JP2001237890A - Management network configuration method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To reduce the possibility that a control packet is affected by a user packet when the control packet such as a COPS and an SNMP is transmitted on the same network as the user packet from an end user. SOLUTION: The management network configuration method of this invention uses a conventional communication quality assurance function of each network unit to preset the setting of priority and band assurance of a control packet for network policy management such as the COPS and the SNMP thereby separating a management network through which the control packet is transmitted from a network through which a user packet is transmitted apparently in the network operation.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

The present invention relates to a method for configuring a management network between a network device capable of setting a policy such as communication quality and a management server for setting a policy in the network device.

[0002]

2. Description of the Related Art In recent years, network devices such as routers and LAN switches have various functions such as a filtering function and a packet priority control function and a band control function for guaranteeing communication quality. As the number of these network devices increases, or as the size of the network increases, such as a corporate network or a carrier network, the network administrator requires an enormous amount of effort for the setting. Recently, in order to reduce the labor of the administrator, a network operation intended by the network administrator (hereinafter referred to as a policy) and its settings can be set in the network device from a network management device or a server for policy management. It became so.

[0003]

In the normal case, the same network as the user packet from the user terminal is used between the network management device or the server for policy management and the network device. When trying to set the administrator's policy on the network device, at the time of initial setting, user packets are not flowing, so it can be set without any problem, but communication from the user starts, and the policy is set while online, or When collecting information such as statistical information from each network device in order to confirm that the network is operating according to the policy that has already been set, the user packet and the information such as the policy setting and confirmation described above Since the control packet flows on the same network, when the user packet has a high traffic, the control packet may be delayed or discarded. This is because policies such as the communication quality assurance described above are generally set for packets from end users, and policies are hardly considered even for control packets for setting policies. It is.

In such a case, a network in which a control packet flows and a network in which a user packet flows are physically different from the other network.
ronous Transfer Mode) control packets are transferred to VP (Vi
rtual Path) and VC (Virtual Channel) settings, the frame relay network transmits control packets to DLCI (Da
ta Link Connection Identifier), there is a method of streaming to a different network logically. However, when using the public network,
If logically another path is provided, there is a high possibility that the operation cost will increase.

[0005] It is an object of the present invention to reduce the possibility that the control packet is affected by the user packet, and to separate the management network network through which the control packet flows from the network through which the user packet flows apparently in network operation. It is in.

[0006]

According to the management network configuration method of the present invention, the priorities and bandwidth guarantees of the control packets are set in advance by the conventional communication quality assurance function of each network device. Thus, the possibility that the control packet is affected by the user packet is reduced. In addition, the management network configuration method of the present invention, by setting a filtering setting for the control packet in advance by using a conventional filtering function of each network device, limits the target range of the management network, It is characterized in that a plurality of management network target areas can be provided.

[0007]

FIG. 1 shows a first embodiment of the present invention.
This will be described with reference to FIG.

FIG. 1 is a diagram showing a configuration example of a corporate network to which the present invention is applied. This network is assumed to be composed of network devices that guarantee communication quality. The head office network 105C is the Ethernet switch 10
Backbone network 105 of 3A or ATM switch 104A
Via A, high performance routers 102A, 102C,
102D and an Ethernet switch 103B are connected. The branch office network 105D includes an Ethernet switch 103C and a router 102E connected to the high performance router 102B.
Are connected. Head Office Network 105
C and the branch office network 105D
A and 102B are connected via a public network 105B. In the head office network 105C, a server device (abbreviated as a policy management server) 101A for performing network management and policy management is connected to the high performance router 102A, an end user terminal 101B is connected to the router 102C, and an end user's terminal is connected to the Ethernet switch 103A. The server device 101C is connected.

In the branch office network 105D, an end user terminal 101D is connected to an Ethernet switch 103D, and an end user terminal 101E is connected to a router 102E. From the policy management server 101A, for example, a control packet 106A for setting a policy flows to the router 102C, and a control packet 106B for setting a policy flows to the router 102E. For example, a user packet 107A is transmitted from the end user terminal 101B to the end user server device 101C.
Flows, or a user packet 107B flows with the end user terminal 101E.

FIG. 2 is a diagram showing a configuration example of a carrier network to which the present invention is applied. This network is assumed to be composed of network devices that guarantee communication quality.

