Abstract: Described herein is a network fabric including a plurality of graphical processing unit (GPU) clusters. The plurality of GPU clusters includes at least a first GPU cluster operating at a first speed and a second GPU cluster operating at a second speed that is different than the first speed. The network fabric includes a plurality of blocks, wherein each block includes: (a) one or more racks that host a GPU cluster, and (b) a plurality of switches arranged in a hierarchical structure that communicatively couple the block to other blocks included in the network fabric. Responsive to receiving a request to execute a workload, allocating one or more GPUs from the plurality of GPU clusters to execute the workload.

Abstract: The present disclosure provides dynamic routing for data flows to a customer network hosted in the cloud. A plurality of compute instances may share a common virtual IP address. Each of the plurality of compute instances may advertise information to a respective network virtualization device (NVD). The information may include the IP address, cost, and/or active/standby status of the compute instance. The NVD may then provide the information to the control plane of a virtual cloud network (VCN), which may aggregate the information from the plurality of compute instances and generate a forwarding table, which may be sent to the NVDs. These techniques may allow a customer to automatically remove a compute instance whose service host has failed. These techniques may also allow a customer to add compute instances and to route data flows according to an active-standby operation, an equal cost active-active operation, or an unequal cost active-active operation.

Abstract: A plurality of GPU clusters are communicatively coupled with one another via a plurality of network devices arranged in a hierarchical structure, wherein the GPU clusters includes at least a first GPU cluster operating at a first speed and a second GPU cluster operating at a second speed that is different than the first speed. A routing policy is configured for each network device, wherein the configuring includes establishing a mapping of each incoming port-link of the network device to a unique outgoing port-link of the network device. For a packet transmitted by a GPU of a host machine and received by a first network device, an incoming port-link of the first network device is determined on which the packet was received and based on the configuring, an outgoing port-link is identified that corresponds to the incoming port-link. The packet is forwarded on the outgoing port-link of the network device.

Abstract: Techniques are described for creating a network-link between a first virtual network in a first cloud environment and a second virtual network in a second cloud environment. The first virtual network in the first cloud environment is created to enable a user associated with a customer tenancy in the second cloud environment to access one or more services provided in the first cloud environment. The network-link is created based on one or more link-enabling virtual networks being deployed in the first cloud environment and the second cloud environment.

Abstract: For end-to-end encryption of a virtual cloud network, a VPN tunnel from a customer device is terminated at a host network headend device using encryption keys secured in hardware and managed by the customer. The network headend device can be a card in a bare-metal server with one or more network virtualization devices. The network headend device is configured to receive a first key provisioned by a customer; receive a first data packet sent from a device of the customer; and decrypt the first data packet using the first key to obtain information. A network virtualization device is configured to receive the information from the network headend device; ascertain that the information is to be sent to a virtual machine in a virtual cloud network; ascertain that data in the virtual cloud network is configured to be encrypted; and encrypt the information with a second key to generate a second data packet before routing the second data packet to the virtual machine.

Abstract: Techniques are described for communications in an L2 virtual network. In an example, the L2 virtual network includes a plurality of L2 compute instances hosted on a set of host machines and a plurality of L2 virtual network interfaces and L2 virtual switches hosted on a set of network virtualization devices. An L2 virtual network interface emulates an L2 port of the L2 virtual network. Access control list (ACL) information applicable to the L2 port is sent to a network virtualization device that hosts the L2 virtual network interface.

Abstract: Discussed herein is a framework that provisions for customized processing for different classes of traffic. A network device in a communication path between a source host machine and a destination host machine extracts a tag from a packet received by the network device. The packet originates at a source executing on the source host machine and whose destination is the destination host machine. The tag set by the source and indicative of a first traffic class to be associated with the packet, the first traffic class being selected by the source from a plurality of traffic classes. The network device determines, based on the tag, that the first traffic class corresponds to a latency sensitive traffic and processes the packet using one or more settings configured at the network device for processing packets associated with the first traffic class.

