CN100440844C

CN100440844C - System and method for realizing virtual special network of hybrid backbond network of hybrid station

Info

Publication number: CN100440844C
Application number: CNB2004100494741A
Authority: CN
Inventors: 李德丰
Original assignee: Huawei Technologies Co Ltd
Current assignee: Huawei Technologies Co Ltd
Priority date: 2004-06-16
Filing date: 2004-06-16
Publication date: 2008-12-03
Anticipated expiration: 2024-06-16
Also published as: CN1710877A; WO2005125103A1

Abstract

The present invention relates to a virtual special network technique which discloses a system and a method for realizing a virtual special network of hybrid sites and hybrid backbone networks. The sites based on different IP versions can carry out mutual visit and open up VPN business by hybrid backbone networks based on different IP versions. The system and the method for realizing a virtual special network of hybrid sites and hybrid backbone networks run an IPv4/IPv6 double routing list on a CE router and a PE router, configure an IPv4 and an IPv6 protocol stacks according to the network connection condition, carry out route release and distribution after carrying out VPN addressing and necessary site conversion of IPv4 address and IPv6 address to a user site, and realize data retransmit by using multi-ply label. Consequently, the present invention realizes VPN under the condition of hybrid sites and hybrid backbone networks.

Description

Realize the system and method for mixed station mixed skeleton network Virtual Private Network

Technical field

The present invention relates to virtual private network technology, be particularly related to user site and backbone network by the 4th edition (Internet Protocol version 4 of internetworking agreement, be called for short " IPv4 ") to the 6th edition (Internet Protocol version 6 of internetworking agreement, be called for short " IPv6 ") Virtual Private Network (VirtualPrivate Networking is called for short " VPN ") technology during evolution.

Background technology

The virtual dedicated network that VPN is on public network to be set up, it has and dedicated network same remarkable fail safe, reliability and ease of manageability.VPN has substituted traditional dialing access, utilize the continuity of internet (Internet) public network or carrier network resource as enterprise private, can save expensive special line rent uses, the fail safe that while VPN can use technique guarantee such as tunnel protocol, authentication and data encryption to communicate by letter is subjected to enterprise customer's welcome.

Enterprise can bring a lot of benefits by the construction of VPN, and for example, by using VPN, enterprise can save the expense of the daily communication of a large amount of enterprises; It is unified to reach business administration to carry out remote teaching and remote monitoring; Can also improve the fail safe of enterprises business information circulation.Can predict, VPN is the Intranet design, the inexorable trend of information management, circulation.

Existing VPN is based on the IPv4 network, and backbone network and the website of promptly forming VPN all are in the IPv4 network.As typical case's representative wherein, how the VPN implementation of Request for Comments (Request for Comments is called for short " RFC ") standard 2547bis definition is to realizing that VPN has made specific descriptions, and detailed description can be with reference to RFC 2547bis.Below the basic principle that realizes this scheme is briefly introduced.

Multi protocol label that RFC2547bis defines exchange (MultiProtocol Label Switching, be called for short " MPLS ") three layers (Layer 3, abbreviation " L3 ") schematic diagram of the model of VPN as shown in Figure 1, this model comprises three component parts: user network edge (Custom Edge Router, abbreviation " CE ") router, backbone network edge (Provider Edge Router, be called for short " PE ") router and backbone network (Provider Router is called for short " P ") router.Wherein, ce router is a part of user resident network, has interface directly to link to each other with the network of operator, and the ce router perception does not need to safeguard the whole routing iinformation of VPN less than the existence of VPN yet; Pe router is the edge device of carrier network, directly links to each other with user's ce router, in the MPLS network, all processing of VPN is all finished on pe router; The P router is in the carrier network, and the discord ce router directly links to each other, and the P router needs basic signalling capability of MPLS and transfer capability.Those of ordinary skill in the art are appreciated that the division of CE and PE mainly is to divide from operator and user's range of management, and CE and PE are the borders of both range of managements.

Can use External BGP (External BGP between CE and the PE, be called for short " EBGP ") or Interior Gateway Protocol (Interior Gateway Protocol, be called for short " IGP ") etc. the Routing Protocol exchanging routing information, also can use static routing.CE needn't support MPLS, the whole networking that does not need perception VPN by, the whole networking of VPN is contracted out to operator and finishes.The whole networking of passing through MP-BGP (Multi-Protocol Border Gateway Protocol is called for short " MP-BGP ") switched vpc N between the PE is by information.

As shown in Figure 1, VPN is made up of a plurality of user site (Site), on PE, corresponding VPN route/forwarding instance (the VPN Routing/Forwarding instance of each website, be called for short " VRF "), it mainly comprises: a series of interfaces and the management information of internetworking agreement (Internet Protocol is called for short " IP ") routing table, Label Forwarding Information Base, use Label Forwarding Information Base.Wherein, interface and management information comprise route-distinguisher (Route Distinguisher is called for short " RD "), route filtering strategy, member interface tabulation etc.Need to prove that there are not man-to-man relation in user site and VPN, a website can belong to a plurality of VPN simultaneously.When specific implementation, the related independent VRF of each website.In fact the VRF of Site combines the VPN member relation and the routing rule of this website among the VPN.The message forwarding information is stored in the IP route table and Label Forwarding Information Base of each VRF.System safeguards that for each VRF one overlaps independently routing table and Label Forwarding Information Base, thereby has prevented that data leak from going out outside the VPN, has prevented that simultaneously the data outside the VPN from entering.

