CN100553220C

CN100553220C - A kind of method and apparatus of realizing that downlink user is isolated in the VLAN

Info

Publication number: CN100553220C
Application number: CNB2007101430420A
Authority: CN
Inventors: 况伟; 张洋
Original assignee: Hangzhou H3C Technologies Co Ltd
Current assignee: New H3C Information Technologies Co Ltd
Priority date: 2007-08-22
Filing date: 2007-08-22
Publication date: 2009-10-21
Anticipated expiration: 2027-08-22
Also published as: CN101119276A

Abstract

The invention provides the method that downlink user is isolated in a kind of VLAN of realization, comprising: set up binding relationship between PVLAN and the SVLAN at switching equipment; For each port of switching equipment is provided with vlan information under the port; Setting comprises the forwarding-table item of network appliance address and the affiliated vlan information of the network equipment; When the port of switching equipment receives to be E-Packeted that the network equipment sends, described forwarding-table item is inquired about and safeguarded to attribute information according to described message, in described port place VLAN and with other VLAN of this VLAN binding in the search purposes network equipment, carry out message and transmit.The present invention also provides a kind of switching equipment.In the embodiment of the invention, make full use of the two-layer retransmitting table list item resource of switch, the number of users that very big increase can insert; The pressure to system of avoiding a large amount of MAC copies of software to bring increases the stability of a system and maintainability.

Description

A kind of method and apparatus of realizing that downlink user is isolated in the VLAN

Technical field

The present invention relates to data communication technology field, relate in particular to the method and apparatus of realizing that downlink user is isolated in the VLAN.

Background technology

Often need a large amount of users of access to be put into different VLAN (Virtual LocalArea Network, VLAN) respectively in the sub-district access and isolate, but these users need to communicate with server.An example of the prior art comprises as shown in Figure 1: SW (Switch, switch) 1 and SW2, Server (server) 1 and Server 2, PC (Personal Computer, personal computer) 1, PC2 and PC3.Wherein, SW1 and SW2 are Layer 2 switch, and PC3 needs and PC1, PC2 isolate, and therefore PC3 are added VLAN4, and PC1 and PC2 are added VLAN3.PC1, PC2, PC3 will communicate by letter with Server2 with the server S erver1 that is in up direction, Server1 also needs to communicate by letter with Server2 in addition, therefore, normally Server1 and Server2 are added another VLAN (as: VLAN2), VLAN2, VLAN3, VLAN4 are defined as certain binding relationship, VLAN2 is PVLAN (a up primary vlan), and VLAN3 and VLAN4 are SVLAN (descending from VLAN).For upstream plant SW2 and Server, can only see the VLAN2 of SW1, saved the VLAN resource.

Most of Ethernet switch is realized two layers of forwarding by inquiry hardware two-layer retransmitting table in the prior art, transmitting main field is DMAC (Destination Medium Access Control, the access control of purpose medium), VLAN ID, outbound port etc., in order to realize the clean culture intercommunication with Server, SW1 need be with each down going port (port that adds SVLAN, comprise: P1, P2 and P3) MAC Address (MAC1 of SVLAN of study, MAC2 and MAC3) copy PVLAN to, also need simultaneously to copy the MAC (MAC4 and MAC5) that up going port (add the port of PVLAN, comprising: P4 and P5) is learnt to each SVLAN.On SW1, need to set up and safeguard a two-layer retransmitting table as shown in table 1:

Table 1:

MAC Address

VLAN ID

DPORT (outbound port)

STATUS (state)

