公开(公告)号：US12192109B2

公开(公告)日：2025-01-07

申请号：US18371454

申请日：2023-09-22

Applicant: VMware LLC

Inventor： Dexiang Wang ,  Sreeram Kumar Ravinoothala ,  Yong Wang ,  Jerome Catrouillet

IPC: H04L47/2416 ,  H04L43/0888 ,  H04L47/122 ,  H04L47/125 ,  H04L47/2425 ,  H04L47/78

Abstract: A network system that implements quality of service (QoS) by rate limiting at a logical network entity is provided. The logical network entity includes multiple transport nodes for transporting network traffic in and out of the logical network entity. The system monitors traffic loads of the multiple transport nodes of the logical network entity. The system allocates a local CR and a local BS to each of the multiple transport nodes. The allocated local CR and the local BS are determined based on the CR and BS parameters of the logical network entity and based on the monitored traffic loads. Each transport node of the logical network entity in turn controls an amount of data being processed by the transport node based on a token bucket value that is computed based on the local CR and the local BS of the transport node.

公开(公告)号：US12120032B2

公开(公告)日：2024-10-15

申请号：US17971591

申请日：2022-10-22

Applicant: VMware LLC

Inventor： Yong Wang ,  Xinhua Hong ,  Sreeram Kumar Ravinoothala ,  Dexiang Wang

IPC: H04L47/24 ,  H04L12/66

CPC classification number: H04L47/24 ,  H04L12/66

Abstract: Some embodiments provide, for a gateway datapath that executes on a gateway device to implement tenant logical routers for multiple different tenant logical networks and process traffic between the tenant logical networks and an external network, a method for managing QoS for the plurality of tenant logical networks. The method receives a data message for a particular tenant logical network. The method executes a set of processing stages to process the data message. The set of processing stages includes a processing stage for a particular tenant logical router of the particular tenant logical network. As part of the processing stage for the particular tenant logical router, the method uses a QoS data structure specific to the particular tenant logical router to determine whether to allow the data message. The gateway device stores at least one separate QoS data structure for each of a set of the tenant logical routers.

公开(公告)号：US12113773B2

公开(公告)日：2024-10-08

申请号：US17570364

申请日：2022-01-06

Applicant: VMware LLC

Inventor： Deepika Solanki ,  Awan Kumar Sharma ,  Yong Wang ,  Sourabh Bhattacharya ,  Sarthak Ray

IPC: H04L9/40 ,  H04L12/46 ,  H04L45/24

CPC classification number: H04L63/0272 ,  H04L12/4641 ,  H04L63/0428 ,  H04L45/24

Abstract: Some embodiments provide a method that identifies multiple paths between a first site and a second site. A security association (SA) is established for transmitting encrypted payload from the first site to the second site in a virtual private network (VPN) session. The method selects a path based on metrics that are obtained for the paths. The selected path is defined by a first endpoint address of the first site and a second endpoint address of the second site. The method sends a message from the first site to the second site to update the SA to switch from using an original path to using the selected path. The message indicates the first and second endpoint addresses. The method transmits a packet including a payload that is encrypted according to the updated SA.

公开(公告)号：US12095889B2

公开(公告)日：2024-09-17

申请号：US17581674

申请日：2022-01-21

Applicant: VMware LLC

Inventor： Yong Wang ,  Guolin Yang ,  Eduard Serra Miralles ,  Dexiang Wang ,  Qing Chang

IPC: H04L69/22 ,  H04L47/31 ,  H04L47/62 ,  H04L47/78

CPC classification number: H04L69/22 ,  H04L47/31 ,  H04L47/6235 ,  H04L47/78

Abstract: Described herein are systems, methods, and software to manage the identification of control packets in an encapsulation header. In one implementation, a computing system may receive a Geneve packet at a network interface and determine that the Geneve packet includes an Operations and Management (OAM) flag. Once the OAM flag is identified, the computing system can select a processing queue from a plurality of processing queues for a main processing system of the computing system based on the OAM flag and assign the Geneve packet to the processing queue.

公开(公告)号：US12021682B1

公开(公告)日：2024-06-25

申请号：US18239923

申请日：2023-08-30

Applicant: VMware LLC

Inventor： Abhishek Goliya ,  Yu Ying ,  Yong Wang

IPC: H04L41/0803 ,  H04L41/0893

CPC classification number: H04L41/0803 ,  H04L41/0893

Abstract: Some embodiments provide a method for configuring logical routers of a logical network. The logical routers are implemented in a Kubernetes cluster as a first set of Pods that each perform logical forwarding operations for the logical routers and a second set of Pods that each perform L7 service operations for a respective logical router. From a Kubernetes control plane component, the method receives a notification that the first set requires scaling to include an additional Pod. The first-set Pods process data messages between the logical network and external networks. Within the network management system, the method defines at least one new interface for processing data messages between the logical network and external networks. The method configures the at least one interface on the additional Pod to communicate with external physical routers to receive traffic from the external networks and send traffic to the external networks.

