KR100546757B1 - ???? ??? packet processing device in packet forwarding engine using network processor - Google Patents

Abstract

The present invention relates to an MPLS VPN packet processing apparatus in a packet forwarding engine using a network processor, in particular, the IBM NP4GS3. Packet forwarding using a network processor to efficiently implement high-speed MPLS VPN packet processing by forwarding MPLS VPN packets with existing Ethernet and IP packets in the packet forwarding engine by providing the appropriate processing function. An apparatus for processing MPLS VPN packets in an engine.

To this end, the MPLS VPN packet processing apparatus in the packet forwarding engine using the network processor according to the present invention is a network processor based packet processing apparatus for implementing MPLS VPN service in an E-PON based OLT system, Packet classification module for classifying the received packet to the packet processing unit, packet processing unit for processing the packet transmitted from the packet classification module, and packet type by analyzing the packet transmitted from the packet switch module at the time of egress. A network processor based packet processing apparatus comprising a hardware classifier for discriminating and a packet processing unit for processing and forwarding the packet transmitted from the hardware classifier to an L2 output unit, the network processor based on a non-MPLS network or an MPLS network. MPLS L2 VPN packet for processing packets from network to non-MPLS network Lee means; And MPLS L3 VPN packet processing means for processing packets transferred from the IP network to the MPLS network or from the MLPS network to the IP network.

Description

JP packet processing device in packet forwarding engine using network processor

Figure 1 shows the overall network configuration of the OLE system for E-PON according to the present invention.

2 is a block diagram showing the internal structure of the NP4GS3 network processor in the packet forwarding engine unit in the case of Ingress.

3 is a block diagram showing the internal structure of the NP4GS3 network processor in the packet forwarding engine unit in the case of output (Egress).

4 is a flowchart illustrating MPLS L2 VPN packet processing transferred from a non-MPLS network to an MPLS network.

5 is a flowchart illustrating MPLS L2 VPN packet processing delivered from a MPLS network to a non-MPLS network.

6 is a flowchart illustrating processing of an MPLS L3 VPN packet transmitted from an IP network to an MPLS network.

7 is a flowchart illustrating processing of an MPLS L3 VPN packet transmitted from an MPLS network to an IP network.

<Explanation of symbols for the main parts of the drawings>

100, 110, 120: packet forward engine unit

130: packet switch module

140: main control processor

200: packet classification module

250, 330: MPLS L2 VPN packet processing means

260, 320: MPLS L2 VPN packet processing means

370: L2 output

400, 500, 600, 700: Input Network Processor (Ingress NP)

410, 510, 610, 710: packet switch module

420, 520, 620, 720: output network processor (Egress NP)

Lookup Table Structure: 450, 470, 540, 560, 650, 670, 740, 760

The present invention relates to an MPLS VPN packet processing apparatus in a packet forwarding engine using a network processor, in particular, the IBM NP4GS3. Packet forwarding using a network processor to efficiently implement high-speed MPLS VPN packet processing by forwarding MPLS VPN packets with existing Ethernet and IP packets in the packet forwarding engine by providing the appropriate processing function. An apparatus for processing MPLS VPN packets in an engine.

The virtual private network (VPN) service is a function that implements a virtual private network in the Internet public network, which is strong in security and enables differentiated traffic control. In addition, it has the advantage that it can be implemented at a much lower cost than the private network implementation through a conventional leased line. However, in the Internet network, it is difficult to provide such a private network service because it is difficult to provide connectionless path management and differentiated traffic control functions in each edge router and backbone router.

In order to solve this problem, many researches have been conducted to implement VPN services in the Internet network, and in particular, technology development using multi-protocol label switching (MPLS) technology has been actively conducted. ought. MPLS technology distinguishes each path by using fixed-length LSP label value representing a virtual path called Label Switched Path (hereinafter referred to as 'LSP'). The lookup and forwarding functions can be implemented. In addition, LSP is determined using a resource reservation protocol such as Resource ReserVation Protocol (RSVP), so that the quality of service (QoS) function can be easily implemented. Routers supporting MPLS are implemented on ATM switches and IP routers, and each router performs traffic control for each LSP or performs differentiated traffic control functions such as IP DiffServ. In addition, in order to handle Internet traffic that is increasing day by day, high speeds are essential in each router, and router development is required to support differentiated services suitable for the characteristics of each subscriber. Network processor-based packet forwarding engine is being actively researched to implement such hardware performance improvement and various service support.