Use Border Gateway Protocol (Border Gateway Protocol between the router, abbreviation " BGP ") issues the VPN route, BGP communication is carried out on two levels, autonomous system (AutonomousSystem, be called for short " AS ") inner Internal BGP (the Internal BGP that adopts, be called for short " IBGP "), adopt EBGP between the AS.For example, the PE-PE session is the IBGP session, and the PE-CE session is the EBGP session.The VPN of BGP between pe router forms information and route propagation, realizes by Multi-protocol Extensions for Border Gateway Protocol (Multiprotocol extensions BGP is called for short " MBGP ").MBGP is backward compatible, both can support traditional IPv4 address family, can support other address family again, for example VPN-IPv4 address family.The route target (Route Target) that carries by MBGP has guaranteed that the route of specific VPN can only be known by other member of this VPN, makes the communication between BGP/MPLSVPN member become possibility.Wherein, the detailed description about MBGP sees also RFC2283.

In the RFC2547bis standard, propagate routing iinformation by Interior Gateway Protocol (InteriorGateway Protocol is called for short " IGP ") or EBGP between CE and the PE, PE obtains the routing table of this VPN, is stored among the independent VRF.Guarantee the connectedness of common IP between the PE by IGP, propagate VPN by IBGP and form information and route, and finish the renewal of VRF separately.PE by upgrading the routing table of CE with the route switching between the CE of directly linking to each other, finishes the route switching between each CE more thus.

Wherein, when using BGP to issue the VPN route, used new address family-VPN-IPv4 address.There are 12 bytes a VPN-IPv4 address, and beginning is the RD of 8 bytes, and the back is the IPv4 address of 4 bytes.PE uses RD that the routing iinformation from different VPN is identified.Operator can distribute RD independently, but need guarantee the AS number part as RD of their special use the overall uniqueness of each RD.RD is that zero VPN-IPv4 address is a synonym with the unique IPv4 address of the overall situation.After handling like this, even the 4 byte IPv4 address overlaps that comprise in the VPN-IPv4 address, the VPN-IPv4 address still can keep the overall situation unique.Wherein, PE is the IPv4 route from the route that CE receives, and needs to introduce in the VRF routing table, needs additional RD this moment.In common realization, for all routes that come from same user site are provided with identical RD.

In the RFC2547bis standard, adopt Route Target attribute-bit and can use the set of the website of certain route, promptly which website is this route can be received by, and pe router can receive the route which website sends.The pe router that links to each other with the website that indicates among the Route Target all can receive the route with this attribute.After pe router receives the route that comprises this attribute, it is joined in the corresponding routing table.There is the set of two Route Target attributes in pe router: a set is used to append to the route that receives from certain website, is called Export Route Targets; Which route another set is used for determining to introduce the routing table of this Site, is called Import RouteTargets.By the entrained Route Target attribute of coupling route, can obtain the member relation of VPN.Coupling Route Target attribute can be used for filtering the routing iinformation that pe router receives.

Figure 2 shows that by coupling Route Target attribute and filter the schematic diagram that receives route.When the MPLSVPN routing iinformation entered pe router, if there is identical entry in Export Route Targets set with ImportRoute Targets set, then this route was received; If Export Route Targets set does not have identical entry with Import Route Targets set, then this route is rejected.

In the RFC2547bis standard, the VPN message is transmitted the two-layer label mode of using.Ground floor, be that outer layer label exchanges in backbone network inside, represented the strip label switching path of (PEER) PE from PE to the opposite end (Label Switched Path is called for short " LSP "), the VPN message utilizes this layer label, just can arrive opposite end PE along LSP.When arriving CE, uses opposite end PE the second layer, i.e. vpn label, and vpn label has indicated message to arrive which website, perhaps more more specifically, arrives which CE.Like this, according to vpn label, just can find the interface that E-Packets.In particular cases, two websites that belong to same VPN are connected to same PE, and the problem that then how to arrive the other side PE does not exist, and only need to solve how to arrive opposite end CE.

And along with the development of communication network technology, traditional IPv4 network has exposed a series of shortcomings, be embodied in aspects such as address space deficiency, poor mobility, poor stability and configuration complexity, therefore the Internet engineering duty group (Internet Engineer Task Force is called for short " IETF ") has proposed IPv6 to address these problems.Through development in a few years, the IPv6 technology is day by day ripe, comparatively successful solution the existing problem of IPv4, become the standard of Next Generation Internet.At present, the popularization of IPv6 enters substantial phase, and many research institutions and company are carrying out the research work of IPv6 networking products.

For at the miscellaneous service that to the process of IPv6 evolution, continues to provide from IPv4 under the IPv4 environment, must study the vpn solution on the IPv6 network synchronously.Because IPv6 itself is yet under test, also informal extensive commercial, more do not exist the formal vpn service under the IPv6 network to use.Be scarcely out of swaddling-clothes for the research of vpn service under the IPv6 in the world now, IPv6 VPN also will adapt to the new features of IPv6, fail safe, service quality (Qualityof Service as vpn service under the IPv6, be called for short " QoS "), mobility and manageability etc., have a lot of research work to carry out.

