Abstract: Systems and methods for support server high availability with network link bonding for cloud overlay networks are disclosed herein. The method can include selecting a compute instance, identifying a plurality of Network Virtualization Devices (“NVD”) for association with the compute instance, and creating a number of Virtualized Network Interface Cards (“VNIC”), each of which VNICs can reside in one of the plurality of NVDs. The method can include overlaying an IP address of the compute instance to each of the VNICs, such that each of the VNICs share a common IP address, designating a network path formed by one of the VNICs in one of the NVDs as an active network path and another of the network paths as an inactive network path, and activating the inactive network path when the active network path fails.

Abstract: When a cloud services provider infrastructure (CSPI) receives a request from an administrator to perform an operation on an appliance, a load balancer may select a first server within the CSPI to process the request. If the first server does not have a connection with the appliance, the first server may generate a redirect response that includes server identification information identifying a particular server having a pre-established connection with the appliance. The first server may send the redirect response to the application that the administrator used to send the request. The application may then generate a second request that includes the server identification information, and send the second request to the CSPI. A load balancer in the CSPI may then forward the second request to the particular server, and the particular server may use the pre-established connection to send a request to the appliance requesting performance of the operation.

Abstract: Techniques for exposing a subset of hosts on an overlay network, without exposing another subset of hosts on the overlay network, are disclosed. A component associated with an overlay network exposes a subset of hosts on the overlay network to components external to the overlay network. The component exposes the subset of hosts by distributing a mapping between (a) the hosts to-be-exposed and (b) the substrate addresses associated with the hosts. Alternatively, a component external to an overlay network exposes a subset of hosts on the overlay network to additional components external to the overlay network. The component exposes the subset of hosts by distributing a mapping between (a) the hosts to-be-exposed and (b) a substrate address associated with the particular component. In either embodiment, a mapping for hosts to-be-hidden is not distributed.

Abstract: Systems and methods for a VLAN switching and routing service (VSRS) are disclosed herein. A method can include generating a table for an instance of a VSRS, which VSRS couples a first virtual layer 2 network (VLAN) with a second network. The table can contain information identifying IP addresses, MAC addresses, and virtual interface identifiers for instances within the virtual layer 2 network. The method can include receiving with the VSRS a packet from a first instance designated for delivery to a second instance within the virtual layer 2 network, identifying with the VSRS the second instance within the virtual layer 2 network for delivery of the packet based on information received with the packet and information contained within the table, and delivering the packet to the identified second instance.

Abstract: Systems and methods for a virtual layer-2 network are disclosed herein. The method can include providing a virtual Layer 3 network in a virtualized cloud environment. The virtual Layer 3 network can be hosted by an underlying physical network. The method can include providing a virtual Layer 2 network in the virtualized cloud environment. The virtual Layer 2 network can be hosted by the underlying physical network.

Abstract: Systems and methods of interface-based ACLs in a virtual Layer-2 network. The method can include sending a packet from source compute instance in a virtual network to a destination compute instance via a destination virtual network interface card (destination VNIC) within a first virtual layer 2 network and evaluating an access control list (ACL) for the packet with a source virtual network interface card (source VNIC). ACL information relevant to the packet can be embedded in the packet. The VSRS can receive the packet and can identify the destination VNIC within the first virtual layer 2 network for delivery of the packet based on information received with the packet and mapping information contained within a mapping table. The VSRS can access ACL information from the packet and can apply the ACL information to the packet.

Abstract: Techniques for loop prevention while allowing multipath in a virtual L2 network are described. In an example, a NIC supports the virtual L2 network. The NIC is configured to receive, via a first port of the NIC, an L2 frame that includes a source MAC address and a destination MAC address. Based on a loop prevention rule, the NIC transmits the L2 frame via its ports except the first port. In an additional example, the NIC is further configured to send an L2 frame to a host via the first port of the NIC. The L2 frame can be a BPDU. Upon receiving a BPDU from the host via the first port, the NIC determines that the BPDU is looped back and disables the first port.

Abstract: When a cloud services provider infrastructure (CSPI) receives a request from an administrator to perform an operation on an appliance, a load balancer may select a first server within the CSPI to process the request. If the first server does not have a connection with the appliance, the first server may generate a redirect response that includes server identification information identifying a particular server having a pre-established connection with the appliance. The first server may send the redirect response to the application that the administrator used to send the request. The application may then generate a second request that includes the server identification information, and send the second request to the CSPI. A load balancer in the CSPI may then forward the second request to the particular server, and the particular server may use the pre-established connection to send a request to the appliance requesting performance of the operation.

Abstract: Techniques for transforming data based on a virtual topology are disclosed. A computer network is associated with a physical topology and a virtual topology. A physical topology is a particular arrangement of digital devices. A virtual topology is a description of a particular arrangement of virtual topology entities (VTEs). VTEs of the virtual topology are instantiated on digital devices of the physical topology. A processing component associated with a particular VTE processes data to perform one or more functions of the particular VTE. An emulation component associated with the particular VTE modifies the data to emulate performance of the functions by the particular VTE.

Abstract: Techniques for implementing a single-addressable virtual topology element (VTE) in a virtual topology. A VTE in a virtual topology may be distributed as multiple instantiated elements in a physical topology. However, the multiple instantiated elements are addressable as a single entity. Obtaining information associated with the VTE includes obtaining and aggregating information from each of the instantiated elements. Applying an overall configuration to the VTE includes determining a respective configuration for each instantiated element based on the overall configuration, and applying the respective configuration to each instantiated element.

