CN220693169U - Core network architecture - Google Patents

Abstract

The application discloses a core network architecture. Wherein, include: the system comprises a first data center module and a second data center module, wherein the first data center module is connected with the second data center module, and the constituent units of the first data center module and the second data center module are the same, and the system comprises: network management server and heartbeat network exchanger; the network management server is used for managing and monitoring network equipment in the core network and providing business services for users; the heartbeat network switch of the first data center module is connected with the heartbeat network switch of the second data center module, and is used for transmitting control information, configuration information and data synchronization between the first data center module and the second data center module. The method and the device solve the technical problem that potential network safety operation hazards caused by communication equipment abnormality are easy to occur due to the fact that the safety protection level of the network management network of the communication system in the related technology is poor.

Description

Core network architecture

Technical Field

The present application relates to the field of network communications technologies, and in particular, to a core network architecture.

Background

With the acceleration of the construction of a novel power system of a power grid, the scale of a power communication network is increased increasingly, and the power grid has higher requirements on the safety stability and the bearing capacity of the power communication network. The network management network centralized monitoring capability and the security protection level difference of the communication system in the related technology are easy to generate network security operation hidden trouble caused by communication equipment abnormality.

In view of the above problems, no effective solution has been proposed at present.

Disclosure of Invention

The embodiment of the application provides a core network architecture to at least solve the technical problem that network safety operation hidden danger caused by communication equipment abnormality is easy to occur due to the fact that the safety protection level of a network management network of a communication system in the related technology is poor.

According to an aspect of the embodiments of the present application, there is provided a core network architecture, including: the system comprises a first data center module and a second data center module, wherein the first data center module is connected with the second data center module, and the constituent units of the first data center module and the second data center module are the same, and the system comprises: network management server and heartbeat network exchanger; the network management server is used for managing and monitoring network equipment in the core network and providing business services for users; the heartbeat network switch of the first data center module is connected with the heartbeat network switch of the second data center module, and is used for transmitting control information, configuration information and data synchronization between the first data center module and the second data center module.

Optionally, the first data center module and the second data center module each include a client access switch, where the client access switches are both connected to the core switch of the first data center module and the core switch of the second data center module, and the client access switches are used to provide access services for the network management clients.

Optionally, the network management client is connected to the client access switch, and is configured to provide a front-end interaction interface for monitoring, managing and configuring network devices in the core network for the target object.

Optionally, the core switch is connected to the network management server through the service switch, and is used for forwarding data traffic in the core network.

Optionally, the service switches in the first data center module and the second data center module are both connected with the core switch of the first data center module and the core switch of the second data center module, and the service switches are used for forwarding and switching different service flows.

Optionally, the core switch of the first data center module and the core switch of the second data center module are respectively connected with a load balancing device, and the core switch of the first data center module and the core switch of the second data center module are connected with each other, wherein the load balancing device is used for uniformly distributing network traffic to different servers or network devices in the core network.

Optionally, the core switch of the first data center module and the core switch of the second data center module are both connected to an egress route of the first data center module and an egress route of the second data center module, wherein the egress route is used to communicate the core network with an external network.

Optionally, the exit route of the first data center module is interconnected with the exit route of the second data center module by bare optical fibers.

Optionally, a border firewall is connected to each link connecting the core switch to the egress route, wherein the border firewall is used to monitor and filter network traffic going into and out of the core network.

Optionally, a longitudinal encryption device is further connected to each link connected between the core switch and the egress route, where the longitudinal encryption device is used to encrypt and decrypt links transmitted in the links.

In this embodiment of the present application, a first data center module and a second data center module are adopted, where the first data center module is connected to the second data center module, and constituent units of the first data center module and the second data center module are the same, and each of the constituent units includes: network management server and heartbeat network exchanger; the network management server is used for managing and monitoring network equipment in the core network and providing business services for users; the heartbeat network switch of the first data center module is connected with the heartbeat network switch of the second data center module, and is used for transmitting control information, configuration information and carrying out data synchronization between the first data center module and the second data center module.

Drawings

The accompanying drawings, which are included to provide a further understanding of the application and are incorporated in and constitute a part of this application, illustrate embodiments of the application and together with the description serve to explain the application and do not constitute an undue limitation to the application. In the drawings:

fig. 1 is a schematic structural diagram of a core network architecture according to an embodiment of the present application;

fig. 2 is a schematic diagram of a network management network core layer backup design according to an embodiment of the present application.