Is the IPv4 network for how at backbone network, and the VPN website all is to realize VPN under the situation of IPv6 network, the 6PE technical scheme that can adopt company of Cisco (CISCO) to propose, and the network of this technical scheme is formed schematic diagram as shown in Figure 3.The basic thought that the 6PE scheme realizes is: each IPv6 website is connected at least one two stack of IPv4 backbone network and supports the pe router of MP-BGP, 6PE router promptly shown in Figure 3.Wherein, the 6PE router is called two stack BGP (Double StackBGP is called for short " DS-BGP ") router, i.e. DS-BGP router.The DS-BGP router has an IPv4 address at least in the IPv4 side, has an IPv6 address at least in the IPv6 side, but and this IPv4 address must be in the IPv4 network route.Route in the IPv6 website is followed the IPv6 Routing Protocol of standard, the 3rd edition (Open Shortest Path First Version3 of OSPF for example, be called for short " OSPFv3 "), the 6th edition (Information Society Initiativesin Standardization version 6 of informatics meeting initiated in standardization, be called for short " ISISv6 ") or routing information protocol of future generation (Routing Information Protocol next generation, be called for short " RIPng "), need not issue to the IPv4 backbone network, only need terminate by BGP4+ at the DS-BGP router, but need between the DS-BGP router, exchange Network Layer Reachable Information (the Network LayerReachability Information of IPv6 by MP-BGP4, be called for short " NLRI "), outlet DS-BGP router to inlet DS-BGP router advertisement route the time with oneself address as next jumpings of these routes; When packet is transmitted, from inlet DS-BGP router the IPv6 packet is passed through the MPLS tunnel, promptly LSP is transparent to outlet DS-BGP router.And the IPv4 address can be used during as the BGP route next jump in the address of DS-BGP router advertisement oneself, and use MPLS tunnel or other tunnel based on the IPv4 address, as generic route encapsulation (Generic Route Encapsulation, be called for short " GRE ") protocol tunnel, IP security protocol (IP Security Protocol, be called for short " IPsec) tunnel; Also can use the IPv6 address, and the use corresponding tunnel, as the 6to4 tunnel, intra site automatic tunnel access protocol (Intra-Site Automatic Tunnel Access Protocol, be called for short " ISATAP ") tunnel, and use the address format of these tunnel requirements.

But IPv4 is a progressive process to the IPv6 transition, and will exist IPv4 network and IPv6 network transition period simultaneously, and user network and backbone network all both may be IPv4 network or IPv6 network, may be again the IPv4/IPv6 hybrid network.Vpn service under this generation network of will looking for novelty can adapt to complicated network environment, can normal use in IPv4 network, IPv6 network or IPv4/IPv6 hybrid network.

In actual applications, there is following problem in such scheme: existing technical scheme can't comprise IPv4 website and IPv6 website simultaneously in user site, and backbone network provides the vpn service solution when comprising IPv4 territory and IPv6 territory simultaneously.

Cause the main cause of this situation to be, existing technical scheme is to be the IPv4 network at backbone network, all the VPN website is the situation of IPv6 website, the DS-BGP that uses in this scheme can't support the website of IPv4, if use common bgp router simply instead then can't realize the functions such as exchange of NLRI, and the route learning of VPN and issue are to carry out in the IPv4 network in the existing technical scheme, router study and issue in the backbone network be can't support to mix, route learning issue and data forwarding therefore do not supported based on the VPN that mixes backbone network.

Summary of the invention

In view of this, main purpose of the present invention is to provide a kind of system and method for realizing the mixed station mixed skeleton network Virtual Private Network, and making can be by visiting based on the backbone network of different IP version and carrying out vpn service mutually based on the website of different IP version.

For achieving the above object, the invention provides a kind of system that realizes the mixed station mixed skeleton network Virtual Private Network, comprise VPN user website based on internetworking agreement the 4th edition or the 6th edition, the user network edge router, backbone network edge router and backbone network, described user site inserts described backbone network by described user network edge router and described backbone network edge router, described backbone network also comprises at least one autonomous system and at least one autonomous system based on internetworking agreement the 6th edition based on internetworking agreement the 4th edition, connects by the autonomous system edge router between the described autonomous system;

Described user site inserts described backbone network by described user network edge router and described backbone network edge router and is connected with autonomous system correspondingly;

The internetworking protocol version of described user site and described autonomous system connects the described user network edge router of described user site and described autonomous system and the dual stack that described backbone network edge router is supported internetworking agreement the 4/6th edition not simultaneously.

Wherein, described based on the multi-protocols External BGP issue route that adopts between internetworking agreement the 4th edition or the 6th edition autonomous system and the described autonomous system edge router based on internetworking agreement the 6th edition.

During based on the described user site of internetworking agreement the 4th edition with based on the described user site intercommunication of internetworking agreement the 6th edition, the 4th edition route A.B.C.D/n of internetworking agreement is mapped to the 6th edition route of internetworking agreement of 0::A:B:C:D/ (96+n) form.

