Nicira, Inc.

Vmware, Inc.

Hewlett-packard Development Company, L.p.

Su Wang

Mukesh Hira

Pankaj Thakkar

Ronghua Zhang

Ganesan Chandrashekhar

Akshay Katrekar

Rahul Jain

Anupam Chanda

Jia Yu

Amre Shakimov

Sandeep Siroya

Saurabh Shah

Daniel R Tretter

Jian Fan

Srinivas Neginhal

Vaibhav Diwakar Kulkarni

Divya Sharma

Vivek Agarwal

Kar-Han Tan

Jinman Kang

Yun David Tang

Sanal Pillai

Kar Han Tan

Hung-Shuo Tai

Vaibhav Kulkarni

Jayant Jian

Some embodiments provide a method for a first data compute node (DCN) operating in a public datacenter. The method receives an encryption rule from a centralized network controller. The method determines that the network encryption rule requires encryption of packets between second and third DCNs operating in the public datacenter. The method requests a first key from a secure key storage. Upon receipt of the first key, the method uses the first key and additional parameters to generate second and third keys. The method distributes the second key to the second DCN and the third key to the third DCN in the public datacenter.

Extension of network control system into public cloud

Some embodiments provide a centralized overlay-network cloud gateway and a set of centralized services in a transit virtual cloud network (VCN) connected to multiple other compute VCNs hosting compute nodes (VMs, containers, etc.) that are part of (belong to) the overlay network. The centralized overlay-network cloud gateway provides connectivity between compute nodes of the overlay network (e.g., a logical network spanning multiple VCNs) and compute nodes in external networks. Some embodiments use the centralized overlay-network cloud gateway to provide transitive routing (e.g., routing through a transit VCN) in the absence of direct peering between source and destination VCNs. The overlay network, of some embodiments, uses the same subnetting and default gateway address for each compute node as the cloud provider network provided by the virtual private cloud provider.

Transitive routing in public cloud

Centralized processing of north-south traffic for logical network in public cloud

Some embodiments provide a method for a managed forwarding element (MFE) executing on a data compute node (DCN) that operates on a host computer in a public datacenter. The MFE implements a logical network that connects multiple DCNs within the public datacenter. The method receives a packet, directed to the DCN, that (i) has a first logical network source address and (ii) is encapsulated with a second source address associated with an underlying public datacenter network. The method determines whether the first logical network source address is a valid source address for the packet based on a mapping table that maps logical network addresses to underlying public datacenter network addresses. When the first source address is not a valid source address for the packet, the method drops the packet.

Managed forwarding element detecting invalid packet addresses

Some embodiments of the invention provide a novel method for interfacing between a first tuple-based controller and a second controller using a message-based protocol. The method of some embodiments identifies a set of changed tuples stored in a set of output tables, generates a set of messages based on the changed tuples, and sends the generated set of messages to a second controller. In some embodiments, the first and second controllers are parts of a network control system that manages forwarding elements to implement a logical network.

Implementing an interface between tuple and message-driven control entities

Some embodiments provide a centralized overlay-network cloud gateway and a set of centralized services in a transit virtual private cloud (VPC) connected to multiple other compute VPCs hosting compute nodes (VMs, containers, etc.) that are part of (belong to) the overlay network. The centralized overlay-network cloud gateway provides connectivity between compute nodes of the overlay network (e.g., a logical network spanning multiple VPCs) and compute nodes in external networks. Some embodiments use the centralized overlay-network cloud gateway to provide transitive routing (e.g., routing through a transit VPC) in the absence of direct peering between source and destination VPCs. The overlay network, of some embodiments, uses the same subnetting and default gateway address for each compute node as the cloud provider network provided by the virtual private cloud provider.

Centralized overlay gateway in public cloud

Example methods and computer systems are provided for east-west service insertion in a public cloud environment. An example method may comprise detecting an egress packet that is destined for a second endpoint located in the same virtual network as a first endpoint. The method may also comprise: in response to determination that service insertion is required, identifying a service path based on a service insertion rule; generating an encapsulated packet by encapsulating the egress packet with an outer header that is addressed from the first endpoint to a network device; and sending the encapsulated packet to cause the network device to send the egress packet towards the service path, thereby steering the egress packet towards the service path for processing.

