Abstract: In one embodiment, a computing platform featuring a controller and a first virtual private cloud network, which is communicatively coupled to the controller. The first virtual private cloud network includes at least a first gateway including egress filtering logic. The egress filtering logic is configured to (i) filter messages routed from the first gateway in accordance with a first set of filtering rules maintained by the first gateway and (ii) bypass the filtering of messages directed to or originating from one or more subnetworks in accordance with the first set of filtering rules.

Abstract: A distributed cloud computing system is disclosed that includes a controller configured to deploy network constructs including any of transit gateways, spoke gateways, subnets, or private networks and logic that, upon execution by one or more processors, causes performance of operations including: causing rendering of a graphical user interface that includes a display panel configured to display progress of a build process for a network topology graph, receiving first user input through the graphical user interface indicating selection of a first cloud service provider, a first access account, and a first cloud region, receiving second user input through the graphical user interface indicating selection of one or more of the network constructs to be deployed in the first cloud region, instructing the controller to deploy the one or more of the network constructs in the first cloud region according to the first user input and the second user input.

Abstract: A distributed cloud computing system is disclosed that includes a controller configured to deploy a first gateway in a first cloud computing network and a second gateway in a second cloud computing network and logic. The logic, upon execution by one or more processors, causes operations including receiving, from the controller, metadata pertaining to a plurality of constructs, receiving, from each of the first and second gateways, network data, deriving gateway metrics spanning multiple cloud computing networks including at least the first and second cloud computing networks, wherein the deriving is based on at least the metadata and the network data of each of the first and second gateways, generating a dashboard visualization illustrating the gateway metrics, wherein the gateway metrics pertain to characteristics of each gateway and deployed constructs associated with each gateway, and causing rendering of the dashboard visualization on a display screen.

Abstract: A network device, such as an ingress gateway for example, includes data analytic logic and message reconfiguration logic. The data analytic logic is configured to determine which of at least one network policy of a plurality of network policies is applicable to an incoming data flow and assigning a classification identifier in accordance with the at least one network policy. The classification identifier is configured to influence routing paths through at least one cloud network. The message reconfiguration logic is configured to encapsulate the classification identifier into content of the incoming data flow in order to generate a classified data flow for routing from a source to a destination through the at least one cloud network.

Abstract: Embodiments of the disclosure relate to a secure, high-performance communication link that relies on single network, multiple logical port addressing. Embodiments of an infrastructure are associated with a high-performance communication link that allows for distribution of network traffic across multiple interconnects using a single network address with different logical network port addressing. This high-performance communication link supports data traffic across different processing logic units residing within a destination computing device.

Abstract: In communication with components of a cloud platform, namely a software-defined network constructed to overlay at least one public cloud network, a controller features a virtual processor and a data store. The data store includes network address translation (NAT) processing logic configured to determine whether a control plane message from tenant resources is associated with a network address overlapping condition, which represents a first network address included in the control plane message overlaps a network address range relied upon by either (a) at least one of the components of the cloud platform or (b) a component associated with other tenant resources. The NAT processing logic is further configured to alter routing data stores that maintain routing information for each of the components of the cloud platform to substitute the first network address with a first virtual network address for subsequent data message routing.

Abstract: A distributed cloud computing system is disclosed that includes a controller configured to deploy a first gateway in a first cloud computing network and a second gateway in a second cloud computing network and logic. The logic, upon execution by one or more processors, causes operations including receiving, from the controller, metadata pertaining to a plurality of constructs, receiving, from each of the first and second gateways, network data, receiving user input corresponding a request to visualize active users, receiving information pertaining to the active users utilizing resources managed by the controller, and causing rendering of a visualization of the active users on a display screen of a network device.

Abstract: A system and method for controlling the handling of intra-VPC and inter-VPC communications is described. First, a destination of a communication is determined it resides within a first virtual private cloud network (VPC) of a source of the communication. If so, filtering communications between the destination and the source is controlled by native cloud constructs associated with a cloud service provider (CSP) underlay network for the first public cloud network. Otherwise, filtering communication between the destination and the source is controlled by a spoke gateway. The spoke gateway is part of a cloud overlay network configured to provide a communication path between the first virtual private cloud network and the second private cloud network and using micro-segmentation to set and manage security policies.

Abstract: A method for establishing a communication coupling within a cloud computing environment between a first gateway of a first virtual private cloud network deployed behind a firewall and a second gateway of a second virtual private cloud network is disclosed. The method includes operations of receiving, by the first gateway, a first controller message from a controller deployed within the cloud computing environment, the first controller message instructing the first gateway to transmit a first gateway message to the second gateway, transmitting, by the first gateway, the first gateway message to the second gateway, receiving, by the first gateway, a second gateway message from the second gateway, the second gateway message initiating a negotiation to establish a first tunnel between the first gateway and the second gateway in accordance with a first security protocol, and completing, by the first gateway, the negotiation thereby causing establishment of the first tunnel.

Abstract: A computerized method for avoiding cross-region communications when utilizing a cloud overlay network is described. The method involves an operation of deploying one or more spoke gateways within at least a first region and a second region of a first virtual private cloud network. Thereafter, a region and a virtual private cloud network associated with a source and a destination of a communication are determined. Upon determining that the destination of the communication resides within a second virtual private cloud network, which is different than the first virtual private cloud network, the routing of the communication between the source and the destination is controlled by one or more spoke gateways solely residing within the region in which the source.

