JP3229265B2 - Address translation device and recording medium recording address translation program - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an address translation device which enables communication between a management device having a different address system in a network and a managed device by a management protocol, and a recording medium on which an address translation program is recorded. Things.

[0002]

2. Description of the Related Art Conventionally, in a network system such as the Internet, for example, in the case of TCP / IP address conversion, RFC1631 (The
There is an address translation function described in IP Network Address Translator. This rewrites the address in the header (IP header) of the IP packet based on a preset IP address conversion definition file, and recalculates the change of the checksum of the IP header accompanying the rewriting. And rewrite. As a result, communication using TCP / IP between devices having different address systems becomes possible, and communication using an upper layer protocol becomes possible.

[0003] IETF (Internet Engineering)
Task Force) is one of the subordinate organizations of the United States Internet Activities Committee, and is examining the scalability of IP (Internet Protocol) to the next generation, including SNMP (Simple Network Management Protocol) and MIB (Management Information Base).
Develops and manages various protocols.

[0004]

When the address translation function according to the prior art is used for communication of a management protocol such as SNMP between a management device having different address systems and a managed device, communication of the management protocol is possible. But
The address information in the management information carried by the PDU (Protocol Data Unit) of the management protocol cannot be converted. For this reason, when address information exists in the PDU of the management protocol, there is a problem that the management device may not be able to perform normal management as described below.

(1) The address in the packet of the lower-level protocol and the address information in the PDU of the higher-level management protocol sometimes differ from the value assumed by the management apparatus, and the management apparatus does not operate normally. (2) In the case where there is a device to be managed in which the address of the lower protocol is duplicated, even if communication of the lower protocol is enabled by converting the address in the packet of the lower protocol and the checksum, the PDU of the management protocol can be used. Since the address information is not converted, the management device receives the management information having the duplicated address information from the managed device, and the management device does not operate normally.

An object of the present invention is to solve the above problems,
Provided is an address translator that enables communication by a management protocol such as SNMP between a management device having different address systems and a managed device and a managed device, and guarantees normal network management by the management protocol in the management device. It is in.

Another object of the present invention is to provide an SNM between a management device having different address systems and a managed device.
An object of the present invention is to provide a computer-readable recording medium on which an address conversion program for enabling communication according to a management protocol such as P is recorded.

[0008]

In order to achieve the above object, the invention of claim 1 is provided between a management device and a managed device having different address systems, and includes an address and a checksum in a packet of a lower protocol. In the address translator provided with means for translating the data, a protocol data unit (PD) of a management protocol used on the lower protocol is used.
A conversion target definition rule for retrieving a location of the address information in U), an address information conversion definition rule for converting the address information in the PDU retrieved based on the conversion target definition rule, and the conversion PDU using the target definition rule and the address information conversion definition rule
Means for converting the address information in the address information.

According to a second aspect of the present invention, in order to cope with the use of a simple network management protocol (SNMP), which is one of the standard protocols for network management, the address information conversion means in the PDU includes an SNM.
Means for converting address information in the management information value of the P_PDU, means for converting address information in the management information name of the SNMP_PDU, means for determining the type of the PDU, means for converting trap source address information, SNMP
_PDU in text format using a predetermined abstract syntax notation, and the SNMP in text format
_PDU encoding means, the conversion target definition rule is composed of a management information value conversion definition file and a management information name conversion definition file, and the address information conversion definition rule is an address information conversion definition file and a trap transmission source address. And an information conversion definition file.

A computer-readable recording medium which records an address conversion program for enabling communication between a management device having a different address system and a managed device according to a management protocol according to the third aspect of the present invention is a low-order storage medium. A process for converting the address in a packet of the protocol into a checksum; a process for searching for a location of address information in a protocol data unit (PDU) of a management protocol used on a lower protocol; And a process for converting address information.

