Mapping subnets in different virtual networks using private address space

A method for facilitating communication between resources in different virtual networks includes creating a first virtual network and a second virtual network within a cloud computing system and creating a first subnet within the first virtual network and a second subnet within the second virtual network. The method also includes mapping the first subnet to the second subnet such that the resources in the first subnet and the second subnet are able to communicate with each other using private address space. The method also includes routing data packets between the first subnet and the second subnet.

CROSS-REFERENCE TO RELATED APPLICATIONS

BACKGROUND

Cloud computing is the delivery of computing services (e.g., servers, storage, databases, networking, software, analytics) over the Internet. Many different types of services may be provided by a cloud computing system, including services based on a software as a service (SaaS) model, services based on a platform as a service (PaaS) model, and services based on infrastructure as a service (IaaS) model.

Broadly speaking, a cloud computing system includes two sections, a front end and a back end, that are in electronic communication with one another via the Internet. The front end includes the interface that users encounter through a client device. The back end includes the resources that deliver cloud-computing services, including processors, memory, storage, and networking hardware. The back end of a cloud computing system typically includes one or more data centers, which may be located in different geographical areas. Each data center typically includes a large number (e.g., hundreds or thousands) of computing devices, which may be referred to as host machines.

At least some of the services that are offered by a cloud computing service provider may utilize virtualization technologies that allow computing resources to be shared by multiple users. For example, virtualization technologies allow a single physical computing device to be shared among multiple users by providing each user with one or more virtual machines hosted by the single physical computing machine. Each such virtual machine may act as a distinct logical computing system, and the various virtual machines may be isolated from one another. As another example, virtualization technologies allow data storage hardware to be shared among multiple users by providing each user with a virtual data store. Each such virtual data store may act as a distinct logical data store, and the various virtual data stores may be isolated from one another.

Virtualization technologies may also be used in the context of computer networking. Network virtualization involves combining hardware and software network resources and network functionality into a software-based administrative entity, which may be referred to as a virtual network. A cloud computing service provider may enable users (e.g., customers) to create virtual networks within a cloud computing system. The use of network virtualization technologies in the context of a cloud computing environment is sometimes referred to as software-defined networking.

Resources may be assigned to virtual networks. In this context, the term “resource” may refer to any item that is capable of being managed by a cloud computing system. Some examples of resources include virtual machines, virtual data stores, databases, and web applications. The resources within a virtual network may communicate with each other and with other entities that are accessible via the Internet.

Computing devices use Internet protocol (IP) addresses to send and receive data from other devices. There are two different categories of IP addresses: public and private. A public IP address is a globally unique IP address assigned to a computing device. A public IP address can be accessed over the Internet. A private IP address, on the other hand, is not globally unique, and IP packets that contain private IP addresses cannot be routed through the public Internet. Private network addresses are not allocated to any specific organization and anyone may use these addresses without approval from a regional Internet registry. Private IP addresses are commonly used for local area networks (LANs) in residential, office, and enterprise environments.

The set of IP addresses that are assigned to a particular network may be referred to as the “address space” of that network. A private IP address space can be specified for a virtual network. Resources in a virtual network may be assigned a private IP address from the address space that is defined for the virtual network. The address spaces of two different virtual networks may overlap.

Currently, there are two different approaches for enabling resources in one virtual network to communicate with resources in another virtual network. Both approaches, however, have significant drawbacks. With one approach, at least one entity in each virtual network may be assigned a public IP address, and communication between the virtual networks may occur via the public Internet. However, exposing the resources in the virtual networks to the public IP address space raises security concerns. With another approach, a technique known as virtual network peering may enable resources in two different virtual networks to be able to communicate with each other. However, for virtual network peering to work properly, the address spaces of both virtual networks cannot overlap. This can be a significant limitation, especially for virtual networks whose address spaces were designed without this requirement in mind.

SUMMARY

In accordance with one aspect of the present disclosure, a method is disclosed for facilitating communication between resources in different virtual networks in a cloud computing system. The method includes mapping a first subnet in a first virtual network to a second subnet in a second virtual network such that resources in the first subnet and the second subnet are able to communicate with each other. The method also includes providing a representative resource in the first subnet of the first virtual network. The representative resource may correspond to a resource in the second subnet of the second virtual network. The method also includes creating a first mapping between a representative resource address and a host machine address. The representative resource address may correspond to the representative resource in the first subnet, and the host machine address may correspond to a host machine on which the resource in the second subnet is located. The method also includes creating a second mapping between the representative resource address and a resource address corresponding to the resource in the second subnet, and routing a data packet from the first virtual network to the resource in the second subnet of the second virtual network based on the first mapping and the second mapping.

At least some resources in the first virtual network that are outside the first subnet may be isolated from the second virtual network. At least some resources in the second virtual network that are outside the second subnet may be isolated from the first virtual network.

The method may further include mapping a first plurality of resources in the first subnet to a first plurality of representative resources in the second subnet and mapping a second plurality of resources in the second subnet to a second plurality of representative resources in the first subnet.

A first address space associated with the first virtual network may overlap with a second address space associated with the second virtual network. Communication between the resources in the first subnet and the second subnet may occur within private Internet protocol (IP) address space.

