KR101319431B1 - VPN Failover System and Failover method in the VPN through Metric adjustment - Google Patents

Abstract

The VPN failover system can quickly overcome the failure with another VPN gateway device by changing the metric value of the RIP packet when one VPN gateway device becomes out of service in a VPN redundancy environment where the RIP uses the RIP.

Description

VPN Failover System and Failover method in the VPN through Metric adjustment}

The present invention relates to a VPN failover system and a failover method in a VPN, and more particularly, to a VPN failover system and a failover method in a VPN, which can reduce the failover time.

Dynamic Routing Protocol is widely used to get internal network traffic in a virtual private network (VPN) or firewall redundancy. Among them, Routing Information Protocol (RIP) is widely used because it is the simplest to use and standard protocol.

In a VPN or firewall duplication environment using such RIP, when a packet is delivered to a router, the router forwards the RIP packet to a VPN device determined according to its routing table, and the VPN device is out of service. In this case, there is a problem that the packet is not processed and is dropped. As time passes, the RIP packet is not received from the VPN service that is out of service, so the routing information disappears, and the route is re-routed to the higher priority, so that the service becomes available, but the time until the service becomes available is long. All transmitted packets are dropped and service disconnection occurs. The service disconnection time is a problem because the router's RIP timer setting defaults to 180 seconds and 240 seconds.

The technical problem to be achieved by the present invention is to overcome the obstacles to other VPN devices in a short time by manipulating the routing path processing rank value of the RIP packet when one VPN device becomes out of service in a VPN duplex environment using the RIP. The present invention provides a VPN failover system and a failover method in a VPN.

The VPN failover system includes a routing table. The VPN failover system determines a route for a packet transmitted from an internal network based on the routing table, and sets a metric value of each network band for a plurality of network bands. A first and a second VPN gateway device which transmits a routing information protocol (RIP) packet to the router, but transmits a RIP packet having the metric value set to a smaller value as the network bandwidth is preferentially processed; And when the first VPN gateway device is abnormal, the second VPN gateway device sets all of the metric values of the plurality of network bands by the first VPN gateway device to process all of the plurality of network bands. The RIP packet set to a value smaller than the metric value is sent to the router. .

The failover method in a VPN including a router and a plurality of VPN gateway devices includes a routing information protocol in which the first and second VPN gateway devices set metric values of each network band for a plurality of network bands. ) Transmitting the packet to the router, but prioritizing the network bandwidth, transmitting the RIP packet having the metric value set to a smaller value to the router, and the router sends the packet from the first and second VPN gateway devices. Whenever the RIP packet is received, the metric value for the plurality of network bands in the RIP packet is checked, and the IP address of the VPN gateway device which has transmitted the smallest metric value for each network band is updated in the routing table. And the second VPN gate if the first VPN gateway device is abnormal. The device sends a RIP packet to the router which sets all of the metric values of the plurality of network bands to a value smaller than the metric value set by the first VPN gateway device to process all of the plurality of network bands. .

According to the present invention, when one VPN gateway device becomes out of service, a failure can be quickly overcome by using another serviceable VPN gateway device.

In particular, companies such as banks and securities firms, which are sensitive to service breakdowns, have problems with breakdown time due to loss of service and loss of customer trust due to service breakdown. Therefore, according to the present invention, the failover time can be greatly shortened and the above situation can be avoided. In addition, the system can be easily implemented by changing only the RIP operation method of the VPN gateway device without changing the settings of other routers or other network equipment.

1 and 2 are conceptual diagrams and block diagrams illustrating packet transmission and reception between an internal network and a remote network in a VPN failover system to which the present invention is applied.
3 is a block diagram illustrating the VPN gateway device of FIG. 2 in more detail.
4 is a conceptual diagram illustrating packet transmission of the VPN failover system of FIG. 1 in a normal serviceable state.
FIG. 5 is a conceptual diagram illustrating a first packet transmission of a second VPN gateway device after a first VPN gateway device becomes out of service in the VPN failover system of FIG. 1.
FIG. 6 is a flowchart illustrating a method for overcoming a failure when a first VPN gateway device becomes in an out of service state in the VPN failover system of FIG. 1.
FIG. 7 is a conceptual diagram illustrating packet transmission after the second VPN gateway device completes the first packet transmission in FIG. 5.

