Embodiment
For making the object, technical solutions and advantages of the present invention clearer, below in conjunction with accompanying drawing, the present invention is described in further detail.
As shown in Figure 1, the many network management system of virtual machine under a kind of cloud computing environment of the present invention, include computational resource server and Virtual Machine Manager server, and wherein, computational resource server further includes:
Network area construction device, for network is divided into several security domains, again each security domain is continued to be divided into several network areas, then for each network area configures actual access switch and build corresponding VLAN pond and IP pond, it is VLAN that described VLAN pond includes all available VLAN(in described network area) numbering section, IP pond includes all available IP address fields in described network area;
Virtual switch creation apparatus, for a plurality of physical nodes are divided into respectively to different security domains, and create virtual switch on the physical node of each security domain, described physical node can be 1 physical host or the computer cluster that consists of a plurality of physical hosts, described virtual switch includes distribution switch and standard switchboard, then the virtual switch in each security domain is connected one by one with the access switch of each network area configuration, and the connection between virtual switch and access switch is configured to trunk pattern; Now, the port set of virtual switch configuration is equivalent to directly be configured on access switch, thereby has realized the intercommunication of virtual network and real network;
Virtual machine creating request processing unit, for receiving user's establishment virtual machine request message, in described establishment virtual machine request message, include the affiliated security domain of virtual machine being created, the information such as the network type label of virtual machine network interface card, for the virtual machine being created distributes a new virtual machine numbering, and the virtual machine state being created is set in establishment, then by the virtual machine numbering being created, the information such as the VLAN numbered list in user-specified network region and corresponding IP address return to user, also to Virtual Machine Manager server, send virtual machine creating notification message simultaneously, in described virtual machine creating notification message, include the virtual machine numbering being created, the VLAN numbered list in user-specified network region, security domain under virtual machine and the information such as network type label of virtual machine network interface card, finally when receiving the establishment successful result that Virtual Machine Manager server returns, virtual machine state is updated to ready, and the virtual machine of notifying user to be created by the IP address access in virtual machine creating response message,
Virtual machine network choice device, for reading one by one each network area from user's application VLAN request message and judging whether have a vlan network having created each network area, if so, the VLAN numbering of the vlan network having created is added in the VLAN numbered list in user-specified network region; If not, in described network area, create VLAN numbering and the IP address of a new vlan network, also selected described new vlan network, then the VLAN numbering of the vlan network newly creating is added in the VLAN numbered list in user-specified network region.
The configuration mode of the network equipment has generally included two kinds of trunk and access, wherein:
1, trunk pattern is as main line, transmits each vlan information, and trunk mouth is used for the connection between the network equipment conventionally, for example connection between switch and switch or switch and router, and the port of trunk pattern can pass through a plurality of VLAN;
2, access pattern is that network equipment port is divided into certain VLAN, is typically used as main frame access, and the port of accsee pattern can only pass through a VLAN, i.e. port place VLAN.
Network area construction device can be divided into different security domains and network area by network according to purposes, safe class, access strategy etc. by the configuration on the network equipment (as switch, fire compartment wall), described network can include one or more dissimilar networks, when comprising a network type, all security domains belong to same network type (such as business network being divided into the security domains such as DMZ district, TEST district, core production area); When comprising a plurality of network types (network types such as business, storage or heartbeat), all security domains belong to respectively different network types.
From Safety Redundancy, consider, the network of server is at least wanted two netting twine trends, is connected in 2 same function roles' access switch, and described network area construction device can also include:
The virtual unit of access switch, be used to 2 access switch of each network area configuration, and it is virtual to 2 access switch, to adopt Intel Virtualization Technology to carry out respectively, thereby 2 access switch is invented to 1 access switch equipment of logic.
As shown in Figure 2, virtual switch creation apparatus can further include:
Virtual switch construction unit, be used for according to the network type of each network area of security domain, for example on the physical node of each security domain, create several distribution switch, for dividing the cluster shared network (business network distribution switch or storage networking distribution switch) of different purposes, and on every physical host, create 1 standard switchboard and monopolize network (for example heartbeat network standard switch) for dividing the physical host of different purposes;
Virtual switch tag unit, for example, for stamping different network type label (business, storage, management) to the virtual switch (including distribution switch and standard switchboard) of each security domain, and be that each security domain builds 1 computing pool, in described computing pool, preserve the information such as virtual switch in security domain and network type label thereof.
