Summary of the invention
The present invention will solve is the problem that the equipment that is connected with the port of using Isolated-User VLAN in the prior art can not get this port vlan information.
First kind of implementation method that comprises the user-isolated virtual local area network (LAN) of main VLAN Primary VLAN and at least one secondary VLAN Secondary VLAN of the present invention may further comprise the steps:
It is the message of outbound port that the Secondry vlan port receives with the Primary vlan port;
Before message is transferred the Primary vlan port, in message, increase Priamry VLAN label.
Preferably, described method also comprises: when when the Primary vlan port receives the message with PrimaryVLAN label, directly transmit according to the destination address in the message.
Preferably, describedly be specially before message is transferred the Primary vlan port: in removing message behind the Secondary VLAN label, send message from the Primary vlan port before.
Alternatively, describedly before being transferred the Primary vlan port, message is specially: in removing message before the Secondary VLAN label;
The described label that increases Primary VLAN in message is specially: insert Primary VLAN label in message after the SecondaryVLAN label.
Preferably, the message that sends from the Primary vlan port is set and carries Primary VLAN label.
Preferably, described method also comprises: before message is transferred the Secondary vlan port, increase Secondary VLAN label in message.
Second kind of implementation method that comprises the user-isolated virtual local area network (LAN) of Primary VLAN and at least one Secondary VLAN of the present invention may further comprise the steps:
It is the message of outbound port that the Primary vlan port receives with the Secondary vlan port;
Before message is transferred the Secondary vlan port, in message, increase Secondary VLAN label.
Preferably, described method also comprises: when receiving the message with Secondary VLAN label from the Secondary vlan port, directly transmit according to the destination address in the message.
Preferably, describedly before message is transferred the Secondary vlan port, be specially: removing in the message behind the Primary VLAN label, send message from the Secondary vlan port before.
Alternatively, describedly before being transferred the Secondary vlan port, message is specially: removing in the message before the Primary VLAN label;
The described label that increases Secondary VLAN in message is specially: insert Secondary VLAN label in message after the PrimaryVLAN label.
Preferably, described method also comprises: the message that sends from the Secondary vlan port is set has Secondary VLAN label.
A kind of network equipment with user-isolated virtual function of local area network provided by the invention comprises that at least one Primary vlan port, Primary label processing module, Primary label are provided with module and forwarding module, wherein:
The Primary vlan port is used for carrying out the uplink message transmitting-receiving of user-isolated virtual local area network (LAN);
The Primary label is provided with module and is used for disposing from the message that this Primary vlan port sends and has or do not have the VLAN label;
The Primary label processing module is used for according to the Primary label modules configured carried or do not carry transmission message from Primary VLAN label to this PrimaryVLAN port output being set;
Forwarding module connects the Primary label processing module, is used for E-Packeting.
Preferably, when having the VLAN label the message that receives from the Primary vlan port, the Primary label processing module exports it to forwarding module; When not having the VLAN label the message that receives from the Primary vlan port, Primary tag processes unit exports it to forwarding module increase the PriamryVLAN label in this message after.
Preferably, the described network equipment comprises that also at least one Secondary vlan port, Secondary label processing module and Secondary label are provided with module, wherein:
The Secondary vlan port is used for carrying out the downlink message transmitting-receiving of user-isolated virtual local area network (LAN);
The Secondary label is provided with module and is used for disposing from the message that this Secondary vlan port sends and has or do not have the VLAN label;
The Secondary label processing module connects forwarding module, is used for according to the Secondary label modules configured carried or do not carry transmission message from Secondary VLAN label to this Secondary vlan port output being set.
Preferably, when having the VLAN label the message that receives from the Secondary vlan port, the Secondary label processing module exports it to forwarding module; When not having the VLAN label the message that receives from the Secondary vlan port, Secondary tag processes unit exports it to forwarding module increase Secondary VLAN label in this message after.
The present invention is by increasing Primary VLAN label or SecondaryVLAN label the message that sends at Primary vlan port and/or Secondary vlan port from Isolated-User VLAN, make the label that can have PrimaryVLAN or Secondary VLAN in the up and downlink message of Isolated-User VLAN, thereby under the condition that does not change existing forwarding process and forwarding decision, greatly expanded the application of Isolated-User VLAN.