Detailed Description

In order to make the present application solution better understood by those skilled in the art, the following description will be made in detail and with reference to the accompanying drawings in the embodiments of the present application, it is apparent that the described embodiments are only some embodiments of the present application, not all embodiments. All other embodiments, which can be made by one of ordinary skill in the art based on the embodiments herein without making any inventive effort, shall fall within the scope of the present application.

It should be noted that the terms "first," "second," and the like in the description and claims of the present application and the above figures are used for distinguishing between similar objects and not necessarily for describing a particular sequential or chronological order. It is to be understood that the data so used may be interchanged where appropriate such that embodiments of the present application described herein may be implemented in sequences other than those illustrated or otherwise described herein. Furthermore, the terms "comprises," "comprising," and "having," and any variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, system, article, or apparatus that comprises a list of steps or elements is not necessarily limited to those steps or elements expressly listed but may include other steps or elements not expressly listed or inherent to such process, method, article, or apparatus.

In the related art, the centralized monitoring capability and the security protection level of the network and the management network of the communication system are poor, so that the problem of potential safety hazards of network operation caused by abnormal communication equipment easily occurs. In order to solve this problem, related solutions are provided in the embodiments of the present application, and are described in detail below.

According to an embodiment of the present application, an embodiment of a core network architecture is provided, and fig. 1 is a schematic structural diagram of the core network architecture provided according to the embodiment of the present application, as shown in fig. 1, including: a first data center module and a second data center module, wherein,

the first data center module is connected with the second data center module, and the constituent units of the first data center module and the second data center module are the same, and each of the constituent units comprises: network management server and heartbeat network exchanger;

specifically, in order to ensure the reliability of the core network, the scheme adopts two data center modules (a first data center module and a second data center module) which are mutually backed up, the two data center modules share storage, network and server resources, the two data center modules can provide services to the outside, and the whole system has the functions of service load balancing and automatic fault switching.

The network management server is used for managing and monitoring network equipment in the core network and providing business services for users;

the network management server is a key device in the communication network, and the functions mainly comprise the following aspects: network monitoring and management: the network management server may monitor and manage network devices in the communication network, including switches, routers, firewalls, servers, and the like. Through the network management server and the gateway client, an administrator can monitor the running state and performance index of the network equipment in real time and discover and solve network faults and problems in time. Configuring and managing network devices: the network management server may centrally manage configuration information of the network device, including IP addresses, routing tables, access control lists, and the like. An administrator can perform centralized configuration and management on network equipment through a network management server, so that the consistency and reliability of configuration are improved. Security management and protection: the network management server may implement network security policies including access control, intrusion detection and prevention, traffic monitoring and restriction, and the like. Through the network management server, an administrator can carry out safety management and protection on the network equipment, and the safety and reliability of the communication network are ensured. Performance optimization and troubleshooting: the network management server may collect and analyze performance data of the network device, including bandwidth utilization, delay, packet loss rate, and the like. The administrator can optimize the performance of the network equipment through the network management server, and the availability and performance of the network are improved. Meanwhile, the network management server can help an administrator to locate and remove network faults, and the fault recovery time is shortened. Resource management and optimization: the network management server can manage and optimize the resources of the network equipment, including port utilization rate, bandwidth allocation, load balancing and the like. Through the network management server, an administrator can effectively configure and manage network resources, and the resource utilization efficiency and the reliability of the network are improved. In a word, the network management server plays important roles in various aspects such as monitoring, management, configuration, safety, performance optimization, fault elimination and the like in the communication network, and is important for guaranteeing the normal operation of the communication network and improving the network performance.

Specifically, two data center modules respectively deploy a plurality of network management server devices. Network management systems are deployed in the first data center module and the second data center module respectively to form a cluster, and read-write service is provided for the two data center host computer services at the same time; in order to realize unified management of network management server equipment of two data center modules, unified disaster recovery management software can be deployed, double-center visual management is realized through the unified disaster recovery management software, and physical topology of double-activity business is intuitively displayed through the management software.

The heartbeat network switch of the first data center module is connected with the heartbeat network switch of the second data center module, and is used for transmitting control information, configuration information and data synchronization between the first data center module and the second data center module.