MAC1	3	P1	Dynamic (dynamically)
MAC1	3	P1	Dynamic (dynamically)	MAC1	2	P1	Dynamic (dynamically)
MAC2	3	P2	Dynamic (dynamically)	MAC1	2	P1	Dynamic (dynamically)
MAC2	3	P2	Dynamic (dynamically)	MAC2	2	P2	Dynamic (dynamically)
MAC3	4	P3	Dynamic (dynamically)	MAC2	2	P2	Dynamic (dynamically)
MAC3	4	P3	Dynamic (dynamically)	MAC3	2	P3	Dynamic (dynamically)
MAC4	2	P4	Dynamic (dynamically)	MAC3	2	P3	Dynamic (dynamically)
MAC4	2	P4	Dynamic (dynamically)	MAC4	3	P4	Dynamic (dynamically)
MAC4	4	P4	Dynamic (dynamically)	MAC4	3	P4	Dynamic (dynamically)
MAC4	4	P4	Dynamic (dynamically)	MAC5	2	P5	Dynamic (dynamically)
MAC5	3	P5	Dynamic (dynamically)	MAC5	2	P5	Dynamic (dynamically)
MAC5	3	P5	Dynamic (dynamically)	MAC5	4	P5	Dynamic (dynamically)

Use the method for MAC copy, the MAC that port is learnt copies mutually at PVLAN and SVLAN, causes to take the hardware MAC address entries and roll up, and wastes a large amount of MAC address entries resources, causes scarcity of resources, significantly reduces the capacity that switch inserts the user.

Summary of the invention

The invention provides the method and apparatus that downlink user is isolated in a kind of VLAN of realization, set up and safeguard a two-layer retransmitting table, in table, add PVLAN ID, SVLAN ID, make and realize that the downlink port isolation need not to carry out the MAC copy in the PVLAN, directly inquire about this table and can realize transmitting.

The invention provides the method that downlink user is isolated in a kind of VLAN of realization, be applied to comprise at least two isolate mutually from VLAN SVLAN, at least one main VLAN PVLAN, and connect the system of switching equipment of described SVLAN and PVLAN, said method comprising the steps of:

Set up binding relationship between PVLAN and the SVLAN at switching equipment;

For each port of switching equipment is provided with vlan information under the port;

According to the binding relationship of vlan information and described PVLAN and SVLAN under described each port, be provided with and safeguard the forwarding-table item of MAC Address, PVLAN and the SVLAN of the equipment that includes port, links to each other with this port;

When the port of switching equipment receives to be E-Packeted that the network equipment sends, target MAC (Media Access Control) address, PVLAN and the SVLAN information of described message and MAC Address, PVLAN and the SVLAN in the described forwarding-table item are mated, obtaining corresponding port in the described forwarding-table item, and be that outbound port is transmitted described waiting and E-Packeted with described port.

The PVLAN of the equipment that described setting and maintenance include port, link to each other with this port and the forwarding-table item of SVLAN specifically comprise:

For each port of switching equipment is provided with port identification information, utilize described port identification information to identify SVLAN and PVLAN under each port.

The forwarding-table item of MAC Address, PVLAN and the SVLAN of the equipment that described setting and maintenance include port, link to each other with this port specifically comprises:

Switching equipment is learnt the source MAC of message, inserts the vlan information and the ingress port information of described message again.

Switching equipment is learnt specifically to comprise to the source MAC of message:

Carry out source MAC matched and searched according to receiving message,, then set up new list item if do not have; If the coupling list item is arranged, then determine whether described list item is refreshed.

Describedly carry out also comprising after the MAC matched and searched of source according to receiving message:

Judge in the described list item VLAN whether with the port of described reception message under VLAN identical, if different, then with VLAN in the VLAN replacement list item under the port of described reception message;

If identical, judge then whether the destination slogan in the list item is identical with the destination slogan of described reception message, if different, then use the destination slogan in the destination slogan substitution table item of described reception message, if identical, then matched and searched success.

In described switching equipment, port register is set, be used to store each port from VLAN ID SVLAN_ID, main VLAN ID PVLAN_ID and outbound port information D PORT;

For the message from the SVLAN port, the MAC in the port parameter of described reception message is that message source MAC Address, PVLAN are that PVLAN_ID, SVLAN in the described port register is that SVLAN_ID, DPORT in the described port register is described port id;

For the message from the PVLAN port, the MAC in the port parameter of described reception message is that message source MAC Address, PVLAN are that PVLAN_ID, SVLAN in the described port register is 0, DPORT is described port id.

