CN107547403A

CN107547403A - Message forwarding method, assisted method, device, controller and main frame

Info

Publication number: CN107547403A
Application number: CN201710619933.2A
Authority: CN
Inventors: 宋小恒
Original assignee: New H3C Technologies Co Ltd
Current assignee: New H3C Technologies Co Ltd
Priority date: 2017-07-26
Filing date: 2017-07-26
Publication date: 2018-01-05
Anticipated expiration: 2037-07-26
Also published as: CN107547403B

Abstract

The application provides a kind of message forwarding method, and this method includes：Given host in RDCS as other host gateways ensures that data message is reachable between main frame and gateway to network notifications address properties information, SDN controllers by predetermined protocol massages according to address attribute information；Given host establishes special line using the egress gateways equipment PGW in the main subnet of ip address and user's private data central site PDCS；For the data message that purpose IP address is subnet of ip address in PDCS, to being sent to PGW by special line after data message progress special line encapsulation.The application can allow enterprise customer independently to carry out special line deployment between RDCS and PDCS, avoid cumbersome application operation, while high degree avoids public cloud egress gateways equipment CGW because disposing a large amount of special lines and caused performance bottleneck.

Description

Message forwarding method, assisted method, device, controller and main frame

Technical field

The application is related to data communication technology, more particularly to a kind of message forwarding method, assisted method, device, controller And main frame.

Background technology

Large enterprise would generally build one or more data center's website (Data Center Site, DCS), multiple DCS can be deployed in different physical regions, can typically pass through special line (Virtual Private Network, VPN) phase Even, so as to form the data center on a whole meaning, this contributes to service response of the enterprise to its operational line, also The robustness of operational line can be strengthened, to accidents such as anti-disasters.

With the development of cloud computing technology, present enterprise can be provided by renting network, storage and the calculating of public cloud Source creates new data center's website (Rent Data Center Site, RDCS), to tackle the need of elastic calculation Will.For example for the ticket booking for ticketing website/inquiry service, booking demand meeting pole during spring transportation increases considerably；Voluntarily The resource such as purchase calculating and storage obviously can cause greatly to waste, because once having crossed spring transportation, such demand again can be significantly Degree reduces.The resource of public cloud is rented to tackle burst flow be more rational method.

Public cloud can be understood as the large-scale data center website in a physical significance, and it is by way of virtualization etc. Data center's website on logical meaning, i.e. RDCS are provided for enterprise (also referred to as tenant).Enterprise as tenant can omit The cost safeguarded to physical resource, such as server power-off protection and disaster-tolerant backup etc..

As it was previously stated, it would generally be connected between different DCS by special line.If each DCS is that enterprise is one's own Private data central site (Private Data Center Site, PDCS), then deployment special line is easier, it is only necessary to Special line as such as IPSec is disposed between two PDCS egress gateways equipment.But if one of website is The data center website RDCS that enterprise rents from public cloud, another website are that user oneself is privately owned, then deployment is got up just It is cumbersome.

Specifically, by taking this special line deployment of ipsec tunnel as an example, user is on the one hand needed in the private site of oneself IPSec configurations are carried out in egress gateways equipment (Private Gateway, PGW), while also need to the service provider of public cloud at this Configured in the egress gateways equipment (Cloud Gateway, CGW) of public cloud.Because CGW is not to be controlled by enterprise customer , therefore enterprise customer can only file an application to publicly-owned cloud service provider, be done by the technical staff of publicly-owned cloud service provider on CGW IPSec is configured.Due to being usually deployed substantial amounts of RDCS in public cloud, it means that needed it is desirable that RDCS and PDCS is interconnected by special line The enterprise customer asked is very more, may exceed tens thousand of.For the service provider of public cloud, on the one hand substantial amounts of special line is matched somebody with somebody Put need of work and consume huge manpower, on the other hand, carrying is thousands of so tens of thousands of individual IPSec as special line, one can be caused As CGW be difficult to the pressure for bearing this special line management and maintenance.

The content of the invention

In view of this, the application provides a kind of message forwarding method, and methods described is applied to main frame, and the main frame is positioned at use In the data center website RDCS that family is rented in public cloud, this method includes：

The address properties information that main frame itself configures is sent by predetermined protocol massages；Wherein described address category Property information include one or more subnet of ip address and MAC Address, one or more of subnet of ip address include specifying Main subnet of ip address；

Use the egress gateways equipment in the main subnet of ip address and the private data central site PDCS of the user PGW establishes special line；

Gateway ip address is configured in the subnet of ip address by the main frame received in one or more of subnets Other main frames send data message when, if the purpose IP address of the data message be PDCS in subnet of ip address, root According to default forward table to being sent to the PGW by the special line after data message progress special line encapsulation.

The application also provides a kind of main frame, including processor, internal memory and nonvolatile memory, and the main frame is positioned at use In the data center website RDCS that family is rented in public cloud, wherein the nonvolatile memory refers to including some computers Order, the processor run those computer instructions to perform including following processing procedure：

Also a kind of message forwarding assisted method of the application, applied on the SDN controllers in public cloud, this method includes：

SDN controllers receive from user in the data center website RDCS that public cloud is rented given host it is predetermined During protocol massages, obtain and preserve the address properties information of the given host of predetermined protocol message carrying, the address Attribute information includes：Main subnet of ip address, other subnet of ip address and MAC Address corresponding with each subnet of ip address；

SDN controllers create corresponding flow table item and are simultaneously issued in network so that given host with the RDCS other Using the given host as being that data message is reachable between the main frame of gateway；

SDN controllers notice public cloud egress gateways CGW is public network IP address corresponding to the main subnet of ip address distribution.

