Distributed network services

Abstract

Providing a distributed network service includes: receiving network traffic at a first physical device; and executing a service engine to participate in the distributed network service. The distributed network service is provided to at least the first target application instance executing in a first VM on the first physical device, and a second target application instance executing in a second VM on a second physical device; and a shared state of the distributed network service is maintained with respect to the first physical device and the second physical device.

What is claimed is: 
     
         1 - 25 . (canceled) 
     
     
         26 . A method of implementing a distributed network service platform in a data center with a plurality of host computers on which a plurality of application virtual machines and a plurality of virtual switches are deployed, the method comprising:
 configuring a first set of service virtual machines (SVMs) on a set of two or more host computers to implement a first distributed network service;   configuring each particular virtual switch in a first set of virtual switches to re-direct packets sent by a particular application VM in a first set of application VMs to a particular SVM in a first set of SVMs to perform the first distributed network service; and   configuring the first set of virtual switches to forward packets returned by the first set of SVMs to destinations of the packets.   
     
     
         27 . The method of  claim 26 , wherein each particular virtual switch re-directs packets sent by a particular application VM executing on a particular host computer along with the particular virtual switch. 
     
     
         28 . The method of  claim 27 , wherein each particular virtual switch re-directs packets sent by the particular application VM to a particular SVM executing on the particular host computer along with the particular application VM and the particular virtual switch. 
     
     
         29 . The method of  claim 27 , wherein each particular virtual switch re-directs packets sent by the particular application VM to a particular SVM executing on the particular host computer or another host computer. 
     
     
         30 . The method of  claim 26 , wherein the SVMs in the first set of SVMs share state regarding the first distributed network service that the first set of SVMs implement. 
     
     
         31 . The method of  claim 26 , wherein the packets sent by the first set of applications are sent to a second set of applications, the method further comprising
 configuring each particular virtual switch in a second set of virtual switches to re-direct packets sent by a particular application VM in a second set of application VMs to a particular SVM in a second set of SVMs to perform a second distributed network service; and   configuring the second set of virtual switches to forward packets returned by the second set of SVMs to destinations of the packets.   
     
     
         32 . The method of  claim 31 , wherein each particular virtual switch in the second set of virtual switches re-directs packets sent by a particular application VM executing on a particular host computer along with the particular virtual switch. 
     
     
         33 . The method of  claim 26 , wherein the distributed network service is a load balancing service. 
     
     
         34 . The method of  claim 26 , wherein the distributed network service is a firewall service. 
     
     
         35 . The method of  claim 26 , wherein each virtual switch is in-line in a datapath of the application VM for which the virtual switch re-directs the packets to the first set of SVMs. 
     
     
         36 . A non-transitory machine readable medium storing a program for implementing a distributed network service platform in a data center with a plurality of host computers on which a plurality of application virtual machines and a plurality of virtual switches are deployed, the program comprising sets of instructions for:
 configuring a first set of service virtual machines (SVMs) on a set of two or more host computers to implement a first distributed network service;   configuring each particular virtual switch in a first set of virtual switches to re-direct packets sent by a particular application VM in a first set of application VMs to a particular SVM in a first set of SVMs to perform the first distributed network service; and   configuring the first set of virtual switches to forward packets returned by the first set of SVMs to destinations of the packets.   
     
     
         37 . The non-transitory machine readable medium of  claim 36 , wherein each particular virtual switch re-directs packets sent by a particular application VM executing on a particular host computer along with the particular virtual switch. 
     
     
         38 . The non-transitory machine readable medium of  claim 37 , wherein each particular virtual switch re-directs packets sent by the particular application VM to a particular SVM executing on the particular host computer along with the particular application VM and the particular virtual switch. 
     
     
         39 . The non-transitory machine readable medium of  claim 37 , wherein each particular virtual switch re-directs packets sent by the particular application VM to a particular SVM executing on the particular host computer or another host computer. 
     
     
         40 . The non-transitory machine readable medium of  claim 36 , wherein the SVMs in the first set of SVMs share state regarding the first distributed network service that the first set of SVMs implement. 
     
     
         41 . The non-transitory machine readable medium of  claim 36 , wherein the packets sent by the first set of applications are sent to a second set of applications, the program further comprising sets of instructions for:
 configuring each particular virtual switch in a second set of virtual switches to re-direct packets sent by a particular application VM in a second set of application VMs to a particular SVM in a second set of SVMs to perform a second distributed network service; and   configuring the second set of virtual switches to forward packets returned by the second set of SVMs to destinations of the packets.   
     
     
         42 . The non-transitory machine readable medium of  claim 41 , wherein each particular virtual switch in the second set of virtual switches re-directs packets sent by a particular application VM executing on a particular host computer along with the particular virtual switch. 
     
     
         43 . The non-transitory machine readable medium of  claim 36 , wherein the distributed network service is a load balancing service. 
     
     
         44 . The non-transitory machine readable medium of  claim 36 , wherein the distributed network service is a firewall service. 
     
     
         45 . The non-transitory machine readable medium of  claim 36 , wherein each virtual switch is in-line in a datapath of the application VM for which the virtual switch re-directs the packets to the first set of SVMs.