The present invention also provides a kind of method based on said system realization mixed station mixed skeleton network Virtual Private Network, comprises following steps:

A addresses the user site based on internetworking agreement the 4th edition or the 6th edition in described Virtual Private Network, and forms route entry according to the address of each user site;

B is according to described route entry, described user site and carry out the study and the issue of route based on the backbone network of internetworking agreement the 4th edition or the 6th edition;

The described backbone network of C carries out the distribution of vpn label and outer layer label;

The route of setting up among the described step B of packet foundation of the described user site of D encapsulates described vpn label and described outer layer label is transmitted by described backbone network.

Wherein, in the described steps A, forming the Address-Family Identifier symbol based on the form that adopts " route-distinguisher+the 4th edition address of internetworking agreement " between the described user site of internetworking agreement the 4th edition is Virtual Private Network-the 4th edition address of internetworking agreement of 1; Between the described user site and the described user site based on internetworking agreement the 6th edition based on internetworking agreement the 4th edition, forming the Address-Family Identifier symbol based on the form that adopts " route-distinguisher+the 6th edition address of internetworking agreement " between the described user site of internetworking agreement the 6th edition is Virtual Private Network-the 6th edition address of internetworking agreement of 2.

With communicate by letter based on the described user site of internetworking agreement the 6th edition, after based on the described user site of internetworking agreement the 4th edition the 4th edition address A.B.C.D of internetworking agreement being mapped to the 6th edition address of internetworking agreement of 0::A:B:C:D form, make up composition Virtual Private Network-the 6th edition address of internetworking agreement with route-distinguisher.

Described step B also comprises following substep:

Internal BGP is passed through in the autonomous system inside of the described backbone network of B1, between the backbone network edge router and autonomous system edge router of this described autonomous system, the route of the described user site that issue is connected with the described backbone network edge router of this described autonomous system;

B2 adopts the multi-protocols External BGP issue route based on internetworking agreement the 6th edition based on the described autonomous system edge router by being connected between the described autonomous system of different editions internetworking agreement;

The route that the described autonomous system edge router of B3 will be learnt is issued based on different editions internetworking agreement end-to-end router to this described autonomous system inside;

Move Routing Protocol between the backbone network edge router of the described backbone network of B4 and the user network edge router of described user site, to described user network edge router issue route.

For the described user site based on internetworking agreement 4th edition of needs visit based on the described user site of internetworking agreement the 6th edition, described step B4 also comprises following substep:

B41 is somebody's turn to do based on the described user network edge router of the described user site of internetworking agreement the 4th edition and the described backbone network edge router that is attached thereto, and operation is based on the Routing Protocol study route of internetworking agreement the 6th edition;

B42 is distributed to described user network edge router by the 6th edition Routing Protocol of internetworking agreement with route with the 6th edition route of internetworking agreement that the route A.B.C.D/n of the described user site of the internetworking agreement of the preservation of described backbone network edge router the 4th edition converts 0::A:B:C:D/ (96+n) to;

In the described user network edge router of B43 0::A:B:C:D/ (96+n) is reduced into the 4th edition route of internetworking agreement of A.B.C.D/n form, will saves as the 6th edition route of internetworking agreement based on the route of the described user site of internetworking agreement the 6th edition.

For the described user site based on internetworking agreement 6th edition of needs visit based on the described user site of internetworking agreement the 4th edition, described step B5 also comprises following substep:

B44 is somebody's turn to do based on the described user network edge router of the described user site of internetworking agreement the 6th edition and the described backbone network edge router that is attached thereto, and operation is based on the Routing Protocol study route of internetworking agreement the 6th edition;

The described user network edge router of B45 will directly be stored as the 6th edition route of internetworking agreement of 0::A:B:C:D/ (96+n) form based on the route of the described user site of internetworking agreement the 4th edition, will save as original form based on the route of the described user site of internetworking agreement the 6th edition.

For the described user site that does not need to visit based on the described user site of internetworking agreement the 6th edition based on internetworking agreement the 4th edition, in described step B, should based between the described user network edge router of the described user site of internetworking agreement the 4th edition and the connected described backbone network edge router only operation based on the Routing Protocol of internetworking agreement the 4th edition, and only learn and preserve the 4th edition route of internetworking agreement of the 4th edition user site of other internetworking agreement, abandon the 6th edition route of internetworking agreement.

Described backbone network edge router is after receiving the route of described Virtual Private Network, and whether decision learns and to described user site issue according to the route target extended community attribute of MP-BGP.

Among the described step C, described vpn label is used to distinguish the different described user site that same inlet backbone network edge router connects, distribute by described inlet backbone network edge router, when the issue route, be distributed to corresponding described backbone network edge router with route; Described outer layer label is used for transmitting packet at described backbone network, label distribution protocol by operation label distribution protocol, RSVP-traffic engineering or constraint route in a described autonomous system distributes, and is being that the two-way connection branch of described Autonomous System Boundary Router, AS Boundary Router is used in the forwarding between the described Autonomous System Boundary Router, AS Boundary Router by the multi-protocols External BGP between the Autonomous System Boundary Router, AS Boundary Router of the described autonomous system of difference.

Described step D also comprises following substep:

D1 follows common internetworking agreement repeating process and carries out the source user website to the internetworking protocol data forwarding between the inlet backbone network edge router;

D2 carries out described inlet backbone network edge router and transmits to the label data between the outlet backbone network edge router;

The described outlet backbone network of D3 edge router carries out described outlet backbone network according to the routing table of described vpn label and its storage and transmits to the internetworking protocol data between the purpose user site.