Embodiment
Between the network equipment, vlan information transmits by the VLAN label in the message.The sign that comprises VLAN in the VLAN label, the network equipment can go out to send the VLAN at the node place of this message by the VLAN tag recognition.What for example, the realization of VLAN label in the Ethernet message was the most common has following two kinds:
First kind is IEEE 802.1Q agreement frame structures specified, as shown in the table:
Target MAC (Media Access Control) address |
Source MAC |
TPID |
TCI |
Frame type |
Data division |
In the last table, between the source MAC and frame type of former ethernet frame structure, increased the VLAN label that comprises 2 byte TPID (Tag protocol Identifier, tag protocol identifier symbol) and 2 byte TCI (Tag ControlInformation, tag control information).Wherein, the TPID value of being fixed as 0x8100 shows to have the 802.1Q label information in this frame; Comprise 12 vlan identifier VID among the TCI, VID has identified the VLAN under this frame uniquely;
Second kind is ISL (Inter Switch Link) the agreement frame structures specified of Cisco (Cisco) company, as shown in the table:
ISL?Header |
Target MAC (Media Access Control) address |
Source MAC |
Frame type |
Data division |
In the last table, the ISL Header (ISL packet header) that has increased by 26 bytes at the front end of former ethernet frame structure is as the VLAN label, comprising the VLAN ID (vlan identifier) of VLAN under this frame of unique identification.
Whether carry the VLAN label corresponding to the message that is sent, the port on the network equipment is divided into following three kinds:
A.Access (access) port: when certain port is the Access port to certain VLAN, when message enters this port, can in message, increase the label of this VLAN; And before message is sent by this port, can remove the VLAN label in the message;
B.Trunk (converging) port: when certain port was the Trunk port to certain VLAN, this port belonged to a plurality of VLAN usually, one of them can be set be the default VLAN of this port; Except the message that belongs to this port default VLAN, carry the label of VLAN under this message in the message that sends by this port;
C.Hybrid (mixing) port: the Hybrid port has increased a function than Trunk port, the message that sends from the Hybrid port promptly can be set carry or do not carry the VLAN label.
In the realization of prior art, all Isolated-User vlan ports all can only be the Access ports.The present invention will realize that the information of Primary VLAN and/or Secondary VLAN is to coupled equipment visibility, promptly be to realize that Primary VLAN label is up and Secondary VLAN label is descending, in other words, making the Isolated-User vlan port except the Access port, also can be Trunk port or Hybrid port.
Need to prove that Isolated-User VLAN has different titles in the product of different company, for example in the switching equipment of Cisco company, be referred to as Private VLAN (special use).The present invention can be applied to all can be mapped as a plurality of VLAN a VLAN, to realize the network equipment of user-isolated function, adopts the general name of user-isolated VLAN as this type of realization among the present invention, and should be with it as the qualification to range of application of the present invention.
In the embodiments of the invention one, the flow process of the file transmitting method that realization Primary VLAN label is up as shown in Figure 2.At step S210, the message that sends from the Primary vlan port is set whether carries Primary VLAN label.
Usually, when the Primary vlan port only belonged to a Primary VLAN, the message that sends from this port did not need to carry Primary VLAN label; And when the Primary vlan port provided up connection for two or more Primary VLAN, then the message of at least one Primary VLAN should carry Primary VLAN label when this port sends.
For make the present invention as far as possible with the prior art compatibility, recommend to adopt the Primary vlan port to be set to Access port, Trunk port or Hybrid port and the message that sends from this port is set whether carries the VLAN label certain Primary VLAN.Is Access port or for the Hybrid port and when sending message and not carrying the VLAN label when certain Primary vlan port is set to certain Primary VLAN, promptly is provided with from this Primary VLAN message that this Primary vlan port sends and does not carry the VLAN label; Is Trunk port or for the Hybrid port and when sending message and carrying the VLAN label when certain Primary vlan port is set to certain Primary VLAN, usually promptly be provided with from this Primary VLAN message that this Primary vlan port sends and carry the VLAN label, the situation of exception is the default VLAN of this Primary VLAN for this Trunk port.