MAC Address, PVLAN and SVLAN in described target MAC (Media Access Control) address with described message, PVLAN and SVLAN information and the described forwarding-table item mate, and specifically comprise:

Carry out purpose MAC matched and searched according to receiving message,, then transmit described message according to described purpose MAC if having, if no, then broadcast described message, make the purpose network equipment receive described broadcasting packet after, return response message, finish the inquiry of target MAC (Media Access Control) address.

Binding relationship between described PVLAN of foundation and the SVLAN specifically comprises:

In described switching equipment configuration PVLAN and SVLAN binding;

Described switching equipment adds PVLAN with up going port, PVLAN is set and carries out untag with the message of the SVLAN of this PVLAN binding and transmits;

Described switching equipment adds SVLAN with down going port, this SVLAN is set and carries out untag with the message of the PVLAN of this SVLAN binding and transmits.

The present invention also provides the switching equipment that downlink user is isolated in a kind of VLAN of realization, is applied to comprise in the system of at least two SVLAN, at least one PVLAN that isolate mutually, comprising:

Binding relationship is set up the unit, is used to set up the binding relationship between PVLAN and the SVLAN;

Forwarding-table item is provided with the unit, be used to each port of switching equipment that the affiliated vlan information of port is set, and, be provided with and safeguard the forwarding-table item of MAC Address, PVLAN and the SVLAN of the equipment that includes port, links to each other with this port according to the binding relationship of vlan information and described PVLAN and SVLAN under described each port;

The message retransmission unit, when being used to receive to be E-Packeted that the network equipment sends, target MAC (Media Access Control) address, PVLAN and the SVLAN information of described message and MAC Address, PVLAN and the SVLAN in the described forwarding-table item are mated, obtaining corresponding port in the described forwarding-table item, and be that outbound port is transmitted described waiting and E-Packeted with described port.

Described binding relationship is set up the unit and is specifically comprised:

Up going port binding subelement adds PVLAN with up going port, PVLAN is set and carries out untag with the message of the SVLAN of this PVLAN binding and transmits;

Down going port binding subelement adds SVLAN with down going port, this SVLAN is set and carries out untag with the message of the PVLAN of this SVLAN binding and transmits.

Described binding relationship is set up the unit and is also comprised:

Sign is provided with subelement, is used to each port of switching equipment that port identification information is set, and utilizes described port identification information to identify each port affiliated SVLAN and PVLAN.

Described forwarding-table item is provided with the unit and specifically comprises:

Source MAC matched and searched subelement is used for carrying out source MAC matched and searched according to receiving message, if do not have, then sets up new list item; If the coupling list item is arranged, then determine whether this list item is refreshed according to timer;

Purpose MAC matched and searched subelement is used for carrying out purpose MAC matched and searched according to receiving message, if having, then transmits described message according to described purpose MAC, if do not have, then broadcasts described message.

Described message retransmission unit specifically comprises:

Forwarding-table item is safeguarded subelement, when being used to receive to be E-Packeted that the network equipment sends, according to the attribute information inquiry of described message and safeguard described forwarding-table item;

Purpose inquiry subelement, be used in described port place VLAN and with other VLAN of this VLAN binding in the search purposes network equipment, and carry out message and transmit.

Have prior art to compare, the present invention has the following advantages:

In the embodiment of the invention, make full use of the two-layer retransmitting table list item resource of switch, the number of users that very big increase can insert; The pressure to system of avoiding a large amount of MAC copies of software to bring increases the stability of a system and maintainability; In addition, under the same subscriber scale, because two layers of list item reduce greatly, it is faster to table look-up, and improves forward efficiency.

Description of drawings

Fig. 1 is that schematic diagram is inserted in the sub-district in the prior art;

Fig. 2 is the method flow diagram that downlink user is isolated in a kind of VLAN of realization in the embodiment of the invention;

Fig. 3 is a MAC matched and searched flow chart in up going port source in the embodiment of the invention;

Fig. 4 is a MAC matched and searched flow chart in down going port source in the embodiment of the invention;

Fig. 5 is a kind of switching equipment structure chart in the embodiment of the invention.

