Abstract: Techniques for performing distributed rate limiting in networks in a cloud environment are described for determining an amount of network bandwidth available to be processed by flow control nodes within a cloud network for a first time period, determining a bandwidth allocation for traffic classes for the first time period, determining, a portion of the bandwidth allocation for the flow control nodes, providing, data to the flow control nodes, where the data indicates the portion of the bandwidth allocation for the traffic classes, and receiving, second data that indicates an amount of network traffic routed during the first time period by individual ones of the flow control nodes.

Abstract: Techniques for performing distributed rate limiting in networks in a cloud environment are described for determining an amount of network bandwidth available to be processed by flow control nodes within a cloud network for a first time period, determining a bandwidth allocation for traffic classes for the first time period, determining, a portion of the bandwidth allocation for the flow control nodes, providing, data to the flow control nodes, where the data indicates the portion of the bandwidth allocation for the traffic classes, and receiving, second data that indicates an amount of network traffic routed during the first time period by individual ones of the flow control nodes.

Abstract: According to certain implementations, a cloud service provider infrastructure establishes a communication tunnel between an on-premise tunnel endpoint within a customer on-premise environment and a cloud-side tunnel endpoint within the cloud service provider infrastructure. One or more components of the cloud service provider infrastructure monitor this communication tunnel and determine, based on the monitoring, updates to one or more parameters used to implement the communication tunnel at the on-premise tunnel endpoint within the customer on-premise environment. These updates are sent from the cloud service provider infrastructure to an agent installed within the customer on-premise environment, and the agent implements the updates at the on-premise tunnel endpoint. This enables the automatic updating of the on-premise tunnel endpoint by the cloud service provider infrastructure.

Abstract: A configuration helper system (CHS) is described that simplifies the task of generating configuration information for a customer premises equipment (CPE) in a customer's on-premise network to enable the CPE to communicate with the customer's cloud network over a particular communication channel. The CHS is configured to generate configuration information that is customized for the particular CPE and communication channel. Given information about the CPE and the communication channel, the CHS automatically identifies a particular set of configuration parameters to be included in the customized configuration information and determines values for the set of parameters, where some of the values may be provided by the customer. A particular CPE-specific format is determined for the configuration information.

Abstract: A configuration helper system (CHS) is described that simplifies the task of generating configuration information for a customer premises equipment (CPE) in a customer's on-premise network to enable the CPE to communicate with the customer's cloud network over a particular communication channel. The CHS is configured to generate configuration information that is customized for the particular CPE and communication channel. Given information about the CPE and the communication channel, the CHS automatically identifies a particular set of configuration parameters to be included in the customized configuration information and determines values for the set of parameters, where some of the values may be provided by the customer. A particular CPE-specific format is determined for the configuration information.

Abstract: The detection of network communication problems in networks that have multiple end nodes, and multiple transit nodes in between. One or more of the end nodes monitors one or more flows, creates associated flow information including performance information for each flow, and then reports the flow information. A system then estimates, for each of multiple flows within the network, a likely path that network traffic takes through that network. The system might then use performance information for each of the reported flows to identify at least one candidate problem network entity that is common amongst the estimated paths of the at least the subset of the plurality of flows.

Abstract: A configuration helper system (CHS) is described that simplifies the task of generating configuration information for a customer premises equipment (CPE) in a customer's on-premise network to enable the CPE to communicate with the customer's cloud network over a particular communication channel. The CHS is configured to generate configuration information that is customized for the particular CPE and communication channel. Given information about the CPE and the communication channel, the CHS automatically identifies a particular set of configuration parameters to be included in the customized configuration information and determines values for the set of parameters, where some of the values may be provided by the customer. A particular CPE-specific format is determined for the configuration information.

