Embodiments are directed to managing communication over one or more networks. A monitoring engine may be instantiated to perform actions including receiving network traffic from a physical network that may be associated with network addresses of the physical network. The monitoring engine may analyze the network traffic to associate activity with gateway identifiers (GIDs) associated with gateway computers in an overlay network such that the GIDs are separate from the network addresses. The monitoring engine may be arranged to monitor the network traffic based on monitoring rules. The monitoring engine may provide metrics associated with the gateway computers based on the monitoring of the network traffic. The monitoring engine may compare the metrics to event rules. The monitoring engine may generate events based on affirmative results of the comparison. The events may be mapped to actions based on characteristics of the events and executed.

Systems, computer-readable media, and methods are disclosed for parallel data processing for service function chains with network functions spanning multiple servers. An example system includes a first server hosting a first network function of a service function chain, a second server hosting a second network function of the service function chain, a mirror function deployed in a first switch to replicate a plurality of packets received by the system and to send respective copies of the plurality of packets to the first network function and to at least one of the second network function and a third network function of the service function chain, and a merge function deployed in a second switch to merge respective outputs of the first network function and the at least one of the second network function and the third network function.

Systems, computer-readable media, and methods are disclosed for parallel data processing for service function chains with network functions spanning multiple servers. An example system includes a first server hosting a first network function of a service function chain, a second server hosting a second network function of the service function chain, a mirror function deployed in a first switch to replicate a plurality of packets received by the system and to send respective copies of the plurality of packets to the first network function and to at least one of the second network function and a third network function of the service function chain, and a merge function deployed in a second switch to merge respective outputs of the first network function and the at least one of the second network function and the third network function.

The present application relates to traffic routing for overlay paths in a public cloud network. A path orchestrator receives a configuration of a set of overlay paths for a wide area network virtualization from a client, each overlay path including virtual routing nodes associated with respective geographic regions and at least one policy for a link between the virtual routing nodes. The path orchestrator is configured to instantiate a plurality of virtual routers on computing resources of the public cloud network located within the respective geographic regions based on the configuration, each virtual router configured to route traffic according to the policy for each link associated with the virtual routing node corresponding to the virtual router. The path orchestrator is configured to scale the plurality of virtual routers based on traffic for the client on the set of overlay paths.

A method includes determining a corresponding level of a security model associated with each device of a plurality of devices connected to a network, each level of the security model having a corresponding tag; applying, to each of the plurality of devices, the corresponding tag based on the corresponding level of the security model with which each of the plurality of devices are associated; receiving, over a network connection, network traffic from at least one of the plurality of devices and the corresponding tag; analyzing the corresponding tag associated with the network traffic; determining a destination for the network traffic; applying one or more security measures to the network traffic based on the corresponding tag for the at least one device and a corresponding tag of the destination for the network traffic; and sending the network traffic to the destination with the corresponding tag of the destination.

The disclosure describes examples where a first data center includes a first gateway router, a first set of computing devices, and a second set of computing devices. The first set of computing devices is configured to execute a software defined networking (SDN) controller cluster to facilitate operation of one or more virtual networks within the first data center. The second set of computing devices is configured to execute one or more control nodes to exchange route information, between the first gateway router and a second gateway router of a second data center different than the first data center, for a virtual network between computing devices within the second data center, and to communicate control information for the second data center to the second set of computing devices, wherein the one or more control nodes form a subcluster of the SDN controller cluster.

The disclosure describes examples where a first data center includes a first gateway router, a first set of computing devices, and a second set of computing devices. The first set of computing devices is configured to execute a software defined networking (SDN) controller cluster to facilitate operation of one or more virtual networks within the first data center. The second set of computing devices is configured to execute one or more control nodes to exchange route information, between the first gateway router and a second gateway router of a second data center different than the first data center, for a virtual network between computing devices within the second data center, and to communicate control information for the second data center to the second set of computing devices, wherein the one or more control nodes form a subcluster of the SDN controller cluster.

A method for managing traffic in a computerized system that may include routers and at least one edge device, the method may include performing traffic management operations for controlling traffic related to the routers while executing a first traffic management operations by the at least one edge device, and executing second traffic management operations by the routers.

A method for managing traffic in a computerized system that may include routers and at least one edge device, the method may include performing traffic management operations for controlling traffic related to the routers while executing a first traffic management operations by the at least one edge device, and executing second traffic management operations by the routers.

In general, this disclosure describes a programmable network platform for dynamically programming a cloud exchange to provide a layer three (L3) routing instance as a service to customers of the cloud exchange. In one example, a cloud exchange comprises an L3 network located within a data center and configured with an L3 routing instance for an enterprise; and for the L3 routing instance, respective first and second attachment circuits for first and second cloud service provider networks co-located within the data center, wherein the L3 routing instance stores a route to a subnet of the second cloud service provider network to cause the L3 routing instance to forward packets, received from the first cloud service provider network via the first attachment circuit, to the second cloud service provider network via the second attachment circuit.