JP2005217715A - Layer 2 switch having vlan inter segment transfer function - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To reduce the traffic of VLAN inter segment communications between a layer 2 switch having a VLAN inter segment transfer function and a router, to reduce the process load of the router and to simply and quickly transfer packets between the VLAN segments. <P>SOLUTION: A host terminal 101 sends an address solution request packet or neighbor search request packets Q(1), Q(2) to a host terminal 103, and the host terminal 103 sends response packets R(3), R(4) to the host terminal 101. The lower 2 switch 200 snoops the packets Q(1), Q(2), R(3), R(4) to learn the correspondence of IP addresses or MAC addresses of the host terminals to ports, and thereafter directly transfers packets between the segments in the same layer 2 switch 200 across the VLAN segments in the layer 2 switch 200, based on the learning result. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention relates to a layer 2 switch having a VLAN (Virtual Local Area Network) inter-segment transfer function, and is a structural unit of a VLAN that is logically divided independently of a physical LAN (Local Area Network) configuration. The present invention relates to a layer 2 switch that allows packets to be directly transferred between segments via a layer 2 switch.

  Conventionally, VLANs are divided into switch segments in order to protect the security of each user under the control of the VLAN, and packet transfer between segments of different VLANs can be performed even between VLANs in the same subnet. In a layer 2 switch, packet transfer is not performed directly across different segments.

  FIG. 13 shows a conventional packet transfer between VLAN segments. In the figure, 101 to 103 are host terminals (Host A to Host N) connected to different VLANs, 200 is a layer 2 switch, 300 is a router, 400 is the same subnet, 501 to 503 are different VLAN segments, P ( 1) to P (4) are transfer packets.

  As illustrated in FIG. 13, when a packet is transmitted from the host terminal (Host A) 101 to the host terminal (Host N) 103 in a different VLAN segment, the layer 2 switch 200 receives the packet P (received from the host terminal (Host A) 101. 1) is transmitted to the router 300, and the router 300 determines the transmission destination of the packet P (2) received from the layer 2 switch 200 based on the layer 3 destination address of the packet and transmits the packet P (2) to the layer 2 switch 200. The layer 2 switch 200 sends the packet P (3) received from the router 300 to the output port corresponding to the layer 2 address, and the packet P (4) is transmitted from the output port to the host terminal (HostN) 103. .

  Thus, packet transmissions addressed to the host terminal (HostN) 103 of different VLAN segments from the host terminal (HostA) 101 are transferred via the upper router 300 and are connected to the same layer 2 switch 200. Even in the packet transmission between (Host A) 101 and (Host N) 103, useless traffic to the router 300 flows through the router 300.

As a prior art document related to the present invention, in Patent Document 1 below, a group is configured by ports communicating with the same protocol, and a plurality of virtual LANs configured to communicate between ports in the group are provided. A LAN system is described.
Japanese Patent No. 3001440

  In conventional inter-segment communication, since all packets are transferred via the router 300, the line between the uplink port of the layer 2 switch 200 and the router 300 becomes a bottleneck. The processing load of the router 300 is increased. Note that layer 3 switch devices capable of communication between VLANs are generally not widely used because they are expensive, and there is a demand for realizing an inter-VLAN communication function with an inexpensive layer 2 switch.

  The present invention reduces unnecessary traffic between an uplink port of a layer 2 switch that divides a segment and the router, and as a result, reduces the processing load on the router due to a decrease in traffic transferred to the router. It is an object of the present invention to provide a layer 2 switch that can easily and quickly perform inter-segment transfer.

  The layer 2 switch having the inter-VLAN segment transfer function according to the present invention includes: (1) a layer 2 switch that accommodates host terminals belonging to different segments divided by a VLAN under a router; Means for snooping the address resolution request packet or neighbor search request packet or its response packet, and means for learning the correspondence between the IP address or MAC address of the host terminal and the port by the snooping and storing the learning result And a means for directly transferring a packet transferred between different segments across the segments in the layer 2 switch based on the learning result without using an upper router.