The data packet may include a first source address and a first destination address. The first source address may be associated with a first resource in the first virtual network. The first destination address may be associated with the representative resource in the first subnet in the first virtual network. The method may further include accessing the first mapping between the representative resource address and the host machine address to determine an additional destination address and encapsulating the data packet to create an encapsulated data packet. The encapsulated data packet may include the additional destination address.

As another example, the first source address may be associated with a first resource in the first virtual network. The first destination address may be associated with the representative resource in the first subnet in the first virtual network. The method may further include performing network address translation to create a translated data packet.

Performing network address translation may include accessing the second mapping between the representative resource address and the resource address to determine a second destination address and replacing the first destination address with the second destination address. Performing network address translation may additionally include accessing a third mapping between the first resource in the first subnet and a second source address. The second source address may be associated with the second virtual network. Performing network address translation may additionally include replacing the first source address with the second source address.

The method may further include receiving a request from a client device to map the first subnet to the second subnet. The mapping may be performed in response to the request.

In accordance with another aspect of the present disclosure, a method for facilitating communication between resources in different virtual networks is disclosed. The method includes receiving a request to add a first resource in a first virtual network to a first subnet within the first virtual network. The first subnet may be mapped to a second subnet in a second virtual network. The method also includes automatically creating a first mapping between the first resource in the first subnet and a representative resource in the second subnet in response to the request. The method also includes receiving a data packet that is addressed to the representative resource in the second subnet. The data packet may be sent by a second resource in the second virtual network. The method also includes routing the data packet to the first resource in the first subnet based on the first mapping.

When the first subnet is mapped to the second subnet, at least some resources in the first virtual network that are outside the first subnet may be isolated from the second virtual network. Similarly, at least some resources in the second virtual network that are outside the second subnet may be isolated from the first virtual network.

A first address space associated with the first virtual network may overlap with a second address space associated with the second virtual network. The routing of the data packet may occur within private Internet protocol (IP) address space.

A source address of the data packet may be associated with the second resource in the second virtual network. A destination address of the data packet may be associated with the representative resource in the second subnet in the second virtual network. The method may additionally include accessing the first mapping between the first resource in the first subnet and the representative resource in the second subnet to determine an address of the first resource. The method may additionally include obtaining, based on the address of the first resource, a host machine address corresponding to a host machine on which the first resource is located. The method may additionally include encapsulating the data packet to create an encapsulated data packet. The encapsulated data packet may include the host machine address.

The data packet may include a first source address and a first destination address. The first source address may be associated with the second resource in the second virtual network. The first destination address may be associated with the representative resource in the second subnet in the second virtual network. The method may further include performing network address translation to create a translated data packet. Performing network address translation may include accessing the first mapping between the first resource in the first subnet and the representative resource in the second subnet to determine a second destination address corresponding to the first resource. Performing network address translation may additionally include replacing the first destination address with the second destination address. Performing network address translation may additionally include accessing a second mapping between the first resource in the first subnet and a second source address. The second source address may be associated with the first virtual network. Performing network address translation may additionally include replacing the first source address with the second source address.

In accordance with another aspect of the present disclosure, a cloud computing system that is configured to facilitate communication between subnets of different virtual networks is disclosed. The cloud computing system includes one or more processors and memory in electronic communication with the one or more processors. The cloud computing system also includes a virtual network management service that is executable by the one or more processors to map a first subnet of a first virtual network to a second subnet of a second virtual network. The cloud computing system also includes mapping information stored in the memory. The mapping information may be created by the virtual network management service in connection with mapping the first subnet to the second subnet. The mapping information may enable resources in the first subnet and the second subnet to communicate with each other. The cloud computing system also includes a routing component that is executable by the one or more processors to route data packets between the first subnet and the second subnet based on the mapping information.

When the first subnet is mapped to the second subnet, at least some resources in the first virtual network that are outside the first subnet may be isolated from the second virtual network. Similarly, at least some resources in the second virtual network that are outside the second subnet may be isolated from the first virtual network.

A first address space associated with the first virtual network may overlap with a second address space associated with the second virtual network. Routing of the data packets between the first subnet and the second subnet may occur within private Internet protocol (IP) address space.

The mapping information may include a first set of mappings between a first plurality of resources in the first subnet and a first plurality of representative resources in the second subnet. The mapping information may also include a second set of mappings between a second plurality of resources in the second subnet and a second plurality of representative resources in the first subnet.

Additional features and advantages will be set forth in the description that follows. Features and advantages of the disclosure may be realized and obtained by means of the systems and methods that are particularly pointed out in the appended claims. Features of the present disclosure will become more fully apparent from the following description and appended claims, or may be learned by the practice of the disclosed subject matter as set forth hereinafter.

DETAILED DESCRIPTION

The present disclosure is generally related to enabling resources in different virtual networks to communicate with each other. Advantageously, the systems and methods disclosed herein enable communication between resources in different virtual networks to occur using private IP addresses. In other words, communication between resources in different virtual networks may occur without requiring data packets to be sent over the Internet using public IP addresses. In addition, the techniques disclosed herein enable resources in different virtual networks to communicate with each other even if the private address spaces of the virtual networks overlap.

