Abstract: Techniques for controlling packet flows are described. In an example, a packet is sent on a virtual network. The packet's header includes scoping data that indicates a network boundary within which the packet is permitted and/or prohibited to flow. A network virtualization device of a substrate network receives the packet. The network virtualization device determines the scoping data from the header and, based on network configuration information, determines the forward flow of the packet. If the forward flow falls within a permitted network boundary indicated by the scoping data, the network virtualization device sends the packet forward. Otherwise, the packet is dropped.

Abstract: Techniques are described for communications in an L2 virtual network. In an example, the L2 virtual network includes a plurality of L2 compute instances hosted on a set of host machines and a plurality of L2 virtual network interfaces and L2 virtual switches hosted on a set of network virtualization devices. An L2 virtual network interface emulates an L2 port of the L2 virtual network. Storm control information applicable to the L2 port is sent to a network virtualization device that hosts the L2 virtual network interface.

Abstract: Techniques are described for communications in an L2 virtual network. In an example, the L2 virtual network includes a plurality of L2 compute instances hosted on a set of host machines and a plurality of L2 virtual network interfaces and L2 virtual switches hosted on a set of network virtualization devices. An L2 virtual network interface emulates an L2 port of the L2 virtual network. Access control list (ACL) information applicable to the L2 port is sent to a network virtualization device that hosts the L2 virtual network interface.

Abstract: Techniques for providing, to a resource on a private network of a service provider, access to a resource on a private network of a customer. Service to customer (S2C) resources deployed on a cloud infrastructure to facilitate the access. Whereas IP address ranges may overlap between private networks and/or private IP addresses may be used in one or more of the private networks, the S2C resources enable the data exchange between the private networks. For example, the S2C resources translate between IP addresses such that data within each private network uses IP addresses that can be properly processed by the private network.

Abstract: Systems and methods of interface-based ACLs in a virtual Layer-2 network. The method can include sending a packet from source compute instance in a virtual network to a destination compute instance via a destination virtual network interface card (destination VNIC) within a first virtual layer 2 network and evaluating an access control list (ACL) for the packet with a source virtual network interface card (source VNIC). ACL information relevant to the packet can be embedded in the packet. The VSRS can receive the packet and can identify the destination VNIC within the first virtual layer 2 network for delivery of the packet based on information received with the packet and mapping information contained within a mapping table. The VSRS can access ACL information from the packet and can apply the ACL information to the packet.

Abstract: Systems and methods for a virtual layer-2 network are described herein. The method can include providing a virtual Layer 3 network in a virtualized cloud environment. The virtual Layer 3 network can be hosted by an underlying physical network. The method can include providing a virtual Layer 2 network in the virtualized cloud environment. The virtual Layer 2 network can be hosted by the underlying physical network.

Abstract: Techniques are disclosed for providing high performant packets processing capabilities in a virtualized cloud environment that enhance the scalability and high availability of the packets processing infrastructure. In certain embodiments disclosed herein, the VNICs functionality performed by network virtualization devices (NVDs) is offloaded from the NVDs to a fleet of computers, referred to as VNIC-as-a-Service System (or VNICaaS system). VNICaaS system is configured to provide Virtual Network Interface Cards (VNICs)-related functionality or service for multiple compute instances belonging to multiple tenants or customers of the CSPI. The VNICaaS system is capable of hosting multiple VNICs to process and transmit traffic in a distributed virtualized cloud networks environment. A single VNIC executed by the VNICaaS system can be used to process packets received from multiple compute instances.

Abstract: Techniques are described for creating a network-link between a first virtual network in a first cloud environment and a second virtual network in a second cloud environment. The first virtual network in the first cloud environment is created to enable a user associated with a customer tenancy in the second cloud environment to access one or more services provided in the first cloud environment. The network-link is created based on one or more link-enabling virtual networks being deployed in the first cloud environment and the second cloud environment.

Abstract: Systems and methods of interface-based ACLs in a virtual Layer-2 network. The method can include sending a packet from source compute instance in a virtual network to a destination compute instance via a destination virtual network interface card (destination VNIC) within a first virtual layer 2 network and evaluating an access control list (ACL) for the packet with a source virtual network interface card (source VNIC). ACL information relevant to the packet can be embedded in the packet. The VSRS can receive the packet and can identify the destination VNIC within the first virtual layer 2 network for delivery of the packet based on information received with the packet and mapping information contained within a mapping table. The VSRS can access ACL information from the packet and can apply the ACL information to the packet.

