CN110022262B - Method, system and device for realizing plane separation based on SDN (software defined network) - Google Patents

Method, system and device for realizing plane separation based on SDN (software defined network) Download PDF

Info

Publication number
CN110022262B
CN110022262B CN201810019109.8A CN201810019109A CN110022262B CN 110022262 B CN110022262 B CN 110022262B CN 201810019109 A CN201810019109 A CN 201810019109A CN 110022262 B CN110022262 B CN 110022262B
Authority
CN
China
Prior art keywords
arp
vrouter
flow table
routing
information
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Expired - Fee Related
Application number
CN201810019109.8A
Other languages
Chinese (zh)
Other versions
CN110022262A (en
Inventor
盛苏林
王仙平
庞俊英
吕屹
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Shanghai Layer Peak Network Technology Co ltd
Original Assignee
Shanghai Layer Peak Network Technology Co ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Shanghai Layer Peak Network Technology Co ltd filed Critical Shanghai Layer Peak Network Technology Co ltd
Priority to CN201810019109.8A priority Critical patent/CN110022262B/en
Publication of CN110022262A publication Critical patent/CN110022262A/en
Application granted granted Critical
Publication of CN110022262B publication Critical patent/CN110022262B/en
Expired - Fee Related legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/02—Topology update or discovery
    • H04L45/08—Learning-based routing, e.g. using neural networks or artificial intelligence
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/50—Routing or path finding of packets in data switching networks using label swapping, e.g. multi-protocol label switch [MPLS]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/74—Address processing for routing
    • H04L45/745—Address table lookup; Address filtering
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/09—Mapping addresses
    • H04L61/10—Mapping addresses of different types
    • H04L61/103—Mapping addresses of different types across network layers, e.g. resolution of network layer into physical layer addresses or address resolution protocol [ARP]

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Artificial Intelligence (AREA)
  • Evolutionary Computation (AREA)
  • Medical Informatics (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

The invention discloses a method for realizing plane separation based on an SDN network, which comprises the following steps: the SDN controller issues an ARP message flow table and an ip message flow table between a user router (CE) and a virtual router (vRouter) to an openflow switch, and establishes a virtual control link between the CE and the vRouter; the virtual control link is used for transmitting control flow; the vRouter acquires ARP information and routing information of each CE, sends the ARP information and the routing information to the SDN controller, and guides the SDN controller to issue a service data flow table to an openflow switch; the SDN controller issues an ARP request flow table and a service data flow table among the CEs to the openflow switch according to the ARP information and the routing information, and establishes virtual service data links among the CEs; the virtual service data link is used for transmitting service data messages. The invention realizes the decoupling of the network data forwarding plane and the routing control plane, and the access equipment of the network is only responsible for data forwarding, thereby improving the performance and stability of the equipment.

