Nicira, Inc.

Vmware, Inc.

Sharath Bhat

Sami Boutros

Subin Cyriac Mathew

Alexander Tessmer

Jerome Catrouillet

Xinghua Hu

Xinhua Hong

Jia Yu

Dexiang Wang

Yashika Narang

Yong Wang

Ankur Dubey

Shadab Shah

Gang Xu

Vijayalaxmi Basavaraj

Subin Cyriac Matthew

Some embodiments provide a method for configuring a set of MFEs to implement a distributed multicast logical router and multiple logical switches to process the multicast data messages. The method sends, from a managed forwarding element (MFE) implementing the distributed multicast logical router, a multicast group query to a set of data compute nodes (DCNs) that are logically connected to one of several logical switches and that execute on the same host machine as the managed forwarding element. The method receives multicast group reports from a subset of the set of DCNs and at least one of the multicast group reports specifies a multicast group of interest. The method distributes, to a set of MFEs executing on other host machines, a summarized multicast group report specifying a set of multicast groups of interest to the first MFE (i.e., multicast groups that the first MFE participates in).

Distributed multicast logical router

In an embodiment, a computer-implemented method for a MAC addresses synchronization mechanism for a bridge port failover is disclosed. In an embodiment, the method comprises: upon detecting a failover of a previously active bridge node, a standby bridge node performing: detecting a failover of a previously active bridge node; sending a request to one or more hosts to cause the one or more hosts to remove, from one or more corresponding forwarding tables, one or more MAC addresses, of one or more virtual machines, that the one or more hosts learned based on communications tunnels established with the previously active bridge node; for each MAC address stored in a MAC-SYNC table maintained by the standby bridge node: generating a first-type reverse address resolution protocol ('RARP') packet having a source MAC address retrieved from the MAC-SYNC table; broadcasting the first RARP message to a virtual extensible LAN ('VXLAN') switch via a bridge port of the VXLAN switch for the VXLAN switch to register the MAC address on the bridge port; storing an association of the MAC address and an identifier of the bridge port in a forwarding table maintained by the standby bridge node; for each MAC address that is stored in the forwarding table, but not in the MAC-SYNC table: generating a second-type RARP packet with such a MAC address to be the source MAC address; broadcasting the second RARP message from the VXLAN switch to a VLAN switch causing a physical switch to update a forwarding table maintained by the physical switch; and starting to forward traffic, via the bridge port, as an active bridge node.

Mac-sync based mechanism for bridge port failover

For a set of gateway devices at the edge of a logical network, some embodiments provide a method for ensuring that data messages from an external network requiring a stateful service are received at an active gateway device. The method advertises the availability of a set of internet protocol (IP) addresses from standby gateway devices with a higher cost than the cost advertised by an active gateway device. In some embodiments, the advertisement is made using a border gateway protocol. Data messages may be unexpectedly received on a standby node despite the higher advertised cost. This could happen due to asymmetric network failures. The method determines if a stateful service is needed for the data messages received on standby node. Based on the determination, the method forwards the received data message to the active gateway device for the active gateway device to provide the stateful service.

Providing stateful services deployed in redundant gateways connected to asymmetric network

Methods, apparatus and articles of manufacture to use artificial intelligence to define encryption and security policies in a software defined data center are disclosed. Example apparatus include a language parser to parse a natural language statement into a policy statement that defines a distributed network encryption policy or a distributed network security policy. Example apparatus also include a comparator to compare the policy statement to a set of reference policy templates and a template configurer to select a first policy template from the set of reference policy templates in response to the comparator determining the first policy template corresponds to the policy statement. A policy distributor distributes a policy rule defined by the first policy template for enforcement at network nodes of a software defined data center. The policy rule is a distributed network encryption policy rule or a security policy rule.

Methods, apparatus and systems to use artificial intelligence to define encryption and security policies in a software defined data center

A computer-implemented method for a media access control (MAC) address synchronization mechanism for a bridge port failover is disclosed. The method comprises: detecting a failover of a previously active bridge node; for each MAC address stored in a MAC-SYNC table: generating a first reverse address resolution protocol ('RARP') packet having a source MAC address; broadcasting the first RARP message to a virtual extensible LAN ('VXLAN') switch via a bridge port to register the source MAC address on the bridge port; and storing an association of the MAC address and an identifier of the bridge port in a forwarding table; for each MAC address stored in the forwarding table but not stored in the MAC-SYNC table: generating a second RARP packet with a MAC address to be the source MAC address; causing a physical switch to update a forwarding table maintained by the physical switch; and forwarding traffic via the bridge port.

MAC-sync based mechanism for bridge port failover

For a managed network implementing at least one logical router having centralized and distributed components, some embodiments provide a method for processing multicast data messages at a first managed forwarding element (MFE) executing on a first host machine that implements a distributed multicast logical router and multiple logical switches logically connected to the logical router in conjunction with a set of additional MFEs executing on additional host machines. The method replicates multicast data messages received from a source data compute node (DCN), operating on the first host machine, that logically connects to a first logical switch of the multiple logical switches. The method replicates the multicast data message to a set of DCNs in the multicast group in the logical network without routing through a centralized local multicast router.

Growing community of inventors

Santa Clara, CA, United States of America

Sharath Bhat