Abstract: Some embodiments provide a method for a network management and control system that manages a virtual infrastructure deployed across a set of datacenters. The method receives a definition of an application to be deployed in the virtual infrastructure. The application definition specifies (i) a set of tiers of the application and (ii) a set of requirements for deploying the application. Based on the application definition, the method automatically defines a logical network architecture for connecting data compute nodes (DCNs) that implement the application tiers in the set of datacenters. The method configures a set of forwarding elements in the set of datacenters to implement the logical network architecture.

Abstract: Some embodiments provide a method for network management and control system that manages one or more logical networks. From a first user, the method receives a definition of one or more security zones for a logical network. Each security zone definition includes a set of security rules for data compute nodes (DCNs) assigned to the security zone. From a second user, the method receives a definition of an application to be deployed in the logical network. The application definition specifies a set of requirements. Based on the specified set of requirements, the method assigns DCNs implementing the application to one or more of the security zones for the logical network.

Abstract: Some embodiments provide a method for a network management and control system that manages a virtual infrastructure deployed across a set of datacenters. Based on input from a top-level user of the virtual infrastructure, the method deploys a first logical network within the virtual infrastructure and defines one or more second-level users of the virtual infrastructure. The method receives input from a second-level user of the virtual infrastructure to define a second logical network and connect the second logical network to the first logical network. The first and second logical networks use a same data model and the second-level users are restricted from viewing configuration of the first logical network.

Abstract: Some embodiments provide a method for a network management and control system that manages a virtual infrastructure deployed across a plurality of sites. The method receives a definition of an application to be deployed in the virtual infrastructure. The application definition specifying a first set of the sites at which to deploy the application. Based on the definition of the application, the method assigns the application to a set of security zones defined for the virtual infrastructure. Each respective security zone is restricted to a respective set of the sites. The method deploys the application in a second set of sites based on the first set of sites and the sets of sites to which the set of security zones are restricted.

Abstract: Example methods and systems for logical network visualization. One example may comprise a computer system obtaining and processing topology information identifying a set of logical network elements. To visualize the set of logical network elements, the computer system may configure logical network topology graph is configured to include a multi-level group node that is formed using (a) a parent group node and (b) a child group node. The parent group node may be configured in a folded state to visualize multiple first elements and associated with parent group node information. The child group node may be configured in a folded state to visualize multiple second elements and associated with child group node information. The computer system may interact with a user device to cause display of the parent group node and the child group node along with the respective parent group node information and child group node information.

Abstract: Described herein are systems, methods, and software to manage usage statistics associated with firewall rules in a computing network. In one implementation, a method of operating a firewall summary service includes identifying a sequence of firewall rules for a computing environment and monitoring usage associated with each of the firewall rules. The method further includes generating, for display, a summary to indicate the sequence of the firewall rules with the usage associated with each of the firewall rules.

Abstract: Some embodiments provide a method for visualizing network flows between multiple security groups in a network. Each security group includes a set of one or more data computer nodes (DCNs). The method receives data regarding network flows between the DCNs of the security groups. In a scalable user interface visualization, the method displays the network flows by aggregating the network flows between DCNs in pairs of security groups. The method provides a filtering tool to enable visualization in the user interface of specific flows between the DCNs of the plurality of security groups.

Abstract: Some embodiments provide a method for defining security groups in a network. In a user interface, the method displays (i) a set of existing security groups and (ii) a set of recommend security groups based on monitored network flows in the network. Each existing security group and recommended security group includes at least one data compute node (DCN). The method provides a user interface tool for (i) accepting recommended security groups to be part of the set of existing security groups and (ii) adding DCNs from the recommended security groups to the existing security groups. Security rules are defined and implemented in the network for DCNs belonging to existing security groups.