Abstract: Systems and methods for a virtual network routing gateway that supports address translation for data plane as well as dynamic routing protocols are disclosed herein. The method can include coupling a gateway with a plurality of ports to a network having a plurality of first IP addresses in a private address space, generating a Network Address Translation (“NAT”) function in the gateway, inputting translation information into the NAT function, advertising routes based on the translation information, populating a unified routing table in the gateway based on the plurality of first IP addresses in the private address space and on translated route advertisements, receive an inbound network packet at the gateway, translating an inbound address of the inbound network packet with the NAT function, and delivering the network packet according to the routing table and based on the translated inbound address.

Abstract: Systems and methods for a VLAN switching and routing service (VSRS) are disclosed herein. A method can include generating a table for an instance of a VSRS, which VSRS couples a first virtual layer 2 network (VLAN) with a second network. The table can contain information identifying IP addresses, MAC addresses, and virtual interface identifiers for instances within the virtual layer 2 network. The method can include receiving with the VSRS a packet from a first instance designated for delivery to a second instance within the virtual layer 2 network, identifying with the VSRS the second instance within the virtual layer 2 network for delivery of the packet based on information received with the packet and information contained within the table, and delivering the packet to the identified second instance.

Abstract: Techniques are described for communications in an L2 virtual network. In an example, the L2 virtual network includes a plurality of L2 compute instances hosted on a set of host machines and a plurality of L2 virtual network interfaces and L2 virtual switches hosted on a set of network virtualization devices. An L2 virtual network interface emulates an L2 port of the L2 virtual network. Access control list (ACL) information applicable to the L2 port is sent to a network virtualization device that hosts the L2 virtual network interface.

Abstract: A method for providing a dedicated region cloud at customer is provided. A first physical port of a network virtualization device (NVD) included in a datacenter is communicatively coupled to a first top-of-rack (TOR) switch and a second TOR switch. A second physical port of the NVD is communicatively coupled to a network interface card (NIC) associated with a host machine. The NVD receives a packet from the host machine via the second physical port of the NVD. The NVD further determines a particular TOR, from a group including the first TOR and the second TOR, for communicating the packet, and transmits the packet to the particular TOR to facilitate communication of the packet to a destination host machine.

Abstract: A method for providing a dedicated region cloud at customer is provided. A first physical port of a network virtualization device (NVD) included in a datacenter is communicatively coupled to a first top-of-rack (TOR) switch and a second TOR switch. A second physical port of the NVD is communicatively coupled with a network interface card (NIC) associated with a host machine. The second physical port provided a first logical port and a second logical port for communications between the NVD and the NIC. The NVD receives a packet from the host machine via the first logical port or the second logical port. Upon receiving the packet, the NVD determines a particular TOR, from a group including the first TOR and the second TOR, for communicating the packet. The NVD transmits the packet to the particular TOR to facilitate communication of the packet to a destination host machine.

Abstract: Techniques are disclosed for managing aspects of a dedicated region cloud at a customer location (a “DRCC”). A DRCC may comprise cloud infrastructure components provided by a cloud provider and hosted by computing devices located at the customer's (a “cloud owner's”) location. Services of the central cloud-computing environment may be similarly executed at the DRCC. The DRCC may include a service configured to collect, store, and/or present data corresponding to the cloud infrastructure components via one or more interfaces (e.g., interfaces provided to the cloud provider and/or the cloud owner). Data collected within the DRCC (e.g., capacity and usage data, etc.) may be provided and accessible to the central cloud at any suitable time. Obtaining such data enables the user to ascertain various operational aspects of the DRCC, while enabling the system and/or user to execute various DRCC-specific operations regarding capacity planning, health and performance, change management, and the like.

