CN102655468B

CN102655468B - A kind of method and system realizing privately owned VPLS

Info

Publication number: CN102655468B
Application number: CN201110050096.9A
Authority: CN
Inventors: 张君辉; 喻敬海
Original assignee: ZTE Corp
Current assignee: Yancheng Hengmao Landscaping Co.,Ltd.
Priority date: 2011-03-02
Filing date: 2011-03-02
Publication date: 2016-12-28
Anticipated expiration: 2031-03-02
Also published as: CN102655468A

Abstract

The invention discloses a kind of method and system realizing privately owned VPLS, all can be at the AC side configuration attribute of PE and corresponding VLAN ID；Extension LDP agreement, sets up local AC and the mapping table of far-end AC on PE；According to local AC mapping table, CE business is carried out flow isolation.The inventive method and system, achieve the isolation of customer service in VPLS network, can realize customer flow isolation according to the application demand of operator, also can make the user's intercommunication in specific group；Further, these users can be with aggregation node intercommunication.It addition, the function of E TREE can also be realized in VPLS network, such that it is able to realize networking application ensure service security flexibly according to the requirement of operator.

Description

A kind of method and system realizing privately owned VPLS

Technical field

The present invention relates to the communications field, be specifically related to one and realize private virtual private network service (Virtual Private LAN Service, VPLS) method and system.

Background technology

Along with the fast development of telecommunication technology, many by the carrying of Internet protocol/multiprotocol label switching (IP/MPLS) technology Business has been trend of the times.The ALL-IPization of network traffics and the flattening of network structure, for MPLS technology from network core layer, Convergence-level moves down into Access Layer and provides possibility.Along with VPLS technology is in the application of access network (Access Network), need Consider under multi-user environment, how to realize the isolation of customer flow and the safety of business.It addition, along with Metro Ethernet skill The development of art, Carrier Requirements realizes between the function of electronics tree (E-TREE), i.e. leaf (leaf) node in VPLS network Being mutually isolated, leaf can only be with root (root) node communication.

Internet engineering duty group (The Internet Engineering Task Force, IETF) RFC4762 Define the technical specification realizing VPLS based on tag distribution protocol (LDP).VPLS is by customer edge (Customer Edge, CE) equipment is connected to Provider Edge (Provider Edge, PE) equipment, and PE is again by the MPLS core net of operator Network realizes full mesh (Full Mesh) and connects, and i.e. realizes the business of similar LAN by MPLS technology, and subscriber equipment passes through this LAN Realize the function interconnected.RFC5517 defines the technical specification of private virtual local area network (Private VLAN, PVLAN), Realize the isolation of customer service by PVLAN technology and improve safety.Ietf draft of being correlated with at present describes at VPLS Network realizes the demand of E-TREE function, framework and implements.

Existing realize the realization of E-TREE function based on VPLS network and mainly have three kinds of modes: (1) is taken by control word The Root/Leaf attribute of band access link (AC), the shortcoming of this mode is to need in pseudo-wire (PW) upper enable control word pattern, And take control word to identify this attribute；(2) virtual switch instance (VSI) virtual upper set up respectively Root PW and Leaf PW realizes the isolation of customer service, and the shortcoming of this mode is to need to set up more PW, add system burden and The complexity of management；(3) on VSI, configure Root VLAN and Leaf VLAN, notice and set up VLAN between VSI and map, from And realize the isolation of customer service, the shortcoming of this mode is only to support a root and leaf attribute, i.e. can only realize leaf and Isolation between leaf node, does not support that under same VSI example, certain user's node is mutually isolated, and certain user group can phase Intercommunication.

Summary of the invention

In view of this, present invention is primarily targeted at a kind of method and system realizing privately owned VPLS of offer, to ensure VPLS networking application flexibly, it is achieved customer flow is isolated and ensures service security.

