JP2012231382A - Virtual routing method in virtual environment and virtual routing system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To perform packet transfer without via any excessive route even under the environment where a network configuration is varied in a fluid manner.SOLUTION: A plurality of virtual machine monitors comprise virtual router IP addresses which are different from each other for each segment and further comprises a first routing table in which virtual machine IP addresses of virtual machines to operate on the plurality of virtual machine monitors and virtual router IP addresses are made correspondent. When transmitting a packet, by referring to the first routing table, a destination virtual router IP address of the packet to be transmitted is identified and it is discriminated whether or not the identified destination virtual router IP address is identical to that of the virtual machine monitor per se. If identical to that of the virtual machine per se as a result of the discrimination, a destination MAC address is translated into a MAC address of the destination virtual machine. If not identical to that of the virtual machine per se as a result of the discrimination, the destination MAC address is translated into a MAC address of the destination virtual router and the packet after the translation is transmitted.

Description

  The present invention relates to routing processing between virtual machines.

  A virtual machine monitor is known as a program for controlling a plurality of operating systems (OS) on a single computer. In particular, Xen (trademark) developed at the University of Cambridge, UK, VMware (trademark) manufactured and sold by VMware, etc. are widely known as virtual machine monitors.

  When these virtual machine monitors are used, one computer can control a plurality of different OSs, and different jobs can be processed in parallel on each OS. In other words, the virtual machine monitor executes a plurality of virtual machines, and each virtual machine can operate different OSs.

  In a virtual machine monitor environment, NW (Network) communication can also be performed between virtual machines with different segments. For example, when the technique described in Patent Document 1 is used, each of the transmission apparatuses that constitute the network is logically divided into a plurality of virtual transmission apparatuses, and each of the virtual transmission apparatuses is individually provided for routing. In a communication system configured to operate with software, it is possible to easily and effectively cope with a software failure.

JP 2009-253743 A

  As described above, it is possible to perform NW communication between virtual machines with different segments, but the above-described technology has the following problems.

  Specifically, when performing NW communication between virtual machines with different segments in a virtual machine monitor environment, packets are normally transferred via a physical router, so that an extra route is used. It is a problem. In addition, there is a problem that there is a possibility that a large delay may occur due to an increase in the traffic amount due to passing through an extra route.

  For example, in the configuration shown in FIG. 1, extra traffic is transferred at least between the layer 2 network 9 and the router 10.

  On the other hand, it is also conceivable to use a SW router on the guest OS installed on the virtual machine monitor. However, in this case, the NW configuration changes fluidly due to hot migration of the virtual machine. Therefore, there is a problem that extra traffic occurs depending on the NW configuration.

  For example, when the virtual machines 30 and 40 having different segments communicate with each other through the SW router 20 which is a virtual machine of the SW router in the configuration shown in FIG. 2, extra traffic is generated on the physical network.

  In such an environment in which the NW configuration changes in a fluid manner, a configuration that can always perform optimum routing processing cannot be built, and extra traffic is generated on the NW.

  Therefore, the present invention provides a virtual routing method and virtual routing system in a virtual environment that can perform packet transfer without going through an extra route even in an environment in which the NW configuration changes dynamically. With the goal.

  According to a first aspect of the present invention, in a communication system in which a plurality of virtual machine monitors are connected to each other, the plurality of virtual machine monitors include virtual router IP addresses different from each other for each segment, The virtual machine monitor includes a first routing table in which a virtual machine IP address of a virtual machine operating on the plurality of virtual machine monitors is associated with the virtual router IP address, and a second routing table indicating the affiliation of the VLAN The plurality of virtual machine monitors identify a destination virtual router IP address of the packet to be transmitted by referring to the first routing table when transmitting the packet, and the identified destination Determine whether the virtual router IP address is the same as the own virtual machine monitor, and If the result is the same as the own virtual machine, the destination MAC address is converted to the destination virtual machine's MAC address. If the result of the determination is not the same as the own virtual machine, the destination MAC address is changed to the destination virtual router's MAC address. There is provided a communication system characterized by converting and transmitting the converted packet.

