Amazon Technologies, Inc.

Nick Matthews

Bashuman Deb

Omer Hashmi

Baihu Qian

Thomas Nguyen Spendley

Anoop Dawani

Shridhar Kulkarni

Daniel William Dacosta

Justin Lin Hsieh

Ramin Ali Dousti

Indira Radhika Pulla

Steve Ge

Nicholas Ryan Lombardi

Viktor Heorhiadi

Paul John Tillotson

Lalith Kumar Ramamoorthi

John David Backes

Alok Mishra

Brandon Michael LaRue

Nikolaos Giannarakis

Guru Kannan

Samuel Bayless

Nathan Launchbury

Syed Mubashir Iqbal

Sagar Chintamani Joshi

Nadia Labai

Vaibhav Katkade

Patrick Trentin

Victor Heorhiadi

David Jonathan Adams

Aaron Scott DeBruin

Christian Elsen

Tomasz Jozef Adamski

Hrushikesh Jaibheem Gangur

Systems and methods are provided for obtaining policy data associated with a private network implemented at least partly within a cloud provider network; establishing, based on the policy data, a first segment within the private network, wherein in a first geographic region of the cloud provider network, traffic associated with the first segment is isolated from traffic associated with a second segment of the private network, and wherein in a second geographic region of the cloud provider network, traffic associated with the first segment is isolated from traffic associated with a third segment of the private network; obtaining metadata indicating an isolated network of the cloud provider network is associated with the first segment; and enabling the isolated network to communicate, over the first segment, across the first geographic region and the second geographic region.

Network configuration analysis and management

Systems and methods are provided for evaluation of communication paths through networks to determine whether communication is permitted across one or more internal network boundaries. The analysis may be used to determine whether a node in one isolated network (e.g., VPC, VPN, client on-premise network, etc.) is able to communicate with a node in another isolated network across region and/or segment boundaries. The automated analysis can allow users (e.g., network administrators) to see what high-level policies (e.g., Cloud WAN policies written in a declarative language) are interfering with or permitting communication between the nodes.

Systems and methods are provided for enforcing symmetric flows of cross-region network traffic through firewalls in multi-region network environments. Enforcement may be configured automatically by analyzing network policy data to identify cross-region traffic that is to be firewalled, and configuring gateway nodes in the various regions to implement symmetric bidirectional flows through any firewalls in the communication path. Beneficially, by enforcing symmetric bi-directional flows of traffic through any firewalls in a communication path, the firewalls may maintain the state of a given communication session even when the communication session is between endpoints in different regions that have different architectures.

Symmetric cross-region network data flow management

Systems and methods are provided for evaluation of networks and changes thereto using automated analysis of network models. The automated analysis can be used to determine how to implement and mutate networks efficiently and effectively, to determine whether and why network resources are unable to communicate with each other, and the like. Automated analysis can allow users (e.g., network administrators) to define networks and pose changes to networks using high-level policies (e.g., written in a declarative language), have those polices automatically translated to lower-level implementation operations for analysis, and in some cases have results of the analysis presented back to the users in an easy-to-understand form.

Dynamic evaluation and implementation of network mutations

Systems and methods are provided for management of network segments that cross geographic regions and/or other types of network divisions in a cloud-based network environment. A cloud-based network provider's geographically-dispersed network infrastructure may serve as the core of a client's private wide area network, and the client may define isolated segments to which other networks (virtual private clouds, virtual private networks, etc.) may be attached. The various segments may remain logically isolated from each other even when implemented across some or all of the same regions—and using the same physical and/or virtual routing components—as other segments of the same client and/or other clients.

Tag-based cross-region segment management

A pair of virtual routers is configured. In response to programmatic requests, dynamic transfer of routing information between the routers in accordance with configuration settings indicated by a client is enabled. The routing information is associated with a set of isolated networks to which the virtual routers are attached. A network packet originating at an address in a first isolated network is transmitted to an address in a second isolated network using a route determined from routing information transmitted between the virtual routers according to the configuration settings.

Dynamic routing for peered virtual routers

Systems and methods are provided for management of network segments that cross geographic regions and/or other types of network divisions in a cloud-based network environment. Gateway may manage traffic across regions using routing metadata that includes a segment identifier. The gateways may also signal their routes across regions based on segment data, and implement the signaled routes using segment-based routing policies. Route selection may be performed using optimization data.

Metadata-based cross-region segment routing

A network change verification (NCV) system is disclosed for checking whether a proposed configuration change on a network alters the way that the network controls recently observed network flows. In embodiments, the system builds an observed flow control model (OFCM) from logs of recent flows observed in the network. The OFCM, which may be periodically updated based on newly observed flows, provides a compact representation of how individual network flows were ostensibly controlled by the network. When a proposed configuration change is received, the system analyzes the change against the OFCM to check whether the change will alter how the network controls recently observed flows. If so, the proposed change is blocked, and an alert is generated identifying flows that are affected by the change. The NCV system thus prevents network operators from accidentally making changes on the network that will materially alter the behavior of the network.

Network change verification based on observed network flows

An indication of a set of premises between which network traffic is to be routed via a private fiber backbone of a provider network is obtained. Respective virtual routers are configured for a first premise and a second premise, and connectivity is established between the virtual routers and routing information sources at the premises. Contents of at least one network packet originating at the first premise are transmitted to the second premise via the private fiber backbone using routing information obtained at the virtual routers from the routing information source at the second premise.

Wide area networking service using provider network backbone network

Growing community of inventors

Westminster, CO, United States of America

Nick Matthews