Secure tunnel infrastructure between hosts in a hybrid network environment

A non-transitory computer-readable storage medium having computer-executable instructions stored thereon that, when executed by a computer, cause the computer to:nassign a first unused substrate IP address from a first network to an endpoint of a first network tunnel at the first network, the first network tunnel comprising a contained substrate-level tunnel between a first border device in the first network and a second border device in the second network;assign a second unused substrate IP address from the second network to the endpoint of the first network tunnel at the second network;establish a second network tunnel between a first host computer in the first network and the first border device in the first network; andestablish a third network tunnel between a second host computer in the second host network and the second border device in the second network,nwherein network packets destined for the first unused substrate IP address from the first host computer are configured to be sent to the first border device through the second network tunnel and are further configured to be sent through the first network tunnel to the second border device, the network packets being used for a migration of a virtual machine from the first host computer to the second host computer, andwherein the network packets received at the second border device are configured to be forwarded to the second host computer using the third network tunnel.

A computer-implemented method of establishing a secure tunnel infrastructure between a first host computer in a private network and a second host computer in a virtual private network, the method comprising executing instructions in a computer system to perform the operations of:nselecting a first unused overlay IP address from an overlay address space of the private network, a networking infrastructure of the private network configured to map the first unused overlay IP address to the first host computer;selecting a second unused overlay IP address from an overlay address space of the virtual private network, a networking infrastructure of the virtual private network configured to map the second unused overlay IP address to the second host computer;establishing a first network tunnel between a first border device in the private network and a second border device in the virtual private network;establishing a second network tunnel between the first host computer and the first border device; andestablishing a third network tunnel between the second border device and the second host computer,nwherein network packets from the first host computer are configured to be sent to the first border device through the second network tunnel and are further configured to be sent through the first network tunnel to the second border device, the network packets being used for a migration of a virtual machine from the first host computer to the second host computer, andwherein the network packets received at the second border device are forwarded to the second host computer using the third network tunnel.

A system comprising:none or more processors; anda main memory coupled to the one or more processors and configured with one or more software modules that cause the one or more processors tonestablish a network tunnel between a first border device in a first network and a second border device in a second network, wherein the first border device is configured to forward network packets destined for an overlay address space of the second network to the second border device in the second network,configuring a networking infrastructure of the first network to map a first overlay IP address from the overlay address space of the first network to a first host computer in the first network, andconfiguring a networking infrastructure of the second network to map a second overlay IP address from an overlay address space of the second network to a second host computer in the second network,nwherein the networking infrastructure of the first network is configured so that network packets destined for the second overlay IP address from the first host computer are sent directly to the first border device, through the first network tunnel to the second border device, the network packets being used for a migration of a virtual machine from the first host computer to the second host computer,wherein the network packets received at the second border device are configured to be forwarded to the second host computer using a second network tunnel established between the second host computer and the second border device, andwherein the networking infrastructures of the first network and the second network are further configured to disable firewall rules regarding the first overlay IP address and the second overlay IP address.