Vmware, Inc.

Nicira, Inc.

Wmware, Inc.

Todd Sabin

Weiqing Wu

Subrahmanyam Manuguri

Serge Maskalik

Anirban Sengupta

Aravind Srinivasan

Sachin Thakkar

Uday Suresh Masurekar

Chidambareswaran Raman

Azeem Feroz

Mitchell T Christensen

Siddharth Ekbote

Debashis Basak

Liang Cui

Jayant Jain

Laxminarayana Tumuluru

Leon Cui

Yong Wang

Jia Yu

Narendra Kumar Basur Shankarappa

Awan Kumar Sharma

Hailing Xu

Manjunath Bandi

Jian Lan

Yan Qi

Sergii Stepanenko

Gabe Rosas

Vemana Murty

Chids Raman

Prachi Dalvi

Shuting Ma

Systems and techniques are described for monitoring network communications using a distributed firewall. One of the techniques includes receiving, at a driver executing in a guest operating system of a virtual machine, a request to open a network connection from a process associated with a user, wherein the driver performs operations comprising: obtaining identity information for the user; providing the identity information and data identifying the network connection to an identity module external to the driver; and receiving, by a distributed firewall, data associating the identity information with the data identifying the network connection from the identity module, wherein the distributed firewall performs operations comprising: receiving an outgoing packet from the virtual machine; determining that the identity information corresponds to the outgoing packet; and evaluating one or more routing rules based at least in part on the identity information.

Distributed identity-based firewalls

Described herein are systems, methods, and software to manage the encapsulation of layer two communications across computing sites. In one example, a gateway at a first computing site may receive an encapsulated packet from a second gateway at a second computing site. After receiving the encapsulated packet, the gateway decapsulates the encapsulated packet and determines that the decapsulated packet satisfies MSS criteria. The gateway further, in response to determining that the decapsulated packet satisfies the MSS criteria, modifies an MSS option associated with the decapsulated packet to a maximum value and forwards the decapsulated packet to a destination virtual node in the first computing site.

Managing layer two network extension communications using maximum segment size (MSS) modifications

An example method of propagating fault domain topology information in a distributed container orchestration system includes: receiving, at control plane software executing in a data center, the fault domain topology, which includes tags for a protection group and fault domains for remote sites in communication with the data center; deploying, by a master server of the distributed container orchestration system that executes in the data center, a node pool comprising virtual machines (VMs) executing in servers of the remote sites, the VMs being nodes of the distributed container orchestration system in which containers execute; determining, by a controller of the master server, relationships among the VMs, the servers, the protection group, and the fault domains based on state of resources maintained by the master server; and providing, by the controller, labels to the servers for associating the tags of the protection group and the fault domains to the VMs.

Propagating fault domain topology to nodes in a distributed container orchestration system

A method for selecting between a plurality of paths for sending an encrypted packet from a source endpoint to a destination endpoint is provided. The method selects a first path of the plurality of paths for sending the encrypted packet from the source endpoint to the destination endpoint, each of the plurality of paths associated with a different one of a plurality of source ports, the encrypted packet being encrypted based on a security association established between the source endpoint and the destination endpoint in accordance with an IPSec protocol. The method further encapsulates, based on the SA having NAT-T enabled, the encrypted packet with a UDP header having a first source port associated with the first path. The method then transmits the encapsulated encrypted packet from the source endpoint to the destination endpoint via the first path.

Path selection for data packets encrypted based on an IPSEC protocol

For a host that executes one or more guest virtual machines (GVMs), some embodiments provide a novel virtualization architecture for utilizing a firewall service virtual machine (SVM) on the host to check the packets sent by and/or received for the GVMs. In some embodiments, the GVMs connect to a software forwarding element (e.g., a software switch) that executes on the host to connect to each other and to other devices operating outside of the host. Instead of connecting the firewall SVM to the host's software forwarding element that connects its GVMs, the virtualization architecture of some embodiments provides an SVM interface (SVMI) through which the firewall SVM can be accessed to check the packets sent by and/or received for the GVMs.

