143 results about "Virtual network interface" patented technology

A system and method for configuring a client device to communicate utilizing a secure web gateway. The method includes generating a virtual network interface having a namespace with a plurality of names, wherein a first name of the namespace is assigned to a client device; assigning a second name of the namespace to a resource accessible to the client device through a zero trust network environment, wherein the resource is deployed in a secure network environment; and configuring the client device to communicate only through the virtual network interface.

Systems and methods are disclosed for implementing cloud network service management. In certain embodiments, a method may comprise operating a cloud native application (CnApp) custom operator in a containerized software environment to dynamically manage cloud native network service on a target application pod via a persistent network interface to an external network. The method may include obtaining a first resource definition data, for a first custom resource, to define attributes for a bundle of resources used to implement the cloud native network service, and creating the first custom resource based on the first resource definition data, including initializing the target application pod. The method may include generating a second resource definition data, derived from the first resource definition data, to define attributes for a virtual network interface to associate with the target application pod, and applying the second resource definition data to initialize creation of a second custom resource.

A zero trust cloud environment provides access to a secure network, and secure network applications. The zero trust cloud environment performs authentication of a user account, and upon successful completion initiates a secure network application, such as an SSH session to a server in a secure network. The server is instructed to generate an isolated network namespace through which a virtual network interface is bridged to the default network namespace. A firewall of the default network namespace does not permit network traffic from the virtual network interface to pass if it is directed to an address of the secure network.

Techniques are described for communications in an L2 virtual network. In an example, the L2 virtual network includes a plurality of L2 compute instances hosted on a set of host machines and a plurality of L2 virtual network interfaces and L2 virtual switches hosted on a set of network virtualization devices. An L2 virtual network interface emulates an L2 port of the L2 virtual network. IGMP configuration is distributed to the L2 virtual switches. A control plane of the L2 virtual network coordinates IGMP configuration across the L2 virtual switches.

A Network Virtualization Device (NVD) executes a set of Virtual Network Interface Cards (VNICs). The set of VNICs includes a first VNIC that forwards packets for a set of one or more packet flows. The NVD stores a first VNIC-related information that includes information identifying a first set of one or more packet flows and associated state information The NVD in response to determining that the state information for the first VNIC is to be synchronized with another NVD, identifies a first backup NVD for the first VNIC, wherein the first backup NVD is a backup for the first VNIC, and communicates to the first backup NVD, a portion of the state information stored by the NVD for the first VNIC.

Techniques are described for communications in an L2 virtual network. In an example, the L2 virtual network includes a plurality of L2 compute instances hosted on a set of host machines and a plurality of L2 virtual network interfaces and L2 virtual switches hosted on a set of network virtualization devices. An L2 virtual network interface emulates an L2 port of the L2 virtual network. Access control list (ACL) information applicable to the L2 port is sent to a network virtualization device that hosts the L2 virtual network interface.

Systems and methods are disclosed for implementing a cloud based network function. In certain embodiments, a method may comprise operating a custom operator in a containerized software environment such as Kubernetes to manage a virtual network interface controller (Vnic) on an application pod, the Vnic being reachable directly from a network external to the containerized software environment. The method may include identifying the application pod to which to add the Vnic, determining a worker node in the containerized software environment on which the application pod is running, creating the Vnic on the worker node, and executing a job on the worker node to inject the Vnic into the application pod.

A system for optimizing network traffic management is provided. The system includes a plurality of data processing units (DPUs), each assigned an identifier and configured to process network traffic for associated virtual network interface cards (vNICs). The system also includes a vNIC placement handler configured to receive media access control (MAC) address information from the plurality of DPUs and execute a relocation of at least two vNICs to be directly associated with one of the plurality of DPUs without through an inter-DPU physical network based on mapping the MAC address information to the identifier. The system further includes a communication framework integrated with the vNIC placement handler to enable transmission of MAC address information from the plurality of DPUs to the vNIC placement handler and offload network traffic from the vNICs to corresponding one or more of the plurality of DPUs.

The present technology pertains to receiving, by a multi-tenanted cloud-native headend, network traffic from a source that is directed to a destination within a network of a first tenant, where the network traffic is routed using BGP over a multi-tenanted BGP network, where the multi-tenanted BGP network utilizes route isolation to isolate the network of the first tenant from networks of other tenants making use of the multi-tenanted BGP network, mapping the received network traffic based on at least a source IP, source port, and virtual network interface (VNI) to a port associated with the network of the first tenant over the isolated BGP route, where the mapping is a stateful mapping, where the mapping is also potentially based on other information associated with the network traffic, and directing the received network traffic to a local address in the network of the first tenant.