The recording medium according to the fourth aspect of the present invention, when the management protocol is SNMP, SNMP_PDU
, A process for converting an address in the management information name of SNMP_PDU, a process for determining the type of PDU, and a process for converting trap source address information And a process for decoding the SNMP_PDU into a text format, and the SNMP_PDU in the text format
And a processing process for encoding

According to the present invention, a PD including address information
When a packet of a lower protocol carrying U passes through the address translation device, the address information conversion means searches the PDU for a portion including the address information according to the conversion target definition rule, and the address of the portion according to the address information conversion definition rule. The information is converted, and the lower-layer protocol address / checksum converter converts the address / checksum in the packet. As a result, the address information in the PDU is matched with the address in the packet, and the managed device can manage the managed device normally as a managed device having an address different from the actual address.

[0013]

Embodiments of the present invention will be described below with reference to the drawings. In the present embodiment, the management protocol is set to SN which is one of the network management standards.
MP (Simple Network Management Protocol: Simple Network Management Protocol), and the lower layer protocol of the SNMP is UDP / IP (User Datagram Protocol).
1 / Internet Protocol) is used, and the address converted by the address information conversion unit in the management protocol PDU is an IP address.

FIG. 1 shows an overall block diagram of an embodiment of the present invention. In FIG. 1, reference numeral 1 denotes a management device (so-called manager) that performs network management by a management protocol, 2 denotes a managed device (so-called agent) managed by a management protocol, and 10 denotes an address translation device according to the present invention. The address translation device 10 includes a management device-side lower protocol processing unit 11 that processes a management device-side lower protocol, a managed device-side lower protocol processing unit 12 that processes a managed device-side lower protocol, and a management protocol PDU. It comprises a management protocol PDU address information conversion unit 13 for converting address information, and a lower protocol address / checksum conversion unit 17 for converting an address in a packet of a lower protocol. Here, the management protocol PDU address information conversion unit 13
Are the main components of the present invention, a conversion target definition rule 14 for retrieving a conversion target part from a PDU, an address information conversion definition rule 15 for rewriting the searched conversion target part, and a conversion target definition rule 14 and an address information conversion unit 16 that performs address information conversion using the address information conversion definition rule 15.

FIG. 2 shows a configuration example of the lower-order protocol address / checksum converter 17. The lower-order protocol address / checksum converter 17 includes a UDP header checksum converter 21 and an IP address converter 2 in the IP header.
2. It comprises an IP header checksum conversion unit 23 and an IP address conversion definition file 24.

FIG. 3 shows a configuration example of the address information conversion unit 13 in the management protocol PDU. SNMP is TCP / IP
(UDP / IP), unlike a lower-level protocol, ASN. 1 (Abstr
act Syntax Notation One: Defined by a notation called abstract syntax notation 1). In FIG. 3, the address information converter 16 particularly shows an example of an application configuration in this case. 1 decoding unit 30, address information conversion unit within management information value 31, address information conversion unit within management information name 32, P
DU type determination unit 33, trap transmission source address information conversion unit 38, ASN. It comprises one encoding unit 39. The conversion target definition rule 15 is the management information value conversion definition file 3
4. It is composed of a management information name conversion definition file 35, and the address information conversion definition rule 15 is composed of an address information conversion definition file 36 and a trap sender address information conversion definition file 37. 4 to 6 show the management information value address information conversion unit 31, the management information name address information conversion unit 32, and the trap transmission source address information conversion unit 38.
3 is a flowchart example of each process of FIG.

FIG. 7 shows a specific example of the management information value conversion definition file 34. Here, each integer separated by a period “.” Is referred to as a component, and the% symbol is 0 to 25.
A symbol indicating four components of an integer up to 5, and a # symbol indicates an arbitrary integer for one component. Reference numeral 71 denotes an object identifier (OI) representing a management information value conversion target.
D) corresponds to the management information name in the PDU. A comment 72 describes a general name of the management information name and the like.

FIG. 8 shows a specific example of the management information name conversion definition file 35. Again, each integer separated by a period “.” Is referred to as a component, and the% symbol is 0 to 25.
A symbol indicating four components of an integer up to 5, and a # symbol indicates an arbitrary integer for one component. An object identifier (OI) 81 represents a management information name conversion target.
D) corresponds to the management information name in the PDU. A comment 82 describes a general name or the like of the management information name.

