Global Network Policy Configuration Across Multi-Datacenter Clouds
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network management systems are limited to managing networks within a single datacenter and struggle to efficiently manage networks spanning multiple datacenters, especially when including a mix of on-premises and cloud-based datacenters, with challenges in communication and service deployment across different datacenter types.
Innovation Solution
A cloud-based network management system deploying service instances in a container cluster, utilizing microservices and multi-tenant services, with local managers at each datacenter, and persistent connections through connection servers to manage and configure networks across multiple datacenters, ensuring isolation and efficient communication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a cloud-based network management system is deployed to manage multiple tenant networks across diverse datacenters, then the system's versatility and scalability are improved, but the device complexity and difficulty of detecting and measuring system state increase
Solution Approach 1:
The system is segmented into multiple independent service instances, each managing a specific datacenter group. Each service instance contains specialized microservices (policy management, network flow monitoring, threat monitoring) that can be independently deployed and scaled. This segmentation allows the system to handle multiple tenant networks across diverse datacenters while maintaining manageable complexity through modular architecture.
Solution Approach 2:
The system implements multi-tenant services that provide universal functionality across all datacenter groups. These services include common authentication, configuration management, and coordination functions that serve multiple specialized service instances. This universality reduces overall system complexity by centralizing shared functions while allowing specialized services to focus on specific datacenter management tasks.
2Adaptability or versatility
If service instances are deployed for each datacenter group with multiple microservices, then the system's ability to provide specialized network management functions is improved, but the device complexity and resource requirements increase
Solution Approach 1:
The system divides network management functions into specialized service instances, each handling specific datacenter groups. Within each service instance, microservices are segmented by function (policy management, network flow monitoring, threat monitoring). This segmentation enables the deployment of only the necessary services for each datacenter group, reducing overall complexity while maintaining specialized functionality where needed.
Solution Approach 2:
Each service instance is configured with local quality characteristics tailored to its specific datacenter group's requirements. For example, a datacenter group requiring strict security compliance receives enhanced threat monitoring capabilities, while a group prioritizing performance receives optimized network flow monitoring. This local quality approach allows specialized functions to be deployed only where needed, reducing unnecessary complexity.
3Adaptability or versatility
If the system manages multiple datacenter groups with different service configurations, then the adaptability to tenant requirements is improved, but the difficulty of detecting and measuring system state across all groups increases
Solution Approach 1:
The system introduces multi-tenant services as intermediaries between the specialized service instances and the external environment. These intermediary services provide unified interfaces for configuration management, authentication, and state querying. They aggregate and normalize the state information from multiple specialized service instances, making it easier to detect and measure system state across all datacenter groups without directly interfacing with each individual service.
Solution Approach 2:
Multi-tenant services provide universal monitoring and management functions that work across all specialized service instances. These services implement standardized protocols and interfaces for detecting system state, enabling consistent monitoring regardless of the specific service instance or datacenter group being observed. This universality reduces the difficulty of system state detection by providing a single point of access to distributed system information.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Some embodiments provide a method of managing policy for a logical network spanning multiple datacenters, including at least first and second datacenters. The method is performed by a network management service operating in a public cloud to manage the datacenters. The method receives (i) a first policy configuration specifying logical network policy at the first datacenter from a first local network manager at the first datacenter and (ii) a second policy configuration specifying logical network policy at the second datacenter from a second local network manager at the second datacenter. The method consolidates the first and second policy configurations into a global policy configuration that also includes policy configuration defined at the network management service. The method uses the global policy configuration to manage the policy configurations for the logical network.