CN106878137B

CN106878137B - Route learning method and device

Info

Publication number: CN106878137B
Application number: CN201611251657.0A
Authority: CN
Inventors: 肖湘光; 程臻; 汪亮
Original assignee: Hangzhou H3C Technologies Co Ltd
Current assignee: Hangzhou H3C Technologies Co Ltd
Priority date: 2016-12-29
Filing date: 2016-12-29
Publication date: 2020-08-04
Anticipated expiration: 2036-12-29
Also published as: CN106878137A

Abstract

The application provides a route learning method and a device, wherein the method comprises the following steps: when receiving an EVPN route from a target interface, judging whether the EVPN route carries Route Distinguisher (RD) information and Route Target (RT) information of a first VPN or not; the first VPN corresponds to EVPN PEER established by target VTEP equipment and remote VTEP equipment; if yes, determining that the EVPN route needs to be learned; otherwise, the EVPN route is refused to be learned. By applying the embodiment of the application, the EVPN PEER route can be isolated from other routes, and the security of the EVPN network is improved.

Description

Route learning method and device

Technical Field

The present application relates to the field of network communication technologies, and in particular, to a method and an apparatus for route learning.

Background

AN EVPN (Ethernet Virtual Private Network) is a two-layer VPN (Virtual Private Network), a control plane adopts MP-BGP (Multi Protocol Border Gateway Protocol) to announce EVPN routing information, a data plane adopts VX L AN (Virtual Extensible local Area Network) encapsulation mode to forward messages, when physical sites of tenants are dispersed at different positions, the EVPN can provide two-layer interconnection for the same subnet of the same tenant based on the existing service provider or enterprise IP (Internet) Network, three-layer interconnection is provided for different subnets of the same tenant through AN EVPN Gateway, and three-layer interconnection with AN external Network is provided for the same subnet.

EVPN not only inherits the advantages of MP-BGP and VX L AN, but also provides new functions.

The configuration is simplified, namely VTEP (VX L AN Tunnel End Point ) automatic discovery, VX L AN Tunnel automatic establishment and VX L AN Tunnel and VX L AN automatic association are realized through MP-BGP, manual configuration of a user is not needed, and the network deployment difficulty is reduced.

Separating the control plane from the data plane: the control plane is responsible for issuing routing information, and the data plane is responsible for forwarding messages, so that the division of labor is clear, and the management is easy.

Support for symmetric IRB (Integrated Bridging and Routing): MP-BGP simultaneously publishes the Media Access Control (MAC) address of the second layer and the routing information of the third layer, and VTEP can carry out the forwarding of the second layer and the routing of the third layer. Therefore, the method can ensure that the traffic is forwarded by adopting the optimal path and can reduce the broadcast traffic.

Disclosure of Invention

The application provides a route learning method and device, which are used for realizing the isolation of an EVPN Peer route from other routes and improving the safety of an EVPN network.

According to a first aspect of the embodiments of the present application, there is provided a route learning method, which applies a virtual extensible local area network tunnel endpoint target VTEP device in an ethernet virtual private network EVPN networking network, where each VTEP device in the EVPN networking network establishes an EVPN PEER based on a virtual private network VPN instance, the method including:

when receiving an EVPN route from a target interface, judging whether the EVPN route carries Route Distinguisher (RD) information and Route Target (RT) information of a first VPN or not; the target VTEP device establishes an EVPNPEER based on the first VPN with a remote VTEP device through the target interface;

if yes, determining that the EVPN route needs to be learned;

otherwise, the EVPN route is refused to be learned.

According to a second aspect of the embodiments of the present application, there is provided a route learning apparatus, which applies a virtual extensible local area network tunnel endpoint target VTEP device in an ethernet virtual private network EVPN networking, where each VTEP device in the EVPN networking establishes an EVPN PEER based on a virtual private network VPN instance, the apparatus including:

a receiving unit, configured to receive an EVPN route;

the judging unit is used for judging whether the EVPN route carries route distinguisher RD information and route target RT information of the first VPN or not when the receiving unit receives the EVPN route from the target interface; the target VTEP equipment establishes an EVPN PEER based on the first VPN with remote VTEP equipment through the target interface;

the learning unit is used for determining that the EVPN route needs to be learned if the EVPN route carries RD information and RT information of the first VPN; otherwise, the EVPN route is refused to be learned.