Embodiment

Core concept of the present invention is: set up in switching equipment and safeguard a two-layer retransmitting table item, add PVLAN_ID, SVLAN_ID in list item, make that realizing that down going port is isolated in the PVLAN need not to carry out the MAC copy, directly inquires about this list item and can realize transmitting.

Below in conjunction with drawings and Examples, the specific embodiment of the present invention is described in further detail.With the SW1 among Fig. 1 is that example describes, and in order to satisfy the application demand of Fig. 1, SW1 has divided three VLAN:VLAN2, VLAN3, VLAN4.

Step s101, set up binding relationship between PVLAN and the SVLAN at switching equipment, and vlan information under the port is set for each port of switching equipment, and a data structure (SVLAN_EN who is used to write down the binding relationship between each VLAN is set in switching equipment, SVLAN_ID, PVLAN_ID).For example, set up the binding relationship of PVLAN (main VLAN) VLAN2 and SVLAN (from VLAN) VLAN3 and VLAN4 at SW1, that is: VLAN2 is PVLAN, and VLAN3, VLAN4 are the SVLAN with the VLAN2 binding.

For up going port P4 and P5, these two ports add PVLAN (VLAN2, the i.e. PVID=2 of this port), require up going port to allow PVLAN (VLAN2) on the software processes and carry out untag (not marking) with the message of the SVLAN (VLAN3 and VLAN4) of this PVLAN binding and transmit, the data structure of port P4 (SVLAN_EN, SVLAN_ID, PVLAN_ID)=(0,0,2).

For down going port P1, the user disposes this port and adds SVLAN (VLAN3, the i.e. PVID=3 of this port), requires down going port to allow this SVLAN (VLAN3) on the software processes and carry out untag with the message of the PVLAN (VLAN2) of this SVLAN binding and transmit, after the user adds a SVLAN with down going port, the register SVLAN_EN position of this port is set as 1, the data structure of port P1 (SVLAN_EN, SVLAN_ID, PVLAN_ID)=(1,3,2);

For down going port P2, identical with the data structure of P1, do not giving unnecessary details;

For down going port P3, and the port data structure (SVLAN_EN, SVLAN_ID, PVLAN_ID)=(1,4,2).

Wherein, data structure (SVLAN_EN, SVLAN_ID, PVLAN_ID) can be stored in PVLAN/SVLAN enable with the mapping relations register in, this register takies 25bit in the present embodiment, in different embodiment, the length of this register can change.As shown in table 1,0bit in the register is from VLAN enable bit SVLAN_EN, and the different values of this enable bit can represent whether port enables, for example in the present embodiment, this bit position being made as 1 o'clock port enabling SVLAN, is not enable SVLAN (default value is 0) at 0 o'clock on port; 1-12bit is the value (default value is 0) of SVLAN_ID, and this value is provided with when port adds SVLAN, and value is SVLAN_ID; 13bit-24bit is the value (default value is port PVLAN_ID) of PVLAN_ID, and this value is provided with when port adds SVLAN, and value is the PVLAN_ID of SVLAN binding.

Table 1:

SVLAN_EN	PVLAN	SVLAN
SVLAN_EN	PVLAN	SVLAN	0bit	1-12bit	13-24bit

Step s102 is provided with the forwarding-table item that comprises network appliance address and the affiliated vlan information of the network equipment.Under initial condition, two-layer retransmitting table among the SW1 is empty, have only after SW1 receives message, just begin to set up two-layer retransmitting table, transmitting foundation is by after source MAC (SMAC) study of switching equipment to message, insert that the VLAN of message and ingress port information etc. finish, the forwarding-table item of foundation is that to receive purpose for switching equipment be that the message of this MAC is tabled look-up and transmitted again; After a message enters switching equipment, can carry out table lookup operation twice to forwarding-table item: be source MAC matched and searched for the first time, purpose is to find out that this message source MAC wants study, if promptly do not mate list item then will set up new list item, has the coupling list item to see whether this list item will refresh again; Be purpose MAC matched and searched for the second time, purpose is that message is transmitted to the place that this goes, if can not find the just broadcasting of this place of going, makes the purpose network equipment of receiving this broadcasting packet return response message, finishes searching of the purpose network equipment.