  According to the second aspect of the present invention, in a routing method performed by a system in which a plurality of virtual machine monitors are connected to each other, the virtual machine monitors are provided with different virtual router IP addresses for each segment. A plurality of virtual machine monitors, a first routing table in which a virtual machine IP address of a virtual machine operating on the plurality of virtual machine monitors is associated with the virtual router IP address, and a VLAN belonging A second routing table, and the plurality of virtual machine monitors refer to the first routing table when transmitting the packet, and the destination virtual router of the packet to be transmitted Identifies the IP address and identifies the identified destination virtual router IP address It is determined whether or not it is the same as the own virtual machine monitor. If the result of the determination is the same as the own virtual machine, the destination MAC address is converted to the MAC address of the destination virtual machine, and the result of the determination is the same as the own virtual machine If not, a routing method is provided that converts the destination MAC address to the MAC address of the destination virtual router and transmits the converted packet.

  According to the present invention, since a virtual router function can be realized, it is possible to perform packet transfer without going through an extra route even in an environment where the NW configuration changes dynamically.

It is a block diagram (1/2) for demonstrating the problem which background art has. It is a block diagram (2/2) for demonstrating the problem which background art has. It is a block diagram showing the basic composition of the embodiment of the present invention. It is a block diagram showing the virtual machine monitor of embodiment of this invention. It is a figure showing about the affiliation of VLAN of embodiment of this invention. It is a flowchart showing about the migration of embodiment of this invention. It is a sequence diagram showing about migration of an embodiment of the present invention. It is a figure represented about the routing table of embodiment of this invention. It is a flowchart showing transmission of the packet of embodiment of this invention. It is a flowchart showing reception of the packet of embodiment of this invention. It is a block diagram showing about the structure after the migration of embodiment of this invention.

  First, an outline of an embodiment of the present invention will be described. The embodiment of the present invention generally includes a routing processing unit having a limited function to operate in a virtual machine monitor environment such as VMware, a mechanism for changing a default GW of a guest OS linked with hot migration of a virtual machine, Virtual router function that executes only routing processing between virtual machines in the hypervisor, realized by combining manual and batch routing table update method without using routing protocol and special packet transmission / reception processing function It will be realized.

  Next, embodiments of the present invention will be described in detail with reference to the drawings.

  This time, the process will be described assuming that there are two virtual machine monitors. In the specification and drawings, a virtual machine (VM) is expressed as “VM”. A gateway (GW) is denoted as “GW”.

  Referring to FIG. 3, the present embodiment includes a virtual machine monitor 110, a virtual machine monitor 120, a management server 300, a switch 400, a router 500, and an external network 600.

  Also, virtual machine monitor management agents 111 and 121 are installed in the virtual machine monitor 110 and the virtual machine monitor 120, respectively. Furthermore, VMs 210 to 230 are operating on the virtual machine monitor 110 and the virtual machine monitor 120. Further, a VM management agent (not shown) is installed in each of the VMs 210 to 230.

  Note that the configuration shown in FIG. 3 is merely an example, and the number of virtual machine monitors and VMs can be arbitrarily implemented. That is, in the present embodiment, the same technique can be applied even if the number of virtual machine monitors is further increased.

  First, management performed by the management server 300 will be described.

  The virtual machine monitor 110 and the virtual machine monitor 120 are managed by the management server 300. Then, under the management of the management server 300, the VMs 210 to 230 can be migrated to an arbitrary virtual machine monitor by hot migration of the virtual machine.

  Also, the management server 300 is in a state where the latest IP addresses of the VMs 210 to 230 can always be grasped via the virtual machine monitoring management agents 111 and 121.

