Nicira, Inc.

Vmware, Inc.

Symantec Operating Corporation

Sachin Mohan Vaidya

Pavlush Margarian

Anirban Sengupta

Mayur Dhas

Naveen Ramaswamy

Azeem Feroz

Laxmikant Vithal Gunda

James Christopher Wiese

Arnold Poon

Hamza Aharchaou

Nikhil Bokare

Jayant Jain

Amarnath Palavalli

Shrinivas Sharad Parashar

Sarat Chandra Annadata

Shivraj Shahajirao Sonawane

Amardeep Nagarkar

Shantanu Kulkarni

Rushikesh Wagh

Vaibhav Bhandari

Shailesh Makhijani

Kausum Kumar

Farzad Ghannadian

Pankaj Thakkar

Ganesan Chandrashekhar

W Andrew Lambeth

Kaushal Bansal

Abhishek Goliya

Anil Kv Kumar

Shadab Shah

Rajiv Krishnamurthy

James Joseph Stabile

Minjal Agarwal

ChiHsiang Su

Ming Xu

Amol Subhash Palshikar

Prayas Gaurav

Yogesh Gaikwad

Bhagyashree Gujar

Pavan Vijaykumar Deolasee

Ujwala Kawalay

Parag Thakur

Alka Pendharkar

Disha Chopra

Sorabh Kalra

Shashikant Anna Shinde

Bharat Dighe

Vanita Bhatt

Some embodiments of the invention provide a method for deploying software-implemented resources in a software defined datacenter (SDDC). The method initially receives a hierarchical API command that, in a declarative format, specifies several operation requests for several software-defined (SD) resources at several resource levels of a resource hierarchy in the SDDC. The method parses the API command to identify the SD resources at the plurality of resource levels. Based on the parsed API command, the method deploys the SD resources by using a deployment process that ensures that any first SD resource on which a second SD resource depends is deployed before the second resource. In some embodiments, a second SD resource depends on a first SD resource when the second SD resource is a child of the first SD resource. Alternatively, or conjunctively, a second SD resource can also depend on a first SD resource in some embodiments when the second SD resource has some operational dependency on the first SD resource. In some embodiments, the method parses the API command by identifying several sets of SD resources, with each set having one or more SD resources at one resource level. The deployment in some embodiments deploys the identified SD resource sets at higher resource levels before deploying SD resources at lower resource levels.

Hierarchical API for a SDDC

Some embodiments of the invention provide a method for processing requests for performing operations on resources in a software defined datacenter (SDDC). The resources are software-defined (SD) resources in some embodiments. The method initially receives a request to perform an operation with respect to a first resource in the SDDC. The method identifies a policy that matches (i.e., is applicable to) the received request for the first resource by comparing a set of attributes of the request with sets of attributes of a set of policies that place constraints on operations specified for resources. In some embodiments, several sets of attributes for several policies can be expressed for resources at different hierarchal resource levels of the SDDC. The method rejects the received request when the identified policy specifies that the requested operation violates a constraint on operations specified for the first resource.

Policy constraint framework for an SDDC

Some embodiments provide a method for distributing a service rule that is to be enforced across a first set of sites and that is defined by reference to a group identifier that identifies a group of machines. The method distributes the service rule to each site in the first set of sites. The method identifies at least one site in the first set of sites that is not in a second set of sites that has already received a definition of the group. The method distributes the group definition to each identified site in the first set of sites that has not already received the definition of the group.

Multi-site security groups

Some embodiments provide a method for a network management and control system that manages a virtual infrastructure deployed across a set of datacenters. The method receives a definition of an application to be deployed in the virtual infrastructure. The application definition specifies a requirement that the application receive data traffic from sources external to the virtual infrastructure. Based on the application definition, the method defines a first set of firewall rules for the application that indicate conditions for allowing data traffic from sources external to the virtual infrastructure. For an existing second set of higher-level firewall rules for data traffic entering and exiting the virtual infrastructure, the method specifies a new firewall rule that directs a network element implementing the sets of firewall rules to apply the first set of firewall rules to any data traffic that is from sources external to the virtual infrastructure and directed to the application.

Firewall rules for application connectivity

Some embodiments provide a method for generating a multi-layer network map from network configuration data. The method receives network configuration data that defines network components and connections between the network components for a network that spans one or more datacenters. Based on the received network configuration data, the method generates multiple data layers for a multi-layer interactive map of the network. Different data layers include different network components and connections. The method generates a visual representation of the network for each data layer. Each visual representation includes a map of the network at a different level of hierarchy.

Network mapping system

Systems and techniques are described for virtual machine security. A described technique includes operating one or more virtual machines each in accordance with a respective security container, wherein the respective security container is associated with a respective rule that specifies transfer of the virtual machine from the respective security container to a quarantine container based on one or more criteria. One or more security services are operated on the one or more virtual machines to identify one or more security threats associated with one or more of the virtual machines. One or more tags generated by the endpoint security services are obtained, where each tag is for a virtual machine that is associated with one of the identified security threats. And one of the virtual machines is identified as requiring transfer to the quarantine container based on, at least, one or more of the obtained tags and the one or more criteria.

Framework for coordination between endpoint security and network security services

Some embodiments provide a method for network management and control system that manages one or more logical networks. From a first user, the method receives a definition of one or more security zones for a logical network. Each security zone definition includes a set of security rules for data compute nodes (DCNs) assigned to the security zone. From a second user, the method receives a definition of an application to be deployed in the logical network. The application definition specifies a set of requirements. Based on the specified set of requirements, the method assigns DCNs implementing the application to one or more of the security zones for the logical network.

Network virtualization infrastructure with divided user responsibilities

Some embodiments provide a method for a network management and control system that manages a virtual infrastructure deployed across a plurality of sites. The method receives a definition of an application to be deployed in the virtual infrastructure. The application definition specifying a first set of the sites at which to deploy the application. Based on the definition of the application, the method assigns the application to a set of security zones defined for the virtual infrastructure. Each respective security zone is restricted to a respective set of the sites. The method deploys the application in a second set of sites based on the first set of sites and the sets of sites to which the set of security zones are restricted.

Application deployment in multi-site virtualization infrastructure

Some embodiments provide a method for a network management and control system that manages a virtual infrastructure deployed across a set of datacenters. Based on input from a top-level user of the virtual infrastructure, the method deploys a first logical network within the virtual infrastructure and defines one or more second-level users of the virtual infrastructure. The method receives input from a second-level user of the virtual infrastructure to define a second logical network and connect the second logical network to the first logical network. The first and second logical networks use a same data model and the second-level users are restricted from viewing configuration of the first logical network.

Multi-tenant network virtualization infrastructure

Some embodiments of the invention provide a novel architecture for capturing contextual attributes on host computers that execute one or more machines, and for consuming the captured contextual attributes to perform services on the host computers. The machines are virtual machines (VMs) in some embodiments, containers in other embodiments, or a mix of VMs and containers in still other embodiments. Some embodiments execute a guest-introspection (GI) agent on each machine from which contextual attributes need to be captured. In addition to executing one or more machines on each host computer, these embodiments also execute a context engine and one or more attribute-based service engines on each host computer. Through the GI agents of the machines on a host, the context engine of that host in some embodiments collects contextual attributes associated with network events and/or process events on the machines. The context engine then provides the contextual attributes to the service engines, which, in turn, use these contextual attributes to identify service rules for processing.

Collecting and processing contextual attributes on a host

Hierarchical API for SDDC

Growing community of inventors

Pune, India

Sachin Mohan Vaidya