Virtual machine can be linked in a plurality of network areas according to multi-business diversification demand simultaneously, and described virtual machine network choice device can further include:
Vlan network creating unit, for creating a new vlan network in network area: a selected available VLAN numbering from the VLAN pond of described network area, then according to the network size that will create, in the IP pond of described network area, mark off an IP subnet section, on fire compartment wall, configure again the information such as the gateway of VLAN and mask, thereby create out one and have the vlan network that is not less than required IP address space, finally from the IP subnet section marking off, select an idle IP address, preserve the network area of the vlan network of described new establishment, and the information such as selected VLAN numbering and IP address.
Described Virtual Machine Manager server further includes:
Virtual machine creating device, for receiving the virtual machine creating notification message that computational resource server is sent, in described virtual machine creating notification message, include the virtual machine numbering being created, the VLAN numbered list in user-specified network region, security domain under virtual machine and the network type label of virtual machine network interface card, security domain under virtual machine, select 1 physical host, and find virtual switch consistent with the network type label of virtual machine network interface card in security domain, then from the VLAN numbered list in user-specified network region, extract one by one each VLAN numbering, and judge that on virtual switch, whether having consistent with it port set numbers, if not, on described virtual switch newly-built one number consistent port set with VLAN, and each port arrangement in described port set is become to access pattern, when the VLAN numbered list from user-specified network region, extracted after all VLAN numberings, h.323-configured gateway on virtual machine network interface card again, the information such as mask and IP address, and a VLAN who successively a network interface card of virtual machine is linked in the VLAN numbered list with user-specified network region numbers in consistent virtual switch port set, finally start the virtual machine process that creates, beginning creates virtual machine on selected physical host, after creating virtual machine success, in the computing pool of the security domain under virtual machine, increase described virtual machine information, to computational resource server, return to establishment successful result simultaneously.
Fig. 3 shows the inside annexation schematic diagram that the present invention creates an embodiment after virtual machine on physical host.As shown in Figure 3, 2 distribution switch for different purposes (being service distribution formula switch and distributed storage switch) on physical host, have been created, 1 standard switchboard and 2 virtual machines (being VM-1 and VM-2), virtual machine respectively with service distribution formula switch, distributed storage switch, standard switchboard is connected, A, B, C, D, E, F is the network interface card of physical host, A`, B`, C`, D`, E`, F` is the network interface card of fictitious host computer (gather Intel Virtualization Technology and carry out the physical host after virtual), A``, B``, C``, D`` is the uplink port of two distribution type switches.
As can be seen from Figure 3, the uplink port group of distribution switch and the port of access switch are connected, and wherein distribution switch side is pressed the pattern configurations of vlan trunking, and access switch side is configured to trunk pattern.The down link port group of virtual switch (is business network port set 1, business network port set n, storage networking port set 1, storage networking port set m, supervising the network port set 1, supervising the network port set p) acquiescence when creating of each port set in has 256 ports, assigned vlan is numbered simultaneously, a network interface card of port under port set and the virtual machine being created (eth0 for example, eth1, eth2) be connected, the one group of switch ports themselves that is equivalent to physical switches, and each port is configured to access pattern, only allow the network traffics of particular vlan numbering to pass through.The data flow that the uplink port group of the distribution switch network traffics of all VLAN numbering (allow by) is responsible for all down link port groups network traffics of particular vlan numbering (only allow by) exports, so uplink port group and down link port group are the relations of one-to-many, the port in the uplink port group of distribution switch can be configured to active and standby or load-sharing mode.Standard switchboard is mainly used in fictitious host computer aspect and carries out the required network of Virtual Machine Manager.
As shown in Figure 4, the many network managements of virtual machine under a kind of cloud computing environment of the present invention, include:
Step 1, network is divided into several security domains, again each security domain is continued to be divided into several network areas, then for each network area configures actual access switch and build corresponding VLAN pond and IP pond, described VLAN pond includes all available VLAN numbering sections in described network area, and IP pond includes all available IP address fields in described network area;
Step 2, a plurality of physical nodes are divided into respectively in different security domains, and create virtual switch on the physical node of each security domain, described physical node can be 1 physical host or the computer cluster that consists of a plurality of physical hosts, and described virtual switch includes distribution switch and standard switchboard;
Step 3, the virtual switch in each security domain is connected one by one with the access switch of each network area configuration, and the connection between virtual switch and access switch is configured to trunk pattern; Now, the port set of virtual switch configuration is equivalent to directly be configured on access switch, thereby has realized the intercommunication of virtual network and real network.
In described step 1, can network be divided into different security domains and network area according to purposes, safe class, access strategy etc. by the configuration on the network equipment (as switch, fire compartment wall).
