Nicira, Inc.

Vmware, Inc.

Wmware, Inc.

Vmare, Inc.

Uday Suresh Masurekar

Kaushal Bansal

Serge Maskalik

Abhishek Goliya

Aravind Srinivasan

Shadab Shah

Minjal Agarwal

Amit Chopra

Jayant Jain

Weiqing Wu

Anirban Sengupta

Sachin Thakkar

Todd Sabin

Abhinav Vijay Bhagwat

Ronghua Zhang

Mani Kancherla

Srinivas Nimmagadda

Kausum Kumar

Jingmin Zhou

Narendra Kumar Basur Shankarappa

Hemanth Kumar Pannem

Qin Li

James Joseph Stabile

Ayyappan Veeraiyan

Sandesh Sawant

Shailesh Urhekar

Steven Peters

Anand Pritam

Vinayak Shashikant Naik

Craig Farley Newell

Debashis Basak

Subrahmanyam Manuguri

Adam Stephen Rykowski

Igor Ganichev

Liang Cui

Sunitha Krishna

Ravishankar Chamarajnagar

Sagar Date

Sulay Shah

Leung Tao Kwok

Siddharth Ekbote

Hailing Xu

Jian Lan

Laxminarayana Tumuluru

Amol Kanitkar

Leon Cui

Jerry Pereira

Yan Qi

Sridhar Kommireddy

Sergii Stepanenko

Gabe Rosas

Bob Sheehan

Abhijeet Deshpande

Utkarsh Singh

Aniket Deole

Prachi Dalvi

Shuting Ma

Techniques are disclosed for securing traffic flowing across multi-tenant virtualized infrastructures using group key-based encryption. In one embodiment, an encryption module of a virtual machine (VM) host intercepts layer 2 (L2) frames sent via a virtual NIC (vNIC). The encryption module determines whether the vNIC is connected to a 'secure wire,' and invokes an API exposed by a key management module to encrypt the frames using a group key associated with the secure wire, if any. Encryption may be performed for all frames from the vNIC, or according to a policy. In one embodiment, the encryption module may be located at a layer farthest from the vNIC, and encryption may be transparent to both the VM and a virtual switch. Unauthorized network entities which lack the group key cannot decipher the data of encrypted frames, even if they gain access to such frames.

Infrastructure level LAN security

Some embodiments of the invention provide a novel method for specifying firewall rules. In some embodiments, the method provides the ability to specify for a particular firewall rule, a set of network nodes (also called a set of enforcement points below) at which the particular firewall should be enforced. To provide this ability, the method of some embodiments adds an extra tuple (referred to below as the AppliedTo tuple) to a firewall rule. This added AppliedTo tuple lists the set of enforcement points at which the firewall rule has to be applied (i.e., enforced).

Method and apparatus for distributing firewall rules

Described herein are systems, methods, and software to manage the encapsulation of layer two communications across computing sites. In one example, a gateway at a first computing site may receive an encapsulated packet from a second gateway at a second computing site. After receiving the encapsulated packet, the gateway decapsulates the encapsulated packet and determines that the decapsulated packet satisfies MSS criteria. The gateway further, in response to determining that the decapsulated packet satisfies the MSS criteria, modifies an MSS option associated with the decapsulated packet to a maximum value and forwards the decapsulated packet to a destination virtual node in the first computing site.

Managing layer two network extension communications using maximum segment size (MSS) modifications

An example method of propagating fault domain topology information in a distributed container orchestration system includes: receiving, at control plane software executing in a data center, the fault domain topology, which includes tags for a protection group and fault domains for remote sites in communication with the data center; deploying, by a master server of the distributed container orchestration system that executes in the data center, a node pool comprising virtual machines (VMs) executing in servers of the remote sites, the VMs being nodes of the distributed container orchestration system in which containers execute; determining, by a controller of the master server, relationships among the VMs, the servers, the protection group, and the fault domains based on state of resources maintained by the master server; and providing, by the controller, labels to the servers for associating the tags of the protection group and the fault domains to the VMs.

Propagating fault domain topology to nodes in a distributed container orchestration system

Some embodiments provide a method for providing dynamic host configuration protocol (DHCP) services to different data compute nodes (e.g., virtual machines) that belong to different logical networks (e.g., for different tenants in a datacenter). In some embodiments, the method inserts a logical network identifier (LNI) value to each DHCP packet and forwards the packet to a DHCP server module for processing the DHCP request. Based on the LNI value, the DHCP server of some embodiments identifies the logical network from which the DHCP packet is received. The DHCP server then provides the requested DHCP service (e.g., assigning an IP address to a data compute node that has originated the DHCP packet, assigning a domain name, etc.) according to a DHCP service configuration for the identified logical network.