Techniques are disclosed for providing high performant packets processing capabilities in a virtualized cloud environment that enhance the scalability and high availability of the packets processing infrastructure. In certain embodiments disclosed herein, the VNICs functionality performed by network virtualization devices (NVDs) is offloaded from the NVDs to a fleet of computers, referred to as VNIC-as-a-Service System (or VNICaaS system). VNICaaS system is configured to provide Virtual Network Interface Cards (VNICs)-related functionality or service for multiple compute instances belonging to multiple tenants or customers of the CSPI. The VNICaaS system is capable of hosting multiple VNICs to process and transmit traffic in a distributed virtualized cloud networks environment. A single VNIC executed by the VNICaaS system can be used to process packets received from multiple compute instances.

The invention discloses a container cluster management system, which comprises a plurality of working nodes, an interception module, a forwarding network bridge and an agent module, the working node comprises a namespace, and the namespace comprises a virtual network interface; the interception module is arranged at a virtual network interface and is used for monitoring and intercepting data passing through the virtual network interface, when the data is non-service data, the non-service data is forwarded to the agent module through a forwarding network bridge, and when the data is service data, the service data is not intercepted; the forwarding network bridge is arranged between the namespace and the working node and is used for providing communication capability between the namespace and the working node and forwarding the non-service data intercepted by the interception module to the proxy module; and the agent module is arranged in the working node and is used for processing the received non-business data. In this way, the non-service data can be processed in the working node as much as possible, the influence on external infrastructures can be reduced, and the performance of the container network cannot be reduced.

A container-based parallel computing system for executing high-performance computing (HPC) applications. The system leverages container technology to package the applications executed at the nodes in a cluster. To load and execute a job in the parallel computing system, containers are deployed in a cluster that include all the application resources and configuration information that the particular HPC application needs to execute. An event-driven batch scheduler may be used to dynamically allocate resources for executing multi-node jobs in the container-based parallel computing system, handling the coordination of resource allocation for the customer. The scheduler insures that jobs begin executing as fast as possible, and handles failure conditions such as partial scaling. Virtual network interfaces are attached to the containers that allow the containers to connect to and communicate with other containers in the cluster directly through the network interfaces of host machines using IP addresses provided by the virtual network interfaces.

A system and method for directing network traffic in a client device based on a domain catalog. The method includes generating a virtual network interface having a namespace with a plurality of names, wherein a first name of the namespace is assigned to a client device; assigning a second name of the namespace to a resource accessible to the client device through a zero trust network environment; configuring the client device to communicate only through the virtual network interface; and sending network traffic to the resource, in response to determining that the resource is allowed based on a domain catalog.

A method including acquiring virtual location information of a virtual data buffer of a virtual network interface component; designating physical location information of a physical data buffer of a physical network interface component as the virtual location information; and storing data according to the virtual location information when the data is being stored into the physical data buffer. Since the physical location information of the physical data buffer of the physical network interface component is designated as the virtual location information instead of being determined via allocation by a physical device. Thus, the physical network interface component is capable of storing, upon receiving data, the data into a data buffer designated by the virtual network interface component, thereby eliminating the process of copying data from a data buffer designated by the physical network interface component to the data buffer designated by the virtual network interface component.

An illustrative method includes a container storage system detecting an event that occurs within a container system comprising a plurality of nodes; determining that the event has a potential to impact, by more than a threshold amount, performance of a first virtual network interface used by the nodes; and transmitting, based on the determining that the event has the potential to impact the performance of the first virtual network interface by more than the threshold amount, a request to a network provider system for the network provider system to provide a second virtual network interface for use by one or more of the nodes.

The invention relates to the technical field of computer networks, and discloses a communication method and device for a computing node, equipment and a storage medium. The method is applied to a computing node, the computing node comprises a virtual switch and a physical network card, a plurality of virtual network interfaces are created in the virtual switch, the plurality of virtual network interfaces are in one-to-one correspondence with a plurality of service networks, and the physical network card is connected with at least one other node. The method comprises the following steps: receiving a target data message of a target service network through a target virtual network interface of a virtual switch; and sending the target data message to a corresponding node in the at least one other node through the physical network card. A plurality of virtual network interfaces are created in the virtual switch, and one virtual network interface corresponds to one service network, so that deployment of a plurality of service networks in the virtual switch is realized, network multiplexing in the virtual switch is realized, and the problem that physical network card resources of computing nodes are insufficient is solved. And a plurality of virtualized networks cannot be provided.