The network processor performs a packet header lookup and forwarding function in hardware, and can also perform multi-field lookup on various headers in addition to the longest prefix match (LPM) lookup method to fulfill various service requirements. (Multi-Field) lookup method is supported. In addition, the network processor can be programmed at the same time to perform packet processing at high speed in the built-in CPU module, which has the advantage of reflecting protocol changes and various subscriber requirements in a short time.

In order to provide a VPN service to an E-PON subscriber, an Ethernet-Passive Optical Network (E-PON) based Optical Line Terminal (OLT) system to which the present invention is applied is provided. It supports VPN service, and supports MPLS L2 VPN service using L2 VLAN group and MPLS L3 VPN service using IP header of L3 (layer 3), respectively. However, since the IBM NP4GS3 network processor used in the packet forwarding engine of the OLT system does not provide a VPN service, the use of the present invention MPLS VPN packet device is essential.

The present invention was created to solve the above problems, and the present invention provides an L2 and L3 header lookup function, an MPLS LSP forwarding function, and a packet header change function for MPLS-based L2 and L3 VPN packets. An object of the present invention is to provide an MPLS VPN packet processing apparatus capable of efficiently implementing the MPLS VPN service function in the NP4GS3 network processor engine.

In order to achieve the above object, an MPLS VPN packet processing apparatus in a packet forwarding engine using a network processor according to the present invention is a network processor based packet processing apparatus for implementing an MPLS VPN service in an E-PON based OLT system. A packet classification module 200 for classifying the received packet at the time of ingress and delivering the received packet to the packet processing units, the packet processing units 210, 220, 230, and 240 for processing the packet transmitted from the packet classification module 200; A hardware classifier 310 for analyzing the packet transmitted from the packet switch module 130 to determine the type of a packet at the time of egress, and the L2 output unit 370 by processing the packet transmitted from the hardware classifier 310. In the packet processor based on the network processor configured to include a packet processor (340, 350, 360) for delivery to),

MPLS L2 VPN packet processing means (250, 330) for processing packets transferred from the non-MPLS network to the MPLS network or from the MPLS network to the non-MPLS network; And

MPLS L3 VPN packet processing means (260, 320) for processing the packet transmitted from the IP network to the MPLS network or the MLPS network to the IP network.

Preferably, the MPLS L2 VPN packet processing means when the packet is transferred from the non-MPLS network to the MPLS network

An Ingress NP 400 that refers to a first lookup structure for a packet input from a non-MPLS network and adds a frame header format (FHF_L2_VPN) to the packet and delivers it to the packet switch module;

A packet switch module 410 for transferring the packet transmitted from the ingress NP to an egress NP; And

And an output NP 420 referring to the second lookup structure for the packet transmitted from the packet switch module and adding the VPN label, the tunnel label, and the L2 'header to the MPLS network. .

Advantageously, said first lookup structure comprises a VLAN ID, TB / TP, LSP and FHF_L2_VPN, and said second lookup structure comprises an LSP, a VPN label, a tunnel label, and an L2 'header.

Preferably, the MPLS L2 VPN packet processing means when the packet is transferred from the MPLS network to the non-MPLS network

Refers to a first lookup structure for a packet input from the MPLS network, removes a VPN label, a tunnel label, and an L2 'header among the input packets, and adds a new frame header format (FHF_L2_VPN') to the packet switch module. Ingress NP 500;

A packet switch module 510 for transferring the packet transmitted from the ingress NP to an egress NP; And

And an output (NP) 520 for referring to the second lookup structure for the packet transmitted from the packet switch module and transferring it to a non-MPLS network without a separate header addition process.

Preferably, the first lookup structure is characterized in that it comprises a VPN label, TB / TP and FHF_L2_VPN '.

Preferably, the MPLS L3 VPN packet processing means when the packet is delivered from the IP network to the MPLS network

An Ingress NP 600 for referring to a first lookup structure for a packet input from an IP network and replacing an existing L2 header with a frame header format (FHF_L3_VPN) and adding the packet to the packet switch module to the packet switch module;

A packet switch module (610) for delivering the packet transmitted from the ingress NP to an egress NP; And

And an output NP 620 for referring to the second lookup structure for the packet transmitted from the packet switch module and adding the VPN label, the tunnel label, and the L2 'header to the MPLS network. .

Advantageously, said first lookup structure comprises a port number, a source IP, a destination IP, TB / TP, LSP and FHF_L3_VPN, and said second lookup structure includes an LSP, a VPN label, a tunnel label, and an L2 'header. Characterized in that.

