JP3570349B2 - Routing device and virtual private network system used therefor - Google Patents

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to a routing apparatus and a virtual private network system used for the same, and more particularly, to a routing method using a virtual LAN (Virtual Local Area Network).
[0002]
[Prior art]
Conventionally, in a network configuration of a virtual LAN, a plurality of terminals are connected to each port of a first switch to form a first LAN, and a plurality of terminals are connected to each port of a second switch to form a second LAN. When the LAN is configured, the plurality of terminals are grouped together in the form of a virtual LAN, and a virtual LAN is configured by a logical configuration to perform terminal-to-terminal communication within the same switch.
[0003]
In the above configuration, when the terminal is moved to a mere port, a switch table can be configured by a general MAC (Media Access Control) address learning method. Since each terminal has a MAC address, the address is taken over when the port is moved.
[0004]
Since the attribute of the virtual LAN is defined in this table, when a packet from each terminal is received, a VLAN-ID (Virtual bridged Local Area Network identification: virtual LAN identifier) is received based on the MAC address and the logical address of the port. ) Is given, and registration in the table is performed.
[0005]
Further, a virtual logical network (virtual LAN) may be constructed across a network, that is, by connecting a transmission line to another switch. In order to perform end-to-end communication with terminals connected between different switches, that is, to perform end-to-end communication of terminals in a virtual LAN having the same LAN attribute, a fixed By assigning a unique port and treating a terminal connected to the fixedly assigned port as one virtual LAN having the same attribute, end-to-end communication of the terminal becomes possible.
[0006]
Further, an identifier called a virtual LAN tag is added to a packet, and a virtual network is identified based on the virtual LAN tag, and transmission can be performed between switches.
[0007]
Furthermore, it is possible to broadcast or unicast a packet to a terminal connected to a port of a switch belonging to the same virtual LAN. Even in this case, the switch table can be configured by learning the MAC address.
[0008]
However, the above network configuration is not intended for communication between virtual LANs (communication between virtual LANs). Enabling communication between virtual LANs as a network means enabling communication between arbitrary terminals.
[0009]
As can be seen from recent examples of network use, it has become commonplace to use the Internet connection and shared data and files. Therefore, when introducing network equipment and constructing a network in the future, it is necessary to increase the number of terminals expected in the future and to provide a network that enables communication between a plurality of virtual LANs.
[0010]
[Problems to be solved by the invention]
In the above-described conventional virtual LAN network configuration, when routing is performed simply by using the virtual LAN, a virtual identification ID cannot be provided. Therefore, when communication is performed from the virtual LAN to the dedicated line via a router, the dedicated line is used. Cannot maintain the closedness as an intranet.
[0011]
SUMMARY OF THE INVENTION An object of the present invention is to solve the above-mentioned problems and to provide a routing device capable of maintaining a closed area as an intranet on a dedicated line, and a virtual private network system used for the routing device.
[0012]
[Means for Solving the Problems]
The routing apparatus according to the present invention includes a routing table that holds an IP address search surface for searching an IP (Internet Protocol) address for each VPN-ID (Virtual Private Network identification), and a VLAN-ID for a received LAN (Local Area Network) frame. Means for assigning a VPN-ID number from virtual ID (Virtual Bridged Local Area Network identification) information and selecting an IP address search surface corresponding to the corresponding VPN-ID from the routing table; and selecting the IP address search surface within the selected IP address search surface. Routing means for performing only routing ,
The means for selecting the routing table and the IP address search surface from the routing table and the routing means are arranged in a layer 3 switch processing means .
[0013]
In the virtual private network system according to the present invention, a LAN (Local Area Network) received from a routing table holding an IP address search surface for searching an IP (Internet Protocol) address for each VPN-ID (Virtual Private Network identification) in advance. A step of assigning a VPN-ID number from the virtual-bridged local area network identification (VLAN-ID) information of the frame and selecting an IP address search plane corresponding to the corresponding VPN-ID, and routing only within the IP address search plane and a step of performing,
The selection of the IP address search plane from the routing table and the routing only within the IP address search plane are performed by the layer 3 switch processing means .
[0014]
That is, an Internet VPN (Virtual Private Network: Virtual Private Network) of the present invention is a virtual private network (VLAN) when a VPN is connected between a Virtual Private Network (VLAN) and a WAN (Wide Area Network: Wide area network) when a VPN is connected via a VPN. Is used as a routing identifier to virtually secure the closed area in an end-to-end Internet dedicated network (intranet).
[0015]
More specifically, the Internet VPN method of the present invention provides a case where a gateway between a LAN to which a VLAN is applied in a L2 (Layer 2) switch unit or a VLAN-packet network is routed by a routing process having an L3 (Layer 3) switch. The route information on the information surface of the routing table is previously entered for each VLAN-ID, and the arriving packet selects a route surface having each VLAN-ID (Virtual Bridged Local Area Network identification: virtual LAN identifier). In addition, it is possible to perform an IP address search only in the corresponding route plane.
