Abstract: Some embodiments provide a method for displaying information about a data message. Through a graphical user interface (GUI) that provides a visualization of paths for a plurality of data messages in a network, the method receives a selection of a particular data message. In response to the selection, the method displays in the GUI (i) a set of characteristics of the selected data message, (ii) a path through a set of services of the network traversed by the selected data message, (iii) information regarding additional data messages sharing at least a subset of the set of characteristics of the selected data message, and (iv) information regarding one or more service rules applied to the data message at one or more of the services.

Abstract: Some embodiments provide a method that provides a visualization of data message paths through sets of services. For each data message of multiple data messages that traverse a network, the method identifies a set of services applied to the data messages within the network based on flow data collected from a set of network elements. The method generates an animated visualization of the data messages that includes representations of the services and paths the data messages take through the services. The method provides the generated visualization in a graphical user interface (GUI) to enable monitoring of data messages traversing the network via different service paths.

Abstract: Some embodiments provide a method for displaying a visualization of a middlebox rule. Through a graphical user interface (GUI) that provides a visualization of middlebox rules, the method receives a selection of a particular middlebox rule defined for a network. In response to the selection, the method displays in the GUI a visualization of the particular middlebox rule that includes (i) a first display area for providing GUI items representing a set of source groups to which the particular middlebox rule is applied, (ii) a second display area for providing GUI items representing a set of services to which the particular middlebox rule is applied, and (iii) a third display area for providing GUI items representing a set of destination groups to which the particular middlebox rule is applied.

Abstract: Some embodiments of the invention provide a method for providing a visualization of a topology for a logical network implemented in a physical network. The method identifies a set of logical elements of the logical network. For each logical element, the method identifies a set of one or more physical elements in the physical network that implements the logical element. Multiple physical elements are identified for at least one of the logical elements. Through a user interface (UI) the method displays a visualization that includes (1) the set of logical elements, (2) connections between the logical elements, (3) the sets of physical elements that implement each logical element in the set of logical elements, and (4) correlations between each logical element and the set of physical elements that implements the logical element. Each logical element and each physical element is represented by a node in the visualization.

Abstract: Some embodiments provide a method for presenting a visualization of a data message flow within a logical network that is implemented across multiple sites. The method receives flow tracing data regarding the data message flow from a source endpoint in a first site to a second endpoint in a second site. The data message flow is processed according to logical forwarding elements (LFEs) implemented in at least the first and second sites. For each of the sites through which the data message flow passes, the method identifies the LFEs that process the data message flow in the site. The method presents a visualization for the data message flow. The visualization includes a separate section for each site through which the data message flow passes. Each section indicates at least a subset of the LFEs that process the data message flow in the corresponding site for the section.

Abstract: Systems and methods are disclosed for updating network configuration documentation. In an example, a user can upload network configuration documentation with updates to a network to a server. The server can create an update topology corresponding to the documentation by identifying symbols that represent network components. The server can identify changes by comparing the update topology to a configuration data of an existing network. For example, the address of a gateway or the connections to the gateway can change. The server can cause the changes to be presented to a user, such as by highlighting the changes in a diagram. The user can confirm the changes, such as with a conversational workflow, and the server can save the changes to a database. The system can also send commands to the applicable network components to effectuate the confirmed changes.

Abstract: Some embodiments provide a method for presenting a visualization of a topology for a logical network. In response to receiving a selection of a particular user interface (UI) item representing a particular group of logical elements, the method presents one or more filter UI items for the particular group of logical elements. Each filter UI item corresponds to a different attribute associated with the logical elements. Upon receiving selection of one or more attribute states for each attribute for which a filter UI item is presented, the method identifies logical elements in the group of logical elements that match the selected attribute states. The method presents, in the UI, an expanded version of the particular group of logical elements that emphasizes the identified logical elements that match the selected attribute states.

Abstract: Systems and methods are disclosed for updating network configuration documentation. In an example, a user can upload network configuration documentation with updates to a network to a server. The server can create an update topology corresponding to the documentation by identifying symbols that represent network components. The server can identify changes by comparing the update topology to a configuration data of an existing network. For example, the address of a gateway or the connections to the gateway can change. The server can cause the changes to be presented to a user, such as by highlighting the changes in a diagram. The user can confirm the changes, such as with a conversational workflow, and the server can save the changes to a database. The system can also send commands to the applicable network components to effectuate the confirmed changes.

Abstract: Some embodiments provide a method for presenting a visualization of a data message flow within a logical network that is implemented across multiple sites. The method receives flow tracing data regarding the data message flow from a source endpoint in a first site to a second endpoint in a second site. The data message flow is processed according to logical forwarding elements (LFEs) implemented in at least the first and second sites. For each of the sites through which the data message flow passes, the method identifies the LFEs that process the data message flow in the site. The method presents a visualization for the data message flow. The visualization includes a separate section for each site through which the data message flow passes. Each section indicates at least a subset of the LFEs that process the data message flow in the corresponding site for the section.

Abstract: Some embodiments provide a method for presenting a visualization of a topology for a logical network. In response to receiving a selection of a particular user interface (UI) item representing a particular group of logical elements, the method presents one or more filter UI items for the particular group of logical elements. Each filter UI item corresponds to a different attribute associated with the logical elements. Upon receiving selection of one or more attribute states for each attribute for which a filter UI item is presented, the method identifies logical elements in the group of logical elements that match the selected attribute states. The method presents, in the UI, an expanded version of the particular group of logical elements that emphasizes the identified logical elements that match the selected attribute states.

