DYNAMICALLY SPECIFYING MULTIPLE PUBLIC CLOUD EDGE NODES TO CONNECT TO AN EXTERNAL MULTI-COMPUTER NODE

• US 20190104413A1
• Filed: 11/15/2018
• Published: 04/04/2019
• Est. Priority Date: 10/02/2017
• Status: Active Grant

• Current Assignee: Vmware LLC (Broadcom, Inc.)
• Original Assignee: Nicira Incorporated (Broadcom, Inc.)
• Inventors: Cidon, Israel, Venugopal, Prashanth, Bergman, Aran, Dar, Chen, Markuze, Alex, Zohar, Eyal
• Granted Patent: US 10,959,098 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 12/4625 Single bridge functionality, e.g. connection of two networks over a single bridge
• CPC Class Codes: H04L 12/4633 Interconnection of networks using encapsulation techniques, e.g. tunneling
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 12/4679 Arrangements for the registration or de-registration of VLAN attribute values, e.g. VLAN identifiers, port VLAN membership
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 43/0811 by checking connectivity
• CPC Class Codes: H04L 43/0835 One way packet loss
• CPC Class Codes: H04L 43/0852 Delays
• CPC Class Codes: H04L 45/123 Evaluation of link metrics techniques for monitoring network metrics H04L43/08
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/08 Access security

Abstract

Some embodiments establish for an entity a virtual network over several public clouds of several public cloud providers and/or in several regions. In some embodiments, the virtual network is an overlay network that spans across several public clouds to interconnect one or more private networks (e.g., networks within branches, divisions, departments of the entity or their associated datacenters), mobile users, and SaaS (Software as a Service) provider machines, and other web applications of the entity. The virtual network in some embodiments can be configured to optimize the routing of the entity'"'"'s data messages to their destinations for best end-to-end performance, reliability and security, while trying to minimize the routing of this traffic through the Internet. Also, the virtual network in some embodiments can be configured to optimize the layer 4 processing of the data message flows passing through the network.

Claims

1. A method for connecting a multi-computer node (MCN) for an entity to a virtual network defined over a set of one or more one public cloud datacenters, the method comprising:

providing, to the multi-computer node (MCN), identifiers identifying a plurality of managed forwarding nodes (MFNs) in the set of public cloud datacenters for the MCN to generate a measurement for each MFN that quantifies an attribute of a connection between the MCN and the MFN;

receiving, from the MCN, measurements for the identified MFNs;

based on the received measurements, selecting a subset of the MFNs for the MCN to use to connect to the virtual network, the subset of MFNs not including all of the plurality of MFNs; and

providing the subset of at least two MFNs to the MCN to use to connect to the virtual network.

2. The method of claim 1, wherein providing the subset of at least two MFNs comprises providing a plurality of routes to the MCN, each route associated with an MFN in the subset of MFNs for entering the virtual network and a different egress MFN for exiting the virtual network.

3. The method of claim 2, wherein selecting the subset of MFNs comprises:

generating a routing graph for identifying routes from the MCN through the virtual network to other compute nodes associated with the entity that are connected to the virtual network;

using the received measurements to compute weights of links in the routing graph; and

using the routing graph and the computed weights to perform route-identifying process to identify the plurality of routes.

4. The method of claim 3, wherein each route identifies a next hop for traversing a routing path from the MCN or a routing path to the MCN, and at least two routes provided to the MCN identify a different MFN in the subset of MFNs as a next hop of a routing path from the MCN.

5. The method of claim 1, wherein the MCN generates a plurality of measurements regarding a plurality of attributes associated with the connection between the MCN and each identified MFN, the method further comprising computing a weight value for the connection between the MCN and each identified MFN based on the plurality of measurements.

6. The method of claim 5, wherein the plurality of measurements comprises message loss rate and message delay for the connection between the MCN and each identified MFN.

7. The method of claim 6, wherein the plurality of measurements further comprises financial cost associated with the connection between the MCN and each identified MFN.

8. The method of claim 1, wherein the subset of MFNs comprises a primary MFN to which the MCN has to connect and a standby MFN to which the MCN has to connect.

9. The method of claim 1, wherein

the MCN has a measurement agent and each identified MFN has a measurement agent,

the MCN measurement agent exchanges messages with each identified MFN'"'"'s measurement agent to generate a measurement for the MFN.

10. The method of claim 1, wherein at least two identified MFNs share one measurement agent as both MFNs are associated with the same public cloud.

11. A non-transitory machine readable medium storing a program for connecting a multi-computer node (MCN) for an entity to a virtual network defined over a set of one or more one public cloud datacenters, the program comprising sets of instructions for:

providing, to the multi-computer node (MCN), identifiers identifying a plurality of managed forwarding nodes (MFNs) in the set of public cloud datacenters for the MCN to generate a measurement for each MFN that quantifies an attribute of a connection between the MCN and the MFN;

receiving, from the MCN, measurements for the identified MFNs;

based on the received measurements, selecting a subset of the MFNs for the MCN to use to connect to the virtual network, the subset of MFNs not including all of the plurality of MFNs; and

providing the subset of at least two MFNs to the MCN to use to connect to the virtual network.

12. The non-transitory machine readable medium of claim 11, wherein the set of instructions for providing the subset of at least two MFNs comprises a set of instructions for providing a plurality of routes to the MCN, each route associated with an MFN in the subset of MFNs for entering the virtual network and a different egress MFN for exiting the virtual network.

13. The non-transitory machine readable medium of claim 12, wherein the set of instructions for selecting the subset of MFNs comprises sets of instructions for:

generating a routing graph for identifying routes from the MCN through the virtual network to other compute nodes associated with the entity that are connected to the virtual network;

using the received measurements to compute weights of links in the routing graph; and

using the routing graph and the computed weights to perform route-identifying process to identify the plurality of routes.

14. The non-transitory machine readable medium of claim 13, wherein each route identifies a next hop for traversing a routing path from the MCN or a routing path to the MCN, and at least two routes provided to the MCN identify a different MFN in the subset of MFNs as a next hop of a routing path from the MCN.

15. The non-transitory machine readable medium of claim 11, wherein the MCN generates a plurality of measurements regarding a plurality of attributes associated with the connection between the MCN and each identified MFN, the method further comprising computing a weight value for the connection between the MCN and each identified MFN based on the plurality of measurements.

16. The non-transitory machine readable medium of claim 15, wherein the plurality of measurements comprises message loss rate and message delay for the connection between the MCN and each identified MFN.

17. The non-transitory machine readable medium of claim 16, wherein the plurality of measurements further comprises financial cost associated with the connection between the MCN and each identified MFN.

18. The non-transitory machine readable medium of claim 11, wherein the subset of MFNs comprises a primary MFN to which the MCN has to connect and a standby MFN to which the MCN has to connect.

19. The non-transitory machine readable medium of claim 11, wherein

the MCN has a measurement agent and each identified MFN has a measurement agent,

the MCN measurement agent exchanges messages with each identified MFN'"'"'s measurement agent to generate a measurement for the MFN.

20. The non-transitory machine readable medium of claim 11, wherein at least two identified MFNs share one measurement agent as both MFNs are associated with the same public cloud.

21. The non-transitory machine readable medium of claim 11, wherein the program further comprises a set of instructions for directing the MCN to establish a secure connection with each MFN in the selected subset of MFNs.