The heartbeat network switch mainly has the following functions: heartbeat monitoring: the heartbeat network switch periodically sends heartbeat signals to other nodes in the network for monitoring the survival status of each node. If a certain node does not receive the heartbeat signal for a long time, the node can be judged to possibly fail or break the network, so that corresponding measures are taken. And (3) data transmission: the heartbeat network switch can realize data transmission among nodes. When one node needs to send data to other nodes, the routing and forwarding can be performed through the heartbeat network switch, so that the efficient transmission of the data in the network is ensured. Data synchronization: the heartbeat network switch can realize data synchronization among nodes. When one node needs to synchronize data with other nodes, the data can be copied and transmitted through the heartbeat network switch, so that the data consistency among the nodes is ensured. In a word, the heartbeat network switch plays an important role in monitoring node states, transmitting data and synchronizing data in the heartbeat network, and improves the reliability and usability of the network.

In the scheme of the application, the principle of separate design of the data transmission link and the heartbeat link is adopted. The end-to-end traffic is isolated by VLAN (Virtual Local Area Network ) or VRF ((Virtual Routing and Forwarding, virtual routing and forwarding), and independent physical interconnection links are allocated at the same time, so that traffic and cluster heartbeat separation traffic are realized without mutual influence.

The core network architecture of the embodiments of the present application is further described below.

Fig. 2 is a schematic diagram of a network management network core layer backup design according to an embodiment of the present application, as shown in fig. 2.

The scheme of the application divides the core network into an access layer, a core layer and an exit layer, and the structures of the layers are respectively introduced below.

Wherein, the access stratum includes: in this embodiment, 2 client access switches, 2 service switches, and 2 heartbeat network switches are deployed in each data center module for illustration.

In this embodiment, 2 heartbeat network switches in the first data center module are virtualized into one device through stacking, and are interconnected with the heartbeat network switches of the opposite end data center (the second data center module), and the heartbeat network switches in the first data center module are the same.

The 4 heartbeat network service exchanges can carry out 10GE cascading through the bare optical fibers, and transmit control information, configuration information and data synchronization.

In some embodiments of the present application, the first data center module and the second data center module each include a client access switch, where the client access switches are both connected to a core switch of the first data center module and a core switch of the second data center module, and the client access switches are configured to provide access services for network management clients.

In some embodiments of the present application, a network management client is connected to a client access switch, and is configured to provide a front-end interactive interface for monitoring, managing, and configuring network devices in a core network for a target object.

Specifically, the client access switch is configured and managed in a stacking simplified manner through 10GE dual links, a gigabit single link is adopted to be connected to the network management client, and the gigabit dual links are respectively connected to the core switches of the first data center module and the second data center module in an uplink mode, so that redundancy and reliability are improved, and meanwhile access requirements are provided for a client user.

In some embodiments of the present application, the core switch is connected to the network management server through the service switch, and is responsible for forwarding data traffic in the core network.

In some embodiments of the present application, the service switches in the first data center module and the second data center module are both connected to the core switch of the first data center module and the core switch of the second data center module at the same time, and the service switches are used to implement forwarding and switching of different service flows.

In particular, the service switch is also deployed using a stacked simplified network architecture and protocol, downlinked to the network management server by 10GE fiber, and up-linked to the core switches of the first and second data center modules by 10GE fiber.

The core layer is further described below.

In some embodiments of the present application, the core switch of the first data center module and the core switch of the second data center module are respectively connected to one load balancing device, and the core switch of the first data center module and the core switch of the second data center module are connected to each other, where the load balancing device is used to uniformly distribute network traffic to different servers or network devices in the core network.

In this embodiment, the core layers of the first data center module and the second data center module in the core network deploy 1 core switch respectively, the downstream client accesses the switch and the service switch, bypasses the load balancing device, and uploads the boundary security device (for example, the boundary firewall, etc.), forwards the network traffic in the core network, and is responsible for the high-speed interconnection of the whole network management network.

The load balancing device is mainly used for distributing and managing network traffic so as to ensure efficient utilization of network resources and balance loads. The load balancing device in the core network in this embodiment may include, but is not limited to, at least one of: load Balancer (Load Balancer): a load balancer is a device that is capable of distributing traffic to multiple servers or network devices. It distributes traffic evenly across different servers according to preset load balancing algorithms, such as polling, weighted polling, minimal connection, etc., to avoid overloading individual servers. Link load balancer (Link Load Balancer): the link load balancer is used for distributing traffic to different network links to achieve load balancing of the network links. The method can select a proper link to distribute the flow according to the load condition and the performance index of the link so as to improve the reliability and the performance of the network. Server load balancer (Server Load Balancer): the server load balancer is used to distribute traffic across multiple servers to balance the load of the servers. The method can select a proper server to distribute the flow according to the load condition, the performance index and the health state of the server so as to improve the availability and the performance of the server. DNS load balancer (DNS Load Balancer): the DNS load balancer distributes traffic to multiple servers by load balancing the results of domain name resolution. According to the load condition and performance index of the server, the method can select a proper server IP address to return to the client so as to realize load balancing of the flow.