Described step D2 also comprises following steps:

D21 increases the outer layer label that distributes in the described autonomous system at this described inlet backbone network edge router place again after increasing the described vpn label of described purpose website for packet on the described inlet backbone network edge router;

D22 is forwarded to described packet in the autonomous system edge router of the adjacent described autonomous system of current described autonomous system according to outer layer label;

D23 is forwarded to next adjacent described autonomous system according to the outer layer label that distributes between the described autonomous system edge router with described packet;

D24 is forwarded to described outlet backbone network edge router with packet.

By relatively finding, technical scheme difference with the prior art of the present invention is, the present invention program moves IPv4/IPv6 double route table on ce router and pe router, the protocol stack that is connected situation configuration of IP v4 and IPv6 according to the network of ce router and pe router, the user site of VPN is carried out VPN addressing and necessary IPv4 address and the laggard walking along the street of IPv6 address transition by issue with distribute, and by use multilayer labels realization forwarding of data, thereby under the situation of mixed station mixed skeleton network, realize VPN.

Difference on this technical scheme, brought comparatively significantly beneficial effect, promptly by adopting the present invention to realize the scheme of mixed station mixed skeleton network VPN, can under the situation of IPv6 transition, form VPN from IPv4 at user network and backbone network, make the solution of the VPN in network transition period have bigger flexibility, reduce the complexity of upgrading network equipment, make IPv4 more level and smooth, improved the economy and the feasibility of network upgrade greatly to the transition upgrading of IPv6.

Description of drawings

Fig. 1 forms schematic diagram for the system that RFC2547bis defines MPLS L3 VPN;

Fig. 2 is for filtering the schematic diagram that receives route by coupling Route Target attribute;

Fig. 3 forms schematic diagram for the 6PE scheme realizes the system of BGP/MPLS VPN;

Fig. 4 is the system's composition schematic diagram according to the realization mixed station mixed skeleton network VPN of a preferred embodiment of the present invention.

Embodiment

For making the purpose, technical solutions and advantages of the present invention clearer, the present invention is described in further detail below in conjunction with accompanying drawing.

Below in conjunction with a specific embodiment of the present invention the present invention program is described.

System according to the realization mixed station mixed skeleton network VPN of a preferred embodiment of the present invention forms schematic diagram as shown in Figure 4.

Need to prove that VPN A and VPN B only are used to represent that a pe router can insert a plurality of VPN simultaneously.

The system that realizes mixed station mixed skeleton network VPN is made up of following components: backbone network is in the pe router and the user site that is connected with pe router by ce router at backbone network edge.

Backbone network is used to issue the VPN route, sets up switching path, finishes the exchange of data.Backbone network comprises the autonomous system of the different address of employing family, connects by the Autonomous System Boundary Router, AS Boundary Router (Autonomous System Border Router is called for short " ASBR ") that is in the autonomous system edge between the autonomous system.As Fig. 4, in a preferred embodiment of the present invention, backbone network is two territories, and an IPv4 autonomous system (IPv4 single domain) and an IPv6 autonomous system (IPv6 single domain) are formed.Need to prove that the route of backbone network issue comprises VPN-IPv4 route and VPN-IPv6 route.Carry out route learning when setting up the VPN switching path at backbone network, at first issue the route of the user site that is connected with the pe router of this autonomous system between PE in autonomous system and the ASBR, then issue the route of learning mutually by EBGP between the ASBR, be the route that the pe router issue is learnt by the opposite end of ASBR by IBGP autonomous system inside under it then, issue route by pe router to ce router at last.Method about the route issue will be described in detail hereinafter.

The existing IPv4 website of user site also has the IPv6 website, and each user site comprises a plurality of different address of host that have.Wherein, the ce router that is connected with backbone network in the user network is supported the corresponding protocol stack according to the IP version of the IP version of this user network and the autonomous system that is connected with it.Pe router according to the IP version of the autonomous system under it with and the IP version of the user site that connects support the corresponding protocol stack.For example, the ce router and the corresponding pe router that are connected to the IPv4 website of IPv4 backbone network only need be supported the IPv4 protocol stack, be connected to the CE of IPv6 website of IPv6 backbone network and corresponding PE and only need support the IPv6 protocol stack, be connected to the IPv4 backbone network the IPv6 website CE and be connected to the CE of IPv4 website of IPv6 backbone network and the PE equipment that inserts these CE then all needs to support the IPv4/IPv6 dual stack.Need to prove, because may there be the relation of exchanging visit in IPv4 website among the same VPN and IPv6 website, therefore need preserve the IPv6 route for the router in the IPv4 website of needs visit IPv6 website, promptly these IPv4 websites need be supported IPv4-IPv6 combined address scheme.

In order to realize the present invention program, need comprise the processing of the user site addressing of the processing of the following aspects: VPN; The route learning of VPN website and the processing of issue; The processing of label distribution; The processing of VPN data forwarding.Hereinafter will elaborate to these processing.

At first illustrate below in a preferred embodiment of the present invention how to finish the processing of user site addressing.Need to prove, in the present invention, only consider that VPN user carries out the situation of unicast communication, require the main frame in each website of VPN to use unicast address, promptly only adopt an IPv4 address or an IPv6 address.