Abstract: Techniques for exposing a subset of hosts on an overlay network, without exposing another subset of hosts on the overlay network, are disclosed. A component associated with an overlay network exposes a subset of hosts on the overlay network to components external to the overlay network. The component exposes the subset of hosts by distributing a mapping between (a) the hosts to-be-exposed and (b) the substrate addresses associated with the hosts. Alternatively, a component external to an overlay network exposes a subset of hosts on the overlay network to additional components external to the overlay network. The component exposes the subset of hosts by distributing a mapping between (a) the hosts to-be-exposed and (b) a substrate address associated with the particular component. In either embodiment, a mapping for hosts to-be-hidden is not distributed.

Abstract: Operations include determining billing for data being transmitted out of an Autonomous System (AS). An internal node in the AS determines billing for a packet transmitted out of the AS based at least on an egress path of the packet. The packet is received at the internal node in the AS The internal node selects an egress path of the packet based on one or more characteristics of the packet. The egress path is mapped directly or indirectly to a billing counter. The billing counter is incremented based on (a) the transmission of the packet on the overlay network to the egress gateway and (b) transmission of the packet out of the AS on the selected egress path.

Abstract: The detection of network communication problems in networks that have multiple end nodes, and multiple transit nodes in between. One or more of the end nodes monitors one or more flows, creates associated flow information including performance information for each flow, and then reports the flow information. A system then estimates, for each of multiple flows within the network, a likely path that network traffic takes through that network. The system might then use performance information for each of the reported flows to identify at least one candidate problem network entity that is common amongst the estimated paths of the at least the subset of the plurality of flows.

Abstract: Techniques for transmitting test traffic on a communication link are disclosed. A computer system includes at least two nodes, interconnected by a particular communication link. A test engine associated with one of the two nodes identifies a level of data traffic being transmitted on the particular communication link. Based on the level of data traffic, the test engine selects a level of test traffic to be transmitted on the particular communication link. The node associated with the test engine transmits the selected level of test traffic on the particular communication link. The test traffic is transmitted concurrently with the data traffic on the particular communication link. The node receiving the test feedback transmits test feedback. Based on the test feedback, the test engine generates test results for the particular communication link. The test engine determines and/or executes a corrective action based on the test results.

Abstract: The detection of network communication problems in networks that have multiple end nodes, and multiple transit nodes in between. One or more of the end nodes monitors one or more flows, creates associated flow information including performance information for each flow, and then reports the flow information. A system then estimates, for each of multiple flows within the network, a likely path that network traffic takes through that network. The system might then use performance information for each of the reported flows to identify at least one candidate problem network entity that is common amongst the estimated paths of the at least the subset of the plurality of flows.

Abstract: Operations include determining billing for data being transmitted out of an Autonomous System (AS). An internal node in the AS determines billing for a packet transmitted out of the AS based at least on an egress path of the packet. The packet is received at the internal node in the AS The internal node selects an egress path of the packet based on one or more characteristics of the packet. The egress path is mapped directly or indirectly to a billing counter. The billing counter is incremented based on (a) the transmission of the packet on the overlay network to the egress gateway and (b) transmission of the packet out of the AS on the selected egress path.

Abstract: Operations include determining billing for data being transmitted out of an Autonomous System (AS). An internal node in the AS determines billing for a packet transmitted out of the AS based at least on an egress path of the packet. The packet is received at the internal node in the AS via a particular overlay network of a plurality of overlay networks. Each overlay network may be associated with a corresponding tenant of a set of tenants. The internal node selects an egress path of the packet based on one or more characteristics of the packet. The egress path and the overlay network are mapped directly or indirectly to a billing counter. The billing counter is incremented based on (a) the transmission of the packet on the overlay network to the egress gateway and (b) transmission of the packet out of the AS on the selected egress path.

Abstract: Operations include executing operations across different third-party computing clouds provided by different vendors. A cloud discovery process allows for a virtual machine, executing on a computing cloud, to discover resources on a different computing cloud provided by a different vendor. The cloud discovery process is implemented by one or more cloud agents executing within third-party clouds. A cloud agent, corresponding to a third-party computing cloud, may use a cross-cloud repository that is maintained by a tenant to discover resources in other third-party computing clouds provided by different vendors. An Application Programming Interface (API) for accessing a particular third-party computing cloud may be exposed to a cloud agent of another third-party computing cloud provided by a different vendor. The cloud agent may trigger operations on the particular third-party computing cloud based on events detected by the cloud agent in the third-party computing cloud corresponding to the cloud agent.