公开(公告)号：US11902164B2

公开(公告)日：2024-02-13

申请号：US17694586

申请日：2022-03-14

Applicant: VMware, LLC

Inventor： Yong Wang ,  Jia Yu ,  David Leroy

IPC: H04L47/125 ,  H04L9/40

CPC classification number: H04L47/125 ,  H04L63/0272 ,  H04L63/164

Abstract: In an embodiment, a computer-implemented method for using virtual tunnel interface teaming to achieve load balance and redundancy in virtual private networks (“VPNs”) is disclosed. In an embodiment, a method comprises: receiving, by a gateway, configuration data from a control plane; based on the configuration data, configuring on the gateway a bonded virtual tunnel interface (“bonded VTI”) having a plurality of slave virtual tunnel interfaces (“slave VTIs”); configuring a plurality of VPN tunnels between the plurality of slave VTIs configured on the gateway and a plurality of slave VTIs configured on a remote gateway; configuring an IPsec VPN tunnel between the bonded VTI configured on the gateway and a corresponding bonded VTI configured on the remote gateway; logically combining the plurality of VPN tunnels into the IPsec VPN tunnel; and enabling communications of IPsec VPN traffic via the IPsec VPN tunnel.

公开(公告)号：US20250106108A1

公开(公告)日：2025-03-27

申请号：US18827558

申请日：2024-09-06

Applicant: VMware LLC

Inventor： Minjal Agarwal ,  Abhishek Goliya ,  Yong Wang

IPC: H04L41/0893

Abstract: Some embodiments provide a novel method for deploying an edge device as a cluster of pods. The method receives a set of criteria for deploying the edge device. The method uses the set of criteria to deploy the edge device as a set of one or more pods executing on a set of one or more nodes. The method implements, on the set of pods, a set of one or more services to perform on data message flows. At least two pods deployed for the edge cluster perform different service operations of different service types such that the different service types are able to be scaled independently.

公开(公告)号：US20250077249A1

公开(公告)日：2025-03-06

申请号：US18239920

申请日：2023-08-30

Applicant: VMware, LLC

Inventor： Abhishek Goliya ,  Yu Ying ,  Yong Wang

IPC: G06F9/455

Abstract: Some embodiments provide a method for configuring a logical network in a Kubernetes cluster, at a network management system external to the Kubernetes cluster. The method receives a definition of a logical router for the logical network. The logical router definition specifies a set of one or more L7 services to be performed on data messages processed by the logical router. Via a control plane of the Kubernetes cluster, the method defines (i) a first CR instance associated with a first CRD for implementing logical forwarding for the logical router and (ii) for each L7 service, a separate CR instance associated with a second CRD for implementing the L7 service.

公开(公告)号：US20240348561A1

公开(公告)日：2024-10-17

申请号：US18751765

申请日：2024-06-24

Applicant: VMware LLC

Inventor： Yong Wang ,  Boon S. Ang ,  Guolin Yang ,  Wenyi Jiang

IPC: H04L49/1546

CPC classification number: H04L49/1546

Abstract: Some embodiments of the invention provide a method for configuring multiple hardware offload units of a host computer to perform operations on packets associated with machines (e.g., virtual machines or containers) executing on the host computer and to pass the packets between each other efficiently. For instance, in some embodiments, the method configures a program executing on the host computer to identify a first hardware offload unit that has to perform a first operation on a packet associated with a particular machine and to provide the packet to the first hardware offload unit. The packet in some embodiments is a packet that the particular machine has sent to a destination machine on the network, or is a packet received from a source machine through a network and destined to the particular machine.

公开(公告)号：US12095668B2

公开(公告)日：2024-09-17

申请号：US18088562

申请日：2022-12-24

Applicant: VMware LLC

Inventor： Dexiang Wang ,  Yong Wang ,  Jerome Catrouillet ,  Sreeram Kumar Ravinoothala

IPC: H04L47/2466 ,  H04L9/40 ,  H04L12/66 ,  H04L61/5007 ,  H04L69/22 ,  H04L69/326 ,  H04L101/686

CPC classification number: H04L47/2466 ,  H04L12/66 ,  H04L61/5007 ,  H04L63/101 ,  H04L63/20 ,  H04L69/22 ,  H04L69/326 ,  H04L2101/686

Abstract: Some embodiments provide a method for a gateway datapath that executes on a gateway device to implement logical routers for a set of logical networks and process traffic between the logical networks and an external network. The method receives a data message at the gateway device. To process the data message, the method executes a set of processing stages that includes a processing stage for a particular logical router. As part of the processing stage for the particular logical router, the method (i) uses an access control list (ACL) table to determine whether the data message is subject to rate limiting controls defined for the particular logical router and (ii) only when the data message is subject to rate limiting controls, determines whether to allow the data message according to a rate limiting mechanism for the particular logical router.