The application also provides a kind of SDN controllers, including processor, internal memory and nonvolatile memory, wherein described Nonvolatile memory includes some computer instructions, and the processor runs those computer instructions to perform including following place Reason process：

The application also provides a kind of apparatus for forwarding message, and applied to main frame, the main frame is located at user and rented in public cloud In data center website RDCS, the device includes：

Attribute propagation module, the address properties information for main frame itself to be configured are sent out by predetermined protocol massages Go；Wherein described address properties information includes one or more subnet of ip address and MAC Address, one or more of subnets IP address includes the main subnet of ip address specified；

Special line management module, for using the main subnet of ip address and the private data central site PDCS of the user Interior egress gateways equipment PGW establishes special line；

Data forwarding module, for receiving the subnet of ip address by the main frame in one or more of subnets When being configured to the data message of other main frames transmission of gateway ip address, if the purpose IP address of the data message is in PDCS Subnet of ip address, then it is described to being sent to after data message progress special line encapsulation by the special line according to default forward table PGW。

The application also provides a kind of forwarding of message and assists device, applied on the SDN controllers in public cloud, the device bag Include：

Attribute acquisition module, user specified master in the data center website RDCS that public cloud is rented is derived from for receiving During the predetermined protocol message of machine, obtain and preserve the address properties information of the given host of predetermined protocol message carrying, The address properties information includes：Main subnet of ip address, other subnet of ip address and MAC corresponding with each subnet of ip address Address；

List item processing module, for creating corresponding flow table item and being issued in network so that given host with it is described Other are using the given host as being that data message is reachable between the main frame of gateway in RDCS；

Device control module, for notifying public cloud egress gateways CGW for public affairs corresponding to the main subnet of ip address distribution Net IP address.

Compared to prior art, technical scheme that the application provides can allow enterprise customer independently RDCS and PDCS it Between carry out special line deployment, avoid cumbersome application operation, while substantial amounts of CGW can be needed to special line management and the dimension undertaken Share tasks are protected to the given host of each enterprise customer, high degree avoids CGW and produced because above-mentioned special line is disposed Performance bottleneck.

Brief description of the drawings

Fig. 1 is a kind of typical data center's website special line internet Organization Chart.

Fig. 2 is data center's website special line internet Organization Chart in one example of the application.

Fig. 3 A are the flow charts of message forwarding assisted method in one example of the application.

Fig. 3 B are the flow charts of message forwarding method in the application another example.

Fig. 3 C are SDN controllers in one example of the application, the schematic diagram of main frame mutual cooperation.

Fig. 4 is the basic hardware structure chart of main frame or SDN controllers in one example of the application.

Fig. 5 is that the extension of LLDP messages uses schematic diagram in one example of the application.

Fig. 6 is the structural representation of apparatus for forwarding message in one example of the application.

Fig. 7 is the structural representation that device is assisted in message forwarding in the application another example.

Embodiment

Fig. 1 is refer to, which depict the data center that enterprise customer in one exemplary of the application rents in public cloud Website (Rented Data Center Site, RDCS) and privately owned data center's website (the Private Data of the enterprise customer Center Site, PDCS) interconnection the network architecture.RDCS may generally be considered as public cloud and be used by virtualization technology for enterprise Family provide with PDCS functionally roughly the same data center's websites, but RDCS is on logical meaning, can in public cloud To create many RDCS for being under the jurisdiction of different enterprise customers.

In the example depicted in figure 1, include multiple main frames (below by taking virtual machine VM as an example) in RDCS, be respectively VM1021、VM1022、VM1023.Include VM1024 in PDCS.Because these main frames belong to enterprise customer, therefore enterprise customer Wish that all VM in RDCS can realize that intranet data communicates with VM1024.Change from the point of view of an angle, enterprise customer wishes Data communication between VM1022 and V1024 can facilitate with VM1022 as VM1023.For the latter, this is undoubtedly Need there is special line between RDCS and PDCS, the otherwise communication of internal network can not pellucidly pass through public between RDCS and PDCS Net (such as internet).

Please continue to refer to Fig. 1, in the conventional technology, the special line between RDCS and PDCS is typically established at going out in public cloud Between mouth gateway device CGW1011 and PDCS egress gateways equipment PGW1012.For example, the dotted line blank arrowhead in Fig. 1 Data communication path is represented, when VM1022 and VM1024 enter row data communication, data message that VM1022 is sent, which arrives first at, to be connect Enter equipment, such as VXLAN access devices (VTEP), then reach CGW1011 via VXLAN tunnels.It is each wherein in public cloud Being established between individual VTEP and SDN controllers has SDN connections (such as Openflow connections), for receiving the control of SDN controllers. SDN controllers can be according to the abundant comprehensive network topological information of its acquisition, to VTEP and other SDN switches or similar Equipment issues various flow table items (being referred to as " forwarding-table item "), to allow the network equipments such as VTEP correctly to forward its reception The data message arrived.This process is current popular SDN technologies, is no longer thoroughly discussed herein.

