Ring connection chart for network orchestration

The present technology pertains to an interactive ring chart user interface for conveying a view of service chains between two logical network objects (physical devices, data centers, applications, services, virtual network functions, etc.). In addition to displaying the service chains, the interactive ring chart can receive user inputs to select a logical network object to view or modify details regarding connections to or from the network object in a detailed view. Additionally, the interactive ring chart can be used to create new service chains between two logical network objects.

TECHNICAL FIELD

The present technology pertains to a user interface for configuring virtual network functions and more specifically pertains to a ring chart user interface for configuring and deploying a service chain between two network endpoints.

BACKGROUND

While various orchestration tools have made orchestration of network functions and service chains between network services, network functions, and network endpoints much easier, there are still many real and virtual devices and services to keep track of.

DESCRIPTION OF EXAMPLE EMBODIMENTS

Overview

The present technology pertains to presenting a graphical user interface made up of representations of network objects that can be useful to view connections and service chains between the network objects as well as to set up connections and service chains between network objects. The present technology can receive an input, using the graphical user interface, that selects a first representation of a first network object from the representations of the network objects and deposits the first network object on to a second representation of a second network object. After receiving the input, a network orchestration service can automatically configure a service chain between the first network object and the second network object.

Example Embodiments

The disclosed technology addresses the need in the art for a user interface that can allow an administrator to configure, view the status of, and manage, service chains and connections between network objects. While network orchestration tools might provide reasonable mechanisms for orchestrating service chains, their interfaces are hard to use, and not practical to use to view service chains at network scale where many network objects are connected to many other objects. The present technology provides an intuitive interface wherein every relevant network object can be viewed along with the connections between them. In some embodiments, the status of the service chains is also viewable. Simply dragging one network object onto another network object can create new service chains. Detailed views of service chains and the ability to make adjustments to their configurations are provided through a detailed view.

A used herein the term “configured” shall be considered to be interchangeably used to refer to configured and configurable, unless the term “configurable” is explicitly used to distinguish from “configured.” The proper understanding of the term will be apparent to persons of ordinary skill in the art in the context in which the term is used.

As described herein, the present technology pertains to an interactive ring chart user interface for conveying a view of service chains between two logical network objects (physical devices, data centers, applications, services, virtual network functions, etc.). In addition to displaying the service chains, the interactive ring chart can receive user inputs to select a logical network object to view or modify details regarding connections to or from the network object in a detailed view. Additionally, the interactive ring chart can be used to create new service chains between two logical network objects.

FIG. 1illustrates an example method for populating the interactive ring chart with logical network objects to form its ring.FIG. 1will be discussed in the context ofFIG. 2for greater clarity and understanding by the reader; however, neitherFIG. 1norFIG. 2should be considered limited by the embodiments of either Figure; rather, the present technology is defined by the appended claims.

To populate the interactive ring graph user interface200with logical network objects, an administrator operating a computing device can select user control202. As illustrated inFIG. 2, user control202can take the form of a button or other user-selectable control. In response to receiving the selection of new endpoint user interface control202, an orchestration service can add (102) a representation of a network object to the graphical user interface. Additionally, a detail view210can be presented for entering configuration properties for the new network object.

The administrator can enter basic network object configuration properties for the network object into detail view210, which can be received by the user interface and stored (104) in a network object dictionary by the orchestration service. Network object configuration properties include any configuration which either defines the object, defines how to “connect” to the object, or defines how data must be formatted when arriving or leaving. For example, examples of network object configuration properties are: IP Address (definition), Geo Location (definition), Name (definition), Routing Protocol (connection), Configuration of the Routing (connection), Encrypted data, etc. Additionally, if the network object is an abstraction for multiple connections, then the network object configuration properties include configurations for the connections. If the object has a gateway, any information needed to connect to that gateway is also included in the network object configuration properties. These definitions could be used when creating the interfaces between he service chains defined in the interface and the object. In the illustrated example, the configuration is a definition of how to “connect” to the object and the switch indicates how data is supposed to behave when traversing to/from this object.

Once the configuration properties are populated into detail view210, the administrator can select, and the user interface can receive the selection of the commit user interface control212. Thereafter, the network orchestration service uses the network object configuration properties to define the network object in the network object dictionary. At this point, no deployment activity occurs. Instead, this information is stored in a dictionary and is used as a partial configuration for the network objects for creating new connections to the network object.

FIG. 3illustrates an example method for creating and deploying a new service chain between at least two network objects.FIG. 3will be discussed in the context ofFIGS. 4A, 4B, 4C, 5A, 5B, and 5Cfor greater clarity and understanding by the reader. However, none ofFIGS. 3, 4A, 4B, 4C, 5A, 5B, and 5Cshould be considered limited by the embodiments of each other. Rather, the present technology is defined by the appended claims.