DETAILED DESCRIPTION Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art may easily implement the present invention. The present invention may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. In the drawings, parts irrelevant to the description are omitted in order to clearly describe the present invention, and like reference numerals designate like parts throughout the specification.

Throughout the specification, when a part is referred to as being "connected" to another part, it includes not only "directly connected" but also "electrically connected" with another part in between .

Throughout the specification, when a part is said to "include" a certain component, it means that it can further include other components, without excluding other components unless specifically stated otherwise. Also, the terms " part, "" module," and " module ", etc. in the specification mean a unit for processing at least one function or operation and may be implemented by hardware or software or a combination of hardware and software have.

1 and 2 are conceptual diagrams and block diagrams illustrating packet transmission and reception between an internal network and a remote network in a VPN failover system to which the present invention is applied.

Referring to FIG. 1, a VPN failover system 100 according to an embodiment of the present invention controls packet transmission between a remote network and an internal network 150. Internal network 150 is connected to a remote network via the Internet 110.

Packets sent from hosts 151 of internal network 150 are directed to hosts 251 in first remote network 250 or hosts 261 in second remote network 260 via the Internet 110. Delivered. Specifically, packets transmitted from hosts of the internal network 150 are delivered to the first remote network 250 or the second remote network 260 via the VPN failover system 100 and the Internet 110. A packet transmitted to the hosts 251 of the first remote network 250 is delivered through the first external VPN gateway device 210 and the first external switching unit 230, and the host of the second remote network 260. The packet transmitted to the fields 261 is transmitted through the second external VPN gateway device 220 and the second external switching unit 240. In the same way, packets transmitted from the hosts 251 of the first remote network 250 are transmitted to the first external switching unit 230, the first external VPN gateway device 210, the Internet 110, and the VPN failure. A packet transmitted from the hosts 261 of the internal network 150 to the hosts 151 of the internal network 150 through the coping system 100 is transmitted to the second external switching unit 240. The second external VPN gateway device 220, the Internet 110, and the VPN failover system 100 are sequentially transmitted to the hosts 151 of the internal network 150.

In the VPN failover system according to the embodiment of the present invention, when one of the first or second VPN gateway devices 120 and 130 becomes out of service (hereinafter, the first VPN gateway device becomes out of service). As an example, the same applies to the case where the second VPN gateway device becomes out of service, of course). The RIP packet is transmitted to the router 140 in which all the metric values of the network band are set to a value smaller than the metric value set by the VPN gateway device which has become out of service. In general, the first and second VPN gateway devices 120 and 130 may handle multiple network bands, but for convenience of description, the first and second VPN gateway devices 120 and 130 may use the first and second VPN gateway devices 120 and 130. The processing of the network band will be described as an example.

Referring to FIG. 2, the VPN failover system 100 includes a first VPN gateway device 120, a second VPN gateway device 130, and a router 140. The apparatus may further include a first switching unit 160 and a second switching unit 170.

The first VPN gateway device 120 and the second VPN gateway device 130 are configured to process a plurality of network bands, and set metric values of each network band to give priority to the order of processing the plurality of network bands. One Routing Information Protocol (RIP) packet is transmitted to the router 140. At this time, the RIP packet having the metric value set to a smaller value is transmitted to the router. For example, when the first VPN gateway device 120 and the second VPN gateway device 130 process the first to third network bands, the first and third network bands are the first VPN gateway device 120. ) Process the second network band first, and the second VPN gateway device 130 preferentially processes the first VPN gateway device 120 by setting the metric values of the first to third network bands to '2'. ',' 3 ',' 2 ', and the second VPN gateway device 130 may set the metric values of the first to third network bands to' 3 ',' 2 ', and' 3 ', respectively. .

When the first VPN gateway device 120 is abnormal (eg, out of service), the second VPN gateway device 130 removes all of the metric values of the plurality of network bands to process all of the plurality of network bands. 1 The RIP packet set to a value smaller than the metric value set by the VPN gateway device 120 is transmitted to the router 140. For example, the first VPN gateway device 120 sets the metric values of the first to third network bands to '2', '3', and '2', respectively, and the second VPN gateway device 130 makes a second value. When the metric values of the first to third network bands are set to '3', '2', and '3', respectively, when the first VPN gateway device 120 becomes abnormal, the second VPN gateway device 130 makes a second decision. In order to process all of the first to third network bands, the router sets the RIP packet having all of the metric values of the first to third network bands set to '1' smaller than the metric value set by the first VPN gateway device 120. And transmit to 140.

