JP2016063511A - Network control system, router virtualization device, network control method, router virtualization method, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To solve the problem of possibility of incapability of managing/maintaining a network in a way similar to the case of using an existing physical router when the existing physical router is replaced with a virtual router.SOLUTION: A network control system includes: a router for controlling a path between a plurality of networks; a switch connected to a virtual network in a network; and a router virtualization device that connects with a router and a switch and provides the router as a plurality of virtual routers for controlling a path between a plurality of virtual networks. The router virtualization device transfers a packet input from the switch to the router; and transfers a packet input from the router to the switch on the basis of an identifier granted according to a predetermined virtual router of the plurality of virtual routers.SELECTED DRAWING: Figure 1

Description

  The present invention relates to a network control system, a router virtualization apparatus, a network control method, a router virtualization method, and a program, and more particularly to a network control system, a router virtualization apparatus, a network control method, and a router virtualization method including router virtualization technology. And program.

  In a multi-tenant environment realized by cloud computing or X as a Service (XaaS), when configuring a network having a plurality of subnets for each tenant, it is necessary to assign a router to each tenant.

  Patent Document 1 discloses a local switch that controls a path between a virtual local area network (hereinafter referred to as a VLAN) as a local intranet segment, a main router that controls a path between a global Internet segment, and a local switch. A network switching system is disclosed that includes a local router switch that filters packets so that only Internet segment traffic is sent to the main router.

  However, if a physical router is prepared for each tenant, the scale of the system becomes enormous and the system configuration becomes complicated, so instances of virtualized routers called virtual routers are created and assigned to tenants. Has been done.

  In order to realize a virtual router, for example, there is a method of using a router corresponding to Virtual Routing and Forwarding (VRF) or a Software Defined Networking (SDN) product having a virtual router function.

JP-A-10-190715

  The virtual router generated by the above-described method has a problem that compatibility with a physical router used before replacement is not guaranteed. For example, there are differences or deficiencies between various functions used in the physical router before replacement, such as a firewall, performance information monitoring, failure monitoring, and management interface, and corresponding functions realized on the virtual router. For this reason, when the existing Information and Communication Technology (ICT) environment is made multi-tenant, the network may not be managed and maintained by the router in the same manner as before the virtual router is replaced.

  An object of the network control system of the present invention is to virtualize a router and maintain compatibility with a physical router.

Claim 1

  According to the present invention, a router can be virtualized and a network can be managed and maintained by a physical router.

It is a block diagram which shows the structure of the network control system in 1st embodiment of this invention. It is a flowchart which shows the operation | movement in 1st embodiment of this invention. It is a flowchart which shows the operation | movement in 1st embodiment of this invention. It is a block diagram which shows the structure of the network control system in 2nd embodiment of this invention. It is a figure which shows the example of the topology definition table of the network control system in 2nd embodiment of this invention, a router definition table, and a transmission waiting frame table. It is a flowchart which shows the operation | movement in 2nd embodiment of this invention. It is a flowchart which shows the operation | movement in 2nd embodiment of this invention. It is a flowchart which shows the operation | movement in 2nd embodiment of this invention. It is a flowchart which shows the operation | movement in 2nd embodiment of this invention. It is a flowchart which shows the operation | movement in 2nd embodiment of this invention. It is a block diagram which shows the structure of the network control system in other embodiment of this invention.

  Hereinafter, preferred embodiments for carrying out the present invention will be described in detail with reference to the drawings. However, although the embodiments described below are technically preferable for carrying out the present invention, the scope of the invention is not limited to the following.

[First embodiment]
First, the present embodiment will be described in detail with reference to the drawings. FIG. 1 is a block diagram showing the configuration of the network control system in the first embodiment.

[Description of configuration]
As shown in FIG. 1, the network control system 1 in this embodiment includes a router 10, virtual networks 20 to 23, a switch 30, and a router virtualization apparatus 40.

  The router 10 controls paths between a plurality of networks. The switch 30 is connected to the virtual networks 20 to 23 in the aforementioned network.

