Managing communications involving external nodes of provided computer networks

• US 9,491,002 B1
• Filed: 02/24/2014
• Issued: 11/08/2016
• Est. Priority Date: 06/30/2010
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Brandwine, Eric Jason, Dickinson, Andrew B.
• Primary Examiner(s): Kim, Hee Soo
• Application Number:
  US14/188,525
• Time in Patent Office: 988 Days
• Field of Search: 709/222, 709/245
• US Class Current: 1/1
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 45/02 Topology update or discovery
• CPC Class Codes: H04L 45/586 of virtual routers
• CPC Class Codes: H04L 45/64 using an overlay routing layer
• CPC Class Codes: H04L 61/50 Address allocation

Abstract

Techniques are described for managing communications for a managed virtual computer network overlaid on a distinct substrate computer network, including for communications involving computing nodes of the managed virtual computer network connected to the substrate network and/or other external nodes of the managed virtual computer network that are not connected to the substrate network. The managed virtual computer network may have multiple associated virtual network addresses, and the managing of the communications may further include using one or more edge modules to direct all communication that have a destination virtual network address within a range or other group of multiple virtual network addresses assigned to one or more external nodes to be forwarded over the substrate network to an edge module associated with the one or more external nodes, including to route communications between different external nodes via the substrate network.

Claims

1. A computer-implemented method comprising:

receiving, by one or more computing systems, configuration information for a virtual computer network having multiple computing nodes overlaid on a substrate network at a first location;

configuring, by the one or more computing systems, an edge module that interconnects the substrate network and an external connection to one or more external nodes at a second location distinct from the first location, the configuring being based at least in part on the received configuration information and including associating one or more virtual network addresses of the virtual computer network with the one or more external nodes; and

managing, by the configured edge module, a communication that is sent from a sending computing node of the multiple computing nodes to an indicated one of the associated one or more virtual network addresses, the managing including initiating forwarding the communication via the external connection to at least one of the one or more external nodes.

2. The computer-implemented method of claim 1 wherein the one or more external nodes include a first external node that is associated with a first virtual network address of the virtual computer network, and wherein the communication is forwarded by the configured edge module to the first external node via the external connection.

3. The computer-implemented method of claim 2 wherein the one or more external nodes further include a second external node that is accessible to the substrate network via a second external connection and that is associated with a second virtual network address of the virtual computer network, and wherein the method further comprises managing a second communication from one of the multiple computing nodes to the second virtual network address by initiating forwarding the second communication via the second external connection to the second external node.

4. The computer-implemented method of claim 3 wherein the configured edge module further interconnects the substrate network and the second external connection, and wherein the managing of the second communication is performed by the configured edge module.

5. The computer-implemented method of claim 4 further comprising, under control of the configured edge module:

receiving, via the external connection, a third communication from the first external node that is directed to the second external node; and

forwarding the third communication from the configured edge module to the second external node via the second external connection without forwarding the third communication over the substrate network.

6. The computer-implemented method of claim 3 further comprising configuring a second edge module to associate the second virtual network address with the second external node, wherein the configured second edge module interconnects the substrate network and the second external connection, and wherein the managing of the second communication is performed by the configured second edge module.

7. The computer-implemented method of claim 6 further comprising, under control of the configured edge module:

receiving, via the external connection, a third communication from the first external node that is directed to the second external node;

encoding the third communication to include information specific to the substrate network; and

forwarding the encoded third communication over the substrate network from the configured edge module to the configured second edge module for further handling.

8. The computer-implemented method of claim 7 further comprising, under control of the configured second edge module:

receiving the forwarded encoded third communication;

decoding the received forwarded encoded third communication to remove the included information specific to the substrate network; and

further forwarding the decoded third communication over the second external connection toward the second external node.

9. The computer-implemented method of claim 7 wherein the configuring of the edge module further includes, before the receiving of the third communication, associating the second virtual network address with the second edge module, and wherein the forwarding of the encoded third communication over the substrate network from the configured edge module to the configured second edge module is performed by the configured edge module based on the configuring of the edge module.

10. The computer-implemented method of claim 2 wherein the configuring of the edge module includes associating the first virtual network address with the first external node.

11. The computer-implemented method of claim 2 wherein the configuring of the edge module includes associating the first virtual network address with the external connection.

12. The computer-implemented method of claim 2 wherein the first external node is part of a first computer network of multiple nodes at a geographical location remote from the substrate network, wherein the external connection is a virtual private network (VPN) connection between the substrate network and the first computer network, and wherein the configured edge module is one of multiple edge devices connected to the substrate network.

13. The computer-implemented method of claim 1 wherein the one or more virtual network addresses are a range of multiple virtual network addresses represented with a classless inter-domain routing (CIDR) block, and wherein the configuring of the edge module includes associating the range of multiple virtual network addresses with the configured edge module.

14. The computer-implemented method of claim 1 wherein the multiple computing nodes and the configured edge module each has a distinct substrate network address that corresponds to a location in the substrate network, and wherein the method further comprises, before the managing of the communication by the configured edge module, forwarding the communication over the substrate network from the sending computing node to the configured edge module by using the substrate network address for the configured edge module.