Next, CGW1011 unloads data message from VXLAN tunnels the initial data message for obtaining main frame transmission (this process also referred to as decapsulates)；Then CGW1011 can inquire about forward table according to the purpose IP address of data message and determine The outgoing interface and next-hop of the data message.In this example, outgoing interface is leased-line interface, and next-hop is PGW1012, then CGW1011 is sent to PGW1012 after carrying out special line encapsulation to data message.At PGW1012, data message is by it from special line Unloading is got off, and is determined to forward the message to VM2024 according to the purpose IP address of data message.Message reaches from PGW1012 VM2024 process can follow existing design, no longer be described in detail one by one.

Fig. 1 illustrate only the RDCS of an enterprise customer, but in fact generally have thousands of enterprise in public cloud Industry user rents the service of its data center, that is to say, that the maintenance and management for having the special line between a large amount of RDCS and PDCS all exists Carried out on CGW, CGW single point pressure is very big.

Fig. 2 is refer to, in one example of the application, RDCS sides use given host, such as VM2021, to simulate one Individual virtual gateway device (VGW).VGW undertakes special line management and maintenance work by CGW is substituted.On the one hand such mode can subtract Few CGW consumes in the ample resources for establishing, managing and safeguarding user's special line, because given host as VM2021 is dispersed in respectively In the RDCS that individual enterprise customer rents.On the other hand, the application can also simplify the flow that enterprise customer disposes special line, simple next Say, enterprise customer can dispose the mode of corresponding software to realize VGW on appropriate main frame, without to publicly-owned cloud service Business files an application, because in the conventional technology, CGW administrative power is simultaneously not belonging to enterprise customer, but belongs to publicly-owned cloud service provider. Correspondingly, publicly-owned cloud service provider is also without there is special technical staff to carry out demand as artificial treatment user, it is only necessary to logical The SDN controllers of public cloud are crossed to coordinate VGW to work.

Fig. 2, Fig. 3 A, Fig. 3 B and Fig. 3 C are refer to, the application provides special line interconnection scheme between a kind of data center's website, Coordinated by a main frame specified in RDCS and the SDN controllers of public cloud and realized.Given host referred to herein can be certain Operation VM on individual physical server or the physical server.SDN controllers generally also can be a physical server ( It can be understood as physical host).For convenience's sake, in this application, when speaking of host hardware, physics master is typically referred to Machine.And when speaking of main frame, it can be physical host or be VM.

Described to further simplify, the basic hardware structure of main frame and SDN controllers may be referred in the application Fig. 4 example, although in fact generally having the difference on hardware between the two, basic hardware framework can be identical. The handling process of host computer side can run computer software by a certain given host in RDCS and realize, the handling process of SDN sides It can also be realized by the computer software run on SDN controllers.Physical host 400 in wherein Fig. 4 includes processor 401st, nonvolatile memory 402, communication bus 403 and network interface 404.Main frame or the SDN control either specified The each step performed on device, all it is that processor 401 reads some calculating from nonvolatile memory 402 in hardware view Machine readable instruction is to run realization.

Refer to shown in Fig. 2, in one example, the main frame specified is VM2021, VM2021 be provided with advance one or Multiple subnet of ip address, one of subnet of ip address are designated as main subnet of ip address.In order to simplify description and convenient understanding, If it is equal to a double layer network without specified otherwise, a subnet below.Such as VM2021 belongs to double layer network when creating 100, such as VLAN100, subnet of ip address 10.11.1.129 is provided with, now can be using 10.11.1.129 as specifying Main subnet of ip address.And VM2021 can also subsequently configure other subnet of ip address.

After VM2021 reaches the standard grade, it is assumed that it belongs to subnet 1, and its double layer network is identified as VLAN100, automatically or manually matches somebody with somebody The subnet of ip address put is 10.11.1.129, and the keeper of enterprise customer can subsequently continue as VM2021 and configure other subnets IP address.In the ideal case, the IP address of each subnet in RDCS is configured with VM2021, each subnet is configured on VM2021 Other VM gateway ip address in IP address i.e. each subnet.Such as there are two subnet 10.11.1.0/24 in RDCS And 10.11.2.0/24, VM2021 then two subnet of ip address of corresponding configuration, respectively 10.11.1.129 and 10.11.2.129. In this application, the default gateway address of each VM (such as VM2023) can configure wherein in subnet 1 (10.11.1.0/24) For 10.11.1.129, the default gateway address of each VM (such as VM2022) is configurable in subnet 2 (10.11.2.0/24) 10.11.2.129.This that is VM2021 be other main frames in each subnet in RDCS default gateway.

For VM2021, although the gateway as other VM, it still can configure the gateway of oneself, such as It is 10.11.1.254 for gateway address corresponding to subnet of ip address 10.11.1.129 configurations, corresponding to 10.11.2.129 configurations Gateway address is 10.11.2.254.These configuration process may rely on automatically configuring for the agreements such as DHCP, can also be by enterprise Keeper's manual configuration of user.After the completion of these configurations, other main frames in addition to VM2021 need to carry out across son When net sends datagram, these main frames can send data message to gateway (VM2021) to realize that the data across subnet are led to Letter, VM2021 carry out three layers of forward process to the data message from these other VM, and also referred to as Internet forwards.

Please continue to refer to Fig. 2, Fig. 3 A, Fig. 3 B and Fig. 3 C, SDN controllers 2031 and given host VM2021 in the application Mutual cooperation realizes that special line interconnects.