For reaching above-mentioned purpose, the technical scheme is that and be achieved in that:

A kind of method realizing private virtual private network service Private VPLS, the method includes:

Access link AC side configuration attribute and corresponding VLAN ID VLAN ID at Provider Edge PE；

Extension tag distribution protocol LDP, sets up local AC and the mapping table of far-end AC on PE；

According to local AC mapping table, customer edge CE business is carried out flow isolation.

The process of described extension LDP agreement includes:

Increase interface parameters relevant for Private VPLS time Type Length scalar sub-TLV；

At session establishment phase, consult whether pseudo-wire PW two ends support centrex service；

When setting up PW, in PW label mapping Label Mapping message, carry sub-TLV；

The notice opposite end when revising AC configuration, to synchronize AC configuration information.

The described process carrying out flow isolation includes:

After the AC entrance of local end PE receives customer flow, before forwarding from PW, the AC mapping table according to setting up enters Row forward filtering, completes the isolation of customer flow at local terminal.

The method farther includes:

For the customer flow from far-end PE, after peeling outer layer tunnel label and PW label, according to internal VLAN ID checks local AC mapping relations table, and carries out forward filtering accordingly.

The method farther includes:

In VPLS network configure Routing Protocol, make all devices three-layer routing up to；

Run LDP agreement, in public network, distribute label switching path LSP label, set up the public network tunnel of PE to PE；

Configuring VPLS example on PE equipment, operational objective Target-LDP, the PW setting up PE to PE connect entirely, and at PW Upper enable labelling tagged pattern.

A kind of system realizing privately owned VPLS, this system includes that the isolation of AC side dispensing unit, protocol extension unit, flow is single Unit；Wherein,

Described AC side dispensing unit, at the AC side configuration attribute of PE and corresponding VLAN ID；

Described protocol extension unit, is used for extending LDP agreement, sets up local AC and the mapping table of far-end AC on PE；

Described flow isolated location, for carrying out flow isolation according to local AC mapping table to CE business.

Described protocol extension unit, when extending LDP agreement, is used for:

Increase relevant interface parameters sub-TLV of Private VPLS；

At session establishment phase, consult whether PW two ends support P-VPLS；

When setting up PW, in PW Label Mapping message, carry sub-TLV；

When described flow isolated location carries out flow isolation, it is used for:

After the AC entrance of local end PE receives customer flow, before forwarding from PW, according to the AC mapping table set up Carry out forward filtering, complete the isolation of customer flow at local terminal.

Described flow isolated location, is further used for:

Described AC side dispensing unit, is further used for:

Running LDP agreement, in triggering public network, the distribution of LSP label, triggers the foundation in the public network tunnel of PE to PE；

Configuring VPLS example on PE equipment, trigger the operation of Target-LDP, what the PW of triggering PE to PE connected entirely builds Vertical, trigger the enable of tagged pattern on PW.

The inventive method and system, achieve the isolation of customer service in VPLS network, can be according to the application of operator Demand realizes customer flow isolation, also can make the user's intercommunication in specific group；Further, these users can be mutual with aggregation node Logical.It addition, the function of E-TREE can also be realized in VPLS network, such that it is able to realize group flexibly according to the requirement of operator Net application also ensures service security.

Accompanying drawing explanation

Fig. 1 is the networking application schematic diagram that the embodiment of the present invention realizes privately owned VPLS；

Fig. 2 is the networking application schematic diagram that the embodiment of the present invention realizes E-tree；

Fig. 3 is the flow chart that one embodiment of the invention realizes privately owned VPLS；

Fig. 4 is the general flow chart that the embodiment of the present invention realizes privately owned VPLS；

Fig. 5 is the system diagram that the embodiment of the present invention realizes privately owned VPLS.