[0016]
Further, regarding the relationship between VPN numbers, the VLAN-ID corresponding to the VPN number may not have the same value end-to-end, as long as the relationship is established before routing.
[0017]
In the Internet VPN method of the present invention, the VPN-ID is identified from the Virtual Bridged LAN Identification of the VLAN-ID, and route information stored for each VPN-ID (Virtual Private Network Identification: virtual private network identifier) is selected. Is possible, so that the closed area is ensured.
[0018]
The conventional VLAN-ID used in the VLAN is used for the L2 bridge, and is not used for the VPN-ID of the L3 routing switch as in the present invention.
[0019]
BEST MODE FOR CARRYING OUT THE INVENTION
Next, an embodiment of the present invention will be described with reference to the drawings. FIG. 1 is a block diagram showing a configuration of a routing device according to one embodiment of the present invention. In FIG. 1, a routing apparatus according to an embodiment of the present invention includes an L2 (Layer 2) switch processing unit 1 having a logical hub function such as a hub or a bridge, and an L3 (Layer 3) switch processing unit 2 such as a router. It is composed of
[0020]
The L2 switch processing unit 1 is connected to a plurality of virtual LANs (Virtual Bridged Local Area Networks) (not shown) via dedicated lines [for example, the Internet or a WAN (Wide Area Network)]. -1 to 11-m, and ports 12-1 to 12-n which are individually connected to a plurality of virtual LANs (VLAN # 1 to VLAN #n) (not shown).
[0021]
The L3 switch processing unit 2 includes a filter unit 21 for filtering a MAC (Media Access Control) address, and an IP (Internet Protocol) address search surface for selecting an IP (Internet Protocol) address search surface for a VPN-ID (Virtual Private Network Identification). It comprises an address search plane selection unit 22 and a routing table 23 for storing IP address search planes for VPN-ID.
[0022]
The L2 switch processing unit 1 assigns a VLAN-ID as a VPN-ID and transmits it together with an IP address when transferring the packet received at the ports 11-1 to 11-m to the L3 switch processing unit 2.
[0023]
The routing table 23 holds an IP address search surface for VPN-ID, and the IP address search surface selection unit 22 selects (points) an IP address search surface corresponding to the VLAN-ID from the L2 switch processing unit 1. . Therefore, in the routing table 23, the routing is performed only within the selected IP address search plane, and the connection information [port, MAC (Media Access Control) address, etc.] searched in the IP address search plane is stored in the L2 switch processing unit 1. Send to
[0024]
The L2 switch processing unit 1 sends out the packet routed by the L3 switch processing unit 2 to the corresponding ports 12-1 to 12-n based on the routing result by the L3 switch processing unit 2.
[0025]
By using the above method, it is possible to perform routing only between virtual LANs having a specific VLAN-ID or between LANs and WANs. Therefore, virtual routing is performed only between specific users in a global network such as the Internet. You can make a specific path.
[0026]
FIG. 2 is a diagram illustrating a VPN relationship in a network interface (NNI) according to an embodiment of the present invention. In FIG. 2, VPNs # 1 to # 3 are set in networks # 1 and # 2, respectively, and a gateway (G / W: Gateway) is provided between VPN # 1 of network # 1 and VPN # 1 of network # 2. Are connected by the VPN # 1 entry, and the VPN # 2 of the network # 1 and the VPN # 2 of the network # 2 are connected by the VPN # 2 entry.
[0027]
FIG. 3 is a diagram showing a configuration example of the routing table 23 of FIG. In FIG. 3, the routing table 23 stores IP address “192.122.092” in areas (corresponding to an IP address search surface) indicated by pointers VPN-ID = 1, VPN-ID = 2, and VPN-ID = 3. .X "," 192.122.09.x "," 192.122.09.x ", respectively, and the connection information" aaaaaa "," bbbbbb "," ccccc ", “Dddddd”, “eeeeee”, “ffffff”, “gggggg”, “hhhhhh”, and “iiiiii” are stored.
[0028]
FIG. 4 is a flowchart showing the operation of the L2 switch processing unit 1 of FIG. 1, and FIG. 5 is a flowchart showing the operation of the L3 switch processing unit 2 of FIG. The operation of the routing device according to one embodiment of the present invention will be described with reference to FIGS.
[0029]
When the L2 switch processing unit 1 receives a packet from the ports 11-1 to 11-m (step S1 in FIG. 4), it assigns a VLAN-ID as the VPN-ID of the received packet and sends it to the L3 switch processing unit 2 together with the IP address. (Step S2 in FIG. 4).
[0030]
When the VLAN-ID assigned as the VPN-ID is sent from the L2 switch processing unit 1 together with the IP address (step S11 in FIG. 5), the IP corresponding to the VLAN-ID in the routing table 23 is sent to the L3 switch processing unit 2. The connection information (MAC address or the like) corresponding to the IP address is searched on the address search surface (step S12 in FIG. 5).