To enable resources in different virtual networks to communicate with each other using private IP addresses and without requiring distinct address spaces, subnets in different virtual networks may be mapped to one another. Resources in the mapped subnets may then be able to communicate with each other using private IP addresses even if the address spaces of the virtual networks overlap.

For example, consider two different virtual networks, which will be referred to as virtual network A and virtual network B. It may be desirable to share one or more resources that exist in virtual network B with the resources in virtual network A. In other words, it may be desirable to enable resources in virtual network A to access and interact with one or more resources that exist in virtual network B (and vice versa). To enable this to occur, a subnet may be created within virtual network A. This subnet will be referred to as subnet A. Similarly, a subnet may be created within virtual network B. This subnet will be referred to as subnet B. Subnet A and subnet B may be mapped to one another.

To share resources from virtual network B with virtual network A, the resources may be added to subnet B. In some implementations, adding the resources to subnet B causes the resources to become mapped to representative resources in subnet A. In other words, for each resource that is added to subnet B, a representative resource may be created in subnet A and a one-to-one mapping may be created between the resource in subnet B and the representative resource in subnet A. Resources in subnet A may then interact with the resources in subnet B through the corresponding representative resources in subnet A. For example, the resources in subnet A may send data packets to the representative resources in subnet A. A data packet that is sent to a representative resource in subnet A may be routed to the corresponding resource in subnet B.

The systems and methods disclosed herein may be implemented in the context of a service provider that provides cloud computing services to users (e.g., customers). The services may be implemented in a cloud computing system that is maintained by the service provider.

FIG. 1illustrates a client device102in electronic communication with a cloud computing system100. Communication between the client device102and the cloud computing system100may occur via the Internet. The client device102includes a front-end application104. In some implementations, the front-end application104may take the form of a web browser (possibly running one or more script files) or a mobile application. A user of the client device102may use the front-end application104to access one or more services106provided by the cloud computing system100. The services106provided by the cloud computing system100may be accessed via application programming interfaces (APIs) corresponding to the services106.

The cloud computing system100may include a virtualization management service106athat facilitates the creation and operation of virtual computing resources such as virtual machines (VMs) and virtual data stores. The front-end application104on the client device102may access the virtualization management service106athrough a corresponding API108a.Someone who uses the services106provided by the cloud computing system100(e.g., a customer of the service provider) may use the front-end application104on the client device102to access the virtualization management service106a,via the API108a,in order to provision virtual computing resources and perform various operations related to managing those virtual computing resources. The virtualization management service106amay receive one or more requests from the front-end application104that are related to provisioning resources, and the virtualization management service106amay provision the requested resources on the cloud computing system100in response to the request(s).FIG. 1shows a plurality of resources110a-b,112a-bon the cloud computing system100.

The cloud computing system100may also include a service106bthat is related to creating and managing virtual networks. This service106bmay be referred to herein as a virtual network management service106b.The front-end application104on the client device102may access the virtual network management service106bthrough a corresponding API108b.Someone who uses the services106provided by the cloud computing system100may use the front-end application104on the client device102to access the virtual network management service106b,via the API108b,in order to perform various operations related to virtual networks.

For example, the functionality provided by the virtual network management service106bmay include provisioning virtual networks on the cloud computing system100. The virtual network management service106bmay receive one or more requests from the front-end application104that are related to provisioning virtual networks, and the virtual network management service106bmay provision the requested virtual networks on the cloud computing system100in response to the request(s).FIG. 1shows two virtual networks114a-bwithin the cloud computing system100. These virtual networks114a-bwill be referred to as virtual network A114aand virtual network B114b.

The functionality provided by the virtual network management service106bmay also include creating subnets within virtual networks. The virtual network management service106bmay receive one or more requests from the front-end application104that are related to creating subnets within virtual networks, and the virtual network management service106bmay create subnets within virtual networks in response to the request(s).FIG. 1shows a subnet116awithin virtual network A114aand a subnet116bwithin virtual network B114b.The subnet116awithin virtual network A114amay be referred to herein as subnet A116a,and the subnet116bwithin virtual network B114bmay be referred to herein as subnet B116b.

The functionality provided by the virtual network management service106bmay also include associating resources with particular virtual networks. The virtual network management service106bmay receive one or more requests from the front-end application104that are related to associating resources with virtual networks, and the virtual network management service106bmay associate resources with particular virtual networks in response to the request(s). In some implementations, the user of the front-end application104may provide user input that associates particular resources with particular virtual networks. Alternatively, the virtual network management service106bmay automatically associate resources with particular virtual networks (e.g., in response to creation of resources and/or creation of virtual networks).FIG. 1shows a plurality of resources110a,112athat are associated with virtual network A114aand a plurality of resources110b,112bthat are associated with virtual network B114b.

The functionality provided by the virtual network management service106bmay also include assigning IP addresses to resources in virtual networks. The virtual network management service106bmay receive one or more requests from the front-end application104that are related to assigning IP addresses to resources in virtual networks, and the virtual network management service106bmay assign IP addresses to resources in virtual networks in response to the request(s). In some implementations, the user of the front-end application104may provide user input that causes IP addresses to be assigned to resources. Alternatively, the virtual network management service106bmay automatically assign IP addresses to resources (e.g., in response to creation of the resources).