Preferably, the MPLS L3 VPN packet processing means when the packet is transferred from the MPLS network to the IP network

An input for removing a VPN label, a tunnel label, and an L2 'header among the input packets by referring to the first lookup structure for a packet input from the MPLS network, and adding a new frame header format (FHF_L3_VPN') to the packet switch module. Ingress) NP 700;

A packet switch module 710 for transferring the packet transmitted from the ingress NP to an egress NP; And

And an output (Egress) NP 720 for replacing the frame header format (FHF_L2_VPN ') with an L2 header by referring to the second lookup structure for the packet transmitted from the packet switch module and transmitting the same to the IP network. do.

Advantageously, said first lookup structure comprises a VPN label, TB / TP, NEXTHOP_IP and FHF_L3_VPN ', and said second lookup structure comprises NEXTHOP_IP and L2 MAC.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. In the description of the gist of the present invention, if it is determined that the detailed description of the related well-known technology or configuration may unnecessarily obscure the gist of the present invention, the detailed description thereof will be omitted.

Referring to FIG. 1, a system according to the present invention includes a packet forward engine unit 100, 110, and 120, a packet switch module 130, and a main control processor 140. In FIG. 1, the packet forwarding engine unit 100, 110, 120 receives a packet from an external interface such as Gigabit Ethernet or Packet of SONET (POS), performs a header lookup and packet forwarding function, and delivers the packet to the packet switch module 130. The packet is transferred back to the packet forwarding engine unit including the output port, reconverted into a header form suitable for the output port, and transmitted to the outside. In addition, the forwarding table information referred to at the time of header lookup or packet forwarding is transmitted through the IPC (Inter Process Communication) channel in the main control processor 140 of FIG. 1. In order to provide the MPLS VPN service, the main control processor unit sets the LSP path using routing protocols such as RSVP and CR-LDP, and also sets the traffic control profile information required for the corresponding LSP path to each packet. It also plays a role of forwarding to the forwarding device through the IPC channel.

FIG. 2 illustrates an internal configuration of the NP4GS3 network processor in the packet forwarding engine unit 100, 110, and 120 of FIG. 1. In particular, FIG. 2 illustrates an ingress for delivering a packet to the packet switch module 130. have. The packet classification module 200 performs a function of classifying received packets into various packet types, and according to each packet type, the corresponding packet processing module performs an appropriate header lookup and forwarding function. In particular, the packets processed by the L2 packet processor 210 also go through the L3 packet processor 230 and the L4 packet processor 240 when additional services are required by the higher processing module. The MPLS packet processing unit 220 is in charge of a general MPLS packet processing function, and the MPLS L2 VPN packet processing means 250 and the MPLS L3 VPN packet processing means 260 of the present invention perform additional packet processing to improve performance. Instead, it passes directly to the switch module.

3 illustrates an internal configuration of an output case in which packets transmitted from the packet switch module 130 are transmitted to an external interface, as opposed to FIG. 2. The hardware classifier 310 analyzes a frame header format (hereinafter referred to as 'FHF'), which is a header part of a packet, which is transmitted to the packet switch module 130 to determine a type of a packet. The packet is delivered to the IP packet processor 340, the MPLS packet processor 350, the L2 packet processor 360, and the like according to the classified packet type. Packets passing through each packet processing unit are delivered to the L2 output unit 370 to attach the L2 header appropriate to the output port, and then to the external interface. In FIG. 3, the MPLS L2 VPN packet processing unit 330 and the MPLS L3 VPN packet processing unit 320 process the L2 header conversion function internally in order to improve performance and to process the MPLS VPN header, and then directly transfer them to the external interface. The points are distinguished.

FIG. 4 illustrates a packet processing procedure performed in the MPLS L2 VPN packet processing means 250 and 330 of FIGS. 2 and 3. In particular, FIG. 4 illustrates a case in which a packet received in a non-MPLS network is delivered to an MPLS network. have. The packet 430 transmitted from the non-MPLS network includes an IP data, an IP header, and an L2 header. In addition, the L2 header (L2 HDR) is largely divided into a VLAN header and a MAC header (440), and if the packet 430 delivered to the ingress NP 400 needs the VPN service, the VLAN header ( VLAN HDR value in VLAN HDR).

