# US 11,115,465 B2 · Accessing endpoints in logical networks and public cloud service providers native networks using a single network interface and a single routing table > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,115,465 B2 - Document ID: US11115465B2 - Status: Granted - Kind: B2 - Application number: 16/785,620 - Filed: 2020-02-09 - Published: 2020-06-04 - Granted: 2021-09-07 - Earliest claimed: 2017-08-24 - Assignees: Nicira, Inc. - Applicants: Nicira, Inc. - Inventors: Shashank Ram; Sairam Venugopal; Yin Lin; Anand Kumar; Nithin Bangalore Raju; Mukesh Hira; Ganesan Chandrashekhar; Vivek Agarwal - Web page: https://patentgrep.com/patent/US11115465B2 ## CPC - H04L 41/08: Configuration management of networks or network elements (address allocation H04L61/50) - H04L 41/0895: Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements - H04L 49/70: {Virtual switches} - H04L 63/00: {Network architectures or network communication protocols for network security (cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00; network architectures or network communication protocols for wireless network security H04W12/00; security arrangements for protecting computers or computer systems against unauthorised activity G06F21/00)} - H04L 63/0272: {Virtual private networks} - H04L 63/102: {Entity profiles} - H04W 12/009: {specially adapted for networks, e.g. wireless sensor networks, ad-hoc networks, RFID networks or cloud networks} - H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) - H04L 69/321: Interlayer communication protocols or service data unit [SDU] definitions; Interfaces between layers - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract A physical host machine of a public cloud system includes a set of processing units for executing instructions stored in non-transitory machine readable media. The physical host machine also includes a physical network interface cars (PNIC) and a non-transitory machine readable medium that stores a data compute node (DCN). The DCN includes first and second applications, first and second logical interfaces, a network stack, and a managed forwarding element (MFE). The first application is connected to the pNIC through the network stack, the first logical interface, and the MFE. The second application is connected to the PNIC through the network stack, the second logical interface, and the MFE. ## Claims ### Claim 1 For a managed forwarding element (MFE) executing within a data compute node (DCN) that operates on a host computer of a public cloud datacenter to process traffic for applications executing on the DCN, a method comprising at a first interface of the MFE, receiving a first packet from a network manager application that executes on the DCN; transmitting the first packet to an underlay network of the public cloud datacenter without encapsulating the first packet; at a second interface of the MFE associated with a first network address of an overlay network to which the DCN is connected, receiving a second packet that is (i) from a tenant workload application and (ii) addressed to a second network address of the overlay network; and encapsulating the second packet and transmitting the encapsulated second packet to the underlay network of the public cloud datacenter to be forwarded to a destination corresponding to the second network address of the overlay network. ### Claim 2 (depends on 1) The method of claim 1, wherein transmitting the first packet comprises sending the first packet to an underlay network destination address through a physical network interface card (NIC) of the host without performing network address translation. ### Claim 3 (depends on 1) The method of claim 1, wherein the DCN comprises an overlay network virtual adapter and an underlay network virtual adapter, and the first packet is received through the underlay network virtual adapter while the second packet is received through the overlay network virtual adapter. ### Claim 4 (depends on 3) The method of claim 3, wherein the overlay network adapter is a Virtual Interface (VIF) while the underlay network adapter is Virtual Extensible Local Area Network (VXLAN) tunnel endpoint (VTEP). ### Claim 5 (depends on 1) The method of claim 1 further comprising: receiving, from a tenant application, a third packet that is addressed to an underlay network destination address; performing a source network address translation (SNAT) operation on the packet to replace a source Internet Protocol (IP) address of the packet with an underlay network IP address of the DCN; and sending the packet to the underlay network destination address. ### Claim 6 (depends on 5) The method of claim 5, wherein performing SNAT operation comprises replacing a source port number of the packet with a number that uniquely identifies a source in the overlay network, the method further comprising: receiving a response packet addressed to a tenant application and using the port number as the destination port number; using the destination port number to identify the IP address in the overlay network for a destination of the response packet; and performing a destination network address translation (DNAT) operation to replace the destination IP address of the response packet with the identified IP address. ### Claim 7 (depends on 6) The method of claim 6 further comprising forwarding the response packet from the MFE through the overlay network virtual adapter. ### Claim 8 (depends on 6) The method of claim 6 further comprising decapsulating the response packet by removing a header of the overlay network from the packet prior to identifying the IP address. ### Claim 9 A non-transitory computer readable medium storing a program for processing packets for applications executing on a data compute node (DCN) along with a managed forwarding element (MFE), the program and the DCN for execution by a set of processing units of a host computer, the program comprising sets of instructions for: receiving, at a first interface of the MFE, a first packet from a network manager application that executes on the DCN; transmitting the first packet to an underlay network of the public cloud datacenter without encapsulating the first packet; receiving, at a second interface of the MFE associated with a first network address of an overlay network to which the DCN is connected, a second packet that is (i) from a tenant workload application and (ii) addressed to a second network address of the overlay network; and encapsulating the second packet and transmitting the encapsulated second packet to the underlay network of the public cloud datacenter to be forwarded to a destination corresponding to the second network address of the overlay network. ### Claim 10 (depends on 9) The non-transitory computer readable medium of claim 9, wherein the set of instructions for transmitting the first packet comprises a set of instructions for sending the first packet to an underlay network destination address through a physical network interface card (NIC) of the host without performing network address translation. ### Claim 11 (depends on 9) The non-transitory computer readable medium of claim 9, wherein the DCN comprises an overlay network virtual adapter and an underlay network virtual adapter, and the first packet is received through the underlay network virtual adapter while the second packet is received through the overlay network virtual adapter. ### Claim 12 (depends on 11) The non-transitory computer readable medium of claim 11, wherein the overlay network adapter is a Virtual Interface (VIF) while the underlay network adapter is Virtual Extensible Local Area Network (VXLAN) tunnel endpoint (VTEP). ### Claim 13 (depends on 9) The non-transitory computer readable medium of claim 9, wherein the program further comprises sets of instructions for: receiving, from a tenant application, a third packet that is addressed to an underlay network destination address; performing a source network address translation (SNAT) operation on the packet to replace a source Internet Protocol (IP) address of the packet with an underlay network IP address of the DCN; and sending the packet to the underlay network destination address. ### Claim 14 (depends on 13) The non-transitory computer readable medium of claim 13, wherein the set of instructions for performing SNAT operation comprises a set of instructions for replacing a source port number of the packet with a number that uniquely identifies a source in the overlay network, the program further comprising sets of instructions for: receiving a response packet addressed to a tenant application and using the port number as the destination port number; using the destination port number to identify the IP address in the overlay network for a destination of the response packet; and performing a destination network address translation (DNAT) operation to replace the destination IP address of the response packet with the identified IP address. ### Claim 15 (depends on 14) The non-transitory computer readable medium of claim 14, wherein the program further comprises a set of instructions for forwarding the response packet from the MFE through the overlay network virtual adapter. ### Claim 16 (depends on 14) The non-transitory computer readable medium of claim 14, wherein the program further comprises a set of instructions for decapsulating the response packet by removing a header of the overlay network from the packet prior to identifying the IP address.