  The router virtualization apparatus 40 is connected to the router 10 and the switch 30 and provides the router 10 as a plurality of virtual routers 50 and 51 that control paths between the plurality of virtual networks 20 to 23. Specifically, the router virtualization apparatus 40 transfers the packet input from the switch 30 to the router 10, and the packet input from the router 10 is determined according to a predetermined virtual router among the plurality of virtual routers 50 and 51. Based on the assigned identifier, the data is transferred to the switch 30.

[Description of operation]
Next, the operation of the network control system 1 in the first embodiment will be described with reference to FIGS.

First, an operation of transferring a packet from the network formed of the virtual networks 20 to 23 to the router 10 will be described with reference to FIG.
In FIG. 2, a packet is input from the network constituted by the virtual networks 20 to 23 to the connected switch 30 (S200). Next, the input packet is input from the switch 30 to the router virtualization apparatus 40 (S201). The router virtualization apparatus 40 transfers the packet input from the switch 30 to the router 10 (S203).

Next, an operation of transferring a packet from the router 10 to the network constituted by the virtual networks 20 to 23 will be described with reference to FIG.
In FIG. 3, when the router 10 transfers a packet to the router virtualization apparatus 40 (S300), the router virtualization apparatus 40 transmits a packet input from the router 10 to a predetermined virtual router among a plurality of virtual routers 50 and 51. Based on the identifier assigned according to the router, the data is transferred to the switch 30 (S301). The switch 30 transfers the packet input from the router virtualization apparatus 40 to the corresponding virtual network based on the assigned identifier (S302).

  In the two operations described above, the router 10 controls routing between a plurality of networks. That is, the router 10 transfers the packet input from the network configured by the virtual networks 20 to 23 via the switch 30 and the router virtualization apparatus 40 to the router virtualization apparatus 40.

[Description of effects]
In the network control system 1 using the router virtualization apparatus 40 in the first embodiment, as described above, the router virtualization apparatus 40 connected to the router 10 and the switch 30 is used to make a plurality of virtual routers. 50, 51 can be provided. Furthermore, compatibility with the router 10 can be maintained by utilizing the router 10. In addition, network management and maintenance can be performed in the setting of the router 10.

[Second Embodiment]
Next, a second embodiment of the invention will be described with reference to the drawings.

  FIG. 4 is a block diagram showing the configuration of the network control system 1 in the second embodiment. In the second embodiment, virtual networks 20 to 23 are VLANs 120 to 123 corresponding to virtual local area network identifiers (hereinafter referred to as VLAN IDs) 211 to 214, and layer 2 switches (hereinafter referred to as L2 switches) 130 as switches 30. Is used. The router virtualization apparatus 40 includes an open flow switch (hereinafter referred to as OFS) 140 and an open flow controller (hereinafter referred to as OFC) 150. The OFC 150 includes a topology definition table 151, a router definition table 152, and a transmission waiting frame table 153.

  In the second embodiment, the router virtualization apparatus 40 is realized using the OpenFlow protocol.

[Description of configuration]
Hereinafter, the configuration of the second embodiment will be described in detail with reference to FIGS. 4 and 5. FIG. 5 is a diagram illustrating an example of the topology definition table 151, the router definition table 152, and the transmission waiting frame table 153 of the network control system in the second embodiment.

  The router 10 is an actual router that is virtualized by the router virtualization apparatus 40. As shown in FIG. 4, the router 10 includes an interface 11 set with an IP address of 192.168.1.254/24, an interface 12 set with an IP address of 172.16.255.254/16, and It has three interfaces, the interface 13 set with the IP address of 192.168.2.254/24. Further, since the interface 13 serves as a gateway to the intranet 80, a route to 10.0.0.0/8 is also set.

  The business network 70 is a network routed by the virtual routers 50 and 51. The business network 70 has two tenants, a tenant 61 and a tenant 62. Here, the VLAN 120 and the VLAN 121 are networks in the tenant 60, and the VLAN 122 and the VLAN 123 are networks in the tenant 61. In the tenant 61, the virtual router 50 routes between the VLAN 120 and the VLAN 121. In the tenant 62, the virtual router 51 routes between the VLAN 122 and the VLAN 123. The VLAN 123 is connected to the intranet 80 by the virtual router 51.