  The VM management agent installed in the VMs 210 to 230 provides an interface that can remotely execute a series of processing units for changing the default GW of the guest OS. The management server 300 is a management agent for virtual machine monitoring It is assumed that this interface can be accessed via 111 and 121 and the default GW of the VMs 210 to 230 can be changed.

  Further, the management server 300 has a certificate 301. By using the certificate 301, it is assumed that the communication between the virtual machine monitoring management agents 111 and 121 and the management server 300 is performed without risk of impersonation or tampering.

  Next, each virtual machine monitor will be described with reference to FIG. In FIG. 4, the virtual machine monitor 110 is described as an example, but the virtual machine monitor 120 is assumed to have the same configuration.

  The virtual machine monitor 110 includes a routing processing unit 113, an external packet transmission queue 114, and an internal packet transmission queue 115 in the hypervisor 112.

  The routing processing unit 113 operates as a virtual router and has one IP address for each segment. This IP address is referred to as a “virtual router IP address”. It is assumed that the virtual router IP address does not overlap with other virtual machine monitors.

  Further, after the routing process, the packet is stored in one of the external packet transmission queue 114 and the internal packet transmission queue 115. The packets stored in the external packet transmission queue 114 are transmitted to the external network via the NIC 116 which is a physical NIC (Network Interface Card). On the other hand, the packet stored in the internal packet transmission queue 115 is transmitted to the virtual machine operating on the virtual machine monitor.

  Next, VLAN affiliation will be described with reference to FIG. In this description, it is assumed that the VMs 210 to 230, the virtual machine monitoring management agents 111 and 121, and the management server 300 belong to the VLAN shown in FIG. In the switch 400, it is assumed that VLANs that may be used by the virtual machine monitors 110 and 120 and the management server 300 are appropriately set in all ports.

  Next, the operation of this embodiment shown in FIG. 3 will be described.

  This time, processing in two cases, that is, a case where the VM 210 communicates with the external network 600 and a case where the VM 210 communicates with a VM 220 having different segments will be described.

  When the VM 210 communicates with the external network 600, first, a destination MAC address is set in the router 500 (a specific setting method will be described later with reference to FIG. 9). Next, the transmission packet is stored 113 in the external transmission packet queue. Thereafter, the packet is transmitted to the router 500. Further, when a packet is transmitted from the router 500 to the VM 210, the virtual machine monitor 110 performs a packet reception process (a specific reception operation will be described later with reference to FIG. 10), but a routing process. Is not performed, and the packet is transmitted to the VM 210 as it is. Therefore, the router 500 can perform normal routing processing without being aware of the existence of the routing processing unit 113 operating on the virtual machine monitor 110.

  On the other hand, when the VM 210 communicates with the VM 220 having a different segment, the destination MAC address is set to the MAC address of the VM 220 (a specific setting method will be described later with reference to FIG. 9). Next, the transmission packet is stored in the internal transmission packet queue 114. Thereafter, the packet is transmitted to the VM 220. In this case, no packet is transmitted outside the virtual machine, and routing processing can be performed without generating extra traffic.

  Next, the operation at the time of executing hot migration will be described with reference to the flowchart of FIG. In this example, it is assumed that the VM 210 starts the migration process from the virtual machine monitor 110 to the virtual machine monitor 120.

  First, virtual machine hot migration execution processing will be described. In the hot migration execution process, in response to an execution command from the management server 300, the VM 210 starts a migration process to the virtual machine monitor 120, which is another virtual machine monitor (step S11).

  When the virtual machine hot migration execution process in step S11 is completed, the VM 210 starts an operation on the virtual machine monitor 120 (step S12).

  Next, the virtual NIC suspend process of the VM 210 is performed (step S13). After the suspend process, communication with the external network is blocked. As a result, the VM 210 cannot perform any packet transmission / reception.