Detailed description of the invention

In actual applications, need under VPLS accesses the network environment of multi-user, realize similar between the subscriber devices PVLAN business, reaches user-isolated flow and improves the purpose of service security；Further, since E-TREE is the function of PVLAN Subset, so also support E-TREE function in VPLS network.Specifically include:

(1) accessing multiple user in VPLS network, similar PVLAN, mutually isolated user node attribute is isolation (isolated), the user node attribute of intercommunication is group (community), and aggregation node attribute is for mixing (promiscuous).PE device A C interface configures the CE nodal community of connection, and configures corresponding VLAN ID (VLAN ID), i.e. Primary VLAN or Secondary VLAN；

(2) when setting up PW or amendment AC configuration, extend LDP agreement, attribute information and the VLAN ID of the AC of VPLS are led to Accuse to opposite end, on PE, i.e. set up local AC and the mapping relations of far-end AC；

(3) local user's flow is after AC enters, and before being forwarded to PW, according to AC mapping table, checks corresponding attribute Whether mate with VLAN, if meeting the filtering rule of PVLAN, then allow to forward, otherwise abandon in this locality；

(4) remote subscriber flow is after PW enters, and before forwarding from local AC, checks whether according to AC mapping table Meet PVLAN filtering rule, and decide whether to allow to forward.

Below in conjunction with the accompanying drawings the implementation method realizing CE-PVLAN in VPLS is illustrated.

As it is shown in figure 1, set up a L2VPN business in VPLS, in this VPN, PE1, PE2 and PE3 are operator Equipment, sets up the full VPLS connected between PE equipment.CE is subscriber equipment, and wherein CE12 and CE32 needs to isolate, CE11, CE31, CE33 and CE22 belong to group 1, and CE21 is the node device converged, and all CE are required for and this device intercommunicating.In order to Realize the pvlan feature between CE equipment, need on PE equipment, set up local AC and the mapping relations of far-end AC, and according to reflecting Penetrate relation and forward filtering rule to support the forwarding behavior of customer flow, thus realize privately owned VPLS.Accordingly, it would be desirable to extension is existing Some LDP agreements, notice the attribute of AC and privately owned VLAN ID between PE, and protocol extension is as follows:

(1) relevant interface parameters (interface parameter) the secondary Type Length of a Private VPLS is increased Scalar (sub-TLV), wherein P-VPLS field is sub-TLV mark, and attribute two bit-identifies, 00 represents unused, and 01 is Isolated attribute, 10 is community attribute, and 11 is promiscuous attribute, the VLAN ID that VLAN ID mark AC is corresponding Value；

(2) at session establishment phase, need to consult whether PW two ends support P-VPLS, i.e. centrex service；

(3), when setting up PW, in PW label mapping (Label Mapping) message, described sub-TLV is carried；

(4) when revising AC configuration, by notice (Notification) message announcement to opposite end, to synchronize AC configuration letter Breath.

The concrete handling process of the present invention is as it is shown on figure 3, concrete steps include:

310: in VPLS network configure Routing Protocol, make all devices three-layer routing up to；

320: run LDP agreement, in public network, distribute label switched path (LSP) label, set up the public network tunnel of PE to PE Road；

330: configuring VPLS example on PE equipment, operational objective LDP (Target-LDP), the PW setting up PE to PE connect entirely Connect, and on PW, enable labelling (tagged) pattern；

340: at the AC side of PE configuration isolated, community or promiscuous attribute and corresponding VLAN ID Value；

350: when setting up PW, if Private VPLS is all supported at VPLS PE two ends, the most mutually notice the AC attribute of local terminal With corresponding VLAN ID, set up local AC and the mapping table of far-end AC；

360: after the AC entrance of local end PE receives customer flow, before forwarding from PW, need first according to foundation AC mapping table carries out forward filtering, completes the isolation of customer flow at local terminal.

So, from the customer flow of far-end PE, after peeling outer layer tunnel label and PW label, it is possible to according to inside VLAN ID check local AC mapping relations table, and carry out forward filtering accordingly.

Below in the implementing of the embodiment of the present invention, Fig. 1 is the networking schematic diagram of embodiment 1, describes two Isolated user, four community and the application scenarios of a Promiscuous；Of course, it is possible to enter on this basis Row further extension, to form more flexible and controlled application.

