Abstract: Some embodiments provide a method for a health monitoring service that monitors a system with a set of services executing across a set of one or more datacenters. For each of multiple services monitored by the health monitoring service, the method (1) contacts an API exposed by the service to provide health monitoring data for the service and (2) receives health monitoring data for the service that provides, for each of multiple aspects of the service, (i) a status and (ii) an explanation for the status in a uniform format used by the APIs of each of the services. At least two different services provide health monitoring data in the uniform format for different groups of aspects of the services.

Abstract: Some embodiments provide a method for a monitoring service that monitors a multi-tenant system with multiple tenant-specific service instances executing in a cloud. For each tenant-specific service instance monitored by the monitoring service, the method collects values for metrics defined in a declarative configuration file for the tenant-specific service instance and compares the collected values to values specified in the declarative configuration file for the metrics to determine whether deployment of other service instances affects operation of the tenant-specific service instance. The metrics in the declarative configuration file are generated based on a service-level agreement for the tenant.

Abstract: Some embodiments provide a method for monitoring a multi-tenant system deployed in a cloud, at a monitoring service deployed in the cloud. The method deploys a first service instance in the cloud for a first tenant that is based on a monitoring service configuration defined by an administrator of the multi-tenant system. The method collects (i) a first set of metrics of the first service instance and (ii) a second set of metrics of a second, existing service instance deployed in the cloud for a second, existing tenant of the multi-tenant system. The method uses the second set of metrics to determine an effect on the second service instance of the deployment of the first service instance.

Abstract: Some embodiments provide a method for providing health status for a system implemented in a network. The method displays, in a graphical user interface (GUI), representations of health status for multiple different services of the system. Each representation for a respective service shows health status for the respective service over a first particular time period. Upon receiving selection of a particular service, the method displays representations of health status data for each of multiple different aspects of the particular service. Each representation for a respective aspect of the service shows operational status for the respective aspect of the service over a second particular time period.

Abstract: Some embodiments provide a method for monitoring a system deployed in a cloud. The method deploys a first health monitoring service that monitors a first set of common services of the system deployed in the cloud by directly communicating with each service in the first set of services to determine whether a respective set of aspects of each respective service are properly operational. The first set of common services are accessed by multiple tenants of the system. Within each respective tenant-specific service instance of multiple tenant-specific service instances deployed in the cloud for the tenants, the method deploys a respective health monitoring service that monitors a respective group of microservices of the service instance by directly communicating with each microservice of the tenant-specific service instance to determine whether a respective set of aspects of each respective microservice are properly operational.

Abstract: Some embodiments provide a method for a health monitoring service that monitors a system with a set of services executing across a set of one or more datacenters. For each of multiple services monitored by the health monitoring service, the method (1) contacts an API exposed by the service to provide health monitoring data for the service and (2) receives health monitoring data for the service that provides, for each of multiple aspects of the service, (i) a status and (ii) an explanation for the status in a uniform format used by the APIs of each of the services. At least two different services provide health monitoring data in the uniform format for different groups of aspects of the services.

Abstract: Techniques are described to provide layer 2 (L2) circuit failover in the event connectivity to an Ethernet Virtual Private Network (EVPN) instance is lost. For example, if one of multi-homed provider edge (PE) devices loses connectivity to the EVPN instance, the PE device may mark its customer-facing interface as down and propagate the interface status to the access node such that the access node may update its routing information to switch L2 circuits to another one of the multi-homed PE devices having reachability to the EVPN instance. In some examples, the plurality of PE devices may further implement Connectivity Fault Management (CFM) techniques to propagate the interface status to the access node such that the access node may update its forwarding information to send traffic on a different L2 circuit to another one of the multi-homed PE devices having reachability to the EVPN instance.

