JP2006339927A - Routing device, routing method used therefor, and program thereof - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a routing device capable of deciding a VPN (Vertual Private Network) accommodating a virtual LAN independently of a VLAN-ID (Vertual bridged Local Area Network Identification). <P>SOLUTION: An L2 processing section 1 has a transmitting/receiving function for virtual LAN frames and a VLAN-VPN management section 2 retrieves a VPN-ID based upon a port number and a VLAN-ID. An L3 processing section 3 has a routing function of determining a packet transfer destination according to the VPN-ID and an IP address. A VLAN-VPN management section 2 has a VLAN-VPN management table in which data of port numbers, VLAN-IDs, and VPN-IDs are held and managed and a VLAN-VPN retrieval processing section which receives the port number and VLAN-ID from the L2 processing section 1, retrieves the VPN-ID by using the VLAN-VPN management table, and reports the retrieval result to the L3 processing section 3. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to a routing apparatus, a routing method used therefor, and a program therefor, and more particularly to a management apparatus for accommodating a plurality of virtual LANs (Local Area Networks) in a virtual private network.

  Conventionally, in a virtual LAN network configuration, a plurality of terminals are connected to each port of a first switch to form a first LAN, and a plurality of terminals are connected to each port of a second switch. When these LANs are configured, the plurality of terminals are grouped together in the form of a virtual LAN, and a virtual LAN is configured by a logical configuration to perform inter-terminal communication within the same switch.

  In the above configuration, when the terminal is moved to a mere port, a switch table can be configured by a general MAC (Media Access Control) address learning method. Since each terminal has a MAC address, when the port is moved, the address is taken over.

  Since the attribute of the virtual LAN is defined in this switch table, when a packet from each terminal is received, a VLAN-ID (Virtual bridged Local Area Network identification: virtual) is based on the MAC address and the logical address of the port. (LAN identifier) is given and registration in the table is performed.

  In some cases, a virtual logical network (virtual LAN) is constructed across a network, that is, by connecting a transmission line to another switch. In order to perform end-to-end communication with terminals connected between different switches, that is, to perform end-to-end communication of terminals in a virtual LAN having the same LAN attribute, each switch must be fixed. By performing a simple port assignment and considering a terminal connected to the fixedly assigned port as one virtual LAN having the same attribute, end-to-end communication of the terminal becomes possible.

  Furthermore, an identifier called a virtual LAN tag can be added to a packet, and a virtual network can be identified based on the virtual LAN tag to perform transmission between switches. Furthermore, packets can be broadcasted or unicasted to terminals connected to switch ports belonging to the same virtual LAN. Even in this case, the switch table can be configured by learning the MAC address.

  However, the above network configuration is not intended for communication between virtual LANs (virtual LAN communication). Enabling communication between virtual LANs as a network means enabling communication between arbitrary terminals. As can be seen from recent network usage examples, it is common to use Internet connections and shared data and files. Therefore, in the future, when introducing network equipment and constructing a network, a network capable of expanding the number of terminals expected in the future and enabling communication between a plurality of virtual LANs is required.

  In the conventional virtual LAN network configuration described above, when routing is performed simply using a virtual LAN, it is impossible to have a virtual identification ID. Therefore, when communicating from a virtual LAN to a dedicated line via a router, the dedicated line In this case, it is not possible to maintain closedness as an intranet.

  Therefore, in a conventional management apparatus, a virtual LAN network using a VLAN (Virtual Bridged Local Area Network) is configured to multiplex a LAN frame by using a plurality of VLAN-IDs to form a closed network. (For example, refer to Patent Document 1).

JP 2002-016640 A

  As described above, conventionally, when a virtual LAN network using a VLAN is constructed, the same VLAN-ID is recognized as the same virtual LAN network. Therefore, the virtual LAN in the same apparatus is designated as a VPN (Virtual Private Network: There are the following problems in housing in a virtual private network.

  In the conventional virtual LAN network construction method, when the virtual LAN is accommodated in the VPN, the process for managing the VLAN-ID of the accommodated virtual LAN is not taken into consideration, and therefore the VLAN-ID is different in the same device. There is a problem that the virtual LAN cannot be accommodated in the same VPN.

  Further, in the conventional method for constructing a virtual LAN network, when a virtual LAN is accommodated in a VPN, the process for managing the VLAN-ID of the accommodated virtual LAN is not considered, so the same accommodated in different ports There is a problem that the virtual LAN cannot be accommodated in another VPN.