  Subsequently, the default GW of the VM 210 is changed from the virtual router IP address of the virtual machine monitor 110 to the virtual router IP address of the virtual machine monitor 120 (step S14). The default GW is changed by kicking a series of processing units stored in advance on the VM 210 from the management server 300. The remote execution of the series of processing units is executed along the flow of the sequence diagram of FIG. Here, the details of step S14 will be described with reference to FIG.

  First, the management server 300 searches the database 302 and tries to acquire the IP address of the virtual router of the migration destination virtual machine monitor (step S14-1). The database 302 may be incorporated in the management server 300, but the database 302 is realized by a device separate from the management server 300, and the realized database 302 and the management server 300 are connected to each other. May be.

  When the management server 300 acquires the IP address of the virtual router of the migration destination virtual machine monitor from the database 302 (step S14-2), the management server 300 transmits the acquired IP address to the virtual machine monitor management agent 111 and issues a default GW change command. (Step S14-3).

  The virtual machine monitor management agent 111 issues a command to change the default GW to the VM management agent 211 of the VM 210 (step S14-4).

  Then, the VM management agent 211 changes the default GW in response to the change command, and notifies the virtual machine monitor management agent 111 that the change has been completed (step S14-5).

  Finally, the virtual machine monitoring management agent 111 transmits a change completion notification to the management server 300, and step S14 ends (step S14-6).

  Next, the routing table of each virtual machine monitor and the database update process of the management server are performed (step S15). As shown in FIG. 8, the routing table of each virtual machine monitor and the management server database include the IP address of each VM managed by the management server 300 and the virtual machine monitor (virtual router IP address) on which each VM operates. Stored in association.

  In this step S15, the information of the virtual machine monitor (virtual router IP address) on which the VM 210 migrated by the virtual machine hot migration operates is rewritten from the migration source virtual machine monitor 110 to the migration destination virtual machine monitor 120.

  In the present embodiment, a routing table and database update process is executed from the management server 300. The update process is performed manually (static). The VM can be migrated to an arbitrary virtual machine monitor by hot migration of the virtual machine, and the IP address may be discontinuous. Therefore, manual (static) update processing is performed without using a routing protocol such as RIP (Routing Information Protocol) or OSPF (Open Shortest Path First). In addition, since the command is executed by the management server 300, the routing table of each virtual machine monitor can be updated in a batch. Further, in this environment, it is not necessary to consider a metric value or an administrative distance value, and only limited information may be stored as shown in FIG.

  In step S16, the virtual NIC resume processing of the VM 210 is performed. In the present embodiment, illegal packet transmission / reception before step S14 and step S15 is completed is prevented by the suspend / resume process of steps S13 and S16.

  When the resume process ends, the VM 210 resumes the network communication process (step S17).

  After the hot migration of the VM 210 is completed, the configuration is as shown in FIG. In FIG. 11, when the VM 210 communicates with an external network, the router 500 performs normal routing processing without being aware of the presence of the routing processing unit 124 operating on the virtual machine monitor 120, as described above. To be implemented.

  On the other hand, when the VM 210 communicates with the VM 220 having a different segment, the destination MAC address is set to the MAC address of the virtual machine monitor 110 and the transmission packet is stored in the external transmission packet queue 115 according to the flowchart shown in FIG. Thereafter, the packet is transmitted to the virtual machine monitor 110. The virtual machine monitor 110 performs packet reception processing according to the flowchart shown in FIG. 10 and changes the destination MAC address to the destination MAC address of the VM 220. Thereafter, the packet is transmitted to the VM 220. Therefore, when the VM 210 communicates with the VM 220 having a different segment, the communication is performed without going through the router 500, so that the routing process can be performed without generating extra traffic.

  Hereinafter, the operation of the routing processing unit 113 during packet transmission / reception will be described in detail.

  FIG. 9 is a flowchart showing an operation at the time of packet transmission from the guest OS (packet transmission outside the virtual machine monitor).

  First, packet transmission from the guest OS is performed (step S21).

  Subsequently, it is identified whether or not the destination IP address of the packet transmitted by the guest OS is the same segment (step S22).