In one embodiment, the first VPN gateway device 120 is configured to prioritize the first network band and standby the second network band by metric values of the first network band. The RIP packet set to a value smaller than the value may be transmitted to the router 140. When the first VPN gateway device 120 is in a normal state (eg, in a serviceable state), the second VPN gateway device 130 may first process the second network band and process the first network band in the standby mode. 2, the RIP packet having the metric value of the network band set to a value smaller than the metric value of the first network band is transmitted to the router 140, and the first and second VPN gateway devices 120 are abnormal. In order to preferentially process all of the network bands, a router (RIP packet) in which both the metric value of the first network band and the metric value of the second network are set to a value smaller than the metric value set by the first VPN gateway device 120 is used. 140).

Since the first VPN gateway device 120 and the second VPN gateway device 130 may transmit a packet (Hello_Packet) indicating their status information to the counterpart device, the second VPN gateway device 130 may use the first VPN gateway device. It can be seen that 120 has become out of service.

The router 140 includes a routing table and routes packets transmitted and received between the hosts 151 in the internal network 150 and the hosts 251 and 261 in the remote networks 250 and 260 based on the routing table. Decide The router 140 may generate a plurality of network bands (eg, first and first) in the RIP packet Packet_1 and Packet_2 whenever a RIP packet is received from the first VPN gateway device 120 and the second VPN gateway device 130. 2) Check the metric value for network band) and update the IP address of the VPN gateway device that sent the smallest metric value for each network band in the routing table. In particular, when the router 140 checks the metric values for the plurality of network bands in the RIP packet and the first and second VPN gateway devices 120 and 130 transmit the same metric values for each network band, The IP address of the VPN gateway device determined by the configured rule is updated in the routing table. In this case, the preset rule may be, for example, when the IP address of the VPN gateway device is large or when the RIP packet is first received. In addition, the router 140 transmits the packet FW_Packet_1, to the first VPN gateway device 120 or the second VPN gateway device 130 based on the network band information included in the packet Ho_Packet transmitted from the internal network 150. Pass FW_Packet_2).

The first switching unit 160 switches the packet transmission between the first and second VPN gateway devices 120 and 130 and the router 140.

The second switching unit 170 switches the packet transmission between the router 140 and the hosts 151 in the internal network 150.

3 is a block diagram illustrating the VPN gateway device of FIG. 2 in more detail. In FIG. 3, the first VPN gateway device 120 will be described as an example.

2 and 3, the first VPN gateway device 120 includes a metric value setting unit 122, a packet transmitter 124, and a VPN encryption / decryption unit 126.

The metric value setting unit 122 sets the metric value differently according to the network band. First, the metric value of the first network band to be processed is set to a value smaller than the metric value of the second network band to be processed in the standby mode.

The packet transmitter 124 generates a RIP packet Packet_1 including the metric value information Prior_Info set by the metric value setting unit 122 and transmits the RIP packet Packet_1 to the router 140. In addition, when the packet Ho_Packet transmitted from the hosts 151 in the internal network 150 is transferred from the router 140, the forwarded packet FW_Packet_1 is transmitted to the Internet 110. In addition, the packet transmitter 124 may transmit a status information packet Hello_Packet indicating the state of the first VPN gateway device 120 when the first VPN gateway device 120 becomes out of service. ) Can be sent.

The VPN encryption / decryptor 126 encrypts the packet FW_Packet_1 transmitted from the router 140 to the packet transmitter 124 based on the VPN security policy SA, and then encrypts the encrypted packet ENC_Packet_1 to the Internet 110. To send. In addition, the VPN encryption / decryption unit 126 decrypts the packet Packet_1 transmitted from the Internet 110 and transmits the decrypted packet DEC_Packet_1 to the packet transmission unit 124.

Although not shown in FIG. 3, the second VPN gateway device 130 also includes a metric value setting unit, a packet transmission unit, and a VPN encryption / decryption unit.

