Abstract: Example methods and systems to perform a distributed backup operation or a distributed restoration operation in a virtualized computing environment including a plurality of components and a plurality of policies are disclosed. One method may include identifying a component or a policy of the plurality of components or policies in response to receiving a first task associated with the distributed backup operation or the distributed restoration operation. In response to the first task associated with the distributed backup operation, the method include generating a backup file having a configuration of the component, but not any configuration of other components of the plurality of components, or a configuration of the policy, but not any configuration of other policies of the plurality of policies; and storing the backup file on a remote server.

Abstract: Managing performance metrics includes: obtaining a plurality of performance metrics associated with a plurality of sources on a network; aggregating, at a first rate, the plurality of performance metrics associated with the plurality of sources to generate a plurality of first aggregated results; maintaining at least some of the plurality of first aggregated results in one or more memories; aggregating, at a second rate, the plurality of first aggregated results to generate a plurality of second aggregated results, the second rate being a lower rate than the first rate; and maintaining at least some of the plurality of second aggregated results in the one or more memories.

Abstract: The technology disclosed herein enables multicast network traffic to pass an RPF check in a logical router having separated packet handlers. In a particular embodiment, a method includes, in a north/south packet handler of a first logical router, receiving first network traffic from an east/west packet handler of the logical router. The first network traffic is multicast network traffic and the logical router is a first hop router for the first network traffic from a source of the first network traffic. The method further includes identifying an entry for the source in unicast routing information for unicast network traffic. Identifying the entry indicates that the first network traffic passes a reverse path forwarding (RPF) check. In response to the first network traffic passing the RPF check, the method includes transferring the first network traffic from the north/south packet handler to a next hop for the first network traffic indicated by first multicast routing information.

Abstract: Example methods and systems are provided for location-aware service request handling. The method may comprise: generating and sending location information associated with virtualized computing instance to a service node or a management entity for transmission to the service node. The location information may identify logical element(s) to which the virtualized computing instance is connected. The method may further comprise: in response to detecting, from the virtualized computing instance, a service request for a service from the service node, generating a modified service request by modifying the service request to include the location information associated with the virtualized computing instance; and sending the modified service request towards the service node.

Abstract: Some embodiments provide a method of performing stateful services that keeps track of changes to states of service nodes to update connection tracker records when necessary. At least one global state value indicating a state of the service nodes is maintained at the edge device. The method generates a record in a connection tracker storage including the current global state value as a flow state value for a first data message in a data message flow. Each time a data message is received for the data message flow, the stored state value (i.e., a flow state value) is compared to the relevant global state value to determine if the stored action may have been updated. After a change in the global state value relevant to the flow the method examines a flow programming table to determine if the flow has been affected by a flow programming instruction(s) that caused the global state value to change.

Abstract: Disclosed are various approaches for encrypting documents using mobile devices. A first application receives, from a second application a file and an identifier of a user account. The first application then sends a request for a certificate to a certificate authority and receives a certificate in response. The file is then encrypted using the certificate, and the encrypted file is returned to the second application. The second application can identify the user account as the recipient of a file. Then, the second application can send an encryption request that includes the identifier of the user account and the file to the first application. In response to the request, the second application receives the encrypted file and then provides the encrypted file to the recipient.

Abstract: Some embodiments of the invention provide a method for deploying software-implemented resources in a software defined datacenter (SDDC). The method initially receives a hierarchical API command that, in a declarative format, specifies several operation requests for several software-defined (SD) resources at several resource levels of a resource hierarchy in the SDDC. The method parses the API command to identify the SD resources at the plurality of resource levels. Based on the parsed API command, the method deploys the SD resources by using a deployment process that ensures that any first SD resource on which a second SD resource depends is deployed before the second resource. In some embodiments, a second SD resource depends on a first SD resource when the second SD resource is a child of the first SD resource. Alternatively, or conjunctively, a second SD resource can also depend on a first SD resource in some embodiments when the second SD resource has some operational dependency on the first SD resource.

Abstract: Example methods and computer systems are provided for filter-based packet handling at a virtual network adapter. The method may comprise: receiving an ingress packet destined for the virtualized computing instance that is supported by the host and connected to the virtual network adapter; and matching the ingress packet to one of multiple filters configured for the virtual network adapter. The multiple filters may include a first filter specifying one or more first packet characteristics and a second filter specifying one or more second packet characteristics. The method may also comprise: in response to matching the ingress packet to the first filter, assigning the ingress packet to a first packet queue; and in response to matching the ingress packet to the second filter, assigning the ingress packet to a second packet queue.

Abstract: In an embodiment, a computer-implemented method for using virtual tunnel interface teaming to achieve load balance and redundancy in virtual private networks (“VPNs”) is disclosed. In an embodiment, a method comprises: receiving, by a gateway, configuration data from a control plane; based on the configuration data, configuring on the gateway a bonded virtual tunnel interface (“bonded VTI”) having a plurality of slave virtual tunnel interfaces (“slave VTIs”); configuring a plurality of VPN tunnels between the plurality of slave VTIs configured on the gateway and a plurality of slave VTIs configured on a remote gateway; configuring an IPsec VPN tunnel between the bonded VTI configured on the gateway and a corresponding bonded VTI configured on the remote gateway; logically combining the plurality of VPN tunnels into the IPsec VPN tunnel; and enabling communications of IPsec VPN traffic via the IPsec VPN tunnel.