Each of the files illustrated in FIGS.
It is a management information value conversion definition example file and a management information value conversion definition example file regarding NM PMIB-2. here,
The MIB is a database (Managem) holding a group of data related to the network for network management.
ent Information Base: management information base), and a set of management information of the MIB is transmitted and received between the management device and the managed device by SNMP. MIB-2 is the M
This is the meaning of the second version of the IB.

FIG. 9 shows an address information conversion definition file 36.
The following shows a specific example. The * symbol is a symbol indicating an integer from 0 to 255. 91 is the actual IP address of the management device, 92 is the IP address of the management device after conversion by the address translation device, 93 is the actual IP address of the managed device, and 94 is the managed device after translation by the address translation device. Side IP address.

FIG. 10 shows an IP address conversion definition file 2
4 shows a specific example. The * symbol is a symbol indicating an integer from 0 to 255. 101 is the actual IP address of the management device, 102 is the IP address of the management device after translation by the address translation device, and 103 is the actual I / O of the managed device.
The P address 104 indicates the IP address of the managed device after the translation by the address translator. However, in the present embodiment, it is assumed that UDP / IP is used as a lower protocol of SNMP, and the address converted by the address information conversion unit 13 in the management protocol PDU is an IP address. It is a definition file.

FIG. 11 shows an example of the trap transmission source address conversion definition file 37. The * symbol is a symbol indicating an integer from 0 to 255. Since the managed device transmits the trap, the trap transmission source address before the translation by the address translator is the real IP (11
1), when the address is converted by the device of the present invention, it is converted into the IP address (112) of the managed device after the conversion.

FIG. 12 shows a network management architecture based on SNMP. The management device 1 and the managed device 2 are linked by a network management protocol. TCP / I
The protocol used to manage the P network is SNM
P, which carries data exchanged between the management device 1 and the managed device 2 in a PDU in a prescribed format. This PDU is a data format of an application layer, and UDP / IP is used for transport of a transport / network layer. Here, there are the following five types of SNMP commands, and there is a PDU corresponding to each command. Get Request: The management device requests the managed device to send the value of the object (managed resource) to the managed device. Get Next Request: Requests the management device to report the value of the next object. Get Response: The managed device sends response data to the management device in response to a request from the management device. The requested data is read from the MIB. Set Request: The setting value of the object on the managed device is changed from the management device. Trap: The managed device notifies the managed device of a status change, occurrence of an abnormality, and the like.

FIG. 13 shows an example of the SNMP PDU format in ASN. 1 together with the abstract syntax definition. The description of each field is omitted, but the present invention relates to Variabl
e-bindings. Variable-bindings takes an array of bears of name (object identifier) and value (value),
It is called BL (Variable-Binding-List). This V
The name in the BL is the object to be operated.

Next, the specific operation of this embodiment will be described in detail by dividing the type of SNMP PDU into three patterns.

<Pattern 1> GetRequest, GetNextRequest, or Set among SNMP PDUs from the management device 1
A case where any PDU of Request is transmitted to the managed device 2 will be described. Here, as an example, it is assumed that SetRequest is sent from the management device 1 to the management device 2, and a specific example of the packet configuration before conversion is as shown in FIG. The hatched part in FIG. 14 is the conversion target part.

The packet arriving at the address translator 10 is received by the lower-level protocol processor 11 on the management device side.
Lower protocol (UDP) and upper protocol (SNMP)
PDU), and the process is passed to the address information converter 16 (FIG. 3) of the address information converter 13 in the management protocol PDU.

In the address information conversion unit 16, first, the AS
N. 1 Pass the packet to the decoding unit 30. ASN. 1 decoding unit 30 converts the SNMP_PDU in the packet into an ASN. 1
The data is decrypted into the text format of the abstract syntax notation and passed to the management information value address information conversion unit 31.

The management information value-in-address information conversion unit 31
As shown in the processing flow of FIG. 4, the management information name in the SNMP_PDU in text format is compared with the conversion target OID (71) of the management information conversion definition file 34, and it is determined whether a matching management information name exists. Search (Step 4
1) If a matching management information name is found, the IP address information included in the management information value is read out, and the converted I-address of the managed device in the address information conversion definition file 36 is read.
A comparison is made with the P address (94), and conversion to the corresponding real IP address (93) is performed (step 42). However, if the management information value is NULL and is not IP address information, no conversion is performed. If the matching management information name is not found in the conversion target object search, the management information value-in-address information conversion unit 31 ends the process.