It is worth mentioning that, network in step 1 can include one or more dissimilar networks, when comprising a network type, all security domains belong to same network type (such as business network being divided into the security domains such as DMZ district, TEST district, core production area); When comprising a plurality of network types (network types such as business, storage or heartbeat), all security domains belong to respectively different network types.
From Safety Redundancy, consider, the network of server is at least wanted two netting twine trends, is connected in 2 same function roles' access switch, and Fig. 4 step 1 also includes:
For 2 access switch of each network area configuration, and it is virtual to 2 access switch, to adopt Intel Virtualization Technology to carry out respectively, thereby 2 access switch is invented to 1 access switch equipment of logic.
As shown in Figure 5, in Fig. 1 step 2, further include:
Step 21, according to the network type of each network area in security domain, for example on the physical node of each security domain, create several distribution switch, for dividing the cluster shared network (business network distribution switch or storage networking distribution switch) of different purposes, and on every physical host of security domain, create 1 standard switchboard and monopolize network (for example heartbeat network standard switch) for dividing the physical host of different purposes;
Step 22, stamp different network type label (for example business, storage, management) to the virtual switch (including distribution switch and standard switchboard) of each security domain;
Step 23, be that each security domain builds 1 computing pool, in described computing pool, preserve the information such as virtual switch in security domain and network type label thereof.
As shown in Figure 6, when user creates a new virtual machine, also include:
Steps A 1, user are sent and are created virtual machine request message to computational resource server, include the security domain under the virtual machine being created, the information such as network type label of virtual machine network interface card in described establishment virtual machine request message;
Steps A 2, computational resource server are that the virtual machine being created distributes a new virtual machine numbering, and the virtual machine state being created is set in establishment;
In steps A 3, the user security domain under virtual machine, select one or more network areas, and send application VLAN request message to computational resource server; The virtual machine being created can be supported one or more network areas, thereby meets the multiple demand of operation system;
Steps A 4, computational resource server read one by one each network area and judge in each network area, whether to have a vlan network having created from application VLAN request message, if so, the VLAN numbering of the vlan network having created is added in the VLAN numbered list in user-specified network region; If not, in described network area, create VLAN numbering and the IP address of a new vlan network, also selected described new vlan network, then the VLAN numbering of the vlan network newly creating is added in the VLAN numbered list in user-specified network region;
Steps A 5, computational resource server return to virtual machine creating response message to user, and described virtual machine creating response message includes the information such as the VLAN numbered list in the virtual machine numbering that is created, user-specified network region and corresponding IP address;
Steps A 6, computational resource server send virtual machine creating notification message to Virtual Machine Manager server, include the virtual machine numbering being created, VLAN numbered list, the security domain under virtual machine and the information such as network type label of virtual machine network interface card in user-specified network region in described virtual machine creating notification message;
Steps A 7, the security domain of Virtual Machine Manager server under virtual machine, select 1 physical host, and find virtual switch consistent with the network type label of virtual machine network interface card in security domain, then from the VLAN numbered list in user-specified network region, extracting one by one each VLAN numbers and judges that on virtual switch, whether having consistent with it port set numbers, if so, continue to extract next VLAN numbering; If not, on described virtual switch newly-built one number consistent port set with VLAN, and each port arrangement in port set is become to access pattern, then continue to extract next VLAN numbering;
Steps A 8, Virtual Machine Manager server be the information such as h.323-configured gateway, mask and IP address on virtual machine network interface card, and a VLAN who successively a network interface card of virtual machine is linked in the VLAN numbered list with user-specified network region numbers in consistent virtual switch port set, then start the virtual machine process that creates, beginning creates virtual machine on selected physical host, after creating virtual machine success, in the computing pool of the security domain under virtual machine, increase described virtual machine information, to computational resource server, return to establishment successful result simultaneously;
Steps A 9, computational resource server are updated to virtual machine state ready, and the virtual machine of notifying user to be created by the IP address access in virtual machine creating response message.
In Fig. 6 steps A 4, in described network area, create VLAN numbering and the IP address of a new vlan network, also selected described new vlan network, further include:
A selected available VLAN numbering from the VLAN pond of described network area, then according to the network size that will create, in the IP pond of described network area, mark off an IP subnet section, on fire compartment wall, configure again gateway and the mask of VLAN, thereby create out one and have the vlan network that is not less than required IP address space, last from the IP subnet section marking off a selected idle IP address, preserve the network area of vlan network of described new establishment and selected VLAN numbering and IP address.
The foregoing is only preferred embodiment of the present invention, in order to limit the present invention, within the spirit and principles in the present invention not all, any modification of making, be equal to replacement, improvement etc., within all should being included in the scope of protection of the invention.