Embodiment 1

With reference to Fig. 1, in the present embodiment, CE12 and CE32 is that isolated, i.e. CE12 and CE32 are mutually isolated, CE12, CE32 Can only communicate with CE21；CE11, CE31, CE33 and CE22 form community, i.e. can between CE11, CE31, CE33 and CE22 With intercommunication, also can communicate with CE21, but can not be with Isolated node CE12 and CE32 intercommunication；CE21 is Promiscuous, phase When in aggregation node, all users can communicate with CE21, and carried out by CE21 and the nucleus equipment on upper strata or server Communication.

Such as PE1, PE1 is connected to CE11 and CE12, and wherein the attribute of CE12 is that the attribute of isolated, CE11 is community.Concrete handling process is as follows:

(1) when PE1 is after CE11 receives customer flow, corresponding AC attribute be community, i.e. PE1 can and local PE or the identical AC of far-end PE attribute communicates, it is also possible to and promiscuous intercommunication, therefore need root at local PE, PE1 The outlet of correspondence is found according to AC mapping table.To the present embodiment, if non-marked (untag) message, then can add in messages VLAN=200, to represent this customer flow, otherwise, if tag message, then carries out vlan inspection；If having passed through vlan Check, then carry out media access control (MAC) address learning and find correspondence according to purpose Media Access Control address (DMAC) Outlet, according to local AC mapping table, the outlet of VLAN200 has two, respectively PW1 and PW2；

(2) receive flow as PE1 from CE12, corresponding attribute be isolated, i.e. PE1 can only with locally or remotely Promicuous equipment communicates, and according to the AC mapping table of local PE, after completing MAC address learning, looks for further according to DMAC It is PW1 to the outlet that far-end promicuous AC is corresponding；

(3) when PE1 receives the flow of far-end AC1 from PE2, due to the VLAN ID=200 of encapsulation, therefore according to this locality AC mapping table, PE1 can only be with local AC1 intercommunication, and can not be with local AC2 intercommunication；

(4) when PE1 receives the flow of far-end AC2 from PE2, due to the VLAN ID=100 of encapsulation, therefore according to this locality AC mapping table, PE1 can communicate with local AC1 and AC2；It addition, message is before AC1 or AC2 forwards, need Replace with the VLAN ID of local AC；

(5) when PE1 receives the AC2 flow of far-end PE 3, due to the VLAN ID=300 of encapsulation, therefore according to this locality AC mapping table, PE1 can only communicate with local AC2, and being checked by the VLAN of two layers can be far-end AC2 and local AC1 Keep apart.

(6) handling process on PE2 with PE3 is similar with above-mentioned respective handling flow process.

Embodiment 2

With reference to Fig. 2, the present embodiment is the subset of embodiment 1.In the present embodiment, CE21 is Root node (promicuous), other AC is leaf node (isolated)；Such as at PE1 equipment, concrete handling process is as follows:

(1) when PE1 is after CE11 receives customer flow, corresponding AC attribute is that leaf (isolated), i.e. PE1 can only be with The AC2 intercommunication of far-end PE 2, and the AC of local AC and other PE is mutually isolated；Correspondence is found according to local AC mapping table Outlet be PW1；It addition, local AC1 and AC2 needs isolation, can be isolated by VLAN inspection at L2 layer；

(2) when PE1 receives leaf AC flow from PE2 or PE3, according to local AC mapping table, it is impossible to turn from local AC Send out, checked that by L2VLAN can realize flow isolates；

(3) when PE1 receives the flow of far-end root AC from PE2, due to the VLAN ID=100 of encapsulation, therefore basis Local AC mapping table, PE1 can be with local AC1, AC2 intercommunication；

(4) handling process on PE2 with PE3 is similar with above-mentioned respective handling flow process.