  Further, (2) the address resolution request packet or the neighbor search request packet including the IP address or MAC address for which correspondence between the IP address or MAC address of the host terminal and the port has not yet been performed, or a response packet thereof, In the layer 2 switch, a means for directly transferring to all the segments is provided.

  Also, (3) snooping the input packet, and based on the learning result IP address or MAC address, the VLAN is newly reassigned in the layer 2 switch using the IP address, MAC address or port number as a policy. Means are provided.

  (4) When it is recognized that the packet is an address resolution request packet or a neighbor search request packet by snooping the packet, the VLAN segment of the host terminal that is the source of the packet and the address resolution or neighbor search Means for newly reallocating the VLAN so that the VLAN segment of the target host terminal becomes the same segment.

  In addition, (5) the inter-LAN segment transfer described in (1) or (2) above, or the new VLAN reassignment described in (3) or (4) is lost in the inter-VLAN segment communication transfer packet. And a means for returning to the initial segment division state by detecting a time-out for a predetermined elapsed time.

  As described above, according to the present invention, in communication between host terminals under a layer 2 switch that divides a segment, a transfer packet between segments is stored in the layer 2 switch based on a learning result by snooping in the layer 2 switch. By directly transferring data between segments, it is possible to reduce useless traffic between the layer 2 switch and its upper router without using an expensive layer 3 switch, and to reduce traffic to the router. Thus, the processing load on the router can be reduced.

  In addition, by newly reassigning VLANs to the segments with high frequency of inter-VLAN segment communication under the layer 2 switch, the VLAN can be easily passed through the layer 2 switch while ensuring the security of each VLAN. Direct communication between segments can be performed.

  In addition, the inter-LAN segment transfer or new VLAN reassignment is terminated by detecting a timeout for a predetermined elapsed time from the end of the inter-VLAN segment communication, and is returned to the initial segment division state. Security can be maintained in its original state.

  FIG. 1 shows a first embodiment of packet transfer between VLAN segments according to the present invention. In the figure, 101 to 103 are host terminals (Host A to Host N) connected to different VLANs, 200 is a layer 2 switch, 300 is a router, 400 is the same subnet, 501 to 503 are different VLAN segments, Q ( 1) and Q (2) are address resolution request packets (ARP) or neighbor discovery request packets (NDP), R (3) and R (4) are response packets, and D (5) It is a communication data packet. In the following drawings, Q represents an address resolution or neighbor search request packet, R represents a response packet thereof, D represents a communication data packet, and the number in parentheses immediately after them represents the transmission order.

  As shown in FIG. 1, the host terminal (Host A) 101 transmits address resolution request packets and neighbor search request packets Q (1) and Q (2) to the host terminal (Host N) 103, and the response packet R (3) and R (4) are transmitted from the host terminal (HostN) 103 to the host terminal (HostA) 101.

  The layer 2 switch 200 performs snooping of the type field of the Ethernet (registered trademark) frame of the address resolution request packet and the neighbor search request packets Q (1) and Q (2) and the response packets R (3) and R (4). By performing (spotting), the packet is identified as an address resolution request packet or a neighbor search request packet and its response packet.

  Then, the correspondence between the IP address and the MAC address (physical address of each port) is learned by snooping the address resolution request packet or the neighbor search request packet and the response packet, and the destination IP address obtained by the learning and its address Based on the correspondence information with the port, subsequent communication data packets between segments in the same layer 2 switch 200 are directly transferred across the segments in the layer 2 switch 200.

  Next, a second embodiment of packet transfer between VLAN segments according to the present invention will be described with reference to FIG. In the second embodiment of the present invention, in the inter-VLAN segment communication by snooping in the first embodiment, the router 300 returns an address resolution or neighbor search packet response packet as a proxy for the host terminal. In the figure, the same elements as those in the first embodiment are denoted by the same reference numerals, and redundant description is omitted. Here, the IP addresses of the host terminal (Host A) 101, the host terminal (Host B) 102, and the host terminal (Host N) 103 are A, B, and N, respectively, and the MAC addresses are a, b, and n, respectively. . The same applies to the following embodiments.

