Identifying multiple nodes in a virtual network defined over a set of public clouds to connect to an external SAAS provider
Some embodiments establish for an entity a virtual network over several public clouds of several public cloud providers and/or in several regions. In some embodiments, the virtual network is an overlay network that spans across several public clouds to interconnect one or more private networks (e.g., networks within branches, divisions, departments of the entity or their associated datacenters), mobile users, and SaaS (Software as a Service) provider machines, and other web applications of the entity. The virtual network in some embodiments can be configured to optimize the routing of the entity's data messages to their destinations for best end-to-end performance, reliability and security, while trying to minimize the routing of this traffic through the Internet. Also, the virtual network in some embodiments can be configured to optimize the layer 4 processing of the data message flows passing through the network.
1. A method for defining multiple routes to a SaaS (Software as a Service) provider through a virtual network defined over a set of one or more public clouds for an entity, the method comprising:
providing, to each of a plurality of managed forwarding nodes (MFNs) in the set of public clouds, an identifier identifying the SaaS provider for the MFN to generate a measurement that quantifies an attribute of a network path between the MFN and the identified SaaS provider;
receiving, from each MFN, measurements for the identified SaaS provider;
based on the received measurements, selecting a set of at least two MFNs to use to reach the SaaS provider from the virtual network, the set of MFNs not including all of the plurality of MFNs;
using the selected set of at least two MFNs to define routes through the virtual network to the SaaS provider from a compute node that belongs to the entity, that is outside of the set of public clouds, and that comprises a forwarding element that connects multiple computers at the compute node to the virtual network through at least one MFN; and
based on the defined routes, providing a set of forwarding rules to the forwarding element of the compute node to use to forward data messages to the SaaS provider through one of the selected MFNs and the virtual network.
2. The method of claim 1 , wherein the identifier for the SaaS provider is a network address associated with the SaaS provider.
3. The method of claim 2 , wherein the network address is a network address associated with a set of one or more datacenters of the SaaS provider, with each datacenter of the SaaS residing outside of the set of public clouds.
4. The method of claim 1 , wherein
providing, to each of the plurality of MFNs, an identifier identifying the SaaS provider comprises providing, to each of the plurality of MFNs, identifiers identifying a plurality of SaaS providers for the MFN to generate a measurement that quantifies an attribute of a connection between the MFN and each identified SaaS provider datacenter, and
selecting the set of at least two MFNs to use to reach the SaaS provider comprises, for each of a set of the SaaS providers, selecting at least two MFNs to use to reach the SaaS provider.
5. The method of claim 4 , wherein using the selected set of MFNs comprises:
generating a routing graph for identifying routes from a plurality of compute nodes of the entity that are external to the virtual network to each SaaS provider through the virtual network;
using the received measurements to compute weights of links in the routing graph; and
using the routing graph to perform a route-identifying process to identify routes to the SaaS providers that use, for each SaaS provider, the set of MFNs for that SaaS provider.
6. The method of claim 5 , wherein providing the set of forwarding rules comprises providing routes to MFNs used to define the virtual network and to the forwarding elements at the entity's compute nodes each route identifying a next hop for traversing a routing path to a SaaS provider from one compute node or a routing path from a SaaS provider to one compute node.
7. The method of claim 1 , wherein each MFN generates a plurality of measurements regarding a plurality of attributes associated with the path between the MFN and the SaaS provider, the method further comprising computing a weight value for the path between each MFN and the SaaS provider based on the plurality of measurements received from the MFN.
8. The method of claim 7 , wherein the plurality of measurements comprises message loss rate and message delay for the path between the SaaS provider and each MFN.
9. The method of claim 8 , wherein the plurality of measurements further comprises financial cost associated with the path between the SaaS provider and each MFN.
10. The method of claim 1 , wherein each MFN has a measurement agent that exchanges messages with the SaaS provider to generate a measurement for the MFN.
11. A non-transitory machine readable medium storing a program for defining, for an entity, multiple routes to a SaaS (Software as a Service) provider through a virtual network defined over a set of one or more public clouds, the program comprising sets of instructions for:
providing, to each of a plurality of managed forwarding nodes (MFNs) in the set of public clouds, an identifier identifying the SaaS provider for the MFN to generate a measurement that quantifies an attribute of a network path between the MFN and the identified SaaS provider;
receiving, from each MFN, measurements for the identified SaaS provider;
based on the received measurements, selecting a set of at least two MFNs to use to reach the SaaS provider from the virtual network, the set of MFNs not including all of the plurality of MFNs;
using the selected set of at least two MFNs to define routes through the virtual network to the SaaS provider from a compute node that belongs to the entity, that is outside of the set of public clouds, and that comprises a forwarding element that connects multiple computers at the compute node to the virtual network through at least one MFN; and
based on the defined routes, providing a set of forwarding rules to the forwarding element of the compute node to use to forward data messages to the SaaS provider through one of the selected MFNs and the virtual network.
12. The non-transitory machine readable medium of claim 11 , wherein the identifier for the SaaS provider is a network address associated with the SaaS provider.
13. The non-transitory machine readable medium of claim 12 , wherein the network address is a network address associated with a set of one or more datacenters of the SaaS provider.
14. The non-transitory machine readable medium of claim 11 , wherein
the set of instructions for providing, to each of the plurality of MFNs, an identifier identifying the SaaS provider comprises a set of instructions for providing, to each of the plurality of MFNs, identifiers identifying a plurality of SaaS providers for the MFN to generate a measurement that quantifies an attribute of a connection between the MFN and each identified SaaS provider datacenter, and
the set of instructions for selecting the set of at least two MFNs to use to reach the SaaS provider comprises a set of instructions for selecting, for each of a set of the SaaS providers, at least two MFNs to use to reach the SaaS provider.
15. The non-transitory machine readable medium of claim 14 , wherein the virtual network is for an entity, and the set of instructions for selecting the set of MFNs for each SaaS provider comprises sets of instructions for:
generating a routing graph for identifying routes from compute nodes of the entity that are external to the virtual network to each SaaS provider through the virtual network;
using the received measurements to compute weights of links in the routing graph; and using the routing graph to perform route-identifying process to identify routes to the SaaS providers that use for each SaaS provider the set of MFNs for that SaaS provider.
16. The non-transitory machine readable medium of claim 15 , wherein the set of instructions for providing the set of forwarding rules comprises a set of instructions for providing routes to MFNs used to define the virtual network and to the forwarding elements at the entity's compute nodes, each route identifying a next hop for traversing a routing path to a SaaS provider from one compute node or a routing path from a SaaS provider to one compute node.
17. The non-transitory machine readable medium of claim 11 , wherein each MFN has a measurement agent that exchanges messages with the SaaS provider to generate a measurement for the MFN.
18. The non-transitory machine readable medium of claim 17 , wherein at least two MFNs share one measurement agent as both MFNs are associated with the same public cloud.
19. The non-transitory machine readable medium of claim 11 , wherein the identifier for the SaaS provider is a network address, the program further comprises sets of instructions for:
providing a list of SaaS providers to a subset of the MFNs before providing the identifiers, and
directing the subset of MFNs to perform DNS operations to identify IP addresses associated with the SaaS providers on the list.
20. The non-transitory machine readable medium of claim 11 , wherein the set of instructions for providing the identifier to each of the plurality of MFNs comprises sets of instructions for:
generating a vicinity report for each MFN in the plurality of MFNs that identifies SaaS providers that are near the MFN; and
directing each MFN to generate measurements for connection paths between the MFN and each SaaS provider on the MFN's vicinity report.