Step s103, when the port of switching equipment receives to be E-Packeted that the network equipment sends, described forwarding-table item is inquired about and safeguarded to attribute information according to described message, in described port place VLAN and with other VLAN of this VLAN binding in the search purposes network equipment, carry out message and transmit.

In addition, forwarding-table item can also wear out to the list item in the two-layer retransmitting table after setting up.The dynamic entry aging mechanism is identical with current device, if ageing timer does not have message source MAC to mate this list item before overtime, and the then aging deletion of this list item.Static MAC configuration distributing is to two-layer retransmitting table, and list item adds PVLAN, SVLAN field according to PVLAN_ID in the port data structure and SVLAN_ID.In addition, the deletion of the MAC address entries in the two-layer retransmitting table can be tabled look-up separately according to conditions such as MAC, PVLAN, SVLAN, PORT, STATUS and be deleted or make up the deletion of tabling look-up among the SW1.

Forwarding-table item setting up procedure among the step s102 wherein is for distinguishing to some extent from the message of PVLAN and SVLAN.Message enters two layers of forwarding logic of certain port, and switching equipment will judge earlier whether this port is the SVLAN port, if enable with the mapping relations register in this port SVLAN_EN be 1, illustrate that then this port is a down going port, enter down going port source MAC matched and searched flow process; If SVLAN_EN is 0, illustrate that then this port is up going port (or common port), enters up going port source MAC matched and searched flow process.

Up going port source MAC matched and searched flow process specifically may further comprise the steps as shown in Figure 3:

Step s201, up going port source MAC matched and searched: search by source MAC, PVLAN_ID coupling two-layer retransmitting table item MAC, PVLAN,, then change step s202, have the coupling list item, then change step s203 if do not mate.

Step s202, MAC learns to message source, adds dynamic entry at two-layer retransmitting table: MAC=message source MAC, PVLAN=PVLAN_ID, SVLAN=0, DPORT=go into PORT ID, and the MAC ageing timer is set.

There is the coupling list item in step s203, and switching equipment need judge whether list item SVLAN is 0, if be 0, then changes step s204, if be not 0, then changes step s205.

Step s204, SVLAN are 0 o'clock, and switching equipment also need judge DPORT and whether go into PORT identical, if DPORT with go into the identical explanation of PORT source MAC and exist, change step s206.If inequality, then change step s205.

Step s205, when list item is the static configuration list item, list item is constant, and with packet loss, forwarding process is ended; When list item is a dynamic entry, message source MAC is learnt to cover former list item: MAC=message source MAC, PVLAN=PVLAN_ID, SVLAN=0, DPORT=go into PORT ID.And the MAC ageing timer is set.

Step s206, DPORT with go into the identical explanation two-layer retransmitting table of PORT in for the list item of source MAC has existed, do not handle for static entry, refresh the MAC ageing timer for dynamic entry, change step s207.

Set up process through above-mentioned steps s201 to two layers of list item of step s206, all receive the message of the main frame that connects separately when each port after, the last formation of SW1 two-layer retransmitting table as shown in table 2.

Table 2:

MAC	PVLAN	SVLAN	DPORT	STATUS
MAC	PVLAN	SVLAN	DPORT	STATUS	MAC1	2	3	P1	dynamic
MAC2	2	3	P2	dynamic	MAC1	2	3	P1	dynamic
MAC2	2	3	P2	dynamic	MAC3	2	4	P3	dynamic
MAC4	2	0	P4	dynamic	MAC3	2	4	P3	dynamic
MAC4	2	0	P4	dynamic	MAC5	2	0	P5	dynamic

Forwarding-table item in the table 2 is saved 7 of forwarding-table items than original scheme, near 60%.And if under the network environment of a large number of users and up server, this numerical value can be bigger.After promptly adopting new departure, same system can insert more users, for operator saves cost, increases profit.In addition, need not software and carry out a large amount of MAC copy work, mitigation system burden, lifting reliability.Under the same subscriber scale, because two layers of list item reduce greatly, it is faster to table look-up, and improves forward efficiency.