Abstract: According to one embodiment, a network device may be adapted to operate within a virtual private cloud where network address translation (NAT) is performed through virtual machines and each network address translation is handled differently by a different NAT control logic unit. The network device features one or more hardware processors, and a memory that stores at least a plurality of network address translation (NAT) control logic unit and demultiplexer logic. The demultiplexer logic, when executed, receives an incoming message and, based at least in part on information within the incoming message, determines a selected NAT control logic unit to receive at least a portion of the information within the incoming message. The selected NAT control logic unit handles address translation for routing of a message based on the incoming message to a public network.

Abstract: A cloud computing system built in accordance with a repeatable network architecture is disclosed that includes a controller, a first set of spoke gateways and a first transit gateway. The controller is configured to deploy the first set of spoke gateways in a first cloud thereby forming an applications layer of the repeatable network architecture, deploy the first transit gateway in the first cloud thereby forming a global transit layer of the repeatable network architecture, and establish communicative couplings between each of the first set of spoke gateways and the first transit gateway. The controller is also configured to deploy a first set of spoke VPCs within the first cloud, wherein each of the spoke VPCs has deployed therein one of the first set of spoke gateways, and a first transit VPC within the first cloud, wherein the first transit gateway is deployed in the first transit VPC.

Abstract: A controller configured to maintain a global virtual private cloud network (global VPC), which comprises a plurality of regions including a first region and a second region. The first region features at least a first workload and a first spoke subnetwork including a first set of spoke gateways. The second region features at least a second workload and a second spoke subnetwork including a second set of spoke gateways. These sets of spoke gateways are part of the cloud overlay network. Responsive to the first workload operating as a source for transmission of a first message to a first destination external to the global VPC, the logic is configured to (i) direct the first message from the first workload to a spoke gateway of the first set of spoke gateways residing withing the first region and (ii) preclude transmission of the first message to the second spoke subnetwork.

Abstract: A computerized method for restricting communications between virtual private cloud networks comprises creating a plurality of security domains. Each of the plurality of security domains identifies gateways associated with one or more virtual private cloud networks. Also, the method features generating transit routing data stores in accordance with each of the plurality of security domains; determining whether a connection policy exists between at least a first security domain and a second security domain of the plurality of security domains; and precluding communications between gateways associated with the first security domain and gateways associated with the second security domain in response to determining that no connection policy exists between the first security domain and the second security domain.

Abstract: A computerized method for establishing a secure channel between a virtual private network (VPN) client processing on a network device for a user and a network gateway is disclosed. The computerized method includes operations of the controller of transmitting an authentication request to an identity provider based on receipt of a resource request from the VPN client, receiving an authentication response from the identity provider, generating an authentication token based on the authentication response and transmitting the authentication token to the VPN client, wherein the controller further stores the authentication token.

Abstract: In one embodiment, a computing platform features a controller, one or more transit virtual private cloud networks (VPCs), and a plurality of spoke VPCs. Communicatively coupled to the transit virtual VPCs, the spoke VPCs include (i) a first spoke VPC associated with a first security region and (ii) a second spoke VPC associated with a second security region. Herein, the first security region is configured to permit spoke gateways of the first spoke VPC to communicate with each other while precluding communications with spoke gateways associated with another security region absent a connectivity policy being a set of rules established by the administrator/user of the network concerning permitted connectivity between different security regions.

Abstract: A distributed cloud computing system is disclosed that includes a controller configured to deploy a first gateway in a first cloud computing network and a second gateway in a second cloud computing network and logic, stored on non-transitory, computer-medium. The logic, upon execution by one or more processors, causes performance of operations including: transmitting one or more requests to the controller for metadata of at least the first gateway and the second gateway; receiving, from at least one of the first gateway and the second gateway, network data of the corresponding gateway; generating a visualization illustrating the metadata and the network data, wherein the metadata and the network data pertain to multiple cloud computing networks; and causing rendering of the visualization on a display screen of a network device.

Abstract: A multi-cloud overlay network for supporting communications between a first public cloud network and a second public cloud network. The overlay network features a management virtual private network, which includes a network load balancing (NLB) component and a controller registered as a target on a port of the NLB component. The overlay network further includes one or more spoke or transit gateways and a multi-cloud access virtual private cloud (VPC) operating within the first public cloud network, and a remote cloud load balancer component operating the second public cloud network. The remote cloud load balancer component is communicatively coupled between the multi-cloud access VPC and one or more remote spoke or transit gateways. The multi-cloud access VPC includes a VPC endpoint that is assigned a private IP address and communicatively coupled to the NLB component and a virtual private network (VPN) gateway communicatively coupled to a private transport.

Abstract: A distributed cloud computing system is disclosed that includes a controller configured to deploy a first gateway in a first cloud computing network and a second gateway in a second cloud computing network, and a topology system logic, stored on non-transitory, computer-medium, and comprising a topology snapshot logic. Upon execution by one or more processors, the topology system logic causes performance of operations that includes periodically saving states of a plurality of constructs at first and second time states, receiving user input corresponding to a selection of one or more constructs of the plurality of constructs, generating a topology mapping visualization that illustrates differences between the first and second states of the selection of one or more constructs of the plurality of constructs, and causing rendering of the topology mapping visualization on a display screen of a network device.

Abstract: In one embodiment, a controller features a first data store, a second data store and route determination logic. The first data store is configured to store current routing information from a source transit gateway within at least a first transit cloud network to a destination transit gateway within at least a second transit cloud network of the cloud network. Each of the source transit gateway and the destination transit gateway being one of a plurality of transit gateways associated with the cloud network. The second data store is configured to store alternative routing information between the source transit gateway and the destination transit gateway. The route determination logic is configured to (i) conduct analytics on all available route paths for a message intended to be sent from the source transit gateway to the destination transit gateway and (ii) select a best route path for the message.