Techniques are described for enforcing the flow of traffic between VNICs using ZPR policy. A method includes accessing a ZPR policy that specifies how a flow of traffic is enforced between endpoints within the one or more networks, wherein the policy includes one or more layer 4 rules and one or more layer 7 rules; identifying from the ZPR policy, a ZPR statement that specifies a connection between a first virtual network interface card (VNIC) and an endpoint; generating, based on the ZPR statement, one or more network security group (NSG) rules; and distributing at least one of the one or more NSG rules to a first NSG associated with the first VNIC.

An illustrative method includes a container storage system detecting an event that occurs within a container system comprising a plurality of nodes; determining that the event has a potential to impact, by more than a threshold amount, performance of a first virtual network interface used by the nodes; and transmitting, based on the determining that the event has the potential to impact the performance of the first virtual network interface by more than the threshold amount, a request to a network provider system for the network provider system to provide a second virtual network interface for use by one or more of the nodes.

Methods, systems, and computer program products for computer networking. Legacy policy-based routing is advanced by adding fallback-aware policy actions that are enabled within a policy-based routing regime. Upon determining that a destination specified in a subject policy is compromised, or down, or unreachable then, a fallback-aware policy action is invoked. Destinations specified in policies may refer to inserted services, wherein an inserted service can be any one of, a service process, a service virtual machine, a hardware network component, or a virtual network interface. Such inserted services might implement a logging service, or a firewall service, or other services that can process a network packet. Fallback-aware policy actions include, a PASSTHROUGH fallback action, an ALLOW fallback action, a FORWARD fallback action, and a DROP fallback action. Various techniques serve to determine whether or not a particular destination of a subject policy is deemed to be compromised, or down or unreachable.

The invention relates to the technical field of computers and provides a method for kernel mode flow control unloading, computer equipment and a medium. Kernel mode flow control is realized, message forwarding and hardware unloading kernel mode flow control are realized through cooperation of the kernel mode flow control data path module and the virtual switch of the user space, the pressure of the central processing unit is released, the flow table processing efficiency is improved, and the flow table processing efficiency is improved by expanding and optimizing the message. According to the method, the forwarding information is added to support kernel mode flow control unloading, so that a kernel protocol interface and a kernel protocol stack of an operating system can be called for processing, and the kernel mode flow control unloading is supported on the basis of supporting the kernel mode flow control unloading; the corresponding relation between the virtual network interface and the virtual instance device and the corresponding relation between the virtual instance device and the representative device can be flexibly adjusted, and therefore the requirement of a user for customizing input and output resources is met.

Embodiments of an overlay network with innovative virtual network switches and related network interface controllers are disclosed. According to one embodiment, the overlay network may comprise at least one virtual network switch (VNS), wherein each VNS is installed within a corresponding first processing endpoint which is logically above a virtualization layer of a virtual network. And, the VNS may be configured to intercept data packets transmitted on a network layer logically below the virtualization layer of the virtual network. The VNS may comprise: (a) a manager element configured to connect to at least one virtual network interface controller (VNIC), each VNIC being installed within a corresponding second processing endpoint of the virtual network, the second processing endpoint being separate from the first processing endpoint; (b) a replicator node configured to replicate and route the data packets; and (c) a switch controller configured to control the first replicator node.

The embodiment of the invention provides a cloud private line connectivity test method and device, electronic equipment and a storage medium. A virtual switch is installed on a simulation node; constructing a first virtual network interface and a second virtual network interface for installing the virtual switch; creating a network namespace for simulating the network environment of the client side equipment at the simulation node; adding the second virtual network interface to the network namespace, and simulating the second virtual network interface to configure network information for the network namespace; adding the first virtual network interface to an integrated bridge, and creating a flow table on the integrated bridge; executing flow receiving and transmitting through the flow table, the network information and the network namespace, and generating flow receiving and transmitting state information; according to the method, the connectivity of the cloud private line between the cloud host and the network namespace is detected based on the traffic transceiving state information, the connectivity of the cloud private line is tested on the basis of not excessively depending on a test environment, the test cost is reduced, and the test efficiency is improved.

