WO2005125103A1

WO2005125103A1 - A virtual private network system of hybrid site and hybrid backbone network and its realizing method

Info

Publication number: WO2005125103A1
Application number: PCT/CN2005/000869
Authority: WO
Inventors: Defeng Li
Original assignee: Huawei Technologies Co., Ltd.
Priority date: 2004-06-16
Filing date: 2005-06-16
Publication date: 2005-12-29
Also published as: CN1710877A; CN100440844C

Abstract

A Virtual Private Network system of hybrid site and hybrid backbone network and its realizing method, relating to the Virtual Private Network technology, make the sites based on different IP versions access each other and develop VPN service through the backbone network based on different IP versions. The Virtual Private Network system of hybrid site and hybrid backbone network and its realizing method, run double routing list on CE router and PE router, configure the IPv4 and IPv6 protocol stack according to the connecting condition of CE router and PE router, perform route release and distribution after VPN addressing for VPN user sites and necessary address conversion of IPv4 and IPv6, and realize data transmission by using multi-label, thereby realize VPN in the case of hybrid site and hybrid backbone network.

Description

Virtual private network system of hybrid site mixed backbone network and its implementation method

Technical field

The present invention relates to virtual private network technology, and in particular, to a virtual backbone of a hybrid site hybrid backbone network with Internet Protocol version 4 (Internet Protocol version 4) and Internet Protocol version 6 (IPv6). Private network system and its implementation method. Background of the invention

A virtual private network (Virtual Private Networking, VPN) is a virtual private network established on a public network. It has the same excellent security, reliability, and manageability as a private network. VPN replaces traditional dial-up access, using the Internet (Internet) public network or operator network resources as a continuation of the enterprise's private network, saving expensive leased line lease fees. At the same time, VPNs can use tunneling protocols, identity verification and data encryption technologies to ensure The security of communication is welcomed by enterprise users.

Enterprises can bring many benefits through the construction of VPNs. For example, by using VPNs, enterprises can save a lot of expenses for daily communication of enterprises; they can conduct remote teaching and remote monitoring to achieve unified corporate management; and they can also improve the internal business information circulation of enterprises. safety. It is foreseeable that VPN is the inevitable trend of enterprise internal network design, information management, and circulation.

At present, the applied VPN is based on the IPv4 network, that is, the backbone network and the sites constituting the VPN are in the IPv4 network. As a typical representative among them, the Request for Comments (RFC) standard 2547bis specifically describes how to implement a VPN. For details, refer to RFC 2547bis. The following briefly introduces the basic principles of implementing this program The MPLS (Layer 3, L3) VPN model is shown in Figure 1. The model includes three components: a user edge router (Custom Edge Router, CE) located at the edge of the customer premise network, and located at the edge of the backbone network. The backbone network edge router (Provider Edge Router, PE) at the layer and the backbone network router (Provider Router, P) at the core layer of the backbone network.

Among them, the CE router is an integral part of the customer premises network, and there are interfaces directly connected to the backbone network of the operator. The CE router does not sense the existence of the VPN and does not need to maintain the entire routing information of the VPN. The PE router is the operator network. The edge device is directly connected to the CE router of the user. In the MPLS network, all processing of the VPN is done on the PE router. The P router is in the carrier network and is not directly connected to the CE router. The P router has MPLS. Basic signaling capabilities and forwarding capabilities. Those skilled in the art can understand that the division of CE and PE is mainly divided from the management scope of operators and users, and CE and PE are the boundaries of the management scope of both.

CE routers and PE routers can use routing protocols such as External Border Gateway Protocol (External BGP, EBGP) or Interior Gateway Protocol (Interior Gateway Protocol, IGP) to exchange routing information, or static routes. The CE does not need to support MPLS and does not need to sense the entire network route of the VPN. The entire network route of the VPN is outsourced to the operator to complete. PE. The entire network routing information of the VPN is exchanged through the Multi-Protocol Border Gateway Protocol (MP-BGP).

As shown in Figure 1, a VPN is composed of multiple user sites (Sites). On the PE, each site corresponds to a VPN Routing / Forwarding instance (VRF). It mainly includes: Protocol (Internet Protocol, IP) routing table, label forwarding table, a series of interfaces using label forwarding table, and management information. The interface and management information include a route distinguishing identifier (Route Distinguishes RD), a route filtering policy, and a list of member interfaces. It can be seen from Figure 1 that there is no one-to-one relationship between a user site and a VPN, and a site can belong to multiple VPNs at the same time. In specific implementation, each site is associated with one Separate VRF. The site's VRF in VPN actually integrates the site's VPN membership and routing rules. The system maintains a separate set of routing tables and label forwarding tables for each VRF, and stores message forwarding information in the routing table and label forwarding tables of each VRF. This prevents data from leaking out of the VPN and prevents data from entering outside the VPN.

Routers use Border Gateway Protocol (BGP) to advertise VPN routes. BGP communication is performed at two levels. The Autonomous System (AS) uses the Internal Border Gateway Protocol (Internal BGP, IBGP), AS. EBGP is used between them. For example, a PE-PE session is an IBGP session, and a PE-CE session is an EBGP session. BGP VPN composition information and route propagation between PE routers are implemented through Multiprotocol extensions BGP (Multiprotocol extensions BGP, MBGP). MBGP is backward compatible. It can support both traditional IPv4 address family and other address families, such as VPN-IPv4 address family. The route target (Route Target) carried by MBGP ensures that the route of a specific VPN can only be known by other members of this VPN, which makes communication between BGP / MPLS VPN members possible. For details about MBGP, see RFC2283.