[0011] The core network 203A is connected to edge routers 202A, 202D, and 202 via core routers 202B and 202C.
202E. The user router 202F is connected to an edge router 202D via an access network 203B, and the user router 202G is connected to an edge router 202E via an access network 203C. The policy management server 201A is connected to the edge router 202A, and the end user terminal 201 is connected to the user router 202F.
B is connected, and the end user's server device 201C is connected to the user router 202G. From the policy management server 201A, for example, a control packet 204A for setting a policy flows to the edge router 202D, and a control packet 204B for setting a policy flows to the edge router 202E. From the end user terminal 201B, for example, the end user server device 2
The user packet 205A flows between the user packet 205A and the user packet 205C.

FIG. 3 shows routers 102 and 2 to which the present invention is applied.
FIG. 2 is a diagram illustrating a configuration example of hardware No. 02. Router 1
Reference numerals 02 and 202 denote a routing management unit 301 that collects routing information and creates and updates a routing table, and a plurality of routing processing units 302 that perform packet routing based on the routing information distributed from the routing management unit 301. (302A, 30
2B), and a packet switch 303 that connects the routing management unit 301 and the plurality of routing processing units 302. The routing management unit 301 includes a CPU
(Centralized Processor Unit) 307B and main memory 308B. Packet buffer 305B
The packet control unit 304B, which controls transmission and reception of packets via the packet switch 303,
It is connected to the CPU 307B via 10B. The routing processing unit 302, like the routing management unit 301, includes a CPU 307A, a main memory 308A, a packet control unit 304A, a packet buffer 305A, and an internal bus 310A. Further, a table memory 306B for storing routing table information and the like, a table search unit 306A for searching the table, and a port control unit 309 for connecting another network device are connected to the packet control unit 304A. Port control unit 30
9 may have multiple ports.

FIG. 4 is a diagram showing an example of packet processing of the routers 102 and 202. The packet received from the port control unit 309 is subjected to port reception processing 401A in the packet control unit 304A, and the packet buffer 305A
At the same time as performing packet reception 402A for storing a packet, header analysis 403A is performed, and table search 404A of routing table 406A and filtering table 407A is performed. Routing table 40
6A is configured with an entry in which a destination network, a next hop address, and a number indicating a routing processing unit of a destination are set as one set. Filtering table 407
A indicates a single or a plurality of conditions that match from the header part of the layer 2 or higher, and is configured from entries in which a process when matching is performed is set as one set. If the result of the table search 404A indicates that processing can be performed by hardware, a transfer packet creation 405A is performed, and switch transmission processing 406A is performed based on the processing indicated in the filtering table 407A.

According to the result of the table search 404A, if the destination is not registered in the routing table 406A or the packet is addressed to the router itself, software processing 409 is performed.

If the packet is addressed to the routing processing unit B, the packet is transmitted from the switch transmission processing 406A to the switch reception processing 406B via the packet switch 303. At the same time as performing packet reception 402B for storing the packet in the packet buffer 305, header analysis 403B is performed, and the layer 2 header table 408 is
Then, a table search 404B of the filtering table 407B is performed. The layer 2 table 408 is composed of entries in which a next hop address and layer 2 header information on a line connected to the port control unit of the routing processing unit B 302B are paired. The layer 2 header information is, for example, when the line is Ethernet, M
AC (Media Access Control) address, and when the line is ATM, VPI / VCI (Virtual Path Identifier)
Identifier / Virtual Channel Identifier). The filtering table 407B has the same configuration as the filtering table 407A. Based on the result of the table search 404B, a transfer packet creation 405B is performed, and a port transmission process 401B is performed based on the process indicated in the filtering table 407B.

If the packet is addressed to the router itself, the packet is transmitted from the switch transmission process 406A to the switch reception process 406C of the routing management unit 301 via the packet switch 303, and the packet is received 402C.
Then, the packet is stored in the packet buffer 305B. The frame / protocol distribution processing 410 analyzes the stored packet, and if the packet is for route control, passes the packet to the route control unit 412. Also, SNMP (Simple Network Management Protocol)
If the packet is the SNMP agent unit 41,
Pass the packet to 1.

FIG. 5 is a diagram showing a configuration example of the communication quality assurance processing 501 in the switch transmission unit 406A and the port transmission unit 401B of the routers 102 and 202. The communication quality assurance processing 501 includes a packet distribution unit 503 and a plurality of buffers 504 (in this example, a C1 buffer 504A,
C2 buffer 504B, C3 buffer 504C, and C4 buffer 504D), a packet scheduler 505, and a buffer class table 502 that defines a class of communication quality assurance. Packet scheduler 505
Performs packet scheduling with high priority and bandwidth guarantee for C1 buffer 504A, and medium priority for C2 buffer 504B,
For 4C, packet scheduling is performed with a low priority, and for C4 buffer 504D, best-effort packet scheduling is performed while there is no packet in C1 buffer 504A to C3 buffer 503C.