  In FIG. 2, when an address resolution request packet or a neighbor search request packet Q (1) is transmitted from the host terminal (Host A) 101 to the host terminal (Host N) 103, the router 300 transmits the address resolution request packet or neighbor search request. A packet Q (2) is received, a response packet R (3) notifying the MAC address n of the host terminal (HostN) 103 on behalf of the host terminal (HostN) 103 by referring to the ARP table (Table 1) in the router 300 ).

  Based on the correspondence information between the IP address obtained by snooping these packets and the port, the layer 2 switch 200 transmits the communication data packet D (5) between segments in the same layer 2 switch 200 thereafter. The data is directly transferred across the segments in the layer 2 switch 200.

  Next, a third embodiment of packet transfer between VLAN segments according to the present invention will be described with reference to FIG. The third embodiment of the present invention is an embodiment in which a packet for address resolution or neighbor search is directly transferred to all segments by the layer 2 switch 200 in the VLAN inter-segment communication by the snooping described above. In the figure, the same elements as those of the above-described embodiment are denoted by the same reference numerals, and redundant description is omitted.

  As shown in FIG. 3, when the address resolution or neighbor search request packet Q (1) is transmitted from the host terminal (Host A) 101, the layer 2 switch 200 transmits the address resolution or neighbor search request packet Q (1). By performing snooping, the layer 2 switch 200 identifies the packet Q (1) as an address resolution or neighbor discovery request packet, and transmits the address resolution or neighbor discovery packet Q (2) across all segments. Transfer to segment.

  Next, a fourth embodiment of packet transfer between VLAN segments according to the present invention will be described with reference to FIG. In the fourth embodiment of the present invention, in the inter-VLAN segment communication by snooping in the third embodiment, the correspondence between the IP address and the port is learned in the layer 2 switch 200, and the learning table is referred to, In this embodiment, the address resolution or neighbor search packet is transferred only to the segment of the destination IP address. In the figure, the same elements as those in the third embodiment are denoted by the same reference numerals, and redundant description is omitted.

  As shown in Table 2 of FIG. 4, the layer 2 switch 200 learns the correspondence between the IP address of each host terminal (Host A, Host B,... Host N) connected to the port and the port number. An IP address learning table storing the learning result is provided in the layer 2 switch 200, and for example, an address resolution or neighbor search request packet Q (1) targeting the IP address N is transmitted from the host terminal (Host A) 101. Then, the layer 2 switch 200 performs snooping of the packet Q (1) to identify the packet Q (1) as an address resolution or neighbor search request packet, and the correspondence between the IP address N and the port number PortN Port number to which the terminal with IP address N is connected Transferring Miko packets ortN into segments.

  Next, a fifth embodiment of packet transfer between VLAN segments according to the present invention will be described with reference to FIG. In the fifth embodiment, in VLAN segment communication by snooping in the fourth embodiment, an address resolution or neighbor search request packet for an IP address not stored in the IP address learning table is transferred to all segments. Then, the IP address is learned from the response packet, and the subsequent address resolution or neighbor search packet is transferred only to the target segment by referring to the IP address learning table. In the figure, the same elements as those in the fourth embodiment are denoted by the same reference numerals, and redundant description is omitted.

  First, in the layer 2 switch 200, for an IP address that has not yet been learned in association with an IP address and a port number of a port to which the terminal of the IP address is connected, for example, as shown in FIG. When the address resolution or neighbor search request packet Q (1) for the IP address N is transmitted from the (Host A) 101, the layer 2 switch 200 performs an address resolution or neighbor search request by snooping the packet Q (1). When the packet is identified and it is recognized that the IP address N is not yet stored in the IP address learning table, the packet Q (2) is distributed directly to all segments in the layer 2 switch 200.