  That is, in the conventional method for constructing a virtual LAN network, a virtual LAN network using a VLAN is configured by multiplexing LAN frames by using a plurality of VLAN-IDs to form a closed network. When the virtual LAN is accommodated in the VPN, the same virtual LAN can be accommodated only in the same VPN in the same device.

  Therefore, in the conventional virtual LAN network construction method, (1) a configuration in which different virtual LANs accommodated in the same port are accommodated in the same VPN, and (2) different virtual LANs accommodated in different ports are the same. (3) A configuration in which the same virtual LAN accommodated in different ports is accommodated in different VPNs cannot be realized. In the technique described in Patent Document 1, since the determination of VPN-ID is realized by means for assigning VPN-ID from VLAN-ID, the above problems (1) to (3) are solved. I can't do it.

  Accordingly, an object of the present invention is to solve the above-described problems and provide a routing device capable of determining a VPN that accommodates a virtual LAN without depending on VLAN-ID, a routing method used therefor, and a program therefor. is there.

The routing device according to the present invention is a routing that determines a packet transfer destination from an L2 processing unit having a virtual LAN (Local Area Network) frame transmission / reception function, a VPN-ID (Virtual Private Network identification), and an IP (Internet Protocol) address. A routing device capable of using VLAN (Virtual Bridged Local Area Network) and VPN (Virtual Private Network),
A plurality of ports provided in the L2 processing means and receiving LAN frames to which different VLAN-IDs are assigned;
VLAN-VPN management means for retrieving the VPN-ID from a port number for identifying each of the plurality of ports and a VLAN-ID (Virtual Bridged Local Area Network identification).

  The routing method according to the present invention determines a packet transfer destination from an L2 processing means having a virtual LAN (Local Area Network) frame transmission / reception function, a VPN-ID (Virtual Private Network identification) and an IP (Internet Protocol) address. L3 processing means having a function, and a routing method used for a routing apparatus that can use a virtual bridged local area network (VLAN) and a virtual private network (VPN), wherein the routing apparatus serves as the L2 processing means. Each of a plurality of ports that receive a LAN frame provided with a different VLAN-ID is specified. Wherein from the port number and VLAN-ID (Virtual bridged Local Area Network identification) for running the process of searching for VPN-ID.

  The routing method program according to the present invention determines a packet transfer destination from an L2 processing means having a virtual LAN (Local Area Network) frame transmission / reception function, a VPN-ID (Virtual Private Network identification) and an IP (Internet Protocol) address. A routing method using a routing device capable of using a virtual bridged local area network (VLAN) and a virtual private network (VPN), the computer of the routing device including: Receive LAN frames with different VLAN-IDs provided in L2 processing means. And to execute the process of searching for the VPN-ID from the port number and VLAN-ID identifying a plurality of ports each (Virtual bridged Local Area Network identification) to.

  That is, the routing device of the present invention is a routing device that can use a VLAN (Virtual Bridged Local Area Network: Virtual LAN) and a VPN (Virtual Private Network: Virtual Private Network). (1) Different VLAN-IDs A configuration in which LAN (Local Area Network) frames having a (Virtual bridged Local Area Network identification) (virtual LAN identifier) can be accommodated and routed in the same VPN, and (2) even a LAN frame having the same VLAN-ID It provides a configuration that can be accommodated in different VPNs and routable.

  More specifically, the routing device of the present invention is composed of a plurality of ports that receive LAN frames to which different VLAN-IDs are assigned. When the L2 (Layer 2) processing unit transfers the packet received from the port to the L3 (Layer 3) processing unit 3, the VPN-ID (Virtual Private Network identification) in which the LAN frame of the port is accommodated is VLAN-VPN. Contact the management department.

  The VLAN-VPN management unit searches for the VPN-ID in which the VLAN is accommodated based on the port number and VLAN-ID information, and notifies the L3 processing unit together with the IP address (Internet Protocol Address). The transfer destination port is determined based on the routing result of the L3 processing unit, and the received packet is transmitted from the determined port.

