Abstract: The disclosure provides an approach for load balancing requests among data centers based on one or more environmental impact factors of the data centers. A method of load balancing requests among data centers is provided. The method includes receiving, at a load balancer from a client, a service request. The method further includes selecting, by the load balancer, a first data center of a plurality of data centers based on one or more environmental impact factors associated with each of the plurality of data centers. The method further includes causing the service request to be serviced by the selected first data center.

Abstract: An example method of file transfer between a client and a server includes: initiating, by the client, a front-end control connection between the client and a horizontally scaled proxy service; creating, by a first proxy instance of a plurality of proxy instances of the horizontally scaled proxy service, a back-end control connection between the first proxy instance and the server; returning, to the client from the first proxy instance, a unique client parameter associated with the front-end connection as a destination port for a front-end data connection; initiating, by the client, the front-end data connection between the client and the horizontally scaled proxy service, the front-end data connection using the destination port as returned by the first proxy instance; and creating, by the first proxy instance, a back-end data connection between the first proxy instance and the server.

Abstract: Some embodiments provide a method that, at a first domain name system (DNS) cluster of a set of DNS clusters, receives a DNS request from a client. The first DNS cluster identifies, based on an identifier of the client in the DNS request, a home DNS cluster of the client. The method forwards the DNS request to the home DNS cluster. The home DNS cluster supplies a DNS response to the client. Identifying the home DNS cluster, in some embodiments, includes performing a hash on the identifier of the client. Supplying the DNS response, in some embodiments, includes receiving a virtual IP (VIP) address associated with one of a plurality of sets of application servers to the client and providing the received VIP address to the client in the DNS response.

Abstract: Example methods and systems for application security enforcement are described. In one example, a computer system may detect, from a client device, a packet requiring processing by a first server pool; and determine whether the packet is associated with a security attack. In response to determination that the packet is not associated with the security attack, the packet may be steered towards the first server pool to cause processing of the packet by one of multiple first application servers. Otherwise, the packet may be steered towards a second server pool to cause processing of the packet by one of multiple second application servers and to learn attack information associated with the security attack. The multiple second application servers in the second server pool may be capable of mimicking behavior of the multiple first application servers in the first server pool.

Abstract: Some embodiments provide a method that, at a first domain name system (DNS) cluster of a set of DNS clusters, receives a DNS request from a client. The first DNS cluster identifies, based on an identifier of the client in the DNS request, a home DNS cluster of the client. The method forwards the DNS request to the home DNS cluster. The home DNS cluster supplies a DNS response to the client. Identifying the home DNS cluster, in some embodiments, includes performing a hash on the identifier of the client. Supplying the DNS response, in some embodiments, includes receiving a virtual IP (VIP) address associated with one of a plurality of sets of application servers to the client and providing the received VIP address to the client in the DNS response.

Abstract: Some embodiments provide a method that, at a first domain name system (DNS) cluster of a set of DNS clusters, receives a DNS request from a client. The first DNS cluster identifies, based on an identifier of the client in the DNS request, a home DNS cluster of the client. The method forwards the DNS request to the home DNS cluster. The home DNS cluster supplies a DNS response to the client. Identifying the home DNS cluster, in some embodiments, includes performing a hash on the identifier of the client. Supplying the DNS response, in some embodiments, includes receiving a virtual IP (VIP) address associated with one of a plurality of sets of application servers to the client and providing the received VIP address to the client in the DNS response.

Abstract: The method of some embodiments forwards packets to a destination node executing on a host computer. The method identifies a set of one or more attributes associated with a set of one or more packets of a data flow. Based on the identified set of attributes, the method dynamically specifies a set of parameters for aggregating, for the destination node, payloads of multiple groups of packets of the data flow. The method creates, according to the set of parameters, an aggregate packet for each group of packets and then forwards each aggregate packet to the destination node. In some embodiments, aggregating each group of packets includes setting headers for each aggregate packet, forwarded to the destination node, where the headers for each aggregate packet correspond to headers of the group of packets.

Abstract: Some embodiments of the invention provide a method of deploying a tenant deployable element to one public cloud. The method identifies first and second candidate resource elements respectively of first and second resource element sub-types to deploy in a public cloud to implement the tenant deployable element. The method identifies, for the first and second candidate resource elements respectively first and second sets of performance metric values to evaluate. The method evaluates the identified first and second sets of metrics to select one candidate resource element to implement the tenant deployable element in the public cloud. The method uses the selected resource element to implement the tenant deployable element in the public cloud.

Abstract: Some embodiments of the invention provide a method for evaluating multiple candidate resource elements that are candidates for deploying a set of one or more tenant deployable elements in a public cloud. For each particular tenant deployable element, the method deploys in the public cloud at least one instance of each of a set of one or more candidate resource elements and at least one agent to execute on the deployed resource element instance. The method communicates with each deployed agent to collect metrics for quantifying performance of the agent's respective resource element instance. The method then aggregates the collected metrics in order to generate a report that quantifies performance of each candidate resource element in the set of candidate resource elements for deploying the particular tenant deployable element in the public cloud.

Abstract: Some embodiments of the invention provide a method of deploying first and second tenant deployable elements to a set of one or more public clouds, the first and second tenant deployable elements being different types of elements. The method identifies first and second sets of performance metrics respectively for first and second sets of candidate resource elements to use to deploy the first and second tenant deployable elements, the two sets of performance metrics being different sets of metrics because the first and second tenant deployable elements being different types of elements, the first set of performance metrics having at least one metric that is not included in the second set of performance metrics.