In SDN controllers side, handling process includes：

Step 301, SDN controllers receive the predetermined protocol message from VM2021, obtain the boss's net wherein carried IP address and other subnet of ip address；

Step 302, SDN controllers create corresponding flow table item and are issued in network, with ensure other described VM with It is that data message is reachable between VM2021；

Step 303, SDN controllers notice CGW is public network IP address corresponding to the main subnet of ip address distribution；

In given host VM2021 sides, handling process includes：

Step 311, VM2021 sends the configuration address attribute information of itself by predetermined protocol massages；Wherein The address properties information includes one or more subnet of ip address and MAC Address, one or more of subnet of ip address Include the main subnet of ip address specified；

Step 312, VM2021 establishes special line using the main subnet of ip address and PGW；

Step 313, when receiving the data message that other main frames are sent in one or more of subnets, for purpose IP address is the data message of subnet of ip address in PDCS, is sent to after special line encapsulation is carried out to the data message by special line PGW。

Step 311, step 301, step 302 are primarily to ensure in RDCS that the data messages that send of other VM can be Two layers successfully reach corresponding to gateway, i.e. VM2021.Because when All hosts cross over subnetwork communicating, first have at two layers smoothly Data message is sent to gateway.Fig. 2 is refer to, for subnet 2 (10.11.2.0/24), it is assumed that double layer network identifies It is VLAN200.Because VM2021 is configured with the IP address 10.11.2.129 of subnet 2, this address is other VM in subnet 2 Gateway address.When other VM need to communicate with other subnets VM in subnet 2, it needs the MAC that gateway is known by ARP protocol Address, the purpose MAC of message is set to the MAC Address of gateway, is subsequently sent to gateway, i.e. VM2021.In this process, it is sub The message that main frame is sent in net 2, its VLAN carried mark is 200, and may be configured as when VM2021 is initial VLAN100, and the physical host where VM2021 may be found that the VLAN marks of the message are 200 when receiving the message, and Do not have VM on this physical host and belong to VLAN200, can then abandon the data message.That is, if not done by The processing of the above-mentioned several steps of the application, the data message that other the interior VM of subnet 2 are sent are had no idea to reach VM2021, also just talked Not upper follow-up VM2021 forward process.

Fig. 3 C and Fig. 5 are refer to, in one example, in order to avoid the generation of the above situation, the application step 311 In, after multiple subnet of ip address are configured with, it can be belonged to VM2021 by predetermined protocol massages to notice the address of itself Property information, say by Neighbor Discovery Protocol (LLDP) message carry address properties information to VTEP3 notice.It is a kind of typical Extended mode is exactly to increase multiple TLV to carry VM2021 subnet of ip address information and mac address information.One of them TLV is the main IP TLV (Main IP TLV) specified, and for carrying main subnet of ip address information, other are Sub IP TLV, is used To carry other subnet of ip address information.VTEP3 is sent in meeting after the LLDP messages of VM2021 transmissions are received from access interface Handled to SDN controllers 2031, because LLDP messages are the protocol massages for belonging to control plane processing.SDN controllers 2031 connect After receiving LLDP messages, MAC Address, main subnet of ip address and other subnet of ip address can be parsed from LLDP messages, Then save MAC Address is corresponding with each subnet of ip address.In addition, on line in running, VM2021 can determine When send LLDP messages, message carries newest address properties information, during to increase or delete some subnet of ip address newly, SDN controllers 2031 can know the change of VM2021 address properties information in time.

Because SDN controllers preserve address properties information, such as VM2021 MAC Address and all-ones subnet IP address pair It should be related to, therefore it can respond the ARP request message of other VM transmissions exactly.Asked assuming that the VM2022 of subnet 2 sends ARP The MAC Address corresponding to acquisition 10.11.2.129 is sought, that is, asks its gateway VM2021 MAC Address.The ARP request meeting VTEP2 is first reached, because ARP is protocol massages, therefore the ARP request is sent to SDN controllers 2031 by VTEP2；SDN is controlled The VM2021 IP address and the corresponding relation of MAC Address that device 2031 preserves according to itself respond the ARP request, then VM2022 VM2021 MAC Address (hereinafter referred to as GMAC) can be obtained.Same reason VM2023 can also be obtained by ARP request 10.11.1.129 corresponding MAC Address (GMAC), detailed process is no longer described in detail.After above-mentioned steps, each height in RDCS Other VM in net can or its gateway MAC Address.

Assuming that VM2022 needs to send datagram to VM2023, this is the communication across subnet to VM2022, is then counted It will be arranged to GMAC according to the target MAC (Media Access Control) address of message, then send.As it was previously stated, under normal circumstances, data message It is that can not correctly reach VM2021.The processing of the application step 302 takes full advantage of the flexibility of SDN controllers so that reporting Text can be reached correctly.In step 302, SDN controllers can calculate other VM arrival such as VM2022 VM2021 path, so The various SDN switches on the path including VTEP equipment issue necessary flow table item afterwards, it is ensured that message can reach VM2021 access device VTEP3；This process is common processing, is no longer described in detail.In this application, SDN controllers issue Flow table item to VTEP3 has more processing.

