Vmware, Inc.

Nicira, Inc.

Oracle International Corporation

Jia Yu

Yong Wang

Xinhua Hong

Ronghua Zhang

Dexiang Wang

David J Leroy

Nilesh Ramchandra Nipane

Teemu Koponen

Ganesan Chandrashekhar

Sachin Thakkar

Su Wang

Piyush Kothari

ChiHsiang Su

Mukesh Hira

Chi-Hsiang Su

Jayant Jain

Mallik Mahalingam

Abhishek Goliya

Akshay Katrekar

Mike Parsa

Hongwei Zhu

Mukesh Baphna

Greg Fichtenholtz

Sharath Bhat

Haihua Luo

Xinghua Hu

Saurabh Shah

Pradeep Bollineni

Sami Boutros

Weiqing Wu

Wenyi Jiang

Guolin Yang

Todd Sabin

Santosh Pallagatti Kotrabasappa

Jerome Catrouillet

Awan Kumar Sharma

Sanal Pillai

Kiran Prabhakar

Liwen Wu

Eduard Serra Miralles

Santhosh Sundararaman

Mark Pariente

Mochi Xue

Gopal Rao

Stephen Dondershine

Vaibhav Kulkarni

Jayant Jian

In some embodiments, a method fragments a first packet into a plurality of fragments when a length of an encapsulated first packet is larger than a maximum transmission unit size. For each fragment in the plurality of fragments, fragmentation information is generated. The method encapsulates each fragment in the plurality of fragments with an outer header to form a plurality of encapsulated packets. The respective fragmentation information for each fragment is inserted in a portion of the outer header that is processed by endpoints of an overlay tunnel and not processed by a device along a path of the overlay tunnel. The plurality of encapsulated packets are sent via the overlay tunnel.

Packet fragmentation using outer header

Example methods for a network device to perform address resolution handling. The method may comprise: in response to a first distributed router (DR) port of a first DR instance detecting an address resolution request from a second DR port of a second DR instance, generating a modified address resolution request that is addressed from a first address associated with the first DR port instead of a second address associated with the second DR port. The modified address resolution request may be broadcasted within a logical network that is connected to the first DR instance through network extension. The method may also comprise: in response to detecting an address resolution response that includes protocol-to-hardware address mapping information associated with an endpoint located on the logical network, generating and sending a modified address resolution response towards the second DR port of the second DR instance.

Address resolution handling at logical distributed routers

A novel design of a gateway that handles traffic in and out of a network by using a datapath daemon is provided. The datapath daemon is a run-to-completion process that performs various data-plane packet-processing operations at the edge of the network. The datapath daemon dispatches packets to other processes or processing threads outside of the daemon by utilizing a user space network stack.

Edge datapath using user space network stack

Some embodiments of the invention provide novel methods for providing a stateful service at a network edge device (e.g., an NSX edge) that has a plurality of north-facing interfaces (e.g., interfaces to an external network) and a plurality of corresponding south-facing interfaces (e.g., interfaces to a logical network). A set of interfaces on each side of the network edge device for a set of equal cost paths, in some embodiments, are bonded together in the network edge device to correspond to a single interface on either side of a logical bridge including at least one logical switch providing a stateful service implemented by the network edge device. The bond is implemented, in some embodiments, by a bonding module executing on the network edge device that maintains a mapping between ingress and egress interfaces to allow deterministic forwarding through the network edge device in the presence of bonded interfaces.

Port mapping for bonded interfaces of ECMP group

A method for selecting between a plurality of paths for sending an encrypted packet from a source endpoint to a destination endpoint is provided. The method selects a first path of the plurality of paths for sending the encrypted packet from the source endpoint to the destination endpoint, each of the plurality of paths associated with a different one of a plurality of source ports, the encrypted packet being encrypted based on a security association established between the source endpoint and the destination endpoint in accordance with an IPSec protocol. The method further encapsulates, based on the SA having NAT-T enabled, the encrypted packet with a UDP header having a first source port associated with the first path. The method then transmits the encapsulated encrypted packet from the source endpoint to the destination endpoint via the first path.

Path selection for data packets encrypted based on an IPSEC protocol

In an embodiment, a computer-implemented method for using virtual tunnel interface teaming to achieve load balance and redundancy in virtual private networks ('VPNs') is disclosed. In an embodiment, a method comprises: receiving, by a gateway, configuration data from a control plane; based on the configuration data, configuring on the gateway a bonded virtual tunnel interface (“bonded VTI”) having a plurality of slave virtual tunnel interfaces (“slave VTIs”); configuring a plurality of VPN tunnels between the plurality of slave VTIs configured on the gateway and a plurality of slave VTIs configured on a remote gateway; configuring an IPsec VPN tunnel between the bonded VTI configured on the gateway and a corresponding bonded VTI configured on the remote gateway; logically combining the plurality of VPN tunnels into the IPsec VPN tunnel; and enabling communications of IPsec VPN traffic via the IPsec VPN tunnel.