Can also will carry Primary VLAN label or not carry Primary VLAN label as default mode of operation, in this case, when working in default mode of operation, step S210 can omit.
At step S220, the message that has Secondary VLAN label is forwarded to the Primary vlan port.
At step S230, remove the Secondary VLAN label in the message.
To being inbound port with the Secondary vlan port, being that the handling process of message of outbound port is identical with the Primary vlan port, repeat no more in step S220 and step S230 and the prior art herein.
At step S240, judge that the message that whether is set to from the Primary vlan port sends carries the VLAN label in step S210, if, execution in step S250; If not, then identical with handling process to message in the prior art, change step S260.If it is unique mode of operation that the Primary vlan port sends the message that carries the VLAN label, then step S240 can omit.
At step S250, in message, increase the label of Primary VLAN under it.Agreement according to this message adopts adds Primary VLAN label in the position of agreement regulation.
At step S260, message is sent out the Primary vlan port.
To the message that receives from the Primary vlan port, judge whether carry the VALN label in this message, if not,, in this message, add Primary VLAN label and forwarding then according to handling process of the prior art; If then directly transmit according to the destination address of this message.
Some network equipments are not supported in before port transmission message, add another VLAN label behind the VLAN label in removing message again, can adopt this moment and realize the up file transmitting method of PrimaryVLAN label in the embodiment of the invention two, its flow process as shown in Figure 3.
Step S310 among the embodiment two and step S320 respectively with embodiment one in step S210 identical with step S220, no longer repeat.
At step S330, judge whether to be set to carry the VLAN label from the message that the Primary vlan port sends, if, execution in step S340; If not, then, change step S350 to identical in the handling process of message and the prior art.
Equally, be unique mode of operation if the Primary vlan port sends the message that carries the VLAN label, then step S330 can omit.
At step S340, in message, insert Primary VLAN label after the Secondary VLAN label.
The position at Secondary VLAN label place promptly is the VLAN label position of agreement regulation in this message, therefore in Secondary VLAN label back, insert Primary VLAN label with Secondary VLAN label position adjacent, at step S350 after the message handling process removes Secondary VLAN label in by prior art, this message promptly becomes the message that carries Primary VLAN label like this.
Message with employing 802.1Q agreement is an example, and after inserting Primary VLAN label, its frame structure is as shown in the table:
The Destination MAC address |
MAC address, source |
?Secondary ?VLAN ?TPID |
Secondary VLAN TCI |
Primary VLAN TPID |
Primary VLAN TCI |
Frame type |
Data division |
At step S350, remove the Secondary VLAN label in the message.
At step S360, message is sent out the Primary vlan port.
To identical the handling process of the message that receives from the Primary vlan port and the embodiment one, no longer repetition.
Corresponding to embodiment one, embodiments of the invention three are used for realizing that Secondary VLAN label is descending, and its flow process as shown in Figure 4.At step S410, the message that sends from the Secondary vlan port is set whether carries Secondary VLAN label.
For make the present invention as far as possible with the prior art compatibility, recommend to adopt the Secondary vlan port to be set to Access port, Trunk port or Hybrid port and the message that sends from this port is set whether carries the VLAN label certain Secondary VLAN.Is Access port or for the Hybrid port and when sending message and not carrying the VLAN label when certain Secondary vlan port is set to certain Secondary VLAN, promptly is provided with from this SecondaryVLAN message that this Secondary vlan port sends and does not carry the VLAN label; Is Trunk port or for the Hybrid port and when sending message and carrying the VLAN label when certain Secondary vlan port is set to certain Secondary VLAN, usually promptly be provided with from this Secondary VLAN message that this Secondary vlan port sends and carry the VLAN label, the situation of exception is the default VLAN of this Secondary VLAN for this Trunk port.
Can also will carry Secondary VLAN label or not carry Secondary VLAN label as default mode of operation, in this case, when working in default mode of operation, step S410 can omit.
At step S420, the message that has Primary VLAN label is forwarded to the Secondary vlan port.
At step S430, remove the Primary VLAN label in the message.
To being inbound port with the Primary vlan port, being that the handling process of message of outbound port is identical with the Secondary vlan port, repeat no more in step S420 and step S430 and the prior art herein.
