Aviatrix Systems, Inc.

In one embodiment, a system for managing a multi-cloud infrastructure is described. The system comprises a conversation analytic service and fulfillment logic. The conversation analytic service is configured to (i) translate incoming data pertaining to query into one or more groups of words, (ii) process the one or more groups of words into a resultant word group for determining an intent associated with the incoming data, and (iii) generate an event request message that includes content identifying the intent associated with the incoming data. The fulfillment logic is communicatively coupled to the conversation analytic service and is configured to retrieve data associated with the intent from cloud resources. The retrieved data is returned to the conversation analytic service for generation of a response to the query associated with the incoming data.

A system featuring a controller and a plurality of nodes operating as a Kubernetes cluster. The plurality of nodes includes a master node communicatively coupled to the controller, and an ingress node being configured to (i) access the master node to obtain at least a first attribute associated with a data flow received by the ingress node based on a network address associated with a source of the data flow, (ii) determine one or more network policies applicable to the data flow based on at least the first attribute, and (iii) determine a classification identifier based on the one or more network policies. The classification identifier provides context associated with the data flow and a reliable association between an application and the data flow associated with the application during propagation of the data flow over a cloud network.

In one embodiment, a computing platform featuring a controller and a first virtual private cloud network, which is communicatively coupled to the controller. The first virtual private cloud network includes at least a first gateway including egress filtering logic. The egress filtering logic is configured to (i) filter messages routed from the first gateway in accordance with a first set of filtering rules maintained by the first gateway and (ii) bypass the filtering of messages directed to or originating from one or more subnetworks in accordance with the first set of filtering rules.

A distributed cloud computing system is disclosed that includes a controller configured to deploy network constructs including any of transit gateways, spoke gateways, subnets, or private networks and logic that, upon execution by one or more processors, causes performance of operations including: causing rendering of a graphical user interface that includes a display panel configured to display progress of a build process for a network topology graph, receiving first user input through the graphical user interface indicating selection of a first cloud service provider, a first access account, and a first cloud region, receiving second user input through the graphical user interface indicating selection of one or more of the network constructs to be deployed in the first cloud region, instructing the controller to deploy the one or more of the network constructs in the first cloud region according to the first user input and the second user input.

A network device, such as an ingress gateway for example, includes data analytic logic and message reconfiguration logic. The data analytic logic is configured to determine which of at least one network policy of a plurality of network policies is applicable to an incoming data flow and assigning a classification identifier in accordance with the at least one network policy. The classification identifier is configured to influence routing paths through at least one cloud network. The message reconfiguration logic is configured to encapsulate the classification identifier into content of the incoming data flow in order to generate a classified data flow for routing from a source to a destination through the at least one cloud network.

A distributed cloud computing system is disclosed that includes a controller configured to deploy a first gateway in a first cloud computing network and a second gateway in a second cloud computing network and logic. The logic, upon execution by one or more processors, causes operations including receiving, from the controller, metadata pertaining to a plurality of constructs, receiving, from each of the first and second gateways, network data, deriving gateway metrics spanning multiple cloud computing networks including at least the first and second cloud computing networks, wherein the deriving is based on at least the metadata and the network data of each of the first and second gateways, generating a dashboard visualization illustrating the gateway metrics, wherein the gateway metrics pertain to characteristics of each gateway and deployed constructs associated with each gateway, and causing rendering of the dashboard visualization on a display screen.

In communication with components of a cloud platform, namely a software-defined network constructed to overlay at least one public cloud network, a controller features a virtual processor and a data store. The data store includes network address translation (NAT) processing logic configured to determine whether a control plane message from tenant resources is associated with a network address overlapping condition, which represents a first network address included in the control plane message overlaps a network address range relied upon by either (a) at least one of the components of the cloud platform or (b) a component associated with other tenant resources. The NAT processing logic is further configured to alter routing data stores that maintain routing information for each of the components of the cloud platform to substitute the first network address with a first virtual network address for subsequent data message routing.

A distributed cloud computing system is disclosed that includes a controller configured to deploy a first gateway in a first cloud computing network and a second gateway in a second cloud computing network and logic. The logic, upon execution by one or more processors, causes operations including receiving, from the controller, metadata pertaining to a plurality of constructs, receiving, from each of the first and second gateways, network data, receiving user input corresponding a request to visualize active users, receiving information pertaining to the active users utilizing resources managed by the controller, and causing rendering of a visualization of the active users on a display screen of a network device.

A computerized method for avoiding cross-region communications when utilizing a cloud overlay network is described. The method involves an operation of deploying one or more spoke gateways within at least a first region and a second region of a first virtual private cloud network. Thereafter, a region and a virtual private cloud network associated with a source and a destination of a communication are determined. Upon determining that the destination of the communication resides within a second virtual private cloud network, which is different than the first virtual private cloud network, the routing of the communication between the source and the destination is controlled by one or more spoke gateways solely residing within the region in which the source.

A controller configured to maintain a global virtual private cloud network (global VPC), which comprises a plurality of regions including a first region and a second region. The first region features at least a first workload and a first spoke subnetwork including a first set of spoke gateways. The second region features at least a second workload and a second spoke subnetwork including a second set of spoke gateways. These sets of spoke gateways are part of the cloud overlay network. Responsive to the first workload operating as a source for transmission of a first message to a first destination external to the global VPC, the logic is configured to (i) direct the first message from the first workload to a spoke gateway of the first set of spoke gateways residing withing the first region and (ii) preclude transmission of the first message to the second spoke subnetwork.