The metric value setting unit in the second VPN gateway device 130, in contrast to the first VPN gateway device 120, preferentially sets the metric value of the second network band to be processed more than the metric value of the first network band to be processed in the standby mode. Set it to a small value.

The packet transmitter in the second VPN gateway device 130 generates and transmits the RIP packet Packet_2 including the metric value information set by the metric value setting unit to the router 140. In addition, when the packet Ho_Packet transmitted from the hosts 151 in the internal network 150 is transmitted from the router 140, the forwarded packet FW_Packet_2 is transmitted to the Internet.

The metric value setting unit in the second VPN gateway device 130 sends a status information packet (Hello_Packet) when the status information packet Hello_Packet is transmitted from the first VPN gateway device 120 when the first VPN gateway device 120 becomes out of service. Hello_Packet) sets both the metric value of the first network band and the metric value of the second network band to a value smaller than the metric value set by the first VPN gateway device 120.

Hereinafter, a packet transmission process of the VPN failover system having the above configuration will be described.

4 is a conceptual diagram illustrating packet transmission of the VPN failover system of FIG. 1 in a normal serviceable state. FIG. 5 is a conceptual diagram illustrating a first packet transmission of a second VPN gateway device after a first VPN gateway device becomes out of service in the VPN failover system of FIG. 1. FIG. 6 is a flowchart illustrating a method for overcoming a failure when a first VPN gateway device becomes in an out of service state in the VPN failover system of FIG. 1.

The VPN failover system of the present invention uses RIP, and the RIP operation is performed between the VPN gateway device and the internal routers. Routing using RIP is characterized by maintaining only the path having the smallest metric value for a particular path. In the present invention, when the first VPN gateway device becomes out of service by using the characteristics of the router, a failure can be quickly overcome by using a second VPN gateway device that can be serviced.

4 to 6, in the normal service state, the first VPN gateway device 120 and the second VPN gateway device 130 preferentially process the 10.10.10.0/24 band and the 20.20.20.0/24 band, respectively. The metric value is set so that the relative band is processed in the standby mode. That is, a metric value (eg, '2') is set for the network band to be processed preferentially, and a larger metric value (eg, '3') is set for the network band to be processed in the standby mode. Routing information including the metric value is included in the RIP packet and transmitted to the router 140 (steps 610 and 640).

4 to 6, the first VPN gateway device 120 and the second VPN gateway device 130 preferentially process the 10.10.10.0/24 band and the 20.20.20.0/24 band, respectively. For example, the metric value is set to process the relative band in the standby mode, but the priority setting method is not limited thereto. In other words, the present invention applies to various priority schemes. For example, 1) The first VPN gateway device 120 may preferentially process both the 10.10.10.0/24 band and the 20.20.20.0/24 band. In this case, the first VPN gateway device 120 has a metric value set to '2' for both the 10.10.10.0/24 band and the 20.20.20.0/24 band, and the second VPN gateway device 130 has a 10.10.10.0/ The metric value can be set to '3' for both 24 bands and 20.20.20.0/24 bands. 2) The second VPN gateway device 130 may preferentially process both the 10.10.10.0/24 band and the 20.20.20.0/24 band. In this case, the first VPN gateway device 120 has a metric value set to '3' for both the 10.10.10.0/24 band and the 20.20.20.0/24 band, and the second VPN gateway device 130 has a 10.10.10.0/ The metric value can be set to '2' for both 24 bands and 20.20.20.0/24 bands. 3) The first VPN gateway device 120 and the second VPN gateway device 130 may process a specific band with the same priority. In this case, the first VPN gateway device 120 and the second VPN gateway device 130 have the metric value set to '2' for both the 10.10.10.0/24 band and the 20.20.20.0/24 band, or '3'. Can be set.