Implementing logical DHCP servers in logical networks

A method for visualizing network flows of a network is provided. The method monitors network flows between a group of machines in a network. The method associates identifiers with the monitored network flows. The method aggregates the monitored network flows into a set of groups based on the associated identifiers. The method displays a set of flow records for the each group of the set of groups.

Application assessment and visibility for micro-segmentation of a network deployment

A method of deploying a network service across a plurality of data centers, includes the steps of: in response to a request for or relating to a network service, identifying virtual network functions associated with the network service and determining network connectivity requirements of the virtual network functions, issuing commands to provision a virtual link between at least two of the data centers in which the virtual network functions are to be deployed.

Multi-site hybrid networks across cloud environments

System and method for performing diagnostics in a multi-cloud system triggers a diagnostic workflow in a first cloud computing environment of the multi-cloud system in response to an event in the multi-cloud system and execute the diagnostic workflow in the first cloud computing environment by identifying components in the multi-cloud system that are affected by the event and obtaining probes for the identified components. For each component of the identified components, a sub-flow of the diagnostic workflow is started to run at least one probe of the obtained probes to generate a diagnostic result of the component. A diagnostic report is generated based on the diagnostic result of each component of the identified components.

Method and system for distributed multi-cloud diagnostics

A method of deploying a network service across a plurality of data centers, includes the steps of: in response to a request for or relating to a network service, identifying virtual network functions associated with the network service and determining network connectivity requirements of the virtual network functions, issuing commands to provision a first virtual link between at least two of the data centers in which the virtual network functions are to be deployed, and issuing commands to provision a second virtual link to one of the data centers in which the virtual network functions are to be deployed.

Some embodiments provide a method for implementing a logical router in a logical network. In some embodiments, the method receives a configuration of a static route for the logical router, which includes several routing components with separate routing tables. The method identifies which of the routing components require addition of a route to a corresponding routing table to implement the configuration of the static route. The method adds the routes to the corresponding separate routing tables of the identified routing components.

Static route configuration for logical router

Some embodiments provide a method or tool for automatically configuring a logical router on one or more edge nodes of an edge cluster (e.g., in a hosting system such as a datacenter). The method of some embodiments configures the logical router on the edge nodes based on a configuration policy that dictates the selection method of the edge nodes. In some embodiments, an edge cluster includes several edge nodes (e.g., gateway machines), through which one or more logical networks connect to external networks (e.g., external logical and/or physical networks). In some embodiments, the configured logical router connects a logical network to an external network through the edge nodes.

Automatic configuration of logical routers on edge nodes

A method of configuring networking, security, and operational parameters of workloads deployed in a virtualized computing environment includes the steps of: storing multiple policies, each defining one of networking, security, or operational parameters, and associating tags to each of the multiple policies, independent of deployment of a virtual computing instance in the virtual computing environment; responsive to a request to perform configuration of a virtual computing instance being deployed, retrieving policies among the stored multiple policies that are associated with same tags as tags contained in the request; generating configuration parameters for data path components in a host machine of the virtual computing instance and for data path components of the virtual computing instance based on the retrieved policies; and transmitting the generated configuration parameters to the host machine for the host machine to configure the networking, security, or operational parameters the virtual computing instance therewith.

Native tag-based configuration for workloads in a virtual computing environment

Systems, methods, and software to enhance the management of software defined networks. A controller is configured to maintain a data plane configuration for a virtual machine environment based on forwarding rules. The controller is further configured to identify a virtual machine group to be deployed in the computing environment, and identify tags associated with each virtual machine in the virtual machine group. Once the tags are identified, the controller may update the data plane forwarding configuration based on the identified tags and the forwarding rules.

Tag based firewall implementation in software defined networks

Some embodiments provide a method for configuring a set of logical routers in a logical network. The method receives a configuration of an advertised route for a first logical router and a set of allowable routes for a second logical router to which the first logical router connects. The method determines whether the set of allowable routes for the second logical router includes the advertised route as an allowed route from the first logical router. Only when the advertised route is an allowed route from the first logical router, the method adds the advertised route to a routing table for at least one component of the second logical router.

Authorization for advertised routes among logical routers

Growing community of inventors

Palo Alto, CA, United States of America

Uday Suresh Masurekar