Abstract: The present disclosure provides for automatic peering between virtual networks, such as virtual private clouds (VPCs). A VPC may be configured to operate in an “auto-peering” mode, allowing for automatic peering to be turned on or off. When auto-peering is turned on, that VPC may seek connections with other VPCs, such as other VPCs matching one or more predefined policies. In addition, the particular VPC with auto-peering turned on may be open to accept connection requests from other VPCs matching one or more predefined policies. The policies for requesting connection may be the same as or different than the policies for accepting connection requests. According to some examples, the VPC may be set to a “listening” mode, in which it is open to peering with any other VPC that matches a predefined policy, but is not actively seeking to establish other connections.

Abstract: A method for scalable event driven auto-diagnosis systems includes obtaining a data packet configured for transmission across a network from a source address to a destination address. The method includes obtaining a list of changes to the network. The method also includes analyzing, based on a network model, the data packet using a plurality of analyzers. The method includes correlating the list of changes to the network and the analysis of the data packet. The method further includes determining, based on the correlation between the list of changes to the network and the analysis of the data packet, a configuration status of the network. The method also includes reporting the configuration status to a user.

Abstract: The present disclosure includes systems, methods, and computer-readable mediums for discovering capabilities of a hardware (HW) accelerator card. A processor may communicate a request for a listing of acceleration services to a HW accelerator card connected to the processor via the communication interface. The HW accelerator card may retrieve the listing from memory and provide a response to the processor that includes a listing of the HW acceleration services provided by the HW accelerator card.

Abstract: A firewall intelligence system, includes a data storage storing a set of firewall rules for a network; a recommendation engine that receives, from a log service, traffic logs detailing traffic for the network and firewall logs detailing the usage of firewall rules in response to the traffic for the network, accesses, from the data storage, the set of firewall rules for the network; processes the set of firewall rules to evaluate the firewall rules against a set of quantitative evaluation rules to determine one or more firewall rule recommendations, wherein each firewall rule recommendation is a recommendation to change at least one of the firewall rules in the set of firewall rules; and a front end API that provides data describing the one or more firewall rule recommendations to a user device.

Abstract: A method for scalable event driven auto-diagnosis systems includes obtaining a data packet configured for transmission across a network from a source address to a destination address. The method includes obtaining a list of changes to the network. The method also includes analyzing, based on a network model, the data packet using a plurality of analyzers. The method includes correlating the list of changes to the network and the analysis of the data packet. The method further includes determining, based on the correlation between the list of changes to the network and the analysis of the data packet, a configuration status of the network. The method also includes reporting the configuration status to a user.

Abstract: A system for simulating network configurations includes data processing hardware and memory hardware in communication with the data processing hardware. The memory hardware stores instructions that when executed on the data processing hardware cause the data processing hardware to perform operations. The operation includes receiving one or more parameter changes for a production network model of a network. The operations also include generating a simulation network model including the one or more parameter changes. Another operation includes analyzing the simulated network flow within the simulation network model. The operations also include generating a report including an impact of the parameter changes on the network. The operations may also include receiving a production network log including a recorded workflow for the production network model and simulating the production workflow of the production network log within the simulation network model to generate a simulated network log.

Abstract: A method includes obtaining a stream of consecutive network configuration snapshots each including network configuration information. The method also includes determining that first network configuration information of a first network configuration snapshot of the network from the stream of consecutive network configuration snapshots for the network is not the same as second network configuration information of a second network configuration snapshot of the network from the stream of consecutive network configuration snapshots for the network. The method also includes generating a reachability differentiation graph that identifies a net change to reachability from the first network configuration information and the second network configuration information based on determining that the first network configuration information is not the same as the second network configuration information.

Abstract: A method includes receiving, from a user device, a reachability request requesting a reachability status of network traffic from a first VM of a VPC to a second VM of the VPC. The method also includes obtaining network configuration information defining a configuration of a network connecting the first VM and the second VM, generating, using the network configuration information associated with the VPC, a simulated path between the first VM and the second VM, and, determining, based on the simulated path, that the second VM is unreachable from the first VM. The method further includes, based on determining that the second VM is unreachable from the first VM, generating a reachability report, the reachability report including each hop of the plurality of hops of the simulated path, and a rationale that the second VM is unreachable from the first VM, and providing the reachability report to the user device.

Abstract: A method includes obtaining a stream of consecutive network configuration snapshots each including network configuration information. The method also includes determining that first network configuration information is the same as second network configuration information. After determining that the first network configuration information is the same as the second network configuration information, the method includes determining that the second network configuration information is not the same as third network configuration information. The method also includes determining a net change in reachability for a network based on a difference in packet reachability. The method also includes determining a policy violation based on the net change in reachability for the network and generating a reachability differentiation report including the policy violation.

Abstract: A firewall intelligence system, includes a data storage storing a set of firewall rules for a network; a recommendation engine that receives, from a log service, traffic logs detailing traffic for the network and firewall logs detailing the usage of firewall rules in response to the traffic for the network, accesses, from the data storage, the set of firewall rules for the network; processes the set of firewall rules to evaluate the firewall rules against a set of quantitative evaluation rules to determine one or more firewall rule recommendations, wherein each firewall rule recommendation is a recommendation to change at least one of the firewall rules in the set of firewall rules; and a front end API that provides data describing the one or more firewall rule recommendations to a user device.