Each time the RIP packet is received from the first VPN gateway device 120 and the second VPN gateway device 130, the router 140 checks the metric value for the network band in the RIP packet and stores it in the routing table. That is, the IP address of the VPN gateway device that has transmitted the smallest metric value for each network band is stored in the routing table (step 650). In FIG. 4, the IP address 1.1.1.1 of the first VPN gateway device 120 whose metric value is set to '2' for the 10.10.10.0/24 band is stored, and the metric value is '2' for the 20.20.20.0/24 band. The IP address 1.1.1.2 of the second VPN gateway device 130 set as is stored in the routing table. Meanwhile, when the router 140 checks the metric values for the plurality of network bands in the RIP packet, when the first and second VPN gateway devices 120 and 130 transmit the same metric value for each network band, The IP address of the VPN gateway device determined by the configured rule is updated in the routing table. In this case, the preset rule may be, for example, when the IP address of the VPN gateway device is large or when the RIP packet is first received.

When hosts belonging to the internal network transmit a packet for communication, the packet is transmitted to the router 140 through a second switching unit (not shown), and the router 140 is connected to the network band information included in the transmitted packet. Forward the packet to the first or second VPN gateway device 120, 130 having the IP address stored in the routing table (step 660). In detail, the packet is transmitted to the VPN gateway device set to a low metric value according to the path stored in the routing table of the router 140. Therefore, in a situation where a service is normally provided, packets going to the 10.10.10.0/24 band are transmitted to the first VPN gateway device 120, and packets going to the 20.20.20.0/24 band are transmitted to the second VPN gateway device 130. do.

On the other hand, as a result of checking the service state of the first VPN gateway device 120 (step 620), when the first VPN gateway device 120 is out of service state, the second VPN gateway device 130 is a metric of all network bands The RIP packet having the value set to a value smaller than the metric value set by the first VPN gateway device 120 is transmitted to the router 140 (step 630). That is, when the first VPN gateway device 120 becomes out of service, the second VPN gateway device 130 transmits the RIP packet to which the metric value for all network bands is set to '1' to the router 140. . When the first VPN gateway device 120 becomes out of service, the second VPN gateway device 130 transmits the RIP packet having the metric value for all network bands to '1' to the router 140 once. After that, step 640 may be further performed, which will be described in detail with reference to FIG. 7.

Whether the first VPN gateway device 120 is out of service is determined from the state information packet transmitted from the first VPN gateway device 120 before transmitting the RIP packet from the second VPN gateway device 130 to the router 140. You can check it.

The router 140 updates a routing table with a new route because a route having a metric value lower than that stored in the metric value for the same network band is input (step 650). That is, before updating, the IP address 1.1.1.1 of the first VPN gateway device 120 having the metric value of '2' for the 10.10.10.0/24 band is stored, and the metric value '2' for the 20.20.20.0/24 band. Although the IP address 1.1.1.2 of the second VPN gateway device 130 is stored, when the RIP packet is transmitted to the router with the metric value for all network bands as '1' in the second VPN gateway device 130, the routing is performed. The table is updated with the IP address 1.1.1.2 of the second VPN gateway device 130 for both the 10.10.10.0/24 band and the 20.20.20.0/24 band.

If the packet is transmitted from hosts belonging to the internal network, the router 140 forwards the packet to a new path, that is, the second serviceable VPN gateway device 130 (step 660). Therefore, when one VPN gateway device becomes out of service, a failure can be quickly overcome by using another serviceable VPN gateway device.

FIG. 7 is a conceptual diagram illustrating packet transmission after the second VPN gateway device completes the first packet transmission in FIG. 5.

Referring to FIG. 7, when the first VPN gateway device 120 becomes out of service, the second VPN gateway device 130 has metrics for all network bands (10.10.10.0/24, 20.20.20.0/24). After the RIP packet having the value set to '1' is transmitted to the router 140 once, the second VPN gateway device 130 sets the metric value '3' for the 10.10.10.0/24 band and then 20.20. The RIP packet having the metric value '2' set for the 20.0 / 24 band is transmitted to the router 140.

As described above, when the first VPN gateway device 120 is out of service, the second VPN gateway device 130 is set to the metric value for all network bands (10.10.10.0/24, 20.20.20.0/24). If the RIP packet is set to '1' once to the router 140, the routing table includes the second VPN gateway device 120 for all network bands (10.10.10.0/24 and 20.20.20.0/24). The route is set to an IP address. Thereafter, the second VPN gateway device 130 sets the metric value '3' for the 10.10.10.0/24 band and sets the metric value '2' for the 20.20.20.0/24 band. , The metric values change to '3' and '2' for the 10.10.10.0/24 band and the 20.20.20.0/24 band, respectively, but because the first VPN gateway device 120 is out of service, the RIP packet Since only the second VPN gateway device 130 is transmitted, the IP address of the routing table of the router 140 is not changed and only the metric value is updated to '3' and '2', respectively.

