Pre-configured virtual gateways for isolated virtual networks

Patent metadata

Field	Value
Publication number	US-9954763-B1
Application number	US-201414192476-A
Country	US
Kind code	B1
Filing date	Feb 27, 2014
Priority date	Feb 27, 2014
Publication date	Apr 24, 2018
Grant date	Apr 24, 2018

Abstract

Methods and apparatus for pre-configured virtual gateways for isolated virtual networks are described. An isolated virtual network (IVN) is configured at a provider network on behalf of a customer. The IVN includes one or more devices whose network addresses are not accessible from the public Internet. In response to a request from a connectivity intermediary, a virtual private gateway (VPG) is established, configurable to enable connectivity between IVNs of the provider network and devices outside the provider network. The VPG is included within a set of candidate VPGs indicated programmatically to the customer. Connectivity is established between the customer's IVN and an external device via the VPG.

First claim

What is claimed is:

1. A system, comprising:
one or more computing devices comprising one or more hardware processors and memory and configured to:
configure a private physical interconnect between a provider network and an intermediary network of a connectivity intermediary outside the provider network;
configure a plurality of interconnect partitions of the private physical interconnect, wherein each interconnect partition has a respective bandwidth limit corresponding to a respective subset of bandwidth capacity of the private physical interconnect;
configure one or more isolated virtual networks within the provider network on behalf of a customer of the provider network, wherein the one or more isolated virtual networks include one or more network endpoints whose network addresses are not accessible from the public Internet;
establish, in response to a request originating from the connectivity intermediary, a particular virtual private gateway configured to enable connectivity, via a particular interconnect partition of the plurality of interconnect partitions, between a particular isolated virtual network of the one or more isolated virtual networks and one or more devices outside the provider network;
include the particular virtual private gateway within a set of candidate virtual private gateways, indicated programmatically to the customer, that can be utilized for connectivity to the particular isolated virtual network;
in response to a request from the customer, enable connectivity between the particular isolated virtual network and at least one device outside the provider network via the particular virtual private gateway, via the particular interconnect partition, and via the intermediary network, wherein the particular virtual private gateway is selected from the set of candidate virtual private gateways, and wherein the particular virtual private gateway is indicated in the request from the customer; and
transfer, using the private physical interconnect and the intermediary network, one or more network packets between a particular resource of the particular isolated virtual network and a particular device outside the provider network, wherein the particular device outside the provider network comprises an endpoint for the one or more network packets.

2. The system as recited in claim 1 , wherein the one or more computing devices are further enabled to:
configure, using a set of parameters provided by the connectivity intermediary, a virtual interface to enable the use of at least one of the plurality of interconnect partitions of the private physical interconnect for traffic associated with the one or more isolated virtual networks, wherein the set of parameters includes one or more of: (a) a VLAN (virtual local area network) identifier, (b) an Internet Protocol (IP) address, (c) a Border Gateway Protocol (BGP) Autonomous System Number (ASN), or (d) a BGP key.

3. The system as recited in claim 2 , wherein the one or more computing devices are further enabled to:
configure, using a different set of parameters provided by the connectivity intermediary, a different virtual interface to enable the use of a different particular interconnect partition of the plurality of interconnect partitions of the private physical interconnect for traffic associated with a different isolated virtual network of the isolated virtual networks established on behalf of a different customer.

4. The system as recited in claim 1 , wherein the particular device outside the provider network comprises a node of a network-accessible service, wherein the one or more computing devices are further configured to:
provide an indication of availability of access to the network-accessible service via the particular virtual private gateway.

5. The system as recited in claim 4 , wherein the indication of availability of access is provided via a programmatic interface of a service marketplace implemented at the provider network.

6. A method, comprising:
performing, by one or more computing devices:
configuring a particular isolated virtual network within a provider network on behalf of a customer, wherein the particular isolated virtual network includes one or more network endpoints whose network addresses are not accessible from the public Internet;
establishing, in response to a request originating from a connectivity intermediary, a particular virtual private gateway configured to enable connectivity, via an interconnect partition of a private physical interconnect, between one or more isolated virtual networks established within the provider network and one or more network devices outside the provider network, wherein the connectivity intermediary is outside the provider network;
including the particular virtual private gateway within a set of candidate virtual private gateways, indicated programmatically to the customer, that can be utilized for connectivity to the particular isolated virtual network;
in response to a request from the customer, enabling connectivity between the particular isolated virtual network and at least one network device outside the provider network via the particular virtual private gateway via the interconnect partition, wherein the particular virtual private gateway is selected from the set of candidate virtual private gateways, and wherein the particular virtual private gateway is indicated in the request from the customer; and
transferring, using the particular virtual private gateway, one or more network packets between a particular computing endpoint of the particular isolated virtual network and a particular device outside the provider network, wherein the particular device outside the provider network comprises an endpoint for the one or more network packets.

7. The method as recited in claim 6 , further comprising performing, by the one or more computing devices:
receiving, from the customer subsequent to a selection by the customer of the particular private virtual gateway from among the set of candidate virtual private gateways, an indication of a requested configuration setting for the particular private virtual gateway; and
configuring the particular private virtual gateway in accordance with the requested configuration setting.

8. The method as recited in claim 6 , further comprising performing, by the one or more computing devices:
configuring the private physical interconnect between the provider network and an intermediary network accessible from the particular network device outside the provider network;
wherein the particular virtual private gateway is configured to utilize the private physical interconnect for at least a portion of the network traffic directed via the virtual private gateway; and

configuring one or more interconnect partitions of the private physical interconnect, wherein the one or more interconnect partitions includes the interconnect partition, wherein each interconnect partition has a respective bandwidth limit corresponding to a respective subset of bandwidth capacity of the private physical interconnect.

9. The method as recited in claim 8 , wherein the private physical interconnect links a pair of co-located routers including a first router owned by the provider network operator and a second router owned by the connectivity intermediary.

10. The method as recited in claim 8 , further comprising performing, by the one or more computing devices:
configuring, using a set of parameters provided by the connectivity intermediary, a particular virtual interface to enable the use of the private physical interconnect for traffic associated with the particular isolated virtual network, wherein the set of parameters includes one or more of: (a) a VLAN (virtual l

Assignees

• Amazon Tech Inc
• Amazon Tech Inc

Inventors

• Ye Shuai
• Cullen Patrick Brigham
• Stalzer Mark Edward

Classifications

• H04L41/0813

  characterised by the conditions triggering a change of settings · CPC title

• H04L45/22

  Alternate routing · CPC title

• H04L45/04 Primary

  Interdomain routing, e.g. hierarchical routing · CPC title

• H04L45/64

  using an overlay routing layer · CPC title