewall configuration for distribution to the host machines. The firewall rule is associated with a minimum required version number. The method identifies a high-level construct in the firewall rule. The method queries a translation cache for the identified high-level construct. The translation cache stores previous translation results for different high-level constructs. Each stored translation result is associated with a version number. When the translation cache has a stored previous translation result for the identified high-level construct that is associated with a version number that is equal to or newer than the minimum required version number, the method uses the previous translation result stored in the cache to translate the identified high-level construct to a low-level construct.

Translation cache for firewall configuration

Some embodiments provide a method for managing firewall protection in a datacenter that includes multiple host machines that each hosts a set of data compute nodes. The method maintains a firewall configuration for the host machines at a network manager of the data center. The firewall configuration includes multiple firewall rules to be enforced at the host machines. The method aggregates a first set of updates to the firewall configuration into a first aggregated update and associates the first aggregated update with a first version number. The method distributes a first host-level firewall configuration update to a first host machine based on the first aggregated update and associates the first host machine with the first version number. The method aggregates a second set of updates to the firewall configuration into a second aggregated update and associates the second aggregated update with a second version number.

Firewall configuration versioning

Some embodiments provide a network system that includes several host machines for hosting virtual machines, divided into several different domains. The network system includes several local domain management servers. A first local domain management server of a first domain is for (i) initiating creation of a set of distributed virtual switch ports associated with a particular logical network identifier on a host machine within its domain and (ii) attaching a first virtual machine on the host machine to a created port associated with the particular logical network identifier in order for the first virtual machine to send traffic over the logical network. The network system includes a second level management server for coordinating the use of logical network identifiers between multiple different logical domain management servers in order for the first virtual machine to communicate via the logical network with a second virtual machine in a second domain.

Hierarchical network managers

A novel method for managing firewall configuration of a software defined data center is provided. Such a firewall configuration is divided into multiple sections that each contains a set of firewall rules. Each tenant of the software defined data center has a corresponding set of sections in the firewall configuration. The method allows each tenant to independently access and update/manage its own corresponding set of sections. Multiple tenants or users are allowed to make changes to the firewall configuration simultaneously.

Using activities to manage multi-tenant firewall configuration

Some embodiments provide a method for determining a realization status of one or more logical entities of a logical network. The method, each time a particular event occurs, increments the value of a realization number and publishes the incremented value to a set of controllers of the logical network. Upon receiving data that specifies the state of a logical entity of the logical network, the method publishes the logical entity state's data to the set of controllers. In some embodiments, the method queries the set of controllers for a realization status of the state data for a set of logical entities that is published to the set of controllers up to a particular point of time. The submitted query, in some embodiments, includes a particular value of the realization number associated with the particular point of time.

Identifying the realization status of logical entities based on a global realization number

Hierachircal network managers

Some embodiments provide a method for identifying a realization status of one or more logical entities of a logical network. In some embodiments the method is implemented by a controller that controls network data communications in a logical network. The method receives a request for realization status of a set of logical entities at a particular point of time that is associated with a particular value of a realization number. The method determines whether configuration data up to the particular point of time for each logical entity in the set has been processed and distributed to a set of local controllers that operates on a set of host machines. The method returns a realization reply that includes a successful realization message when the configuration data up to the particular point in time for each logical entity in the set has been processed and distributed to the set of local controllers.

Determining the realization status of logical entities in logical networks

A multi-layer policy framework for monitoring and enforcing policy is provided. The multi-layer policy framework receives the desired state of the policy at each layer and translates the desired state into a realized state for the layer. The desired state specifies the intent of the user and the realized specifies the specific actions that have to be performed in order to reach the desired state. The realized state at each layer is sent to the next lower layer as the desired state for the lower layer. At the lowest layer, the desired state is converted into a realized state that includes a set of rules used to enforce the policy. The set of rules are then enforced at different enforcement points at the lowest layer.

Multi-layer policy definition and enforcement framework for network virtualization

Methods, apparatuses and systems directed to an aggregate bandwidth utilization control scheme including fair share bandwidth allocation and dynamic allocation of bandwidth in response to detected traffic utilization. In one implementation, the present invention includes a weighted, fair share aggregate bandwidth allocation mechanism that dynamically responds to observed bandwidth utilization to provide unutilized or excess bandwidth to flows and partitions that require it. In another implementation, the present invention features a weighted fair share allocation scheme for hierarchical partition configurations. In other implementations, the present invention provides a per-flow target rate assignment mechanism that prevents spiraling decline of data flow rates.

Aggregate network resource utilization control scheme

Controller side method of generating and updating a controller assignment list

Growing community of inventors

Los Altos, CA, United States of America

James Joseph Stabile