Abstract: Some embodiments of the invention provide novel methods for providing transparent services for multicast data messages traversing a network edge device operating at a boundary between two networks. The method analyzes data messages received at the network edge device to determine whether they require a service provided at the boundary and whether they are unicast or multicast (including broadcast). The method modifies a multicast destination media access control (MAC) address of a multicast data message requiring a service to be a unicast destination MAC address and provides, without processing by a standard routing function, the modified data message directly to an interface associated with a service node that provides the particular service required by the data message. The method receives the serviced data message, restores the multicast destination MAC address, and forwards the serviced data message to a set of destinations associated with the multicast destination address.

Abstract: Some embodiments of the invention provide a method for migrating a machine on a first host computer to a second host computer. At the first host computer, the method gathers a set of service insertion data used by a first service insertion module executing on the first host computer to identify a particular chain of multiple services that a set of multiple service nodes have to perform on a particular data message flow associated with the machine. To the second host computer, the method sends a set of machine configuration data and the set of service insertion data. The second host computer (1) uses the machine configuration data to deploy the machine on the second host computer and (2) uses the gathered set of service insertion data to configure a second service insertion module executing on the second host computer to identify the particular chain of two or more services.

Abstract: Some embodiments provide a method for migrating a service machine between two hosts. The method configures a first host (1) to gather service machine data associated with the service machine executing on the first host and (2) to send the gathered service machine data to the second host. Each host executes a software forwarding element to implement a distributed forwarding element (DFE) that implements a dedicated service forwarding plane that forwards data messages associated with guest machines to the services machines. The method configures the second host to use the received service machine data to deploy the service machine on the second host and to connect the deployed service machine to the DFE. The method configures the DFE to forward data messages associated with a guest machine executing on a third host, and addressed to the service machine to the second host instead of the first host.

Abstract: A method for monitoring several data compute nodes (DCNs) on a group of managed host machines is provided. The method receives service usage data from a group of managed hosts. The service usage data identifies service usage for each of a plurality of entities associated with each managed host. The method aggregates the received service usage data. The method displays the aggregated service usage data.

Abstract: The disclosure provides an approach for computing service paths for a service chain identifying a sequence of services. One method includes including information about a plurality of hosts in a heap. Each of the plurality of hosts includes at least one service virtual computing instance (SVCI) configured to provide at least one of the services of the service chain. The information includes, for each of the plurality of hosts, a number of service paths computed for the service chain at the host and one of a number of services provided by unused SVCIs of the host or a number of consecutive services provided by unused SVCIs of the host. The method further includes selecting a host from the heap based on the information. The method further includes generating a first service path for the service chain, the first service path identifying at least one SVCI of the selected host.

Abstract: Some embodiments provide novel methods for performing services for machines operating in one or more datacenters. For instance, for a group of related guest machines (e.g., a group of tenant machines), some embodiments define two different forwarding planes: (1) a guest forwarding plane and (2) a service forwarding plane. The guest forwarding plane connects to the machines in the group and performs L2 and/or L3 forwarding for these machines. The service forwarding plane (1) connects to the service nodes that perform services on data messages sent to and from these machines, and (2) forwards these data messages to the service nodes. In some embodiments, the guest machines do not connect directly with the service forwarding plane. For instance, in some embodiments, each forwarding plane connects to a machine or service node through a port that receives data messages from, or supplies data messages to, the machine or service node.

Abstract: Some embodiments provide a novel method for distributing data message flows among multiple service nodes that provide a particular service in a managed network. In some embodiments, the service nodes provide an edge service at an edge device (e.g., a gateway) of the managed network. The method collects a set of attributes from each service node of the multiple service nodes regarding the service node from which the set of attributes are collected. The collected attributes may include usage statistics, characteristics of the service nodes, and characteristics of the connections to the service nodes. The collected attributes are used to compute a score (e.g., a weight or priority) for each service node. Based on the policy and the computed scores, a set of rules and tables are generated to distribute the data message flows to the service nodes to implement the policy.