The IP addresses that are assigned to the resources of a virtual network may be private IP addresses. The set of IP addresses that are assigned to a particular virtual network may be referred to as the “address space” of that virtual network. If the resources in two different virtual networks have private IP addresses assigned to them, then the address spaces of those virtual networks may overlap with one another. In other words, the same private IP address may be assigned to different resources in different virtual networks.

As indicated above, the present disclosure proposes mapping subnets in different virtual networks to one another so that resources in the mapped subnets are able to communicate with each other using private IP addresses even if the address spaces of the virtual networks overlap. Thus, in accordance with the present disclosure, the functionality provided by the virtual network management service106bmay also include mapping subnets in different virtual networks to one another. The virtual network management service106bmay receive one or more requests from the front-end application104that are related to performing mapping operations, and the virtual network management service106bmay perform mapping operations in response to the request(s). For example, a user may cause the front-end application104to send a request to the virtual network management service106bto map subnet A116aand subnet B116bto each other. The virtual network management service106bmay cause subnet A116aand subnet B116bto be mapped to each other in response to the request.

Mapping subnets in different virtual networks to one another makes it possible to share some of the resources in one virtual network with another virtual network without completely exposing everything in the virtual networks to one another. For example, suppose that a user (e.g., someone who owns or otherwise has management rights with respect to virtual network A114aand virtual network B114b) wants to share a set of resources112bin virtual network B114bwith virtual network A114a,so that the resources110a,112ain virtual network A114aare able to interact with the resources112bthat have been shared. However, further suppose that the user does not want to share other resources110bin virtual network B114bwith virtual network A114a.In other words, the user does not want to expose any information (e.g., address information) about the other resources110bin virtual network B114bto virtual network A114a,so that these other resources110bremain isolated from virtual network A114a.The user may accomplish this by causing subnet B116band subnet A116ato be mapped to each other (e.g., through user input submitted via the front-end application104), and then adding the resources112bthat the user wants to share with virtual network A114ato subnet B116b.The resources110a,112bin virtual network A114aare then able to interact with the resources112bthat have been added to subnet B116b.However, virtual network A114aremains unaware of the other resources110bin virtual network B114b(i.e., the resources110bin virtual network B114bthat have not been added to subnet B116b). Therefore, these other resources110bremain isolated from virtual network A114a.

Similarly, if a user wants to share a set of resources112ain virtual network A114awith virtual network B114b,the resources112athat the user wants to share may be added to subnet A116a.The resources110b,112bin virtual network B114bare then able to interact with the resources112athat have been added to subnet A116a.However, virtual network B114bremains unaware of the other resources110ain virtual network A114a(i.e., the resources110ain virtual network A114athat have not been added to subnet A116a). Therefore, these other resources110aremain isolated from virtual network B114b.

FIG. 2illustrates an example involving a single resource212bin virtual network B214bmay be shared with virtual network A214a.As in the previous example, it will be assumed that subnet B216bin virtual network B214bis mapped to subnet A216ain virtual network A214a.When the user adds the resource212bto subnet B216b,a representative resource218may be created in subnet A216a.This representative resource218may be mapped to the resource212bin subnet B216b.In other words, a one-to-one mapping220may be created between the resource212bin subnet B216band the representative resource218in subnet A216a.In some implementations, the representative resource218may be automatically created by the cloud computing system200(e.g., by a virtual network management service206provided by the cloud computing system200) in response to the resource being added to subnet B216b.In other words, once the user causes subnet B216bto be mapped to subnet A216aand causes the resource212bto be added to subnet B216b,the representative resource218may be created in subnet A216awithout additional user input.

A resource210ain virtual network A214amay communicate with the resource212bin subnet B216bby sending a data packet222to the corresponding representative resource218in subnet A216a.The mapping220between the representative resource218in subnet A216aand the resource212bin subnet B216benables the data packet222to be routed from the representative resource218to the resource212b.The cloud computing system200includes a routing component224that is responsible for routing data packets222.

FIGS. 3A-Cillustrate an example showing how a resource310ain virtual network A314amay communicate with a resource312bin subnet B316bof virtual network B314bthrough a representative resource318in subnet A316a.

In this example, the IP address that is associated with the resource310ain virtual network A314awill be referred to as IP address X. The IP address that is associated with the representative resource318in subnet A316aof virtual network A314awill be referred to as IP address Y. The IP address that is associated with the resource312bin subnet B316bof virtual network B314bwill be referred to as IP address W. The resource310ain virtual network A314aruns on a host machine that will be referred to herein as host A326a.The resource312bin subnet B316bof virtual network B314bruns on a host machine that will be referred to herein as host B326b.The IP address of host A326awill be referred to herein as IP address PM. The IP address of host B326bwill be referred to herein as IP address PA2. The IP addresses of the host machines326a-b(PA1and PA2) are physical IP addresses, whereas the other IP addresses (X, Y, and W) may be virtual IP addresses (i.e., IP addresses that are associated with virtualized resources).