  The router virtualization apparatus 40 virtualizes the router 10 into virtual routers 50 and 51. The router virtualization apparatus 40 includes an OFS 140 and an OFC 150. The OFS 140 is a data plane defined by the OpenFlow protocol, and is a switch that transfers and discards frames according to instructions from the OFC 150. The OFS 140 includes a port 41, a port 42, and a port 43 as inward ports, and a port 44, a port 45, and a port 46 as outward ports, respectively.

  Here, the “inward port” is a port to which a packet transferred from the router 10 to a host in the business network 70 is input. The “outward port” is a port to which a packet transferred from the host to the router 10 is input.

  A frame with a VLAN tag (a frame having a VLAN ID) is input to the port 45 or transferred from the port 45. Frames without VLAN tags are input to other ports.

  The OFC 150 is a control plane defined by the OpenFlow protocol, and is a device that realizes router virtualization by controlling the OFS 140. The OFC 150 includes a topology definition table 151, a router definition table 152, and a transmission waiting frame table 153 shown in FIG.

  The L2 switch 130 is connected to a network constituted by VLANs 120 to 123 through ports 34 to 37. Further, the L2 switch 130 is connected to the outward ports 44 to 46 of the OFS 140 in the router virtualization apparatus 40 through the ports 31 to 33.

  Referring to FIG. 5, the topology definition table 151 defines the virtual routers 50 and 51 and the links that the virtual routers 50 and 51 have. The link is an identifier for associating the inward port connected to the virtual router and its VLAN tag with the outward port and its VLAN tag on a one-to-one basis.

  Here, the link 5112 of the virtual router 50 associates the case where the port 42 and the VLAN tag are not provided with the case where the port 45 and the VLAN tag 212 are provided. On the other hand, the link 5113 included in the virtual router 51 associates the case where the port 42 and the VLAN tag are not provided with the case where the port 45 and the VLAN tag 213 are provided. The link 5112 and the link 5113 are identical in that “the case where there is no port 42 and VLAN tag and the port 45” are associated with each other. However, the link 5112 and the link 5113 are linked due to the difference in the VLAN tag associated with the port 45. A branch from the port 45 to the VLAN 121 in the path 5112 and a path from the port 45 to the VLAN 122 in the link 5113 are branched.

  The virtual router 50 and the virtual router 51 are virtual routers used by the tenant 61 and the tenant 62 (in other words, a virtual router is assigned to each tenant), and are associated with the port 45 as described above. The route in the tenants 60 and 61 can be divided between the tenants by the VLAN tag.

  As shown in the topology definition table 151 of FIG. 5, the virtual router 50 includes a link 5111 for port 41 and port 44 (both without VLAN tag), and a link 5112 for port 42 (no VLAN tag) and port 45. The VLAN tags 212 are associated with each other.

  On the other hand, the virtual router 51 associates the port 42 (no VLAN tag) with the VLAN tag 213 of the port 45 through the link 5113, and associates the port 43 with the port 46 (both without the VLAN tag) through the link 5114.

  The router definition table 152 defines interface information that the router 10 has. For example, the interface 11 is connected to the port 41 without a VLAN tag, the MAC address is de: ad: be: ef: 00: 01, the IP address is 192.168.1.254, and the route is 192.168.1. 0/24. The same applies to the interface 12 and the interface 13. Note that the route 10.0.0.0/8 to the intranet 80 of the interface 13 is also defined in the router definition table 152.

  The transmission wait frame table 153 is a buffer that stores frames that cannot be output to the outgoing port because the destination MAC address is waiting to be resolved by ARP (Address Resolution Protocol). For example, frames such as frame 531 and frame 532 in the transmission waiting frame table 153 may be forwarded to hosts that exist on different VLANs and have different MAC addresses but the same IP address. . In this case, the router 10 cannot resolve the MAC address. For this reason, the router 10 resolves the MAC address using the pseudo MAC address, stores the frame addressed to the pseudo MAC address transmitted by the router 10 in the transmission wait frame table 153, and resolves the actual MAC address. .