Abstract: Some embodiments of the invention provide a method for evaluating multiple candidate resource elements associated with different resource element types for deploying one tenant deployable element in a single public cloud. The method deploys a set of one or more agents in the public cloud to collect metrics evaluating performance of each of the multiple candidate resource elements. The method communicates with the set of deployed agents to collect metrics to quantify performance of each candidate resource element. The method aggregates the collected metrics in order to generate a report that quantifies performance of each type of candidate resource element for deploying the tenant deployable element in the single public cloud.

Abstract: Some embodiments of the invention provide a method of adjusting deployment of a set of resource elements in a public cloud. The method deploys agents on a first set of resource elements in the public cloud. The method communicates with the deployed agents to generate performance metrics regarding the first set of resource elements. The method analyzes the performance metrics to determine that a deployment of a second set of resource elements in the public cloud has to be modified. The method modifies the deployment of the second set of resource elements based on the analysis.

Abstract: Some embodiments provide a method that, at a first domain name system (DNS) cluster of a set of DNS clusters, receives a DNS request from a client. The first DNS cluster identifies, based on an identifier of the client in the DNS request, a home DNS cluster of the client. The method forwards the DNS request to the home DNS cluster. The home DNS cluster supplies a DNS response to the client. Identifying the home DNS cluster, in some embodiments, includes performing a hash on the identifier of the client. Supplying the DNS response, in some embodiments, includes receiving a virtual IP (VIP) address associated with one of a plurality of sets of application servers to the client and providing the received VIP address to the client in the DNS response.

Abstract: Some embodiments provide a method that, at a first domain name system (DNS) cluster of a set of DNS clusters, receives a DNS request from a client. The first DNS cluster identifies, based on an identifier of the client in the DNS request, a home DNS cluster of the client. The method forwards the DNS request to the home DNS cluster. The home DNS cluster supplies a DNS response to the client. Identifying the home DNS cluster, in some embodiments, includes performing a hash on the identifier of the client. Supplying the DNS response, in some embodiments, includes receiving a virtual IP (VIP) address associated with one of a plurality of sets of application servers to the client and providing the received VIP address to the client in the DNS response.

Abstract: Some embodiments provide a method for generating a test traffic configuration for testing a first network. From a second network, the method receives a set of data streams representing data traffic observed in the second network. The method uses a machine learning engine to analyze the set of data streams in order to determine traffic patterns in the second network. The method generates the test traffic configuration for testing the first network by replicating the traffic patterns of the second network in the first network.

Abstract: Some embodiments of the invention provide a method of deploying tenant deployable elements on resource elements in public cloud datacenters. The method receives a request to deploy a particular tenant deployable element in one of a first public cloud datacenter (PCD) and a second PCD, the first public cloud datacenter belonging to a first cloud service provider (CSP) and the second public cloud datacenter belonging to a second CSP. For each candidate resource element in the first PCD, the method identifies a first set of performance metrics associated with the candidate resource element. For each candidate resource element in the second PCD, the method identifies a second set of performance metrics associated with the candidate resource element. The method evaluates the identified first and second sets of metrics to select a resource element to implement the particular tenant deployable element in one of the first and second PCDs.

Abstract: Example methods and systems for capability-aware service request distribution are described. In one example, a network element may obtain a set of capability information associated with multiple load balancers capable of service request handling and identify varying capability levels among the multiple load balancers. The network element may assign unequal path cost information to the multiple load balancers to indicate the varying capability levels. The unequal path cost information may include (a) a first path cost that is assigned to the first load balancer; and (b) a second path cost that is assigned to the second load balancer and different to the first path cost to indicate the lower capability level of the second load balancer compared to the first load balancer. In response to detecting a service request, the service request may be steered towards one of the multiple load balancers based on the unequal path cost information.

Abstract: Some embodiments provide a method for generating a test traffic configuration for testing a first network. From a second network, the method receives a set of data streams representing data traffic observed in the second network. The method uses a machine learning engine to analyze the set of data streams in order to determine traffic patterns in the second network. The method generates the test traffic configuration for testing the first network by replicating the traffic patterns of the second network in the first network.

Abstract: Example methods and systems for application security enforcement are described. In one example, a computer system may detect, from a client device, a packet requiring processing by a first server pool; and determine whether the packet is associated with a security attack. In response to determination that the packet is not associated with the security attack, the packet may be steered towards the first server pool to cause processing of the packet by one of multiple first application servers. Otherwise, the packet may be steered towards a second server pool to cause processing of the packet by one of multiple second application servers and to learn attack information associated with the security attack. The multiple second application servers in the second server pool may be capable of mimicking behavior of the multiple first application servers in the first server pool.

Abstract: Example methods and systems for capability-aware service request distribution are described. In one example, a network element may obtain a set of capability information associated with multiple load balancers capable of service request handling and identify varying capability levels among the multiple load balancers. The network element may assign unequal path cost information to the multiple load balancers to indicate the varying capability levels. The unequal path cost information may include (a) a first path cost that is assigned to the first load balancer; and (b) a second path cost that is assigned to the second load balancer and different to the first path cost to indicate the lower capability level of the second load balancer compared to the first load balancer. In response to detecting a service request, the service request may be steered towards one of the multiple load balancers based on the unequal path cost information.