Abstract: In some embodiments, a method receives, by a first network device, a packet from a first workload that is located in first site. The first site includes stretched networks across a second site and a third site. The packet includes a destination IP address for a device in the second site. The method determines that the destination IP address does not match an eligible route in a routing table. The first workload was migrated from the second site to the first site and is located on a stretched network between the first site and the second site. A site identifier associated with the first workload is determined where the site identifier identifies the second site. The method selects a site policy based on the site identifier and uses the site policy to send the packet through a layer 2 channel to the second network device in the second site.

Abstract: Some embodiments provide a method for an MFE, in a first datacenter, to implement an LN spanning the first datacenter and a set of additional datacenters. The method stores records that each map one or more LN addresses for DCNs belonging to the LN and operating in the first datacenter to a different TEP address. The method stores an additional record that maps addresses for DCNs connected to a particular LFE of the LN and operating in the additional datacenters to a group of TEP addresses corresponding to LN gateways that handle data traffic for the particular LFE between the first datacenter and the additional datacenters. Upon receiving a data message with a destination address corresponding to a DCN connected to the particular LFE and operating in one of the additional datacenters, the method uses the additional record to identify a TEP address for encapsulating the data message.

Abstract: Some embodiments provide a system for implementing a logical network that spans multiple datacenters. The system includes, at each of the datacenters, a set of host computers that execute (i) data compute nodes (DCNs) belonging to the logical network and (ii) managed forwarding elements (MFEs) that implement the logical network to process data messages for the DCNs executing on the host computers. The system also includes, at each of the datacenters, a set of computing devices implementing logical network gateways for logical forwarding elements (LFEs) of the logical network. The logical network gateways are connected to the logical network gateways for the LFEs at the other datacenters. The MFEs executing on the host computers in a first datacenter communicate with the MFEs executing on the host computers in a second datacenter via the logical network gateways of the first and second datacenters.

Abstract: Some embodiments provide a method for implementing a logical network across multiple datacenters. The method receives a configuration for a logical router that handles data traffic between the logical network implemented in the plurality of datacenters and networks external to the logical network. The method, for each datacenter defines (i) an active centralized routing component of the logical router in the datacenter and (ii) a standby centralized routing component of the logical router in the datacenter. The centralized routing components for a particular datacenter handle the data traffic between the logical network in the particular datacenter and the external networks. The active and standby centralized routing components are each assigned to edge computing devices in the datacenter that implement the centralized routing components.

Abstract: Some embodiments provide a method for distributing rules associated with a particular logical network element that is implemented across one or more physical sites. The method uses a set of attributes of a set of elements associated with the particular logical network element to identify a particular set of physical sites spanned by the particular logical network element. The method identifies a set of rules associated with the particular logical network element. The method distributes the identified set of rules to each site of the identified set of physical sites.

Abstract: Some embodiments provide a method for implementing a logical router that spans multiple datacenters. The method receives a configuration for a set of logical switches and a logical router (LR) that (i) handles data traffic between data compute nodes (DCNs) connected to the logical switches and endpoints not connected to the set of logical switches and (ii) performs stateful services on the traffic. The DCNs include at least one DCN operating in each datacenter. For each datacenter, the method defines a centralized routing component (SR) for the LR for handling the traffic between the DCNs in the datacenter and the endpoints not connected to the set of logical switches. The method designates one of the SRs as a primary SR and the other SRs as secondary SRs. The secondary SRs forward traffic, received from DCNs in their respective datacenters and for which stateful services are required, to the primary SR.

Abstract: Some embodiments provide a network management system for managing a logical network that spans multiple physical sites. The network management system includes a global network manager for receiving global logical network configuration data for the multiple physical sites. The network management system includes, at each of the physical sites, (i) a local network manager for receiving a logical network configuration for the physical site from the global network manager and (ii) a set of central controllers for distributing logical network configuration data to computing devices that implement the logical network at the physical site.

Abstract: Some embodiments provide a method for a first network controller executing at a first site of multiple sites spanned by a logical network. Network controllers execute at each site. The method generates logical network state data for the first site based on (i) data received from computing devices that implement the logical network at the first site and (ii) logical network configuration data from a network manager at the first site. The method provides the logical network state data for the first site to a second network controller executing at a second site. The method provides logical network state data received from the second site to the computing devices that implement the logical network at the first site.

Abstract: Some embodiments provide a method for a computing device that implements a first logical network gateway in a first datacenter to process data messages between data compute nodes (DCNs) belonging to the logical network and operating in the first datacenter and DCNs belonging to the logical network and operating in a second datacenter. From a host computer in the first datacenter, the method receives a logical network data message encapsulated with a first tunnel header including a first virtual network identifier corresponding to a logical forwarding element of the logical network. The method removes the first tunnel header and encapsulates the logical network data message with a second tunnel header include a second virtual network identifier corresponding to the logical forwarding element. The method transmits the logical network data message encapsulated with the second tunnel header to a second logical network gateway in the second datacenter.

Abstract: Some embodiments provide a method for proxying ARP requests. At an MFE that executes on a host computer operating at a first site to implement a distributed router along with at least one additional MFE at the first site, the method receives, from a router at a remote second site, an ARP request for an IP address associated with a logical switch that spans the first site and the remote second site, and to which both the distributed router and the router at the remote second site connect. The method determines whether a table that includes IP addresses for a set of DCNs that use the distributed router as a default gateway includes the IP address. When the IP address is in the table, the method proxies the request at the host computer. When the particular IP address is not in the table, the MFE does not proxy the request.