At step S440, judge that the message that whether is set to from the Secondary vlan port sends carries the VLAN label in step S410, if, execution in step S450; If not, then identical with handling process to message in the prior art, change step S460.
If it is unique mode of operation that the Secondary vlan port sends the message that carries the VLAN label, then step S440 can omit.
At step S450, in message, increase the label of Secondary VLAN under it.Agreement according to this message adopts adds Secondary VLAN label in the position of agreement regulation.
At step S260, message is sent out the Secondary vlan port.
To the message that receives from the Secondary vlan port, judge whether carry the VLAN label in this message, if not,, in this message, add SecondaryVLAN label and forwarding then according to handling process of the prior art; If then directly transmit according to the destination address of this message.
Corresponding to embodiment two, to not being supported in before port transmission message, add the network equipment of another VLAN label behind the VLAN label in removing message again, can adopt the method for the embodiment of the invention four to realize that Secondary VLAN label is descending.Its flow process as shown in Figure 5.
The step S510 of embodiment four and step S520 respectively with embodiment three in step S410 identical with step S420, no longer repeat.
At step S530, judge whether to be set to carry the VLAN label from the message that the Secondary vlan port sends, if, execution in step S540; If not, then, change step S550 to identical in the handling process of message and the prior art.
Equally, be unique mode of operation if the Secondary vlan port sends the message that carries the VLAN label, then step S530 can omit.
At step S540, in message, insert Secondary VLAN label after the Primary VLAN label.
The position at Primary VLAN label place promptly is the VLAN label position of agreement regulation in this message, therefore in Primary VLAN label back, insert Secondary VLAN label with Primary VLAN label position adjacent, at step S550 after the message handling process removes Primary VLAN label in by prior art, this message promptly becomes the message that carries Secondary VLAN label like this.
Message with employing 802.1Q agreement is an example, and after inserting Secondary VLAN label, its frame structure is as shown in the table:
The Destination MAC address |
MAC address, source |
?Primary ?VLAN ?TPID |
Primary VLAN TCI |
Secondary VLAN TPID |
Secondary VLAN TCI |
Frame type |
Data division |
At step S550, remove the Primary VLAN label in the message.
At step S560, message is sent out the Secondary vlan port.
To identical the handling process of the message that receives from the Secondary vlan port and the embodiment three, no longer repetition.
Be understood that, embodiments of the invention one and embodiment two can be respectively and embodiment three or embodiment four applied in any combination, make the user to carry or not carry the VLAN label from the message that Primary vlan port and Secondary vlan port send according to the needs setting of practical application.
Fig. 6 is for using the structure chart of the network equipment of the present invention.Forwarding module 640 is connected with Primary label processing module 620, Secondary label processing module 640 respectively, Primary label processing module 620 is provided with module 630 with Primary vlan port 610 and Primary label respectively and is connected, and Secondary label processing module 660 is provided with module 670 with Secondary vlan port 650 and Secondary label respectively and is connected.
Primary vlan port 610 is used for receiving and dispatching the uplink message of Isolated-User VLAN, and Secondary vlan port 650 is used for receiving and dispatching the downlink message of Isolated-User VLAN.
The Primary label is provided with module 630 function that will be configured to carry Primary VLAN label or not carry Primary VLAN label from the message of Primary vlan port 610 transmissions is provided; Equally, the Secondary label is provided with module 670 function that will be configured to carry Secondary VLAN label or not carry Secondary VLAN label from the message of Secondary vlan port 650 transmissions is provided.
Forwarding module 640 is transmitted according to the destination address message in the message.
When Primary vlan port 610 receives message, export it to Primary VLAN label processing module 620.If the VLAN label is arranged in the reception message, Primary VLAN label processing module 620 directly exports it to forwarding module 640; If there is not the VLAN label in the reception message, Primary VLAN label processing module 620 exports it to forwarding module 640 after adding Primary VLAN label therein.