Owing in VPN, still there is the IPv4 website, consider the in short supply of publicly-owned IPv4 address, in a preferred embodiment of the present invention, allow the IPv4 website among the VPN to continue to use private ip v4 address, and allow the website of different VPN to use identical private ip v4 address.

In VPN, the IPv4 address is still adopted in the communication between IPv4 website and the IPv4 website, the value 1 that the Address-Family Identifier symbol in MP-BGP (Address Family Identifier is called for short " AFI ") territory uses RFC1700 to distribute as IPv4 address family; The IPv6 address is all adopted in intercommunication mutually between intercommunication mutually between IPv4 website and the IPv6 website and two the IPv6 websites, and the value 2 of RFC 1700 for the distribution of IPv6 address family can be used in the AFI territory in MP-BGP.Need to prove that when the IPv4 website intercomed mutually with the IPv6 website, the IPv4 address A.B.C.D in the IPv4 website was mapped to the IPv6 address of corresponding 0::A:B:C:D form.In MP-BGP route issuing process, follow-up Address-Family Identifier symbol (Subsequence Address Family Identifier is called for short " SAFI ") territory uses 128, expression VPN-IPv4/IPv6 address.

In a preferred embodiment of the present invention, owing to used private ip v4 address, in order to guarantee the uniqueness of VPN route and address in backbone network, continue to use the notion of the RD among the RFC 2547bis, promptly forming AFI by the form that adopts RD+ (IPv4 address) between IPv4 website and IPv4 website is 1 VPN-IPV4 address, is 2 VPN-IPv6 address at the form composition AFI by employing RD+ (IPv6 address) between IPv4 website and the IPv6 website or between two IPv6 websites.Need to prove, and the IPv4 address A.B.C.D in the IPv4 website of communicating by letter between the IPv6 website need make up with RD and form the VPN-IPv6 address after be mapped to the IPv6 address of 0::A:B:C:D form again.

In a preferred embodiment of the present invention, the processing of route learning and issue can be carried out according to method hereinafter described.

At first, after each user site to VPN addresses, polymerization is carried out in the address of each user site form corresponding route entry.Those of ordinary skill in the art are appreciated that in order to realize the relation of the visit between each user site among the VPN, these route entries need be distributed to corresponding website.

Then, the autonomous system inside of backbone network is by the route of the IBGP VPN user site that issue is connected with the pe router of this autonomous system between the pe router of this autonomous system and ASBR.Wherein, the route of issue comprises IPv4 route and IPv6 route.Need to prove, because backbone network exists IPv4 autonomous system and IPv6 autonomous system, this step has two kinds of situations when carrying out: when autonomous system is the IPv4 network, between the pe router of IPv4 network and ASBR by based on the multi-protocols Internal BGP (Multi-Protocol Internal BGP is called for short " MP-IBGP ") of the full connection of IPv4 or use the route of the VPN user site that the Router Reflector issue is connected with the PE of this IPv4 network; When autonomous system is the IPv6 network, the route of the VPN website that is connected with the pe router of this IPv6 network by MP-IBGP or the issue of suitable Router Reflector between the pe router in the IPv6 network and its ASBR based on the full connection of IPv6.

Then, issue corresponding route by multi-protocols External BGP (Multi-Protocol External BGP is called for short " MP-IBGP ") to the opposite end between the ASBR between the IPv4/IPv6 network based on IPv6.

Then, according to bgp protocol, the route of learning from the EBGP opposite end need be issued to the IBGP opposite end.Those of ordinary skill in the art can, so far, all pe routers can both receive the route that belongs to whole VPN user site.

At last, the operation Routing Protocol is issued corresponding route to ce router between pe router and the ce router.In a preferred embodiment of the present invention, need the IPv4 user site and the pe router operation of visit IPv6 VPN user site to learn IPv6 route and IPv4 route simultaneously based on the Routing Protocol of IPv6, by the IPv4 route A.B.C.D/n among the VRF of pe router being converted to the IPv6 route of 0::A:B:C:D/ (96+n), be distributed to ce router by the IPv6 Routing Protocol, in ce router, it is reduced into the IPv4 route of A.B.C.D/n, for the IPv6 route of other IPv6 user site, then in ce router, still save as the IPv6 route; When this IPv4 user site visit IPv4 website, carry out the coupling of IPv4 route, carry out the coupling of IPv6 route during visit IPv6 website.In a preferred embodiment of the present invention, the IPv6 user site that needs visit IPv4 VPN user site, also move Routing Protocol between its ce router and the pe router based on IPv6, learn the route of other website, route for other IPv4 user site, directly be stored as the IPv6 route of 0::A:B:C:D/ (96+n) form,, then save as original form for the route of other IPv6 user site.Need illustrate, be among the A.B.C.D/n mentioned above, and A.B.C.D is a network segment address, and n is a mask.

In a preferred embodiment of the present invention, if in the topological relation that some IPv4 user site is determined according to the RouteTarget attribute not needs visit other IPv6 user site, then only need the Routing Protocol of operation between its ce router and the pe router based on IPv4, and only learn and preserve the IPv4 route of other IPv4 user site, then abandon for the IPv6 route.