15. The computer-implemented method of claim 14 further comprising, before forwarding the communication over the substrate network from the sending computing node to the configured edge module, selecting the configured edge module from a pool of multiple alternative edge modules associated with the external connection, and encoding the communication with information specific to the substrate network.

16. The computer-implemented method of claim 1 wherein the external connection is a multi-protocol label switching (MPLS) connection, a connection to a public network, or a dedicated private connection to a distinct location.

17. The computer-implemented method of claim 1 wherein the received configuration information further indicates a specified network topology for the virtual computer network, and wherein the method further comprises providing the virtual computer network by overlaying the virtual computer network on the substrate network without physically implementing the specified network topology for the virtual computer network.

18. The computer-implemented method of claim 1 wherein the received configuration information further indicates a plurality of virtual network addresses for use with the virtual computer network, and wherein the method further comprises assigning a subset of multiple virtual network addresses from the plurality of virtual network addresses to the multiple computing nodes.

19. The computer-implemented method of claim 18 wherein the one or more external nodes are part of the virtual computer network, and wherein the method further comprises assigning the one or more virtual network addresses for the virtual computer network to the one or more external nodes, the one or more virtual network addresses being distinct from the multiple virtual network addresses assigned to the multiple computing nodes.

20. The computer-implemented method of claim 1 further comprising, for each of one or more second communications sent between the multiple computing nodes, encoding the second communication in a manner specific to the substrate network, and forwarding the encoded second communication over the substrate network to a destination computing node without forwarding the encoded second communication to any edge module for the substrate network.

21. A system, comprising:

one or more hardware processors of one or more computing systems; and

an edge module that interconnects, via one or more external connections, a first network at a first location with one or more external nodes at a distinct second location, wherein the first network is associated with multiple first virtual network addresses, and wherein the edge module is configured to, when executed by at least one of the one or more hardware processors, manage a communication that is sent from a sending computing node of the first network to an indicated second virtual network address distinct from the multiple first virtual network addresses, by;

receiving the communication;

determining that the indicated second virtual network address is associated with one of the external nodes at the second location; and

initiating forwarding the received communication to the associated one external node via at least one of the one or more external connections.

22. The system of claim 21 wherein the one or more external nodes include one or more first external nodes separated from multiple computing nodes of the first network via a first external connection of the one or more external connections and include one or more second external nodes separated from the multiple computing nodes via a second external connection of the one or more external connections, and wherein the edge module is further configured to manage a second communication received by the edge module from one of the first external nodes over the first external connection that is directed to one of the second external nodes by initiating forwarding the second communication to the one second external node over the second external connection.

23. The system of claim 21 wherein the first network is a virtual network overlaid on a substrate network, wherein the one or more external nodes include one or more first external nodes separated from multiple computing nodes of the first network via a first external connection, wherein a second edge module interconnects the multiple computing nodes with one or more second external nodes via a second external connection, and wherein the edge module is further configured to manage a second communication received by the edge module from one of the first external nodes over the first external connection that is directed to one of the second external nodes by:

encoding the second communication in a manner specific to the substrate network; and

forwarding the encoded second communication over the substrate network from the edge module to the second edge module for further handling.

24. The system of claim 21 wherein the edge module includes software instructions for execution by the at least one hardware processors or is part of a hardware edge device connected to a substrate network on which the first network is overlaid.

25. The system of claim 21 wherein the edge module consists of a means for performing the managing of the communication.

26. A non-transitory computer-readable medium having stored contents that configure a computing system to:

configure, by the configured computing system, an edge module that interconnects multiple computing nodes of a virtual computer network at a first location and an external connection to one or more external nodes at a second location distinct from the first location, the configuring including associating one or more virtual network addresses of the virtual computer network with the one or more external nodes; and

manage, by the configured computing system, a communication that is sent from a sending computing node of the multiple computing nodes and is directed to an indicated one of the associated one or more virtual network addresses, the managing including initiating forwarding, by the configured edge module, of the communication via the external connection to at least one of the one or more external nodes.

27. The non-transitory computer-readable medium of claim 26 wherein the stored contents include executable instructions that further configure the computing system to receive configuration information for the virtual computer network that includes a specified network topology for the virtual computer network, and to provide the virtual computer network by overlaying the virtual computer network on a substrate network without physically implementing the specified network topology for the virtual computer network, and wherein the configuring of the edge module is further performed in a manner based at least in part on the received configuration information.

28. The non-transitory computer-readable medium of claim 27 wherein the one or more external nodes are part of the virtual computer network, wherein the received configuration information further indicates a plurality of virtual network addresses for use with the virtual computer network, and wherein the stored contents further configure the computing system to assign a subset of multiple virtual network addresses from the plurality of virtual network addresses to the multiple computing nodes and to assign the one or more virtual network addresses for the virtual computer network to the one or more external nodes, the one or more virtual network addresses being distinct from the multiple virtual network addresses assigned to the multiple computing nodes.

29. The non-transitory computer-readable medium of claim 26 wherein the stored contents further configure the computing system to, for each of one or more second communications sent between the multiple computing nodes, encode the second communication in a manner specific to the substrate network, and forward the encoded second communication over the substrate network to a destination computing node.