Referring to FIGS. 7 and 9, a specific example of the conversion in the management information value-internal address information conversion unit 31 will be described. The Set of the packet shown in FIG.
Request PDU (management information name = 1.3.6.1.2.
(1.4.20.1.1.20.168.0.1, management information value = 20.168.0.1), the management information name is changed to the management information value conversion definition file in FIG. Since the definition of the second line of the OID (71) to be converted corresponds to the definition of the management information value (20.168.0.1) and the conversion of the managed device with reference to the address information conversion definition file 36 of FIG. After IP address 94 (20.168.0.1)
And compares the management information value with the corresponding real IP address 9
3 (192.168.0.1), and the management information value is converted to “192.168.0.1”.

When the processing by the management information value address information conversion section 31 is completed, the management information name address information conversion section 32
The process is passed to. Management information name address information conversion unit 3
5, the management information name in the text-formatted SNMP_PDU is compared with the conversion target OID (81) of the management information name conversion definition file 35 as shown in the processing flow of FIG. It is searched for the existence (step 51), and if a matching management information name is found,
The IP address information included in the% element of the conversion target OID (81) is read, and the management information name conversion definition file 35 is read.
Is compared with the converted IP address (94) on the managed device side, and is converted to the corresponding real IP address (93) (step 52). The management information name address information conversion unit 32
If no matching management information name is found in the conversion target object search, the process ends.

FIG. 8 and FIG. 9 show a specific example of conversion in the management information name-in-address information conversion unit 32.
For the packet No. 4, the address conversion unit 3 in the management information value
1 to SetRequest PDU (management information name = 1.3.6.
1.2.1.4.2.10.1.1.20.168.0.
1, management information value = 192.168.0.1), the management information name corresponds to the definition of the second line of the conversion target OID (81) in the management information name conversion definition file 35 in FIG. Therefore, referring to the address information conversion definition file 36 in FIG.
(20.168.0.1) and the corresponding real IP
It is converted to an address 93 (192.168.1.0), and the management information name is changed to "1.3.3.6.1.2.4.1.2".
0.1.1.192.168.0.1 ".

When the processing by the management information name address information conversion section 32 is completed, the processing is passed to the PDU type determination section 33. The PDU type determination unit 33 determines whether the PDU received by the request field is Trap or not Trap. If the PDU is Trap, the process is passed to the trap transmission source address information conversion unit 38;
N. 1 The processing is passed to the encoding unit 39 (in the case of SNMP, the processing is different depending on whether the received PDU is Trap or not, and the processing of the PDU type determination unit (33) is performed). Since pattern 1 is other than Trap, ASN.
The process is passed to one encoding unit 39. ASN. 1 encoding unit 39
Is ASN. S converted to a text format by the 1 decoding unit 30
NMP_PDU is transferred to ASN. 1 and passes the processing to the lower-order protocol address / checksum converter 17. In the specific example, the SUMP-PD
A packet in which the management information value (value) and the management information name (name) in U are converted as shown in FIG. 15 is passed to the lower-order protocol address / checksum converter 17.

In the lower-order protocol address / checksum converter 17 (FIG. 2), the UDP header checksum converter 21 first converts the UDP header checksum caused by the operation of the SNMP_PDU into a UDP header checksum.
The header checksum is recalculated, the header checksum of the UDP header is converted to a correct value, and the IP header I
The process is passed to the P address conversion unit 22. IP in IP header
The address conversion unit 22 converts the source address and the destination address in the IP header from the real IP address (101) on the management device side and the converted IP address (102) based on the IP address conversion definition file 24. Then, the destination address is converted from the converted IP address (104) on the managed device side to the real IP address (103).

Referring to FIG. 10, a specific example of the conversion performed by the IP address conversion unit 22 in the IP header will be described. The SNMP packet (source address = 10.0.2) shown in FIG. .1, destination address = 20.168.1.1), the source address is compared with the real IP address 101 of the IP address translation definition file 24 in FIG.
P address 102 (110.0.2.1), the destination address is compared with the translated IP address 104 in the definition file 24, and the real IP address 10
3 (192.168.1.1). FIG. 16 shows the packet after the conversion.