By applying the embodiment of the application, each VTEP device in an EVPN networking establishes an EVPNPEER based on a VPN instance, judges whether an EVPN route carries RD information and RT information of a first VPN or not when receiving the EVPN route from a target interface, and determines that the EVPN route needs to be learned when the EVPN route carries the RD information and the RT information of the first VPN; otherwise, the EVPN route is refused to be learned, the isolation of the EVPN Peer route from other routes is realized, and the safety of the EVPN network is improved.

Drawings

Fig. 1 is a schematic diagram of an EVPN networking architecture;

fig. 2 is a schematic flowchart of a route learning method according to an embodiment of the present application;

fig. 3 is a schematic structural diagram of a route learning apparatus according to an embodiment of the present application;

fig. 4 is a schematic structural diagram of another route learning apparatus provided in an embodiment of the present application;

fig. 5 is a schematic structural diagram of another route learning apparatus according to an embodiment of the present application.

Detailed Description

In the networking shown in fig. 1, it is assumed that all MSE (Multiple Service Edge) devices are configured with EVPN and play a role of VTEP, and two-layer and three-layer forwarding is performed between the MSE devices through the EVPN, and the MSE also simultaneously plays a role of BRAS (Broadband Remote Access Server) Service and a role of general dedicated line Service (for example, MP L S (Multi-Protocol L exchange) VPN dedicated line), where the MSE devices interact with a Remote MSE device through a CR (Core Router).

Currently, PEERs established between EVPNs on MSE devices are based on public network/global, so that routes of the EVPN PEERs are mixed with other routes without isolation, which affects security of EVPN networks, such as security of L SN (L ocalService Node)/MSE in fig. 1.

In order to make the technical solutions in the embodiments of the present application better understood and make the above objects, features and advantages of the embodiments of the present application more comprehensible, the technical solutions in the embodiments of the present application are described in further detail below with reference to the accompanying drawings.

Referring to fig. 2, a schematic flow chart of a route learning method provided in an embodiment of the present application is shown, where the method may be applied to a target VTEP device in an EVPN networking, and as shown in fig. 2, the route learning method may include the following steps:

step 201, when receiving an EVPN route from a target interface, determining whether the EVPN route carries RD information and RT information of a first VPN; wherein the first VPN corresponds to EVPN PEER established by the target VTEP device and the remote VTEP device. If yes, go to step 202; otherwise, go to step 203.

In the embodiment of the application, the target VTEP device does not refer to a fixed VTEP device, but may refer to any VTEP device in the EVPN networking; similarly, the target interface does not refer to a fixed interface, but may refer to any logical interface on the target VTEP device for establishing the EVPN tunnel, and the following description of the present application is omitted.

In the embodiment of the application, in order to implement isolation between EVPN PEER routes and other routes and improve security of an EVPN network, when an EVPN PEER is established between VTEP devices, the EVPN PEER may be established based on a VRF (Virtual Routing Forwarding, which may also be referred to as a VPN instance), and when a VTEP device issues an EVPN route, identification information of a VPN instance needs to be carried in the EVPN route according to a VPN instance corresponding to the EVPN PEER established between the VTEP device and the remote VTEP device, so that the remote VTEP device may determine whether EVPN route learning needs to be performed according to the received identification information of the VPN instance carried in the EVPN route.

Accordingly, in this embodiment of the present application, when the target VTEP device receives the EVPN Route from the target interface, the target VTEP device needs to perform validity detection on the EVPN Route according to a VPN corresponding to the EVPN PEER established between the local terminal and the remote VTEP device (referred to as a first VPN, that is, the EVPN PEER established between the target VTEP device and the remote VTEP device is the EVPN PEER established based on the first VPN), and according to the first VPN, that is, determine whether the EVPN Route received from the target interface carries RD (Route Distinguisher) information and RT (Route target) information of the first VPN, so as to determine whether the EVPN Route needs to be learned.

In one embodiment of the present application, the route learning method provided by the present application may further include:

acquiring a first VPN corresponding to an EVPN PEER established by target VTEP equipment and remote VTEP equipment;

establishing a binding between the target interface and a first VPN;

correspondingly, the determining whether the EVPN route carries the RD information and the RT information of the first VPN may include:

and judging whether the EVPN route carries RD information and RT information of the first VPN or not according to the first VPN bound by the target interface.