Describing visible in conjunction with above technology, the present invention realizes the key operation thinking of privately owned VPLS and can represent such as Fig. 4 institute The flow process shown, this flow process comprises the following steps:

Step 410: at AC side configuration attribute and the corresponding VLAN ID of PE.

Step 420: extension LDP agreement, sets up local AC and the mapping table of far-end AC on PE.

Step 430: CE business is carried out flow isolation according to local AC mapping table.

In order to ensure that above-mentioned technology describes and operation thinking can realize smoothly, setting as shown in Figure 5 can be carried out. Seeing Fig. 5, Fig. 5 is the system diagram that the embodiment of the present invention realizes privately owned VPLS, and this system includes AC side dispensing unit, the association being connected View expanding element, flow isolated location.

In actual applications, AC side dispensing unit can be at the AC side configuration attribute of PE and corresponding VLANID.Agreement expands Exhibition unit can extend LDP agreement, sets up local AC and the mapping table of far-end AC on PE.Flow isolated location can be according to this Ground AC mapping table carries out flow isolation to CE business.

The most visible, either method or system, the present invention realizes the technology of privately owned VPLS, in VPLS network Achieve the isolation of customer service, customer flow isolation can be realized according to the application demand of operator, in also making specific group User's intercommunication；Further, these users can be with aggregation node intercommunication.It addition, can also realize E-TREE's in VPLS network Function, such that it is able to realize networking application ensure service security flexibly according to the requirement of operator.

Certainly, the present invention also can have other various embodiments, in the case of without departing substantially from present invention spirit and essence thereof, ripe Know those skilled in the art to work as and can make various corresponding change and deformation according to the present invention, but these change accordingly and become Shape all should belong to the protection domain of appended claims of the invention.

The above, only presently preferred embodiments of the present invention, it is not intended to limit protection scope of the present invention.

Claims

1. the method realizing private virtual private network service Private VPLS, it is characterised in that the method includes:

Method the most according to claim 1, it is characterised in that the process of described extension LDP agreement includes:

When setting up PW, in PW label mapping Label Mapping message, carry sub-TLV；

Method the most according to claim 1, it is characterised in that described in carry out the process of flow isolation and include:

After the AC entrance of local end PE receives customer flow, before forwarding from PW, carry out turning according to the AC mapping table set up Send out and filter, complete the isolation of customer flow at local terminal.

4. according to the method described in any one of claims 1 to 3, it is characterised in that the method farther includes:

For the customer flow from far-end PE, after peeling outer layer tunnel label and PW label, according to internal VLAN ID inspection Look into the AC mapping relations table of this locality, and carry out forward filtering accordingly.

Method the most according to claim 4, it is characterised in that the method farther includes:

Configuring VPLS example on PE equipment, operational objective Target-LDP, the PW setting up PE to PE entirely connect, and make on PW Can labelling tagged pattern.

6. the system realizing privately owned VPLS, it is characterised in that this system include AC side dispensing unit, protocol extension unit, Flow isolated location；Wherein,

System the most according to claim 6, it is characterised in that described protocol extension unit, when extending LDP agreement, is used In:

Increase relevant interface parameters sub-TLV of Private VPLS；

At session establishment phase, consult whether PW two ends support centrex service；

When setting up PW, in PW Label Mapping message, carry sub-TLV；

System the most according to claim 6, it is characterised in that when described flow isolated location carries out flow isolation, be used for:

After the AC entrance of local end PE receives customer flow, before forwarding from PW, the AC mapping table according to setting up is carried out Forward filtering, completes the isolation of customer flow at local terminal.

9., according to the system described in any one of claim 6 to 8, it is characterised in that described flow isolated location, use further In:

System the most according to claim 9, it is characterised in that described AC side dispensing unit, is further used for:

PE equipment configures VPLS example, triggers the operation of Target-LDP, trigger the full establishment of connection of PW of PE to PE, touch Send out the enable of tagged pattern on PW.