[Description of operation]
Next, the operation in the second embodiment will be described in detail with reference to FIGS. In addition, when there is a difference between the operation as the router virtualization apparatus 40 in the first embodiment and the operation when the router virtualization apparatus 40 in the second embodiment includes the OFS 140 and the OFC 150, a comparison is appropriately made. To explain. 6 to 8 are described as a case where the router virtualization apparatus 40 includes the OFS 140 and the OFC 150.

  FIG. 6 is a flowchart showing a main routine in the second embodiment. FIG. 7 is a flowchart showing a subroutine for processing a frame input to the outward ports 44 to 46 in the second embodiment. FIG. 8 is a flowchart showing a subroutine for processing a frame input to the inward ports 41 to 43 in the second embodiment. FIG. 9 is a flowchart illustrating a subroutine for acquiring virtual router candidates in the second embodiment. FIG. 10 is a flowchart showing a subroutine of frame transfer processing in the second embodiment.

  First, the main routine in the second embodiment will be described with reference to FIG. When the router virtualization apparatus 40 includes the OFS 140 and the OFC 150, the operation illustrated in FIG. 6 is performed when the frame is input to the OFS 140 and the packet issued from the OFS 140 when the flow entry matching the frame is not registered. -Executed by the OFC 150 in response to the In message. The operations shown in FIGS. 7 to 10 are similarly executed by the OFC 150.

  Here, in order to cope with a change in the system configuration, it is assumed that the flow entry has no persistence. Specifically, an appropriate hard timeout is specified in the Modify Flow Entry message that the OFC 150 issues to the OFS 140 when registering the flow entry.

  When a frame arrives at the OFS 140 and a Packet-in message is issued from the OFS 140 to the OFC 150, the OFC 150 first creates a structure of a flow entry match condition that is initialized to match an arbitrary frame (S400). ). Subsequently, the OFC 150 adds the input port of the frame and the input VLAN tag to the matching condition (S401), and searches the topology definition table 151 based on the input port and the input VLAN tag (S402).

  On the other hand, in the router virtualization apparatus 40 described in the first embodiment, the operation of FIG. 6 is executed every time a frame is input to the router virtualization apparatus 40. When the frame arrives, the router virtualization apparatus 40 acquires the input port and input VLAN tag of the frame, and then searches the topology definition table 151 based on the input port and the input VLAN tag.

  Here, if a line that matches the matching condition is not found in the topology definition table 151, it is an undefined port or an undefined VLAN tag, so the OFC 150 uses the Modify Flow Entry message to select a matching frame. The flow entry to be discarded is registered in the flow table and the process is terminated (S403). In the router virtualization apparatus 40 in the first embodiment, the frame is discarded in S403 and the process is terminated. Hereinafter, when the OFC 150 “registers a flow entry for discarding a matched frame using the Modify Flow Entry message in the flow table and ends the processing”, the router virtualization apparatus 40 described in the first embodiment uses the frame Is discarded and the process is terminated.

  On the other hand, if a matching row is found, the OFC 150 adds the ether type of the frame to the match condition (S404) and checks whether the protocol indicated by the ether type is ARP or IP (S405). In the router virtualization apparatus 40 described in the first embodiment, the ether type of the frame is acquired in S404, and it is checked in S405 whether the protocol indicated by the ether type is ARP or IP. Here, if the protocol is neither ARP nor IP, it is a protocol that cannot be processed, so the OFC 150 registers a flow entry for discarding the matched frame in the flow table using the Modify Flow Entry message, and ends the processing ( S403).

  On the other hand, if the protocol is ARP or IP, the OFC 150 searches the router definition table 152 based on the input port (S406). If no line is found, the input is from the outward port, so the OFC 150 executes a subroutine for processing the frame of the outward port shown in FIG. 7 (S407). On the other hand, if a line is found, it is an input from the inward port, so the OFC 150 executes a subroutine for processing the frame of the inward port shown in FIG. 8 (S408).

