CN117896256A - NAT network element deployment method and system based on container - Google Patents

Abstract

The invention relates to the technical field of network element deployment, and provides a NAT network element deployment method and system based on a container, wherein the method comprises the following steps: receiving the flow reaching the physical network card on the physical machine through the virtual switch; analyzing the received flow through a virtual switch and then sending the flow to a NAT network element container; the NAT network element container carries out NAT logic processing on the flow sent by the virtual switch and returns the flow to the virtual switch; and the virtual switch sends the flow returned by the NAT network element container to the next node through a physical network card of the physical machine. The NAT network element deployment method and system based on the container can improve the cloud server ECS network element deployment to container deployment, reduce resource consumption and improve deployment efficiency; the network element container uses virtual device of virtio-user to butt-joint the vswitch, accelerate the network performance; and the stability of the product management surface is improved by managing the network element containers through kubernetes.

Description

NAT network element deployment method and system based on container

Technical Field

The present invention relates to the field of network element deployment technologies, and in particular, to a method and a system for deploying NAT network elements based on a container.

Background

Because of the high flexibility and elasticity of cloud network development, developers realize specific network functions, such as network address translation (Network Address Translation, NAT, for short), load balancing, virtual private network (Virtual Private Network, VPN, for short) and the like, through network function virtualization (Network Functions Virtualization, NFV, for short) in the development and practice processes. Compared with the traditional hardware scheme, the network service function realized by the NFV has the advantages of higher iteration speed and richer functions.

FIG. 1 is an exemplary diagram of network function virtualization in the prior art, as shown in FIG. 1, for improving the scalability and flexibility of network functions, using virtual machines for deploying network functions; meanwhile, in order to improve network transceiving performance, a virtual switch based on a user state data platform development suite (Data Plane Development Kit, abbreviated as DPDK) is deployed on a physical machine, and a kernel message transceiving flow is bypassed. In the prior art, an open source computer simulation and a virtualizer (qemu) complete the simulation of a virtual device and the negotiation with a back-end vhost-user, and the vhost-user maps mmap memory to the whole qemu process, shares the memory of the whole qemu process, and provides for virtual ring to communicate based on the shared memory. In practical application, the NFV network element deployment by using the virtual machine has a certain flexibility, but because the virtual machine completely simulates a computer, the function required to be loaded is more, and the number of dependent components is more, the following defects exist: 1. the scheduling efficiency is low, and the pulling speed is low; 2. more memory and CPU resources are required to be consumed; 3. in implementing network functions, a complete virtual machine is not required, such as strong isolation and storage functions of the virtual machine are not necessary in most scenarios.

Therefore, how to provide a more efficient and resource-saving NAT network element deployment method becomes a technical problem to be solved.

Disclosure of Invention

In view of the above, the present invention aims to overcome the shortcomings of the prior art, and to provide a method and a system for deploying NAT network elements based on containers.

According to a first aspect of the present invention, there is provided a container-based NAT network element deployment method, the method comprising:

receiving the flow reaching the physical network card on the physical machine through the virtual switch;

analyzing the received flow through a virtual switch and then sending the flow to a NAT network element container;

the NAT network element container carries out NAT logic processing on the flow sent by the virtual switch and returns the flow to the virtual switch;

and the virtual switch sends the flow returned by the NAT network element container to the next node through a physical network card of the physical machine.

Preferably, in the container-based NAT network element deployment method of the present invention, the receiving, by the virtual switch, the traffic arriving at the physical network card on the physical machine includes: the virtual switch sends a flow request to the physical machine, and after the flow reaches the physical network card of the physical machine, the physical machine sends the flow of the physical network card to the corresponding virtual switch according to the received flow request.

Preferably, in the container-based NAT network element deployment method of the present invention, the received traffic is parsed by the virtual switch and then sent to the NAT network element container, including: the virtual switch analyzes the flow received from the physical network card, and sends the analyzed flow to the NAT network element container where the corresponding NAT network element is located through the virtio channel.

Preferably, in the container-based NAT network element deployment method of the present invention, the virtual switch analyzes the traffic received from the physical network card, and sends the analyzed traffic to the NAT network element container where the corresponding NAT network element is located through the virtio channel, including: the virtual switch unpacks the message in the flow received from the physical network card and sends the unpacked message to the NAT network element container where the corresponding NAT network element is located through the virtio channel.

Preferably, in the container-based NAT network element deployment method of the present invention, NAT network element container performs NAT logic processing on traffic sent by a virtual switch and returns the processed traffic to the virtual switch, including: and the NAT network element container carries out NAT logic processing on the received traffic, and returns the traffic after the NAT logic processing to the virtual switch through the virtio channel.