Abstract: Some embodiments provide novel methods for performing services for machines operating in one or more datacenters. For instance, for a group of related guest machines (e.g., a group of tenant machines), some embodiments define two different forwarding planes: (1) a guest forwarding plane and (2) a service forwarding plane. The guest forwarding plane connects to the machines in the group and performs L2 and/or L3 forwarding for these machines. The service forwarding plane (1) connects to the service nodes that perform services on data messages sent to and from these machines, and (2) forwards these data messages to the service nodes. In some embodiments, the guest machines do not connect directly with the service forwarding plane. For instance, in some embodiments, each forwarding plane connects to a machine or service node through a port that receives data messages from, or supplies data messages to, the machine or service node.

Abstract: Some embodiments provide a method for forwarding a data message. The method performs a lookup to map a set of header fields of the data message to an identifier corresponding to a service that performs non-forwarding processing on data messages. The method uses a dynamically-updated data structure for the identifier to retrieve instructions for forwarding data messages to the service. The method forwards the data message according to the retrieved instructions from the data structure for the identifier.

Abstract: For a network including multiple host machines that together implement at least one logical network including a firewall, some embodiments provide a method for collecting traffic flow data that includes identifiers for firewall rules applied to the traffic flow and a logical entity identifier. In some embodiments, the host machines receive traffic monitoring configuration data for a logical network. The traffic monitoring configuration data in some embodiments indicates a set of logical entities of the logical network for which to collect traffic flow data and a set of traffic flow data collectors associated with the set of logical entities. The indicated logical entities may be logical forwarding elements (logical switches, routers, etc.) or logical ports of logical forwarding elements.

Abstract: Example methods and systems for connectivity check with service insertion have been disclosed. One example may comprise a computer system receiving a connectivity check packet that is injected for forwarding along a service path between a source virtualized computing instance and a destination virtualized computing instance. In response to detecting a connectivity issue associated with the service path, first report information identifying the first service virtualized computing instance and an observation that the connectivity check packet is dropped may be generated and sent. Otherwise, the connectivity check packet may be forwarded towards a second virtualized computing instance, being a next-hop on the service path, or the destination virtualized computing instance. Second report information identifying the first service virtualized computing instance and an observation that the connectivity check packet is forwarded may be generated and sent.

Abstract: In an embodiment, a method for a VRF and multi-service insertion on edge gateways is described. In an embodiment, the method comprises obtaining a rule configuration. Based on, at least in part, the rule configuration, a rule table is created. The rule table comprises rule data records, wherein a rule data record comprises packet attributes and a redirection identifier. A policy configuration comprising policy records is obtained. Each policy record comprises a redirection identifier, a next_hop, and an address pair for interfaces. A mapping between VRF identifiers and address pairs is generated. Based on, at least in part, the mapping and the policy configuration, a policy table is generated. The policy table comprises table records, wherein a table record comprises a redirection identifier, a next_hop, and an address pair. The rule and policy tables are used to redirect a packet from an edge gateway to a service virtual machine.

Abstract: Some embodiments provide novel methods for performing services for machines operating in one or more datacenters. For instance, for a group of related guest machines (e.g., a group of tenant machines), some embodiments define two different forwarding planes: (1) a guest forwarding plane and (2) a service forwarding plane. The guest forwarding plane connects to the machines in the group and performs L2 and/or L3 forwarding for these machines. The service forwarding plane (1) connects to the service nodes that perform services on data messages sent to and from these machines, and (2) forwards these data messages to the service nodes. In some embodiments, the guest machines do not connect directly with the service forwarding plane. For instance, in some embodiments, each forwarding plane connects to a machine or service node through a port that receives data messages from, or supplies data messages to, the machine or service node.