When the interactive ring graph user interface200has at least two network objects represented therein, the interactive ring graph user interface200can be used to orchestrate service chains between the network objects. Therefore, the method illustrated inFIG. 3begins when the interactive ring graph user interface200presents (302) representations of network objects—for example, network objects remote VPN204, AZURE205, capital206, Amazon Web Services (AWS)207, and salesforce208. In some embodiments, the represented network objects are virtual network objects (e.g., remote VPN204), which are implementations of network functions using software. In some embodiments, the represented network objects are applications or storage services hosted by a specific cloud provider (e.g., Capital, Salesforce, etc.). In some embodiments, the represented network objects are other applications or services which may be instantiated in a public cloud. (e.g., AZURE,205, AWS207, etc.).

The orchestration service can receive (304) an input in user interface200, where the input is a selection of (304) a representation of a network object. The input can further drag the selection of the representation of the network object to another network object where it is deposited. For example, and as shown inFIG. 4A, the representation of the application, capital206, can be selected and dragged and dropped onto the representation of the network function, remote VPN,204. The orchestration service can receive and interpret this input in user interface200as a command to create a service chain between the application, capital206, and the network function, remote VPN204.

Additionally, when the representation of the network object is selected (304) any network objects that are incompatible with first network object can be distinguished from network objects that can be connected with the first network object. For example, incompatible network objects can be grayed out. The orchestration service can determine compatibility or incompatibility of network objects based on properties listed for the network objects in the object dictionary.

In some embodiments, a network object can be considered incompatible based on business policies or technical limitations. For example, some business policies include: a policy stipulating the number of connections between objects; a policy limiting the total connections into an object; a policy which stipulates certain categories of objects can only connect to other objects that meet some mutual criteria (e.g. if one object is flagged as INTERNAL CONFIDENTIAL, a policy could exist that prevents users from connecting it to objects which are not secure/aren't required to have high security connections in place), etc. Examples of possible technical limitations include: number of virtual ports defined on a gateway, or an incompatibility difference in configuration between objects (one could have BGP, the other OSPF), etc.

The orchestration service can present (306) detail view210of the new service chain. As illustrated inFIG. 4A, the service chain between the application, capital206, and the network function, remote VPN204is being configured as represented by the dotted line. Detail view210shows the selected service chain in more detail, and in particular service chain illustration220provides several selectable options222,224,226, and228for further configuring the service chain. For example, selectable option222is an option to specify whether two network objects should be connected through a DMZ or connected directly. Selectable option222specifically refers to whether the service chain is an end-to-end service chain, or if the service chain is linking two logical half-chains together. This option recognizes that half chains are often for services located outside a trusted network, and traffic coming into any other network service is prudently routed through a DMZ, which limits access to specific hosts of the respective network objects that are connected through the DMZ.

An end-to-end chain directly connects applications, services, and network functions together. A half-chain is a representation of reusable collection of network objects that can form a logical object or function. For example, if any connection to AWS requires a router and a firewall, then each direct link would require these two network elements (which would be a lot of duplications of the same networking functions). Instead, a half chain that includes these two elements could be utilized. Other network objects only need to connect to the half-chain, thus reducing the total number of routers and firewalls needed to be deployed (since a router and firewall are already included in the AWS half chain). Thus, half-chains are used to provide reuse of network elements.

Selectable options224,226, and228pertain to respective segments of the service chain that can be configured. For example, selectable option224pertains to an option to configure a gateway to remote VPN204. Selectable option226pertains to an option to configure the service chain between remote VPN204and capital206. Selectable option228pertains to an option to configure a gateway to capital206.

The administrator can select one of the segments of the service chain in detail pane210and orchestration service can receive (308) a selection of the selected segment of the service chain. For example, as seen inFIG. 4Ban administrator is selecting selectable option226to configure the service chain. After receiving (308) the selection of the segment of the service chain, the orchestration service can present (310) template options240including service chain types for the selected segment as seen inFIG. 4C. For example,FIG. 4Cshows three different templates service change templates242,244, and246. The administrator can then select one of the service chain templates from template options240. As seen inFIG. 4Can administrator selects template option244which configures a router in front of remote VPN204, a router in front of capital206, and a firewall in between the two routers. The orchestration service can receive (312) the selection of the presented template, and further receive a selection of selectable option232to deploy the configuration, as illustrated inFIG. 5A. Thereafter the orchestration service can automatically configure (314) the service chain between the first network object and the second network object.

Orchestration includes the automated arrangement, configuration, coordination, and management of computer systems, middleware, and services. In the context of the present technology the orchestration service performs orchestration of virtual network functions, and service chaining between service providers, endpoints, virtual network functions, applications, and services. Orchestration coordinates, connects, monitors, and manages the needed resources from the platform for the network function virtualization services. Orchestration may need to coordinate with many network and software elements, including inventory systems, billing systems, provisioning tools, and operating support systems.