  Here, if they are the same segment (Yes in step S22), the process proceeds to step S28, and a normal packet transmission process in layer 2 is performed.

  On the other hand, if it is determined in step S22 that the segments are not the same (No in step S22), the process proceeds to step S23. And the routing process by the routing process part 113 shown by step S23-7 is implemented.

  Specifically, in step S23, the packet is transmitted to the virtual router that is the default GW (step S23).

  Next, the virtual router in which the destination IP address is registered is identified by referring to the routing table (step S24).

  Then, it is determined whether the virtual router IP address is the same as that of the own virtual machine monitor (step S25). If they are not the same (No in step S25), the process proceeds to step S26, and if they are the same (Yes in step S25), the process proceeds to step S27.

  In step S26, by converting the destination MAC address of the packet header into the MAC address of the identified destination virtual router, packet transmission processing can be immediately performed. In other words, the arp packet enables processing without waiting for the destination MAC address acquisition time.

  In step S27, the packet transmission process can be immediately performed by converting the destination MAC address of the packet header into the MAC address of the destination virtual machine. In other words, the arp packet enables processing without waiting for the destination MAC address acquisition time.

  Thereafter, the packet is stored in the transmission queue (step S28), and hypervisor packet transmission processing is performed (step S29).

  FIG. 10 is a flowchart showing an operation when the virtual machine monitor receives a packet from the outside.

  First, the virtual machine monitor receives a packet from the outside (step S31).

  Subsequently, packet header analysis processing is performed (step S32).

  If the destination IP address and the destination MAC address are not operating on the own virtual machine monitor in step S33 and step S34 (No in step S33 and step S34), the packet is discarded (step S35).

  On the other hand, if it is operating on the own virtual machine monitor (Yes in step S33 and step S34), it is identified whether the destination MAC address of the packet header is addressed to the own virtual router (step S36). .

  If it is addressed to the own virtual router (Yes in step S36), the routing processor 113 converts the destination MAC address into the MAC address of the destination VM (step S37). In S36, the process proceeds directly to Step S38 without going through the routing processing unit 113.

  In step S38, the hypervisor performs packet reception processing (packet transmission to the virtual machine). According to the flowchart shown in FIG. 10, processing can be reduced by discarding extra packets and performing the minimum necessary routing processing.

  The management server and the virtual machine monitor according to the embodiment of the present invention can be realized by hardware. However, the computer can record the program for causing the computer to function as the management server and the virtual machine monitor. It can also be realized by reading from the medium and executing it.

  In addition, the virtual routing method according to the embodiment of the present invention can be realized by hardware, but the computer can also read and execute a program for causing the computer to execute the method from a computer-readable recording medium. Can be realized.

  Moreover, although the above-described embodiment is a preferred embodiment of the present invention, the scope of the present invention is not limited only to the above-described embodiment, and various modifications are made without departing from the gist of the present invention. Implementation in the form is possible.

  Furthermore, in the above-described embodiment, the program for realizing the virtual machine monitor, the management agent, and the like has been described as being stored in the computer in advance. However, a program for operating the computer as all or part of the management server or the virtual machine monitor, or for executing the above-described processing is stored on a flexible disk, a CD-ROM (Compact Disc Read-Only Memory), a DVD ( Stored in a computer-readable recording medium such as Digital Versatile Disc (MO), Magneto Optical Disk (Disc) (BD), Blu-ray Disc (BD), etc., installed on another computer, and operates as the above-mentioned means Alternatively, the above-described steps may be executed.

  Furthermore, the program may be stored in a disk device or the like included in a server device on the Internet, and the program may be executed by, for example, superimposing the program on a carrier wave and downloading it to a computer.

  The embodiment of the present invention described above has many effects as described below.

  The first effect is that packet transfer is possible without going through an extra route. In addition, when performing communication beyond the physical router, the physical router can perform packet transfer processing without being aware of the existence of the virtual router.