In this embodiment, after establishing the EVPN PEER based on the VPN instance between the VTEP devices, the VPN instance may be bound on the logical interface of the EVPN tunnel.

When interaction between the VTEP devices is realized through a CR (Core Router), the VTEP devices can bind VPN instances on a logical interface of an EVPN tunnel established between the VTEP devices and the CR.

Correspondingly, when the target VTEP device receives the EVPN route from the target interface, in order to determine whether the EVPN route needs to be learned, the target VTEP device performs validity detection on the EVPN route according to the VPN (i.e., the first VPN) bound by the target interface, that is, determines whether the EVPN route received from the target interface carries RD information and RT information of the first VPN, so as to determine whether the EVPN route needs to be learned.

Step 202, determining that the EVPN route needs to be learned.

Step 203, refusing to learn the EVPN route.

In this embodiment of the application, if the target VTEP device determines that the EVPN route received from the target interface carries the RD information and the RT information of the first VPN, the target VTEP device may determine that the EVPN route passes the validity detection, and further, the target VTEP device may further analyze the EVPN route and learn the EVPN route.

If the EVPN route does not carry the RD information and the RT information of the first VPN, the target VTEP device may determine that the EVPN route does not pass the validity detection, and the target VTEP device may refuse to learn the EVPN route, for example, the target VTEP device may directly discard the EVPN route.

In one embodiment of the present application, after determining that the EVPN route needs to be learned, the method may further include:

and learning the EVPN route according to the RT information of the second VPN carried in the EVPN route.

In this embodiment, when an EVPN route is issued between EVPN PEERs, in addition to RD information and RT information of a VPN corresponding to the EVPN PEER need to be carried in the EVPN route, RT information of a VPN (referred to as a second VPN herein) to which the EVPN route belongs also needs to be carried.

Correspondingly, when the target VTEP device determines that it needs to learn the EVPN route received from the target interface, the target VTEP device may further obtain RT information of the second VPN carried in the EVPN route to determine the VPN to which the EVPN route belongs, and further learn the EVPN route according to the RT information of the second VPN.

when an EVPN route needs to be issued to the remote VTEP equipment, RD information and RT information of a third VPN are added to the EVPN route; wherein the target VTEP device and the remote VTEP device establish an EVPN PEER based on the third VPN;

and sending the EVPN route carrying the RD information and the RT information of the third VPN to the far-end VTEP equipment, so that the far-end VTEP equipment determines whether to learn the EVPN route according to the RD information and the RT information carried in the received EVPN route.

In this embodiment, when the target VTEP device needs to issue the EVPN Route to the remote VTEP device, the target VTEP device may add, in the EVPN Route, RD (Route Distinguisher) information and RT (Route target) information of a VPN (referred to herein as a third VPN, that is, an EVPN PEER established between the target VTEP device and the remote VTEP device based on the third VPN) corresponding to the EVPN PEER established between the target VTEP device and the remote VTEP device.

For example, assuming that EVPN PEERs are established between VTEP1 and VTEP2 based on VPN1, VTEP1 needs to add RD information and RT information of VPN1 in EVPN routes when VTEP1 needs to publish the EVPN routes to VTEP 2.

In this embodiment, after the RD information and the RT information of the third VPN are added to the EVPN route by the target VTEP device, the EVPN route carrying the RD information and the RT information of the third VPN may be sent to the remote VTEP device, and then the remote VTEP device may perform validity detection on the EVPN route according to the RD information and the RT information of the VPN carried in the received EVPN route to determine whether to learn the EVPN route.

It can be seen that, in the method flow shown in fig. 2, by establishing the EVPN PEER on the VPN instance and binding the corresponding VPN on the logical interface of the EVPN tunnel established on the VTEP device, when the VTEP device receives the EVPN route from the target interface, it can be determined whether the EVPN route carries the RD information and the RT information of the VPN bound by the target interface, and when the EVPN route is carried, it is determined that the EVPN route needs to be learned, otherwise, the EVPN route is rejected from being learned, so that the EVPN PEER route is isolated from other routes, and the security of the EVPN network is improved.