Abstract: Some embodiments provide a method for providing a user interface (UI) for a network management application. The method provides a first UI for accessing a global network manager through the network management application to configure a global logical network spanning multiple physical sites. For each respective site, the method provides an additional UI for accessing a respective local network manager for the site (i) to modify the global logical network at the respective site and (ii) to configure a local logical network at the respective site. The method provides a UI item for toggling between the first UI and the additional UIs. Multiple UI items available in the first UI are also available in the additional UIs.

Abstract: Some embodiments provide a method of operating several logical networks over a network virtualization infrastructure. The method defines a managed physical switching element (MPSE) that includes several ports for forwarding packets to and from a plurality of virtual machines. Each port is associated with a unique media access control (MAC) address. The metho defines several managed physical routing elements (MPREs) for the several different logical networks. Each MPRE is for receiving data packets from a same port of the MPSE. Each MPRE is defined for a different logical network and for routing data packets between different segments of the logical network. The method provides the defined MPSE and the defined plurality of MPREs to a plurality of host machines as configuration data.

Abstract: For a managed network including multiple host machines implementing multiple logical networks, some embodiments provide a method that reduces the memory and traffic load required to implement the multiple logical networks. The method generates configuration data for each of multiple host machines including (i) data to configure a host machine to implement a set of logical forwarding elements that belong to a set of routing domains and (ii) identifiers for each routing domain in the set of routing domains. The method then receives data regarding tunnels endpoints operating on each of the host machines and an association with the routing identifiers sent to the host machines. The method then generates a routing domain tunnel endpoint list for each routing domain based on the data received from each of the host machines including a list of the tunnel endpoints associated with the routing domain which the host machines can use to facilitate packet processing.

Abstract: A physical host machine of a public cloud system includes a set of processing units for executing instructions stored in non-transitory machine readable media. The physical host machine also includes a physical network interface cars (PNIC) and a non-transitory machine readable medium that stores a data compute node (DCN). The DCN includes first and second applications, first and second logical interfaces, a network stack, and a managed forwarding element (MFE). The first application is connected to the pNIC through the network stack, the first logical interface, and the MFE. The second application is connected to the PNIC through the network stack, the second logical interface, and the MFE.

Abstract: Some embodiments provide a method for defining a logical network (LN) that spans multiple sites and is managed at each site by a local manager. At a global manager that manages the logical network, the method creates a tree from a definition of the LN that spans the sites. The tree includes nodes representing elements in the LN and connections between the nodes to express relationships between the elements. Each of at least a subset of nodes has a span attribute identifying sites spanned by an LN element corresponding to the node. The method uses the span attributes to create a parsed tree for each site. Based on the parsed tree of each site, the method identifies a portion of the LN definition that is relevant for the site. The method provides, to the local manager of each site, the portion of the LN definition identified for the site.

Abstract: Some embodiments provide a method for managing a logical network that spans multiple physical sites. The method creates a global tree data structure for defining the logical network. The method adds at least two physical sites to the global tree data structure. The physical sites added to the global tree structure are eligible to be spanned by the logical network. The method adds multiple logical network elements to the global tree data structure. At least a subset of the logical network elements reference the physical sites in the global tree data structure in order to span to the physical sites.

Abstract: Some embodiments provide a method for a global manager that manages a logical network configuration for multiple datacenters that each have a local manager for managing the logical network configuration within the datacenter. Based on detecting that a connection to a particular local manager of a particular datacenter has been restored after a period of unavailability, the method identifies a portion of the logical network configuration that is relevant to the particular datacenter. In a series of transactions, the method transfers the identified portion of the logical network configuration to the particular local manager. During the series of transactions, the method identifies modifications to the identified portion of the logical network configuration to be included in the series of transactions. Upon completion of the series of transactions, the method transfers a notification to the particular local manager indicating completion of the series of transactions.

Abstract: Certain embodiments described herein are generally directed to allocating security parameter index (“SPI”) values to a plurality of endpoints in a network. The SPI values may be derived using an SPI derivation formula and a plurality of parameters. In some embodiments, the SPI values may be derived by an endpoint and in other embodiments by a server. Using the SPI derivation formula and the plurality of parameters enables endpoints and servers to instantaneously derive SPI values without the need for servers to store them.

Abstract: In some embodiments, a method for selecting an egress point for accessing an external network associated with a distributed logical router that is distributed across at least a first computing device and a second computing device is provided. The method receives, by an instance of the logical router at the first computing device, first identification information and a first preference value. The method compares the first preference value to a second preference value. The second preference value is associated with second identification information corresponding to a current computing device that is identified as a current preferred egress point for the logical router. The method determines whether to set the egress point connected to the instance of the logical router in the second computing device as a new preferred egress point for the logical router.

Abstract: A LRE (logical routing element) that have LIFs that are active in all host machines spanned by the LRE as well as LIFs that are active in only a subset of those spanned host machines is provided. A host machine having an active LIF for a particular L2 segment would perform the L3 routing operations for network traffic related to that L2 segment. A host machine having an inactive LIF for the particular L2 segment would not perform L3 routing operations for the network traffic of the L2 segment.