Abstract: Systems and methods for a VLAN switching and routing service (VSRS) are disclosed herein. A method can include generating a table for an instance of a VSRS, which VSRS couples a first virtual layer 2 network (VLAN) with a second network. The table can contain information identifying IP addresses, MAC addresses, and virtual interface identifiers for instances within the virtual layer 2 network. The method can include receiving with the VSRS a packet from a first instance designated for delivery to a second instance within the virtual layer 2 network, identifying with the VSRS the second instance within the virtual layer 2 network for delivery of the packet based on information received with the packet and information contained within the table, and delivering the packet to the identified second instance.

Abstract: Systems and methods for a virtual layer-2 network are described herein. The method can include providing a virtual Layer 3 network in a virtualized cloud environment. The virtual Layer 3 network can be hosted by an underlying physical network. The method can include providing a virtual Layer 2 network in the virtualized cloud environment. The virtual Layer 2 network can be hosted by the underlying physical network.

Abstract: Systems and methods for a virtual layer-2 network are described herein. The method can include providing a virtual Layer 3 network in a virtualized cloud environment. The virtual Layer 3 network can be hosted by an underlying physical network. The method can include providing a virtual Layer 2 network in the virtualized cloud environment. The virtual Layer 2 network can be hosted by the underlying physical network.

Abstract: Techniques for providing, to a resource on a private network of a service provider, access to a resource on a private network of a customer. Service to customer (S2C) resources deployed on a cloud infrastructure to facilitate the access. Whereas IP address ranges may overlap between private networks and/or private IP addresses may be used in one or more of the private networks, the S2C resources enable the data exchange between the private networks. For example, the S2C resources translate between IP addresses such that data within each private network uses IP addresses that can be properly processed by the private network.

Abstract: Techniques are described for communications in an L2 virtual network. In an example, the L2 virtual network includes a plurality of L2 compute instances hosted on a set of host machines and a plurality of L2 virtual network interfaces and L2 virtual switches hosted on a set of network virtualization devices. An L2 virtual network interface emulates an L2 port of the L2 virtual network. Access control list (ACL) information applicable to the L2 port is sent to a network virtualization device that hosts the L2 virtual network interface.

Abstract: Techniques are described for communications in an L2 virtual network. In an example, the L2 virtual network includes a plurality of L2 compute instances hosted on a set of host machines and a plurality of L2 virtual network interfaces and L2 virtual switches hosted on a set of network virtualization devices. An L2 virtual network interface emulates an L2 port of the L2 virtual network. IGMP configuration is distributed to the L2 virtual switches. A control plane of the L2 virtual network coordinates IGMP configuration across the L2 virtual switches.

Abstract: Techniques for loop prevention while allowing multipath in a virtual L2 network are described. In an example, a network virtualization device can generate a first L2 bridge protocol data unit by applying a first loop detection protocol specific to only the first port and the first host machine. The network virtualization device can transmit, to the first compute instance via the first port, a first frame that includes the first L2 BPDU. The network virtualization device can receive, from the first compute instance via the first port, a second frame. The network virtualization device can determine that the second frame comprises the first L2 BPDU. The network virtualization device can determine that a loop exists between the network virtualization device and the first compute instance based on the first loop detection protocol and the first L2 BPDU of the second frame.

Abstract: Techniques are described for communications in an L2 virtual network of a customer. In an example, the L2 virtual network includes a plurality of L2 compute instances hosted on a set of host machines and a plurality of L2 virtual network interfaces and L2 virtual switches hosted on a set of network virtualization devices. An L2 virtual network interface emulates an L2 port of the L2 virtual network. Information associated with the L2 virtual switches is collected and provided to the customer.

Abstract: Techniques are described for creating a network-link between a first virtual network in a first cloud environment and a second virtual network in a second cloud environment. The first virtual network in the first cloud environment is created to enable a user associated with a customer tenancy in the second cloud environment to access one or more services provided in the first cloud environment. The network-link is created based on one or more link-enabling virtual networks being deployed in the first cloud environment and the second cloud environment.

Abstract: Techniques for controlling packet flows through the generation of packet flow rules are described. In an example, a network virtualization device receives network data. The network virtualization device determines a set of networks of a virtual network based on the network data. The network virtualization device receives flow data of the customer. The network virtualization device generates a packet flow rule based on the flow data and the set of networks. The packet flow rule defines a network boundary of one or more networks such that a first packet having a destination within the network boundary can flow and such that a second packet having a destination outside of the network boundary is to be dropped. The network virtualization device stores the packet flow rule in association with the compute instance.

Abstract: Techniques are described for creating a network-link between a first virtual network in a first cloud environment and a second virtual network in a second cloud environment. The first virtual network in the first cloud environment is created to enable a user associated with a customer tenancy in the second cloud environment to access one or more services provided in the first cloud environment. The network-link is created based on one or more link-enabling virtual networks being deployed in the first cloud environment and the second cloud environment.