Vmware, Inc.

Nicira, Inc.

Yang Ping

Raju Koganty

Pierluigi Rolando

Anuprem Chalvadi

Jayant Jain

Yong Feng

Fenil Kavathia

Li Sun

Akhila Naveen

Jianjun Shen

Rahul Mishra

Kantesh Mundaragi

Yanjun Lin

Aayush Saxena

Dexiang Wang

Chen Li

Amit Chopra

Feng Pan

Rajeev Nair

Bin Qian

Camille Lecuyer

Saahil Gokhale

Aravinda Kidambi Srinivasan

Deepika Rajendra Kalani

Pankaj Thakkar

Igor Ganichev

Wei Guo

Da Wan

Medhavi Dhawan

Ziyou Wang

Parasuramji Rajendran

Yuanjun Yao

Mihir Patil

Xiaozheng Guo

Mary Firenze

Some embodiments provide novel methods for performing services for machines operating in one or more datacenters. For instance, for a group of related guest machines (e.g., a group of tenant machines), some embodiments define two different forwarding planes: (I) a guest forwarding plane and (2) a service forwarding plane. The guest forwarding plane connects to the machines in the group and performs L2 and/or L3 forwarding for these machines. The service forwarding plane (1) connects to the service nodes that perform services on data messages sent to and from these machines, and (2) forwards these data messages to the service nodes. In some embodiments, the guest machines do not connect directly with the service forwarding plane.

Providing services with guest VM mobility

Some embodiments provide a novel secure method for suppressing address discovery messaging. In some embodiments, the method receives an address discovery record that provides a network address associated with a machine connected to a network. The method then identifies a set of one or more rules for evaluating the received address discovery record to determine whether the address discovery record or its provided network address should be distributed to one or more hosts and/or devices associated with the network. The method then processes the set of rules to determine whether the received address discovery record violates a rule in the set of rules so as to prevent the distribution of its provided network address. When the address discovery record violates a rule, the method discards it in some embodiments. On the other hand, when the address discovery record does not violate any rule in the identified set of rules, the method distributes the address discovery record or its provided network address to one or more hosts and/or devices associated with the network.

Secured suppression of address discovery messages

A method of recording layer-2 (L2) mappings created for workloads executing on a plurality of hosts in a first database managed by a network management server: upon receipt of a first mapping reported by a first host, determining that the first mapping is not recorded in the first database; and in response to the determining that the received first mapping is not recorded in the first database, generating a first timestamp and persisting a first record in the first database that includes the first mapping and the first timestamp.

Resolving L2 mapping conflicts without reporter synchronization

Certain embodiments described herein are generally directed to handling a hypervisor restart event in a distributed network system. Embodiments include receiving, by a central controller, a session identifier from a first hypervisor. Embodiments further include comparing, by the central controller, the session identifier to a stored session identifier associated with the first hypervisor. Embodiments further include determining, by the central controller based on the session identifier not matching the stored session identifier associated with the first hypervisor, that the first hypervisor has restarted. Embodiments further include updating, by the central controller, the stored session identifier associated with the first hypervisor to match the session identifier. Embodiments further include identifying, by the central controller, a second hypervisor that is associated with the first hypervisor. Embodiments further include sending, by the central controller, a notification to the second hypervisor that the first hypervisor has restarted.

Hypervisor restart handling mechanism using random session numbers

Example methods and systems for software bug reproduction. One example method may comprise obtaining log information associated with multiple transactions processed by a control-plane node to configure a set of data-plane nodes and transform an initial network state to a first network state; and configuring a replay environment that is initialized to the initial network state, and includes a mock control-plane node and a set of mock data-plane nodes. The method may also comprise, based on the log information, replaying the multiple transactions using the mock control-plane node to configure the set of mock data-plane nodes and transform the replay environment from the initial network state to a second network state. Based on a comparison between the first network state and the second network state, a determination may be made as to whether a software bug is successfully reproduced in the replay environment.