Abstract: A method for providing cloud network reachability analysis includes receiving a reachability query requesting a reachability status of a target including a packet header associated with a data packet. The packet header includes a source IP address and a destination IP address. The method also includes generating one or more simulated forwarding paths for the data packet based on the packet header using a data plane model. Each simulated forwarding path includes corresponding network configuration information. The method includes determining the reachability status of the target based on the one or more simulated forwarding paths and providing the determined reachability status and the one or more simulated forwarding paths to a user device associated with the reachability query which causes the user device to present the network configuration information for each simulated forwarding path.

Abstract: The present disclosure includes systems, methods, and computer-readable mediums for discovering capabilities of a hardware (HW) accelerator card. A processor may communicate a request for a listing of acceleration services to a HW accelerator card connected to the processor via the communication interface. The HW accelerator card may retrieve the listing from memory and provide a response to the processor that includes a listing of the HW acceleration services provided by the HW accelerator card.

Abstract: A firewall intelligence system, includes a data storage storing a set of firewall rules for a network; a recommendation engine that receives, from a log service, traffic logs detailing traffic for the network and firewall logs detailing the usage of firewall rules in response to the traffic for the network, accesses, from the data storage, the set of firewall rules for the network; processes the set of firewall rules to evaluate the firewall rules against a set of quantitative evaluation rules to determine one or more firewall rule recommendations, wherein each firewall rule recommendation is a recommendation to change at least one of the firewall rules in the set of firewall rules; and a front end API that provides data describing the one or more firewall rule recommendations to a user device.

Abstract: The present disclosure includes systems, methods, and computer-readable mediums for discovering capabilities of a hardware (HW) accelerator card. A processor may communicate a request for a listing of acceleration services to a HW accelerator card connected to the processor via the communication interface. The HW accelerator card may retrieve the listing from memory and provide a response to the processor that includes a listing of the HW acceleration services provided by the HW accelerator card.

Abstract: A system for simulating network configurations includes data processing hardware and memory hardware in communication with the data processing hardware. The memory hardware stores instructions that when executed on the data processing hardware cause the data processing hardware to perform operations. The operation includes receiving one or more parameter changes for a production network model of a network. The operations also include generating a simulation network model including the one or more parameter changes. Another operation includes analyzing the simulated network flow within the simulation network model. The operations also include generating a report including an impact of the parameter changes on the network. The operations may also include receiving a production network log including a recorded workflow for the production network model and simulating the production workflow of the production network log within the simulation network model to generate a simulated network log.

Abstract: Aspects of the disclosure provide for a proxyless NAT infrastructure with dynamic port allocation. A proxyless NAT infrastructure is configured to perform NAT between a network of virtual machines (VMs) and a device external to the network, without a device, such as a NAT server or a router, acting as a proxy. A system can include a control plane for provisioning VMs of a network, including configuring each VM to perform NAT and initially assigning a number of ports for communicating with other devices. The control plane maintains a feedback loop-receiving data characterizing port usage and network traffic at ports allocated to the various VMs and scaling the port allocation for each VM based on the received data. The control plane can allocate additional ports as determined to be needed by a VM, and later retrieve the ports to be reused for other VMs.

Abstract: A system for simulating network configurations includes data processing hardware and memory hardware in communication with the data processing hardware. The memory hardware stores instructions that when executed on the data processing hardware cause the data processing hardware to perform operations. The operations includes receiving one or more parameter changes for a production network model of a network. The operations also include generating a simulation network model including the one or more parameter changes. Another operation includes analyzing the simulated network flow within the simulation network model. The operations also include generating a report including an impact of the parameter changes on the network. The operations may also include receiving a production network log including a recorded workflow for the production network model and simulating the production workflow of the production network log within the simulation network model to generate a simulated network log.

Abstract: Aspects of the disclosed technology comprise generating firewall rules based on traffic, outputting the generated firewall rules to an output file, and using the output file to set firewall rules in a network. The firewall rules may be generated without a priori knowledge of the network; alternatively no firewall rules are required. Generated rules may be tuned for user preferences to adjust for the number of generated firewall rules, and their over or under inclusiveness to non-historic traffic data.

Abstract: Aspects of the disclosure provide for a proxyless NAT infrastructure with dynamic port allocation. A proxyless NAT infrastructure is configured to perform NAT between a network of virtual machines (VMs) and a device external to the network, without a device, such as a NAT server or a router, acting as a proxy. A system can include a control plane for provisioning VMs of a network, including configuring each VM to perform NAT and initially assigning a number of ports for communicating with other devices. The control plane maintains a feedback loop—receiving data characterizing port usage and network traffic at ports allocated to the various VMs and scaling the port allocation for each VM based on the received data. The control plane can allocate additional ports as determined to be needed by a VM, and later retrieve the ports to be reused for other VMs.

Abstract: The present disclosure includes systems, methods, and computer-readable mediums for discovering capabilities of local and remote hardware (HW) accelerator cards. A local hardware (HW) accelerator card may provide, via a communication interface, a listing of acceleration services from the local HW accelerator card. The listing of acceleration services may include a first set of acceleration services provided by one or more accelerators of the local HW accelerator card and a second set of acceleration services provided by one or more accelerators of a remote HW accelerator card. A workload instruction defining a workload for processing by at least one of the acceleration services of the second set of acceleration services may be received from a processor of a computing device. The workload instruction may be forwarded to the remote HW accelerator card.