Preferably, in the container-based NAT network element deployment method of the present invention, NAT network element container performs NAT logic processing on the received traffic, and returns the traffic after NAT logic processing to the virtual switch through the virtio channel, including: and the NAT network element container carries out NAT logic processing on the message in the received flow, and returns the message after the NAT logic processing to the virtual switch through the virtio channel.

Preferably, in the container-based NAT network element deployment method of the present invention, the virtual switch sends the flow returned by the NAT network element container to the next node through the physical network card of the physical machine, including: before the virtual machine sends the flow returned by the NAT network element container to the next node through the physical network card of the physical machine, the virtual machine performs network function virtualization processing on the message in the flow according to the service scene requirement.

According to a second aspect of the present invention, there is provided a container-based NAT network element deployment system, the system including a NAT network element deployment server for receiving, by a virtual switch, traffic arriving at a physical network card on a physical machine; analyzing the received flow through a virtual switch and then sending the flow to a NAT network element container; the NAT network element container carries out NAT logic processing on the flow sent by the virtual switch and returns the flow to the virtual switch; and the virtual switch sends the flow returned by the NAT network element container to the next node through a physical network card of the physical machine.

Preferably, in the container-based NAT network element deployment system of the present invention, the NAT network element deployment server includes:

the virtual switch is used for receiving the flow reaching the physical network card on the physical machine, analyzing the received flow and then sending the flow to the NAT network element container; the flow returned by the NAT network element container is sent to a physical network card of a physical machine;

the NAT network element container is used for returning the flow sent by the virtual switch to the virtual switch after NAT logic processing is carried out on the flow;

and the physical machine is used for receiving the arriving flow through the physical network card and sending the flow returned by the NAT network element container to the next node through the physical network card.

According to a third aspect of the present invention there is provided a computer device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, the processor implementing the method of the first aspect of the present invention when executing the program.

According to the NAT network element deployment method and system based on the container, the network element ECS deployment based on the cloud server is improved to be container deployment, so that the resource consumption is reduced, and the deployment efficiency is improved; the network element container uses virtual device of virtio-user to butt-joint the vswitch, accelerate the network performance; and the stability of the product management surface is improved by managing the network element containers through kubernetes.

Drawings

In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings that are needed in the embodiments will be briefly described below, and it is obvious that the drawings in the following description are only some embodiments of the present invention, and that other drawings can be obtained according to these drawings without inventive effort for a person skilled in the art.

FIG. 1 is an exemplary diagram of prior art network function virtualization;

fig. 2 is a schematic diagram of a system suitable for use in the container-based NAT network element deployment method according to an embodiment of the present application;

fig. 3 is a diagram illustrating an architecture of a NAT network element deployment server in a container-based NAT network element deployment system according to an embodiment of the present invention;

fig. 4 is a diagram illustrating another architecture example of a NAT network element deployment server in a container-based NAT network element deployment system according to an embodiment of the present invention;

fig. 5 is a flowchart illustrating steps of a container-based NAT network element deployment method according to an embodiment of the present invention;

fig. 6 is a schematic structural diagram of the apparatus provided by the present invention.

Detailed Description

Embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

It should be noted that, without conflict, the following embodiments and features in the embodiments may be combined with each other; and, based on the embodiments in this disclosure, all other embodiments that may be made by one of ordinary skill in the art without inventive effort are within the scope of the present disclosure.

It is noted that various aspects of the embodiments are described below within the scope of the following claims. It should be apparent that the aspects described herein may be embodied in a wide variety of forms and that any specific structure and/or function described herein is merely illustrative. Based on the present disclosure, one skilled in the art will appreciate that one aspect described herein may be implemented independently of any other aspect, and that two or more of these aspects may be combined in various ways. For example, an apparatus may be implemented and/or a method practiced using any number of the aspects set forth herein. In addition, such apparatus may be implemented and/or such methods practiced using other structure and/or functionality in addition to one or more of the aspects set forth herein.

Fig. 2 is a schematic diagram of a system suitable for use in the container-based NAT network element deployment method according to an embodiment of the present application; as shown in fig. 2, the system may include a NAT network element deployment server 101, a communication network 102, and/or one or more NAT network element deployment clients 103, which are illustrated in fig. 2 as a plurality of NAT network element deployment clients 103.