  Therefore, the routing device of the present invention has a function of managing the relationship between the port number and the VLAN-ID and VPN in the port, so that (1) different virtual LANs accommodated in the same port can be Configuration to manage and accommodate as VPN, (2) Configuration to manage and accommodate different virtual LANs accommodated in different ports, and (3) Separate the same virtual LAN accommodated in different ports It is possible to adopt a configuration that manages and accommodates as a VPN.

  As described above, the routing device of the present invention has the information table and the search process that can search for the VPN-ID accommodated from the port number and the VLAN-ID, and is therefore accommodated in the same port. Different virtual LANs can be accommodated in the same VPN and routed, and as a result, communication between different virtual LAN networks can be performed while maintaining closedness.

  In addition, since the routing device of the present invention has an information table and search processing that can search for the VPN-ID accommodated from the port number and the VLAN-ID, different virtual LANs accommodated in different ports can be obtained. It is possible to accommodate and route in the same VPN, and as a result, it becomes possible to communicate between different virtual LAN networks while maintaining the closed area.

  Furthermore, since the routing device of the present invention has an information table and search processing capable of searching for the VPN-ID accommodated from the port number and VLAN-ID, the same virtual LAN accommodated in different ports Can be accommodated in another VPN and routed, and as a result, the existing virtual LAN to be divided can be accommodated in a device that implements the present invention, so that the VLAN-ID can be changed without changing the VLAN-ID. It becomes possible to change.

  With the configuration and operation described below, the present invention can obtain an effect that a VPN that accommodates a virtual LAN can be determined without depending on VLAN-ID.

  Next, embodiments of the present invention will be described with reference to the drawings. FIG. 1 is a block diagram showing a configuration of a routing apparatus according to an embodiment of the present invention. In FIG. 1, a routing device according to an embodiment of the present invention includes an L2 (Layer 2) processing unit 1 having a virtual LAN (Local Area Network) frame transmission / reception function, a port number, and a VLAN-ID (Virtual bridged Local Area Network). identification (virtual private network: virtual private network (NID) and virtual private network (NID): VPN (Virtual Private Network): VPN (Virtual Private Network): VPN (Virtual Private Network): Searching for VPN-ID (Virtual Private Network identification) from virtual identification Packet transfer destination from IP and Internet Protocol (IP) address And a L3 (Layer 3) processing section 3 which has a routing function determined.

  The L2 processing unit 1 includes ports 11-1 to 11-m connected to different networks [for example, the Internet and WAN (Wide Area Network)], and the ports 11-1 to 11-m are different VLANs. -A plurality of virtual LANs (network A100, network B200) to which IDs are assigned are accommodated. The L3 processing unit 3 includes a routing table 31 that determines a packet transfer destination based on VPN-ID and IP address information.

  FIG. 2 is a block diagram showing a detailed configuration of the VLAN-VPN management unit 2 shown in FIG. In FIG. 2, the VLAN-VPN management unit 2 stores the port number, VLAN-ID, and VPN-ID data in the VLAN-VPN management table 22, and the L2 processing unit 1 receives the port number and VLAN-ID. And a VLAN-VPN search processing unit 21 that performs a VPN-ID search process using the VLAN-VPN management table 22 and notifies the L3 processing unit 3 of the search result.

  FIG. 3 is a diagram showing a configuration example of the VLAN-VPN management table 22 shown in FIG. In FIG. 3, the VLAN-VPN management table 22 corresponds to VLAN-IDs (for example, “11”, “12”, “13”,...) In the area indicated by the port numbers 11-1 to 11-m. VPN-ID (for example, “21”, “22”, “23”,...) Is held.

  Note that the configuration and operation of the L3 processing unit 3 and the L2 processing unit 1 shown in FIG. 1 are well known to those skilled in the art, and are not directly related to the present embodiment. .

  FIG. 4 is a flowchart showing the operation of the VLAN-VPN management unit 2 shown in FIG. The operation of the routing apparatus according to an embodiment of the present invention will be described with reference to FIGS. Note that the processing operation shown in FIG. 4 can also be realized by executing a computer-executable program in the VLAN-VPN management unit 2.

  A routing device according to an embodiment of the present invention, when receiving a packet from a connected virtual LAN network (for example, network A100), performs routing to determine a virtual LAN network (for example, network B200) to which the packet is transferred. Process. In order to perform the routing process, the L2 processing unit 1 notifies the VLAN-VPN management unit 2 of the port number that received the packet and the VLAN-ID and IP address information of the virtual LAN frame.

