Multi-tenant network virtualization infrastructure

For a network management and control system that manages a virtual infrastructure deployed across a set of datacenters, a method comprising:

• based on input from a top-level user of the virtual infrastructure, (i) deploying a first logical network within the virtual infrastructure and (ii) defining a set of one or more second-level users of the virtual infrastructure;
• receiving input from a particular second-level user of the virtual infrastructure to define a second logical network and connect the second logical network to the first logical network,
• wherein the first and second logical networks use a same data model and wherein the set of second-level users is restricted from viewing configuration of the first logical network;
• receiving input from the particular second-level user of the virtual infrastructure to create accounts for a set of one or more third-level users of the virtual infrastructure, wherein the set of third-level users of the virtual infrastructure is enabled to define logical networks that connect to one or more of the first and second logical networks.

For a network management and control system that manages a virtual infrastructure deployed across a set of datacenters, a method comprising:

• based on input from a top-level user of the virtual infrastructure, (i) deploying a first logical network within the virtual infrastructure and (ii) defining a set of one or more second-level users of the virtual infrastructure;
• receiving input from a particular second-level user of the virtual infrastructure to define a second logical network and connect the second logical network to the first logical network,
• wherein the first and second logical networks use a same data model and wherein the set of second-level users is restricted from viewing configuration of the first logical network;
• wherein the top-level user is enabled to view and configure physical infrastructure entities that are hidden from the set of second-level users;
• wherein the logical network definitions are stored as policy trees, wherein the policy tree for the first logical network comprises physical infrastructure nodes defining the physical infrastructure of different sites, wherein the policy tree for the second logical network is restricted from comprising any physical infrastructure nodes.

A non-transitory machine-readable medium storing a network manager program which when executed by at least one processing unit manages a virtual infrastructure deployed across a set of datacenters, the network manager program comprising sets of instructions for:

• based on input from a top-level user of the virtual infrastructure, (i) deploying a first logical network within the virtual infrastructure and (ii) defining a set of one or more second-level users of the virtual infrastructure;
• receiving input from a particular second-level user of the virtual infrastructure to define a second logical network and connect the second logical network to the first logical network,
• wherein the first and second logical networks use a same data model and wherein the set of second-level users is restricted from viewing configuration of the first logical network;
• receiving input from the particular second-level user of the virtual infrastructure to create accounts for a set of one or more third-level users of the virtual infrastructure;
• the set of third-level users of the virtual infrastructure is enabled to define logical networks that connect to one or more of the first and second logical networks;
• and
• the logical networks defined by the set of third-level users uses the same data model as the first and second logical networks.

A non-transitory machine-readable medium storing a network manager program which when executed by at least one processing unit manages a virtual infrastructure deployed across a set of datacenters, the network manager program comprising sets of instructions for:

• based on input from a top-level user of the virtual infrastructure, (i) deploying a first logical network within the virtual infrastructure and (ii) defining a set of one or more second-level users of the virtual infrastructure;
• receiving input from a particular second-level user of the virtual infrastructure to define a second logical network and connect the second logical network to the first logical network,
• wherein the first and second logical networks use a same data model and wherein the set of second-level users is restricted from viewing configuration of the first logical network;
• wherein the top-level user is enabled to view and configure physical infrastructure entities that are hidden from the set of second-level users;
• the logical network definitions are stored as policy trees;
• the policy tree for the first logical network comprises physical infrastructure nodes defining the physical infrastructure of different sites;
• and
• the policy tree for the second logical network is restricted from comprising any physical infrastructure nodes.