Abstract: Techniques are described to provide layer 2 (L2) circuit failover in the event connectivity to an Ethernet Virtual Private Network (EVPN) instance is lost. For example, if one of multi-homed provider edge (PE) devices loses connectivity to the EVPN instance, the PE device may mark its customer-facing interface as down and propagate the interface status to the access node such that the access node may update its routing information to switch L2 circuits to another one of the multi-homed PE devices having reachability to the EVPN instance. In some examples, the plurality of PE devices may further implement Connectivity Fault Management (CFM) techniques to propagate the interface status to the access node such that the access node may update its forwarding information to send traffic on a different L2 circuit to another one of the multi-homed PE devices having reachability to the EVPN instance.

Abstract: Techniques are described to provide layer 2 (L2) circuit failover in the event connectivity to an Ethernet Virtual Private Network (EVPN) instance is lost. For example, if one of multi-homed provider edge (PE) devices loses connectivity to the EVPN instance, the PE device may mark its customer-facing interface as down and propagate the interface status to the access node such that the access node may update its routing information to switch L2 circuits to another one of the multi-homed PE devices having reachability to the EVPN instance. In some examples, the plurality of PE devices may further implement Connectivity Fault Management (CFM) techniques to propagate the interface status to the access node such that the access node may update its forwarding information to send traffic on a different L2 circuit to another one of the multi-homed PE devices having reachability to the EVPN instance.

Abstract: Techniques are disclosed for an Ethernet Virtual Private Network (EVPN) Virtual Private Wire Service (VPWS) network with service interface-aware forwarding. In one example, a first network device signals to a second network device, using EVPN route advertisements, a multi-service service tunnel to transport network packets for a plurality of services. The services are identifiable by virtual local area network (VLAN) identifiers in the packets. The first network device is configured with a single transport interface for the service tunnel and the single transport interface is configured with respective service interfaces for the services. The first network device detects failure of a failed service interface of the service interfaces and outputs, in response to the failure, an EVPN route withdrawal message for the service tunnel that identifies the service corresponding to the failed service interface.

Abstract: The techniques describe detecting connectivity failure of an aggregated interface. To monitor connectivity of the aggregated interface, a packet processor of a plurality of packet processors is set as a session master responsible for managing an active forwarding plane connectivity detection session with a peer session master node. The other local packet processors of the virtual network node are selected as session standby nodes that each have a passive forwarding plane connectivity detection session running to the peer session master node. If a session master node goes down (i.e., by link or node failure), one of the local session standby nodes may detect the failure and is set as a new session master node by activating its passive session having the same session parameters.

Abstract: The techniques describe forwarding multicast traffic using a multi-level cache in a network device forwarding plane for determining a set of outgoing interfaces of the network device on which to forward the multicast traffic. For example, a multi-level cache is configured to store a multicast identifier of a multicast packet and multicast forwarding information associated with the multicast identifier, such as identification of one or more egress packet processors of the network device to which the multicast packet is to be sent for forwarding to the set of one or more egress network devices, and/or outgoing interfaces of the network device toward each egress network device of the set of one or more egress network devices. The multi-level cache is also configured to store respective multicast identifiers that are to be encapsulated with outgoing multicast packets that are forwarded to the set of one or more egress network devices.

Abstract: Techniques are described for providing targeted selection of cascade ports of an aggregation device. In one example, the disclosed techniques enable dynamic assignment of active and backup cascade ports of an aggregation device for each extended port of satellite devices. In this example, rather than allocating resources for each of the extended ports of the satellite devices on all of the cascade ports of the aggregation device, the aggregation device instead allocates resources for each of the extended port only on the assigned active and backup cascade ports for the respective one of the extended ports of the satellite devices. The techniques are also described for providing traffic steering to a backup cascade port in the event the assigned active cascade port is unreachable, and, if the cascade port remains unreachable for a specified duration, the aggregation device may assign new active and backup cascade ports for the extended port.