Table 1

It refer to shown in table 1, data flow characteristics refer to that other VM are sent to the feature of VM2021 data messages, and this can be with By SDN controllers arbitrarily according to definition is actually needed, in general, VM2021 MAC Address, i.e. GMAC can be included in feature. More processing are action part, and the application has increased the modification of VLAN marks newly.Assuming that VM2022 send data message to VTEP3 is reached, because VM2022 belongs to VLAN200, therefore the VLAN marks carried in data message are 200.And VTEP3 can Unloading acquisition initial data message in VXLAN tunnels is being finished according to action 1 with elder generation, the unloading of VXLAN tunnels is common technique, herein No longer it is described in detail.Then the VLAN of data message mark can be revised as 100 by VTEP according to action 2, that is, by data message VLAN mark be revised as the affiliated double layer network of main frame corresponding to the target MAC (Media Access Control) address of data message VLAN mark, Ran Houzai VM2021 is sent to, now the physical host belonging to VM2021 finds itself have VM to belong to VLAN100, then would not be because of VLAN marks mismatch and abandon the data message.It is two-way when being communicated due to data, therefore SDN controllers 2031 can be given VTEP2 issues similar list item, and only modification action is that VLAN marks are revised as into 200 from 100, principle be it is consistent, no It is described in detail again.

The foregoing describe and how to realize that the data message between other VM and VM2021 can be reached mutually.Next proceed to retouch State how VM2021 realizes its gateway function, assist RDCS and PDCS to realize that special line interconnects instead of CGW2011.

In step 303, SDN controllers 2031 be VM2021 with distributing public network IP corresponding with main subnet of ip address Location.In realization, SDN controllers notice CGW2011 is main subnet of ip address one public network IP address of corresponding distribution, such as 20.5.1.1.This special corresponding relation will be described in detail in subsequent step.It is worth noting that in Fig. 2, although 20.5.1.1 the position in figure is located at below VM2021, but actually this public network IP address 20.5.1.1 is disposed on In address conversion NAT modules on CGW2011, merely just for more pictute.

In preferable example, public network IP address 20.5.1.1 deployment special line corresponding with main subnet of ip address uses Public network IP address, the various messages to be carried on special line provide NAT services, and it is different from CGW2011 and provides General N AT services. Such as the 20.6.1.1 illustrated in Fig. 2, this public network IP address 20.6.1.1 main function are as a large amount of in public cloud Main frame (including VM in other RDCS) accesses the public network IP address used during public network, such as VM2022 accesses some internet Website, then the source IP address of its data message sent can be converted into 20.6.1.1, different VM meeting when passing through CGW2011 Words can be distinguished by the port numbers of message, and this is typical NAT processes, is not described in detail herein.

As it was previously stated, VM2021 is a given host as other VM gateways, in specific example, in Fig. 2 VM2021 can come " promoting " be virtual gateway device VGW by way of installing software, be one or more in RDCS Other main frames in net provide three layers of forwarding service.Out of subnet for other main frames of being serviced, it generally only knows gateway Address information.By taking IPv4 as an example, the information such as gateway ip address, subnet mask are commonly configured with the IP protocol stack of main frame.Such as Preceding described, main frame further can obtain gateway MAC address corresponding with gateway ip address by ARP protocol, therefore substantially Perception of the main frame for gateway is realized indirectly by the configuration of the IP protocol stack of itself.As it was previously stated, RDCS in other When VM accesses the main frame of other subnets, when either accessing the main frame in RDCS, or accessing the main frame in long-range PDCS, it is sent out The inevitable VM2021 all first reached as its gateway of data message gone out.

The VM that VM in RDCS is accessed in PDCS needs to forward by VM2021, and VM2021 can be in step 312 The middle connection for creating special line and realizing RDCS and PDCS.In general, VM2021 is according to user's (typically enterprise customer's management Member) instruct to realize that special line is disposed.The keeper of enterprise customer can sign in VM2021 come hand by way of Telnet Dynamic to create special line, keeper can also create special line by SDN controllers.So that special line is ipsec tunnel as an example, on VM2021 It can be understood as being mounted with the corresponding software module for supporting ipsec tunnel agreement., will in ipsec tunnel connection procedure is built Ipsec tunnel is initiated using the PGW2012 to main subnet of ip address and opposite end to connect.

During tunnel creation, VM2021 and PGW2012 will send various ipsec protocol messages mutually to create tunnel Road, these protocol massages include the protocol massages of multiple steps such as security negotiation, specifically may be referred to IPSec relevant criterions. During tunnel creation, from the point of view of VM2021 sides, tunnel source address is 10.11.1.129, and destination address is PGW IP Location 30.6.1.1, tunnel next hop address are the gateway ip address 10.11.1.254 of itself.Same reason, on PGW2012 The connection of corresponding tunnel is established, from the point of view of PGW2012, its tunnel source address is 30.6.1.1, destination address 20.5.1.1, It is exactly public network IP address 20.5.1.1 corresponding with main subnet of ip address 10.11.1.129, because channel message is passing through During CGW2011, the source address 10.11.1.129 of channel message can be converted to 20.5.1.1 by CGW2011 NAT modules.One In individual preferable example, public network IP address 20.5.1.1 is unique corresponding, this corresponding pass with primary ip address 10.11.1.129 The meaning of system is that more special line agreements can be adapted to, and it is not TCP/UDP reports to have the message used during the foundation of some special lines Text, therefore, it is difficult to the main frame of data message is distinguish between with the port numbers in message during NAT.

