Deploying firewall for virtual network defined over public cloud infrastructure

Abstract

Some embodiments establish for an entity a virtual network over several public clouds of several public cloud providers and/or in several regions. In some embodiments, the virtual network is an overlay network that spans across several public clouds to interconnect one or more private networks (e.g., networks within branches, divisions, departments of the entity or their associated datacenters), mobile users, and SaaS (Software as a Service) provider machines, and other web applications of the entity. The virtual network in some embodiments can be configured to optimize the routing of the entity's data messages to their destinations for best end-to-end performance, reliability and security, while trying to minimize the routing of this traffic through the Internet. Also, the virtual network in some embodiments can be configured to optimize the layer 4 processing of the data message flows passing through the network.

1 - 18 . (canceled) 
     
     
         19 . A method of defining for an entity a virtual wide area network (WAN) over a plurality of public cloud datacenters, the method comprising:
 at each public cloud datacenter in the plurality of public cloud datacenters,
 deploying at least router for forwarding data message flows to at least one other router in at least one other public cloud datacenter; 
 deploying at least one measurement agent to obtain measurements regarding network connections between public cloud datacenters, and to provide the measurements to a controller set that (i) receives other measurements from measurement agents in other public cloud datacenters and (ii) based on the collected measurements, identifies routes between different sets of routers in the public cloud datacenters for different data message flows, said routes defining the virtual WAN; 
 providing the identified routes from the controller set to the router of the public cloud datacenter to use to forward data messages through the virtual WAN. 
   
     
     
         20 . The method of  claim 19 , wherein the public cloud datacenters are public cloud datacenters of one multi-tenant public cloud provider. 
     
     
         21 . The method of  claim 19 , wherein the public cloud datacenters are public cloud datacenters of more than one multi-tenant public cloud provider. 
     
     
         22 . The method of  claim 19 , wherein the measurements include measurements that quantify data message throughput speeds of the connections. 
     
     
         23 . The method of  claim 19 , wherein the measurements include measurements that quantify data message loss values or delay values of the connections. 
     
     
         24 . The method of  claim 19 , wherein the entity and the virtual WAN are a first entity and a first virtual WAN, the method further comprising defining virtual-network routes through the deployed routers in order to define a second virtual WAN for a second entity. 
     
     
         25 . The method of  claim 19 , wherein the virtual WAN is an overlay virtual WAN and the identified routes are overlay routes established by encapsulating data messages traversing these routes with encapsulation headers that store network addresses for ingress and egress routers for entering and exiting the virtual WAN and network addresses of next hop routers for identifying next hop destinations for traversing the virtual WAN. 
     
     
         26 . The method of  claim 25 , wherein at least a subset of the routers are also configured to implement virtual WANs for other entities, wherein the encapsulation headers also store an entity identifier value that identifies the entity associated with the data message. 
     
     
         27 . The method of  claim 19 , wherein the virtual WAN connects machines at multiple different machine locations of the entity, said locations including at least two of an office location, a datacenter location, a remote device location, and a SaaS (Software as a Service) provider location. 
     
     
         28 . The method of  claim 19 , wherein at least two datacenters are in different regions. 
     
     
         29 . The method of  claim 28 , wherein said different regions are different cities, different states, or different countries. 
     
     
         30 . The method of  claim 19 , wherein the measurement agents obtain measurements by sending pinging messages to each other in order to measure signal latency. 
     
     
         31 . The method of  claim 19 , wherein the measurement agents obtain measurements by sending pinging messages to each other in order to measure signal drop rates. 
     
     
         32 . A system for establishing a virtual WAN for an entity over a plurality of public cloud datacenters in a plurality of regions, the apparatus comprising:
 a first set of routers in a first multi-tenant public cloud datacenter in a first region;   a second set of routers in a second multi-tenant public cloud datacenter in a second region different than the first region;   a set of measurement agents deployed in the public clouds to obtain measurements regarding connections between routers in the first and second sets; and   a set of controllers to aggregate said measurements and to define virtual-network routes through the first and second set routers, said routes distributed to the first and second sets of routers to configure these elements to implement the virtual WAN.   
     
     
         33 . The system of  claim 32 , wherein the measurements include measurements that quantify at least one of data message throughput speeds, data loss rates, and data delay values of the connections. 
     
     
         34 . The system of  claim 32 , wherein at least a subset of the routers are also configured to implement virtual WANs for other entities. 
     
     
         35 . The system of  claim 32 , wherein the virtual WAN is a virtual wide area network (WAN) that connects machines at multiple different machine locations of the entity, said locations including at least two of an office location, a datacenter location, a remote device location, and a SaaS (Software as a Service) provider location. 
     
     
         36 . The system of  claim 32 , wherein the measurement agents obtain measurements by sending pinging messages to each other. 
     
     
         37 . A non-transitory machine readable medium storing a program that when executed by at least one processing unit defines for an entity a virtual wide area network (WAN) over a plurality of public cloud datacenters, the program comprising sets of instructions for:
 at each public cloud datacenter in the plurality of public cloud datacenters,
 deploying at least router for forwarding data message flows to at least one other router in at least one other public cloud datacenter; 
 deploying at least one measurement agent to obtain measurements regarding network connections between public cloud datacenters, and to provide the measurements to a controller set that (i) receives other measurements from measurement agents in other public cloud datacenters and (ii) based on the collected measurements, identifies routes between different sets of routers in the public cloud datacenters for different data message flows, said routes defining the virtual WAN; 
 providing the identified routes from the controller set to the router of the public cloud datacenter to use to forward data messages through the virtual WAN. 
   
     
     
         38 . The non-transitory machine readable medium of  claim 37 , wherein the public cloud datacenters are public cloud datacenters of more than one multi-tenant public cloud provider.