FIG. 6 is a diagram showing a configuration example of the filtering table 407. Filtering table 407
Indicates a single or a plurality of conditions that match from the header part of the layer 2 or higher of the packet as described above, and the entry 60 is a set of the processing when the conditions are matched.
It consists of 0. In this example, the policy management server 1
01A, 201A and the control packets exchanged between the routers 102, 202 are COPS (Common O
In the case of the “pen policy service” protocol, the packet is stored in the C1 buffer 504A and the bandwidth is guaranteed to be 1 Mbps (entry 601). In the case of the SNMP, the packet is stored in the C2 buffer 504B (entry 602). ), TCP (Transmission Control Protc)
ol) is set to discard if the port number is 43210 and the source network is 192.168.10.0 (entry 603), and if it does not match any of the conditions, it is stored in the C4 buffer. (Entry 603).

The outline of the packet reception and packet transmission processing procedures of the routers 102 and 202 has been described with reference to FIGS. 4 and 5, but will be described below with reference to the flowcharts of FIGS. 7 to 9.

It is assumed that most of these processes are performed by hardware in the packet control unit 304.

FIG. 7 is a flow chart showing a procedure for receiving a packet. Packet reception 4 from port reception processing 401A
At the same time as 02A, header analysis (701) is performed, and routing table search (702) and filtering table search (703) are performed.

As a result of the routing table search (702), if the search is successful (704), information on the destination routing processing unit and the next hop address is obtained (70).
5), a transfer packet is created (706). The filtering table search (703) is performed in parallel with the routing table search (702). As a result of the filtering table search (703), in the case of a condition match (708), the filtering table search (703) is created in the creation of a transfer packet (706). Processing (709) of the condition that matched the packet is performed.

As a result of the routing table search (703), if the search fails (704), post-processing by software is performed (707). The post-processing by software (707) is, for example, an ICMP due to a destination not being found.
(Internet Control Message Protocol) Unrea
For example, transmission of a channel message. As a result of the filtering table search (703), if the condition does not match (708), the default condition is processed (7).
10). The processing of the default condition (710) enables the filtering table 407 to be described like the entry 603.

FIG. 8 is a flow chart showing a procedure for transmitting a packet. At the same time as packet reception 402B from switch reception processing 406B, header analysis (801) is performed,
A layer 2 table search (802) and a filtering table search (803) are performed.

As a result of the layer 2 header table search (802), if the search is successful (804), layer 2 header information is acquired (805) and a transfer packet is created (8).
06).

Filtering table search (803)
Is performed in parallel with the layer 2 header table search (802). As a result of the filtering table search (803), in the case of the condition match (808), the packet created in the creation of the transfer packet (806) is matched. The condition processing (809) is performed. As a result of the layer 2 header table search (803), if the search fails (804), post-processing by software is performed (807). The post-processing by software (807) is, for example, an ARP (Address Resolution Protocol) due to missing layer 2 header information.
col) message transmission. As a result of the filtering table search (803), if the conditions do not match (808), the default conditions are processed (81).
0). The processing of the default condition (810) enables the filtering table 407 to be described like the entry 603.

FIG. 9 shows the communication quality assurance processing, that is, the processing procedure (709, 809) in the case of passing a packet to the switch transmission unit 406A and the port transmission unit 401B when the filtering conditions match in FIGS. 7 and 8. It is a flow. It is assumed that the filtering table used in this flow has the contents shown in FIG.

If the condition match (708, 808) is COPS
If a match is made by the protocol (901), the packet is stored in the C1 buffer 504A, and a setting is made to guarantee the bandwidth of 1 Mbps (902). If a match is made by the SNMP (903), the packet is stored in the C2 buffer 504B. (904), and the TCP port number is 4321
0 and the source network is 192.168.1
In the case of 0.0, (905) is set to be discarded (906), and if it does not match any condition, it is set to be stored in the C4 buffer (907).

As described above, according to the management network configuration method of the present invention, priorities and bandwidth guarantee settings for control packets such as COPS and SNMP are preset by the conventional communication quality assurance function of each network device. By doing so, the possibility that the control packet is affected by the user packet can be reduced.