From the above, it can be seen that the starting point of special line is no longer going out for public cloud between RDCS and PDCS in this application Mouthful gateway device CGW2011, in fact the starting point of this special line become a main frame in RDCS, i.e. VM2012.On the one hand, The application can remove the trouble that user files an application to publicly-owned cloud service provider from, it is allowed to which enterprise customer more neatly exists Build special line between RDCS and PDCS, for example, use itself more preference special line technology and the safety of more preference or other set Put.On the other hand, tunnel connection no longer needs to be deployed in the egress gateways equipment of public cloud as IPSec.Equivalent to big The IPSec establishment of connections and maintenance task of amount are distributed in public cloud on some main frame in the RDCS of each enterprise customer, CGW loads can be reduced with high degree, avoid the problem of CGW turns into performance bottleneck.

Fig. 2 is refer to, after ipsec tunnel creates.From the point of view of logic level, each subnet and PDCS in RDCS The Internet interconnection for the inside that interior each subnet can is formed by this ipsec tunnel on logical meaning.VM2021 Three node layers as structure in-house network network layers interconnection need to undertake three layers of forwarding task.

Unlike gateway in traditional sense, VM2021 does not simultaneously need especially complex forward table to design.For one Three common node layers, for example router, forward table are typically what control plane generated.In one example, VM2021 can be with The function of the complex control aspect such as Routing Protocol need not be supported to generate forwarding-table item, need not can also be controlled by SDN Device issues flow table item.In this example, VM2021 can realize data message by inquiring about the forward table pre-defined Forwarding.

Sequence number	Purpose IP address	Outgoing interface	Next-hop
				1	10.11.1.0/24	Network interface	It is direct-connected
2	10.11.2.0/24	Network interface	It is direct-connected
				3	10.10.1.0/24	Leased-line interface	CGW
4	It is default	Network interface	CGW
				……	……	……	……

Table 2

It refer to table 2 to illustrate, for the network environment in Fig. 2, the upper predetermined forward tables of VM2021 include 4 in table 2 List item records, wherein first and second list items represent that the purpose IP address of data message is the IP in subnet 1 and subnet 2 respectively During address, the outgoing interface of data message is ordinary network interface.3rd list item represents that data message destination address is subnet 3 During (10.10.1.0/24) interior IP address, the outgoing interface of data message is leased-line interface.Wherein it should be noted that leased-line interface The often interface on logical meaning.The next-hop represent how to determine corresponding to target MAC (Media Access Control) address.It is such as direct-connected Main frame, purpose MAC are exactly MAC Address corresponding to purpose IP address in ARP.

The data message gone out for leased-line interface in interface, it is necessary to do ipsec tunnel encapsulation, equivalent to original An IPSec heading is encapsulated on the basis of IP datagram text again and forms channel message.The outer layer purpose IP of channel message Location is 30.6.1.1, and source IP address is main subnet of ip address 10.11.1.129.Then opposite end is sent to by tunnel PGW2012, as it was previously stated, when by CGW2011, the source IP address 10.11.1.129 of outer layer can be converted into 20.5.1.1. At PGW2012, channel message, which will be decapsulated, exposes original IP datagram text, then by PGW2012 according to IP datagram The purpose IP address inquiry forward table of text forwards the message to corresponding main frame.PGW2012 E-Packet to main frame process not It is described in detail again, may be referred to prior art realization.

Sequence number	Purpose IP address	Outgoing interface	Next-hop
				1	10.10.1.0/24	Leased-line interface	CGW
2	It is default	Network interface	CGW

Table 3

Table 3 is refer to, in another example, VM2021 employs more simple forward table, and VM2021 looks into execution Generally there was only two possibility in table.It can simplifiedly be interpreted as：The data message forwarded for needs, if the purpose of message Main frame representated by IP address is located in PDCS, and such data message can hit first list item, and then enter leased-line interface； If first list item can not be hit, Article 2 list item is hit, Article 2 list item can be understood as default list item, that is to say, that In addition to the data message for needing to forward by leased-line interface, it is in need three layers forwarding data messages pass through net Network interface is sent to CGW2011 and does three layers of forward process.

In this example, the message in addition to outgoing interface is leased-line interface, by being sent in the unification of default forwarding-table item Common three layers of forward process is done on to VM2021 gateway CGW2011, can so simplify VM2021 and be used as in forwarding characteristic Design complexities.Forwarding work is more left for CGW2011 to handle, and the forwarding of data message be exactly CGW2011 so Router or three-tier switch be good at.On the whole, in this example, VM2021 conducts, substitute CGW2011 special line maintenance and management task.If each enterprise customer uses this technology, that means on CGW2011 Originally needed in some given host that the special line safeguarded is distributed in each enterprise customer RDCS, efficiently avoid The performance bottlenecks of CGW2011 on a control level, for example establish and safeguard performance bottleneck caused by tunnel.And this example In, VM2011 is such can be given to CGW2011 to locate the data message forwarding task acquiescence inside most RDCS again Reason, takes full advantage of the powerful transfer capabilitys of CGW2011 again, because what router or interchanger be most good at is exactly data message Forwarding, comparatively the ability of key-course is generally all much smaller for the transfer capability of data plane.

Still by taking Fig. 2 as an example, VM2022 is sent to VM2023 data message, can enter VTEP first, pass through VXLAN tunnels Road is carried to up to its gateway VM2021, and VM2021 inquiries forward table forwards the message to VM2023, or is transmitted to CGW2011, VM2023 is transmitted to by CGW2011, refer to the message flow representated by the dotted line with filled arrows in Fig. 2 To.For reverse data message, reason is same.For example VM2023 is sent to VM2022 data message and equally By VM2021, process processing is similar as before.

