Nicira, Inc.

Saurabh Shah

Ronghua Zhang

Ganesan Chandrashekhar

Mukesh Hira

Su Wang

Jia Yu

Akshay Katrekar

Sanal Pillai

Vaibhav Kulkarni

Jayant Jian

Some embodiments provide a method for a first data compute node (DCN) operating in a public datacenter. The method receives an encryption rule from a centralized network controller. The method determines that the network encryption rule requires encryption of packets between second and third DCNs operating in the public datacenter. The method requests a first key from a secure key storage. Upon receipt of the first key, the method uses the first key and additional parameters to generate second and third keys. The method distributes the second key to the second DCN and the third key to the third DCN in the public datacenter.

Centralized processing of north-south traffic for logical network in public cloud

Some embodiments provide a method for a network controller that manages a logical network implemented in a datacenter comprising forwarding elements to which the network controller does not have access. The method identifies a data compute node (DCN), that operates on a host machine in the datacenter, to attach to the logical network. The DCN has a network interface with a first network address provided by a management system of the datacenter, and executes (i) a workload application and (ii) a managed forwarding element (MFE). The method distributes configuration data for configuring the MFE to receive data packets sent from the workload application on the DCN and perform network security and forwarding processing on the data packets. The data packets sent by the workload application have a second network address as a source address when received by the MFE and are encapsulated by the MFE using the first network address.

Managed forwarding element executing in public cloud data compute node with different internal and external network addresses

Some embodiments provide a method for a network controller that manages a logical network implemented in a datacenter having forwarding elements to which the network controller does not have access. The method identifies a data compute node (DCN) operating on a host machine in the datacenter, to attach to the logical network. The DCN has a network interface with an address provided by a datacenter management system. A workload application executes in a first namespace of the DCN. The method distributes configuration data for configuring a managed forwarding element (MFE) executing in a second namespace of the DCN to receive data packets sent from the application via an interface pairing between the first and second namespaces. The data packets sent by the application have the provided address as a source address when received by the MFE and are encapsulated by the MFE using the provided address as a source address.

Managed forwarding element executing in separate namespace of public cloud data compute node than workload application

Some embodiments provide a method for a network controller that manages a logical network implemented in a datacenter having forwarding elements to which the network controller does not have access. The method identifies a data compute node (DCN), that operates on a host machine in the datacenter, to attach to the logical network. The DCN has a network interface with a network address provided by a management system of the datacenter. The DCN executes (i) a workload application and (ii) a managed forwarding element (MFE). The method distributes configuration data for configuring the MFE to receive data packets sent from the workload application on the DCN and perform network security processing on the data packets without performing logical forwarding operations. The data packets sent by the workload application have the provided network address as a source address when received by the MFE and are not encapsulated by the MFE.

Growing community of inventors

Mountain View, CA, United States of America

Saurabh Shah