  FIG. 7 is a subroutine for processing a frame input from the outward port. First, the OFC 150 checks whether the protocol indicated by the ether type of the frame is ARP or IP (S500). Here, if the protocol is IP, the OFC 150 adds the source IP address and the destination IP address included in the frame to the matching condition (S501), and then specifies the destination IP address and shows the result in FIG. A subroutine for acquiring virtual router candidates is executed (S502). The router virtualization apparatus 40 acquires the source IP address and the destination IP address included in the frame in S501, and executes the process in S502. Here, if the number of virtual router candidates is zero or plural (S503), since the IP address is an illegal IP address that cannot be narrowed down to the virtual router, the OFC 150 matches using the Modify Flow Entry message. The flow entry for discarding the completed frame is registered in the flow table, and the process is terminated (S504).

On the other hand, when the number of virtual router candidates is one, the OFC 150 acquires from the topology definition table 151 the input port and the input VLAN tag and the output port and the output VLAN tag associated with the same link in the virtual router ( S505) Subsequently, the action of changing the VLAN tag of the frame to the output VLAN tag and the action having the output port as the output destination are designated, and the subroutine of the frame transfer process shown in FIG. 10 is executed (S506). In the router virtualization apparatus 40 described in the first embodiment, the frame VLAN tag is changed to the output VLAN tag in S506 and the frame is output from the output port. If the protocol is ARP in S500, the OFC 150 Whether it is an ARP reply or an ARP request is checked (S507). If the ARP type is an ARP request, the OFC 150 acquires a port and a VLAN tag that share a link with the input port and the input VLAN tag from the topology definition table 151, and then interfaces from the router definition table 152. The IP address and the MAC address are acquired (S508).

  If the target IP address included in the ARP request matches the IP address of the router (S509), the OFC 150 generates an ARP reply frame with the router MAC address as the sender MAC address, and uses the Send Packet message. Then, an input VLAN tag is assigned and output from the input port (S510). In the router virtualization apparatus 40 described in the first embodiment, the frame generated in S510 is attached with the input VLAN tag and output from the input port.

  On the other hand, if the ARP type is ARP reply, first the transmission waiting frame table 153 is searched based on the input port, the input VLAN tag, and the sender IP address included in the ARP reply (S511), and matches the search condition. An attempt is made to acquire the line and whether or not the line has been acquired is checked (S512).

  Here, when the line can be acquired, the following action is designated, and the frame transfer processing subroutine shown in FIG. 10 is executed (S513). In other words, the frame data included in the row is used as an output frame, the action of changing the VLAN tag of the frame to the VLAN tag included in the acquired row, and the destination MAC address of the frame is changed to the sender MAC address included in the ARP reply. Specify an action and an action whose output destination is the port included in the line. In the router virtualization apparatus 40 described in the first embodiment, the frame data included in the row is set as the output frame in S513, the VLAN tag of the frame is changed to the VLAN tag included in the row, and the destination MAC address of the frame is changed. Change to the sender MAC address included in the ARP reply, and output the frame from the port included in the row.

  Then, the row of the frame for which transfer has been completed is deleted from the transmission waiting frame table 153 (S514), and the same processing is repeated for the remaining transmission waiting frames (S511).

  FIG. 8 is a subroutine for processing a frame input from an inward port. First, it is checked whether the protocol indicated by the ether type of the frame is ARP or IP (S600). Here, when the protocol is IP, the source IP address and the destination IP address included in the frame are added to the matching condition (S601), and then the source IP address is designated and the virtual router shown in FIG. A subroutine for acquiring candidates is executed (S602). The router virtualization apparatus 40 acquires the transmission source IP address and the destination IP address included in the frame in S601, and executes the process of S602.