The Ingress NP (Network Process) 400 uses this value as a search key to extract the destination NP and output port information to be forwarded using the Exact Match method, referring to the lookup table 450, and the LSP to be used in the MPLS network. The frame header format (FHF_L2_VPN) is generated using the value and the FHF_L2_VPN value. The generated frame header format FHF_L2_VPN is transmitted to the packet switch module 410 in the form of a packet 460 newly added to the input packet 430. Here, the lookup table 450 includes a VLAN ID, a Target Board / Target Port (TB / TP), a Label Switched Path (LSP), and an FHF_L2_VPN.

The packet switch module 410 transfers the packet 460 transferred from the ingress NP 400 to the egress NP 420.

Meanwhile, the output (Egress) NP 420 refers to the lookup table 470 included in the frame header format (FHF_L2_VPN) in the packet 460 again, and the VPN label (VPN LABEL) and the tunnel to the existing packet 430. A label (TUNNEL LABEL) and an L2 'header (L2' HDR) are added, and this new type of packet 480 is delivered to the MPLS network.

FIG. 5 illustrates a packet processing procedure performed by the MPLS L2 VPN packet processing means 250 and 330 of FIGS. 2 and 3. In contrast to FIG. 4, a packet received by the MPLS network is transferred to a non-MPLS network. Is showing. The L2 VPN packet 530 transmitted through the MPLS network includes IP data, IP header, IP header, L2 header, VPN label, tunnel label, and L2 '. The header L2 'HDR is included, and the entire packet including the L2 header is encapsulated in the form of an MPLS packet.

Ingress NP 500 discards the L2 header (L2 'HDR) and the MPLS tunnel label value (TUNNEL LABEL) and then looks up the lookup structure 540 to retrieve the destination NP and output port information to forward. The packet 550 including the header format FHF_L2_VPN 'is transmitted to the packet switch module 510.

The packet switch module 510 transmits the packet 550 to the egress NP 520, and when the egress NP 520 detects the frame header format (FHF_L2_VPN '), a separate header addition process is performed. The packet is forwarded to the external interface (non-MPLS network) without performing 570.

FIG. 6 illustrates a packet processing procedure performed by the MPLS L3 VPN packet processing means 260 and 320 of FIGS. 2 and 3, and forwards a packet requiring an MPLS VPN service to an MPLS network. It will perform the function. The packet 630 received from the IP network includes an IP data, an IP header, and an L2 header. The L2 header (L2 HDR) also includes a destination IP address and a source IP address 440.

In the ingress NP 600, a lookup structure 650 combining a destination IP address, a source IP address, and received input port information 640 and 650 from a header L2 HDR of a received IP packet 630. After performing the multi-field classification lookup with reference to the destination NP and output port information is extracted respectively. Based on this information, the packet 660 generated by adding the new frame header format FHF_L3_VPN is transferred to the packet switch module 610, and the packet switch module transmits to the output NP 620.

The output NP 620 refers to the lookup table 670 and uses the label exchange path information (LSP) included in FHF_L3_VPN to generate the VPN label (VPN LABEL) and MPLS tunnel label information (MPL LABEL) required to generate the MPLS VPN header. The packet 680 encapsulating the VPN TUNNEL LABEL into the MPLS VPN packet form 680 is delivered to the MPLS network.

FIG. 7 illustrates a packet processing procedure performed by the MPLS L3 VPN packet processing means 260 and 320 of FIGS. 2 and 3, and in contrast to FIG. 6, a function of delivering an L3 VPN packet received from an MPLS network to an IP network. Will be performed.

The L3 VPN packet processing means goes through almost the same procedure as the L2 VPN packet processing means. The ingress NP 700 discards the L2 header (L2 'HDR) and the MPLS tunnel label value (TUNNEL LABEL) from the packet 730 input from the MPLS network, and then refers to the VPN label by referring to the lookup table 740. Determine the destination NP and output port to forward from (VPN LABEL). In this case, in the case of L2 VPN, the entire packet including the L2 header is encapsulated in the MPLS packet, but in the case of the L3 VPN, only the IP packet is encapsulated in the MPLS packet. The packet 750 delivered to the packet switch module 710 includes frame header format (FHF_L3_VPN) information, and the packet 750 is delivered to an output (Egress) NP 720. The output NP 720 transfers the packet 770 including the L2 header to the external interface (IP network) with reference to the lookup table 760.

As described above, the present invention can implement the MPLS VPN packet service in the IBM NP4GS3 network processor-based packet forwarding engine by providing a packet forwarding function and a packet conversion function through header lookup from L2 and L3 packets requiring the MPLS VPN service. It has an effect.

