Cloud network reachability analysis for virtual private clouds
A method includes receiving, from a user device, a reachability request requesting a reachability status of network traffic from a first VM of a VPC to a second VM of the VPC. The method also includes obtaining network configuration information defining a configuration of a network connecting the first VM and the second VM, generating, using the network configuration information associated with the VPC, a simulated path between the first VM and the second VM, and, determining, based on the simulated path, that the second VM is unreachable from the first VM. The method further includes, based on determining that the second VM is unreachable from the first VM, generating a reachability report, the reachability report including each hop of the plurality of hops of the simulated path, and a rationale that the second VM is unreachable from the first VM, and providing the reachability report to the user device.
1 . A computer-implemented method executed by data processing hardware that causes the data processing hardware to perform operations comprising:
receiving, from a user device, a reachability request requesting a reachability status of network traffic from a first virtual machine (VM) of a virtual private cloud (VPC) to a second VM of the VPC;
obtaining network configuration information defining a configuration of a network connecting the first VM and the second VM;
generating, using the network configuration information, a simulated path between the first VM and the second VM;
determining, based on the simulated path, that the second VM is unreachable from the first VM; and
based on determining that the second VM is unreachable from the first VM, generating a reachability report, the reachability report comprising:
a list of each hop of the simulated path, wherein the list identifies, based on the network configuration information, a matching egress firewall rule applied by the first VM during the simulated path and a matching ingress firewall rule applied by the second VM during the simulated path; and
a rationale that the second VM is unreachable from the first VM; and
providing the reachability report to the user device.
2 . The method of claim 1 , wherein the reachability request further comprises a destination port.
3 . The method of claim 1 , wherein determining that the second VM is unreachable comprises using a network abstract state machine.
4 . The method of claim 1 , wherein the network configuration information comprises:
ports/interfaces for directing a data packet within the VPC;
firewall rules applied to the data packet at each step along the simulated path; and
a network configuration associated with each hop of the simulated path.
5 . The method of claim 1 , wherein determining that the second VM is unreachable comprises determining:
a dropped state indicating that a data packet will be dropped due to a configuration checkpoint failure or a missing configuration; or
an aborted state indicating the second VM is unreachable due to missing configurations.
6 . The method of claim 1 , wherein the reachability request further comprises:
a source port associated with a data packet; and
a destination port associated with the data packet.
7 . The method of claim 1 , wherein at least one hop comprises a load balancer within the VPC.
8 . The method of claim 1 , wherein determining that the second VM is unreachable comprises determining from the network configuration information, a path specific check based on a type of the simulated path.
9 . The method of claim 8 , wherein the type of the simulated path is based on a source instance and a destination instance of the simulated path.
10 . The method of claim 1 , wherein generating the simulated path between the first VM and the second VM comprises generating the simulated path using a data plane model for the network.
11 . A system comprising:
data processing hardware; and
memory hardware in communication with the data processing hardware, the memory hardware storing instructions that when executed on the data processing hardware cause the data processing hardware to perform operations comprising:
receiving, from a user device, a reachability request requesting a reachability status of network traffic from a first virtual machine (VM) of a virtual private cloud (VPC) to a second VM of the VPC;
obtaining network configuration information defining a configuration of a network connecting the first VM and the second VM;
generating, using the network configuration information, a simulated path between the first VM and the second VM;
determining, based on the simulated path, that the second VM is unreachable from the first VM; and
based on determining that the second VM is unreachable from the first VM, generating a reachability report, the reachability report comprising:
a list of each hop of the simulated path, wherein the list identifies, based on the network configuration information, a matching egress firewall rule applied by the first VM during the simulated path and a matching ingress firewall rule applied by the second VM during the simulated path; and
a rationale that the second VM is unreachable from the first VM; and
providing the reachability report to the user device.
12 . The system of claim 11 , wherein the reachability request further comprises a destination port.
13 . The system of claim 11 , wherein determining that the second VM is unreachable comprises using a network abstract state machine.
14 . The system of claim 11 , wherein the network configuration information comprises:
ports/interfaces for directing a data packet within the VPC;
firewall rules applied to the data packet at each step along the simulated path; and
a network configuration associated with each hop of the simulated path.
15 . The system of claim 11 , wherein determining that the second VM is unreachable comprises determining:
a dropped state indicating that a data packet will be dropped due to a configuration checkpoint failure or a missing configuration; or
an aborted state indicating the second VM is unreachable due to missing configurations.
16 . The system of claim 11 , wherein the reachability request further comprises:
a source port associated with a data packet; and
a destination port associated with the data packet.
17 . The system of claim 11 , wherein at least one hop comprises a load balancer within the VPC.
18 . The system of claim 11 , wherein determining that the second VM is unreachable comprises determining from the network configuration information, a path specific check based on a type of the simulated path.
19 . The system of claim 18 , wherein the type of the simulated path is based on a source instance and a destination instance of the simulated path.
20 . The system of claim 11 , wherein generating the simulated path between the first VM and the second VM comprises generating the simulated path using a data plane model for the network.