  Here, when the number of virtual router candidates is zero or plural (S603), since the IP address is an invalid IP address that cannot be narrowed down only to the virtual router, a matching frame using the Modify Flow Entry message is displayed. The flow entry to be discarded is registered and the process is terminated (S604).

  On the other hand, if the number of virtual router candidates is one, the output port and output VLAN tag sharing the link with the input port and input VLAN tag in the virtual router are acquired from the topology definition table 151 (S605), and then the frame It is checked whether the destination MAC address is a pseudo MAC address (S606).

  If the destination is a pseudo MAC address, the destination IP address encoded in the pseudo MAC address is acquired (S607), and the destination IP address and output port, output VLAN tag, and the entire frame data are transmitted. The frame is registered in the waiting frame table 153 (S608), and an ARP request frame with the destination IP address as the target IP address is generated, and the output VLAN tag is attached to the frame using the Send Packet message and output from the output port. (S609). In the router virtualization apparatus 40 described in the first embodiment, an output VLAN tag is attached to the frame generated in S609 and output from the output port.

  On the other hand, when the destination is not a pseudo MAC address, the action of changing the VLAN tag of the frame to the output VLAN tag and the action having the output port as the output destination are designated, and the frame transfer processing subroutine shown in FIG. 10 is executed. (S610). In the router virtualization apparatus 40 described in the first embodiment, the VLAN tag of the frame is changed to the output VLAN tag in S610, and the frame is output from the output port.

  If the protocol is ARP in S600, it is checked whether it is an ARP reply or an ARP request, and if it is an ARP reply, the process is ignored and the process ends (S611). On the other hand, if the request is an ARP request, the interface IP address is obtained from the router definition table 152 based on the input port and the input VLAN tag. If this is the same as the target IP address of the ARP request, the ARP reply is not transmitted. The process ends (S612). This is a process for ignoring such an ARP request when the router may transmit an ARP request for its own IP address in order to confirm duplication of the IP address.

  On the other hand, if the target IP address of the ARP request is different from the IP address of the router interface, an ARP reply frame is generated with the pseudo MAC address encoded as the target IP address as the sender MAC address, and a Send Packet message is used. An input VLAN tag is attached to the frame and output from the input port (S613). Here, the pseudo MAC address stores the IP address in the lower 32 bits and sets the U / L bit to 1 in order to avoid duplication with the actual MAC address. In the router virtualization apparatus 40 described in the first embodiment, an ARP reply frame is generated with a pseudo MAC address encoded with the target IP address as a sender MAC address in S613, and an input VLAN tag is attached to the frame and input. Output from the port.

  FIG. 9 is a subroutine for acquiring virtual router candidates. First, all rows having an input port of a frame and an input VLAN tag are acquired from the topology definition table 151, and a set of virtual routers included in those rows is set as a virtual router candidate A (S700). For example, for a frame input without a VLAN tag to the port 42, the virtual router candidate A is {511, 512}.

  Next, when the IP address designated at the time of calling this subroutine is a special IP address (S701), the virtual router candidate A is returned as a virtual router candidate (S702). Here, special IP addresses are 255.255.255.255, 0.0.0.0, and multicast addresses. Since such an IP address cannot be used for the subsequent route search, the virtual router candidate A is returned as a virtual router candidate.

  On the other hand, if it is not a special IP address, the route of the IP address is searched from the router definition table 152 by a longest match, and the route is narrowed down only (S703). If no route is found (S704), the virtual router candidate A is returned as a virtual router candidate (S702).

  On the other hand, when a route is found, all the rows having ports and VLAN tags included in the row are acquired from the topology definition table 151, and a set of virtual routers included in those rows is set as a virtual router candidate B ( S705). For example, when the IP address is 10.0.0.1, the virtual router candidate B is {512}. Finally, the product set of virtual router candidate A and virtual router candidate B is returned as a virtual router candidate (S706).

  FIG. 10 is a subroutine of frame transfer processing. First, a Send Packet message is issued using an action designated when this subroutine is called, and a frame is transmitted (S800). Next, a Modify Flow Entry message is issued using the action and match condition specified when this subroutine is called, and a flow entry is registered (S801). The router virtualization apparatus 40 described in the first embodiment does not execute the operations (S800 and S801) in FIG.