To enable the resource310ain virtual network A314a(shown inFIG. 3A) to send a data packet322to the resource312bin subnet B316bof virtual network B314b(shown inFIG. 3B), certain mapping information may be created. In particular, a one-to-one mapping320amay be created between IP address Y (the IP address of the representative resource318in subnet A316a) and IP address PA2(the physical IP address of the host machine, host B326b,on which the resource312bis located). In addition, a one-to-one mapping320bmay be created between IP address Y and IP address W (the IP address of the resource312bin subnet B316b). Moreover, a one-to-one mapping320cmay be created between IP address X (the IP address of the resource310athat originally sent the data packet322) and another IP address, which will be referred to as IP address Z. The purpose of this mapping320cwill be discussed in greater detail below.

The resource310ain virtual network A314ainitially creates the data packet322with a source address328and a destination address330. The data packet322is shown inFIG. 3C. The source address328includes IP address X (the IP address of the resource310a) and a port that will be referred to as port PS1. The destination address330includes IP address Y (the IP address of the representative resource318in subnet A316a) and a port that will be referred to as port PD.

The data packet322is delivered to a networking stack332athat is running on host A326a.The networking stack332aencapsulates the data packet322with an additional source address334and an additional destination address336, thereby creating an encapsulated data packet342. The additional source address334includes IP address PA1, which is the physical IP address of host A326a(the host machine on which the resource310ain virtual network A314ais running). The additional destination address336is IP address PA2, which is the physical IP address of host B326b(the host machine on which the resource312bin subnet B316bof virtual network B314bis running). To determine the additional destination address336, the networking stack332aaccesses mapping information338ato identify the mapping320abetween IP address Y (which is identified in the destination address330of the data packet322, and which is also the IP address of the representative resource318in subnet A316a) and IP address PA2(the physical IP address of the host machine, host B326b,on which the resource312bis located). The networking stack332amay identify this mapping320aby communicating with a directory service340.

The encapsulated data packet342is then transmitted over a communication interface344from host A326ato host B326b,and delivered to a networking stack332bthat is running on host B326b(as shown inFIG. 3B). The networking stack332bon host B326bstrips away the additional source address334and the additional destination address336from the encapsulated data packet342. The networking stack332balso accesses mapping information338bto perform network address translation, thereby creating a translated data packet346. The translated data packet346is shown inFIG. 3C. In particular, based on the mapping320cbetween IP address X and IP address Z, the source address348of the translated data packet346is changed from IP address X (which was in the source address328of the initial data packet322) to IP address Z. In addition, the port associated with the source address348is changed from port PS1(which was the port that was identified in the source address328of the initial data packet322) to port PS2. Changing the port in this manner allows the data packet322to be distinguished from other data packets sent by other resources in virtual network A314a.Moreover, based on the mapping320bbetween IP address Y and IP address W, the destination address350of the translated data packet346is changed from IP address Y (which was the destination address330of the initial data packet322) to IP address W (which is the IP address of the resource312bthat is the intended destination of the initial data packet322). The port associated with the destination address350(port PD) is not changed, because that is the port on which the resource312bis listening.

Once network address translation has been performed, the networking stack332broutes the translated data packet346to the resource312bin subnet B316b,which receives and processes the translated data packet346. The source address348of the translated data packet346includes IP address Z, which corresponds to virtual network B314b.Thus, to the resource312bin subnet B316b(which receives the translated data packet346), it appears as though the translated data packet346has been sent by an entity within virtual network B314b.

For the sake of simplicity, in the example shown inFIGS. 3A-3C, there is just one resource312bin subnet B316b.However, it may be desirable to expose a plurality of resources in virtual network B314bto virtual network A314a,and vice versa.FIG. 4illustrates an example in which subnet mapping facilitates access to a plurality of resources.

As in the previous example, the cloud computing system400shown inFIG. 4includes two virtual networks: virtual network A414aand virtual network B414b.Virtual network A414aincludes a subnet that will be referred to as subnet A416a.Virtual network B414bincludes a subnet that will be referred to as subnet B416b.For purposes of the present example, it will be assumed that subnet A416aand subnet B416bare mapped to one another.

FIG. 4shows a first resource452and a second resource454in subnet B416b.When these resources452,454are added to subnet B416b,representative resources456,458may be created in subnet A416a.These representative resources456,458may be mapped to the resources452,454in subnet B416b.In other words, a one-to-one mapping420amay be created between the first representative resource456in subnet A416aand the first resource452in subnet B416b,and a one-to-one mapping420bmay be created between the second representative resource458in subnet A416aand the second resource454in subnet B416b.

FIG. 4also shows a first resource460and a second resource462in subnet A416a.When these resources460,462are added to subnet A416a,representative resources464,466may be created in subnet B416b.These representative resources464,466may be mapped to the resources460,462in subnet A416a.In particular, a one-to-one mapping420cmay be created between the first representative resource464in subnet B416band the first resource460in subnet A416a,and a one-to-one mapping420dmay be created between the second representative resource466in subnet B416band the second resource462in subnet A416a.