As such, when the first VPN gateway device 120 becomes out of service, the second VPN gateway device 130 sets the metric value for all network bands (10.10.10.0/24, 20.20.20.0/24) to '1. After the RIP packet set to '1' is transmitted to the router 140 once, the second VPN gateway device 130 sets the metric value '3' for the 10.10.10.0/24 band and then sets the metric value to '20 .20.20.0 / 24 'band. The reason for transmitting the RIP packet having the metric value '2' set to the router 140 is that the second VPN gateway device 130 continuously receives the RIP packet having the metric value set to '1' for all network bands. When the first VPN gateway device 120 is restored to the serviceable state, the second VPN gateway device 130 transmits a RIP packet having a smaller metric value to the router 140. Packet forwarded from the network continues to be the second VPN gateway device Because only 130 is delivered.

On the other hand, when the first VPN gateway device 120, which was in the out of service state, becomes available again, the first VPN gateway device 120 transmits the RIP packet in which the first metric value is set for each network band. ), So that the first and second VPN gateway devices 120 and 130 can provide the service again after a predetermined time.

As described above, according to the VPN failover system of the present invention, when one VPN gateway device becomes out of service, the failure can be quickly overcome by using another serviceable VPN gateway device. These systems can also be implemented simply by changing the RIP behavior of the VPN gateway device without having to change the configuration of other routers or other network equipment.

The embodiments of the present invention described above are not only implemented by the apparatus and method but may be implemented through a program for realizing the function corresponding to the configuration of the embodiment of the present invention or a recording medium on which the program is recorded, The embodiments can be easily implemented by those skilled in the art from the description of the embodiments described above.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments, It belongs to the scope of right.

100: VPN failover system
110: Internet
120: first VPN gateway device
122: metric value setting unit
124: packet transmission unit
126: VPN encryption and decryption unit
130: second VPN gateway device
140: router
150: internal network 151, 251, 261: host
160: first switching unit 170: second switching unit
210: first external VPN gateway device
220: second external VPN gateway device
230: first external switching unit 240: second external switching unit
250: first remote network 260: second remote network

Claims (15)