Abstract: Generally described, systems and methods are provided for monitoring and detecting causes of failures of network paths. The system collects performance information from a plurality of nodes and links in a network, aggregates the collected performance information across paths in the network, processes the aggregated performance information for detecting failures on the paths, analyzes each of the detected failures to determine at least one root cause, and initiates a remedial workflow for the at least one root cause determined. In some aspects, processing the aggregated information may include performing a statistical regression analysis or otherwise solving a set of equations for the performance indications on each of a plurality of paths. In another aspect, the system may also include an interface which makes available for display one or more of the network topology, the collected and aggregated performance information, and indications of the detected failures in the topology.

Abstract: A method of executing in-session encryption verification includes receiving a plurality of client data packets for transmission through a network; receiving one or more test data packets for verifying an encryption device; merging the client data packets and the one or more test packets into a data stream; selecting security parameters for each packet in the data stream based on a corresponding packet type; encrypting each packet in the data stream using the encryption device and the corresponding security parameters; and transmitting the data stream comprising encrypted packets through the network. The method also includes decrypting the encrypted packets at a receiving system using congruent techniques.

Abstract: Techniques for transforming data based on a virtual topology are disclosed. A computer network is associated with a physical topology and a virtual topology. A physical topology is a particular arrangement of digital devices. A virtual topology is a description of a particular arrangement of virtual topology entities (VTEs). VTEs of the virtual topology are instantiated on digital devices of the physical topology. A processing component associated with a particular VTE processes data to perform one or more functions of the particular VTE. An emulation component associated with the particular VTE modifies the data to emulate performance of the functions by the particular VTE.

Abstract: Techniques for transforming data based on a virtual topology are disclosed. A computer network is associated with a physical topology and a virtual topology. A physical topology is a particular arrangement of digital devices. A virtual topology is a description of a particular arrangement of virtual topology entities (VTEs). VTEs of the virtual topology are instantiated on digital devices of the physical topology. A processing component associated with a particular VTE processes data to perform one or more functions of the particular VTE. An emulation component associated with the particular VTE modifies the data to emulate performance of the functions by the particular VTE.

Abstract: Techniques for implementing a single-addressable virtual topology element (VTE) in a virtual topology. A VTE in a virtual topology may be distributed as multiple instantiated elements in a physical topology. However, the multiple instantiated elements are addressable as a single entity. Obtaining information associated with the VTE includes obtaining and aggregating information from each of the instantiated elements. Applying an overall configuration to the VTE includes determining a respective configuration for each instantiated element based on the overall configuration, and applying the respective configuration to each instantiated element.

Abstract: Techniques for implementing a single-addressable virtual topology element (VTE) in a virtual topology. A VTE in a virtual topology may be distributed as multiple instantiated elements in a physical topology. However, the multiple instantiated elements are addressable as a single entity. Obtaining information associated with the VTE includes obtaining and aggregating information from each of the instantiated elements. Applying an overall configuration to the VTE includes determining a respective configuration for each instantiated element based on the overall configuration, and applying the respective configuration to each instantiated element.

Abstract: Techniques for implementing a single-addressable virtual topology element (VTE) in a virtual topology. A VTE in a virtual topology may be distributed as multiple instantiated elements in a physical topology. However, the multiple instantiated elements are addressable as a single entity. Obtaining information associated with the VTE includes obtaining and aggregating information from each of the instantiated elements. Applying an overall configuration to the VTE includes determining a respective configuration for each instantiated element based on the overall configuration, and applying the respective configuration to each instantiated element.

Abstract: Techniques for exposing a subset of hosts on an overlay network, without exposing another subset of hosts on the overlay network, are disclosed. A component associated with an overlay network exposes a subset of hosts on the overlay network to components external to the overlay network. The component exposes the subset of hosts by distributing a mapping between (a) the hosts to-be-exposed and (b) the substrate addresses associated with the hosts. Alternatively, a component external to an overlay network exposes a subset of hosts on the overlay network to additional components external to the overlay network. The component exposes the subset of hosts by distributing a mapping between (a) the hosts to-be-exposed and (b) a substrate address associated with the particular component. In either embodiment, a mapping for hosts to-be-hidden is not distributed.

Abstract: Techniques for exposing a subset of hosts on an overlay network, without exposing another subset of hosts on the overlay network, are disclosed. A component associated with an overlay network exposes a subset of hosts on the overlay network to components external to the overlay network. The component exposes the subset of hosts by distributing a mapping between (a) the hosts to-be-exposed and (b) the substrate addresses associated with the hosts. Alternatively, a component external to an overlay network exposes a subset of hosts on the overlay network to additional components external to the overlay network. The component exposes the subset of hosts by distributing a mapping between (a) the hosts to-be-exposed and (b) a substrate address associated with the particular component. In either embodiment, a mapping for hosts to-be-hidden is not distributed.

Abstract: Techniques for exposing a subset of hosts on an overlay network, without exposing another subset of hosts on the overlay network, are disclosed. A component associated with an overlay network exposes a subset of hosts on the overlay network to components external to the overlay network. The component exposes the subset of hosts by distributing a mapping between (a) the hosts to-be-exposed and (b) the substrate addresses associated with the hosts. Alternatively, a component external to an overlay network exposes a subset of hosts on the overlay network to additional components external to the overlay network. The component exposes the subset of hosts by distributing a mapping between (a) the hosts to-be-exposed and (b) a substrate address associated with the particular component. In either embodiment, a mapping for hosts to-be-hidden is not distributed.