Description

Method, system and device for realizing plane separation based on SDN (software defined network)
Technical Field
The invention relates to the field of SDN communication, in particular to a method for realizing plane separation based on an SDN network. The invention simultaneously relates to a system for realizing plane separation based on the SDN network and a device for realizing plane separation based on the SDN network.
Background
The MPLS VPN is an IP-VPN based on MPLS technology, which applies the MPLS technology on network routing and switching equipment, simplifies the routing mode of a core router, utilizes an IP virtual private network (IP VPN) realized by label switching combined with the traditional routing technology, can be used for constructing broadband Intranet and Extranet, and meets various flexible service requirements.
MPLS VPNs are further subdivided into two-layer VPNs and three-layer VPNs according to whether a PE (Provider Edge Router) participates in VPN routing processing. The L2VPN/L3VPN is responsible for accessing service data of a user from a user side, then packaging the data into MPLS messages, entering the MPLS messages into a bound MPLS tunnel, transmitting the MPLS messages to an opposite terminal network, then unpacking the MPLS messages on network equipment at the opposite terminal, outputting the MPLS messages to an output interface of the L2VPN/L3VPN, and transmitting the MPLS messages to the user at the other terminal. MPLS is a bearer layer protocol, L2VPN is an application layer protocol for processing two-layer messages, and L3VPN is an application layer protocol for processing three-layer messages.
In order to implement three-layer interconnection between user networks in a conventional IP network, normal interaction of routing information between user branches is usually implemented by MPLS L3VPN technology, and user data is securely transmitted between sites in a VPN manner. As shown in fig. 1, a PE Router is deployed at the Edge of a network, a route is advertised between the PE Router and a customer CE (customer Edge Router) through BGP or other IGP routing protocols, and an L3VPN of MPLS is implemented between the PE routers through MP-BGP advertised route and private network label allocation.
In the above scheme, not only service provisioning and maintenance are complex, but also the PE router is used as a routing control device and also bears a data forwarding task between user networks, and both the routing function and the forwarding function may consume large network resources and router system resources, and have certain challenges on performance and stability of the PE router.
Disclosure of Invention
The invention provides a method for realizing plane separation based on an SDN (software defined network), which aims to solve the problems of cross-backbone network interconnection of the traditional user IP network, route learning among user networks and poor performance, stability and expansibility caused by the coupling of a forwarding function and a routing function of access equipment.
The invention provides a method for realizing plane separation based on an SDN network, which comprises the following steps:
the SDN controller issues an ARP message flow table and an ip message flow table between a user router (CE) and a virtual router (vRouter) to an openflow switch, and establishes a virtual control link between the CE and the vRouter; the virtual control link is used for transmitting control flow;
the vRouter acquires ARP information and routing information of each CE, sends the ARP information and the routing information to the SDN controller, and guides the SDN controller to issue a service data flow table to an openflow switch;
the SDN controller issues an ARP request flow table and a service data flow table among the CEs to the openflow switch according to the ARP information and the routing information, and establishes virtual service data links among the CEs; the virtual service data link is used for transmitting service data messages.
Preferably, the controlling the flow rate at least comprises: routing protocols and ARP protocols;
preferably, the ARP information at least includes: the CE side IP address, MAC address and mapping relation of the IP address and the MAC address.
Preferably, the service data flow table is issued based on a matching user network segment, or is issued based on a matching next-hop destination MAC address.
Preferably, the router acquires the routing information by installing a routing engine, or acquires the routing information by entering.
Preferably, a vruter is established for each user, the vruter is deployed in mutually isolated containers to provide routing control for each user, and the containers access the network through the OVS.
The invention also provides a system for realizing plane separation based on the SDN network, which comprises the following steps: SDN controller, openflow switch, customer router CE, and virtual router vRouter, wherein,
the SDN controller is used for issuing an ARP message flow table and an ip message flow table between the CE and the vRouter to the openflow switch, and establishing a virtual control link between the CE and the vRouter; the virtual control link is used for transmitting control flow;
the vRouter is used for acquiring ARP information and routing information of each CE, sending the ARP information and the routing information to the SDN controller, and guiding the SDN controller to issue a service data flow table to an openflow switch;
the SDN controller is further configured to issue an ARP request flow table and a service data flow table between the CEs to the openflow switch according to the ARP information and the routing information, and establish a virtual service data link between the CEs; the virtual service data link is used for transmitting service data messages.
Preferably, the controlling the flow rate at least comprises: routing protocols and ARP protocols;
preferably, the ARP information at least includes: the CE side IP address, MAC address and mapping relation of the IP address and the MAC address.
Preferably, the service data flow table is issued based on a matching user network segment, or is issued based on a matching next-hop destination MAC address.
Preferably, the vRouter is further configured to obtain the routing information by installing a routing engine, or obtain the routing information by entering.
Preferably, the vrouters are deployed in mutually isolated containers, which provide routing control for each user, and the containers access the network through the OVS, with one vRouter instance for each user.
The invention also provides a device for realizing plane separation based on the SDN network, which comprises:
the device comprises an acquisition unit, a routing unit and a control unit, wherein the acquisition unit is used for acquiring ARP (address resolution protocol) information and routing information of each CE after an SDN (software defined network) controller issues an ARP (address resolution protocol) message flow table and an ip message flow table between a CE (customer edge) and a vRouter (virtual router) of a user router to an openflow switch and a virtual control link between the CE and the vRouter is established;
and the sending unit is used for sending the ARP information and the routing information to the SDN controller, guiding the SDN controller to issue an ARP request flow table and a service data flow table among the CEs to an openflow switch, and establishing a virtual service data link among the CEs.
Preferably, the controlling the flow rate at least comprises: routing protocols and ARP protocols;
the ARP information includes at least: the CE side IP address, MAC address and mapping relation of the IP address and the MAC address.
Compared with the prior art, the invention has the following advantages:
the method of the invention separates the route control function from the access equipment, so that the access equipment is only responsible for data forwarding, thereby improving the performance and stability of the equipment and reducing the complexity of service opening and maintenance. The invention realizes the decoupling of the network data forwarding plane and the routing control plane, the access device of the user network is not configured with any routing control function any more and only takes charge of data forwarding, thereby improving the performance and stability of the device, reducing the complexity of service opening and maintenance, and specially taking charge of routing control through the defined virtual router in butt joint with the user network, thereby improving the expansibility of the whole network.
Drawings
FIG. 1 is a schematic diagram of three levels of interconnection between user networks in the prior art;
fig. 2 is a flowchart of a method for implementing plane separation based on an SDN network according to the present invention;
fig. 3 is a schematic structural diagram of an implementation manner of a vRouter according to an embodiment of the present invention;
fig. 4 is a schematic structural diagram of a system for implementing plane separation based on an SDN network according to the present invention;
fig. 5 is a structural diagram of an embodiment of implementing plane separation based on an SDN network according to an embodiment of the present invention.
Detailed Description
In the following description, numerous specific details are set forth in order to provide a thorough understanding of the present invention. This invention may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein, but rather construed as limited to the embodiments set forth herein.
The SDN is mainly applied to the SDN, the core technology of the SDN is an Openflow protocol, the Openflow protocol runs on a physical network of the SDN, and the SDN physical network comprises an SDN controller and a plurality of Openflow switches. The following are terms of art involved:
CE: CustomerEdg, customer edge device, customer premises router to which the service provider is connected. The CE router provides service access for the user by connecting one or more PE routers. A CE router is typically an IP router that establishes an adjacency with a connected PE router. The CE router has an interface directly connected to a service provider, and may be a router or a switch. The CE is unaware of the existence of the VPN.
PE: ProviderEdge, the edge device of Provide, the edge router of the service provider backbone, which corresponds to a Label Edge Router (LER). The PE router connects the CE router and the P router and is the most important network node. Customer traffic flows into the customer network through the PE routers or to the MPLS backbone through the PE routers.
MPLS is Multi-Protocol Label Switching, which is a new generation of IP high-speed backbone network Switching standard. MPLS uses labels (labels) for data forwarding. When a packet enters the network, a short mark with a fixed length is allocated to the packet, and the mark and the packet are packaged together, and the switching node only forwards the packet according to the mark in the whole forwarding process. MPLS is independent of second and third layer protocols, such as ATM and IP. It provides a way to map IP addresses to simple labels with fixed length for different packet forwarding and packet switching technologies. Which is the interface to existing routing and switching protocols.
SDN: software Defined Networking, namely a Software Defined network, aims to realize the complete separation of a data plane and a control plane of network equipment compared with an innovative novel network architecture of a traditional network;
OpenFlow: a network communication protocol belongs to a data link layer and can control the forwarding plane of a network switch or a router so as to change the network path taken by a network data packet. OpenFlow allows the routing of packet forwarding to be changed by adding, modifying and removing packet control rules and actions from the packet forwarding table of a remote control network switch. The flow table rules may be matched based on the packet content and setting the priority of the flow table. .
An OpenFlow switch: a forwarding switch supporting an OpenFlow protocol belongs to a form of an SDN network element. The network device supports standard OpenFlow forwarding, and supports a controller to issue flow table configuration. And simultaneously, a vxlan interface is supported to be connected with the traditional network equipment. And executing forwarding action according to the flow table rule issued by the controller. The switches can also communicate with each other.
An SDN controller: the control unit interacts with SDN network elements such as an OpenFlow switch and the like, and a single or a plurality of controllers form a control plane. And carrying out centralized control on the network, issuing flow tables to all the switches, and managing the flow tables on all the switches in a centralized manner so as to realize the centralized management of the whole network.
OpenFlow flow table: OpenFlow controls OpenFlow switches through flow tables, the flow tables define rules of the switches for processing data message actions through matching message content, and the messages are matched with a plurality of flow tables through setting priorities, and then the messages processed actions made with high priorities are executed.
ARP (Address Resolution Protocol): a lower layer protocol in the TCP/IP stack is responsible for resolving an IP address into a corresponding MAC address.
BGP: the commonly used IP routing protocol is used to advertise routes between different routers.
VLAN: the virtual local area network isolates the service in a two-layer network.
OFS: abbreviation of OpenFlow Switch.
Docker vessel: the Docker container is an open-source application container engine, so that developers can package their applications and dependency packages into a portable container and then distribute the portable container to any popular Linux machine, and virtualization can be realized.
The invention realizes the data forwarding of the forwarding plane and the learning decoupling of the routing of the control plane by defining a virtual router network component vRouter of the control plane. The vRouter can have two functions according to different implementations, namely learning a route and announcing route information from a user side router, so that the user side router dynamically learns the route; secondly, the vRouter guides the SDN controller to issue a flow table to an openflow switch of the SDN network through the collected routing information and ARP information, so as to implement a routing control plane function of the device, while the PE device is only used for forwarding data and does not run any routing protocol. The present invention relates to two types of virtual links: a control link and a service link, wherein the control link and the routing protocol are between CE < - > VRouter; and service connection, namely the service data message running among the CEs is not forwarded through VRouter. The embodiments of the present application will be described in detail below with reference to the accompanying drawings.
Referring to fig. 2, fig. 3, fig. 4 and fig. 5, fig. 2 is a flowchart of a method for implementing plane separation based on an SDN network according to the present invention; fig. 3 is a schematic structural diagram of an implementation of vRouter in an embodiment of the present invention; fig. 4 is a schematic structural diagram of a system for implementing plane separation based on an SDN network according to the present invention; fig. 5 is a schematic structural diagram of an embodiment of implementing plane separation based on an SDN network;
the invention needs to establish a virtual router vRouter for each user, which is used for centrally controlling the router CE to learn and issue routing information and ARP information; preferably, the learning and publishing of the CE are centralized, specifically: the learning of routing information and ARP information from one CE and the distribution to another CE is a function of the route learning of a user network.
To achieve user isolation, the vRouter can be deployed in separate containers, providing routing control for each user.
Preferably, the container may be a docker container. Docker is an open source application container engine, so we can package our vRouter into a portable container and then publish it to the server to implement virtualization. The containers are fully sandboxed without any interface between each other. We can use the remote API to manage and create the Docker container. The Docker container is created by Docker mirroring. The container to mirror relationship is similar to objects and classes in object-oriented programming.
We can create one Docker instance for each vRouter. The problem addressed by the Docker core is to utilize LXCs to implement VM-like functionality, thereby providing more computing resources to the user with more economical hardware resources.
The docker container is equivalent to an independent network, and the OVS is connected with a virtual interface on the server through an interface. The docker container is accessed to the network through the OVS.
Preferably, the vruter may be deployed on a server independently or integrated into the SDN controller, and if the deployment is independent, the SDN controller needs to provide an API interface to accept the routing information of the vruter. And the vRouter sends the routing information and ARP information of the user to the SDN controller through an API (application program interface) provided by the SDN controller. If the controller is integrated in the SDN controller, the controller is integrated to mean that the SDN controller performs a function of a router, so that a role of the router does not need to be separately defined.
For example, referring to fig. 3, for example, there are two users, and a virtual router vruter 1 and a virtual router vruter 2 are created for each of the two users, and the vruter 1 and the virtual router2 are respectively deployed in two containers to provide routing control for the two users. As shown in fig. 5, the SDN includes two forwarding devices: OFS-1 and OFS-2; eth1 of vRouter1 is logically interconnected with port1 of customer-side router CE1, and eth2 of vRouter1 is logically interconnected with port2 of customer-side router CE 2. The routing information for CE1 is 10.1.0.0/16, the ip of access port1 is 169.254.1.1, and the MAC address is 00:00:00: 01; the routing information for CE2 is 10.2.0.0/16, ip in access port2 is 169.254.2.2, and the MAC address is 00:00:00:00:00: 02.
The invention discloses a method for realizing plane separation based on an SDN network, which specifically comprises the following steps:
step S101, an SDN controller issues an ARP message flow table and an ip message flow table between a CE and a vRouter to an openflow switch, and a virtual control link between the CE and the vRouter is established; the virtual control link is used for transmitting control flow;
preferably, the ARP message flow table and the ip message flow table between the CE and the vRouter include: the ARP message flow table from CE to vruter and the ARP message flow table from vruter to CE are as follows:
preferably, the ARP packet flow table from CE to vruter at least includes: the device comprises a matching field and an action field, wherein the matching field comprises a CE access port number, a source address and a destination address are ip addresses of a CE and a vRouter respectively, and the action field is a vlan with an action to the vRouter and sent to the vRouter.
Preferably, the ARP packet flow table from the vRouter to the CE at least includes: the method comprises a matching field and an action field, wherein the matching field comprises a vRouter access port number, ip addresses of a source and a destination which are vRouter and CE respectively, and the action field is that the action is to remove vlan and send the action to the CE.
Preferably, the ip packet flow table from CE to vRouter at least includes: the device comprises a matching field and an action field, wherein the matching field comprises a CE access port number, a source address and a destination address are ip addresses of a CE and a vRouter respectively, and the action field is a vlan with an action to the vRouter and sent to the vRouter.
Preferably, the ip packet flow table from vRouter to CE at least includes: the method comprises a matching field and an action field, wherein the matching field comprises a vRouter access port number, ip addresses of which the source and the destination are vRouter and CE respectively, and the action field is that the action is to remove vlan and send the action to the CE.
Preferably, the controlling the flow rate at least comprises: routing protocol and ARP protocol.
Preferably, for the routing protocol messages between the CE and the vRouter to be intercommunicated, two types of flow tables are required, one type is an ARP flow table, the other type is an ip message flow table used by the transmission routing protocol, and the routing protocol is encapsulated into an ip message for communication.
Preferably, the SDN controller issues an ARP message flow table between the CE and the vruter to the openflow switch, so as to complete ARP intercommunication between the CE and the vruter, the vruter obtains ARP information of each CE, the vruter transmits the ARP information of the CE to the SDN controller through a relevant API, the SDN controller issues an ip message flow table from the CE to the vruter to the openflow switch, so as to ensure that ip flow between the CE and the vruter is reachable, and connection can be established.
Step S102, the vRouter acquires routing information and ARP information of each CE, sends the routing information and the ARP information to the SDN controller, and guides the SDN controller to issue a service data flow table to an openflow switch;
the ARP information includes at least: the IP address and the MAC address of the CE side and the mapping relation between the IP address and the MAC address;
as shown in fig. 3, the routing information and ARP of the vRouter may be obtained by installing a routing engine, or may accept manual entry by providing an API interface to the outside. The vRouter is connected with the SDN controller, the SDN controller needs to provide an API interface, receive routing information and ARP information notified by the vRouter, and issue a flow table for the openflow switch under the guidance of the routing information and the ARP information.
And the vRouter acquires the routing information and the ARP information sent by the CE by installing a routing engine, and has the functions of route learning and distribution. The routing engine may be open-source or non-open-source software that may run on the service area and may run an associated routing protocol, such as goBGP, through which it may interact with the subscriber's router to route information, like a conventional router.
Preferably, the obtaining, by the vRouter, the routing information and the ARP information of each CE may be implemented in an EBPP manner. The vRouter learns the routing information and ARP information on the CE1 and CE2, and announces the routing information, so that the user-side router CE learns the routing information dynamically. A vRouter learns a route from one CE and publishes it to another. The method for completing mutual user route learning between CEs through the vRouter specifically comprises the following steps: the vRouter learns routing information and ARP information from one CE and issues to another CE. For example, in the example shown in fig. 5, vRouter learns a 10.1.0.0/16 segment route from CE1 and publishes to CE2, a 10.2.0.0/16 segment route from CE2 and publishes to CE 1. Since the vRouter is not responsible for the traffic flow, when the vRouter publishes the routing information, it needs to modify the next hop of the derived route to the outlet IP of the CE device corresponding to the network where the routing network segment is located through the derived policy control of the BGP, and cannot specify the IP address where the vRouter connects with the opposite end.
Preferably, the obtaining of the routing information and the ARP information of each CE by the vRouter may be implemented in a static manual entry manner. If a static manual entry mode is adopted, the function of the vRouter is realized. In a static mode, the vruter does not have a route learning and issuing function, the user CE device configures a static route by a user, the user network route is also entered on the vruter by a manual entry mode, each CE device and the vruter still have a straight chain in logic, but in this case, the CE device and the vruter are not used for learning and issuing route information, but the vruter can acquire MAC address information of a straight chain IP of each CE through an ARP request, so that the vruter has the route information and the ARP information of each user network as well as the EBGP mode, and transmits the route information and the ARP information to the SDN controller through an API interface provided by the SDN controller, and the SDN controller can issue all flow tables to openflow switches OFS-1 and OFS-2, as shown above. In this case, the primary function of the vRouter is to direct the controller to issue a forwarding flow table for the openflow switch.
The route control method in the embodiment of the present invention is exemplified by EBGP and a static method, but is not limited to these two methods, for example, IGP protocol may also be used for implementation, or vRouter may also be implemented by one physical router in the access network. Other ways of implementing route control are within the scope of the invention.
By way of example of fig. 5, fig. 5 shows that two routes CE1 and CE2 of the same user access a backbone network through openflow switches OFS-1 and OFS-2, respectively, an SDN controller manages the switches OFS-1 and OFS-2 through an openflow protocol, and a virtual control link is established between each of the vRouter, the CE1 and the CE2 for interconnection between the vRouter and the CE, and only control traffic such as a routing protocol and an ARP protocol is forwarded on the virtual control link, and forwarding of service traffic is not undertaken.
Preferably, the CE and the vRouter may establish an EBGP connection, and publish routing information to each other through the BGP protocol.
Routing information is mainly the main information of the next hop required to a destination:
R1Routing Table:
10.1.0.0/16next-hop 169.254.1.1
10.2.0.0/16next-hop 169.254.2.1
ARP information is the mapping relation of IP and MAC;
R1ARP Table:
169.254.1.1 00:00:00:00:00:01
169.254.2.1 00:00:00:00:00:02
the established virtual control Link is Link1 in fig. 4, the SDN controller needs to issue an ARP packet flow table from CE1 to vruter and an ARP packet flow table from vruter to CE1 to the switch OFS-1, so as to ensure that the ARP packet between CE1 and vruter can be forwarded to the other side, and the ARP packet flow table specifically includes the following contents:
Entry1:
"in_port＝p3,arp,arp_spa＝169.254.1.1,arp_tpa＝169.254.1.2,actions＝set_field:100->vl an_vid,output:p5"
the Entry1 flow table has the specific meanings: matching the arp message received from the CE1 access port, the source and destination are the ip addresses of CE1 and vrouter, respectively, and the action is to load the vlan to the vrouter and send the vlan to the vrouter.
Entry2:
"in_port＝p5,dl_vlan＝100,arp,arp_spa＝169.254.1.2,arp_tpa＝169.254.1.1,actions ＝strip_vlan,output:p3"
The Entry2 flow table has the specific meanings: matching the arp message received from the vrouter, the source and destination are ip addresses of the vrouter and the CE1 respectively, removing the vlan, and sending to the CE 1.
After obtaining the ARP of the user side ip, the vruter issues the ip message flow table from the CE to the vruter and from the vruter to the CE, so as to ensure that the ip flow between the CE and the vruter is reachable, and an EBGP connection can be established, where the ip message flow table specifically includes the following contents:
Entry3:
"in_port＝p3,ip,nw_src＝169.254.1.1,nw_dst＝169.254.1.2, actions＝set_field:100->vlan_vid,output:p5"
the Entry3 flow table has the specific meanings: and matching the ip message received from the CE1, wherein the source and the destination are the ip addresses of the CE1 and the vrouter respectively, and the action is that the ip message is sent to the vrouter after being uploaded to the vlan of the vrouter.
Entry4:
"in_port＝p5,dl_vlan＝100,ip,nw_src＝169.254.1.2,nw_dst＝169.254.1.1,actions＝ strip_vlan,output:p3"
The Entry4 flow table has the specific meanings: and matching the ip message sent from the vrouter to the CE1, wherein the source and the destination are ip addresses of the vrouter and the CE1 respectively, and sending the ip message to the CE1 after the action of removing the vlan.
A virtual control link is established between CE1 and the vRouter. The established virtual control Link is Link2 in fig. 5, and the SDN controller needs to issue an ARP packet flow table between CE2 and vruter to the switch OFS-2, so as to ensure that the ARP packet between CE2 and vruter can be forwarded to the other side. The flow table of ARP packets between CE2 and vruter is similar to the aforementioned Entry1-Entry2, and is not described again. The SDN controller needs to issue an ip message flow table between the CE2 and the vruter to the switch OFS-2, so as to ensure that the traffic between the CE2 and the vruter is reachable, and establish an EBPG connection. The ip message flow table between CE2 and vRouter is similar to the Entry3-Entry4, and is not described again.
A virtual control link is established between CE2 and the vRouter.
CE1 and CE2 transmit control traffic via the virtual control link, such as routing protocol and ARP protocol.
The CE completes mutual user route learning through the vRouter, and the method specifically comprises the following steps: the vRouter learns routing information and ARP information from one CE and issues to another CE. For example, in the example shown in fig. 5, vRouter learns a 10.1.0.0/16 segment route from CE1 and publishes it to CE2, and learns a 10.2.0.0/16 segment route from CE2 and publishes it to CE 1. The vRouter learns the routing information and ARP information on CE1 and CE 2. Since the vRouter is not responsible for the traffic flow, when the vRouter issues the routing information, it needs to control and modify the next hop of the derived route to the egress IP of the CE device corresponding to the network where the routing network segment is located through the derived policy of the BGP, and cannot specify the IP address where the vRouter is connected to the opposite end. Therefore, when the vRouter publishes a route of 10.1.0.0/16 network segment to the CE2, the next hop is modified to 169.254.1.1 instead of 169.254.2.2; similarly, when the vRouter publishes a route of 10.2.0.0/16 segment to CE1, the next hop is modified to 169.254.2.1 instead of 169.254.1.2. Thus CE1 learns the route: 10.2.0.0/16 next-hop 169.254.2.1, CE2 learned route: 10.1.0.0/16next-hop 169.254.1.1. For example, if the vRouter implements route control by using EBGP, the CE and the vRouter can establish EBGP connection by issuing an ARP message flow table (Entry 1-Entry 2) and an ip message flow table (Entry 3-Entry 4) that interconnect ip between the CE and the vRouter, thereby implementing control flow intercommunication between the CE and the vRouter, and automatically interacting route information by using EBGP protocol.
Step S103, the SDN controller issues an ARP request flow table and a service data flow table among the CEs to the openflow switch according to the ARP information and the routing information, and establishes a virtual service data link among the CEs, wherein the virtual service data link is used for transmitting service data messages.
Preferably, the CE transmits the service data packet through the virtual service data link.
Preferably, the SDN controller issues an ARP request flow table between the CEs to the openflow switch according to the MAC address and the routing information in the ARP information.
Preferably, the service data flow table is issued based on a matching user network segment, or is issued based on a matching next-hop destination MAC address.
Preferably, the SDN controller issues an ARP request flow table between the CEs to the openflow switch, completes ARP intercommunication between the CEs, the CE1 obtains ARP information of the CE2, and the CE2 obtains ARP information of the CE 1; the ARP information includes at least: the CE side IP address, MAC address and mapping relation of the IP address and the MAC address. And the SDN controller issues a service data flow table between CEs to the openflow switch for forwarding service flow between CEs.
Preferably, at least one of ARP request flow tables of CE1 to CE2 includes: the ARP request message is sent from CE1 to CE2, the source and destination are ip addresses from CE1 to CE2, respectively, and the action is to be sent to CE2 after being uploaded to vlan of CE 2.
Preferably, at least one of ARP request flow tables of CE2 to CE1 includes: the method comprises a matching field and an action field, wherein the matching field comprises matching ip addresses of an arp message sent from OFS-2 to CE1, the source and destination are respectively CE2 and CE1, and the action is to remove vlan and send the vlan to CE 1.
Preferably, the issuing of the traffic data flow tables from flow table CE1 to CE2 based on the matching user network segment at least includes: a match field and an action field, the match field comprising: matching the ip packet sent from CE1 to CE2, where the destination address is the ip address of the user segment connected to CE2, and the action field includes: the operation was to hit a vlan of CE2, and then to OFS-2.
Preferably, the issuing of the traffic data flow tables from flow table CE2 to CE1 based on the matching user network segment at least includes: a match field comprising a matching ip message sent from OFS-2 to CE1 for the purpose of the segment ip address of the subscriber segment to which CE1 is attached, and an action field comprising: the action is to remove the vlan, which is then sent to CE 1.
Preferably, the issuing of the traffic data flow table from the flow table CE1 to the flow table CE2 based on the MAC address matching the next hop destination at least includes: a match field and an action field, the match field comprising: matching the message received from CE1, MAC address being the MAC address of CE2 interface, action field includes: the action is to hit the vlan of CE2, and then to CE 2.
Preferably, the issuing of the traffic data flow table from the flow table CE2 to the flow table CE1 based on the MAC address matching the next hop destination at least includes: a match field and an action field, the match field comprising: matching the message received from OFS-2, where the MAC address is the interface MAC address of CE1, and the action field includes: the action is to remove the vlan, which is then sent to CE 1.
Taking fig. 5 as an example for illustration, the vruter transmits the user routing information and the ARP information to the SDN controller through an API interface provided by the SDN controller, and is used for instructing the SDN controller to issue service data flow tables to openflow switches OFS-1 and OFS-2 respectively, establish a virtual service data Link3 between the OFS-1 and the OFS-2, and instruct the OFS-1 and the OFS-2 to forward data packets; service data messages are forwarded between the CEs through a virtual service data Link3, and an SDN controller issues the following flow table to an OFS-1, specifically as follows:
(1) the SDN controller issues to switch OFS-1 an ARP request flow table of CE1 to CE2 and an ARP request flow table of CE2 to CE1 for ARP requests of CE1 to CE2 and ARP requests of CE2 to CE 1:
Entry5:
"in_port＝p3,arp,arp_spa＝169.254.1.1,arp_tpa＝169.254.2.1,actions＝set_field:300->vl an_vid,output:p5"
the Entry5 flow table has the specific meanings: matching the ARP request message sent from CE1 to CE2, the source and destination are ip addresses from CE1 to CE2, respectively, and the action is to get the vlan of CE2, and then send it to CE 2.
Entry6:
"in_port＝p5,arp,dl_vlan＝300,arp_spa＝169.254.2.1,arp_tpa＝169.254.1.1,actions ＝strip_vlan,output:p3"
The Entry6 flow table has the specific meanings: matching the arp message sent from OFS-2 to CE1, the source and destination are ip addresses of CE2 and CE1, respectively, and the action is to remove vlan and send to CE 1.
(2) The SDN controller issues a service data flow table to the switch OFS-1, the service data flow table is used for forwarding service flow between CEs, a virtual service data link between the CE1 and the CE2 is established, and a service data message is transmitted between the CE1 and the CE2 through the virtual service data link.
Preferably, the flow table may be issued based on a matching user network segment, or may be issued based on a destination mac.
The following description is given for example of the flow table distribution based on the matching user network segment:
Entry7:
"in_port＝p3,nw_dst＝10.2.0.0/16,actions＝set_field:300->vlan_vid,output:p5"
the Entry7 flow table has the specific meanings: matching the ip message sent from CE1 to CE2, the destination address is the ip address of the user network segment connected to CE2, and sending to OFS-2 after the action is to tie up the vlan of CE 2.
Entry8:
"in_port＝p5,dl_vlan＝300,nw_dst＝10.1.0.0/16,actions＝strip_vlan,output:p3"
The Entry8 flow table has the specific meanings: the ip message sent from the OFS-2 to the CE1 is matched, the purpose is the ip address of the user network segment connected to the CE1, and the action is to remove the vlan and send the ip message to the CE 1.
The following description will be given for example of the flow table delivery based on the matching of the next hop destination MAC address:
Entry9:
"in_port＝p3,
eth_dst＝00:00:00:00:00:02,actions＝set_field:300->vlan_vid,output:p5"
the Entry9 flow table has the specific meanings: matching the message received from the CE1, wherein the MAC address is the MAC address of the CE2 interface, and the action is to call the vlan of the CE2 and then send the message to the CE 2;
Entry10:
"in_port＝p5,dl_vlan＝300,eth_dst＝00:00:00:00:00:01,actions＝ strip_vlan,output:p3"
the Entry10 flow table has the specific meanings: and matching the message received from the OFS-2, wherein the MAC address is the interface MAC address of the CE1, and the action is to remove the vlan and then send the message to the CE 1.
Entry7 and Entry8 are flow tables forwarded according to the network segment under the routing information, and Entry9 and Entry10 are flow tables forwarded according to the MAC of the opposite end destination under the MAC address.
The Entry9 and 10 has the advantages over 7 and 8 that the number of flow tables based on destination MAC is only related to the number of CE nodes, but not to how many private network segments each CE is connected with, thus reducing the number of flow tables to a great extent; and because the service forwarding flow table does not relate to the routing network segment information, when the routing information of the user side changes, the service flow table cannot be changed along with the change of the routing information to influence the service flow, and the stability is higher.
The invention also discloses a system for realizing plane separation based on the SDN network, which not only comprises the following steps: SDN controller, openflow switch, customer router CE, and virtual router vRouter, wherein,
the SDN controller is used for issuing an ARP message flow table and an ip message flow table between the CE and the vRouter to the openflow switch, and establishing a virtual control link between the CE and the vRouter; the virtual control link is used for transmitting control flow;
the vRouter is used for acquiring ARP information and routing information of each CE, sending the ARP information and the routing information to the SDN controller, and guiding the SDN controller to issue a service data flow table to an openflow switch;
the SDN controller is further used for issuing an ARP request flow table and a service data flow table among the CEs to the openflow switch according to the ARP information and the routing information, and establishing virtual service data links among the CEs; the virtual service data link is used for transmitting service data messages.
Preferably, the controlling the flow rate at least comprises: routing protocol and ARP protocol.
The ARP information includes at least: the IP address and the MAC address of the CE side and the mapping relation between the IP address and the MAC address;
preferably, the service data flow table is issued based on a matching user network segment, or is issued based on a matching next-hop destination MAC address.
Preferably, the vRouter is further configured to obtain the routing information by installing a routing engine, or obtain the routing information by entering.
Preferably, the vrouters are deployed in mutually isolated containers, which provide routing control for each user, and the containers access the network through the OVS, with one vRouter instance for each user.
The present invention further provides a device for implementing plane separation based on an SDN network, where the device in this embodiment is a virtual router vRouter, and the device includes:
the device comprises an acquisition unit, a routing unit and a control unit, wherein the acquisition unit is used for acquiring ARP (address resolution protocol) information and routing information of each CE after an SDN (software defined network) controller issues an ARP (address resolution protocol) message flow table and an ip message flow table between a CE (customer edge) and a vRouter (virtual router) of a user router to an openflow switch and a virtual control link between the CE and the vRouter is established;
a sending unit, configured to send the ARP information and the routing information to the SDN controller, direct the SDN controller to issue an ARP request flow table and a service data flow table between the CEs to an openflow switch, and establish a virtual service data link between the CEs;
preferably, the controlling the flow rate at least comprises: routing protocol and ARP protocol.
Preferably, the ARP at least information includes: the CE side IP address, MAC address and mapping relation of the IP address and the MAC address.
The scheme of the application has good expansibility, and the vRouter can automatically complete the issuing of the flow table and the learning of the route without influencing the existing service no matter the user network segment is added to the user network or the network node is newly added.
The method provided by the invention realizes the decoupling of the network data forwarding plane and the routing control plane, ensures that the access equipment of the user network is not configured with any routing control function and is only responsible for data forwarding, improves the performance and stability of the equipment, reduces the complexity of service opening and maintenance, is specially responsible for routing control through the defined virtual router which is in butt joint with the user network, and improves the expansibility of the whole network.
Although the present invention has been described with reference to the preferred embodiments, it is not intended to limit the present invention, and those skilled in the art can make various changes and modifications without departing from the spirit and scope of the present invention, and therefore, the scope of the present invention should be limited only by the appended claims.

Claims (12)

1. A method for realizing plane separation based on an SDN network is characterized by comprising the following steps:
the SDN controller issues an ARP message flow table and an ip message flow table between a user router (CE) and a virtual router (vRouter) to an openflow switch, and establishes a virtual control link between the CE and the vRouter; the virtual control link is used for transmitting control flow;
the vRouter acquires ARP information and routing information of each CE, sends the ARP information and the routing information to the SDN controller, and guides the SDN controller to issue a service data flow table to an openflow switch;
the SDN controller issues an ARP request flow table and a service data flow table among the CEs to the openflow switch according to the ARP information and the routing information, and establishes virtual service data links among the CEs; the virtual service data link is used for transmitting service data messages.
2. The method of claim 1, wherein the controlling the flow rate comprises at least: routing protocols and ARP protocols;
the ARP information includes at least: the CE side IP address, MAC address and mapping relation of the IP address and the MAC address.
3. The method of claim 1, wherein the traffic data flow table is delivered based on matching subscriber segments or based on matching next hop destination MAC addresses.
4. The method of claim 1, wherein the vruter obtains the routing information by installing a routing engine or obtaining the routing information by logging.
5. The method of claim 1, wherein:
and establishing a vRouter for each user, wherein the vRouter is deployed in mutually isolated containers and provides routing control for each user, and the containers are accessed to the network through the OVS.
6. A system for implementing plane separation based on an SDN network, comprising: SDN controller, openflow switch, customer router CE, characterized by, still include virtual router vRouter, wherein,
the SDN controller is used for issuing an ARP message flow table and an ip message flow table between the CE and the vRouter to the openflow switch, and establishing a virtual control link between the CE and the vRouter; the virtual control link is used for transmitting control flow;
the vRouter is used for acquiring ARP information and routing information of each CE, sending the ARP information and the routing information to the SDN controller, and guiding the SDN controller to issue a service data flow table to an openflow switch;
the SDN controller is further used for issuing an ARP request flow table and a service data flow table among the CEs to the openflow switch according to the ARP information and the routing information, and establishing virtual service data links among the CEs; the virtual service data link is used for transmitting service data messages.
7. The system of claim 6, wherein the controlling the flow rate comprises at least: routing protocols and ARP protocols;
the ARP information includes at least: the CE side IP address, MAC address and mapping relation of the IP address and the MAC address.
8. The system of claim 6, wherein the traffic data flow table is delivered based on matching subscriber segments or based on matching next hop destination MAC addresses.
9. The system of claim 6, wherein the vRouter is further configured to obtain the routing information by installing a routing engine, or by logging the routing information.
10. The system of claim 6, wherein:
the vRouter is deployed in mutually isolated containers, routing control is provided for each user, the containers are accessed to the network through the OVS, and each user has one vRouter instance.
11. An apparatus for implementing plane separation based on an SDN network, comprising:
the device comprises an acquisition unit, a routing unit and a control unit, wherein the acquisition unit is used for acquiring ARP (address resolution protocol) information and routing information of each CE after an SDN (software defined network) controller issues an ARP (address resolution protocol) message flow table and an ip message flow table between a CE (customer edge) and a vRouter (virtual router) of a user router to an openflow switch and a virtual control link between the CE and the vRouter is established;
and the sending unit is used for sending the ARP information and the routing information to the SDN controller, guiding the SDN controller to issue an ARP request flow table and a service data flow table between the CEs to an openflow switch, and establishing a virtual service data link between the CEs.
12. The apparatus of claim 11, wherein the controlling the flow rate comprises at least: routing protocols and ARP protocols;
the ARP information includes at least: the CE side IP address, MAC address and mapping relation of the IP address and the MAC address.
CN201810019109.8A 2018-01-09 2018-01-09 Method, system and device for realizing plane separation based on SDN (software defined network) Expired - Fee Related CN110022262B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201810019109.8A CN110022262B (en) 2018-01-09 2018-01-09 Method, system and device for realizing plane separation based on SDN (software defined network)

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201810019109.8A CN110022262B (en) 2018-01-09 2018-01-09 Method, system and device for realizing plane separation based on SDN (software defined network)

Publications (2)

Publication Number Publication Date
CN110022262A CN110022262A (en) 2019-07-16
CN110022262B true CN110022262B (en) 2021-07-30

Family

ID=67187733

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201810019109.8A Expired - Fee Related CN110022262B (en) 2018-01-09 2018-01-09 Method, system and device for realizing plane separation based on SDN (software defined network)

Country Status (1)

Country Link
CN (1) CN110022262B (en)

Families Citing this family (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110430114B (en) * 2019-07-24 2022-02-11 中国电子科技集团公司第七研究所 Virtual router and method for realizing interconnection between SDN network and traditional IP network
CN110430076B (en) * 2019-07-31 2022-05-31 新华三技术有限公司合肥分公司 Route management method and device
CN113630427B (en) * 2020-05-07 2022-12-06 华为技术有限公司 Protection switching method and device
US11870677B2 (en) * 2020-06-04 2024-01-09 Juniper Networks, Inc. Liveness detection and route convergence in software-defined networking distributed system
US11329911B2 (en) * 2020-06-04 2022-05-10 Juniper Networks, Inc. Local repair for underlay failure using prefix independent convergence
CN113992571B (en) * 2021-09-29 2024-02-09 新华三大数据技术有限公司 Multipath service convergence method, device and storage medium in SDN network
CN115442297B (en) * 2022-09-06 2023-08-22 中电云数智科技有限公司 System and method for realizing EIP intelligent access based on BGP

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104901890A (en) * 2015-06-24 2015-09-09 上海斐讯数据通信技术有限公司 Route generating and coupling method and system of SDN
CN105049450A (en) * 2015-08-24 2015-11-11 北京汉柏科技有限公司 Cloud security system based on virtual network environment and deployment framework of cloud security system
CN106936777A (en) * 2015-12-29 2017-07-07 中移(苏州)软件技术有限公司 Cloud computing distributed network implementation method based on OpenFlow, system

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104022960B (en) * 2013-02-28 2017-05-31 新华三技术有限公司 Method and apparatus based on OpenFlow protocol realizations PVLAN

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104901890A (en) * 2015-06-24 2015-09-09 上海斐讯数据通信技术有限公司 Route generating and coupling method and system of SDN
CN105049450A (en) * 2015-08-24 2015-11-11 北京汉柏科技有限公司 Cloud security system based on virtual network environment and deployment framework of cloud security system
CN106936777A (en) * 2015-12-29 2017-07-07 中移(苏州)软件技术有限公司 Cloud computing distributed network implementation method based on OpenFlow, system

Also Published As

Publication number Publication date
CN110022262A (en) 2019-07-16

Similar Documents

Publication Publication Date Title
CN110022262B (en) Method, system and device for realizing plane separation based on SDN (software defined network)
US9124567B2 (en) Methods and devices for converting routing data from one protocol to another in a virtual private network
JP3868815B2 (en) Communications system
KR100612318B1 (en) Apparatus and method for implementing vlan bridging and a vpn in a distributed architecture router
EP3042476B1 (en) Buffer-less virtual routing
US9166807B2 (en) Transmission of layer two (L2) multicast traffic over multi-protocol label switching networks
WO2006005260A1 (en) A virtual private network and the method for the control and transmit of the route
US20050147104A1 (en) Apparatus and method for multihop MPLS/IP/ATM/frame relay/ethernet pseudo-wire
CN109327374B (en) System and method for realizing three-layer VPN network access
CN104518940A (en) Communication method and device for NVO3 (network virtualization over layer 3) network and MPLS (multi-protocol label switching) network
WO2010151571A2 (en) Method and apparatus for implementing l2 vpns on an ip network
WO2005013050A2 (en) Method and apparatus for implementing hub-and-spoke topology virtual private networks
JP2002164937A (en) Network and edge router
CN101107824A (en) Connection-oriented communications scheme for connection-less communications traffic
CN103326940A (en) Method for forwarding message in network and edge device of operator
CN112671650B (en) End-to-end SR control method, system and readable storage medium under SD-WAN scene
Shvedov et al. Segment routing in data transmission networks
CN110035012B (en) SDN-based VPN flow scheduling method and SDN-based VPN flow scheduling system
CN102891903A (en) NAT (Network Address Translation) converting method and equipment
CN114172865B (en) IPv6 dual stack implementation method under cloud network
CN102394804A (en) VPN system building method and VPN system
WO2005114944A1 (en) A method for implementing ipv4 and ipv6 mixing sites virtual private network
Cittadini et al. MPLS virtual private networks
Wu et al. Research on the application of cross-domain VPN technology based on MPLS BGP
Finlayson et al. VPN Technologies-a comparison

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
TA01 Transfer of patent application right

Effective date of registration: 20200323

Address after: 200040 room 1013, No. 250, JIANGCHANG Third Road, Jing'an District, Shanghai

Applicant after: Shanghai layer peak Network Technology Co.,Ltd.

Address before: 310012 506, room 4, 998 West Wen Yi Road, Wuchang Street, Yuhang District, Hangzhou, Zhejiang.

Applicant before: HANGZHOU DAHU TECHNOLOGY Co.,Ltd.

TA01 Transfer of patent application right
GR01 Patent grant
GR01 Patent grant
CF01 Termination of patent right due to non-payment of annual fee

Granted publication date: 20210730

CF01 Termination of patent right due to non-payment of annual fee