  When the VLAN-VPN management unit 2 receives the port number, VLAN-ID, and IP address notified from the L2 processing unit 1 (step S1 in FIG. 4), the port number notified by the VLAN-VPN search processing unit 21 is Whether it is a normal value is confirmed (step S2 in FIG. 4). If it is out of the range, the L2 processing unit 1 is notified that there is no corresponding information (step S4 in FIG. 4), and the search process is terminated.

  If the port number is in a normal range, the VLAN-VPN management unit 2 checks the normality of the VLAN-ID notified by the VLAN-VPN search processing unit 21 (step S3 in FIG. 4), and the VLAN-ID is normal. If it is not a value, L2 processing unit 1 is notified that there is no corresponding information (step S4 in FIG. 4), and the search process is terminated.

  If the VLAN-ID is a normal value, the VLAN-VPN management unit 2 searches the VLAN-VPN management table 22 for the port number and the VPN-ID corresponding to the VLAN-ID (step S5 in FIG. 4). If the VPN-ID does not exist as a result of this VPN-ID search (step S6 in FIG. 4), the VLAN-VPN management unit 2 notifies the L3 processing unit 3 that the IP address and VPN-ID do not exist (FIG. 4). 4 Step S8), the search process is terminated.

  On the other hand, if the VLAN-VPN management unit 2 can retrieve the designated port number and the VPN-ID of the VLAN-ID, it notifies the L3 processing unit 3 of the VPN-ID and the IP address (step S7 in FIG. 4). The process ends.

  When the VPN-ID is notified, the L3 processing unit 3 performs routing processing based on the VPN-ID and the IP address, and derives the port number of the packet transfer destination and the VLAN-ID accommodated in the port. When the VPN-ID does not exist, the L3 processing unit 3 determines that the network is accommodated in a general network that does not use the VPN, performs a routing process based on the IP address, and stores the packet transfer destination port number and the port. The contained VLAN-ID is derived.

  The L3 processing unit 3 notifies the L2 processing unit 1 of the derived port number and VLAN-ID. The L2 processing unit 1 determines a virtual LAN network (for example, the network B200) to which the received packet is transferred, from the notified port number and VLAN-ID.

  In the present embodiment, by performing the above-described series of processing, (1) a configuration in which different virtual LAN networks accommodated in the same port are accommodated in the same VPN, and (2) a difference accommodated in different ports. A configuration in which the virtual LAN network is accommodated in the same VPN, and (3) a configuration in which the same virtual LAN network accommodated in different ports is accommodated in different VPNs can be realized.

  As described above, in this embodiment, different virtual LANs accommodated in the same port are provided by including an information table capable of retrieving the VPN-ID accommodated from the port number and the VLAN-ID and the retrieval process thereof. The networks can be accommodated in the same VPN and routed. As a result, communication between different virtual LAN networks can be performed while keeping the closed area.

  Further, in this embodiment, by providing an information table capable of searching for a VPN-ID accommodated from a port number and a VLAN-ID and a search process thereof, different virtual LAN networks accommodated in different ports are the same. As a result, it is possible to communicate between different virtual LAN networks while maintaining the closed property.

  Furthermore, in this embodiment, the same virtual LAN network accommodated in different ports can be obtained by providing an information table capable of retrieving the VPN-ID accommodated from the port number and the VLAN-ID and the retrieval process. It can be accommodated and routed in another VPN, and as a result, it can be changed to a separate network without changing the VLAN-ID by accommodating the existing virtual LAN network to be divided into devices implementing the present invention. become.

  The present invention is not limited to the above-described embodiments. For example, a virtual network using another line such as a POS (Packet Over SONET (Synchronous Optical Network)) line or an ATM (Asynchronous Transfer Mode) line is used as a VPN. It can also be applied to housing.

It is a block diagram which shows the structure of the routing apparatus by one Example of this invention. It is a block diagram which shows the detailed structure of the VLAN-VPN management part shown in FIG. FIG. 3 is a diagram illustrating a configuration example of a VLAN-VPN management table illustrated in FIG. 2. 3 is a flowchart illustrating an operation of a VLAN-VPN management unit illustrated in FIG. 2.