A router having a routing table for determining a route of a packet transmitted from an internal network based on the routing table;
RIP (Routing Information Protocol) packet, which sets the metric value of each network band for a plurality of network bands, is transmitted to the router. First and second VPN gateway device for transmitting to the router,
In the case where the first VPN gateway device is abnormal, the second VPN gateway device sets all of the metric values of the plurality of network bands to be processed by all of the plurality of network bands. Send a RIP packet set to a value smaller than the value to the router,
The second VPN gateway device does not transmit error information other than the RIP packet,
The router does not determine whether an error occurs, and operates according to the received RIP packet VPN failover system. The method of claim 1, wherein the router
Each time the RIP packet is received from the first and second VPN gateway devices, the VPN gateway device checks the metric value for the plurality of network bands in the RIP packet and transmits the smallest metric value for each network band. VPN failover system for updating the IP address of the routing table. The method of claim 2, wherein the router
When the first and second VPN gateway devices transmit the same metric value for each of the network bands as a result of checking the metric values for the plurality of network bands in the RIP packet, the VPN gateway device determined by a preset rule. VPN failover system to update the IP address of the routing table. The method of claim 1,
If the first VPN gateway device is abnormal
And the first VPN gateway device transmits a status information packet to the second VPN gateway device. 5. The method of claim 4, wherein the first VPN gateway device prioritizes the first network band and standbys the second network band with the metric value of the first network band. Send the RIP packet set to a value smaller than the metric value to the router,
When the first VPN gateway device is normal, the second VPN gateway device preferentially processes the second network band, and applies the metric value of the second network band to process the first network band in the standby mode. The RIP packet set to a value smaller than the metric value of one network band is transmitted to the router, and when the first VPN gateway device is abnormal, the first and second network bands are preferentially processed to process both the first and second network bands. And a VPN failover system for transmitting a RIP packet in which all metric values of a second network band are set to a value smaller than a metric value set by the first VPN gateway device. The method of claim 5, wherein the first VPN gateway device
A metric value setting unit for setting metric values of the first and second network bands but setting metric values of the first network band to be smaller than metric values of the second network band;
A packet transmitter for generating a RIP packet having a set metric and transmitting the same to a router;
And the packet transmitter transmits the state information packet to the second VPN gateway device when the first VPN gateway device is abnormal. The method of claim 5, wherein the second VPN gateway device
A metric value setting unit for setting metric values of the first and second network bands but setting metric values of the second network band to be smaller than metric values of the first network band;
A packet transmitter for generating a RIP packet having a set metric and transmitting the same to a router;
The metric value setting unit, when the first VPN gateway device is abnormal, a value smaller than both of the metric values set by the first VPN gateway device based on the status information packet. VPN failover system to set up. The method of claim 5, wherein the first VPN gateway device transmits a RIP packet having the metric value of the first network band set to '2' and the metric value of the second network band set to '3'. and,
The second VPN gateway device, when the first VPN gateway device is normal, sets the RIP packet having the metric value of the second network band set to '2' and the metric value of the first network band set to '3'. And transmitting to the router a RIP packet having both the metric values of the first and second network bands set to '1' when the first VPN gateway device is abnormal. The VPN failover of claim 1, wherein the second VPN gateway device transmits one RIP packet to the router to process all of the plurality of network bands when the first VPN gateway device is abnormal. system. The apparatus of claim 9, wherein the second VPN gateway device transmits a RIP packet to the router to process all of the plurality of network bands once when the first VPN gateway device is abnormal. A VPN failover system for transmitting a RIP packet having a metric value of a plurality of network bands as an initial metric value to the router. A failover method in a VPN including a router and a plurality of VPN gateway devices,
The first and second VPN gateway devices transmit a routing information protocol (RIP) packet in which a metric value of each network band is set for a plurality of network bands to the router, and the metric value is preferentially processed. Transmitting a RIP packet having a smaller value to the router;
Each time the RIP packet is received from the first and second VPN gateway devices, the router checks the metric value for the plurality of network bands in the RIP packet and transmits the smallest metric value for each network band. Updating the IP address of the VPN gateway device in the routing table;
In the case where the first VPN gateway device is abnormal, the second VPN gateway device sets all of the metric values of the plurality of network bands to process all of the plurality of network bands. Send a RIP packet set to a smaller value to the router,
The second VPN gateway device does not transmit error information other than the RIP packet,
The router does not determine whether an error occurs, and the failover method in a VPN that operates according to the received RIP packet. 12. The method of claim 11, wherein when the router checks the metric value for the plurality of network bands in the RIP packet, the first and second VPN gateway devices transmit the same metric value for each network band. A failover method in a VPN that updates an IP address of a VPN gateway device determined by a preset rule to the routing table. 12. The method of claim 11, wherein before transmitting the RIP packet from the second VPN gateway device to the router, checking the state of the first VPN gateway device based on the state information packet transmitted from the first VPN gateway device. Failover method in the VPN further comprising. 12. The method of claim 11, wherein the first VPN gateway device prioritizes the first network band and standbys the second network band with the metric value of the first network band of the second network band. Send the RIP packet set to a value smaller than the metric value to the router,
When the first VPN gateway device is normal, the second VPN gateway device preferentially processes the second network band, and applies the metric value of the second network band to process the first network band in the standby mode. The RIP packet set to a value smaller than the metric value of one network band is transmitted to the router, and when the first VPN gateway device is abnormal, the first and second network bands are preferentially processed to process both the first and second network bands. And transmitting a RIP packet to the router in which all of the metric values of the second network band are set to a value smaller than the metric value set by the first VPN gateway device. The method of claim 11, wherein the second VPN gateway device transmits a RIP packet to the router when the first VPN gateway device is abnormal.
Transmitting, once to the router, a RIP packet having all of the metric values of the plurality of network bands set to a value smaller than the metric value set by the first VPN gateway device to process all of the plurality of network bands. Wow,
After transmitting the RIP packet once, transmitting a RIP packet having the metric value of the plurality of network bands as an initial metric value to the router.

Images