Mothod, non-transitory computer-readable storage medium, and computer system for endpoint to perform east-west service insertion in public cloud environments

The present disclosure generally relates to deploying a proxy control plane and/or north-south data plane in a control virtual private cloud of a logical network implemented on a software-defined datacenter. The control virtual private cloud is shared by a plurality of compute virtual private clouds of the network. In some embodiments, a proxy control plane is deployed on the control virtual private cloud and disseminates policies directly to endpoints of the logical network. In some embodiments, a north-south data plane is deployed on the control virtual private cloud and directly manages north-south network traffic from endpoints of the logical network. In some embodiments, a proxy control plane and a north-south network data plane are deployed on the control virtual private cloud.

Providing networking and security to workloads via a control virtual private cloud shared across multiple virtual private clouds

Some embodiments provide a method for a network controller. The method configures a first data compute node (DCN), operating within a public first datacenter that includes forwarding elements to which the network controller does not have access, to operate as a gateway forwarding element between (i) other DCNs in the first datacenter on which forwarding elements are configured by the network controller and (ii) forwarding elements in a second datacenter. The method configures the forwarding elements executing on the other DCNs in the public datacenter to implement a logical switch to which the other DCNs attach. The method configures the forwarding elements in the second datacenter to implement the logical switch. DCNs in the second datacenter also attach to the same logical switch.

Logical network domains stretched between public and private datacenters

Some embodiments provide a method for a public cloud manager that interacts with a management system of a public datacenter. The method receives a notification from a network controller that a second data compute node is compromised. The second data compute node operates on a host machine in the public datacenter and executes a forwarding element managed by network controller. The method interacts with application programming interfaces (APIs) of the public datacenter to quarantine the data compute node.

Identifying and handling threats to data compute nodes in public cloud

A method of diagnosing a software-defined network is provided. The method determines an observed plurality of network control events from a set of network control event messages. Each network control event message includes a unique identifier and is used for configuring a network configuration entity on a network component. The method, from a description of an expected configuration of the network, determines an expected plurality of network control events. The method backtraces the observed control events from the current configuration of the network to determine whether the expected network control events have occurred. The method identifies a network component as the source of fault when the network component receives an input set of network control events that matches a set of expected network events but does not produce a set of output network control events that match a set of network control events.

Programmatically diagnosing a software defined network

Some embodiments provide a method and system for configuring a plurality of managed forwarding elements (MFEs) in a plurality of cloud-provider virtual networks (CPVNs) to make routing decisions that efficiently use a peered transit CPVN and peering with other CPVNs in the plurality of CPVNs. In some embodiments, a controller set receives an identification of peering relationships between CPVNs in the plurality of CPVNs and generates configuration data for configuring each MFE. The configuration data is used to configure the MFE to forward data messages received at the MFE using a peering between a source CPVN and a destination CPVN when possible and to forward data messages received at the MFE to a transit gateway device in a transit CPVN when it is not possible to use a peering between the source and destination CPVNs.

Intelligent use of peering in public cloud

Some embodiments provide a method for a network controller that manages a logical network implemented in a datacenter comprising forwarding elements to which the network controller does not have access. The method identifies a data compute node (DCN), that operates on a host machine in the datacenter, to attach to the logical network. The DCN has a network interface with a first network address provided by a management system of the datacenter, and executes (i) a workload application and (ii) a managed forwarding element (MFE). The method distributes configuration data for configuring the MFE to receive data packets sent from the workload application on the DCN and perform network security and forwarding processing on the data packets. The data packets sent by the workload application have a second network address as a source address when received by the MFE and are encapsulated by the MFE using the first network address.

Managed forwarding element executing in public cloud data compute node with different internal and external network addresses

Some embodiments provide a method for a network controller that manages a logical network implemented in a datacenter having forwarding elements to which the network controller does not have access. The method identifies a data compute node (DCN) operating on a host machine in the datacenter, to attach to the logical network. The DCN has a network interface with an address provided by a datacenter management system. A workload application executes in a first namespace of the DCN. The method distributes configuration data for configuring a managed forwarding element (MFE) executing in a second namespace of the DCN to receive data packets sent from the application via an interface pairing between the first and second namespaces. The data packets sent by the application have the provided address as a source address when received by the MFE and are encapsulated by the MFE using the provided address as a source address.

Growing community of inventors

Sunnyvale, CA, United States of America

Su Wang