Migrating firewall connection state for a firewall service virtual machine

System and computer-implemented method in a cloud architecture including a mixed network having local objects in a local network and external objects in an external network, wherein the external objects are accessed through proxy communications, uses a proxy inventory to determine whether a connection from a first computing object to a second computing object should be excluded from a proxy. The connection from the first computing object to the second computing object is performed based on the determination.

Method and apparatus for automated determination between proxied and bypassed proxy connections

Techniques leveraging CPU flow affinity to increase throughput of a layer 2 (L2) extension network are disclosed. In one embodiment, an L2 concentrator appliance, which bridges a local area network (LAN) and a wide area network (WAN) in a stretched network, is configured such that multiple Internet Protocol Security (IPsec) tunnels are pinned to respective CPUs or cores, which each process traffic flows for one of the IPsec tunnels. Such parallelism can increase the throughput of the stretched network. Further, an L2 concentrator appliance that receives FOU packets is configured to distribute the received FOU packets across receive queues based a deeper inspection of inner headers of such packets.

High throughput layer 2 extension leveraging CPU flow affinity

The disclosure provides an approach for diagnosing a data plane of a network, wherein the network spans a first data center and a second data center, and wherein the second data center is remote to the first, the method comprising: accessing a secure connection between the first data center and the second data center; modifying, by the first performance controller, firewall settings of the first data center from a first setting to a second setting; opening on the second data center an instance of a performance tool; opening on the first data center a client of the instance of the performance tool; sending data packets over the data plane of the network; receiving the data packets; generating metrics associated with the data packets; and modifying firewall settings of the first data center from the second setting to the first setting.

Method of diagnosing data delivery over a network between data centers

The disclosure provides an approach for preventing the failure of virtual computing instance transfers across data centers. In one embodiment, a flow control module collects performance information primarily from components in a local site, as opposed to components in a remote site, during the transfer of a virtual machine (VM) from the local site to the remote site. The performance information that is collected may include various performance metrics, each of which is considered a feature. The flow control module performs feature preparation by normalizing feature data and imputing missing feature data, if any. The flow control module then inputs the prepared feature data into machine learning model(s) which have been trained to predict whether a VM transfer will succeed or fail, given the input feature data. If the prediction is that the VM transfer will fail, then remediation actions may be taken, such as slowing down the VM transfer.

Machine learning prediction of virtual computing instance transfer performance

A method of transferring data between local and remote computing systems includes the step of transferring data between the local and remote computing systems via a local buffer in the local computing system and a series of steps carried out during transferring of data from the local to the remote computing system. The steps include receiving a statistic from the remote computing system, computing an average transfer rate of the data transfer between the local and remote computing systems based on the statistic, determining whether or not a throttle condition is in effect based on the computed average transfer rate, and upon determining that the throttle condition is in effect, throttling the transferring of data into the local buffer.

Dynamic flow control for transferring data efficiently and effectively over non-linear buffered network paths

Configuring interactions with a service virtual machine

An approach is disclosed for steering network traffic away from congestion hot-spots to achieve better throughput and latency. In one embodiment, multiple Foo-over-UDP (FOU) tunnels, each having a distinct source port, are created between two endpoints. As a result of the distinct source ports, routers that compute hashes of packet fields in order to distribute traffic flows across network paths will compute distinct hash values for the FOU tunnels that may be associated with different paths. Probes are scheduled to measure network metrics, such as latency and liveliness, of each of the FOU tunnels. In turn, the network metrics are used to select particular FOU tunnel(s) to send traffic over so as to avoid congestion and high-latency hotspots in the network.

Steering network flows away from congestion and high latency hotspots

The disclosure provides an approach for managing and diagnosing middleboxes in a cloud computing system. In one embodiment, a network operations center, that is located remote to a virtualized cloud computing system and communicates with the cloud computing system via a wide area network, controls network middleboxes in the cloud computing system through a secure routing module inside a gateway of the cloud computing system. The secure routing module is configured to receive, from an authenticated management application and via a secure communication channel, packets intended for managing network middleboxes. In turn, the secure routing module establishes secure communication channels with the target middleboxes, translates the identified packets to protocols and/or application programming interfaces (APIs) of the target middleboxes, and transmits the translated packets to the target middleboxes.

Growing community of inventors

Morganville, NJ, United States of America

Todd Sabin