  The reason is that a virtual router function is realized when communication is performed between virtual machines in different segments.

  The second effect is that routing processing is possible even in a configuration in which virtual machines on each virtual machine monitor have discontinuous IP addresses. Furthermore, it is possible to migrate to an arbitrary virtual machine monitor by hot migration of the virtual machine.

  The reason for this is that the routing table is updated collectively by the management server, and the updating method is carried out by static (manual) without using a routing protocol.

  The third effect is that, after execution of hot migration of a virtual machine, packet transmission is possible without waiting for the destination MAC address acquisition time by the arp packet.

  The reason is that when the virtual machine hot migration is executed, the default GW is changed, and the routing processing unit converts the destination MAC address part in the packet to the destination virtual router MAC address, so it is necessary to acquire the destination MAC address by the arp packet. Because there is no.

  The fourth effect is that no extra routing processing is performed.

  This is because a mechanism is implemented in which routing processing is not performed in the case of inter-segment communication when packet transmission / reception processing is performed. In addition, it is desirable from the viewpoint of security because it performs processing to drop unrelated packets.

  The fifth effect is that only simple information needs to be stored in the routing table.

  The reason is that only the IP addresses of all VMs managed by the management server and the information of the virtual machine monitor (virtual router IP address) on which the VM operates need be stored.

  The sixth effect is that it becomes possible to prevent flooding of an extra packet.

  This is because the virtual NIC suspend process and resume process are executed.

  The seventh effect is that spoofing can be prevented at the time of routing table update processing.

  The reason is that a certificate is used.

  The eighth effect is that it is not necessary to change the segment to which the virtual machine belongs at the time of migration.

  The reason is that routing processing between different segments is possible by providing each virtual machine monitor with a routing processing unit. For this reason, there is an effect that extra traffic is not generated during communication between different segments.

The configuration, operation, and effect of the present embodiment have been described above. To sum up these, it can be said that the virtual machine monitor and the virtual machine monitor management server have the following functions.
1. The hypervisor of each virtual machine monitor has a routing processing unit for performing routing processing.
2. In order to implement the routing function, the hypervisor of each virtual machine monitor has a non-overlapping IP address (virtual router IP address) for a plurality of segments. (In other words, it has multiple IP addresses with different segments, and each IP address is different for each virtual machine monitor, and there is no duplication.)
3. In order to use the above routing function, each virtual machine monitor holds a routing table. There are two types of routing tables. One is used for communication between physical routers, and the other is used for communication between virtual machine monitors. The routing table used for communication between virtual machine monitors has the characteristics shown in 4 to 7 below.
4). Each routing table used for communication between virtual machine monitors describes the correspondence between the IP addresses of all VMs managed by the management server and the virtual router IP address of the virtual machine monitor on which the VM operates. Shall.
5. The routing table does not include items other than those mentioned above, and stores only limited information. (Information such as metric values and administrative distance values used in normal routing is not stored.)
6). The routing table is updated manually (static) and does not use a routing protocol such as RIP or OSPF. (By permitting only manual registration, registration to the routing table is possible even when the IP addresses of VMs operating on each virtual machine monitor are discontinuous, and routing can be continued)
7). The routing table is updated only by the management server.
8). Assume that the management server has a certificate function and cannot update the routing table of the virtual machine monitor illegally from an external server other than the management server.
9. It is assumed that the management server has a database and holds information on the IP addresses of all VMs and the virtual router IP address of the virtual machine monitor on which each VM operates.
10. It is assumed that a management agent is installed in each VM, and the management server can grasp the latest IP address information.
11. The management agent provides an interface capable of kicking a series of processing units for changing the default GW on the guest OS to the designated IP address from the outside, and can be executed from the management server.
12 When the command for changing the default GW is executed from the management server, the command is executed via the virtual machine monitor while performing secure communication using the certificate function of “8”.
13. When a VM migrates to another virtual machine monitor due to a virtual machine hot migration or the like, each virtual machine monitor updates information in the routing table. It also updates database information owned by the management server.
14 For a VM that is migrated to another virtual machine monitor by hot migration of the virtual machine, the virtual router IP address of the migration destination virtual machine monitor is set as the default GW using the function “11” from the management server. .
15. The hypervisor of each virtual machine monitor has a MAC address determination processing unit for determining the MAC address of the received packet. When the virtual machine monitor receives a packet from the outside of the virtual machine monitor, the MAC address determination processing unit reads the MAC address information from the packet, and the destination MAC address matches the MAC address of the virtual router of the own virtual machine monitor. Determine if you are.

