US 11,695,697 B2 · Performing in-line service in public cloud

Abstract

Some embodiments provide a novel way to insert a service (e.g., a third party service) in the path of a data message flow, between two machines (e.g., two VMs, two containers, etc.) in a public cloud environment. For a particular tenant of the public cloud, some embodiments create an overlay logical network with a logical overlay address space. To perform a service on data messages of a flow between two machines, the logical overlay network passes to the public cloud's underlay network the data messages with their destination address (e.g., destination IP addresses) defined in the logical overlay network. The underlay network (e.g., an underlay default downlink gateway) is configured to pass data messages with such destination addresses (e.g., with logical overlay destination addresses) to a set of one or more service machines. The underlay network (e.g., an underlay default uplink gateway) is also configured to pass to the particular tenant's public cloud gateway the processed data messages that are received from the service machine set and that are addressed to logical overlay destination addresses. The tenant's public cloud gateway is configured to forward such data messages to a logical forwarding element of the logical network, which then handles the forwarding of the data messages to the correct destination machine.

Claims19

Dependent claims

A method for providing a service for data messages exchanged between machines in a virtual private cloud (VPC) in a public cloud, the method comprising:

establishing first and second VPCs for first and second tenants in the public cloud;
configuring a first router for the first VPC and a second router for the second VPC respectively to connect a set of machines in each VPC, each VPC's router comprising at least one logical interface (LIF);
configuring each VPC's router to direct, through the at least one LIF of the VPC's router, a subset of data messages exchanged between the VPC's machines to a shared network of the public cloud;
and
configuring the shared network to forward the subset of data messages, received from the at least one LIF of each VPC's router, to a common set of service machines that are deployed in a service VPC for use by multiple tenant VPCs, the common set of service machines performing a set of one or more services on a particular received data message of the subset of data messages and providing the particular received data message back to the shared network to forward the particular received data message to the VPC router that provided the particular received data message for the VPC router to forward the particular received data message to a destination machine in the VPC corresponding to the respective router with the at least one LIF.

2 more elements

A non-transitory machine readable medium storing a program for providing a service for data messages exchanged between machines in a virtual private cloud (VPC) in a public cloud, the program for execution by at least one processing unit of a computer, the program comprising sets of instructions for:

establishing first and second VPCs for first and second tenants in the public cloud;
configuring a first router for the first VPC and a second router for the second VPC respectively to connect a set of machines in each VPC, each VPC's router comprising at least one logical interface (LIF);
configuring each VPC's router to direct, through the at least one LIF of the VPC's router, a subset of data messages exchanged between the VPC's machines to a shared network of the public cloud;
and
configuring the shared network to forward the subset of data messages, received from the at least one LIF of each VPC's router, to a common set of service machines that are deployed in a service VPC for use by multiple tenant VPCs, the common set of service machines performing a set of one or more services on a particular received data message of the subset of data messages and providing the particular received data message back to the shared network to forward the particular received data message to the VPC router that provided the particular received data message for the VPC router that provided the particular received data message to forward the particular received data message to a destination machine in the VPC corresponding to the respective router with the at least one LIF.

2 more elements

Dependencies are inferred from the claim text.

Performing in-line service in public cloud

Life of this patent

Performing in-line service in public cloud

Life of this patent

Abstract

Claims19