Service insertion at logical network gateway

1. A method comprising:

receiving a definition of a logical network for implementation in a datacenter, the logical network comprising at least one logical switch to which logical network endpoints attach and a logical router for handling data traffic between the logical network endpoints in the datacenter and an external network;

receiving configuration data attaching a third-party service to at least one interface of the logical router via an additional logical switch designated for service attachments, the third-party service for performing non-forwarding processing on the data traffic between the logical network endpoints and the external network; and

configuring a gateway machine in the datacenter to implement the logical router and to redirect at least a subset of the data traffic between the logical network endpoints and the external network to the attached third-party service.

2. The method of claim 1 , wherein receiving the configuration data comprises:

receiving a definition of the logical router interface as a service attachment interface;

receiving a definition of the additional logical switch and connection of the service attachment interface to the additional logical switch; and

receiving attachment of the third-party service to the additional logical switch.

3. The method of claim 2 , wherein the definition of the additional logical switch specifies the additional logical switch as a logical switch for attachment of third-party services.

4. The method of claim 2 , wherein receiving the configuration data further comprises receiving a definition of the third-party service.

5. The method of claim 1 further comprising defining a distributed routing component and a centralized routing component for the logical router, wherein the distributed routing component is implemented by a plurality of machines including the gateway machine and the centralized routing component is implemented only by the gateway machine.

6. The method of claim 1 , wherein the gateway machine is configured to redirect data traffic received from the external network prior to applying the logical router configuration to said data traffic.

7. The method of claim 6 , wherein the gateway machine applies the logical router configuration to the data traffic received from the external network after redirecting said data traffic to the third-party service and receiving the data traffic back from the third-party service.

8. The method of claim 1 , wherein the gateway machine is configured to redirect data traffic directed to the external network after applying the logical router configuration to said data traffic.

9. The method of claim 1 , wherein the third-party service is a first third-party service and the subset of the data traffic between the logical network endpoints and the external network that is redirected to the first third-party service is a first subset of the data traffic between the logical network endpoints and the external network, the method further comprising:

receiving configuration data attaching a second third-party service to the interface of the logical router via the additional logical switch, the second third-party service also for performing non-forwarding processing on the data traffic between the logical network endpoints and the external network; and

configuring the gateway machine to redirect a second subset of the data traffic between the logical network endpoints and the external network to the second third-party service.

10. The method of claim 9 , wherein the first and second third-party services have interfaces with network addresses in a same subnet as the interface.

11. The method of claim 1 , wherein the interface is a first interface of the logical router, the additional logical switch is a first logical switch designated for service attachments, and the subset of the data traffic between the logical network endpoints and the external network that is redirected to the third-party service is a first subset of the data traffic between the logical network endpoints and the external network, the method further comprising:

receiving configuration data attaching the third-party service to a second interface of the logical router via a second logical switch designated for service attachments; and

configuring the gateway machine to redirect a second subset of the data traffic between the logical network endpoints and the external network to the third-party service via the second logical switch.

12. The method of claim 11 , wherein the third-party service has separate interfaces with separate network addresses attached to the first and second logical switches.

13. The method of claim 1 , wherein the configuration data attaches the third-party service to two interfaces of the logical router, wherein the gateway machine is configured to direct data traffic incoming from the external network to the third-party service via a first one of the interfaces and receive said incoming data traffic back from the third-party service via a second one of the interfaces.

14. The method of claim 13 , wherein the gateway machine is configured to direct outgoing data traffic from the logical network endpoints to the third-party service via the second interface and receive said outgoing data traffic back from the third-party service via the first interface.

15. A non-transitory machine-readable medium storing a program for execution by at least one processing unit, the program comprising sets of instructions for:

receiving a definition of a logical network for implementation in a datacenter, the logical network comprising at least one logical switch to which logical network endpoints attach and a logical router for handling data traffic between the logical network endpoints in the datacenter and an external network;

receiving configuration data attaching a third-party service to at least one interface of the logical router via an additional logical switch designated for service attachments, the third-party service for performing non-forwarding processing on the data traffic between the logical network endpoints and the external network; and

configuring a gateway machine in the datacenter to implement the logical router and to redirect at least a subset of the data traffic between the logical network endpoints and the external network to the attached third-party service.

16. The non-transitory machine-readable medium of claim 15 , wherein the set of instructions for receiving the configuration data comprises sets of instructions for:

receiving a definition of the third-party service;

receiving a definition of the logical router interface as a service attachment interface;

receiving a definition of the additional logical switch and connection of the service attachment interface to the additional logical switch; and

receiving attachment of the third-party service to the additional logical switch.

17. The non-transitory machine-readable medium of claim 15 , wherein the program further comprises a set of instructions for defining a distributed routing component and a centralized routing component for the logical router, wherein the distributed routing component is implemented by a plurality of machines including the gateway machine and the centralized routing component is implemented only by the gateway machine.

18. The non-transitory machine-readable medium of claim 15 , wherein the gateway machine is configured to (i) redirect data traffic received from the external network prior to applying the logical router configuration to said data traffic and (ii) apply the logical router configuration to the data traffic received from the external network after redirecting said data traffic to the third-party service and receiving the data traffic back from the third-party service.

19. The non-transitory machine-readable medium of claim 15 , wherein the gateway machine is configured to redirect data traffic directed to the external network after applying the logical router configuration to said data traffic.

20. The non-transitory machine-readable medium of claim 15 , wherein the third-party service is a first third-party service and the subset of the data traffic between the logical network endpoints and the external network that is redirected to the first third-party service is a first subset of the data traffic between the logical network endpoints and the external network, the program further comprising sets of instructions for:

receiving configuration data attaching a second third-party service to the interface of the logical router via the additional logical switch, the second third-party service also for performing non-forwarding processing on the data traffic between the logical network endpoints and the external network; and

configuring the gateway machine to redirect a second subset of the data traffic between the logical network endpoints and the external network to the second third-party service.

21. The non-transitory machine-readable medium of claim 15 , wherein the interface is a first interface of the logical router, the additional logical switch is a first logical switch designated for service attachments, and the subset of the data traffic between the logical network endpoints and the external network that is redirected to the third-party service is a first subset of the data traffic between the logical network endpoints and the external network, the program further comprising sets of instructions for:

receiving configuration data attaching the third-party service to a second interface of the logical router via a second logical switch designated for service attachments; and

configuring the gateway machine to redirect a second subset of the data traffic between the logical network endpoints and the external network to the third-party service via the second logical switch.

22. The non-transitory machine-readable medium of claim 15 , wherein the configuration data attaches the third-party service to two interfaces of the logical router, wherein the gateway machine is configured to (i) direct data traffic incoming from the external network to the third-party service via a first one of the interfaces and receive said incoming data traffic back from the third-party service via a second one of the interfaces and (ii) direct outgoing data traffic from the logical network endpoints to the third-party service via the second interface and receive said outgoing data traffic back from the third-party service via the first interface.