Intelligent use of peering in public cloud
Some embodiments provide a method and system for configuring a plurality of managed forwarding elements (MFEs) in a plurality of cloud-provider virtual networks (CPVNs) to make routing decisions that efficiently use a peered transit CPVN and peering with other CPVNs in the plurality of CPVNs. In some embodiments, a controller set receives an identification of peering relationships between CPVNs in the plurality of CPVNs and generates configuration data for configuring each MFE. The configuration data is used to configure the MFE to forward data messages received at the MFE using a peering between a source CPVN and a destination CPVN when possible and to forward data messages received at the MFE to a transit gateway device in a transit CPVN when it is not possible to use a peering between the source and destination CPVNs.
1. A method for configuring a plurality of managed forwarding elements (MFEs) in a plurality of cloud-provider virtual networks (CPVNs) to make routing decisions that efficiently use a peered transit CPVN and peering with other CPVNs in the plurality of CPVNs, the MFEs implementing a logical forwarding element of a tenant logical network spanning the transit CPVN and the plurality of CPVNs, the method comprising:
at a set of controller computers,
receiving an identification of peering relationships between CPVNs in the plurality of CPVNs;
generating configuration data for configuring each particular MFE (1) to forward data messages received at the particular MFE using a peering between a source CPVN including a source compute node in the tenant logical network and a destination CPVN including a destination compute node when possible and (2) to forward data messages received at the particular MFE to a transit gateway device in a transit CPVN when it is not possible to use a peering between the source and destination CPVNs, the transit gateway device implementing a logical routing element of the tenant logical network; and
sending the configuration data for each particular MFE to a corresponding configuration agent executing in a CPVN in which the particular MFE executes to configure the particular MFE.
2. The method of claim 1 , wherein it is possible to forward a data message received at each particular MFE when (1) a peering exists between a source and destination CPVN and (2) no service provided by the transit gateway device is required for the data message.
3. The method of claim 1 , wherein the configuration data for configuring a particular MFE comprises a list of internet protocol (IP) addresses and prefixes for which using peering is impossible.
4. The method of claim 3 , wherein the configuration data is used to remove routes to the IP addresses and prefixes included in the list, so that a default route to the transit gateway device is used to route data messages matching the IP addresses and prefixes included in the list.
5. The method of claim 1 , wherein the tenant logical network is implemented as an overlay logical network and the IP addresses assigned to compute nodes in the tenant logical network executing in the plurality of CPVNs are identical to the IP addresses assigned to the compute nodes by a cloud-provider to implement the CPVNs.
6. The method of claim 5 , wherein the compute nodes are connected to an MFE implementing a hybrid logical switching element that performs switching for both a CPVN and the tenant logical network.
7. The method of claim 1 , wherein using the peering between a source CPVN and a destination CPVN comprises sending a data message to a forwarding element of the source CPVN without encapsulation.
8. The method of claim 7 , wherein the forwarding element of the source CPVN encapsulates the data message before forwarding the data message to the destination CPVN.
9. The method of claim 1 , wherein forwarding a data message received at a specific MFE to a transit gateway device comprises encapsulating the data message with an address associated with the transit gateway device.
10. A system comprising:
a set of controller computers; and
a plurality of managed forwarding elements (MFEs) in a plurality of cloud-provider virtual networks (CPVNs) comprising a transit CPVN peered with each CPVN and a set of other CPVNs peered with other CPVNs in the plurality of CPVNs, the MFEs implementing a logical forwarding element of a tenant logical network spanning the transit CPVN and the plurality of CPVNs;
the set of controller computers comprising a non-transitory machine readable medium storing a program comprising sets of instructions for:
receiving an identification of peering relationships between CPVNs in the plurality of CPVNs;
generating configuration data for configuring each particular MFE (1) to forward data messages received at the particular MFE using a peering between a source CPVN including a source compute node in the tenant logical network and a destination CPVN including a destination compute node when possible and (2) to forward data messages received at the particular MFE to a transit gateway device in a transit CPVN when it is not possible to use a peering between the source and destination CPVNs, the transit gateway device implementing a logical routing element of the tenant logical network; and
sending the configuration data for each particular MFE to a corresponding configuration agent executing in a CPVN in which the particular MFE executes to configure the particular MFE.
11. The system of claim 10 , wherein it is possible to forward a data message received at each particular MFE when (1) a peering exists between a source and destination CPVN and (2) no service provided by the transit gateway device is required for the data message.
12. The system of claim 10 , wherein the configuration data for configuring a particular MFE comprises a list of internet protocol (IP) addresses and prefixes for which using peering is impossible.
13. The system of claim 12 , wherein the configuration data is used to remove routes to the IP addresses and prefixes included in the list, so that a default route to the transit gateway device is used to route data messages matching the IP addresses and prefixes included in the list.
14. The system of claim 10 , wherein the tenant logical network is implemented as an overlay logical network and the IP addresses assigned to compute nodes in the tenant logical network executing in the plurality of CPVNs are identical to the IP addresses assigned to the compute nodes by a cloud-provider to implement the CPVNs.
15. The system of claim 14 , wherein the compute nodes are connected to an MFE implementing a hybrid logical switching element that performs switching for both a CPVN and the tenant logical network.
16. The system of claim 10 , wherein using the peering between a source CPVN and a destination CPVN comprises sending a data message to a forwarding element of the source CPVN without encapsulation.
17. The system of claim 16 , wherein the forwarding element of the source CPVN encapsulates the data message before forwarding the data message to the destination CPVN.
18. The system of claim 10 , wherein forwarding a data message received at a specific MFE to a transit gateway device comprises encapsulating the data message with an address associated with the transit gateway device.