Abstract: In an embodiment, a method for a VRF and multi-service insertion on edge gateways is described. In an embodiment, the method comprises: detecting a packet; determining attributes for the packet; based on the attributes, determining whether the attributes match one or more rule attributes of a particular rule in a rule table; in response to determining that the attributes match the one or more rule attributes of a particular rule in the rule table: determining, based on the particular rule, a particular redirection identifier, a particular VRF identifier, a particular next_hop, a particular address pair, and a particular BFD status; based on the particular BFD status, determining whether to redirect the packet; and in response to determining to redirect the packet, redirecting the packet toward a service virtual machine from an interface indicated by one of addresses in the particular address pair.

Abstract: Some embodiments provide a novel method for configuring a service data compute node (DCN) executing on a host computer to perform network services (e.g., firewall, load balancing, intrusion detection, network address translation (NAT), other middlebox services, etc.) for several DCNs executing on the host computer. The method receives, at the service DCN, an identification of a set of container specifications that will be implemented (e.g., will be executed by) the service DCN. The method then retrieves the identified set of container specifications (e.g., container images) from a container repository storing multiple received container specifications. In some embodiments, the container specifications include container images generated by a third party service partner for providing a particular service or set of services and stored in a container repository. The method then instantiates the retrieved containers to provide the identified network services to data messages received at the service DCN.

Abstract: Some embodiments provide a method for assigning different service path identifiers to each of a set of different service paths along each of which a same set of service operations are performed on a set of packets. The method retrieves an available service path identifier from an identifier storage that stores service path identifiers for multiple service paths. The method generates a set of proposed service path identifiers based on the retrieved available service path identifier and the number of service paths in the set of service paths. The method performs a write operation on the identifier storage based on the set of proposed service path identifiers, and based on a determination that the write operation was successful, assigns the set of proposed service path identifiers to the set of service paths. Based on the set of service path identifiers, the method forwards the set of packets along the set of service paths.

Abstract: Some embodiments provide a method for troubleshooting a virtual network that is implemented across a plurality of computing devices. The method provides a command line interface (CLI) for receiving and executing commands for debugging and monitoring the virtual network. Each command is for communicating with a set of the computing devices in order to monitor a network service being provided by the set of computing devices. The CLI operates in multiple different contexts for monitoring multiple different types of network services. While the CLI is operating in a particular context for a particular type of network service, the method receives a command comprising a set of identifiers. The method determines the validity of the received command under the particular context. When the received command is valid under the particular context, the method transmits data to a computing device identified by the received command.

Abstract: Methods, computer-readable storage medium, and systems described herein facilitate registering and consuming network services on a virtual network. A virtual machine management server (VMMS) is configured to receive a service definition associated with a network service. The VMMS creates one or more service profiles based on the service definition. The VMMS configures a plurality of hosts based on the one or more service profiles such that the network service is usable, via a virtual network, by one or more virtual machines within the plurality of hosts.

Abstract: Some embodiments provide a method for clustering a set of data compute nodes (DCNs), which communicate with each other more frequently, on one or more host machines. The method groups together guest DCNs (GDCNs) that (1) execute on different host machines and (2) exchange network data among themselves more frequently, in order to reduce interhost network traffic. The more frequently-communicating GDCNs can be a set of GDCNs that implement a distributed application, GDCNs of a particular tier in a multi-tier network architecture (e.g., a web tier in a three-tier architecture), GDCNs that are dedicated to a particular tenant in a hosting system, or any other set of GDCNs that exchange data among each other regularly for a particular purpose.

Abstract: Some embodiments provide a method for assigning different service path identifiers to each of a set of different service paths along each of which a same set of service operations are performed on a set of packets. The method retrieves an available service path identifier from an identifier storage that stores service path identifiers for multiple service paths. The method generates a set of proposed service path identifiers based on the retrieved available service path identifier and the number of service paths in the set of service paths. The method performs a write operation on the identifier storage based on the set of proposed service path identifiers, and based on a determination that the write operation was successful, assigns the set of proposed service path identifiers to the set of service paths. Based on the set of service path identifiers, the method forwards the set of packets along the set of service paths.