[0031]
If the connection information is retrieved (step S13 in FIG. 5), the L3 switch processing unit 2 notifies the L2 switch processing unit 1 of the retrieved connection information (step S14 in FIG. 5). If the connection information is not retrieved (FIG. 5). Step S13), the corresponding status is notified to the L2 switch processing unit 1 (step S16 in FIG. 5).
[0032]
When the L2 switch processing unit 1 receives the connection information from the L3 switch processing unit 2 (step S3 in FIG. 4), based on the input connection information, the corresponding VLANs # 1 to ## from the ports 12-1 to 12-n. n (step S4 in FIG. 4). Further, if no connection information is sent from the L3 switch processing unit 2 (step S3 in FIG. 4), that is, if there is no corresponding information, the L2 switch processing unit 1 discards the received packet (step S6 in FIG. 4).
[0033]
The L2 switch processing unit 1 and the L3 switch processing unit 2 repeat the above-described processing operation until the processing is completed (steps S1 to S6 in FIG. 4 and steps S1 to S16 in FIG. 5).
[0034]
As described above, when the gateway between the LAN to which the virtual LAN is applied or the VLAN and the packet network in the L2 switch processing unit 1 is routed by the routing processing including the L3 switch processing unit 2, the information surface (the IP address) of the routing table 23 is used. By pre-entering the route information of the search plane) for each VLAN-ID, selecting a route plane for each VLAN-ID of the arriving packet, and performing an IP address search only within the applicable route plane. An end user using the virtual LAN can use the Internet as an intranet for a specific user having a closed area. In this case, the number of routing entries for each route plane can be reduced.
[0035]
【The invention's effect】
As described above, according to the present invention, a LAN (Local Area Network) received from a routing table holding an IP address search surface for searching an IP (Internet Protocol) address for each VPN-ID (Virtual Private Network identification) in advance. ) A VPN-ID number is allocated from VLAN-ID (Virtual Bridged Local Area Network identification) information of a frame, an IP address search surface corresponding to the corresponding VPN-ID is selected, and routing is performed only within the IP address search surface. By doing so, there is an effect that the closed area as an intranet can be maintained in the dedicated line.
[Brief description of the drawings]
FIG. 1 is a block diagram illustrating a configuration of a routing device according to an embodiment of the present invention.
FIG. 2 is a diagram showing a VPN relationship in an interface between networks according to an embodiment of the present invention.
FIG. 3 is a diagram illustrating a configuration example of a routing table in FIG. 1;
FIG. 4 is a flowchart illustrating an operation of an L2 switch processing unit in FIG. 1;
FIG. 5 is a flowchart illustrating an operation of an L3 switch processing unit in FIG. 1;
[Explanation of symbols]
1 L2 switch processing unit 2 L3 switch processing unit 11-1 to 11-m Ports 12-1 to 12-n Ports (VLAN # 1 to VLAN #n)
21 filter unit 22 IP address search plane selection unit 23 routing table

Claims (6)

A routing table that holds an IP address search surface for searching for an IP (Internet Protocol) address for each VPN-ID (Virtual Private Network identification), and a VLAN-ID (Virtual Network Alarm) of a received LAN (Local Area Network) frame means for allocating a VPN-ID number from identification information and selecting an IP address search plane corresponding to the VPN-ID from the routing table, and routing means for performing routing only within the selected IP address search plane. have a,
A routing device, wherein a means for selecting the routing table and the IP address search surface from the routing table and the routing means are arranged in a layer 3 switch processing means . Layer 2 switch processing means having a plurality of ports for receiving the LAN frame and ports provided for the VLAN-ID and for transmitting the LAN frame to a VLAN corresponding to the routing result of the routing means 2. The routing apparatus according to claim 1 , wherein a VPN-ID number is assigned from VLAN-ID information of the received LAN frame. 3. The routing device according to claim 1 , wherein the layer 3 switch processing unit includes a filter unit for filtering a MAC (Media Access Control) address. From a routing table holding an IP address search surface for searching for an IP (Internet Protocol) address for each VPN-ID (Virtual Private Network identification), a received LAN (Local Area Network) frame of a received LAN (Local Area Network) frame is used. Area Network identification) assigns a VPN-ID number from the information possess selecting an IP address search plane corresponding to the VPN-ID of the relevant, and performing routing only at its IP address search plane,
A virtual private network system , wherein the selection of the IP address search plane from the routing table and the routing only within the IP address search plane are performed by a layer 3 switch processing means . Layer 2 switch processing means having a plurality of ports for receiving the LAN frame and ports provided for the VLAN-ID and for transmitting the LAN frame to a VLAN corresponding to the routing result of the routing means 5. The virtual private network system according to claim 4 , wherein a VPN-ID number is assigned from VLAN-ID information of the received LAN frame. 6. The virtual private network system according to claim 4 , wherein filtering of a MAC (Media Access Control) address is performed by the layer 3 switch processing means.

Images