In some implementations, the representative resources456,458,464,466may be automatically created by the cloud computing system400(e.g., by a virtual network management service406provided by the cloud computing system400) in response to the resources452,454,460,462being added to a mapped subnet. For example, once the user causes subnet B416bto be mapped to subnet A416aand causes the first resource452and the second resource454to be added to subnet B416b,the representative resources456,458may be created in subnet A416awithout additional input from the user. In addition, the relevant mappings (i.e., the mapping420abetween the first representative resource456in subnet A416aand the first resource452in subnet B416b,and the mapping420bbetween the second representative resource458in subnet A416aand the second resource454in subnet B416b) may also be created automatically in response to the resources452,454being added to subnet B416b.Similarly, once the user causes the first resource460and the second resource462to be added to subnet A416a,the representative resources464,466may be created in subnet B416bwithout additional input from the user. In addition, the relevant mappings (i.e., the mapping420cbetween the first representative resource464in subnet B416band the first resource460in subnet A416a,and the mapping420dbetween the second representative resource466in subnet B416band the second resource462in subnet A416a) may also be created automatically in response to the resources460,462being added to subnet A416a.

A resource468in virtual network A414amay communicate with a resource in subnet B416bof virtual network B414bby sending a data packet to the corresponding representative resource in subnet A416a.For example, a resource468in virtual network A414amay communicate with the first resource452in subnet B416bby sending a data packet to the IP address associated with the first representative resource456in subnet A416a.The mapping420abetween the first representative resource456and the first resource452enables the data packet to be routed from the first representative resource456to the first resource452. In a similar manner, a resource468in virtual network A414amay communicate with the second resource454in subnet B416bby sending a data packet to the IP address associated with the second representative resource458in subnet A416a.The mapping420bbetween the second representative resource458and the second resource454enables the data packet to be routed from the second representative resource458to the second resource454.

Similarly, a resource470in virtual network B414bmay communicate with a resource in subnet A416aof virtual network A414aby sending a data packet to the corresponding representative resource in subnet B416b.For example, a resource470in virtual network B414bmay communicate with the first resource460in subnet A416aby sending a data packet to the IP address associated with the first representative resource464in subnet B416b.The mapping420cbetween the first representative resource464and the first resource460enables the data packet to be routed from the first representative resource464to the first resource460. In a similar manner, a resource470in virtual network B414bmay communicate with the second resource462in subnet A416aby sending a data packet to the IP address associated with the second representative resource466in subnet B416b.The mapping420dbetween the second representative resource466and the second resource462enables the data packet to be routed from the second representative resource466to the second resource462.

The cloud computing system400may include routing components424that access mapping information438in order to route data packets in the manner described above. In some implementations, the routing components424and the mapping information438may be included as part of a networking stack that is included on host machines within the cloud computing system400.

A virtual network that is created by a cloud computing system may include resources that exist independently of the cloud computing system. For example, resources within a network that exists independently of the cloud computing system may be included in a virtual network. An example of such a network is a network (e.g., a local area network) that is maintained and operated by a customer of the service provider. This type of network may be referred to as an on-premises network to indicate that the network exists at one or more locations (e.g., the customer's premises) that are separate from the cloud computing system. A virtual network management service provided by a cloud computing system may permit resources in an on-premises network to be added to a virtual network that is created by the virtual network management service.

FIG. 5illustrates an example in which mapped subnets include resources from a network572that exists independently of the cloud computing system500. The on-premises network572includes a plurality of resources574a-b,576a-b.The resources574a-b,576a-bmay take the form of computing devices within the on-premises network572.

As in the examples discussed previously, the cloud computing system500shown inFIG. 5includes two virtual networks: virtual network A514aand virtual network B514b.Virtual network A514aincludes subnet A516a,and virtual network B514bincludes subnet B516b.Subnet A516ais mapped to subnet B516b.Because of this mapping between subnet A516aand subnet B516b,the resources510a,510bin virtual network A514aare able to interact with the resources512bin virtual network B514bthat have been added to subnet B516b.However, the other resources510bin virtual network B514bremain isolated from virtual network A514a.Similarly, the resources510b,512bin virtual network B514bare able to interact with the resources512ain virtual network A514athat have been added to subnet A516a.However, the other resources510ain virtual network A514aremain isolated from virtual network B514b.

Some of the resources574a,576ain the on-premises network572may be added to virtual network A514a.Some of the resources574athat are added to virtual network A514amay be added to subnet A516a.Because of the mapping between subnet A516aand subnet B516b,the resources510b,512bin virtual network B514bare able to interact with the resources574ain the on-premises network572that are added to subnet A516a.However, the other resources576ain the on-premises network572that have been added to virtual network A514abut not subnet A516aremain isolated from virtual network B514b.

Similarly, some of the resources574b,576bin the on-premises network572may be added to virtual network B514b.Some of the resources574bthat are added to virtual network B514bmay be added to subnet B516b.Because of the mapping between subnet A516aand subnet B516b,the resources510a,512ain virtual network A514aare able to interact with the resources574bin the on-premises network572that are added to subnet B516b.However, the other resources576bin the on-premises network572that have been added to virtual network B514bbut not subnet B516bremain isolated from virtual network A514a.