Abstract: Techniques for executing multiple Virtual Private Network (VPN) endpoints associated with an Endpoint Pool Address are disclosed. A VPN endpoint manager determines traffic attributes of traffic addressed to the Endpoint Pool Address. The VPN endpoint manager selects a quantity of VPN endpoints to be executed for processing the traffic based on the traffic attributes. The VPN endpoint manager causes execution of a plurality of VPN endpoints corresponding to the selected quantity. The VPN endpoint manager selects one VPN endpoint, from the VPN endpoint pool, to process each data packet addressed to the Endpoint Pool Address. The VPN endpoint manager may select different VPN endpoints to process data packets of different VPN sessions. The VPN endpoint manager may transfer a VPN session from one VPN endpoint to another VPN endpoint. The VPN endpoints in the VPN endpoint pool operate concurrently to process data packets addressed to the Endpoint Pool Address.

Abstract: Operations include executing operations across different third-party computing clouds provided by different vendors. A cloud discovery process allows for a virtual machine, executing on a computing cloud, to discover resources on a different computing cloud provided by a different vendor. The cloud discovery process is implemented by one or more cloud agents executing within third-party clouds. A cloud agent, corresponding to a third-party computing cloud, may use a cross-cloud repository that is maintained by a tenant to discover resources in other third-party computing clouds provided by different vendors. An Application Programming Interface (API) for accessing a particular third-party computing cloud may be exposed to a cloud agent of another third-party computing cloud provided by a different vendor. The cloud agent may trigger operations on the particular third-party computing cloud based on events detected by the cloud agent in the third-party computing cloud corresponding to the cloud agent.

Abstract: Techniques for executing multiple Virtual Private Network (VPN) endpoints associated with an Endpoint Pool Address are disclosed. A VPN endpoint manager determines traffic attributes of traffic addressed to the Endpoint Pool Address. The VPN endpoint manager selects a quantity of VPN endpoints to be executed for processing the traffic based on the traffic attributes. The VPN endpoint manager causes execution of a plurality of VPN endpoints corresponding to the selected quantity. The VPN endpoint manager selects one VPN endpoint, from the VPN endpoint pool, to process each data packet addressed to the Endpoint Pool Address. The VPN endpoint manager may select different VPN endpoints to process data packets of different VPN sessions. The VPN endpoint manager may transfer a VPN session from one VPN endpoint to another VPN endpoint. The VPN endpoints in the VPN endpoint pool operate concurrently to process data packets addressed to the Endpoint Pool Address.

Abstract: Techniques for exposing a subset of hosts on an overlay network, without exposing another subset of hosts on the overlay network, are disclosed. A component associated with an overlay network exposes a subset of hosts on the overlay network to components external to the overlay network. The component exposes the subset of hosts by distributing a mapping between (a) the hosts to-be-exposed and (b) the substrate addresses associated with the hosts. Alternatively, a component external to an overlay network exposes a subset of hosts on the overlay network to additional components external to the overlay network. The component exposes the subset of hosts by distributing a mapping between (a) the hosts to-be-exposed and (b) a substrate address associated with the particular component. In either embodiment, a mapping for hosts to-be-hidden is not distributed.

Abstract: Operations include determining billing for data being transmitted out of an Autonomous System (AS). An internal node in the AS determines billing for a packet transmitted out of the AS based at least on an egress path of the packet. The packet is received at the internal node in the AS via a particular overlay network of a plurality of overlay networks. Each overlay network may be associated with a corresponding tenant of a set of tenants. The internal node selects an egress path of the packet based on one or more characteristics of the packet. The egress path and the overlay network are mapped directly or indirectly to a billing counter. The billing counter is incremented based on (a) the transmission of the packet on the overlay network to the egress gateway and (b) transmission of the packet out of the AS on the selected egress path.