NAT network element deployment server 101 may be any suitable server for storing information, data, programs, and/or any other suitable type of content. In some embodiments, NAT network element deployment server 101 may perform appropriate functions. For example, in some embodiments, NAT network element deployment server 101 may be used for container-based NAT network element deployment. As an alternative example, in some embodiments, NAT network element deployment server 101 may be used to: receiving the flow reaching the physical network card on the physical machine through the virtual switch; analyzing the received flow through a virtual switch and then sending the flow to a NAT network element container; the NAT network element container carries out NAT logic processing on the flow sent by the virtual switch and returns the flow to the virtual switch; and the virtual switch sends the flow returned by the NAT network element container to the next node through a physical network card of the physical machine.

In this embodiment, the network element is a basic unit in the network, is responsible for implementing various functions of the network, and is a constituent element of the network. The network element consists of one or more machine discs or machine frames, and can independently complete certain transmission functions. In network communications, the network elements may be network devices, servers, routers, switches, etc. A network element is the smallest unit in network management that can be monitored and managed. According to different classification standards, the network elements can be classified into different types, such as an access network element, an aggregation network element, a transmission network element, a service network element, a boundary network element, a core network element and the like.

Fig. 3 is a diagram illustrating an architecture of a NAT network element deployment server in a container-based NAT network element deployment system according to an embodiment of the present invention, and as shown in fig. 3, the NAT network element deployment server in the container-based NAT network element deployment system of the present embodiment includes:

the virtual switch is used for receiving the flow reaching the physical network card on the physical machine, analyzing the received flow and then sending the flow to the NAT network element container; the flow returned by the NAT network element container is sent to a physical network card of a physical machine;

the NAT network element container is used for returning the flow sent by the virtual switch to the virtual switch after NAT logic processing is carried out on the flow;

and the physical machine is used for receiving the arriving flow through the physical network card and sending the flow returned by the NAT network element container to the next node through the physical network card.

In the network element deployment system based on the container, the network element part is virtualized by using the container, the NAT function is realized by applying the network element part in the container, the container is in butt joint with the virtual equipment of the virtual equipment which is realized by using a user mode and provided by the vswitch-DPDK by using the DPDK, the equipment is a network acceleration scheme which is specially provided for the container, the network element is deployed by using the container, and compared with a virtual machine, the network element deployment system has less resource consumption, faster pulling-up speed and easier deployment. The application in the container realizes the functions of the snat source address conversion and the dnat destination address conversion of the nat gateway, and the whole flow from the container to the virtual switch and then to the physical network card is in the user mode, so that the extremely high network throughput performance can be obtained.

As another example, in some embodiments, the NAT network element deployment server 101 may send the container-based NAT network element deployment method to the NAT network element deployment client 103 for use by the user according to the request of the NAT network element deployment client 103.

As an optional example, in some embodiments, the NAT network element deployment client 103 is configured to provide a visual deployment interface, where the visual deployment interface is configured to receive a selection input operation of the NAT network element deployment based on the container by the user, and, in response to the selection input operation, obtain, from the NAT network element deployment server 101, a deployment interface corresponding to an option selected by the selection input operation and display the deployment interface, where at least information of the NAT network element deployment based on the container and operation options for the information of the NAT network element deployment based on the container are displayed in the deployment interface.

In some embodiments, communication network 102 may be any suitable combination of one or more wired and/or wireless networks. For example, the communication network 102 can include any one or more of the following: the internet, an intranet, a Wide Area Network (WAN), a Local Area Network (LAN), a wireless network, a Digital Subscriber Line (DSL) network, a frame relay network, an Asynchronous Transfer Mode (ATM) network, a Virtual Private Network (VPN), and/or any other suitable communication network. NAT network element deployment client 103 can be coupled to communication network 102 via one or more communication links (e.g., communication link 104), and communication network 102 can be linked to NAT network element deployment server 101 via one or more communication links (e.g., communication link 105). The communication link may be any communication link suitable for transferring data between the NAT network element deployment client 103 and the NAT network element deployment server 101, such as a network link, dial-up link, wireless link, hardwired link, any other suitable communication link, or any suitable combination of such links.

NAT network element deployment client 103 may include any one or more clients that present an interface related to container-based NAT network element deployment in an appropriate form for use and operation by a user. In some embodiments, NAT network element deployment client 103 may comprise any suitable type of device. For example, in some embodiments, NAT network element deployment client 103 may include a mobile device, a tablet computer, a laptop computer, a desktop computer, and/or any other suitable type of client device.

Although NAT network element deployment server 101 is illustrated as one device, in some embodiments any suitable number of devices may be used to perform the functions performed by NAT network element deployment server 101. For example, in some embodiments, multiple devices may be used to implement the functions performed by NAT network element deployment server 101. Alternatively, the function of the NAT network element deployment server 101 may be implemented using a cloud service.