Using VTI teaming to achieve load balance and redundancy

Some embodiments provide a method for a first data compute node (DCN) operating in a public datacenter. The method receives an encryption rule from a centralized network controller. The method determines that the network encryption rule requires encryption of packets between second and third DCNs operating in the public datacenter. The method requests a first key from a secure key storage. Upon receipt of the first key, the method uses the first key and additional parameters to generate second and third keys. The method distributes the second key to the second DCN and the third key to the third DCN in the public datacenter.

Centralized processing of north-south traffic for logical network in public cloud

In an embodiment, a computer-implemented method for a MAC addresses synchronization mechanism for a bridge port failover is disclosed. In an embodiment, the method comprises: upon detecting a failover of a previously active bridge node, a standby bridge node performing: detecting a failover of a previously active bridge node; sending a request to one or more hosts to cause the one or more hosts to remove, from one or more corresponding forwarding tables, one or more MAC addresses, of one or more virtual machines, that the one or more hosts learned based on communications tunnels established with the previously active bridge node; for each MAC address stored in a MAC-SYNC table maintained by the standby bridge node: generating a first-type reverse address resolution protocol ('RARP') packet having a source MAC address retrieved from the MAC-SYNC table; broadcasting the first RARP message to a virtual extensible LAN ('VXLAN') switch via a bridge port of the VXLAN switch for the VXLAN switch to register the MAC address on the bridge port; storing an association of the MAC address and an identifier of the bridge port in a forwarding table maintained by the standby bridge node; for each MAC address that is stored in the forwarding table, but not in the MAC-SYNC table: generating a second-type RARP packet with such a MAC address to be the source MAC address; broadcasting the second RARP message from the VXLAN switch to a VLAN switch causing a physical switch to update a forwarding table maintained by the physical switch; and starting to forward traffic, via the bridge port, as an active bridge node.

Mac-sync based mechanism for bridge port failover

A method of utilizing the same hardware network interface card (NIC) in a gateway of a datacenter to communicate datacenter tenant packet traffic and packet traffic for a set of applications that execute in the user space of the gateway and utilize a network stack in the kernel space of the gateway. The method sends and receives packets for the datacenter tenant packet traffic through a packet datapath in the user space. The method sends incoming packets from the NIC to the set of applications through the datapath in the user space, a user-kernel transport driver connecting the kernel network stack to the datapath in the user space, and the kernel network stack. The method receives outgoing packets at the NIC from the set of applications through the kernel network stack, the user-kernel transport driver, and the data path in the user space.

In-band management interface with user space datapath

The disclosure provides an approach for routing traffic in a network. Embodiments include receiving, by a service router of an edge services gateway (ESG), a packet comprising a virtual network identifier (VNI) and a virtual local area network (VLAN) identifier. Embodiments include sending, by the service router, the packet to a virtual switch of the ESG based on the VNI of the packet. Embodiments include determining, by the virtual switch, a virtual routing and forwarding (VRF) router of the ESG for the packet based on the VLAN identifier. Embodiments include forwarding, by the virtual switch, the packet to the VRF router.

Disambiguating traffic in networking environments with multiple virtual routing and forwarding (VRF) logical routers

The disclosure provides an approach for performance management. Embodiments include receiving, at a port of a router, a transport control protocol (TCP) or user datagram protocol (UDP) packet generated by a performance component of the router. Embodiments include identifying, by the router, a rule related to the TCP or UDP packet. Embodiments include forwarding, by the router, the packet to an interface of a kernel based on the rule. Embodiments include receiving, by the performance component, in response to the TCP or UDP packet, an additional packet from the interface of the kernel. Embodiments include determining, by the performance component, a performance metric based on the TCP or UDP packet and the additional packet.

On-demand packet redirection

Example methods and systems for uplink-aware logical overlay tunnel monitoring are described. In one example, a first computer system may establish a logical overlay tunnel with a second computer system. The first computer system may generate and send, over the logical overlay tunnel via the first uplink, a first encapsulated monitoring packet identifying the first uplink. Based on a first reply, first performance metric information associated with the first uplink may be determined. The first computer system may generate and send, over the logical overlay tunnel via the second uplink, a second encapsulated monitoring packet identifying the second uplink. Based on a second reply, second performance metric information associated with the second uplink may be determined. Based on the first performance metric information and the second performance metric information, the first uplink or the second uplink may be selected to send encapsulated data packet(s) over the logical overlay tunnel.

Uplink-aware monitoring of logical overlay tunnels

Some embodiments provide a method for an MFE, in a first datacenter, to implement an LN spanning the first datacenter and a set of additional datacenters. The method stores records that each map one or more LN addresses for DCNs belonging to the LN and operating in the first datacenter to a different TEP address. The method stores an additional record that maps addresses for DCNs connected to a particular LFE of the LN and operating in the additional datacenters to a group of TEP addresses corresponding to LN gateways that handle data traffic for the particular LFE between the first datacenter and the additional datacenters. Upon receiving a data message with a destination address corresponding to a DCN connected to the particular LFE and operating in one of the additional datacenters, the method uses the additional record to identify a TEP address for encapsulating the data message.

Tunnel endpoint group records

Growing community of inventors

Sunnyvale, CA, United States of America

Jia Yu