Further, in the embodiments of the present application, to achieve isolation between EVPN PEERs, a VTEP device may establish EVPN PEERs based on different VPN instances with different remote VTEP devices.

For example, VTEP1 may establish an EVPN PEER with VTEP2 based on VPN1, and establish an EVPN PEER with VTEP3 based on VPN2, when VTEP1 needs to issue an EVPN route to a remote VTEP device, the EVPN route issued to VTEP2 needs to carry RD information and RT information of VPN1, and the EVPN route issued to VTEP3 needs to carry RD information and RT information of VPN2, so that EVPN route isolation between different EVPN PEERs may be further implemented on the basis of EVPN route isolation from non-EVPN routes.

Accordingly, in the embodiment of the present application, the target VTEP device may establish the EVPN PEER based on a different VPN with a different remote VTEP device; or, the target VTEP device may also establish the EVPN PEER based on the same VPN with a different remote VTEP device.

Further, in this embodiment of the application, when the target VTEP device receives the data packet, the target VTEP device may determine a VPN (referred to as a fourth VPN herein) described in the data packet according to the L3 VNI (L eye-3 VX L AN ID, three-layer VX L AN identifier) carried in the data packet, and forward the data packet according to the identifier of the fourth VPN and the destination IP address of the data packet.

Specifically, when the target VTEP device receives a data packet sent by the remote VTEP device, for example, a data packet forwarded by the remote VTEP device through the CR, the target VTEP device may obtain L3 VNI in the data packet, and determine a VPN ID of a VPN to which the data packet belongs according to the L3 VNI, and further, the target VTEP device may search for a corresponding route in the VPN according to the VPN ID and a destination IP address of the data packet (the destination IP address refers to an inner layer destination IP address of the data packet, and is not a destination IP address of an EVPN tunnel), so as to forward the data packet.

In order to enable those skilled in the art to better understand the technical solutions provided in the embodiments of the present application, the technical solutions provided in the embodiments of the present application are described below with reference to specific application scenarios.

Taking the EVPN networking shown in fig. 1 as an example, in this embodiment, it is assumed that a VPN instance VPN1 is created between the MSE1 and the MSE2, and an EVPN PEER is established based on the VPN1, and the MSE1 binds the VPN1 (the VPN is a VPN to which a route corresponding to the EVPN PEER established between the MSE1 and the MSE2 belongs) on a logical interface (assumed to be interface a) of the EVPN tunnel established by the CR.

When the MSE1 needs to publish an EVPN route to the MSE2, the MSE1 needs to carry RD information and RT information of the VPN1 in the EVPN route.

It is worth to be noted that the EVPN route also carries RT information of a VPN to which the EVPN route (private network route) belongs, that is, the EVPN route needs to carry one RD information and two RT information.

Correspondingly, when the MSE1 receives the EVPN route from the interface a, the MSE1 needs to determine whether the EVPN route carries RD information and RT information of the VPN1 according to the VPN instance (i.e., the VPN1) bound to the interface a, and if the EVPN route carries RD information and RT information, the MSE1 determines that the EVPN route passes validity detection, and further analyzes and learns the EVPN route.

After the route learning is completed, when the data message is forwarded, the data message sent by the MSE1 from the CR to the MSE2 is forwarded by acquiring the VPNID corresponding to the VPN (assumed to be the VPN2) to which the message belongs according to the L3 VNI in the message, and searching the corresponding route in the corresponding VPN2 according to the destination IP of the VPNID + message.

As can be seen from the above description, in the technical solution provided in the embodiment of the present application, each VTEP device in the EVPN networking establishes an EVPN PEER based on a VPN instance, determines whether an EVPN route carries RD information and RT information of a first VPN when receiving the EVPN route from a target interface, and determines that the EVPN route needs to be learned when the EVPN route carries RD information and RT information of the first VPN; otherwise, the EVPN route is refused to be learned, the isolation of the EVPN Peer route from other routes is realized, and the safety of the EVPN network is improved.

