Three tiers of SaaS providers for deploying compute and network infrastructure in the public cloud
Some embodiments establish for an entity a virtual network over several public clouds of several public cloud providers and/or in several regions. In some embodiments, the virtual network is an overlay network that spans across several public clouds to interconnect one or more private networks (e.g., networks within branches, divisions, departments of the entity or their associated datacenters), mobile users, and SaaS (Software as a Service) provider machines, and other web applications of the entity. The virtual network in some embodiments can be configured to optimize the routing of the entity's data messages to their destinations for best end-to-end performance, reliability and security, while trying to minimize the routing of this traffic through the Internet. Also, the virtual network in some embodiments can be configured to optimize the layer 4 processing of the data message flows passing through the network.
1. A system with three tiers of SaaS providers for deploying compute and network resources in a plurality of public clouds, the system comprising:
a first public cloud provider to provide compute machines, and network elements to connect the compute machines, in at least a first public cloud datacenter;
a second public cloud provider to provide compute machines, and network elements to connect the compute machines, in at least a second public cloud datacenter;
a virtual network provider (VNP) to deploy different virtual networks that each spans two or more different public cloud datacenters of two or more different public cloud providers; and
a compute and network provider (CNP) to deploy compute machines in the first and second public cloud datacenters for each of a plurality of tenants and to communicate with the VNP to deploy, for each of two or more tenants, a different tenant-specific virtual network that spans the first and second public cloud datacenters of the first and second public cloud providers to connect machines of the tenant (i) that are outside of the first and second public cloud datacenters and (ii) that connect to the first and second public cloud datacenters through a network outside of the public cloud datacenters,
wherein the first and second public cloud providers, the VNP, and the CNP are four different entities that provide three tiers of SaaS services, with the first tier being a public cloud provider tier, the second tier being a VNP tier, and the third tier being a CNP tier.
2. The system of claim 1 , wherein:
the tenants are entities that interact with CNP; and
the CNP provides a set of credentials to the VNP to use to deploy the virtual networks with the different public cloud providers on behalf of the CNP.
3. The system of claim 2 , wherein
the public cloud providers send billing reports to the CNP for resources consumed by the CNP on behalf of the CNP's tenants;
the VNP sends billing reports to the CNP for using resources of the VNP to deploy virtual networks; and
the CNP sends billing reports to the CNP tenants for the compute and network resources that the CNP deploys through the public cloud providers and the VNP.
4. The system of claim 1 , wherein the VNP deploys and configures managed forwarding elements (MFEs) in the first and second public cloud datacenters of the first and second public cloud providers to define different virtual networks.
5. The system of claim 4 , wherein:
the VNP configures a set of measurement agents in a plurality of public cloud datacenters to obtain measurements regarding connections between the plurality of public cloud datacenters; and
the VNP defines, based on the obtained measurements, virtual-network routes through MFEs deployed in the plurality of public cloud datacenters, and distributes the routes to the MFEs to configure these elements to implement the virtual network.
6. The system of claim 5 , wherein the measurements include measurements that quantify at least one of data message throughput speeds of the connections, data message loss values, and delay values of the connections.
7. The system of claim 5 , wherein the VNP has a set of controllers to aggregate said measurements, and based on the aggregated measurements, to define the virtual-network routes.
8. The system of claim 5 , wherein the virtual-network routes are overlay routes established by encapsulating data messages traversing these routes with encapsulation headers that store network addresses for ingress and egress forwarding elements for entering and exiting the virtual network and network addresses of next hop forwarding elements for identifying next hop destinations for traversing the virtual network.
9. The system of claim 4 , wherein:
the MFEs are a first set of MFEs that the VNP deploys for the CNP and
the VNP deploys another set of MFEs for another CNP to connect the compute machines that the other CNP deploys in datacenters of the public cloud providers for the other CNP's tenants.
10. The system of claim 1 , wherein each of the different deployed virtual networks is a virtual wide area network (WAN) that connects machines at multiple different machine locations of a tenant of the CNP, said locations including at least two of an office location, a datacenter location, a remote device location, and a SaaS (Software as a Service) provider location.
11. A method for deploying compute and network resources in a plurality of public clouds, the method comprising:
with a first set of machines associated with a compute and network provider (CNP) that interacts with two or more tenants to deploy, for each tenant, compute machines in first and second public cloud datacenters:
communicating with a second set of machines of a first public cloud provider to deploy compute machines in at least a first public cloud datacenter comprising network elements to connect compute machines in the first public cloud datacenter;
communicating with a third set of machines of a second public cloud provider to deploy compute machines in at least a second public cloud datacenter comprising network elements to connect compute machines in the second public cloud datacenter; and
communicating with a fourth set of machines of a virtual network provider (VNP) to deploy different tenant-specific virtual networks that each spans two or more different public cloud datacenters of two or more different public cloud providers,
wherein each tenant-specific virtual network belongs to a tenant of the CNP,
wherein each of at least two tenant-specific virtual networks for each of at least two tenants spans the first and second public cloud datacenters of the first and second public cloud providers to connect machines of the tenant (i) that are outside of the first and second public cloud datacenters and (ii) that connect to the first and second public cloud datacenters through a network outside of the public cloud datacenter;
wherein the first and second public cloud providers, the VNP, and the CNP are four different entities that provide three tiers of SaaS services, with the first tier being a public cloud provider tier, the second tier being a VNP tier, and the third tier being a CNP tier.
12. The method of claim 11 , wherein:
the tenants are entities that interact with CNP; and
the CNP provides a set of credentials to the VNP to use to deploy the virtual networks with the different public cloud providers on behalf of the CNP.
13. The method of claim 12 , wherein:
the public cloud providers send billing reports to the CNP for resources consumed by the CNP on behalf of the CNP's tenants;
the VNP sends billing reports to the CNP for using resources of the VNP to deploy virtual networks; and
the CNP sends billing reports to the CNP tenants for the compute and network resources that the CNP deploys through the public cloud providers and the VNP.
14. The method of claim 11 , wherein the VNP deploys and configures managed forwarding elements (MFEs) in the first and second public cloud datacenters of the first and second public cloud providers to define different virtual networks.
15. The method of claim 14 , wherein:
the VNP configures a set of measurement agents in a plurality of public cloud datacenters to obtain measurements regarding connections between the plurality of public cloud datacenters; and
the VNP defines, based on the obtained measurements, virtual-network routes through MFEs deployed in the plurality of public cloud datacenters, and distributes the routes to the MFEs to configure these elements to implement the virtual network.
16. The method of claim 15 , wherein the measurements include measurements that quantify at least one of data message throughput speeds of the connections, data message loss values, and delay values of the connections.
17. The method of claim 15 , wherein the VNP has a set of controllers to aggregate said measurements, and based on the aggregated measurements, to define the virtual-network routes.
18. The method of claim 15 , wherein the virtual-network routes are overlay routes established by encapsulating data messages traversing these routes with encapsulation headers that store network addresses for ingress and egress forwarding elements for entering and exiting the virtual network and network addresses of next hop forwarding elements for identifying next hop destinations for traversing the virtual network.
19. The method of claim 14 , wherein:
the MFEs are a first set of MFEs that the VNP deploys for the CNP; and
the VNP deploys another set of MFEs for another CNP to connect the compute machines that the other CNP deploys in datacenters of the public cloud providers for the other CNP's tenants.
20. The method of claim 11 , wherein each of the different deployed virtual networks is a virtual wide area network (WAN) that connects machines at multiple different machine locations of a tenant of the CNP, said locations including at least two of an office location, a datacenter location, a remote device location, and a SaaS (Software as a Service) provider location.