[Description of effects]
In the network control system 1 using the router virtualization apparatus 40 in the second embodiment, the router virtualization apparatus 40 controls communication to a specific tenant using a VLAN tag by associating a virtual router with a tenant. Therefore, in a multi-tenant environment using physical routers, a virtual router can be introduced while maintaining compatibility.

[Other Embodiments]
Hereinafter, variations of the present invention will be described. The identifier described in the first embodiment may be given by the router virtualization apparatus 40. The identifier may be given based on a combination of a predetermined virtual router and a port of the router virtualization apparatus 40 to which a packet transferred to the switch 30 is input. Similarly, the identifier is assigned based on the combination of the identifier and IP (Internet Protocol) address of the virtual network that is the transmission source of the packet and the port of the router virtualization apparatus 40 to which the packet to be transferred to the switch 30 is input. May be. Further, the above combinations may be stored in advance as a table.

  In the first embodiment, the network control system 1 having the router 10, the switch 30, and the router virtualization apparatus 40 has been described. However, even when the router virtualization apparatus 40 is a single unit, the above-described configuration and operation can provide operational effects.

  In the second embodiment, the method of realizing the router virtualization apparatus with a combination of OFS and OFC using the OpenFlow protocol has been described. However, the router virtualization apparatus 40 of the present invention can also be realized by controlling a single physical or virtual network apparatus with hardware or firmware built in the apparatus. It can also be realized as software that operates on a physical or virtual computer having a plurality of network interfaces.

  In the second embodiment described above, the L2 switch 130 is used. However, as shown in FIG. 11, virtual switches 165 to 168 can be created on the hypervisor 160 and operated in the same manner as the L2 switch 130. . Here, FIG. 11 shows only the hypervisor 160 and its components. In the second embodiment, the IPv4 address system has been described. However, an IPv6 address system may be used.

  A part or all of the above-described embodiment can be described as in the following supplementary notes, but is not limited thereto.

[Appendix 1]
A router that controls the route between multiple networks;
A switch connected to a virtual network in the network;
A router virtualization apparatus connected to the router and the switch, and providing the router as a plurality of virtual routers that control paths between the plurality of virtual networks;
Have
The router virtualization apparatus transfers a packet input from the switch to the router, and the packet input from the router is based on an identifier given according to a predetermined virtual router among the plurality of virtual routers. Forward to the switch,
Network control system.

[Appendix 2]
The identifier is given based on a combination of the predetermined virtual router and a port of the router virtualization apparatus to which the packet to be transferred to the switch is input.
The network control system according to attachment 1.

[Appendix 3]
The identifier is given based on a combination of an identifier and an IP address of a virtual network that is a transmission source of the packet, and a port of the router virtualization apparatus to which the packet to be transferred to the switch is input.
The network control system according to appendix 1 or 2.

[Appendix 4]
The combination is stored as a table,
The network control system according to attachment 3.

[Appendix 5]
The network control system according to any one of appendices 1 to 4, wherein the tenant has a plurality of the virtual networks and the virtual router is assigned to each of the tenants of the plurality of tenants.

[Appendix 6]
In a plurality of networks whose routes are controlled by a router, the router is provided as a virtual router that controls a route between a plurality of virtual networks in the plurality of networks,
The packet input from the switch connected to the virtual network is transferred to the router, and the packet input from the router is based on an identifier given according to a predetermined virtual router among the plurality of virtual routers. Forward to the switch,
Router virtualization device.

[Appendix 7]
The identifier is given based on a combination of the predetermined virtual router and the router virtualization apparatus port input by the packet to be transferred to the switch.
The router virtualization apparatus according to attachment 6.

[Appendix 8]
A first step of forwarding packets input from the switch to the router;
A second step of assigning an identifier corresponding to a virtual router that controls a path between a plurality of virtual networks to a packet input from the router and transferring the packet to a switch connected to the network configured by a virtual network And a network control method.