  The host terminal (HostN) 103 with the IP address N transmits a response packet R (3) to the address resolution or neighbor search request packet Q (2). The response packet R (4) of the destination IP address A from the host terminal (HostN) 103 is distributed only to the segment of the port Port1 to which the host terminal (HostA) 101 is connected with reference to the already learned table. To do.

  The layer 2 switch 200 learns the association between the IP address N and the PortN of the host terminal (HostN) 103 by snooping the packet, and stores the learning result in the IP address learning table of Table 3. Then, based on the IP address learning table, the communication data packet D (5) between the segments in the same layer 2 switch 200 is directly transferred across the segments in the layer 2 switch 200.

  Next, a sixth embodiment of packet transfer between VLAN segments according to the present invention will be described with reference to FIG. In the sixth embodiment, in the inter-VLAN segment communication by snooping in the third embodiment, the address resolution or neighbor search request packet and its response packet are transferred to all segments, and the source and destination of those packets are transmitted. The correspondence between the MAC address and the port number is learned based on the MAC address, and then the address resolution or neighbor search packet and the communication data packet are transferred only to the target segment based on the learning result. In the figure, the same elements as those of the above-described embodiment are denoted by the same reference numerals, and redundant description is omitted.

  Here, it is assumed that the correspondence between the MAC address and the port number is not learned in the layer 2 switch 200, and as shown in FIG. 6, address resolution or neighbor search for the IP address N from the host terminal (Host A) 101 is performed. When the request packet Q (1) is transmitted, the layer 2 switch 200 performs its snooping, identifies that the packet Q (1) is an address resolution or neighbor discovery request packet, and transmits the packet Q (1). Transfer to all segments.

  By identifying that the address resolution or neighbor search request Q (1) packet is transmitted as the source MAC address a from the host terminal (Host A) 101 of the port number Port1, the correspondence between the MAC address a and Port1 is learned. , And stored in the MAC address learning table of Table 4.

  The correspondence between the MAC address n and Port N is learned by identifying that the response packet to the address resolution or neighbor search request packet is transmitted from the host terminal (Host N) 103 of the port number Port N as the source MAC address n. , And stored in the MAC address learning table of Table 4.

  Subsequent address resolution or neighbor search packets, communication data packets D (5), etc. are referred to the MAC address learning table in Table 4 to cross-segment the host terminal (Host A) 101 within the layer 2 switch 200. And the host terminal (HostN) 103.

  Next, FIG. 7 shows a configuration example of the layer 2 switch 200 according to the present invention. In the figure, 201 is a switching unit, 202 is a CPU unit, 203 is a VLAN processing unit, and 204 is an external interface. The CPU unit 202 divides the VLAN segment by software control. By snooping the address resolution request packet or the neighbor search request packet and its response packet and referring to the IP address learning table or the MAC address learning table, the CPU unit 202 changes the packet input from the external interface 204 to the VLAN to which it originally belongs. The switching unit 201 is controlled so as to transfer across the segment, and in the layer 2 switch 200, the packet belonging to each VLAN segment is directly transferred between the VLAN segments beyond the VLAN segment.

  Next, an embodiment in which a new VLAN is reassigned by snooping in the inter-VLAN segment communication according to the present invention will be described with reference to FIG. FIG. 8 shows a device configuration of the layer 2 switch 200 of this embodiment. In the figure, 201 is a switching unit, 204 is an external interface, 205 is a snooping unit, 206 is a VLAN policy confirmation unit, and 207 is a VLAN ID assignment unit.

  In FIG. 8, when a packet input from the external interface 204 is snooping by the snooping unit 205 and the packet is a packet for address resolution or neighbor search, the VLAN ID bypassing the VLAN policy confirmation unit 206 of the original transfer process is bypassed. The packet is sent to the assigning unit 207, and the VLAN ID assigning unit 207 assigns the IP address or MAC address and port to the VLAN re-reception based on the MAC address or IP address obtained by snooping and the learning table corresponding to them. It is used as an allocation policy, and a new VLAN is reassigned, and a packet is transferred beyond the original VLAN.