Although the preferred embodiments of the present invention have been described in detail above, those of ordinary skill in the art to which the present invention pertains may make various changes without departing from the spirit and scope of the present invention as defined in the appended claims. It will be appreciated that modifications or variations may be made. Therefore, changes in the future embodiments of the present invention will not be able to escape the technology of the present invention.

Claims (9)

A network processor based packet processing apparatus for implementing MPLS VPN service in an E-PON based OLT system, comprising: a packet classification module for classifying a received packet upon ingress and delivering the received packet to the packet processing units; Packet processor for processing the forwarded packet, a hardware classifier for determining the type of packet by analyzing the packet transmitted from the packet switch module when the output (Egress), and processing the packet delivered from the hardware classifier and delivered to the L2 output unit In the network processor based packet processing apparatus configured to include a packet processing unit, MPLS L2 VPN packet processing means for processing packets transferred from a non-MPLS network to an MPLS network or from the MPLS network to the non-MPLS network; And MPLS L3 VPN packet processing means for processing packets transferred from the IP network to the MPLS network or from the MPLS network to the IP network; The MPLS L2 VPN packet processing means when the packet is transferred from the non-MPLS network to the MPLS network An Ingress NP that adds a frame header format (FHF_L2_VPN) to a packet input from the non-MPLS network with reference to a first lookup structure and delivers the packet to the packet switch module; A packet switch module for transferring a packet transmitted from the ingress NP to an egress NP; And MPLS VPN packet comprising; an egress NP for adding a VPN label, a tunnel label, and an L2 'header to the packet transmitted from the packet switch module with reference to a second lookup structure and forwarding the packet to the MPLS network. Processing unit. delete The method of claim 1, wherein the first lookup structure includes a VLAN ID, TB / TP, LSP, and FHF_L2_VPN, and the second lookup structure includes an LSP, a VPN label, a tunnel label, and an L2 'header. MPLS VPN packet processing unit. The method of claim 1, wherein the MPLS L2 VPN packet processing means when the packet is transferred from the MPLS network to the non-MPLS network. Ingress that removes the VPN label, tunnel label, and L2 'header of the packet input from the MPLS network with reference to a third lookup structure, and adds a new frame header format (FHF_L2_VPN') to the packet switch module. NP; A packet switch module for transferring a packet transmitted from the ingress NP to an egress NP; And And an egress NP for transmitting the packet transmitted from the packet switch module to the non-MPLS network without a separate header addition process. 5. The apparatus of claim 4, wherein the third lookup structure comprises a VPN label, TB / TP and FHF_L2_VPN '. The method of claim 1, wherein the MPLS L3 VPN packet processing means when the packet is transferred from the IP network to the MPLS network An Ingress NP that replaces an existing L2 header of a packet input from the IP network with a frame header format FHF_L3_VPN by referring to a fifth lookup structure and transmits the packet to a packet switch module; A packet switch module for transferring a packet transmitted from the ingress NP to an egress NP; And MPLS VPN packet comprising; an egress NP for adding the VPN label, the tunnel label, and the L2 'header to the packet transmitted from the packet switch module with reference to a sixth lookup structure and forwarding the packet to the MPLS network. Processing unit. 7. The sixth lookup structure of claim 6, wherein the fifth lookup structure includes a port number, a source IP, a destination IP, TB / TP, LSP and FHF_L3_VPN, and the sixth lookup structure includes an LSP, a VPN label, a tunnel label, and an L2 'header. MPLS VPN packet processing apparatus comprising a. The method of claim 1, wherein the MPLS L3 VPN packet processing means when the packet is transferred from the MPLS network to the IP network Ingress that removes the VPN label, tunnel label, and L2 'header of the packet input from the MPLS network with reference to the seventh lookup structure, and adds a new frame header format (FHF_L3_VPN') to the packet switch module. NP; A packet switch module for transferring a packet transmitted from the ingress NP to an egress NP; And MPLS VPN, comprising: an output NP which transfers the frame header format (FHF_L2_VPN ') of the packet transmitted from the packet switch module to the L2 header with reference to an eighth lookup structure to the IP network; Packet processing unit. The apparatus of claim 8, wherein the seventh lookup structure includes a VPN label, TB / TP, NEXTHOP_IP, and FHF_L3_VPN ', and the eighth lookup structure includes NEXTHOP_IP and L2 MAC.

Images