Software bug reproduction

Some embodiments provide novel methods for performing services for machines operating in one or more datacenters. For instance, for a group of related guest machines (e.g., a group of tenant machines), some embodiments define two different forwarding planes: (1) a guest forwarding plane and (2) a service forwarding plane. The guest forwarding plane connects to the machines in the group and performs L2 and/or L3 forwarding for these machines. The service forwarding plane (1) connects to the service nodes that perform services on data messages sent to and from these machines, and (2) forwards these data messages to the service nodes. In some embodiments, the guest machines do not connect directly with the service forwarding plane. For instance, in some embodiments, each forwarding plane connects to a machine or service node through a port that receives data messages from, or supplies data messages to, the machine or service node. In such embodiments, the service forwarding plane does not have a port that directly receives data messages from, or supplies data messages to, any guest machine. Instead, in some such embodiments, data associated with a guest machine is routed to a port proxy module executing on the same host computer, and this other module has a service plane port. This port proxy module in some embodiments indirectly can connect more than one guest machine on the same host to the service plane (i.e., can serve as the port proxy module for more than one guest machine on the same host).

Configuring distributed forwarding for performing service chain operations

Creating and distributing service chain descriptions

Specifying service chains

Some embodiments of the invention provide a method for migrating a machine on a first host computer to a second host computer. At the first host computer, the method gathers a set of service insertion data used by a first service insertion module executing on the first host computer to identify a particular chain of multiple services that a set of multiple service nodes have to perform on a particular data message flow associated with the machine. To the second host computer, the method sends a set of machine configuration data and the set of service insertion data. The second host computer (1) uses the machine configuration data to deploy the machine on the second host computer and (2) uses the gathered set of service insertion data to configure a second service insertion module executing on the second host computer to identify the particular chain of two or more services.

Some embodiments provide a method for migrating a service machine between two hosts. The method configures a first host (1) to gather service machine data associated with the service machine executing on the first host and (2) to send the gathered service machine data to the second host. Each host executes a software forwarding element to implement a distributed forwarding element (DFE) that implements a dedicated service forwarding plane that forwards data messages associated with guest machines to the services machines. The method configures the second host to use the received service machine data to deploy the service machine on the second host and to connect the deployed service machine to the DFE. The method configures the DFE to forward data messages associated with a guest machine executing on a third host, and addressed to the service machine to the second host instead of the first host.

Providing services with service VM mobility

The disclosure provides an approach for computing service paths for a service chain identifying a sequence of services. One method includes including information about a plurality of hosts in a heap. Each of the plurality of hosts includes at least one service virtual computing instance (SVCI) configured to provide at least one of the services of the service chain. The information includes, for each of the plurality of hosts, a number of service paths computed for the service chain at the host and one of a number of services provided by unused SVCIs of the host or a number of consecutive services provided by unused SVCIs of the host. The method further includes selecting a host from the heap based on the information. The method further includes generating a first service path for the service chain, the first service path identifying at least one SVCI of the selected host.

Service path computation for service insertion

Specifying and distributing service chains

Some embodiments provide a method for assigning different service path identifiers to each of a set of different service paths along each of which a same set of service operations are performed on a set of packets. The method retrieves an available service path identifier from an identifier storage that stores service path identifiers for multiple service paths. The method generates a set of proposed service path identifiers based on the retrieved available service path identifier and the number of service paths in the set of service paths. The method performs a write operation on the identifier storage based on the set of proposed service path identifiers, and based on a determination that the write operation was successful, assigns the set of proposed service path identifiers to the set of service paths. Based on the set of service path identifiers, the method forwards the set of packets along the set of service paths.

Service path identifier allocation in service insertion

Certain embodiments described herein are generally directed to determining the spans of logical entities in a logical network using a graph theoretic method. For example, in some embodiments, a configuration of the logical network is represented as a directed graph with labeled edges. The span of any logical entity in the logical network may then be computed based on the directed graph of the logical network. For example, for a given entity represented by a given node, the set of nodes that can be reached from the given node via span-depends-on edges only may be computed and referred to as the span base of the given node. Further, the set of all managed forwarding elements reachable from each node of the span base of the given node via contains edges only is the span for the given entity.

Logical network configuration span

Growing community of inventors

San Jose, CA, United States of America

Yang Ping