Granted Patent B2

US 12,407,598 · App. 18/119,208 · Granted Sep 2, 2025

Inventors: Hitesh Patel (Newark, CA); Dileep K. Devireddy (San Jose, CA); Mingsheng Peng (Pleasanton, CA)

Assignee: VMware LLC

H04L45/586H04L45/02H04L45/3065H04L45/42H04L67/567

Abstract

Claims (45)

1. A method for routing data traffic between a group of virtual datacenters implemented in a public cloud, the method comprising:

at a gateway router to which each of at least two of the virtual datacenters in the group of virtual datacenters connect, each respective virtual datacenter comprising a respective set of network management components implemented in the public cloud and a respective set of network endpoints executing in the public cloud and connected by a respective logical network that is managed by the respective network management components of respective virtual datacenter:

receiving routes advertised by the respective logical network at each of the virtual datacenters that connect to the gateway router; and

using the received routes to route data traffic, sent between the logical networks of the virtual datacenters of the group, to routers configured between the logical networks at each of the virtual datacenters and the gateway router;

wherein first traffic entering and exiting a virtual datacenter is associated with a first tier router and a second traffic between the network management components is associated with a second tier router, the first tier router and the second tier router being configured to separate the first traffic and the second traffic, the first tier router being a tier-0 router, the second tier router being a tier-1 router, a virtual datacenter being defined with two tier-1 routers connected to a tier-0 router, the tier-0 router comprising a logical router configured to handle traffic entering and exiting the virtual datacenter, the two tier-1 routers comprising a management gateway and a compute gateway segregated by the tier-0 router.

2. The method of claim 1 , wherein the routes for each virtual datacenter comprise (i) routes for network addresses associated with the network management components of the virtual datacenter and (ii) routes for network addresses associated with the logical network endpoints of the virtual datacenter.

3. The method of claim 1 , wherein (i) the gateway router and (ii) the routers configured for each of the virtual datacenters to connect the virtual datacenters to the gateway router are configured by a cloud management platform.

4. The method of claim 1 , wherein the logical network at a particular virtual datacenter comprises:

a first logical router for handling data traffic entering and exiting the particular virtual datacenter;

a second logical router for connecting one or more management network segments to the first logical router, wherein the network management components are connected to the management network segments; and

a third logical router for connecting one or more logical network segments with network endpoints to the first logical router.

5. The method of claim 4 , wherein the routes received from the particular datacenter are advertised by the second and third logical routers.

6. The method of claim 1 further comprising:

receiving routes for network addresses associated with a virtual private cloud (VPC) of the public cloud that hosts services native to the public cloud; and

using the routes for the network addresses associated with the VPC to route data traffic, sent from the logical networks of the virtual datacenters to the services hosted at the VPC, to a network attachment for the VPC.

7. The method of claim 1 , wherein the group is associated with a particular enterprise, wherein the gateway router is a first gateway router, wherein the method further comprises:

receiving routes for network addresses associated with an on-premises datacenter of the enterprise that belongs to the group; and

using the routes for the network addresses associated with the on-premises datacenter to route data traffic, sent from the logical networks of the virtual datacenters to network endpoints located at the on-premises datacenter, to a second gateway router that provides connectivity for the on-premises datacenter.

8. The method of claim 7 , wherein the second gateway is implemented in the public cloud and uses one of a virtual private network (VPN) and a dedicated line to communicate with the on-premises datacenter.

9. The method of claim 7 , wherein the first gateway router (i) allows data traffic between the virtual datacenters and the on-premises datacenter, (ii) allows data traffic between the virtual datacenters and any VPCs added to the group, (iii) does not allow traffic between the on-premises datacenter and any other on-premises datacenters added to the group, and (iv) does not allow traffic between the on-premises datacenter and any VPCs added to the group.

10. The method of claim 1 , wherein the gateway router and the at least two datacenters are located in a first region of the public cloud, wherein the gateway router is a first gateway router, wherein the method further comprises:

receiving routes advertised by the respective logical networks at each of a set of one or more virtual datacenters that are located in a second region of the public cloud and connect to a second gateway router also located in the second region of the public cloud; and

using said routes to route data traffic, sent from the logical networks of the virtual datacenters located in the first region to the logical networks of the virtual datacenters located in the second region, to the second gateway router.