VM2024 message is sent to for VM2022, VM2021 equally can be first reached by VTEP, VM2021 inquiries turn Deliver determination to go out from leased-line interface, CGW2011 is sent to after message then is done into tunnel encapsulation, at CGW2011 NAT PGW2012 is sent to after reason, is decapsulated at PGW2012, then inquires about forward table and determines to be transmitted to VM204, refer to band in Fig. 2 There is the message flow direction representated by the dotted line of hollow arrow.VM2021 data message is returned for VM2024, first reaches PGW2012 Place, tunnel encapsulation is done on PGW2012, is subsequently sent at CGW2011.CGW2011 can't decapsulate to tunnel, only It is accordingly to do NAT change process, CGW forwards the message to VM2021 according to channel message outer layer purpose IP address, VM2021 pairs Channel message decapsulation obtains original IP data message, determines to be transmitted to VM2022 further according to forward table.In some instances, VM2021 is mainly as use, but in fact VM2021 can equally provide the business service similar with other VM.And this Do not conflict with the role that it is served as a bit.

Fig. 6 is refer to, in one example, the application also provides a kind of apparatus for forwarding message 600 in host computer side, and it can be with Corresponding to the message forwarding logic shown in Fig. 4.The device 600 is applied to main frame, and the main frame is located at user in public cloud In the data center website RDCS of interior rental, the device 600 includes：Attribute propagation module 601, special line management module 602, data Forwarding module 603 and special line processing module 604.

The attribute propagation module 601, for the address properties information that main frame itself configures to be passed through into predetermined agreement report Text is sent；Wherein described address properties information includes one or more subnet of ip address and MAC Address, it is one or Multiple subnet of ip address include the main subnet of ip address specified；The special line management module 602, for using boss's net IP address establishes special line with the egress gateways equipment PGW in the private data central site PDCS of the user；The data turn Module 603 is sent out, for being configured to gateway in the subnet of ip address by the main frame received in one or more of subnets During the data message that other main frames of IP address are sent, if the purpose IP address of the data message is for subnet IP in PDCS Location, then according to default forward table to being sent to the PGW by the special line after data message progress special line encapsulation.

In one example, the special line is ipsec tunnel；Wherein described boss's net IP address and RDCS inner outlet gateways The first public network IP address configured on equipment CGW has corresponding relation, wherein first public network IP address is used for channel message NAT conversion；The second public network IP address is also configured with the CGW and is used for the NAT that main frame in RDCS accesses public network data message Conversion：If the purpose IP address that the data forwarding module 603 is additionally operable to the data message is subnet of ip address in RDCS Data message, then the data message is given to the gateway device of this main frame.In another example, the special line processing module 604, for from special line receive have special line encapsulation message when, by it is described with special line encapsulation message decapsulated Obtain initial data message；Wherein described data forwarding module 603 is additionally operable to enter initial data message according to default forward table Row forwarding.

Fig. 7 is refer to, in another example, the application also provides a kind of message forwarding and assists device 700, applied to public affairs Have on the SDN controllers in cloud, the device 700 includes attribute acquisition module 701, list item processing module 702 and equipment control Module 703.

The attribute acquisition module 701, for receiving the data center website RDCS for being derived from user and being rented in public cloud During the predetermined protocol message of interior given host, obtain and preserve the address category of the given host of predetermined protocol message carrying Property information, the address properties information include：Main subnet of ip address, other subnet of ip address and with each subnet of ip address pair The MAC Address answered；The list item processing module 702, for creating corresponding flow table item and being issued in network, so as to specify master Other are using the given host as being that data message is reachable between the main frame of gateway in machine and the RDCS；Device control module 703, notice public cloud egress gateways CGW are public network IP address corresponding to the main subnet of ip address distribution.

In other examples, the message forwarding assists device 700 also to include ARP processing modules 704, for receiving State other main frames be directed to given host ARP request when, according to the address properties information send arp response to it is described other master Machine.In other examples, moved wherein the flow table item for being issued to the access device of main frame in RDCS includes VLAN mark modifications Make；VLAN mark modifications act to be corresponded to for the VLAN marks of data message to be revised as to the target MAC (Media Access Control) address of data message The affiliated double layer network of main frame VLAN mark.

Figure 6 above and Fig. 7 example are made that the description of summary from virtual bench aspect, and more detailed realizations can be with With reference to the details of realizing in foregoing each method handling process, the detail of virtual bench aspect and method handling process aspect It is consistent, is no longer described in detail one by one here.

The preferred embodiment of the application is the foregoing is only, not limiting the application, all essences in the application God any modification, equivalent substitution and improvements done etc., should be included within the scope of the application protection with principle.

Claims

1. a kind of message forwarding method, it is characterised in that methods described is applied to main frame, and the main frame is located at user in public cloud In the data center website RDCS of interior rental, this method includes：

The address properties information that main frame itself configures is sent by predetermined protocol massages；Wherein described address properties letter Breath includes one or more subnet of ip address and MAC Address, and one or more of subnet of ip address include the master specified Subnet of ip address；

Built using the main subnet of ip address and the egress gateways equipment PGW in the private data central site PDCS of the user Vertical special line；

Receive the subnet of ip address by the main frame in one or more of subnets be configured to gateway ip address its During the data message that his main frame is sent, if the purpose IP address of the data message is subnet of ip address in PDCS, according to pre- If forward table by the special line after data message progress special line encapsulation to being sent to the PGW.

2. according to the method for claim 1, it is characterised in that：The special line is ipsec tunnel.