Explanation of symbols

1 L2 processing unit
2 VLAN-VPN management part
3 L3 processing unit 11-1 to 11-m port
21 VLAN-VPN search processing part
22 VLAN-VPN management table
31 Routing table
100 network A
200 Network B

Claims (9)

L2 processing means having a function of transmitting / receiving a virtual LAN (Local Area Network) frame, L3 processing means having a routing function for determining a packet transfer destination from a VPN-ID (Virtual Private Network identification) and an IP (Internet Protocol) address A routing device that can use a VLAN (Virtual Bridged Local Area Network) and a VPN (Virtual Private Network),
A plurality of ports provided in the L2 processing means and receiving LAN frames to which different VLAN-IDs are assigned;
A routing apparatus comprising: a VLAN-VPN management unit that searches for the VPN-ID from a port number that identifies each of the plurality of ports and a VLAN-ID (Virtual Bridged Local Area Network identification).   The VLAN-VPN management means includes a VLAN-VPN management table for managing a VPN that accommodates a virtual LAN corresponding to the VLAN-ID from the port number and the VLAN-ID, and from the VLAN-VPN management table to the VLAN. The routing apparatus according to claim 1, further comprising a VLAN-VPN search processing means for searching for a VPN that accommodates a virtual LAN corresponding to the ID. The L2 processing means inquires of the VLAN-VPN management means about the VPN-ID in which the virtual LAN frame of the port is accommodated when transferring the packet received from the port to the L3 processing means,
The VLAN-VPN management means searches for the VPN-ID in which the virtual LAN is accommodated based on the port number and the VLAN-ID information, and notifies the L3 processing means together with the IP address;
The routing apparatus according to claim 1 or 2, wherein the L3 processing unit determines a packet transfer destination from the VPN-ID and the IP address from the VLAN-VPN management unit.   A configuration in which at least different virtual LANs accommodated in the same port are managed and accommodated as one VPN, a configuration in which different virtual LANs accommodated in different ports are managed and accommodated as one VPN, and different ports The routing apparatus according to claim 1, wherein the routing apparatus is configured to manage and accommodate the same virtual LAN accommodated as a separate VPN.   L2 processing means having a function of transmitting / receiving a virtual LAN (Local Area Network) frame, L3 processing means having a routing function for determining a packet transfer destination from a VPN-ID (Virtual Private Network identification) and an IP (Internet Protocol) address A routing method using a routing device that can use a virtual bridged local area network (VLAN) and a virtual private network (VPN), wherein the routing device is provided in the L2 processing means and is a different VLAN-ID. Port number and VLAN-ID for identifying each of a plurality of ports that receive a LAN frame to which an ID is assigned Routing method characterized by performing a process of searching for the VPN-ID because Virtual bridged Local Area Network identification) and.   The process of searching for the VPN-ID is performed based on the virtual number corresponding to the VLAN-ID from the VLAN-VPN management table for managing the VPN accommodating the virtual LAN corresponding to the VLAN-ID from the port number and the VLAN-ID. 6. The routing method according to claim 5, wherein a VPN that accommodates the LAN is searched.   The process of searching for the VPN-ID is performed when the L2 processing unit inquires the VPN-ID in which the virtual LAN frame of the port is accommodated when transferring the packet received from the port to the L3 processing unit. The VPN-ID in which the virtual LAN is accommodated is searched based on the port number and the VLAN-ID information, notified to the L3 processing means together with the IP address, and the L3 processing means is notified of the VPN 7. The routing method according to claim 5, wherein a packet transfer destination is determined from the ID and the IP address.   A configuration in which at least different virtual LANs accommodated in the same port are managed and accommodated as one VPN, a configuration in which different virtual LANs accommodated in different ports are managed and accommodated as one VPN, and different ports 8. The routing method according to claim 5, wherein the same virtual LAN accommodated in the network is managed and accommodated as another VPN.   L2 processing means having a function of transmitting / receiving a virtual LAN (Local Area Network) frame, L3 processing means having a routing function for determining a packet transfer destination from a VPN-ID (Virtual Private Network identification) and an IP (Internet Protocol) address A routing method using a routing device that can use a virtual bridged local area network (VLAN) and a virtual private network (VPN), and is provided in the L2 processing means in the routing device computer and in a different VLAN. A port number that identifies each of a plurality of ports that receive a LAN frame to which an ID is assigned; LAN-ID (Virtual bridged Local Area Network identification) because the program for executing the process of searching for the VPN-ID.

Images