11. The method of claim 1 , wherein the gateway router is implemented as a horizontally scalable router in the public cloud.

12. A non-transitory machine-readable medium storing a program which when executed by at least one processing unit implements a gateway router for routing data traffic between a group of virtual datacenters implemented in a public cloud, the program comprising sets of instructions for:

receiving routes advertised by a respective logical network at each of at least two virtual datacenters in the group of virtual datacenters that connect to the gateway router, each respective virtual datacenter comprising a respective set of network management components implemented in the public cloud and a respective set of network endpoints executing in the public cloud and connected by a respective logical network that is managed by the respective network management components of respective virtual datacenter; and

using the received routes to route data traffic, sent between the logical networks of the virtual datacenters of the group, to routers configured between the logical networks at each of the virtual datacenters and the gateway router;

wherein a first traffic entering and existing a virtual datacenter is associated with a first tier router and a traffic between the network management components is associated with a second tier router, the first tier router and the second tier router being configured to separate the first traffic and the second traffic, the first tier router being a tier-0 router, the second tier router being a tier-1 router, a virtual datacenter being defined with two tier-1 routers connected to a tier-0 router, the tier-0 router comprising a logical router configured to handle traffic entering and exiting the virtual datacenter, the two tier-1 routers comprising a management gateway and a compute gateway segregated by the tier-0 router.

13. The non-transitory machine-readable medium of claim 12 , wherein the routes for each virtual datacenter comprise (i) routes for network addresses associated with the network management components of the virtual datacenter and (ii) routes for network addresses associated with the logical network endpoints of the virtual datacenter.

14. The non-transitory machine-readable medium of claim 12 , wherein (i) the gateway router and (ii) the routers configured for each of the virtual datacenters to connect the virtual datacenters to the gateway router are configured by a cloud management platform.

15. The non-transitory machine-readable medium of claim 12 , wherein the logical network at a particular virtual datacenter comprises:

a first logical router for handling data traffic entering and exiting the particular virtual datacenter;

a second logical router for connecting one or more management network segments to the first logical router, wherein the network management components are connected to the management network segments; and

a third logical router for connecting one or more logical network segments with network endpoints to the first logical router.

16. The non-transitory machine-readable medium of claim 12 , wherein the program further comprises sets of instructions for:

receiving routes for network addresses associated with a virtual private cloud (VPC) of the public cloud that hosts services native to the public cloud; and

using the routes for the network addresses associated with the VPC to route data traffic, sent from the logical networks of the virtual datacenters to the services hosted at the VPC, to a network attachment for the VPC.

17. The non-transitory machine-readable medium of claim 12 , wherein the group is associated with a particular enterprise, wherein the gateway router is a first gateway router, wherein the program further comprises sets of instructions for:

receiving routes for network addresses associated with an on-premises datacenter of the enterprise that belongs to the group; and

using the routes for the network addresses associated with the on-premises datacenter to route data traffic, sent from the logical networks of the virtual datacenters to network endpoints located at the on-premises datacenter, to a second gateway router that provides connectivity for the on-premises datacenter.

18. The non-transitory machine-readable medium of claim 17 , wherein the second gateway is implemented in the public cloud and uses one of a virtual private network (VPN) and a dedicated line to communicate with the on-premises datacenter.

19. The non-transitory machine-readable medium of claim 17 , wherein the first gateway router (i) allows data traffic between the virtual datacenters and the on-premises datacenter, (ii) allows data traffic between the virtual datacenters and any VPCs added to the group, (iii) does not allow traffic between the on-premises datacenter and any other on-premises datacenters added to the group, and (iv) does not allow traffic between the on-premises datacenter and any VPCs added to the group.

20. The non-transitory machine-readable medium of claim 2 , wherein the gateway router and the at least two datacenters are located in a first region of the public cloud, wherein the gateway router is a first gateway router, wherein the program further comprises sets of instructions for:

receiving routes advertised by the respective logical networks at each of a set of one or more virtual datacenters that are located in a second region of the public cloud and connect to a second gateway router also located in the second region of the public cloud; and

using said routes to route data traffic, sent from the logical networks of the virtual datacenters located in the first region to the logical networks of the virtual datacenters located in the second region, to the second gateway router.

Assignments (2)

Continuity (2)

References Cited (96)