Processing data messages of a virtual network that are sent to and received from external service machines
Some embodiments establish for an entity a virtual network over several public clouds of several public cloud providers and/or in several regions. In some embodiments, the virtual network is an overlay network that spans across several public clouds to interconnect one or more private networks (e.g., networks within branches, divisions, departments of the entity or their associated datacenters), mobile users, and SaaS (Software as a Service) provider machines, and other web applications of the entity. The virtual network in some embodiments can be configured to optimize the routing of the entity's data messages to their destinations for best end-to-end performance, reliability and security, while trying to minimize the routing of this traffic through the Internet. Also, the virtual network in some embodiments can be configured to optimize the layer 4 processing of the data message flows passing through the network.
1. For a multi-tenant virtual network system, a method of processing a data message that is associated with a virtual network that is defined for a particular tenant over a plurality of public cloud datacenters, the method comprising:
establishing, for the particular tenant, the virtual network that spans the plurality of public cloud datacenters to connect machines of the particular tenant that reside outside of the plurality of public cloud datacenters;
determining that the data message is associated with an external service machine outside of the virtual network and the plurality of public cloud datacenters;
based on a tenant identifier (TID) for the particular tenant in the virtual network system, performing, at a first public cloud datacenter that serves as an ingress node for the data message to the virtual network, a first source network address translation (SNAT) operation to modify a first source network address of the data message to a modified second source network address;
performing, at a second public cloud datacenter that serves as an egress node for the data message from the virtual network, a second SNAT operation to modify the modified second source network address of the data message to a modified third source network address; and
forwarding the data message, with the third modified source network address, to the external service machine through an external network that is outside of the public cloud datacenters.
2. The method of claim 1 further comprising performing the first and second SNAT operations for data messages of different tenants, wherein
the first SNAT operation for the data messages of each tenant is based on the TID that the virtual network system associates with each tenant, and
the first SNAT operation maps the data messages of different tenants to different source network address spaces to ensure that even when a common network address space is used by two tenants, the modified second source network addresses of the different tenants do not overlap.
3. The method of claim 1 , wherein the first SNAT operation is performed in a stateless manner that does not create a record for a flow of the data message to use to process subsequent data messages that are part of the data message's flow, while the second SNAT operation is performed in a stateful manner that creates a record for the data message to use the record to process subsequent data messages that are part of the data message's flow as the data message.
4. The method of claim 1 further comprising:
at a first router in the second public cloud datacenter that is used to define the virtual network along with at least one other router in at least the first public cloud datacenter, receiving the data message with an encapsulated tunnel header from the other router; and
extracting the TID from the tunnel header.
5. The method of claim 4 , wherein the first router is an egress gateway for the data message to leave the virtual network that is defined over the plurality of public cloud datacenters.
6. The method of claim 4 , wherein determining that the data message is associated with an external service machine comprises:
extracting a destination network address from an original header of the data message that is encapsulated by the tunnel header; and
using the extracted destination network address to determine that the data message's destination address is associated with an interface connected to a machine outside of the public cloud datacenters.
7. The method of claim 6 , wherein
the external network is the Internet, and
using the extracted destination network address comprises performing a lookup operation in the public Internet context based on the extracted destination network address.
8. The method of claim 1 , wherein the first, second and third network addresses each comprises a layer 3 network address.
9. The method of claim 1 , wherein
the first, second and third network addresses each comprises a layer 3 network address and a layer 4 network address, and
at least one of the first and second SNAT operations modifies both the layers 3 and 4 network addresses.
10. The method of claim 1 , wherein
the first, second and third network addresses each comprise a layer 3 network address and a layer 4 network address, and
each of the first and second SNAT operations modifies both the layers 3 and 4 network addresses.
11. The method of claim 1 , wherein the external service machine is a machine of a SaaS (software as a service) provider, while a source of the data message is one of a machine in an office of the particular tenant, a machine in a private datacenter of the particular tenant, or a remote user machine of the particular tenant.
12. The method of claim 11 , wherein the service machine is in a private datacenter of the SaaS provider.
13. The method of claim 1 , wherein the modified second source network address is an address in a private network address space of a public cloud datacenter, while the third source network address is a public network address.
14. The method of claim 1 further comprising creating at least one record for the first and second SNAT operations in order to use the record to perform at least one destination network address translation operation for a data message received from the external service machine.
15. The method of claim 1 , wherein the public cloud datacenters are multi-tenant public cloud datacenters.