Based on the above system, the embodiments of the present application provide a NAT network element deployment method based on a container, which is described in the following embodiments.

Fig. 4 is a diagram illustrating another architecture example of a NAT network element deployment server in a container-based NAT network element deployment system according to an embodiment of the present invention; fig. 5 is a flowchart illustrating steps of a container-based NAT network element deployment method according to an embodiment of the present invention, where the container-based NAT network element deployment method of the present embodiment may be executed at the NAT network element deployment server shown in fig. 4. As shown in fig. 4 and 5, the container-based NAT network element deployment method includes the steps of:

step S201: and receiving the flow reaching the physical network card on the physical machine through the virtual switch.

As an optional example, in this embodiment, the virtual switch sends a flow request to the physical machine, and after the flow reaches the physical network card of the physical machine, the physical machine sends the flow of the physical network card to the corresponding virtual switch according to the received flow request.

Step S202: and analyzing the received traffic through the virtual switch and then sending the analyzed traffic to the NAT network element container.

As an optional example, in this embodiment, the virtual switch parses the traffic received from the physical network card, and sends the parsed traffic to the NAT network element container where the corresponding NAT network element is located through the virtio channel. It should be noted that, in the method of this embodiment, the virtual switch decapsulates the packet in the traffic received from the physical network card and sends the packet to the NAT network element container where the corresponding NAT network element is located through the virtio channel. In practical application, the message in the flow received by the physical network card can be over-encapsulated and then sent to the NAT network element container where the corresponding NAT network element is located through the virtio channel. In the method of the embodiment, the overlay is one or more virtual logical networks constructed on the same underway network through a network virtualization technology. Although the different overlay networks share the equipment and the lines in the Underlay network, the services in the overlay network are decoupled from the physical networking and interconnection technologies in the Underlay network, and the multi-instantiation of the overlay network can serve different services (such as multiple departments) of the same tenant or serve different tenants, and is a core networking technology used by solutions such as SD-WAN and data center. The virtio channel is used for communication of virtual devices with virtual switches.

Step S203: and the NAT network element container carries out NAT logic processing on the traffic sent by the virtual switch and returns the traffic to the virtual switch.

As an optional example, in this embodiment, the NAT network element container performs NAT logic processing on the received traffic, and returns the traffic after NAT logic processing to the virtual switch through the virtio channel. It should be noted that, in the method of this embodiment, the NAT network element container performs NAT logic processing on the packet in the received flow, and returns the packet after NAT logic processing to the virtual switch through the virtio channel. It should be noted that in the method of this embodiment, NAT network element containers may be managed by using kubernetes, which is an open-source application platform for managing containerization on multiple hosts in a cloud platform, where management of NAT network element containers by kubernetes may implement high flexibility and high automation of network element resource management, and may improve reliability of a management plane.

Step S204: and the virtual switch sends the flow returned by the NAT network element container to the next node through a physical network card of the physical machine.

As an optional example, in the method of the embodiment of the present invention, before sending the flow returned by the NAT network element container to the next node through the physical network card of the physical machine, the virtual machine performs network function virtualization processing on the packet in the flow according to the service scenario requirement.

In the NAT network element deployment method and system based on the container, the network element deployment based on the cloud server (Elastic Compute Service, ECS) is improved to container deployment, so that the resource consumption is reduced, and the deployment efficiency is improved; the network element container uses virtual device of virtio-user to butt-joint the vswitch, accelerate the network performance; and the stability of the product management surface is improved by managing the network element containers through kubernetes.

As shown in FIG. 6, the present invention also provides an apparatus comprising a processor 310, a communication interface 320, a memory 330 for storing a processor executable computer program, and a communication bus 340. Wherein the processor 310, the communication interface 320 and the memory 330 perform communication with each other through the communication bus 340. The processor 310 implements the method of the container-based NAT network element deployment method described above by running an executable computer program.

The computer program in the memory 330 may be implemented in the form of software functional units and may be stored in a computer-readable storage medium when sold or used as a separate product. Based on such understanding, the technical solution of the present application may be embodied essentially or in a part contributing to the prior art or in a part of the technical solution, in the form of a software product stored in a storage medium, including several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods of the embodiments of the present application. And the aforementioned storage medium includes: a U-disk, a removable hard disk, a Read-Only Memory (ROM), a random access Memory (RAM, random Access Memory), a magnetic disk, or an optical disk, or other various media capable of storing program codes.