Abstract: The techniques describe a network device comprising one or more processors configured to: receive configuration data configuring a plurality of virtual network nodes, wherein the configuration data configures a virtual client node including a corresponding line card having a port connected to a first customer network device, and configures a virtual core node including a corresponding line card having a port connected to a core network; provision a layer-2 (L2) circuit that includes, as an access interface, an interface logically connecting the virtual client node and virtual core node, wherein the L2 circuit provides connectivity between the virtual client node and a remote virtual client node; and forward, via the L2 circuit, packets between the virtual client node and the remote virtual client node to realize a logical network between the first customer network device and a second customer network device connected to the remote virtual PE node.

Abstract: A network device selects a primary source for multicast traffic and a secondary source for the multicast traffic, where the multicast traffic is provided to endpoint devices communicating with a network, and where the primary source and the secondary source are redundant sources. The network device provides a first join request that includes information that causes a primary path to be provided from the primary source through the network. The network device provides a second join request that includes information that causes a secondary path to be provided from the secondary source through the network. The network device receives the multicast traffic from the primary source via the primary path and the secondary source via the secondary path, and provides the multicast traffic received from the primary source to the endpoint devices. The network device prevents the multicast traffic received from the secondary source from reaching the endpoint devices.

Abstract: Techniques are disclosed for an Ethernet Virtual Private Network (EVPN) Virtual Private Wire Service (VPWS) network with service interface-aware forwarding. In one example, a first network device signals to a second network device, using EVPN route advertisements, a multi-service service tunnel to transport network packets for a plurality of services. The services are identifiable by virtual local area network (VLAN) identifiers in the packets. The first network device is configured with a single transport interface for the service tunnel and the single transport interface is configured with respective service interfaces for the services. The first network device detects failure of a failed service interface of the service interfaces and outputs, in response to the failure, an EVPN route withdrawal message for the service tunnel that identifies the service corresponding to the failed service interface.

Abstract: The techniques describe adaptive load-balancing based on traffic feedback from packet processors. In one example, a source virtual network node of the network device may determine whether a particular destination packet processor is or may become oversubscribed. For example, source packet processors of the source virtual network node may exchange feedback messages including traffic flow rate information. The source virtual network node may compute a total traffic flow rate and compare the total traffic flow rate with a bandwidth of the particular destination packet processor. In response to determining that the bandwidth of the destination packet processor is oversubscribed, the source virtual network node may update a forwarding plane data structure to reduce a likelihood of selecting the destination packet processor to which to forward packet flows.

Abstract: Techniques are described to provide layer 2 (L2) circuit failover in the event connectivity to an Ethernet Virtual Private Network (EVPN) instance is lost. For example, if one of multi-homed provider edge (PE) devices loses connectivity to the EVPN instance, the PE device may mark its customer-facing interface as down and propagate the interface status to the access node such that the access node may update its routing information to switch L2 circuits to another one of the multi-homed PE devices having reachability to the EVPN instance. In some examples, the plurality of PE devices may further implement Connectivity Fault Management (CFM) techniques to propagate the interface status to the access node such that the access node may update its forwarding information to send traffic on a different L2 circuit to another one of the multi-homed PE devices having reachability to the EVPN instance.

Abstract: Techniques are disclosed for an Ethernet Virtual Private Network (EVPN) Virtual Private Wire Service (VPWS) network with service interface-aware forwarding. In one example, a first network device signals to a second network device, using EVPN route advertisements, a multi-service service tunnel to transport network packets for a plurality of services. The services are identifiable by virtual local area network (VLAN) identifiers in the packets. The first network device is configured with a single transport interface for the service tunnel and the single transport interface is configured with respective service interfaces for the services. The first network device detects failure of a failed service interface of the service interfaces and outputs, in response to the failure, an EVPN route withdrawal message for the service tunnel that identifies the service corresponding to the failed service interface.

Abstract: The techniques describe packet reordering for packets flowing on a new path in response to a change in internal forwarding paths in a network device. For example, a network device may dynamically change the selection of an internal forwarding path to achieve fabric path optimization (“OFP”) or to ensure optimized load balancing. Packets forwarded on the new path are buffered such that the transmission of packets forwarded on the new path are delayed for a buffering time period of at least the time in which a packet is being sent from the source packet processor to the initial destination packet processor.