When the processing of the IP address conversion unit 22 in the IP header is completed, the processing is passed to the IP header checksum conversion unit 23. IP header checksum converter 23
Is to correct the change in the IP header checksum caused by translating the IP address in the IP header,
Recalculate the header checksum of the IP header,
The header checksum is converted into a correct value, and the process is passed to the managed device side lower protocol processing unit 12. The managed device side lower protocol processing unit 12 transmits the packet to the managed device side.

<Pattern 2> SNMP from managed device 2
A case in which a PDU of GetResponse is transmitted to the management device 1 among the PDUs of FIG. The packet arriving at the address translator 10 is sent to the managed device side lower protocol processor 1
2 and is passed to the management protocol PDU address information conversion unit 13. The processing in the address conversion unit 16 and the lower-order protocol address checksum conversion unit 17 of the management protocol PDU address information conversion unit 13 is basically the same as that in the case of pattern 1. However, in the management information value address conversion unit 31, the management information name address conversion unit 32, and the IP header IP address conversion unit 22, the address conversion is performed in reverse to the pattern 1. The IP header checksum conversion unit 23 passes the processing to the management device side lower protocol processing unit 11. The management device-side lower-level protocol processing unit 11 transmits the packet to the management device.

<Pattern 3> SNMP from managed device 2
The case where the Trap PDU is sent to the management device 1 among the PDUs will be described. The packet arriving at the address translator 10 is received by the managed device-side lower-level protocol processor 12 and is sent to the address information translator 13 in the management protocol PDU.
The process is passed to the address information conversion unit 16 of FIG. The processing in the address conversion unit 16 is the same as that of the pattern 2 up to the management information name address information conversion unit 32. The management information name-in-address information conversion unit 32 executes the processing in the PDU type determination unit 3
Pass to 3. The PDU type determination unit 33 passes the process to the trap transmission source address information conversion unit 38 because the PDU is Trap. The trap transmission source address conversion unit 38 determines whether or not conversion is necessary (step 61) as shown in the processing flow of FIG. 6, and if necessary, uses the trap transmission source address information conversion definition file 37 to perform the conversion. PDU
Is converted from the real IP address (111) of the managed device to the converted IP address (112) (step 62).

Referring to FIG. 11, a specific conversion example will be described. The Trap PDU from the managed device 2 to the management device 1 (assuming the trap source address = 30.168.10.5) is the trap source. When passed to the address conversion unit 38, the trap transmission source address conversion unit 38 uses the trap transmission source address information conversion definition file 37 shown in FIG.
0.168.10.5) to the converted IP address 112
(40.168.10.5).

After the end of the processing, the trap transmission source address converter 38 converts the ASN. The process is passed to one encoding unit 39. AS
N. The processing after the one encoding unit 39 is the same as that of the pattern 2.

Although the embodiment of the present invention has been described above, the functions of the address information conversion section 16 and the lower-order protocol address / checksum conversion section 17 in FIG. 1 can be realized collectively as an address conversion program. The address conversion program is FD or CD
-It can be recorded on a recording medium such as a ROM in a computer-readable format and sold. By installing the address conversion program recorded on this type of recording medium in a computer, it becomes possible to use the program in the embodiment shown in FIGS. 2 and 3, for example.

In this embodiment, the management protocol SNMP is used as shown in FIG. 13, and UDP / IP is used as a lower protocol of the SNMP. However, the management protocol is CMIP (Common Management Information).
For example, TCP / IP or ATM (Asynchronous) is used as address information in a PDU of a lower protocol type and a management protocol such as a mation protocol (common management information protocol).
Transaction Mode (Asynchronous Transfer Mode) and MAC
(Media Access Control: media access control), etc.

[0043]

As described above, according to the present invention,
Even when the address information is present in the PDU of the management protocol, the address information in the PDU of the management protocol is also converted according to the conversion of the address in the packet of the lower protocol, so that the management device operates normally and the address of the lower protocol is changed. Even if there are duplicate managed devices, the management can be performed normally because the conversion can be performed without duplication by describing the address information conversion definition rule.