Various embodiments of the present technology generally relate to a VnicSet operator system containing instructions to implement a process to manage a virtual network interface controller (Vnic) on an application pod of a containerized software environment, the Vnic being directly reachable from a network external to the containerized software environment. In an aspect, the process includes monitoring a plurality of Vnics created for deployment within the containerized software environment, each of the plurality of Vnics being associated with a respective application pod within the containerized software environment, determining one or more non-active Vnics within the plurality of Vnics, and rectifying the one or more non-active Vnics.

The present disclosure provides a configuration method for virtual network interface card resource, including: integrating a plurality of virtual network interface cards in a node where a container group is located, so as to obtain a virtual network interface card set including a plurality of virtual network interface card groups; assigning a target virtual network interface card group for the container group from the virtual network interface card set; analyzing the target virtual network interface card group to obtain address information of target virtual network interface cards in the target virtual network interface card group; and configuring a virtual network interface card resource for the container group according to the address information.

A method for configuring a communication network including a gateway adapted for connecting the communication network to a wide area communication network and connected to a plurality of nodes implementing an access point functionality is described. The nodes are coordinated in a centralised manner by a current master node selected from the plurality of nodes. The current master node obtains a virtual MAC address and an IP address associated with the virtual MAC address, the IP address being reserved for configuring network services. It next configures a virtual network interface from the IP address associated with the virtual MAC address.

A cloud computing resource system may receive an allocation request to connect the virtual machine to a customer network, wherein the virtual machine is executing while the allocation request is received and the allocation request includes network configuration information of the customer network. A cloud computing resource system may detect a discovery request from the virtual machine triggered by receipt of the allocation request, wherein the virtual machine remains executing during detection of the discovery request. A cloud computing resource system may update, responsive to detecting the discovery request from the virtual machine, a virtual network interface controller of the virtual machine with the network configuration information of the customer network, wherein the virtual machine remains executing during updating of the network configuration information.

Provided in the embodiments of the present application are a message forwarding method, a network information management method, a related device and a storage medium. In the embodiments of the present application, a virtual switch undergoes function division, where an operation and maintenance management module is responsible for providing network management and operation and maintenance services for virtual network interface controllers, and a first network forwarding module and a second network forwarding module are responsible for separately providing data forwarding services for different virtual network interface controllers; in terms of deployment, the operation and maintenance management module and the first network forwarding module are run on a hardware acceleration device, while the second network forwarding module is deployed on a physical machine, thus achieving a hybrid virtualization architecture. The present application can expand the network virtualization functionality by using processors and memories of physical machines while keeping hardware architectures and control architectures of hardware acceleration devices unchanged, so as to improve the network virtualization capability, thus increasing the number of virtual network interface controllers serviced by virtual switches and improving the network performance and the deployment density of virtualization instances (such as VM).

The embodiment of the invention relates to remote server isolation using a zero-trust architecture. A zero-trust cloud environment provides access to secure networks and secure network applications. A zero-trust cloud environment performs authentication of a user account and initiates a secure network application, such as an SSH session with a server in a secure network, upon successful completion. The server is instructed to generate an isolated network namespace through which the virtual network interface is bridged to a default network namespace. If network traffic from the virtual network interface is directed to a secure address, the firewall of the default network namespace does not allow the traffic to pass.

Techniques are described for communications in an L2 virtual network. In an example, the L2 virtual network includes a plurality of L2 compute instances hosted on a set of host machines and a plurality of L2 virtual network interfaces and L2 virtual switches hosted on a set of network virtualization devices. An L2 virtual network interface emulates an L2 port of the L2 virtual network. Storm control information applicable to the L2 port is sent to a network virtualization device that hosts the L2 virtual network interface.

A distributed unit (DU) in a virtual radio access network (vRAN) of a wireless 5G (fifth generation) network is implemented using software-defined networking (SDN) technology on a single computer server that is physically co-located with a radio unit in a distributed RAN (D-RAN) architecture. An update agent facilitates versioning support through interoperations with different DU versions, v1 and v2, to prevent them from concurrently executing real-time processing threads on the server's processor which would cause malfunctions. DU v2 is initialized using non-real-time threads. The update agent blocks real-time processing thread generation by DU v2 after initialization is complete. The update agent sets DU v1 processing threads to non-real-time and unblocks DU v2 to migrate data traffic between the versions. A layer 2 switch provides duplicated data packets to virtual network interface cards that are implemented for the respective DU versions and which share a common MAC (medium access control) address.