Abstract: Disclosed herein is a method of providing fault domains within a rack. An availability domain comprising a rack is provided, where the rack comprising a plurality of top-of-rack (TOR) switches and a plurality of host machines. A first fault domain is created within the availability domain. The first fault domain comprised a first TOR switch from the plurality of TOR switches and a first subset of host machines from the plurality of host machines. The first subset of host machines is communicatively coupled to the first TOR. A second fault domain is created within the availability domain, where the second fault domain comprised a second TOR switch from the plurality of TOR switches and a second subset of host machines from the plurality of host machines. The second subset of host machines is communicatively coupled to the second TOR.

Abstract: Described herein is a network fabric architecture for DRCC. The fabric includes a plurality of blocks of switches. A compute fabric (CFAB) block is provided that is communicatively coupled to the plurality of blocks of switches. The CFAB block includes: (i) a set of one or more racks, where each rack comprised one or more servers configured to execute one or more workloads of a customer, and (ii) a first plurality of switches organized into a first plurality of levels. The first plurality of switches is communicatively couples the set of one or more racks to the plurality of blocks of switches. A network fabric block is provided that is communicatively coupled to the plurality of blocks of switches and includes (i) one or more edge devices including a first edge device providing connectivity (to a workload) to a first external resource, and (ii) a second plurality of switches organized into a second plurality of levels.

Abstract: Systems and methods for highly-available host networking with active-active or active-backup traffic load-balancing are disclosed herein. The method can include selecting a compute instance from an overlay network residing on a substrate network, identifying a plurality of Network Virtualization Devices (“NVD”) for association with the compute instance, creating a loopback interface on each of the NVDs, each of which loopback interfaces can include a shared IP address that can be in the substrate layer, prepopulating a table in each of the NVDs, the table linking the shared IP address to the compute instance, and each of the plurality of NVDs advertising a unique route to the compute instance via the shared IP address.

Abstract: Techniques are described for communications in an L2 virtual network. In an example, the L2 virtual network includes a plurality of L2 compute instances hosted on a set of host machines and a plurality of L2 virtual network interfaces and L2 virtual switches hosted on a set of network virtualization devices. An L2 virtual network interface emulates an L2 port of the L2 virtual network. Span port information applicable to the L2 port is sent to a network virtualization device that hosts the L2 virtual network interface.

Abstract: Systems and methods of interface-based ACLs in a virtual Layer-2 network. The method can include sending a packet from source compute instance in a virtual network to a destination compute instance via a destination virtual network interface card (destination VNIC) within a first virtual layer 2 network and evaluating an access control list (ACL) for the packet with a source virtual network interface card (source VNIC). ACL information relevant to the packet can be embedded in the packet. The VSRS can receive the packet and can identify the destination VNIC within the first virtual layer 2 network for delivery of the packet based on information received with the packet and mapping information contained within a mapping table. The VSRS can access ACL information from the packet and can apply the ACL information to the packet.

Abstract: The present disclosure provides dynamic routing for data flows to a customer network hosted in the cloud. A plurality of compute instances may share a common virtual IP address. Each of the plurality of compute instances may advertise information to a respective network virtualization device (NVD). The information may include the IP address, cost, and/or active/standby status of the compute instance. The NVD may then provide the information to the control plane of a virtual cloud network (VCN), which may aggregate the information from the plurality of compute instances and generate a forwarding table, which may be sent to the NVDs. These techniques may allow a customer to automatically remove a compute instance whose service host has failed. These techniques may also allow a customer to add compute instances and to route data flows according to an active-standby operation, an equal cost active-active operation, or an unequal cost active-active operation.

Abstract: A network interface card, such as a SmartNIC, is used to provide encryption, such as network encryption virtual function (NEVF), for a virtual machine, so that a customer can control network keys in a virtual cloud network. The NEVF includes a memory device (e.g., SRAM) and a crypto processor (e.g., a crypto core). The memory device stores a crypto key. The crypto processor uses the crypto key to encrypt data to and from a virtual machine in the virtual cloud network. A key management system can be used to securely transfer crypto keys to the NEVF. Having one NEVF per virtual machine can enable a customer to manage the crypto key for a virtual cloud network.