  When the VLAN reassignment policy described above recognizes that the packet is an address resolution request or neighbor search request packet by packet snooping, the VLAN segment of the source host terminal and the address resolution or neighbor search target VLAN reassignment is performed so that the VLAN segment of the host terminal is the same segment.

  VLAN reassignment, for example, changes a segment that has been divided into floor units or layout units within a floor to a segment that corresponds to a new organization or arrangement when there is an organizational change or arrangement change in an office or the like. In this case, by performing VLAN reassignment corresponding to the new segment, it becomes possible to easily perform communication between VLAN segments in the layer 2 switch.

  Next, an embodiment of the present invention in which the router changes the VLAN range of the layer 2 switch by UPnP (Universal Plug and Play) will be described with reference to FIG. In the figure, the same elements as those of the above-described embodiments of FIGS. 1 to 6 are denoted by the same reference numerals, and redundant description is omitted. In FIG. 9, U (1) is a UPnP control packet. When there is a segment divided by VLAN under the router 300, the upper router 300 controls the layer 2 switch 200 by the UPnP control packet to the layer 2 switch 200, and reassigns the VLAN.

  Next, an embodiment for controlling the VLAN range of the layer 2 switch with the UPnP control packet when the router receives the address resolution request packet or the neighbor search request packet in the inter-segment communication according to the present invention will be described with reference to FIG. To do. In the figure, the same elements as those in the embodiment of FIG. In FIG. 10, Q (1) and Q (2) are address resolution request packets, R (3) and R (4) are response packets, U (5) and U (6) are UPnP packets, and D (7) Is a communication data packet.

  First, as in the embodiment of FIG. 2, an address resolution or neighbor search request packet Q (1) is transmitted from the host terminal (HostA) 101, and a response packet R (3) is transmitted from the router 300. Address resolution is performed. When the router 300 receives the address resolution or neighbor search request packet Q (2), the VLAN segment of the source host terminal (Host A) 101 and the VLAN segment of the host terminal (Host N) 103 that is the target of address resolution Are sent to the same segment from the router 300 to the layer 2 switch 200. As a result, the subsequent communication data packet D (7) is directly transferred by the layer 2 switch 200 as a packet transfer within the same segment without passing through the router 300.

  Next, termination of inter-segment communication according to the present invention will be described with reference to FIG. As shown in the flowchart, the layer 2 switch identifies an input packet (step S1), receives an address resolution or neighbor search request packet (ARP, NDP) (step S2), or receives a UPnp control packet (step S3). Then, based on these, inter-segment transfer or VLAN segment reassignment is performed as described above, and inter-segment communication is performed in which packet transfer is performed across the segments (step S4).

  After that, when there is no inter-segment communication transfer packet and the inter-segment communication is completed, a predetermined time from the end of the communication is monitored by a timer, and when the timeout is detected (step S5), the above-described step S4 The inter-segment communication or segment reassignment is terminated, and the initial segment division state that was initially divided is restored (step S0). By doing so, security between segments by VLAN division can be maintained in the original state.

  FIG. 12 shows an example of a network configuration using the present invention. In the figure, 600 is an Internet communication network, 301 is a router of the first Internet service provider ISP1, 302 is a router of the second Internet service provider ISP2, 200 is a layer 2 switch divided by VLAN, 101, 102, 103 Is the host terminal.

  In the layer 2 switch 200, when the host terminals 101, 102, and 103 are divided by VLAN, when communication is performed between the host terminals 101, 102, and 103 under the layer 2 switch 200, the layer 2 switch 200 of the present invention. By using this, it is possible to perform inter-VLAN communication directly via the layer 2 switch 200 without connecting to the router 301 or 302 of the Internet service provider ISP1 or ISP2, that is, without going through the Internet communication network 600. .