Abstract: When a failure occurs at a host in a cluster of hosts in a virtualized computing environment, virtualized computing instances that were running on the failed host are restarted on the active host(s) in the cluster. Resources to enable the restart of the virtualized computing instances are made available by powering off virtualized computing instances that are running on the active hosts. Determination of which virtualized computing instances to power off and to power on can be performed based on power off settings and restart priority levels that are configured for the virtualized computing instances.

Abstract: Various examples for providing a dynamic runtime interface for device management are described. In one example, a computing environment can access metadata that describes a configuration of a user interface made in a profile template designer application. The computing environment can identify a request for a profile creator that provides at least one setting for a desired configuration of a client device enrolled with a management service, and, in response to the request being identified, dynamically generate the user interface using the metadata, where the user interface includes a configured to receive the at least one setting for the desired configuration of the client device. The computing environment can generate a configuration profile accessible by the client device that causes an agent application executable on the client device to configure the client device in accordance with the configuration profile.

Abstract: The technology disclosed herein enables packet handling based on user information included in packet headers. In a particular embodiment, a method provides, in a gateway to a network environment, establishing a first connection with a first connection endpoint outside of the network environment. The method further provides identifying first user information associated with the first connection and adding the first user information to a packet header of one or more first packets associated with the first connection. Also, the method provides transferring the one or more first packets into the network environment.

Abstract: Example methods and computer systems are provided for logical overlay network monitoring. The method may comprise: obtaining egress metric information associated with egress encapsulated packets that are sent by a source virtual tunnel endpoint (VTEP) to a destination VTEP over a logical overlay network; and obtaining ingress metric information associated with ingress encapsulated packets that are received by the destination VTEP from the source VTEP over the logical overlay network. The method may also comprise: performing a comparison to identify a divergence between the egress metric information and the ingress metric information; and based on the divergence, detecting a performance issue affecting logical overlay network connectivity between the source VTEP and the destination VTEP.

Abstract: A computer-implemented system and method for identifying stale configurations of a software-defined network (SDN) component uses a configuration export file of the SDN component to generate configuration dependency strands for configurations of the SDN component. The configuration dependency strands can then be classified as being stale based on at least one of path length, reference count and a custom attribute to elements in a network infrastructure for the configuration dependency strands.

Abstract: Persistent connections are provided between components in a container environment. A hypertext transfer protocol (HTTP) client may include a monitoring service and a proxy service. To obtain information regarding containers in the container environment, the monitoring service communicates a request to the proxy service. The proxy service in turn maintains a persistent connection for a session with a container management service using an authentication token, and communicates the request to the container management service during the session. The container management service obtains the requested information from the container(s) and returns the information in a response to the proxy service, which in turn returns the response to the monitoring service. The session is destroyed/ended only under certain error conditions—otherwise, the session between the proxy service and the container management system is kept persistent.

Abstract: Examples described herein include systems and methods for providing network insights on a graphical user interface (“GUI”). The GUI can visualize network errors to help administrative or information technology users more quickly identify issues with an enterprise application. The enterprise application can report network request information to a server. Then the GUI can present visual overlays that compare error metrics between different time cycles of the application. The visual overlay can graphically display these errors on top of one another for immediate relative visualization. Additionally, a grouped list of host destinations can be simultaneously provided. The destination addresses can be abbreviated, and errors grouped accordingly in a manner that provides advantageous error visualization.

Abstract: A method of optimizing network processing in a system comprising a physical host and a set of physical network interface controllers (PNICs) is provided. The physical host includes a forwarding element. The method includes determining that a set of conditions is satisfied to bypass the forwarding element for exchanging packets between a particular data compute node (DCN) and a particular PNIC. The set of conditions includes the particular DCN being the only DCN connected to the forwarding element and the particular PNIC being the only PNIC connected to the forwarding element. The method exchanges packets between the particular DCN and the particular PNIC bypassing the forwarding element. The method determines that at least one condition in said set of conditions is not satisfied. The method utilizes the forwarding element to exchange packets between the particular DCN and the particular PNIC.

Abstract: Examples described herein include systems and methods for bare metal management of computing devices. Firmware of the computing device can be configured to contact a network location as part of an HTTP boot and download a boot agent. The boot agent can be prioritized to execute before a primary OS boot loader. The boot agent can download an OS configuration including a package that is inserted into the primary OS. The primary OS, as configured, can then boot. The boot agent can also attest to OS health and device compliance on subsequent boots. For example, the boot agent can cause the firmware to track how many boots have occurred since compliance verification. If a threshold number of boots occur without verification, the boot agent can initiate restoration. Alternatively, if a decommission flag is set, the boot agent can cause the computing device to boot into its original configuration.

Abstract: Disclosed are various embodiments for creating and managing virtual appliances. A command to create a virtual machine image for a hosted instance of an application image is received. The virtual machine image is created in response to receiving the command. The virtual machine image can include an operating system; a container orchestration service configured to host the instance of the application image; and a configuration service. The configuration service can be configured to at least install a management agent in response to a first boot of the virtual machine and configure the management agent to download and install the application image.

Abstract: Redo logs are used to facilitate efficient cloning of virtual machines. When a virtual machine with a virtual hard disk is to be cloned, two redo logs are created, both of which are linked to the virtual hard disk. The virtual machine being cloned is then linked to one redo log, and a newly created virtual machine is linked to the other. Each time an additional virtual machine is created, two new redo logs are created and linked to the end of the disk chain. The parent and newly created virtual machine are each linked to one of the new redo logs.