Abstract: Techniques are disclosed for communicating data in a virtualized environment comprising virtual machines executing on one or more computing devices. An underlying physical destination address of a virtual machine executing on a virtual network is changed from a first physical address to a second physical address. A traffic forwarder function is executed on a virtual switch within the virtual network. The traffic forwarder function is executed during a time threshold determined based on a reprogramming time for network devices in the virtualized environment to update the underlying physical destination address. A data packet addressed to the first physical address is by the traffic forwarder function on a network external to the virtual network. A destination address of the data packet is updated from the first physical address to the second physical address. The data packet is forwarded to the updated destination address.

Abstract: The disclosed system implements techniques to enable a tenant of a cloud-based platform to effectively and efficiently apply a policy that copies data packets communicated to or from a virtual machine in the tenant's own virtual network. When applied, the policy mirrors data traffic associated with a workload executing on a virtual machine in the tenant's virtual network. To mirror the data traffic, a copy of a data packet is streamed to another virtual machine so that network analytics can be performed (e.g., performance analytics, security analytics, etc.). In various examples, the policy can be a role-based mirroring policy that defines a plurality of roles in association with a role-based access model that scales operations and that provides improved security for a tenant's virtual network.