As described above, in a cloud computing system that includes virtual networks with mapped subnets, it may be desirable to share a plurality of resources in one virtual network with another virtual network. One way to accomplish this is to add all of the resources to a mapped subnet. For example, if a user would like to share resources A, B, and C in a virtual network with another virtual network, each of those resources may be added to a mapped subnet in the virtual network. This causes a representative resource for each shared resource (i.e., a representative resource for resource A, a representative resource for resource B, and a representative resource for resource C) to be created in a corresponding mapped subnet in the other virtual network.

Alternatively, a resource that represents the resources to be shared may be added to a mapped subnet. This representative resource may be referred to as a gateway resource. For example, instead of adding resources A, B, and C to the mapped subnet, a gateway resource D may be added to the mapped subnet. A single representative resource corresponding to gateway resource D may then be created in the mapped subnet in the other virtual network. Data packets that are destined for resources A, B, and C may include additional information that enables the gateway resource D to forward the data packets to the intended destination.

FIG. 6illustrates an example involving a gateway resource678. As in the examples discussed previously, the cloud computing system600shown inFIG. 6includes two virtual networks: virtual network A614aand virtual network B614b.Virtual network A614aincludes subnet A616a,and virtual network B614bincludes subnet B616b.Subnet A616ais mapped to subnet B616b.

In the example discussed above in connection withFIG. 4, a plurality of resources452,454are added to subnet B416b.When these resources452,454are added to subnet B416b,representative resources456,458are created in subnet A416a.These representative resources456,458are mapped to the resources452,454in subnet B416b.A resource468in virtual network A414amay communicate with a resource in subnet B416bof virtual network B414bby sending a data packet to the corresponding representative resource in subnet A416a.For example, a resource468in virtual network A414amay communicate with the first resource452in subnet B416bby sending a data packet to the IP address associated with the first representative resource456in subnet A416a.The mapping420abetween the first representative resource456and the first resource452enables the data packet to be routed from the first representative resource456to the first resource452.

By contrast, in the example shown inFIG. 6, the resources610a-bthemselves are not added to subnet B616b.Instead, a gateway resource678that represents the resources610a-bis added to subnet B616b.When the gateway resource678is added to subnet B616b,a representative resource618is created in subnet A616a.A one-to-one mapping620is created between the gateway resource678and the corresponding representative resource218in subnet A616a.

A resource612in virtual network A614amay communicate with one of the resources610a-bin virtual network B614bby sending a data packet622to the representative resource618in subnet A616a.The data packet622may include additional identifying information680that enables the gateway resource678to forward the data packet622(or at least the relevant contents of the data packet622) to the intended resource. For example, a resource612in virtual network A614amay communicate with the first resource610ain virtual network B614bby sending a data packet622to the IP address associated with the representative resource618in subnet A616a.The mapping620between the representative resource618and the gateway resource678enables the data packet622to be routed from the representative resource618to the gateway resource678. The gateway resource678may then use the identifying information680in the data packet622to determine which of the resources610a-bin virtual network B614bshould receive the data packet622(or some portion thereof).

FIG. 7illustrates an example of a method700for facilitating communication between resources in different virtual networks414a-b.The method700will be described in relation to the cloud computing system400that is shown inFIG. 4.

The method700includes creating702a first virtual network (e.g., virtual network A414a) and a second virtual network (e.g., virtual network B414b) within a cloud computing system400. A plurality of resources (e.g., resources460,462,468) may be assigned to the first virtual network414a,and a plurality of resources (e.g., resources452,454,470) may be assigned to the second virtual network414b.The method700also includes creating704a first subnet (e.g., subnet A416a) within the first virtual network414aand a second subnet (e.g., subnet B416b) within the second virtual network414b.

The method700also includes mapping706the first subnet416aand the second subnet416bto each other to enable resources in the first subnet416aand resources in the second subnet416bto communicate with each other. Some resources (e.g., resources460,462) within the first virtual network414amay be added to the first subnet416a,and some resources (e.g., resources452,454) within the second virtual network414bmay be added to the second subnet416b.The resources in the first virtual network414aare then able to interact with the resources452,454that have been added to the second subnet416bin the second virtual network414b.However, the first virtual network414aremains unaware of the other resources470in the second virtual network414b(i.e., the resources470in the second virtual network414bthat have not been added to the second subnet416b). Therefore, these other resources470remain isolated from the first virtual network414a.Similarly, the resources in the second virtual network414bare then able to interact with the resources460,462that have been added to the first subnet416ain the first virtual network414a.However, the second virtual network414bremains unaware of the other resources468in the first virtual network414a(i.e., the resources468in the first virtual network414athat have not been added to the first subnet416a). Therefore, these other resources468remain isolated from the second virtual network414b.

The method700also includes routing708data packets between the first subnet416aand the second subnet416b.For example, if a resource468in the first virtual network414asends a data packet to the IP address associated with a representative resource456in the first subnet416a,that data packet may be routed from the representative resource456in the first subnet416ato the corresponding resource452in the second subnet416bbased on mapping information438. Conversely, if a resource470in the second virtual network414bsends a data packet to the IP address associated with a representative resource464in the second subnet416b,that data packet may be routed from the representative resource464in the second subnet416bto the corresponding resource460in the first subnet416abased on mapping information438.

FIG. 8illustrates another example of a method800for facilitating communication between resources in different virtual networks414a-b.The method800will be described in relation to the cloud computing system200that is shown inFIG. 2.