Need explanation the time, in the processing of the study of route and issue, whether pe router is learnt and to corresponding user site issue according to the Route Target extended community attribute decision of using MP-BGP after receiving the VPN route.In a preferred embodiment of the present invention, outlet (Egress) pe router carries the vpn label that corresponding Export Route Target and Egress PE distribute for this VPN website to its BGP opposite end issue VPN route the time.If the BGP opposite end is not ASBR, then VPN route that receives and the Import Route Target that disposes on this BGP opposite end are mated, if can the match is successful, then receive this route and to the user site issue of corresponding VRF correspondence; If the BGP opposite end is two ASBR between the autonomous system, then issue opposite end ASBR by EBGP, opposite end ASBR is distributed to IBGP opposite end in this territory with this route, carries out the coupling of RouteTarget in the IBGP opposite end, accepts and issues this route to the relative users website determining whether.

In a preferred embodiment of the present invention, still use VRF to preserve the route of different VPN.Different AFI at each VPN in VRF preserves IPv4 route and IPv6 route respectively, also preserve corresponding IPv4 route and IPv6 route in the ce router in the IPv4 of VPN website simultaneously, and with ce router the agency (Proxy) during as this other website of VPN site access, when carrying out matched routings, be IPv4 user site or IPv6 user site difference Match IP v4 route or IPv6 route according to the purpose user site of visiting.Need to prove, because the IPv6 user site among the VPN only need be preserved the IPv6 route, the pe router that inserts this IPv6 website needed earlier IPv4 route A.B.C.D/n to be converted to the IPv6 route of 0::A:B:C:D/ (96+n) before the route with other IPv4 website is distributed to this website.

In a preferred embodiment of the present invention, the processing of label distribution can be carried out according to rule hereinafter described.

The different VPN website that same Egress PE connects distributes different vpn labels to distinguish by Egress PE, and this vpn label is distributed to corresponding PE with route by MP-BGP issue route the time.For outer layer label, in IPv4 backbone network and IPv6 backbone network all by operation label distribution protocol (Label Distribution Protocol, be called for short " LDP ") or RSVP (Reservation Protocol, be called for short " RSVP ")-traffic engineering (Traffic Engineering, be called for short " TE ")/label distribution protocol (the Constraint-Routing Label DistributionProtocol of constraint route, abbreviation " CR-LDP ") carries out label distribution, but between the ASBR in two autonomous territories, move MP-EBGP, and be the outer layer label that the two-way connection of ASBR distributes this section LSP by MP-EBGP, this outer layer label only is used for the forwarding between these two ASBR.Wherein, be that the two-way connection of ASBR distributes the outer layer label of LSP can be with reference to RFC3107 specifically how by MP-EBGP.

In a preferred embodiment of the present invention, the processing of data forwarding comprises following several forwarding: the source user website is to the IP data forwarding between inlet (Ingress) pe router; The Ingress pe router is transmitted to the label data between the Egress pe router; Egress PE is to the IP data forwarding between the purpose user site.Narration respectively below.

The source user website is transmitted to the IP packet between inlet (Ingress) pe router and is followed common IP repeating process.As indicated above, preserved the routing table of IPv4/IPv6 two types in the user site, visit the source user website of IPv4/IPv6 purpose user site when carrying out the IP data forwarding for needs, can be that IPv4 website or IPv6 website are inquired about corresponding routing table according to the purpose user site, follow corresponding routing table packet is forwarded to Ingress PE.

The Ingress pe router is transmitted to the label data between the Egress pe router need be after being the vpn label of place, destination website for packet increase Egress PE on the Ingress PE, increase the outer layer label that the label distribution protocol (LDP/RSVP-TE/CR-LDP) in the autonomous territory at this Ingress PE place distributes again, then packet is forwarded to the ASBR that this autonomous system arrives next adjacent autonomous system along the LSR of LSP according to outer layer label, the outer layer label that distributes according to the ASBR of the adjacent autonomous system of the next one and the MP-EBGP between this ASBR is forwarded to the ASBR of next adjacent autonomous system then, continues then that LSP is forwarded to Egress PE with packet in the adjacent autonomous system of the next one.

Egress PE needs Egress PE after receiving the packet that comprises vpn label to the IP data forwarding between the purpose user site, determine the purpose user site by distinguishing vpn label, and follow corresponding routing table according to source user website and purpose user site type and be forwarded to destination host.Wherein, in this step, only just inquire about the IPv4 routing table when source user website and purpose user site are the IPv4 website, other situations are all inquired about the IPv6 routing table.

In addition, need to prove, if for the topological relation between each website of realizing VPN, control as topology such as full mesh networking, partial mesh, still can continue to use the method among the RFC 2547bis, promptly realize by Route Target, route issue and learning mechanism are identical between the PE that tells about during this and 2.2.3 save, promptly the topological relation according to VPN determines whether to learn routing table, realizes the topological relation of VPN according to routing table.

Those of ordinary skill in the art are appreciated that, the situation that comprises a plurality of IPv4/IPv6 autonomous systems for the VPN backbone network, can utilize the principle of telling about hereinbefore to carry out address assignment, route learning, packet forwarding and VPN topological relation realizes, promptly by issue VPN route between autonomous system that is increasing newly by MP-BGP between the ASBR between autonomous system that increases newly and the existing network and existing network, and distribute continue label forwarding in the VPN backbone network of outer layer label.