Step s207 searches whether there is the coupling list item by DMAC and PVLAN, if exist, then changes step s209, otherwise changes step s208.

Step s208, this message of broadcasting in the VLAN that port adds.

Step s209 judges whether the SVLAN in the target MAC (Media Access Control) address list item equates with the SVLAN_ID of message inbound port register, or the SVLAN_ID of message inbound port register is 0, or the SVLAN that extracts in the purpose MAC address entries is 0; If satisfy, then change step s210, otherwise continue to search next list item.

Step s210 presses list item indication DPORT with message and transmits.

Wherein, down going port source MAC matched and searched flow process specifically may further comprise the steps as shown in Figure 4:

Step s301 carries out matched and searched by source MAC, judges the list item that whether exists in the two-layer retransmitting table with this source MAC coupling, if do not mate list item, the list item of not setting up this source MAC in the two-layer retransmitting table is described, change step s302, if have the coupling list item, then change step s303.

Step s302 learns the source MAC of this reception message, adds dynamic entry in two-layer retransmitting table: MAC=message SMAC, PVLAN=PVLAN_ID, SVLAN=SVLAN_ID, DPORT=inlet PORT ID; And the MAC ageing timer is set, change step s308 then.

There is the coupling list item in step s303, judges whether the list item SVLAN in the two-layer retransmitting table is identical with the SVLAN_ID that enables with the mapping relations register, if identical, then changes step s304, if different, then changes step s305.

Step s304, judge DPORT and this message in the two-layer retransmitting table whether go into PORT identical, if identical, then change step s306, if different, illustrate that then variation has taken place the inbound port of this message, change step s307.

Step s305, SVLAN is different with SVLAN_ID, needs to judge whether the PVLAN of two-layer retransmitting table item is identical with port PVLAN_ID.If PVLAN is identical with PVLAN_ID, illustrate that then variation has taken place the SVLAN under the MAC of source, change step s308, PVLAN is different with PVLAN_ID, then shows source MAC this list item that do not match, and returns step s301 and continues to search next bar list item.

Step s306, DPORT with go into the identical explanation two-layer retransmitting table of PORT in for the list item of source MAC has existed, do not handle for static entry, refresh the MAC ageing timer for dynamic entry, change step s308.

Step s307, when list item was the static configuration list item, the list item in the two-layer retransmitting table was constant, and with this packet loss, forwarding process is ended; When list item is a dynamic entry, MAC learns to message source, covers the list item in the former two-layer retransmitting table: MAC=source MAC, and PVLAN=PVLAN_ID, SVLAN=SVLAN-ID, DPORT=goes into PORT_ID, and the MAC ageing timer is set; Change step s308.

Step s308 searches whether there is the coupling list item by DMAC and PVLAN, if exist, then changes step s309, otherwise changes step s311.

Step s309 judges whether the SVLAN in the target MAC (Media Access Control) address list item equates with the SVLAN_ID of message inbound port register, or the SVLAN_ID of message inbound port register is 0, or the SVLAN that extracts in the purpose MAC address entries is 0; If satisfy, then change step s310, continue to search next list item otherwise change step s308.

Step s310 presses list item indication DPORT with message and transmits.

Step s311, this message of broadcasting in the VLAN that port adds.

Use with networking shown in Figure 1 up going port of the present invention source MAC matched and searched flow process is described.When PC1 visit SERVER2, it is MAC1 that PC1 sends source MAC, target MAC (Media Access Control) address is that the message of the MAC5 of SERVER2 enters SW1, in SW1, carry out source MAC study, PVLAN/SVLAN according to port enables and mapping relations register SVLAN_EN=1, and the information of SLVAN=3, PVLAN=2 of having extracted has been set up two layers of list item such as table 3:

Table 3

MAC	PVLAN	SVLAN	DPORT	STATUS
MAC	PVLAN	SVLAN	DPORT	STATUS	MAC1	2	3	P1	dynamic

When searching target MAC (Media Access Control) address and be the MAC5 of SERVER2 according to MAC5+VLAN2 (PVLAN), discovery can't be found then message is broadcasted in SVLAN, and SERVER2 receives the message that PC1 broadcasting is come; Because when enabling to be provided with the mapping relations register, SVLAN and PVLAN are bound, therefore, SERVER2 can receive the broadcasting packet from PC1.