[Brief description of the drawings]

FIG. 1 is a functional block diagram of an embodiment of the present invention.

FIG. 2 is a specific functional block diagram of a lower-order protocol address / checksum conversion processing unit;

FIG. 3 is a specific functional block diagram of a management protocol PDU address conversion processing unit.

FIG. 4 is a flowchart of a management information value in-address conversion operation.

FIG. 5 is a flowchart of a management information name address conversion processing operation.

FIG. 6 is a flowchart of a trap transmission source address conversion processing operation.

FIG. 7 is a diagram showing a specific example of a management information value conversion definition file.

FIG. 8 is a diagram showing a specific example of a management information name conversion definition file.

FIG. 9 is a diagram showing a specific example of an address information conversion definition file.

FIG. 10 is a diagram showing a specific example of an IP address conversion definition file.

FIG. 11 is a diagram showing a specific example of a trap transmission source address conversion definition file.

FIG. 12 is a diagram illustrating an SNMP network management architecture.

FIG. 13 is a format example of SNMP_PDU.

FIG. 14 is a diagram illustrating a specific example of an SNMP packet before conversion.

FIG. 15 is a diagram showing a packet after the address conversion within the SNMP_PDU.

FIG. 16 is a diagram showing a packet after lower-order protocol (IP) address conversion.

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 1 Management device by management protocol 2 Managed device by management protocol 10 Address conversion device 11 Management device side lower protocol processing unit 12 Managed device side lower protocol processing unit 13 Management protocol PDU address information conversion unit 14 Address information conversion definition rule 15 Conversion target definition rule 16 Address information conversion unit 17 Lower protocol address / checksum conversion unit

──────────────────────────────────────────────────続 き Continuation of the front page (72) Takao Yamamoto, inventor, Nippon Telegraph and Telephone Corporation 3-9-1-2 Nishishinjuku, Shinjuku-ku, Tokyo (56) References JP-A-10-4407 (JP, A) ( 58) Field surveyed (Int. Cl. ⁷ , DB name) H04L 12/28 200 G06F 13/00 353

Claims (4)

(57) [Claims] 1. An address translation device which is provided between a management device and a managed device having different address systems and has a means for translating an address and a checksum in a packet of a lower protocol, wherein said address translation device is used on said lower protocol. Conversion target definition rule for searching for a location of address information in a protocol data unit (hereinafter abbreviated as PDU) of a management protocol to be converted, and converting the address information in the PDU searched based on the conversion target definition rule An address conversion device comprising: an address information conversion definition rule for converting address information in a PDU using the conversion target definition rule and the address information conversion definition rule. 2. The address translation device according to claim 1, wherein a simple network management protocol (hereinafter abbreviated as SNMP), which is one of the standard protocols for network management, is used as a management protocol, and the address information conversion means in the PDU includes: , SNMP_PDU
Means for converting address information in the management information value of the
Means for converting the address information in the management information name of the MP_PDU, means for determining the type of the PDU, means for converting the trap source address information, and decoding of the SNMP_PDU into a text format in a predetermined abstract syntax notation Means for encoding the SNMP_PDU in text format, wherein the conversion target definition rule comprises a management information value conversion definition file and a management information name conversion definition file, and the address information conversion definition rule comprises an address information conversion rule. An address translation device comprising a definition file and a trap transmission source address information translation definition file. 3. A computer-readable recording medium on which an address translation program for enabling communication between a management device having different address systems and a managed device by a management protocol is recorded, wherein A process for converting an address and a checksum of the PDU, a process for searching for a location of address information in a protocol data unit (PDU) of a management protocol used on a lower protocol, and a process for converting the address information in the searched PDU. A conversion process. 4. The recording medium according to claim 3, wherein when the management protocol is SNMP, SNMP_PDU is used.
, A process for converting an address in the management information name of SNMP_PDU, a process for determining the type of PDU, and a process for converting trap source address information And a process for decoding the SNMP_PDU into a text format, and the SNMP_PDU in the text format
And a recording process for encoding the data.