The load balancing device can realize adjustment of load balancing strategies and monitoring of traffic through configuration, monitoring and management software. They play a key role in the core network and can improve the performance, reliability and scalability of the network.

The 2 core switches can adopt 10GE cascading, and backup is carried out on the outlet network through 2 pairs of bare optical fibers.

As an optional implementation manner, a communication management system (SG-TMS) can be further interconnected with core switches of the first data center module and the second data center module through transverse isolation, specifically, the SG-TMS system is respectively interconnected with the core switches of the first data center module and the second data center module through bare fibers, the SG-TMS system can reach routes of network management systems, data acquisition and instruction issuing are performed through a northbound interface, normalized management of resource data is provided, and real-time monitoring of multi-manufacturer equipment is provided;

wherein the communication management system (SG-TMS) is a software system for managing and monitoring a communication network. It can help to efficiently manage and maintain its communication devices and networks. SG-TMS has the following functions: and (3) device management: the SG-TMS may monitor and manage communication devices such as routers, switches, firewalls, etc. It can detect the status, performance and health of the device and provide real-time alarms and notifications. Network monitoring: SG-TMS may monitor the performance and traffic of the entire communication network. The method can monitor the throughput, delay and packet loss rate of the network in real time and generate reports and statistical data. Fault management: SG-TMS may help identify and resolve faults in the communication network. It can automatically detect faults and send alarms while providing guidance for fault removal and fault recovery. Configuration management: the SG-TMS may centrally manage and configure the settings of the communication device. It can help administrators configure devices remotely, back up and restore configuration, and ensure consistency between devices. And (3) safety management: the SG-TMS may monitor and manage the security of the communication network. It can detect and block potential security threats and provide security audit and logging functions. By using SG-TMS, the reliability, performance and safety of the communication network can be improved, faults and downtime are reduced, and the operation and maintenance efficiency is improved.

The exit layer is further described below. The egress layer is the boundary of the core network (internal network) to the external network, and in this embodiment, in each data center module of the egress layer: egress routers, longitudinal encryption devices, boundary firewalls, etc.

In some embodiments of the present application, the core switch of the first data center module and the core switch of the second data center module are both connected to an egress route of the first data center module and an egress route of the second data center module, wherein the egress route is used to communicate the core network with an external network.

In some embodiments of the present application, the egress route of the first data center module and the egress route of the second data center module are interconnected by bare optical fibers.

In some embodiments of the present application, a boundary firewall is connected to each link connecting between the core switch and the egress route, wherein the boundary firewall is used to monitor and filter network traffic going into and out of the core network.

In some embodiments of the present application, a longitudinal encryption device is further connected to each link connected between the core switch and the egress route, where the longitudinal encryption device is used to encrypt and decrypt links transmitted in the links.

The egress router in the core network is used for transmitting the data packet from the local network to the target network. The egress router is responsible for finding the best path and forwarding the packet to the next network node according to the routing table until the target network is eventually reached. The egress router may also perform Network Address Translation (NAT) and network packet filtering functions, increasing network security and optimizing network performance.

Longitudinal encryption devices and firewalls are used to provide border security protection, and in particular, the role of the longitudinal encryption devices in the core network is to encrypt data to protect confidentiality and integrity of the data. By encrypting the data, an unauthorized person or organization can be prevented from acquiring sensitive information, and the data is ensured not to be tampered or stolen in the transmission process. The boundary firewall functions to protect the boundary between the core network and the external network from unauthorized access and attacks. The boundary firewall can monitor and filter network traffic entering and exiting the core network, and according to a set security policy, potential threat and malicious activity are prevented, and the security and stability of the core network are improved.

In summary, the role of the longitudinal encryption device and the boundary firewall in the core network is to strengthen the security of data and protect the core network from network attacks.

Specifically, the exit routers of the two data center modules are interconnected through bare optical fibers; the core switch of the first data center module is connected with the boundary firewall and the longitudinal encryption equipment and is interconnected with the outlet router of the second data center module; and the core switch of the second data center module is connected with the boundary firewall and the longitudinal encryption equipment, and is interconnected with the outlet router of the first data center module to transfer service data.