Next, a second embodiment of the present invention will be described with reference to FIG.
This will be described with reference to FIG. In the second embodiment, a case will be described in which each network device restricts a target range of a management network by filtering settings, and a case where a target range of a plurality of management network is provided.

FIG. 10 shows FIG. 6 shown in the description of the first embodiment.
FIG. 9 is a diagram illustrating a configuration example of a filtering table, similarly to the configuration example of the filtering table of FIG. In the filtering table 1000A of the configuration example A, in the case of the COPS protocol, it is set to be discarded (entry 100
2) In the case of SNMP, the data is stored in the C1 buffer 504A and the setting is performed so as to guarantee the bandwidth of 512 Kbps (entry 1003). In the case of the RSVP, the data is stored in the C1 buffer 504A and the bandwidth of 64 Kbps is guaranteed. It is set (entry 1004), and if it does not match any of the conditions, it is set to be stored in the C4 buffer (entry 1005). By performing the setting as in the configuration example A, the target range of the management network can be limited for each type of policy. In the filtering table 1000B of the configuration B, in the case of the COPS protocol for exchanging with the policy management server 1, it is stored in the C1 buffer 504A and set so as to guarantee the bandwidth of 1 Mbps (entry 1006).
It is set to be stored in the C2 buffer 504B (entry 1007). In the case of the COPS protocol for exchanging with the policy management server 2, it is set to be discarded (entry 1008). It is set to be stored in the buffer (entry 1009).

By performing the setting as in the configuration example B,
In the case where there are a plurality of policy management servers, a plurality of management network target areas can be provided.

Next, a third embodiment of the present invention will be described with reference to FIGS. In the third embodiment, a method for setting communication quality assurance for each network device will be described.

FIG. 11 is a diagram showing an example of a process for setting the configuration definition information of the router. In the routing management unit 301,
The router has a man-machine interface 1101 for setting configuration definition information such as setting its own address, setting a line interface to be used, setting a routing protocol to be used, and the like. The configuration definition information is stored in the configuration definition file 1102,
The configuration setting processing 1103 sets values in various tables and the like in the router.

In the following, a description will be given of a processing procedure when the configuration definition information is reflected in the filtering table 407 of the routing processing unit 302. In the description of the first embodiment, an example of the packet processing of the router is shown in FIG. 4, but the description of that part is omitted here because it is the same here.
In the above description, the switch transmission process 406A and the switch reception processes 406B and 406C are described only in one-way communication, but two-way communication is also possible as the switch transmission / reception process. Similarly, two-way communication is possible for the packet receptions 402A to 402C.

The switch transmission / reception processing 406C of the routing management unit 301 and the routing processing unit B 30 of FIG.
Between the switch transmission / reception processing 406B of 2B, in addition to transmission / reception of packets addressed to the router itself and transmission / reception from the router, transmission / reception of information for controlling between apparatuses is also performed, and the apparatus has an inter-device control interface 1104 for that. Routing processing unit B3
02B receives the route control packet, it is addressed to the router itself.
02C, frame / protocol distribution processing 410
Is passed to the path control unit 412. When the routing processing unit B302B receives the SNMP packet, the same processing is performed, and the packet is transferred to the SNMP agent 411. Conversely, when the routing controller 412 sets the routing table 1105 in the routing table 406B, or when the SNMP agent 411 sends the MIB
(Management Information Base) setting / reading 11
06, the inter-device control interface 1104
Done through. The setting of the configuration definition information is similarly performed via the inter-device control interface 1104.

FIG. 12 is a diagram showing a configuration example of the configuration definition file. The configuration definition file 1102 includes COPS and S
An entry 12 in which a definition of use / non-use of a function such as NMP, and designation of a plurality of management server addresses is one set.
00. In this example, the COPS function is turned on, only the address of the policy management server 1 is set as the management server address (entry 1201), and the SNMP function is turned on (entry 1203).

FIG. 13 shows the configuration definition file 110 of FIG.
FIG. 12 is a diagram illustrating what should happen when 2 is set in the filtering table 407B. From the configuration file 1102, if the packet is a packet that exchanges data with the policy management server 1 using the COPS protocol, C1
The data is stored in the buffer 504A and converted into a setting that guarantees a bandwidth of 1 Mbps (entry 1301).
In the case of a packet that is a protocol and is not exchanged with the policy management server 1, it is converted to a setting to be discarded (entry 1302), and in the case of SNMP, it is converted to a setting to be stored in the C2 buffer in 504B (entry 1303) If it does not match any of the conditions, it is converted to a setting to store it in the C4 buffer (entry 1304).