The system embodiments described above are merely illustrative, in which elements illustrated as separate elements may or may not be physically separate, and elements shown as elements may or may not be physical elements, may be located in one place, or may be distributed over a plurality of network elements. Some or all of the modules may be selected based on actual needs to achieve the purpose of the embodiment. Those of ordinary skill in the art will understand and implement the present invention without undue burden.

From the above description of the embodiments, it will be apparent to those skilled in the art that the embodiments may be implemented by means of software plus necessary general hardware platforms, or of course may be implemented by means of hardware. Based on such understanding, the foregoing technical solutions may be embodied essentially or in part in the form of a software product, which may be stored in a computer-readable storage medium, such as a ROM/RAM, a magnetic disk, an optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to perform the various embodiments or methods of some parts of the embodiments.

The foregoing is merely illustrative of the present invention, and the present invention is not limited thereto, and any changes or substitutions easily contemplated by those skilled in the art within the scope of the present invention should be included in the present invention. Therefore, the protection scope of the invention is subject to the protection scope of the claims.

Claims (10)

1. A container-based NAT network element deployment method, the method comprising:

receiving the flow reaching the physical network card on the physical machine through the virtual switch;

analyzing the received flow through a virtual switch and then sending the flow to a NAT network element container;

the NAT network element container carries out NAT logic processing on the flow sent by the virtual switch and returns the flow to the virtual switch;

and the virtual switch sends the flow returned by the NAT network element container to the next node through a physical network card of the physical machine.

2. The container-based NAT network element deployment method of claim 1, wherein receiving traffic arriving at the physical network card on the physical machine through the virtual switch includes: the virtual switch sends a flow request to the physical machine, and after the flow reaches the physical network card of the physical machine, the physical machine sends the flow of the physical network card to the corresponding virtual switch according to the received flow request.

3. The container-based NAT network element deployment method of claim 1, wherein the received traffic is parsed by the virtual switch and sent to the NAT network element container, comprising: the virtual switch analyzes the flow received from the physical network card, and sends the analyzed flow to the NAT network element container where the corresponding NAT network element is located through the virtio channel.

4. The NAT network element deployment method according to claim 3, wherein the virtual switch parses traffic received from the physical network card, and sends the parsed traffic to the NAT network element container where the corresponding NAT network element is located through the virtio channel, comprising: the virtual switch unpacks the message in the flow received from the physical network card and sends the unpacked message to the NAT network element container where the corresponding NAT network element is located through the virtio channel.

5. The container-based NAT network element deployment method of claim 1, wherein the NAT network element container performs NAT logic processing on traffic sent by the virtual switch and returns the processed traffic to the virtual switch, comprising: and the NAT network element container carries out NAT logic processing on the received traffic, and returns the traffic after the NAT logic processing to the virtual switch through the virtio channel.

6. The method for deploying a NAT network element based on container of claim 5 wherein the NAT network element container performs NAT logic processing on the received traffic and returns the NAT logic processed traffic to the virtual switch via the virtio channel, comprising: and the NAT network element container carries out NAT logic processing on the message in the received flow, and returns the message after the NAT logic processing to the virtual switch through the virtio channel.

7. The container-based NAT network element deployment method of claim 1, wherein the virtual switch sends the traffic returned by the NAT network element container to the next node through the physical network card of the physical machine, comprising: before the virtual machine sends the flow returned by the NAT network element container to the next node through the physical network card of the physical machine, the virtual machine performs network function virtualization processing on the message in the flow according to the service scene requirement.

8. The NAT network element deployment system based on the container is characterized by comprising an NAT network element deployment server, wherein the NAT network element deployment server is used for receiving the flow reaching a physical network card on a physical machine through a virtual switch; analyzing the received flow through a virtual switch and then sending the flow to a NAT network element container; the NAT network element container carries out NAT logic processing on the flow sent by the virtual switch and returns the flow to the virtual switch; and the virtual switch sends the flow returned by the NAT network element container to the next node through a physical network card of the physical machine.

9. The container-based NAT network element deployment system of claim 8, wherein the NAT network element deployment server comprises:

the virtual switch is used for receiving the flow reaching the physical network card on the physical machine, analyzing the received flow and then sending the flow to the NAT network element container; the flow returned by the NAT network element container is sent to a physical network card of a physical machine;

the NAT network element container is used for returning the flow sent by the virtual switch to the virtual switch after NAT logic processing is carried out on the flow;

and the physical machine is used for receiving the arriving flow through the physical network card and sending the flow returned by the NAT network element container to the next node through the physical network card.

10. A computer device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, the processor implementing the steps of the method according to any one of claims 1-7 when the program is executed.