The method800includes receiving802a request to add a resource212bin a virtual network (e.g., virtual network B214b) to a subnet (e.g., subnet B216b) within the virtual network214b.The request may be received from a user of the cloud computing system200via a front-end application that is running on a client device.

In response to receiving the request, the method800also includes automatically creating804a mapping220between the resource212bin the subnet216band a representative resource218in another subnet (e.g., subnet A216a) that is mapped to the subnet216b.The other subnet216acorresponds to another virtual network214awithin the cloud computing system200.

The mapping220facilitates routing of data packets between the subnets216a-b.For example, when a data packet222that is addressed to the representative resource218in the other subnet216ais received806(e.g., after being sent by another resource210ain the other subnet216a), the data packet222may be routed to the corresponding resource212bin the subnet216bbased on the mapping220.

As discussed above, the techniques disclosed herein may be implemented via a cloud computing system. Cloud computing systems are built using principles of distributed systems. A distributed computing system is a type of computing system whose components are located on multiple computing devices. For example, a distributed computing system may include a plurality of distinct processing, memory, storage, and communication components that are connected by one or more communication networks. The various components of a distributed computing system may communicate with one another in order to coordinate their actions.

Thus, a plurality of interconnected computing systems may be used to facilitate communication between resources in different virtual networks in accordance with the present disclosure.FIG. 9illustrates certain components that may be included within a computing system900.

The computing system900includes a processor901. The processor901may be a general purpose single- or multi-chip microprocessor (e.g., an Advanced RISC (Reduced Instruction Set Computer) Machine (ARM)), a special purpose microprocessor (e.g., a digital signal processor (DSP)), a microcontroller, a programmable gate array, etc. The processor901may be referred to as a central processing unit (CPU). Although just a single processor901is shown in the computing system900ofFIG. 9, in an alternative configuration, a combination of processors (e.g., an ARM and DSP) could be used.

The computing system900also includes memory903in electronic communication with the processor901. The memory903may be any electronic component capable of storing electronic information. For example, the memory903may be embodied as random access memory (RAM), read-only memory (ROM), magnetic disk storage media, optical storage media, flash memory devices in RAM, on-board memory included with the processor901, erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM) memory, registers, and so forth, including combinations thereof.

Instructions905and data907may be stored in the memory903. The instructions905may be executable by the processor901to implement some or all of the methods, steps, operations, actions, or other functionality that is disclosed herein. Executing the instructions905may involve the use of the data907that is stored in the memory903. Unless otherwise specified, any of the various examples of modules and components described herein may be implemented, partially or wholly, as instructions905stored in memory903and executed by the processor901. Any of the various examples of data described herein may be among the data907that is stored in memory903and used during execution of the instructions905by the processor901.

The computing system900may also include one or more communication interfaces909for communicating with other electronic devices. The communication interface(s)909may be based on wired communication technology, wireless communication technology, or both. Some examples of communication interfaces909include a Universal Serial Bus (USB), an Ethernet adapter, a wireless adapter that operates in accordance with an Institute of Electrical and Electronics Engineers (IEEE) 802.11 wireless communication protocol, a Bluetooth® wireless communication adapter, and an infrared (IR) communication port.

A computing system900may also include one or more input devices911and one or more output devices913. Some examples of input devices911include a keyboard, mouse, microphone, remote control device, button, joystick, trackball, touchpad, and lightpen. One specific type of output device913that is typically included in a computing system900is a display device915. Display devices915used with embodiments disclosed herein may utilize any suitable image projection technology, such as liquid crystal display (LCD), light-emitting diode (LED), gas plasma, electroluminescence, or the like. A display controller917may also be provided, for converting data907stored in the memory903into text, graphics, and/or moving images (as appropriate) shown on the display device915. The computing system900may also include other types of output devices913, such as a speaker, a printer, etc.

The techniques described herein may be implemented in hardware, software, firmware, or any combination thereof, unless specifically described as being implemented in a specific manner. Any features described as modules, components, or the like may also be implemented together in an integrated logic device or separately as discrete but interoperable logic devices. If implemented in software, the techniques may be realized at least in part by a non-transitory computer-readable medium having computer-executable instructions stored thereon that, when executed by at least one processor, perform some or all of the steps, operations, actions, or other functionality disclosed herein. The instructions may be organized into routines, programs, objects, components, data structures, etc., which may perform particular tasks and/or implement particular data types, and which may be combined or distributed as desired in various embodiments.

The steps, operations, and/or actions of the methods described herein may be interchanged with one another without departing from the scope of the claims. In other words, unless a specific order of steps, operations, and/or actions is required for proper functioning of the method that is being described, the order and/or use of specific steps, operations, and/or actions may be modified without departing from the scope of the claims.

In an example, the term “determining” (and grammatical variants thereof) encompasses a wide variety of actions and, therefore, “determining” can include calculating, computing, processing, deriving, investigating, looking up (e.g., looking up in a table, a database or another data structure), ascertaining and the like. Also, “determining” can include receiving (e.g., receiving information), accessing (e.g., accessing data in a memory) and the like. Also, “determining” can include resolving, selecting, choosing, establishing and the like.