FIG. 14 is a diagram showing a flow of a processing procedure at the time of setting the configuration definition. Man-machine interface 1101
Then, the configuration file is edited (1401), and the content of the configuration setting as shown in FIGS. 12 and 13 is converted into the content of the filtering table (1402).
Performs a filtering table setting request (1403),
The setting request is transmitted by the inter-device control interface 1104A on the routing management unit 301 side (1404).
The inter-device control interface 1104B on the routing processor B 302B side receives the setting request (140
5), the filtering table setting shown in FIG. 13 is performed 1406).

As described above, according to the communication quality assurance setting method in the management network configuration method of the present invention, the setting to the filtering table is automatically performed only by setting the configuration definition, and the setting such as COPS or SNMP is performed. Communication quality assurance of the control packet can be set.

[0041]

According to the present invention, by setting in advance the priority and bandwidth guarantee settings for control packets such as COPS and SNMP for setting the network policy, the control packets can be transmitted from the end user. , It is possible to separate the management network in which the control packet flows from the network in which the user packet flows in terms of network operation.

[Brief description of the drawings]

FIG. 1 is a diagram showing a configuration example of a corporate network to which the present invention is applied.

FIG. 2 is a diagram showing a configuration example of a carrier network to which the present invention is applied.

FIG. 3 is a diagram illustrating an example of a hardware configuration of a router.

FIG. 4 is a diagram showing an example of packet processing of a router.

FIG. 5 is a diagram showing a configuration example of a communication quality assurance process.

FIG. 6 is a diagram showing a configuration example of a filtering table in the first embodiment.

FIG. 7 is a diagram showing a processing procedure of packet reception.

FIG. 8 is a diagram showing a processing procedure of packet transmission.

FIG. 9 is a diagram showing a processing procedure when a filtering condition is matched.

FIG. 10 is a diagram illustrating a configuration example of a filtering table according to the second embodiment.

FIG. 11 is a diagram showing an example of a router configuration definition setting process.

FIG. 12 is a diagram showing a configuration example of a configuration definition file.

FIG. 13 is a diagram illustrating a configuration example of a filtering table according to a third embodiment.

FIG. 14 is a diagram showing a processing procedure when setting a configuration definition.

[Explanation of symbols]

101: Policy management server, 102/202: Router, 101/201: User terminal (server), 301 ...
Routing management unit, 302... Routing processing unit, 4
07: Filtering table, 501: Communication quality assurance processing.

Claims (5)

[Claims] 1. A method for configuring a network between a server device for managing policies and each network device in a case where a policy such as communication quality assurance or filtering setting is given to each network device in a corporate network or a carrier network. When a control packet for giving a policy to each network device is transmitted using a network through which a data packet from an end user flows, each network device having a communication quality assurance unit and a filtering unit is configured as described above. A control packet is filtered out of all packets transmitted and received by the filtering means, and communication quality such as priority control and band control is previously guaranteed for the filtered control packet by the communication quality assurance means. By And reducing the possibility that the control packet is affected by the user packet. 2. The management network configuration method according to claim 1, wherein the control packet is for performing communication quality assurance, for performing network management,
There are various types such as those for virtually configuring a private network, and each network device performs a different communication quality assurance for each type of policy setting by the communication quality assurance means and the filtering means. A network guarantee method for setting, canceling, monitoring, etc., the communication according to the traffic amount. 3. The management network network configuration method according to claim 1, wherein each of the network devices performs, by the filtering unit, whether or not the policy can be accepted for each type of policy setting based on the filtering setting. A method for configuring a management network, comprising: limiting a target range of a management network. 4. A method for limiting a target range of a management network in the management network configuration method according to claim 3, wherein each of the network devices includes a server for managing a policy or a network by the filtering means. A management network configuration method, wherein, when there are a plurality of networks, a source and a destination of a control packet from the server device are designated to perform filtering setting, thereby providing a plurality of management network target areas. 5. A method for setting communication quality assurance to each network device in the management network configuration method according to claim 1 or 4, wherein the configuration definition at the time of installation or configuration change of each network device is provided. When setting whether or not control from the server managing the policy is set in the setting, if the control is possible, the control quality assurance of the communication quality assurance is automatically given to the control packet with the server managing the policy. Means and means of said filtering,
The communication quality is set so as to guarantee the communication quality, and when the control is impossible, the control packet with the server device that manages the policy is automatically discarded by the filtering means. How to set warranty.