  A part or all of the above-described embodiment can be described as in the following supplementary notes, but is not limited thereto.

(Supplementary Note 1) In a communication system in which a plurality of virtual machine monitors are connected to each other,
The plurality of virtual machine monitors include different virtual router IP addresses for each segment,
The plurality of virtual machine monitors includes a first routing table in which a virtual machine IP address of a virtual machine operating on the plurality of virtual machine monitors is associated with the virtual router IP address, and a second routing table indicating VLAN affiliation A routing table;
The plurality of virtual machine monitors, when transmitting a packet, identify a destination virtual router IP address of the packet to be transmitted by referring to the first routing table, and the identified destination virtual router IP address is determined by itself. It is determined whether the virtual machine monitor is the same as the virtual machine monitor, and if the result of the determination is the same as the own virtual machine, the destination MAC address is converted to the MAC address of the destination virtual machine. If not, the communication system converts the destination MAC address to the MAC address of the destination virtual router and transmits the converted packet.

(Supplementary note 2) In the communication system according to supplementary note 1,
The plurality of virtual machine monitors refer to the received packet header when a packet is received from the outside, and the destination IP address and destination MAC address as a result of the reference are operating on the own virtual machine monitor. A communication system that performs packet reception processing after converting a destination MAC address to a MAC address of a destination virtual machine when the destination MAC address is addressed to a virtual router.

(Supplementary Note 3) In the communication system according to Supplementary Note 1 or 2,
The plurality of virtual machine monitors refer to the received packet header when a packet is received from the outside, and the destination IP address and destination MAC address as a result of the reference are operating on the own virtual machine monitor. A communication system, wherein the received packet is discarded when the destination MAC address is not addressed to the virtual router.

(Supplementary note 4) In the communication system according to any one of supplementary notes 1 to 3,
A communication system that performs communication with an external network via a physical router by referring to the second routing table.

(Supplementary Note 5) In the communication system according to any one of Supplementary Notes 1 to 4,
The communication system further includes a management server,
The communication system, wherein the first routing table is updated only by the management server.

(Supplementary note 6) In the communication system according to supplementary note 5,
The communication system is characterized in that the update of the first routing table performed by the management server is performed manually, and a routing protocol for automatically allocating an IP address is not used.

(Supplementary note 7) In the communication system according to supplementary note 5 or 6,
When the virtual machine migrates to a migration destination virtual machine monitor that is a virtual machine different from the migration source virtual machine monitor, the predetermined process including the change of the first routing table is executed. A communication system, wherein a virtual NIC of a virtual machine is stopped to stop packet transmission and reception while the predetermined process is being executed.

(Supplementary Note 8) In a routing method performed by a system in which a plurality of virtual machine monitors are connected to each other,
Causing the plurality of virtual machine monitors to prepare different virtual router IP addresses for each segment;
The plurality of virtual machine monitors includes a first routing table in which a virtual machine IP address of a virtual machine operating on the plurality of virtual machine monitors is associated with the virtual router IP address, and a second routing table indicating VLAN affiliation And a step of preparing a routing table,
The plurality of virtual machine monitors, when transmitting a packet, identify a destination virtual router IP address of the packet to be transmitted by referring to the first routing table, and the identified destination virtual router IP address is determined by itself. It is determined whether the virtual machine monitor is the same as the virtual machine monitor, and if the result of the determination is the same as the own virtual machine, the destination MAC address is converted to the MAC address of the destination virtual machine. If not, the routing method converts the destination MAC address to the MAC address of the destination virtual router, and transmits the converted packet.