Use with networking shown in Figure 1 down going port of the present invention source MAC matched and searched flow process is described.It is MAC5 that SERVER2 sends the message source MAC Address of responding PC1, target MAC (Media Access Control) address is that the message of the MAC1 of PC1 enters SW1, in SW1, carry out source MAC study, PVLAN/SVLAN according to port enables and mapping relations register SVLAN_EN=0, has extracted SLVAN=0, PVLAN=2 and has set up two layers of list item such as table 4:

List item 4

MAC	PVLAN	SVLAN	DPORT	STATUS
MAC	PVLAN	SVLAN	DPORT	STATUS	MAC5	2	0	P5	dynamic

When searching target MAC (Media Access Control) address and be the MAC1 of PC1, MAC=MAC1, the PVLAN=2 in the list item 3, the list item of SVLAN=3 have been found, according to mating in the SVLAN of regular message inbound port and two layers of list item according to MAC1+VLAN2 (PVLAN); The SVLAN that extracts equates or is arbitrary to be 0 to be considered as hitting, (be in the target MAC (Media Access Control) address list item SVLAN with equate by the SVLAN that extracts in the source MAC or source MAC in the SVLAN that extracts be 0 or the target MAC (Media Access Control) address list item in SVLAN be 0) then message transmit toward port P1 according to this list item, PC1 has received the back message using that SERVER2 sends.

Can hit list item 4 when follow-up PC1 visits SERVER2 once more and carry out the clean culture forwarding.And PC2 and PC3 visit Server2 also can mate this list item clean culture and transmit.

In addition, PC2, PC3 visit PC1 process, as above routine, system can set up the forwarding-table item of the MAC of coupling PC2 by hardware study respectively, as table 5; Set up the forwarding-table item of the MAC of coupling PC3, as table 6.

Table 5:

MAC	PVLAN	SVLAN	DPORT	STATUS
MAC	PVLAN	SVLAN	DPORT	STATUS	MAC2	2	3	P2	dynamic

Table 6:

MAC	PVLAN	SVLAN	DPORT	STATUS
MAC	PVLAN	SVLAN	DPORT	STATUS	MAC3	2	4	P3	dynamic

When coupling purpose MAC1, the message that PC2 sends can hit the list item 3 of example, because from the SVLAN of inlet extraction and equating of list item 3, PC2 and PC1 can realize exchanging visits; And the message that PC3 sends because, two SVLAN are not 0 and unequal again, can't mate, and can only broadcast in VLAN4, PC1 can't receive that PC1 and PC3 have realized isolation.

The present invention also provides the switching equipment that downlink user is isolated in a kind of VLAN of realization, as shown in Figure 5, be applied to comprise at least two from the system of SVLAN, at least one main PVLAN, comprising: binding relationship is set up unit 100, is used to set up the binding relationship between PVLAN and the SVLAN; Forwarding-table item is provided with unit 200, is used to each port of switching equipment that the affiliated vlan information of port is set, and the forwarding-table item that comprises network appliance address and the affiliated vlan information of the network equipment is set; Message retransmission unit 300, when being used to receive to be E-Packeted that the network equipment sends, according to the inquiry of the attribute information of described message and safeguard described forwarding-table item, in described port place VLAN and with other VLAN of this VLAN binding in the search purposes network equipment, carry out message and transmit.

Described binding relationship is set up unit 100 and is specifically comprised: up going port binding subelement 110, be used for up going port is added PVLAN, and PVLAN is set and carries out untag with the message of the SVLAN of this PVLAN binding and transmit; Down going port binding subelement 120 is used for down going port is added SVLAN, this SVLAN is set and carries out untag with the message of the PVLAN of this SVLAN binding and transmits; Sign is provided with subelement 130, is used to each port of switching equipment that port identification information is set, and utilizes described port identification information to identify each port affiliated SVLAN and PVLAN.