3. according to the method for claim 1, it is characterised in that：The main subnet of ip address and RDCS inner outlet gateway devices The first public network IP address configured on CGW has corresponding relation, wherein first public network IP address is used for the NAT of channel message Conversion；The second public network IP address is also configured with the CGW and is used for the NAT conversions that main frame in RDCS accesses public network data message.

4. according to the method for claim 1, it is characterised in that：Also include：

If the purpose IP address of the data message is the data message of subnet of ip address in RDCS, the data message is given to The gateway device of this main frame.

5. according to the method for claim 1, it is characterised in that：Also include：

When receiving the message with special line encapsulation from special line, it is former that the message with special line encapsulation is subjected to decapsulation acquisition Beginning data message, initial data message is forwarded according to default forward table.

6. a kind of main frame, the main frame is deployed in the data center website RDCS that user rents in public cloud when actually using In, it is characterised in that the main frame includes processor, network interface, memory and communication bus, wherein, processor, network connects Mouthful, memory completes mutual communication by communication bus；

Memory, for storing machine readable instructions；

Processor, for reading the machine readable instructions stored on the memory, require that 1-5 is any described with perform claim Method and step.

7. a kind of apparatus for forwarding message, applied to main frame, the main frame is located at the data-centric that user rents in public cloud In point RDCS, the device includes：

Attribute propagation module, the address properties information for main frame itself to be configured are sent by predetermined protocol massages； Wherein described address properties information includes one or more subnet of ip address and MAC Address, one or more of subnet IP Address includes the main subnet of ip address specified；

Special line management module, in the private data central site PDCS using the main subnet of ip address and the user Egress gateways equipment PGW establishes special line；

Data forwarding module, for being configured in the subnet of ip address by the main frame received in one or more of subnets For gateway ip address other main frames send data message when, if the purpose IP address of the data message be PDCS in subnet IP address, then according to default forward table to being sent to the PGW by the special line after data message progress special line encapsulation.

8. device according to claim 7, it is characterised in that：The special line is ipsec tunnel.

9. device according to claim 7, it is characterised in that：The main subnet of ip address and RDCS inner outlet gateway devices The first public network IP address configured on CGW has corresponding relation, wherein first public network IP address is used for the NAT of channel message Conversion；The second public network IP address is also configured with the CGW and is used for the NAT conversions that main frame in RDCS accesses public network data message.

10. device according to claim 7, it is characterised in that：If the data forwarding module is additionally operable to the datagram The purpose IP address of text is the data message of subnet of ip address in RDCS, then the gateway that the data message is given to this main frame is set It is standby.

11. device according to claim 7, it is characterised in that：Also include：

Special line processing module, for from special line receive have special line encapsulation message when, by it is described with special line encapsulation Message carries out decapsulation and obtains initial data message；Wherein described data forwarding module is additionally operable to according to default forward table to original Data message is forwarded.

12. a kind of message forwards assisted method, applied on the SDN controllers in public cloud, this method includes：

SDN controllers receive the predetermined protocol from user's given host in the data center website RDCS that public cloud is rented During message, obtain and preserve the address properties information of the given host of predetermined protocol message carrying, the address properties Information includes：Main subnet of ip address, other subnet of ip address and MAC Address corresponding with each subnet of ip address；

SDN controllers create corresponding flow table item and are issued in network, so that other are with this in given host and the RDCS Given host is as being that data message is reachable between the main frame of gateway；

13. according to the method for claim 12, it is characterised in that also include：

SDN controllers receive other main frames be directed to given host ARP request when, according to the address properties information send Other described main frames are given in arp response.

14. according to the method for claim 12, it is characterised in that be wherein issued to the stream of the access device of main frame in RDCS List item includes VLAN mark modification actions；VLAN mark modifications are acted for the VLAN marks of data message to be revised as into data The VLAN marks of the affiliated double layer network of main frame corresponding to the target MAC (Media Access Control) address of message.

15. a kind of SDN controllers, it is characterised in that it is total that the SDN controllers include processor, network interface, memory and communication Line, wherein, processor, network interface, memory completes mutual communication by communication bus；

Memory, for storing machine readable instructions；

Processor, for reading the machine readable instructions stored on the memory, any institutes of 12-14 are required with perform claim The method and step stated.

16. device is assisted in a kind of message forwarding, applied on the SDN controllers in public cloud, the device includes：

Attribute acquisition module, user's given host in the data center website RDCS that public cloud is rented is derived from for receiving During predetermined protocol message, obtain and preserve the address properties information of the given host of predetermined protocol message carrying, it is described Address properties information includes：Main subnet of ip address, other subnet of ip address and MAC corresponding with each subnet of ip address Location；

List item processing module, for creating corresponding flow table item and being issued in network, so that in given host and the RDCS Other are using the given host as being that data message is reachable between the main frame of gateway；

Device control module, for notifying public cloud egress gateways CGW for public network IP corresponding to the main subnet of ip address distribution Address.

17. device according to claim 16, it is characterised in that also include：

ARP processing modules, when being directed to the ARP request of given host for receiving other described main frames, belonged to according to the address Property information send arp response to other described main frames.

18. device according to claim 16, it is characterised in that be wherein issued to the stream of the access device of main frame in RDCS List item includes VLAN mark modification actions；VLAN mark modifications are acted for the VLAN marks of data message to be revised as into data The VLAN marks of the affiliated double layer network of main frame corresponding to the target MAC (Media Access Control) address of message.