As illustrated inFIG. 5B, the orchestration service can present (316) progress indicators showing the status of the deployment of the service chain. Detail pain210shows that a first router in the service chain has been deployed as is illustrated by the checkmark icon252, but the firewall and the next router in the service chain have not yet been fully provisioned as illustrated by the animated icons254,256. Ring chart200also shows that the service chain between remote VPN204and Capital206has not been fully deployed yet as indicated by dotted line258. Once the service chain has been fully deployed ring graph200will show a solid line between remote VPN204and Capital206, as illustrated inFIG. 5C.

The orchestration service and user interface200are effective not only to configure service chains but also to show the status of various service chains.FIG. 6illustrates an example method for showing the status of the service chains shown in ring chart200.FIG. 6will be discussed in the context ofFIGS. 7, and 8for greater clarity and understanding by the reader. However, none ofFIGS. 6, 7, and 8should be considered limited by the embodiments of each other. Rather, the present technology is defined by the appended claims.

Orchestration service can present (402) ring chart200made up of representations of network objects and service chains between the network objects, including status indicators pertaining to the respective service chains. For example, as seen inFIG. 7, service chain267between the AZURE and data center is fully deployed (as shown by a light line), while service chain262between remote VPN and campus is in the progress of being deployed (as shown by a dotted line). Some service chains have failed to deploy such as service chain264between campus and client/server. Other service chains are shown to be partially deployed such as service chain263between remote VPN and AZURE. A light line represents a first part of service chain263from remote VPN through the DMZ, while a second portion of the service chain from the DMZ to AZURE is shown in a dashed line indicating that it is still in progress of being deployed. Service chain265between SharesOne and Client Server is partially deployed but the orchestration of the service chain between the DMZ and the client/server has failed with errors, and this is indicated by a light line from SharesOne through the DMZ and a dark line from the DMZ to Client Server.

WhileFIG. 7shows an overview of the status of all the connections between the network objects,FIG. 8illustrates a detailed view have all connections originating from the selected network object. When an administrator selects a particular network object such as remote VPN204as shown inFIG. 8, the orchestration service can receive the selection and can present (404) a detailed view of the service chains to which the selected network object is connected in detail pane210. As shown inFIG. 8ring chart200has also been adjusted to distinguish (406) all connections between remote VPN204and the other network objects to which is connected, and a further detail view is shown and details pane210.

As seen inFIG. 8details pane210shows the respective service chains connected to remote VPN204in greater detail. For example, details pane210shows that remote VPN204is connected to a campus network without passing through with DMZ, but traffic does pass through two firewalls and a router. Further remote VPN is connected to both AWS and AZURE by passing traffic through the DMZ and several routers and firewalls.

If the administrator desires to edit the configuration, the administrator can select selectable option273to edit the service chains as illustrated inFIG. 4BandFIG. 4C.

FIG. 9shows an example of computing system500, which can be for example any computing device making up the orchestration service, or any device or system responsible for presenting and displaying the user interfaces described herein, or any component thereof in which the components of the system are in communication with each other using connection505. Connection505can be a physical connection via a bus, or a direct connection into processor510, such as in a chipset architecture. Connection505can also be a virtual connection, networked connection, or logical connection.

Example system500includes at least one processing unit (CPU or processor)510and connection505that couples various system components including system memory515, such as read-only memory (ROM)520and random access memory (RAM)525to processor510. Computing system500can include a cache of high-speed memory512connected directly with, in close proximity to, or integrated as part of processor510.

Processor510can include any general purpose processor and a hardware service or software service, such as services532,534, and536stored in storage device530, configured to control processor510as well as a special-purpose processor where software instructions are incorporated into the actual processor design. Processor510may essentially be a completely self-contained computing system, containing multiple cores or processors, a bus, memory controller, cache, etc. A multi-core processor may be symmetric or asymmetric.

To enable user interaction, computing system500includes an input device545, which can represent any number of input mechanisms, such as a microphone for speech, a touch-sensitive screen for gesture or graphical input, keyboard, mouse, motion input, speech, etc. Computing system500can also include output device535, which can be one or more of a number of output mechanisms known to those of skill in the art. In some instances, multimodal systems can enable a user to provide multiple types of input/output to communicate with computing system500. Computing system500can include communications interface540, which can generally govern and manage the user input and system output. There is no restriction on operating on any particular hardware arrangement, and therefore the basic features here may easily be substituted for improved hardware or firmware arrangements as they are developed.

The storage device530can include software services, servers, services, etc., that when the code that defines such software is executed by the processor510, it causes the system to perform a function. In some embodiments, a hardware service that performs a particular function can include the software component stored in a computer-readable medium in connection with the necessary hardware components, such as processor510, connection505, output device535, etc., to carry out the function.