Though by reference some preferred embodiment of the present invention, the present invention is illustrated and describes, but those of ordinary skill in the art should be understood that, can do various changes to it in the form and details, and the spirit and scope of the present invention that do not depart from appended claims and limited.

Claims

1. system that realizes the mixed station mixed skeleton network Virtual Private Network comprises VPN user website, user network edge router, backbone network edge router and backbone network based on internetworking agreement the 4th edition or the 6th edition, it is characterized in that,

Described backbone network also comprises at least one autonomous system and at least one autonomous system based on internetworking agreement the 6th edition based on internetworking agreement the 4th edition, connects by the autonomous system edge router between the described autonomous system;

2. the system of realization mixed station mixed skeleton network Virtual Private Network according to claim 1, it is characterized in that, described based on internetworking agreement the 4th edition or the 6th edition autonomous system and described autonomous system edge router between adopt multi-protocols External BGP issue route based on internetworking agreement the 6th edition.

3. the system of realization mixed station mixed skeleton network Virtual Private Network according to claim 1, it is characterized in that, during based on the described user site of internetworking agreement the 4th edition with based on the described user site intercommunication of internetworking agreement the 6th edition, the 4th edition route A.B.C.D/n of internetworking agreement is mapped to the 6th edition route of internetworking agreement of 0::A:B:C:D/ (96+n) form.

4. the method based on claim 1 realization mixed station mixed skeleton network Virtual Private Network is characterized in that, comprises following steps:

5. the method for realization mixed station mixed skeleton network Virtual Private Network according to claim 4, it is characterized in that, in the described steps A, forming the Address-Family Identifier symbol based on the form that adopts " route-distinguisher+the 4th edition address of internetworking agreement " between the described user site of internetworking agreement the 4th edition is Virtual Private Network-the 4th edition address of internetworking agreement of 1; Between the described user site and the described user site based on internetworking agreement the 6th edition based on internetworking agreement the 4th edition, forming the Address-Family Identifier symbol based on the form that adopts " route-distinguisher+the 6th edition address of internetworking agreement " between the described user site of internetworking agreement the 6th edition is Virtual Private Network-the 6th edition address of internetworking agreement of 2.

6. the method for realization mixed station mixed skeleton network Virtual Private Network according to claim 5, it is characterized in that, with communicate by letter based on the described user site of internetworking agreement the 6th edition, after based on the described user site of internetworking agreement the 4th edition the 4th edition address A.B.C.D of internetworking agreement being mapped to the 6th edition address of internetworking agreement of 0::A:B:C:D form, make up composition Virtual Private Network-the 6th edition address of internetworking agreement with route-distinguisher.

7. the method for realization mixed station mixed skeleton network Virtual Private Network according to claim 4 is characterized in that, described step B also comprises following substep:

8. the method for realization mixed station mixed skeleton network Virtual Private Network according to claim 7, it is characterized in that, for the described user site based on internetworking agreement 4th edition of needs visit based on the described user site of internetworking agreement the 6th edition, described step B4 also comprises following substep:

9. the method for realization mixed station mixed skeleton network Virtual Private Network according to claim 7, it is characterized in that, for the described user site based on internetworking agreement 6th edition of needs visit based on the described user site of internetworking agreement the 4th edition, described step B5 also comprises following substep:

10. the method for realization mixed station mixed skeleton network Virtual Private Network according to claim 7, it is characterized in that, for the described user site that does not need to visit based on the described user site of internetworking agreement the 6th edition based on internetworking agreement the 4th edition, in described step B, should based between the described user network edge router of the described user site of internetworking agreement the 4th edition and the connected described backbone network edge router only operation based on the Routing Protocol of internetworking agreement the 4th edition, and only learn and preserve the 4th edition route of internetworking agreement of the 4th edition user site of other internetworking agreement, abandon the 6th edition route of internetworking agreement.

11. the method for realization mixed station mixed skeleton network Virtual Private Network according to claim 7, it is characterized in that, described backbone network edge router is after receiving the route of described Virtual Private Network, and whether decision learns and to described user site issue according to the route target extended community attribute of MP-BGP.

12. the method for realization mixed station mixed skeleton network Virtual Private Network according to claim 4, it is characterized in that, among the described step C, described vpn label is used to distinguish the different described user site that same inlet backbone network edge router connects, distribute by described inlet backbone network edge router, when the issue route, be distributed to corresponding described backbone network edge router with route; Described outer layer label is used for transmitting packet at described backbone network, label distribution protocol by operation label distribution protocol, RSVP-traffic engineering or constraint route in a described autonomous system distributes, and is being that the two-way connection branch of described Autonomous System Boundary Router, AS Boundary Router is used in the forwarding between the described Autonomous System Boundary Router, AS Boundary Router by the multi-protocols External BGP between the Autonomous System Boundary Router, AS Boundary Router of the described autonomous system of difference.

13. the method for realization mixed station mixed skeleton network Virtual Private Network according to claim 4 is characterized in that, described step D also comprises following substep:

14. the method for realization mixed station mixed skeleton network Virtual Private Network according to claim 13 is characterized in that, described step D2 also comprises following steps:

D24 is forwarded to described outlet backbone network edge router with packet.