Distributed visibility fabrics for private, public, and hybrid clouds
Improved network visibility may be achieved by deriving network traffic information from numerous visibility platforms that are communicatively coupled to one another. In some embodiments, an end user interacts with a distributed visibility fabric via a user interface, which can include a high-level representation of each visibility platform. The end user can then map the network objects of each visibility platform onto a series of network visibility appliances. This technique allows certain network objects (e.g., maps) to be intelligently distributed amongst the series of network visibility appliances.
1. A visibility platform comprising:
an agent, mounted on a virtual machine, configured to acquire virtualized traffic of a specific end user;
a first network visibility appliance configured to forward the virtualized traffic to an ingress endpoint of a tunnel; and
a second network visibility appliance configured to
receive the virtualized traffic at an egress endpoint of the tunnel, and
dispatch at least some of the virtualized traffic to a network tool.
2. The visibility platform of claim 1 , wherein the first network visibility appliance resides within a virtual network of a cloud computing platform.
3. The visibility platform of claim 1 , further comprising:
a controller configured to
interface with an application programming interface (API) of a multi-tenant cloud computing platform to identify the virtual machine belonging to the specific end user and traffic flows of the virtual machine, and
receive user input indicative of a selection of a specific traffic flow of the virtual machine.
4. The visibility platform of claim 3 , wherein the agent is further configured to:
create a duplicate traffic flow by mirroring the specific traffic flow of the virtual machine; and
forward the duplicate traffic flow as the virtualized traffic to the ingress endpoint of the tunnel.
5. The visibility platform of claim 3 , wherein the specific traffic flow represents virtualized traffic traversing a specific virtualized network interface card (vNIC) of the virtual machine.
6. The visibility platform of claim 4 , wherein the agent is further configured to:
apply a traffic filter before forwarding the duplicate traffic flow to the ingress endpoint of the tunnel.
7. The visibility platform of claim 4 , wherein the second network visibility appliance is further configured to:
apply a traffic filter before forwarding the at least some of the virtualized traffic to the network tool.
8. The visibility platform of claim 1 , wherein dispatching at least some of the virtualized traffic to the network tool comprises:
forwarding the at least some of the virtualized traffic to an ingress endpoint of another tunnel for transmission to the network tool.
9. The visibility platform of claim 1 , wherein the second network visibility appliance resides within a computing environment controlled by the specific end user.
10. The visibility platform of claim 9 , further comprising:
a local agent configured to acquire traffic traversing the computing environment controlled by the specific end user.
11. A method comprising:
acquiring, on a virtual machine, virtualized traffic of a specific end user;
forwarding the virtualized traffic to an ingress endpoint of a tunnel;
receiving the virtualized traffic at an egress endpoint of the tunnel; and
dispatching at least some of the virtualized traffic to a network tool.
12. The method of claim 11 , wherein said forwarding is performed within a virtual network of a cloud computing platform.
13. The method of claim 11 , further comprising:
interfacing with an application programming interface (API) of a multi-tenant cloud computing platform to identify a virtual machine belonging to the specific end user and traffic flows of the virtual machine, and
receiving user input indicative of a selection of a specific traffic flow of the virtual machine.
14. The method of claim 13 , further comprising:
creating a duplicate traffic flow by mirroring the specific traffic flow of the virtual machine; and
forwarding the duplicate traffic flow as the virtualized traffic to the ingress endpoint of the tunnel.
15. The method of claim 13 , wherein the specific traffic flow represents virtualized traffic traversing a specific virtualized network interface card (vNIC) of the virtual machine.
16. The method of claim 14 , further comprising:
applying a traffic filter before forwarding the duplicate traffic flow to the ingress endpoint of the tunnel.
17. The method of claim 14 , further comprising:
applying a traffic filter before forwarding the at least some of the virtualized traffic to the network tool.
18. The method of claim 11 , wherein dispatching at least some of the virtualized traffic to the network tool comprises:
forwarding the at least some of the virtualized traffic to an ingress endpoint of another tunnel for transmission to the network tool.
19. The method of claim 11 , wherein said receiving and said dispatching are performed within a computing environment controlled by the specific end user.
20. The method of claim 19 , further comprising:
using a local agent to acquire traffic traversing the computing environment controlled by the specific end user.