[Appendix 9]
In the second step, the identifier of the packet to be transferred to the switch is given based on a combination of the virtual router and the port of the router virtualization apparatus to which the packet to be transferred to the switch is input. The
The network control method according to attachment 8.

[Appendix 10]
In the second step, the combinations are stored as a table,
The network control method according to appendix 9.

[Appendix 11]
A first step of forwarding packets input from the switch to the router;
A second step of assigning an identifier corresponding to a virtual router that controls a path between a plurality of virtual networks to a packet input from the router and transferring the packet to a switch connected to the network configured by a virtual network Including,
Router virtualization method.

[Appendix 12]
Processing to forward packets input from the switch to the router;
A process of assigning an identifier corresponding to a virtual router that controls a route between a plurality of virtual networks to a packet input from the router, and transferring the packet to a switch connected to the network configured by a virtual network;
A program that causes a computer to execute.

  However, the present invention is not limited to the above-described embodiments, and can be appropriately changed by those skilled in the art without departing from the scope of the invention.

DESCRIPTION OF SYMBOLS 1 Network control system 10 Router 11-13 Interface 20-23 Virtual network 30 Switch 31-37 Port 40 Router virtualization apparatus 41-46 Port 50, 51 Virtual router 60, 61 Tenant 70 Business network 80 Intranet 120-123 VLAN
130 L2 Switch 140 Open Flow Switch 150 Open Flow Controller 151 Topology Definition Table 152 Router Definition Table 153 Transmission Waiting Frame Table 160 Hypervisor 161-164 Physical NIC
165 to 168 Virtual switch 165a, 165b port 166a, 165b ', 165b''port 165a, 165b port 165a, 165b port

Claims (10)

A router that controls the route between multiple networks;
A switch connected to a virtual network in the network;
A router virtualization apparatus connected to the router and the switch, and providing the router as a plurality of virtual routers that control paths between the plurality of virtual networks;
Have
The router virtualization apparatus transfers a packet input from the switch to the router, and the packet input from the router is based on an identifier given according to a predetermined virtual router among the plurality of virtual routers. Forward to the switch,
Network control system. The identifier is given based on a combination of the predetermined virtual router and a port of the router virtualization apparatus to which the packet to be transferred to the switch is input.
The network control system according to claim 1. The combinations are stored in advance as a table,
The network control system according to claim 2. In a plurality of networks whose paths are controlled by a router, the router is provided as a virtual router that controls paths between a plurality of virtual networks in the plurality of networks.
The packet input from the switch connected to the virtual network is transferred to the router, and the packet input from the router is based on an identifier given according to a predetermined virtual router among the plurality of virtual routers. Forward to the switch,
Router virtualization device. The identifier is given based on a combination of the predetermined virtual router and the router virtualization apparatus port input by the packet to be transferred to the switch.
The router virtualization apparatus according to claim 4. A first step of forwarding packets input from the switch to the router;
A second step of assigning an identifier corresponding to a virtual router that controls a path between a plurality of virtual networks to a packet input from the router and transferring the packet to a switch connected to the network configured by a virtual network And a network control method. In the second step, the identifier of the packet to be transferred to the switch is given based on a combination of the virtual router and the port of the router virtualization apparatus to which the packet to be transferred to the switch is input. The
The network control method according to claim 6. In the second step, the combinations are stored as a table,
The network control method according to claim 7. A first step of forwarding packets input from the switch to the router;
A second step of assigning an identifier corresponding to a virtual router that controls a path between a plurality of virtual networks to a packet input from the router and transferring the packet to a switch connected to the network configured by a virtual network Including,
Router virtualization method. Processing to forward packets input from the switch to the router;
A process of assigning an identifier corresponding to a virtual router that controls a route between a plurality of virtual networks to a packet input from the router, and transferring the packet to a switch connected to the network configured by a virtual network;
A program that causes a computer to execute.
However, the present invention is not limited to the above-described embodiments, and can be appropriately changed by those skilled in the art without departing from the scope of the invention.

Images