  The present invention is suitable in an environment using virtualization software such as VMware, Xen, Hyper-V.

110, 120 Virtual machine monitor 111, 121 Virtual machine monitor management agent 112, 122 Hypervisor 113, 123 Routing processor 114, 124 External packet transmission queue 115, 125 Internal packet transmission queue 116, 126 NIC
210, 220, 230 VM
300 Management Server 301 Certificate 302 Database 400 Switch 500 Router 600 External Network

Claims (8)

In a communication system in which multiple virtual machine monitors are connected to each other,
The plurality of virtual machine monitors include different virtual router IP addresses for each segment,
The plurality of virtual machine monitors includes a first routing table in which a virtual machine IP address of a virtual machine operating on the plurality of virtual machine monitors is associated with the virtual router IP address, and a second routing table indicating VLAN affiliation A routing table;
The plurality of virtual machine monitors, when transmitting a packet, identify a destination virtual router IP address of the packet to be transmitted by referring to the first routing table, and the identified destination virtual router IP address is determined by itself. It is determined whether the virtual machine monitor is the same as the virtual machine monitor, and if the result of the determination is the same as the own virtual machine, the destination MAC address is converted to the MAC address of the destination virtual machine. If not, the communication system converts the destination MAC address to the MAC address of the destination virtual router and transmits the converted packet. The communication system according to claim 1,
The plurality of virtual machine monitors refer to the received packet header when a packet is received from the outside, and the destination IP address and destination MAC address as a result of the reference are operating on the own virtual machine monitor. A communication system that performs packet reception processing after converting a destination MAC address to a MAC address of a destination virtual machine when the destination MAC address is addressed to a virtual router. The communication system according to claim 1 or 2,
The plurality of virtual machine monitors refer to the received packet header when a packet is received from the outside, and the destination IP address and destination MAC address as a result of the reference are operating on the own virtual machine monitor. A communication system, wherein the received packet is discarded when the destination MAC address is not addressed to the virtual router. The communication system according to any one of claims 1 to 3,
A communication system that performs communication with an external network via a physical router by referring to the second routing table. The communication system according to any one of claims 1 to 4,
The communication system further includes a management server,
The communication system, wherein the first routing table is updated only by the management server. The communication system according to claim 5, wherein
The communication system is characterized in that the update of the first routing table performed by the management server is performed manually, and a routing protocol for automatically allocating an IP address is not used. The communication system according to claim 5 or 6,
When the virtual machine migrates to a migration destination virtual machine monitor that is a virtual machine different from the migration source virtual machine monitor, the predetermined process including the change of the first routing table is executed. A communication system, wherein a virtual NIC of a virtual machine is stopped to stop packet transmission and reception while the predetermined process is being executed. In a routing method performed by a system in which a plurality of virtual machine monitors are connected to each other,
Causing the plurality of virtual machine monitors to prepare different virtual router IP addresses for each segment;
The plurality of virtual machine monitors includes a first routing table in which a virtual machine IP address of a virtual machine operating on the plurality of virtual machine monitors is associated with the virtual router IP address, and a second routing table indicating VLAN affiliation And a step of preparing a routing table,
The plurality of virtual machine monitors, when transmitting a packet, identify a destination virtual router IP address of the packet to be transmitted by referring to the first routing table, and the identified destination virtual router IP address is determined by itself. It is determined whether the virtual machine monitor is the same as the virtual machine monitor, and if the result of the determination is the same as the own virtual machine, the destination MAC address is converted to the MAC address of the destination virtual machine. If not, the routing method converts the destination MAC address to the MAC address of the destination virtual router, and transmits the converted packet.

Images