  In this way, when each host terminal belongs to a different Internet service provider, each host terminal is an Internet service provider (ISP) BRAS (Broadband Remote Access Server: authentication of each user, billing, ISP distribution, etc. And direct communication via the layer 2 switch without communication via the Internet communication network which is the best effort. These are particularly effective when performing large-capacity data communication between host terminals under the layer 2 switch.

  Also, by using the layer 2 switch 200 of the present invention in offices, campuses, hospitals, etc. where there is much communication between VLANs under the layer 2 switch 200, it is possible to easily switch the layer 2 switch 200 switch while ensuring security in each VLAN. Can communicate directly.

It is a figure which shows 1st Embodiment of the packet transfer between VLAN segments by this invention. It is a figure which shows 2nd Embodiment of the packet transfer between VLAN segments by this invention. It is a figure which shows 3rd Embodiment of the packet transfer between VLAN segments by this invention. It is a figure which shows 4th Embodiment of the packet transfer between VLAN segments by this invention. It is a figure which shows 5th Embodiment of the packet transfer between VLAN segments by this invention. It is a figure which shows 6th Embodiment of the packet transfer between VLAN segments by this invention. It is a figure which shows the structural example of the layer 2 switch 200 by this invention. FIG. 6 is a diagram illustrating an embodiment for performing reallocation of a new V VLAN according to the present invention. It is a figure which shows embodiment of this invention which changes the VLAN range of a layer 2 switch by UPnP. It is a figure which shows embodiment of this invention which controls the VLAN range of a layer 2 switch with a UPnP control packet at the time of reception of an address resolution request packet or a neighbor search request packet. It is explanatory drawing about completion | finish of the communication between segments by this invention. It is a figure which shows an example of the network structure using this invention. It is a figure which shows the packet transfer between the conventional VLAN segments.

Explanation of symbols

101-103 Each host terminal connected to a different VLAN 200 Layer 2 switch 300 Router 400 Same subnet 501-503 Each VLAN segment Q (1), Q (2) Address resolution or neighbor search request packet R (3), R ( 4) Address resolution or neighbor search response packet D (5) Communication data packet

Claims (5)

In a layer 2 switch that accommodates host terminals belonging to different segments divided by VLAN under the router,
Means for snooping an address resolution request packet or a neighbor search request packet addressed to or sent from the host terminal or a response packet thereof;
Means for learning the correspondence between the IP address or MAC address of the host terminal and the port by the snooping, and storing the learning result;
Means for directly transferring packets transferred between different segments across the segments within the layer 2 switch based on the learning result without using an upper router, between VLAN segments Layer 2 switch with forwarding function.   In the layer 2 switch, the address resolution request packet or the neighbor search request packet including the IP address or MAC address for which the correspondence between the IP address or MAC address of the host terminal and the port has not yet been learned or the response packet thereof is included in the layer 2 switch. 2. The layer 2 switch having a VLAN inter-segment transfer function according to claim 1, further comprising means for directly transferring to all the segments.   A means for snooping an input packet and newly reassigning a VLAN in a layer 2 switch based on the IP address or MAC address of the learning result, using the IP address, MAC address or port number as a policy; The layer 2 switch having a VLAN inter-segment transfer function according to claim 1 or 2.   When it is recognized that the packet is an address resolution request packet or a neighbor search request packet by snooping the packet, the VLAN segment of the host terminal that is the source of the packet and the host terminal that is the target of the address resolution or neighbor search 4. The layer 2 switch having a VLAN inter-segment transfer function according to claim 3, further comprising means for newly reassigning a VLAN so that the VLAN segment becomes the same segment.   The inter-LAN segment transfer according to claim 1 or 2 or the new VLAN reassignment according to claim 3 or 4 is terminated by detecting a time-out at a predetermined elapsed time after the transfer packet for inter-VLAN segment communication is lost. And a layer 2 switch having a VLAN inter-segment transfer function, comprising means for returning to the initial segment division state.

Images