PROCESSING DATA MESSAGES OF A VIRTUAL NETWORK THAT ARE SENT TO AND RECEIVED FROM EXTERNAL SERVICE MACHINES

• US 20190104064A1
• Filed: 05/04/2018
• Published: 04/04/2019
• Est. Priority Date: 10/02/2017
• Status: Active Grant

• Current Assignee: Vmware LLC (Broadcom, Inc.)
• Original Assignee: Nicira Incorporated (Broadcom, Inc.)
• Inventors: Cidon, Israel, Dar, Chen, Venugopal, Prashanth, Zohar, Eyal, Bergman, Aran, Markuze, Alex
• Granted Patent: US 10,778,466 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 12/14 Charging , metering or billing arrangements for data wireline or wireless communications
• CPC Class Codes: H04L 12/1403 Architecture for metering, charging or billing
• CPC Class Codes: H04L 12/1428 Invoice generation, e.g. customization, lay-out, database processing, algorithms for calculating the bill or formatting invoices as WWW pages invoicing in general G06Q30/04
• CPC Class Codes: H04L 12/2854 Wide area networks, e.g. public data networks
• CPC Class Codes: H04L 12/2859 Point-to-point connection between the data network and the subscribers encapsulation H04L12/4633; virtual LANs H04L12/4641; routing of packets H04L45/00
• CPC Class Codes: H04L 12/4633 Interconnection of networks using encapsulation techniques, e.g. tunneling
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 2101/35 containing special prefixes
• CPC Class Codes: H04L 2212/00 Encapsulation of packets
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 41/0803 Configuration setting
• CPC Class Codes: H04L 41/0895 Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements
• CPC Class Codes: H04L 41/40 using virtualisation of network functions or resources, e.g. SDN or NFV entities
• CPC Class Codes: H04L 43/08 Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
• CPC Class Codes: H04L 43/0829 Packet loss
• CPC Class Codes: H04L 43/0852 Delays
• CPC Class Codes: H04L 43/0888 Throughput
• CPC Class Codes: H04L 45/04 Interdomain routing, e.g. hierarchical routing
• CPC Class Codes: H04L 45/12 Shortest path evaluation
• CPC Class Codes: H04L 45/14 Routing performance; Theoretical aspects
• CPC Class Codes: H04L 45/64 : using an overlay routing layer
• CPC Class Codes: H04L 45/74 : Address processing for routing
• CPC Class Codes: H04L 45/745 : Address table lookup; Address filtering
• CPC Class Codes: H04L 61/25 : of the same type
• CPC Class Codes: H04L 61/2514 : between local and global IP addresses
• CPC Class Codes: H04L 61/255 : Maintenance or indexing of mapping tables
• CPC Class Codes: H04L 61/4511 : using domain name system [DNS]
• CPC Class Codes: H04L 63/0245 : Filtering by information in the payload
• CPC Class Codes: H04L 63/0263 : Rule management
• CPC Class Codes: H04L 63/0272 : Virtual private networks
• CPC Class Codes: H04L 63/0281 : Proxies
• CPC Class Codes: H04L 63/20 : for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/10 : in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04M 15/00 : Arrangements for metering, time-control or time indication ; Metering, charging or billing arrangements for voice wireline or wireless communications, e.g. VoIP
• CPC Class Codes: H04M 15/51 : for resellers, retailers or service providers

Abstract

Some embodiments establish for an entity a virtual network over several public clouds of several public cloud providers and/or in several regions. In some embodiments, the virtual network is an overlay network that spans across several public clouds to interconnect one or more private networks (e.g., networks within branches, divisions, departments of the entity or their associated datacenters), mobile users, and SaaS (Software as a Service) provider machines, and other web applications of the entity. The virtual network in some embodiments can be configured to optimize the routing of the entity'"'"'s data messages to their destinations for best end-to-end performance, reliability and security, while trying to minimize the routing of this traffic through the Internet. Also, the virtual network in some embodiments can be configured to optimize the layer 4 processing of the data message flows passing through the network.

Claims

1. For a multi-tenant virtual network system, a method of processing a data message that is associated with a virtual network that is defined for a particular tenant over a set of public cloud datacenters, the method comprising:

at an ingress gateway through which the data message enters the virtual gateway,

determining that the data message is associated with an external service machine outside of the virtual network and the plurality of public cloud datacenters; and

performing a first source network address translation (SNAT) operation to modify a first source network address associated with the data message to a modified second source network address; and

at an egress gateway from which the data message exits the virtual network,

performing a second SNAT operation to modify the modified second source network address of the data message to a modified third source network address; and

forwarding the data message, with the third modified source network address to the external service machine through an external network that is outside of the public cloud datacenters.

2. The method of claim 1, wherein both the first and second SNAT operations are stateful processes each of which creates a record associated with a flow identifier of the data message to use to process subsequent data messages that are part of the data message'"'"'s flow.

3. The method of claim 1, wherein

the first source network address is a network address in a private network address space of an entity that is not one of the public cloud providers, and

the second and third source network addresses are network address in a public network address space.

4. The method of claim 1, wherein

the first source network address is a network address in a private network address space of an entity that is not one of the public cloud providers,

the second source network address is a network address in a private network address space of a public cloud provider, and

the third source network address is a network address in a public network address space.

5. The method of claim 1, wherein the ingress and egress gateways are forwarding elements that are deployed and configured in the set of public cloud datacenters to implement the virtual network over the public cloud datacenters.

6. The method of claim 1 further comprising:

before the first SNAT operation, performing a third SNAT operation to modify an original source network address of the data message to the first source network address.

7. The method of claim 1, wherein the third SNAT is based on a tenant identifier (TID) that identifies the particular tenant in the multi-tenant virtual network control system.

8. The method of claim 7 further comprising performing the first, second and third SNAT operations for data messages of different tenants, wherein

the third SNAT operation for the data messages of each tenant is based on the TID that the virtual network system associates with each tenant, and

the third SNAT operations map the data messages of different tenants to different source network address spaces to ensure that even when a common network address space is used for two tenants, the modified second source network addresses of the different tenants do not overlap.

9. The method of claim 7, wherein the first and second and third network addresses each comprises a layer 3 network address.

10. The method of claim 7, wherein

the first, second and third network addresses each comprises a layer 3 network address and a layer 4 network address, and

at least one of the first, second and third SNAT operations modifies both the layers 3 and 4 network addresses.

11. The method of claim 1, wherein each of the first, second and third SNAT operations modifies both the layers 3 and 4 network addresses.

12. The method of claim 1, wherein determining that the data message is associated with an external service machine comprises:

extracting a destination network address from a header of the data message;

using the extracted destination network address to determine that the data message'"'"'s destination address is associated with an interface connected to a machine outside of the public cloud datacenters.

13. The method of claim 12, wherein

the external network is the Internet, and

using the extracted destination network address comprises performing a lookup operation in the public Internet context based on the extracted destination network address.

14. The method of claim 1, wherein the external service machine is a machine of a SaaS (software as a service) provider, while a source of the data message is one of a machine in an office of the particular tenant, a machine in a private datacenter of the particular tenant, or a remote user machine of the particular tenant.

15. The method of claim 14, wherein the service machine is in a private datacenter of the SaaS provider.

16. The method of claim 1 further comprising creating at least one record for the first and second SNAT operations in order to use the record to perform at least one destination network address translation operation for a data message received from the external service machine.

17. The method of claim 1, wherein the set of public cloud datacenters comprise a plurality of multi-tenant public cloud datacenters.