Abstract: Some embodiments of the invention provide a method for presenting a visualization of a logical network that spans multiple geographically dispersed sites. For each logical element in a set of logical elements of the logical network, the method identifies a set of sites spanned by the logical element. Through a user interface (UI), the method displays a visualization of a topology of the logical network, the visualization including (1) representations for the logical elements and for logical connections between the logical elements and (2) at least a first set of UI items specifying each site of the multiple sites spanned by the logical network to indicate, for each logical element represented in the visualization, the set of sites spanned by the logical element.

Abstract: Some embodiments provide a method for network management and control system that manages one or more logical networks. From a first user, the method receives a definition of one or more security zones for a logical network. Each security zone definition includes a set of security rules for data compute nodes (DCNs) assigned to the security zone. From a second user, the method receives a definition of an application to be deployed in the logical network. The application definition specifies a set of requirements. Based on the specified set of requirements, the method assigns DCNs implementing the application to one or more of the security zones for the logical network.

Abstract: Some embodiments provide a method for defining security groups in a network. In a user interface, the method displays (i) a set of existing security groups and (ii) a set of recommend security groups based on monitored network flows in the network. Each existing security group and recommended security group includes at least one data compute node (DCN). The method provides a user interface tool for (i) accepting recommended security groups to be part of the set of existing security groups and (ii) adding DCNs from the recommended security groups to the existing security groups. Security rules are defined and implemented in the network for DCNs belonging to existing security groups.

Abstract: Examples herein include systems and methods for processing natural language queries across database platforms. An example method can include storing relational graphs representing relational paths between resources, such as by using nodes and edges. When a user inputs a query in natural language format, the method can identify and extract a matching intent and entity using a natural language understanding tool trained with an automated script. The method can include fetching a relational path and formatting it as an ordered list of nodes and edges. The list can be translated into a framework specific to a first database relevant to the query to obtain a translated path. The translated path can be used to execute the query at the database. Returned results can be displayed as a list of objects on a GUI.

Abstract: Some embodiments provide a method for presenting a visualization of a data message flow within a logical network that is implemented across multiple sites. The method receives flow tracing data regarding the data message flow from a source endpoint in a first site to a second endpoint in a second site. The data message flow is processed according to logical forwarding elements (LFEs) implemented in at least the first and second sites. For each of the sites through which the data message flow passes, the method identifies the LFEs that process the data message flow in the site. The method presents a visualization for the data message flow. The visualization includes a separate section for each site through which the data message flow passes. Each section indicates at least a subset of the LFEs that process the data message flow in the corresponding site for the section.

Abstract: Some embodiments provide a method for presenting a visualization of a topology for a logical network. In response to receiving a selection of a particular user interface (UI) item representing a particular group of logical elements, the method presents one or more filter UI items for the particular group of logical elements. Each filter UI item corresponds to a different attribute associated with the logical elements. Upon receiving selection of one or more attribute states for each attribute for which a filter UI item is presented, the method identifies logical elements in the group of logical elements that match the selected attribute states. The method presents, in the UI, an expanded version of the particular group of logical elements that emphasizes the identified logical elements that match the selected attribute states.

Abstract: Some embodiments of the invention provide a method for providing a visualization of a topology for a logical network implemented in a physical network. The method identifies a set of logical elements of the logical network. For each logical element, the method identifies a set of one or more physical elements in the physical network that implements the logical element. Multiple physical elements are identified for at least one of the logical elements. Through a user interface (UI) the method displays a visualization that includes (1) the set of logical elements, (2) connections between the logical elements, (3) the sets of physical elements that implement each logical element in the set of logical elements, and (4) correlations between each logical element and the set of physical elements that implements the logical element. Each logical element and each physical element is represented by a node in the visualization.

Abstract: Some embodiments provide a method for a network management and control system that manages a virtual infrastructure deployed across a set of datacenters. Based on input from a top-level user of the virtual infrastructure, the method deploys a first logical network within the virtual infrastructure and defines one or more second-level users of the virtual infrastructure. The method receives input from a second-level user of the virtual infrastructure to define a second logical network and connect the second logical network to the first logical network. The first and second logical networks use a same data model and the second-level users are restricted from viewing configuration of the first logical network.

Abstract: Some embodiments provide a method for a network management and control system that manages a virtual infrastructure deployed across a plurality of sites. The method receives a definition of an application to be deployed in the virtual infrastructure. The application definition specifying a first set of the sites at which to deploy the application. Based on the definition of the application, the method assigns the application to a set of security zones defined for the virtual infrastructure. Each respective security zone is restricted to a respective set of the sites. The method deploys the application in a second set of sites based on the first set of sites and the sets of sites to which the set of security zones are restricted.

Abstract: Some embodiments of the invention provide a method for providing a visualization of a topology for a logical network implemented in a physical network. The method identifies a set of logical elements of the logical network. For each logical element, the method identifies a set of one or more physical elements in the physical network that implements the logical element. Multiple physical elements are identified for at least one of the logical elements. Through a user interface (UI) the method displays a visualization that includes (1) the set of logical elements, (2) connections between the logical elements, (3) the sets of physical elements that implement each logical element in the set of logical elements, and (4) correlations between each logical element and the set of physical elements that implements the logical element. Each logical element and each physical element is represented by a node in the visualization.