Referring to fig. 3, a schematic structural diagram of a route learning apparatus provided in an embodiment of the present application is shown, where the route learning apparatus may be applied to a target VTEP device in the foregoing method embodiment, and as shown in fig. 3, the route learning apparatus may include:

a receiving unit 310, configured to receive an EVPN route;

a determining unit 320, configured to determine, when the receiving unit 310 receives the EVPN route from the target interface, whether the EVPN route carries the route specifier RD information and the route target RT information of the first VPN; wherein the first VPN corresponds to EVPN PEER of the target VTEP device and the remote VTEP device;

a learning unit 330, configured to determine that the EVPN route needs to be learned if the EVPN route carries RD information and RT information of the first VPN; otherwise, the EVPN route is refused to be learned.

Referring to fig. 4 together, a schematic structural diagram of another route learning device according to an embodiment of the present invention is shown in fig. 4, where, on the basis of the route learning device shown in fig. 3, the route learning device shown in fig. 4 may further include:

an obtaining unit 340, configured to obtain a first VPN corresponding to an EVPN PEER established by the target VTEP device and the remote VTEP device;

an establishing unit 350, configured to establish a binding between the target interface and the first VPN;

correspondingly, the determining unit 320 is specifically configured to determine, according to the first VPN bound to the target interface, whether the EVPN route carries RD information and RT information of the first VPN.

In an optional embodiment, the learning unit 330 is specifically configured to learn the EVPN route according to RT information of the second VPN carried in the EVPN route when it is determined that the EVPN route needs to be learned.

Referring to fig. 5 together, a schematic structural diagram of another route learning device provided in the embodiment of the present application is shown in fig. 5, where, on the basis of the route learning device shown in fig. 3, the route learning device shown in fig. 5 may further include:

an adding unit 360, configured to add, when the target VTEP device needs to issue an EVPN route to a remote VTEP device, route discriminator RD information and route target RT information of a third VPN in the EVPN route; the target VTEP device and the remote VTEP device establish an EVPN PEER based on the third VPN;

a sending unit 370, configured to send the EVPN route carrying the RD information and the RT information of the third VPN to the remote VTEP device, so that the remote VTEP device determines whether to learn the EVPN route according to the RD information and the RT information carried in the received EVPN route.

In an optional embodiment, the target VTEP device and different remote VTEP devices establish EVPN PEER based on different VPNs; or the target VTEP device and different remote VTEP devices establish the EVPN PEER based on the same VPN.

In AN optional embodiment, the sending unit 370 is specifically configured to, when the target VTEP device receives a data packet, determine a fourth VPN to which the data packet belongs according to a three-layer VX L AN identifier L3 VNI carried in the data packet, and forward the data packet according to the identifier of the fourth VPN and a destination IP address of the data packet.

The implementation process of the functions and actions of each unit in the above device is specifically described in the implementation process of the corresponding step in the above method, and is not described herein again.

For the device embodiments, since they substantially correspond to the method embodiments, reference may be made to the partial description of the method embodiments for relevant points. The above-described embodiments of the apparatus are merely illustrative, and the units described as separate parts may or may not be physically separate, and parts displayed as units may or may not be physical units, may be located in one place, or may be distributed on a plurality of network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the scheme of the application. One of ordinary skill in the art can understand and implement it without inventive effort.

As can be seen from the above embodiments, each VTEP device in the EVPN networking establishes an EVPN peer based on a VPN instance, determines whether the EVPN route carries RD information and RT information of a first VPN when receiving the EVPN route from a target interface, and determines that the EVPN route needs to be learned when the EVPN route carries RD information and RT information of the first VPN; otherwise, the EVPN route is refused to be learned, the isolation of the EVPN Peer route from other routes is realized, and the safety of the EVPN network is improved.

Other embodiments of the present application will be apparent to those skilled in the art from consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the invention following, in general, the principles of the application and including such departures from the present disclosure as come within known or customary practice within the art to which the invention pertains. It is intended that the specification and examples be considered as exemplary only, with a true scope and spirit of the application being indicated by the following claims.

It will be understood that the present application is not limited to the precise arrangements described above and shown in the drawings and that various modifications and changes may be made without departing from the scope thereof. The scope of the application is limited only by the appended claims.