Forwarding module 640 will be that the message of outbound port exports PrimaryVLAN label processing module 620 to Primary vlan port 610.Primary VLAN label processing module 620 is provided with module 630 query configurations to the Primary label, when being configured to send message and carrying the VLAN label, Primary VLAN label processing module 620 is carried the transmission message of Primary VLAN label to 610 outputs of Primary vlan port; When being configured to send message and not being with the VLAN label, Primary VLAN label processing module 620 is not carried the transmission message of Primary VLAN label to 610 outputs of Primary vlan port.
When Secondary vlan port 650 receives message, export it to Secondary VLAN label processing module 660.If the VLAN label is arranged in the reception message, Secondary VLAN label processing module 660 directly exports it to forwarding module 640; If there is not the VLAN label in the reception message, Secondary VLAN label processing module 660 exports it to forwarding module 640 after adding Secondary VLAN label therein.
Forwarding module 640 will be that the message of outbound port exports Secondary VLAN label processing module 660 to Secondary vlan port 650.Secondary VLAN label processing module 660 is provided with module 670 query configurations to the Secondary label, when being configured to send message and carrying the VLAN label, Secondary VLAN label processing module 660 is carried the transmission message of Secondary VLAN label to 650 outputs of Secondary vlan port; When being configured to send message and not carrying the VLAN label, Secondary VLAN label processing module 660 is not carried the transmission message of Secondary VLAN label to 650 outputs of Secondary vlan port.
Can adopt the method for the embodiment of the invention one to four to carry out tag processes in Primary VLAN label processing module 620 and the Secondary VLAN label processing module 660.
In the embodiment and the application network equipment of the present invention of above-mentioned four implementation methods of the present invention, when the Primary vlan port is configured to carry the VLAN label in the transmission message, surpass one Primary vlan port if having among this PrimaryVLAN, identical in the message forwarding method that then carries the VLAN label between the Primary vlan port and the prior art.In like manner, transmit the message that carries the VLAN label and also can adopt implementation method of the prior art belonging to together between the Secondary vlan port of a SecondaryVLAN.
After using the present invention, if the ID of Primary VLAN is Pvlan, the ID of Secondary VLAN is Svlan, the Primary vlan port is Pport, the Secondary vlan port is Sport, after user configuration is mapped to Pvlan with Svlan, can also be by the up and descending of VLAN label be set to issue orders:
Pport Access Pvlan: the collocating uplink message does not carry the VLAN label;
Pport Trunk Pvlan: the collocating uplink message carries the VLAN label;
Pport Hybrid Pvlan untagged: the collocating uplink message does not carry the VLAN label;
Ppot Hybrid Pvlan tagged: the collocating uplink message carries the VLAN label;
Sport Access Svlan: the configurating downlink message does not carry the VLAN label;
Sport Trunk Svlan: the configurating downlink message carries the VLAN label;
Sport Hybrid Svlan untagged: the configurating downlink message does not carry the VLAN label;
Sport Hybrid Svlan tagged: the configurating downlink message carries the VLAN label.
After using the present invention, in network configuration shown in Figure 1,4 Secondary VLAN:Svlan1, Svlan2, Svlan3 and Svlan4 are set on switch 130, wrap port respectively and draw together Sport1, Sport2, Sport3 and Sport4; 2 Primary VLAN are set: the Pvlan1 and the Pvlan2 that comprises Pport1 and server 112 connectivity ports that comprise Pport1 and server 111 connectivity ports.Svlan1 and Svlan2 are mapped to Pvlan1, Svlan3 and Svlan4 are mapped to Pvlan2, configuration is carried Primary VLAN label from the message that the Pport1 port sends, can realize that then user 141 and 142 isolates with server 112 in access server 111, and user 143 and 144 isolates with server 111 in access server 112.
The present invention is under the prerequisite that does not change existing techniques in realizing, can realize the VLAN label uplink and downlink demand of Isolate-User Vlan easily by simple processing, make Isolated-User VLAN in networking, have and other VLAN identical functions, expanded the range of application of Isolated-User VLAN; Simultaneously, the present invention handles existing forwarding process and forwarding process and MAC address entries and does not do any change, has kept the compatibility with prior art.
Above-described embodiment of the present invention does not constitute the qualification to protection range of the present invention.Any any modification of being done within the spirit and principles in the present invention, be equal to and replace and improvement etc., all should be included within the claim protection range of the present invention.