Through the scheme, the two data centers are mutually backed up, the two data centers share storage, network and server resources, and can provide services to the outside, so that the aim of enabling the whole system to have service load balancing and automatic fault switching functions is fulfilled, the centralized monitoring capacity and the safety protection level of the communication system are improved, the monitoring reliability and the safety of the communication equipment are improved, and the technical problem that network safety operation hidden danger caused by communication equipment abnormality is easy to occur due to the fact that the safety protection level of the network management network of the communication system in the related technology is poor is solved.

The foregoing embodiment numbers of the present application are merely for describing, and do not represent advantages or disadvantages of the embodiments.

In the foregoing embodiments of the present application, the descriptions of the embodiments are emphasized, and for a portion of this disclosure that is not described in detail in this embodiment, reference is made to the related descriptions of other embodiments.

In the several embodiments provided in the present application, it should be understood that the disclosed technology content may be implemented in other manners. The above-described embodiments of the apparatus are merely exemplary, and the division of the units, for example, may be a logic function division, and may be implemented in another manner, for example, a plurality of units or components may be combined or may be integrated into another system, or some features may be omitted, or not performed. Alternatively, the coupling or direct coupling or communication connection shown or discussed with each other may be through some interfaces, units or modules, or may be in electrical or other forms.

The units described as separate parts may or may not be physically separate, and parts displayed as units may or may not be physical units, may be located in one place, or may be distributed on a plurality of units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional unit in each embodiment of the present application may be integrated in one processing unit, or each unit may exist alone physically, or two or more units may be integrated in one unit. The integrated units may be implemented in hardware or in software functional units.

The integrated units, if implemented in the form of software functional units and sold or used as stand-alone products, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present application may be embodied in essence or a part contributing to the prior art or all or part of the technical solution in the form of a software product stored in a storage medium, including several instructions to cause a computer device (which may be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the methods described in the embodiments of the present application. And the aforementioned storage medium includes: a U-disk, a Read-Only Memory (ROM), a random access Memory (RAM, random Access Memory), a removable hard disk, a magnetic disk, or an optical disk, or other various media capable of storing program codes.

The foregoing is merely a preferred embodiment of the present application and it should be noted that modifications and adaptations to those skilled in the art may be made without departing from the principles of the present application and are intended to be comprehended within the scope of the present application.

Claims (10)

1. A core network architecture, comprising: a first data center module and a second data center module, wherein,

the first data center module is connected with the second data center module, and the first data center module and the second data center module have the same constituent units, and each of the first data center module and the second data center module comprises: network management server and heartbeat network exchanger;

the network management server is used for managing and monitoring network equipment in the core network and providing business service for users;

the heartbeat network switch is connected with the network management server, and the heartbeat network switch of the first data center module is connected with the heartbeat network switch of the second data center module, and is used for transmitting control information, configuration information and carrying out data synchronization between the first data center module and the second data center module.

2. The core network architecture of claim 1, wherein the first data center module and the second data center module each comprise a client access switch, wherein,

the client access switches are connected with the core switch of the first data center module and the core switch of the second data center module at the same time, and the client access switches are used for providing access service for network management clients.

3. The core network architecture of claim 2, wherein the network management client is coupled to the client access switch for providing a front-end interactive interface for monitoring, managing, and configuring network devices in the core network for a target object.

4. A core network architecture according to claim 3, wherein the core switch is connected to the network management server via a service switch for being responsible for forwarding data traffic in the core network.

5. The core network architecture of claim 4, wherein the service switches in the first data center module and the second data center module are both simultaneously connected to a core switch of the first data center module and a core switch of the second data center module, the service switches being configured to enable forwarding and switching of different service traffic.

6. A core network architecture according to claim 3, characterized in that the core switch of the first data center module and the core switch of the second data center module are each connected to one load balancing device and the core switch of the first data center module and the core switch of the second data center module are connected to each other, wherein the load balancing devices are used for evenly distributing network traffic to different servers or network devices in the core network.

7. The core network architecture of claim 6, wherein the core switch of the first data center module and the core switch of the second data center module are both simultaneously connected with an egress route of the first data center module and an egress route of the second data center module, wherein the egress route is for communicating a core network with an external network.

8. The core network architecture of claim 7, wherein the egress route of the first data center module and the egress route of the second data center module are interconnected by bare optical fibers.

9. The core network architecture of claim 7, wherein a border firewall is coupled to each link between the core switch and the egress route, wherein the border firewall is configured to monitor and filter network traffic to and from the core network.

10. The core network architecture of claim 9, wherein a longitudinal encryption device is further connected to each link between the core switch and the egress route, wherein the longitudinal encryption device is configured to encrypt and decrypt links transmitted in the links.