Described forwarding-table item is provided with unit 200 and specifically comprises: source MAC matched and searched subelement 210, be used for carrying out source MAC matched and searched according to receiving message, and if do not have, then set up new list item; If the coupling list item is arranged, then determine whether this list item is refreshed according to a series of judgements; Purpose MAC matched and searched subelement 220 is used for carrying out purpose MAC matched and searched according to receiving message, if having, then transmits described message according to described purpose MAC, if do not have, then broadcasts described message.

Message retransmission unit 300 specifically comprises: forwarding-table item is safeguarded subelement 310, when being used to receive to be E-Packeted that the network equipment sends, according to the attribute information inquiry of described message and safeguard described forwarding-table item; Purpose inquiry subelement 320, be used in described port place VLAN and with other VLAN of this VLAN binding in the search purposes network equipment, and carry out message and transmit.

The above only is a preferred implementation of the present invention; should be pointed out that for those skilled in the art, under the prerequisite that does not break away from the principle of the invention; can also make some improvements and modifications, these improvements and modifications also should be considered as protection scope of the present invention.

Claims

1, a kind of method that realizes that downlink user is isolated in the VLAN, be applied to comprise at least two isolate mutually from VLAN SVLAN, at least one main VLAN PVLAN, and connect the system of switching equipment of described SVLAN and PVLAN, it is characterized in that, said method comprising the steps of:

Set up binding relationship between PVLAN and the SVLAN at switching equipment;

2, realize the method that downlink user is isolated in the VLAN according to claim 1, it is characterized in that the PVLAN of the equipment that described setting and maintenance include port, link to each other with this port and the forwarding-table item of SVLAN specifically comprise:

3, realize the method that downlink user is isolated in the VLAN according to claim 1, it is characterized in that the forwarding-table item of MAC Address, PVLAN and the SVLAN of the equipment that described setting and maintenance include port, link to each other with this port specifically comprises:

4, as described in claim 3, realize the method that downlink user is isolated in the VLAN, it is characterized in that switching equipment is learnt specifically to comprise to the source MAC of message:

5, it is characterized in that the method that downlink user is isolated in the VLAN as realizing as described in the claim 4, describedly carry out also comprising after the MAC matched and searched of source according to receiving message:

6, as described in claim 4, realize the method that downlink user is isolated in the VLAN, it is characterized in that, in described switching equipment, port register is set, be used to store each port from VLAN ID SVLAN_ID, main VLAN ID PVLAN_ID and outbound port information D PORT;

7, realize the method that downlink user is isolated in the VLAN according to claim 1, it is characterized in that, MAC Address, PVLAN and SVLAN in described target MAC (Media Access Control) address with described message, PVLAN and SVLAN information and the described forwarding-table item mate, and specifically comprise:

8, realize the method that downlink user is isolated in the VLAN according to claim 1, it is characterized in that the binding relationship between described PVLAN of foundation and the SVLAN specifically comprises:

In described switching equipment configuration PVLAN and SVLAN binding;

9, a kind of switching equipment of realizing that downlink user is isolated in the VLAN is applied to comprise in the system of at least two SVLAN, at least one PVLAN that isolate mutually, it is characterized in that, comprising:

10, as described in claim 9, realize the switching equipment that downlink user is isolated in the VLAN, it is characterized in that described binding relationship is set up the unit and specifically comprised:

11, as described in claim 10, realize the switching equipment that downlink user is isolated in the VLAN, it is characterized in that described binding relationship is set up the unit and also comprised:

12, as described in claim 9, realize the switching equipment that downlink user is isolated in the VLAN, it is characterized in that described forwarding-table item is provided with the unit and specifically comprises:

13, as described in claim 9, realize the switching equipment that downlink user is isolated in the VLAN, it is characterized in that described message retransmission unit specifically comprises: