CN111327523A

CN111327523A - Network protection method and device based on aggregation port, network equipment and storage medium

Info

Publication number: CN111327523A
Application number: CN202010130487.0A
Authority: CN
Inventors: 乔鹏
Original assignee: Sangfor Technologies Co Ltd
Current assignee: Sangfor Technologies Co Ltd
Priority date: 2020-02-28
Filing date: 2020-02-28
Publication date: 2020-06-23
Anticipated expiration: 2040-02-28
Also published as: CN111327523B

Abstract

The invention discloses a network protection method, a device, network equipment and a storage medium based on an aggregation port. Wherein, the method comprises the following steps: determining that at least one member port of the aggregation port has the operation state change; acquiring target IP address information; and sending the target IP address information into the network, so that the external switch updates the FDB based on the transfer path of the target IP address information. In the embodiment of the invention, the external switch updates the FDB based on the transmission path of the target IP address information, and can obtain the correct FDB in time after the member port of the aggregation port changes the operation state, thereby ensuring the smoothness of the network.

Description

Network protection method and device based on aggregation port, network equipment and storage medium

Technical Field

The present invention relates to the field of communications network technologies, and in particular, to a network protection method and apparatus based on an aggregation port, a network device, and a storage medium.

Background

Link Aggregation (Link Aggregation) is a technology for binding a plurality of physical ports into one logical port (i.e., Aggregation port), and can treat a plurality of physical connections as a single logical connection, i.e., virtualize a plurality of network cards into one network card. The multiple member ports of the aggregation port may support multiple modes, such as a load balancing mode and a master/slave switching mode.

In the related art, when the member ports of the aggregation port are changed, the phenomenon that the network is disconnected is often caused.

Disclosure of Invention

In view of this, embodiments of the present invention provide a method, an apparatus, a network device, and a storage medium for protecting a network based on an aggregation port, which aim to ensure the smooth of the network when a member port of the aggregation port changes.

The technical scheme of the embodiment of the invention is realized as follows:

the embodiment of the invention provides a network protection method based on an aggregation port, which comprises the following steps:

determining that at least one member port of the aggregation port has the operation state change;

acquiring target Internet Protocol (IP) address information;

sending the target IP address information into a network, so that an external switch updates a Forwarding table (FDB) based on a transfer path of the target IP address information.

The embodiment of the invention also provides a network protection device based on the aggregation port, which comprises:

the determining module is used for determining that at least one member port of the aggregation port has running state change;

the acquisition module is used for acquiring target IP address information;

and the message sending module is used for sending the target IP address information to a network, so that the external switch updates the FDB based on the transmission path of the target IP address information.

An embodiment of the present invention further provides a network device, including: a processor and a memory for storing a computer program capable of running on the processor, wherein the processor, when running the computer program, is adapted to perform the steps of the method according to any of the embodiments of the present invention.

The embodiment of the present invention further provides a network system, which includes an external switch and the network device in the foregoing embodiment, where the external switch includes at least two switches connected in cascade, and the at least two switches are respectively connected to member ports on an aggregation port of the network device.

The embodiment of the present invention further provides a storage medium, where a computer program is stored on the storage medium, and when the computer program is executed by a processor, the steps of the method according to any embodiment of the present invention are implemented.

The technical scheme provided by the embodiment of the invention determines that at least one member port of the aggregation port has operation state change, acquires the target IP address information, and sends the target IP address information to the network, so that the external switch updates the FDB based on the transmission path of the target IP address information, and can obtain correct FDB in time after the member port of the aggregation port has operation state change, thereby ensuring the smoothness of the network.

Drawings

FIG. 1 is a schematic diagram of a network topology based on aggregation ports in the related art;

fig. 2 is a schematic flowchart of a network protection method based on an aggregation port according to an embodiment of the present invention;

FIG. 3 is a flow chart of a network protection method based on aggregation port according to an embodiment of the present invention;

fig. 4 is a schematic structural diagram of a network protection device based on a convergence port according to an embodiment of the present invention;

FIG. 5 is a schematic structural diagram of a network device according to an embodiment of the present invention;

fig. 6 is a schematic structural diagram of a network system according to an embodiment of the present invention.

Detailed Description

The present invention will be described in further detail with reference to the accompanying drawings and examples.

Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs. The terminology used in the description of the invention herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention.

In the related art, when the member ports of the aggregation port are changed, the phenomenon that the network is disconnected is often caused. For example, in practical applications, as shown in fig. 1, a client (PC)101 connects a network device through an external switch 102, where the external switch 102 includes two switches sw1, sw2 for supporting the active/standby mode, and sw1 and sw2 are in cascade connection, where in cascade connection, sw1 and sw2 are logically independent switches, which is different from a switch in the stack mode. The network device includes an aggregation port 103, a DVS (Distributed Virtual Switch) 104, and a Virtual terminal device connected to the DVS 104, such as a Virtual machine vm1, vm2, a Virtual router vr1, and the like. Here, the distributed virtual switch is a virtual network management method for managing virtual switches (software-based virtual switches or smart network card virtual switches) on a plurality of hosts, and includes management of physical ports of the hosts and virtual ports of the virtual machines. The distributed virtual machine switch can ensure the consistency of network configuration when the virtual machine is migrated between the hosts.

As shown in fig. 1, the PC of the external environment continuously accesses the virtual machine vm1 in the virtual environment.

The flow direction and switch tabulation sequence is as follows:

the PC accesses vm1, first knowing vm1 MAC (Media Access Control) address. The MAC Address of vm1 is learned by ARP (Address Resolution Protocol).

And when the PC is not the sws 2, the message is flood. The sw2 learns a new FDB entry.

sw2 FDB

MAC port

AA-BB-CC-DD-EE-FF sw2-1

When the answer is sw2- - > sw1, the message continues to flood. Sw1 learns a new FDB entry.

sw1 FDB

MAC port

AA-BB-CC-DD-EE-FF sw1-1

Assuming that eth0 in the aggregation port 103 is the main port and eth1 is the spare port, the link from sw2 to eth1 is disabled.

Messages pass from sw1- - > eth0 through aggregation port 103 to DVS 104. The DVS 104 learns a new FDB entry.

DVS FDB

MAC port

AA-BB-CC-DD-EE-FF dvs-1

The DVS 104 continues the flood and the message reaches vm 1. vm1 returns a message. The DVS 104 learns a new FDB entry.

DVS FDB

MAC port

AA-BB-CC-DD-EE-FF dvs-1

AA-BB-CC-DD-EE-11dvs-2

The back-packed packet is passed from the DVS 104 through the aggregation port 103 and onto the switch sw1 of the external environment. The sw1 learns a new FDB entry.

sw1 FDB

MAC port

AA-BB-CC-DD-EE-FF sw1-1

AA-BB-CC-DD-EE-11 sw1-2

The returned packet is learned to a new FDB table entry by sw1- - > sw2 and sw 2.

sw2 FDB

MAC port

AA-BB-CC-DD-EE-FF sw2-1

AA-BB-CC-DD-EE-11 sw2-3

From sw2- - > PC, via sw 2-1. Thus, subsequent messages are unblocked.

However, when the physical port eth0 goes wrong, i.e., from UP to DOWN, the aggregation port 104 will switch to the standby port eth1 according to the switching principle. But at this time the FDB entries in the external switch sw2 are not updated.

sw2 FDB

MAC port

AA-BB-CC-DD-EE-FF sw2-1

AA-BB-CC-DD-EE-11 sw2-3 (invalid)

Therefore, traffic from the PC to vm1 will continue to send traffic to switch sw1, but sw1 will have broken its way to eth0, and flood will be required on switch sw1 to find a new way, but due to switch flood principle, flood cannot reach vm1 except for the port sw1 to sw 2. So that a web break occurs at this time.

Therefore, when the member port of the aggregation port 103 changes, if the external network is not notified of the change, the external network leaves invalid FDB entries, resulting in network failure.

Based on this, in various embodiments of the present invention, when the running state of at least one member port of the aggregation port changes, the change is notified to the external environment in time, so that the external switch in the external environment can update the FDB in time, and the smoothness of the network is ensured. Here, the external environment is relative to the internal virtual environment connected to the aggregation port.

An embodiment of the present invention provides a network protection method based on an aggregation port, as shown in fig. 2, the method includes:

step 201, determining that at least one member port of an aggregation port has operation state change;

step 202, acquiring target IP address information;

step 203, sending the target IP address information to the network, so that the external switch updates the FDB based on the delivery path of the target IP address information.

Here, the determining that the operating state of at least one member port of the aggregation port changes includes: and determining that at least one member port of the aggregation port is switched from an operating (UP) state to a failure (DOWN) state or is restored from the DOWN state to the UP state. The destination IP address information is IP address information of a virtual terminal device in an internal virtual environment connected to the aggregation port. The external switch can update the local FDB based on the transmission path of the target IP address information, so that the invalid FDB list items remained in the external network can be updated in time after the member port of the aggregation port changes the operation state, the correct FDB is obtained, and the smoothness of the network is ensured.

In an embodiment, the obtaining the target IP address information includes:

determining a target terminal device according to the DVS connected with the aggregation port, acquiring IP address information of the target terminal device, and taking the IP address information of the target terminal device as the target IP address information; wherein the target terminal device is one or more terminal devices connected to the DVS.

In an application example, as shown in fig. 1, vm1, vm2, and vr1 connected to the DVS 104 may all be target terminal devices, and IP address information of vm1, vm2, and vr1 may be acquired as target IP address information. Therefore, the FDB can be updated for each terminal device connected with the DVS, and the smoothness of the network is ensured.

In another embodiment, the obtaining the target IP address information includes:

acquiring a target MAC address in an FDB of the DVS connected with the aggregation port, and determining the target IP address information based on the target MAC address; and the target MAC address is a MAC address corresponding to other ports except the port connected with the aggregation port in the FDB of the DVS.

In an application example, according to a MAC address existing in an FDB of the DVS, a MAC address corresponding to a port other than DVS-1 may be selected as a target MAC address, and target IP address information may be determined based on the target MAC address. If the IP address of vm1 is determined: 4.3.2.2 as the target IP address information, so it can accurately select the IP address information and reduce the message transmission.

In one embodiment, the sending the target IP address information to the network includes:

and controlling the terminal equipment corresponding to the target IP address to generate and send a free ARP message.

Here, the free ARP packet means that the packet sending end IP address and the destination IP address are both local IP addresses, the packet source MAC address is a local MAC address, and the packet destination MAC address is a broadcast address. Thus, the external switch receives the gratuitous ARP message of the corresponding terminal device, and can update the FBD table entry corresponding to the corresponding terminal device in the local FDB, that is, the corresponding relation between the MAC address and the port.

In one embodiment, the polymerization port comprises: the system comprises a main member port and a standby member port, wherein the main member port is connected with an external first switch, the standby member port is connected with an external second switch, and the first switch and the second switch are in cascade connection; the determining that the operating state of at least one member port of the aggregation port changes comprises the following steps: and determining that the main member port is switched to the DOWN state from the UP state or is recovered to the UP state from the DOWN state.

In practical application, if the main member port of the aggregation port is switched from UP to DOWN, the external switch can update the FDB in time by acquiring the target IP address information and controlling the terminal device corresponding to the target IP address to generate and send a free ARP message, thereby ensuring smooth network. If the main member port of the aggregation port is switched from DOWN to UP, in the same way, the preemption mode of the aggregation port can be recovered in time by acquiring the target IP address information and controlling the terminal equipment corresponding to the target IP address to generate and send a free ARP message.

The present invention will be described in further detail with reference to the following application examples.

As shown in fig. 1, the network topology structure of the present application embodiment needs to synchronize part of IP address information in an internal virtual environment to an external environment after a member port eth0 of an aggregation port is switched from UP to DOWN, and specifically as shown in fig. 3, the network topology structure includes:

step 301, determining that the member port of the aggregation port has operation state change;

when the member port eth0 of the aggregation port is switched from UP to DOWN, a controller (controller) may detect this event, thereby determining that the member port of the aggregation port has changed operating status. Here, the controller has a view of god in the internal virtual environment, and can acquire the configuration in the internal virtual environment.

Step 302, detecting IP address information needing to be informed of an external environment through a controller;

here, the controller acquires the distributed virtual switch directly connected to the aggregation port, and performs IP address query on a target MAC address of an FDB entry existing in the distributed virtual switch to obtain corresponding IP address information as target IP address information. Here, the destination MAC address is a MAC address corresponding to a port other than the port connected to the aggregation port in the FDB of the distributed virtual switch. For example, the MAC address can be based on dvs-2: AA-BB-CC-DD-EE-11, obtaining a target IP address: 4.3.2.2.

step 303, the controller sends the IP address information needing to be informed to a free ARP message;

the controller, based on the target IP address: 4.3.2.2, determining that vm1 needs to send gratuitous ARP messages, and controlling vm1 to send gratuitous ARP messages.

Step 304, the switch in the external environment receives the gratuitous ARP message and updates the FDB.

In practical application, the transmission path for sending the gratuitous ARP message by vm1 is as follows: vm1- - > DVS- - > eth1- - > sw 2. The sw2 learns the correct FDB entry as follows:

sw2 FDB

MAC port

AA-BB-CC-DD-EE-FF sw2-1

AA-BB-CC-DD-EE-11 sw2-2

thus, the path for the PC to subsequently access virtual machine vm1 is: PC is in the shape of a network, sw2 is in the shape of a network, eth1 is in the shape of a DVS, vm1 and the smoothness of the network is guaranteed.

In order to implement the method according to the embodiment of the present invention, an embodiment of the present invention further provides a network protection device based on an aggregation port, where the network protection device based on an aggregation port corresponds to the network protection method based on an aggregation port, and each step in the embodiment of the network protection method based on an aggregation port is also completely applicable to the embodiment of the network protection device based on an aggregation port.

As shown in fig. 4, the aggregation-based network protection device includes: the system comprises a determining module 401, an obtaining module 402 and a message sending module 403, wherein the determining module 401 is configured to determine that at least one member port of an aggregation port has a running state change; the obtaining module 402 is configured to obtain target IP address information; the message sending module 403 is configured to send the target IP address information to a network, so that an external switch updates an FDB based on a transmission path of the target IP address information.

In an embodiment, the determining module 401 is specifically configured to: and determining that at least one member port of the aggregation port is switched to the DOWN state from the UP state or is recovered to the UP state from the DOWN state.

In an embodiment, the obtaining module 402 is specifically configured to: determining a target terminal device according to the DVS connected with the aggregation port, acquiring IP address information of the target terminal device, and taking the IP address information of the target terminal device as the target IP address information; wherein the target terminal device is one or more terminal devices connected to the DVS.

In an embodiment, the obtaining module 402 is specifically configured to: acquiring a target MAC address in an FDB of the DVS connected with the aggregation port, and determining the target IP address information based on the target MAC address; and the target MAC address is a MAC address corresponding to other ports except the port connected with the aggregation port in the FDB of the DVS.

In an embodiment, the message sending module 403 is specifically configured to: and controlling the terminal equipment corresponding to the target IP address to generate and send a free ARP message.

In one embodiment, the polymerization port comprises: the main member port is connected with an external first switch, the standby member port is connected with an external second switch, and the first switch is connected with the second switch in a cascade manner. The determining module 401 is specifically configured to: and determining that the main member port is switched to the DOWN state from the UP state or is recovered to the UP state from the DOWN state.

In actual application, the determining module 401, the obtaining module 402, and the message sending module 403 may be implemented by a processor in a network protection device based on an aggregation interface. Of course, the processor needs to run a computer program in memory to implement its functions.

It should be noted that: in the network protection device based on the aggregation port according to the embodiment, when performing network protection based on the aggregation port, only the division of the program modules is illustrated, and in practical applications, the above processing may be distributed to different program modules according to needs, that is, the internal structure of the device is divided into different program modules to complete all or part of the above-described processing. In addition, the aggregation port-based network protection device provided in the above embodiments and the aggregation port-based network protection method embodiment belong to the same concept, and specific implementation processes thereof are described in detail in the method embodiment and are not described herein again.

Based on the hardware implementation of the program module, and in order to implement the method according to the embodiment of the present invention, the embodiment of the present invention further provides a network device. Fig. 5 shows only an exemplary structure of the network device, not the entire structure, and a part of or the entire structure shown in fig. 5 may be implemented as necessary.

As shown in fig. 5, a network device 500 provided in an embodiment of the present invention includes: at least one processor 501, memory 502, a user interface 503, and at least one network interface 504. The various components in network device 500 are coupled together by a bus system 505. It will be appreciated that the bus system 505 is used to enable communications among the components of the connection. The bus system 505 includes a power bus, a control bus, and a status signal bus in addition to a data bus. For clarity of illustration, however, the various buses are labeled as bus system 505 in FIG. 5.

The user interface 503 may include a display, a keyboard, a mouse, a trackball, a click wheel, a key, a button, a touch pad, a touch screen, or the like, among others. The network interface 504 includes an aggregation port through which the network device connects with communication devices in the external environment.

Memory 502 in embodiments of the present invention is used to store various types of data to support the operation of network devices. Examples of such data include: any computer program for operating on a network device.

The aggregation port-based network protection method disclosed by the embodiment of the invention can be applied to the processor 501, or can be implemented by the processor 501. The processor 501 may be an integrated circuit chip having signal processing capabilities. In implementation, the steps of the aggregation-port-based network protection method may be implemented by hardware integrated logic circuits or instructions in software in the processor 501. The Processor 501 may be a general purpose Processor, a Digital Signal Processor (DSP), or other programmable logic device, discrete gate or transistor logic device, discrete hardware components, etc. Processor 501 may implement or perform the methods, steps, and logic blocks disclosed in embodiments of the present invention. A general purpose processor may be a microprocessor or any conventional processor or the like. The steps of the method disclosed by the embodiment of the invention can be directly implemented by a hardware decoding processor, or can be implemented by combining hardware and software modules in the decoding processor. The software module may be located in a storage medium located in the memory 502, and the processor 501 reads the information in the memory 502, and completes the steps of the aggregation interface-based network protection method provided by the embodiment of the present invention in combination with hardware thereof.

In an exemplary embodiment, the network Device may be implemented by one or more Application Specific Integrated Circuits (ASICs), DSPs, Programmable Logic Devices (PLDs), Complex Programmable Logic Devices (CPLDs), FPGAs, general purpose processors, controllers, Micro Controllers (MCUs), microprocessors (microprocessors), or other electronic components for performing the aforementioned methods.

It will be appreciated that the memory 502 can be either volatile memory or nonvolatile memory, and can include both volatile and nonvolatile memory. Among them, the nonvolatile Memory may be a Read Only Memory (ROM), a Programmable Read Only Memory (PROM), an Erasable Programmable Read-Only Memory (EPROM), an Electrically Erasable Programmable Read-Only Memory (EEPROM), a magnetic random access Memory (FRAM), a Flash Memory (Flash Memory), a magnetic surface Memory, an optical disk, or a Compact Disc Read-Only Memory (CD-ROM); the magnetic surface storage may be disk storage or tape storage. Volatile memory can be Random Access Memory (RAM), which acts as external cache memory. By way of illustration and not limitation, many forms of RAM are available, such as Static Random Access Memory (SRAM), Synchronous Static Random Access Memory (SSRAM), Dynamic Random Access Memory (DRAM), Synchronous Dynamic Random Access Memory (SDRAM), Double Data Rate Synchronous Dynamic Random Access Memory (DDRSDRAM), Enhanced Synchronous Dynamic Random Access Memory (ESDRAM), Enhanced Synchronous Dynamic Random Access Memory (Enhanced DRAM), Synchronous Dynamic Random Access Memory (SLDRAM), Direct Memory (DRmb Access), and Random Access Memory (DRAM). The described memory for embodiments of the present invention is intended to comprise, without being limited to, these and any other suitable types of memory.

An embodiment of the present invention further provides a network system, as shown in fig. 6, including an external switch 600 and the network device 500 described in the foregoing embodiment, where the external switch 600 includes at least two switches connected in cascade, and the at least two switches are respectively connected to member ports on an aggregation port of the network device 500. For example, the external switch 600 includes switches sw1 and sw2, and the aggregation port includes member ports eth0 and eth1, where sw1 is connected with eth0, sw2 is connected with eth1, and sw1 is cascade-connected with sw 2.

In an exemplary embodiment, the embodiment of the present invention further provides a storage medium, that is, a computer storage medium, which may be specifically a computer readable storage medium, for example, including a memory 502 storing a computer program, where the computer program is executable by a processor 501 of a network device to perform the steps described in the method of the embodiment of the present invention. The computer readable storage medium may be a ROM, PROM, EPROM, EEPROM, Flash Memory, magnetic surface Memory, optical disk, or CD-ROM, among others.

It should be noted that: "first," "second," and the like are used for distinguishing between similar elements and not necessarily for describing a particular sequential or chronological order.

In addition, the technical solutions described in the embodiments of the present invention may be arbitrarily combined without conflict.

The above description is only for the specific embodiments of the present invention, but the scope of the present invention is not limited thereto, and any person skilled in the art can easily conceive of the changes or substitutions within the technical scope of the present invention, and all the changes or substitutions should be covered within the scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. A network protection method based on an aggregation port is characterized by comprising the following steps:

acquiring target internet protocol IP address information;

and sending the target IP address information to the network, so that the external switch updates the forwarding table FDB based on the transfer path of the target IP address information.

2. The method of claim 1, wherein determining that a change in operating state has occurred in at least one member port of the aggregation port comprises:

and determining that at least one member port of the aggregation port is switched to a fault DOWN state from a working UP state or is recovered to an UP state from a DOWN state.

3. The method of claim 1, wherein obtaining the destination IP address information comprises:

determining target terminal equipment according to a distributed virtual switch DVS connected with the aggregation port, acquiring IP address information of the target terminal equipment, and taking the IP address information of the target terminal equipment as the target IP address information; wherein the target terminal device is one or more terminal devices connected to the DVS.

4. The method of claim 1, wherein obtaining the destination IP address information comprises:

acquiring a target Media Access Control (MAC) address in a digital video broadcasting (DVS) FDB connected with the aggregation port, and determining the target IP address information based on the target MAC address; and the target MAC address is a MAC address corresponding to other ports except the port connected with the aggregation port in the FDB of the DVS.

5. The method of claim 1, wherein sending the target IP address information into a network comprises:

and controlling the terminal equipment corresponding to the target IP address to generate and send a free Address Resolution Protocol (ARP) message.

6. The method of claim 1, wherein the polymerization port comprises: the system comprises a main member port and a standby member port, wherein the main member port is connected with an external first switch, the standby member port is connected with an external second switch, and the first switch and the second switch are in cascade connection; the determining that the operating state of at least one member port of the aggregation port changes comprises the following steps:

and determining that the main member port is switched to the DOWN state from the UP state or is recovered to the UP state from the DOWN state.

7. An aggregation port based network protection device, comprising:

the acquisition module is used for acquiring target IP address information;

8. A network device, comprising: a processor and a memory for storing a computer program capable of running on the processor, wherein,

the processor, when executing the computer program, is adapted to perform the steps of the method of any of claims 1 to 6.

9. A network system comprising an external switch and the network device of claim 8, the external switch comprising at least two switches connected in cascade, the at least two switches being connected to member ports on an aggregation port of the network device, respectively.

10. A storage medium having a computer program stored thereon, the computer program, when executed by a processor, implementing the steps of the method of any one of claims 1 to 6.