Claims

1. A route learning method is applied to virtual extensible local area network tunnel endpoint target VTEP equipment in Ethernet virtual private network EVPN networking, and is characterized in that each VTEP equipment in the EVPN networking establishes an EVPN PEER Peer based on a virtual private network VPN instance, and the method comprises the following steps:

when receiving an EVPN route from a target interface, judging whether the EVPN route carries Route Distinguisher (RD) information and Route Target (RT) information of a first VPN or not; the first VPN corresponds to EVPN PEER established by target VTEP equipment and remote VTEP equipment;

if yes, determining that the EVPN route needs to be learned;

otherwise, the EVPN route is refused to be learned.

2. The method of claim 1, further comprising:

acquiring a first VPN corresponding to an EVPN PEER established by the target VTEP equipment and the remote VTEP equipment;

establishing a binding of the target interface and the first VPN;

the determining whether the EVPN route carries the RD information and the RT information of the first VPN includes:

3. The method of claim 1, wherein after determining that the EVPN route needs to be learned, further comprising:

learning the EVPN route according to the RT information of the second VPN carried in the EVPN route; wherein the second VPN is a VPN to which the EPVN route belongs.

4. The method of claim 1, further comprising:

when an EVPN route needs to be issued to the remote VTEP equipment, RD information and RT information of a third VPN are added to the EVPN route; the target VTEP device and the remote VTEP device establish an EVPN PEER based on the third VPN;

and sending the EVPN route carrying the RD information and the RT information of the third VPN to the far-end VTEP equipment, so that the far-end VTEP equipment determines whether the EVPN route needs to be learned according to the RD information and the RT information carried in the received EVPN route.

5. The method according to claim 1, wherein the target VTEP device establishes an EVPN PEER with a different remote VTEP device based on a different VPN; or the target VTEP device and different remote VTEP devices establish the EVPN PEER based on the same VPN.

6. The method of claim 1, further comprising:

when a data message is received, determining a fourth VPN to which the data message belongs according to three layers of VX L AN identifications L3 VNIs carried in the data message;

and forwarding the data message according to the identifier of the fourth VPN and the destination IP address of the data message.

7. A route learning device is applied to virtual extensible local area network tunnel endpoint target VTEP equipment in Ethernet virtual private network EVPN networking, and is characterized in that each VTEP equipment in the EVPN networking establishes an EVPN PEER PER based on a virtual private network VPN instance, and the device comprises:

a receiving unit, configured to receive an EVPN route;

the judging unit is used for judging whether the EVPN route carries route distinguisher RD information and route target RT information of the first VPN or not when the receiving unit receives the EVPN route from the target interface; the first VPN corresponds to EVPN PEER established by target VTEP equipment and remote VTEP equipment;

8. The apparatus of claim 7, further comprising:

an obtaining unit, configured to obtain a first VPN corresponding to an EVPN PEER established by the target VTEP device and the remote VTEP device;

an establishing unit, configured to establish a binding between the target interface and the first VPN;

the determining unit is specifically configured to determine, according to the first VPN bound to the target interface, whether the EVPN route carries route specifier RD information and route target RT information of the first VPN.

9. The apparatus of claim 7,

the learning unit is specifically configured to learn the EVPN route according to RT information of the second VPN carried in the EVPN route when it is determined that the EVPN route needs to be learned; wherein the second VPN is a VPN to which the EPVN route belongs.

10. The apparatus of claim 7, further comprising:

an adding unit, configured to add, when the target VTEP device needs to issue an EVPN route to a remote VTEP device, route discriminator RD information and route target RT information of a third VPN to the EVPN route; the target VTEP device and the remote VTEP device establish an EVPN PEER based on the third VPN;

and a sending unit, configured to send the EVPN route carrying the RD information and the RT information of the third VPN to the remote VTEP device, so that the remote VTEP device determines whether to learn the EVPN route according to the RD information and the RT information carried in the received EVPN route.

11. The apparatus of claim 7, wherein the target VTEP device establishes an EVPN PEER with a different remote VTEP device based on a different VPN; or the target VTEP device and different remote VTEP devices establish the EVPN PEER based on the same VPN.

12. The apparatus of claim 10,

the sending unit is further configured to determine, when the target VTEP device receives a data packet, a fourth VPN to which the data packet belongs according to a three-layer VX L AN identifier L3 VNI carried in the data packet, and forward the data packet according to the identifier of the fourth VPN and a destination IP address of the data packet.