In the RFC2547bis standard, routing information is transmitted between the CE and the PE through the Interior Gateway Protocol (IGP) or EBGP. The PE obtains the VPN routing table and stores it in a separate VRF. PEs use IGP to ensure normal IP connectivity, and use IBGP to propagate VPN composition information and routes, and update their VRFs. Route exchange between CEs.

Among them, when using BGP to advertise VPN routes, a new address family-VPN-IPv4 address is used. A VPN-IPv4 address has 12 bytes, starting with an 8-byte RD, followed by a 4-byte IPv4 address. PE uses RD to identify routing information from different VPNs. Operators can assign RDs independently, but need to use their dedicated AS number as part of the RD to ensure the global uniqueness of each RD. VPN-IPv4 address with RD zero is the same as globally unique An IPv4 address is synonymous. After processing in this way, even if the 4-byte IPv4 address contained in the VPN-IPv4 address overlaps, the VPN-IPv4 address can still be globally unique. The route received by the PE from the CE is an IPv4 route and needs to be imported into the VRF routing table. At this time, an RD needs to be attached. In a common implementation, set the same RD for all routes from the same user site.

In the RFC2547bis standard, the Route Target attribute is used to identify the set of sites that can use a route, that is, which sites can receive the route, and which sites can receive the routes transmitted by the PE router. All PE routers connected to the site specified in the Route Target will receive routes with this attribute. After the PE router receives the route containing this attribute, it adds it to the corresponding routing table. A PE router has two sets of Route Target attributes: one set is used to attach to routes received from a site, and is called Export Route Targets; the other set is used to determine which routes can be imported into the routing table of this site, called Is Import Route Targets. Membership of the VPN can be obtained by matching the Route Target attribute carried in the route. Matching the Route Target attribute can be used to filter the routing information received by the PE router.

Figure 2 is a schematic diagram of filtering received routes by matching the Route Target attribute. When the MPLS VPN routing information enters the PE router, if the Export Route Targets set and the Import Route Targets set have the same entry, the route is received; if the Export Route Targets set does not have the same entry as the Import Route Targets set, the route is rejected.

In the RFC2547bis standard, VPN 4 text forwarding uses two layers of labeling. The first layer, that is, the outer label is exchanged inside the backbone network, represents a Label Switched Path (LSP) from PE to the peer (PEER). VPN packets can use this layer label to The LSP reaches the peer PE. When reaching the CE from the opposite PE, the second layer, that is, the inner label, is used. The inner label indicates to which site the packet arrives, or more specifically, to which CE. In this way, the interface that forwards the packet can be found based on the inner label. Special Under special circumstances, if two sites that belong to the same VPN are connected to the same PE, the problem of how to reach the other PE does not exist, but only how to reach the peer CE.

With the development of communication network technology, the traditional IPv4 network has exposed a series of shortcomings, such as insufficient address space, poor mobility, poor security, and complicated configuration. Therefore, the Internet Engineering Task Force (IETF) IPv6 was proposed to address these issues. After several years of development, IPv6 technology has gradually matured, and it has successfully solved the problems existing in IPv4, becoming the standard of the next generation Internet.

In order to continue to provide various services in the IPv4 environment during the evolution from IPv4 to IPv6, VPN solutions on IPv6 networks must be studied simultaneously. Because IPv6 itself is still in the experimental stage, there is no formal large-scale commercial use, and there is no formal VPN service application under IPv6 networks.

For how to implement a VPN when the backbone network is an IPv4 network and the VPN sites are all IPv6 networks, the 6PE technology solution can be used. The network composition diagram of this technology solution is shown in Figure 3. The basic idea of the 6PE solution implementation is: Each IPv6 site is connected to at least one dual stack of the IPv4 backbone network and supports the MP-BGP PE router, that is, the 6PE router shown in FIG. 3. The 6PE router is called a Double Stack BGP (DS-BGP) router, that is, a DS-BGP router. The DS-BGP router has at least one IPv4 address on the IPv4 side and at least one IPv6 address on the IPv6 side, and the IPv4 address must be routable in the IPv4 network. The routing in IPv6 sites follows standard IPv6 routing protocols, such as Open Shortest Path First Version 3 (OSPFv3), Information Society Initiatives in Standardization version 6, ISISv6, or The Routing Information Protocol next generation (RIPng) does not need to be advertised to the IPv4 backbone network. It only needs to be terminated by BGP4 + on the DS-BGP routers, but the IPv6 network needs to be exchanged between the DS-BGP routers through MP-BGP4. 2. layer reachability information Reachability Information (NLRI). When the egress DS-BGP router advertises routes to the ingress DS-BGP router, it uses its own address as the next hop of these routes. When the data packet is forwarded, the ingress DS-BGP router passes the IPv6 data packet. The MPLS tunnel, that is, the LSP, is transparently transmitted to the egress DS-BGP router. The DS-BGP router can use its IPv4 address when advertising its own address as the next hop of the BGP route, and use MPLS tunnels or other IPv4 address-based tunnels, such as Generic Route Encapsulation (GRE) protocol tunnels, IP security protocols. (IP Security Protocol, IPsec) tunnels; IPv6 addresses can also be used and corresponding tunnels, such as 6to4 tunnels, Intra-Site Automatic Tunnel Access Protocol (ISATAP) tunnels, and use these tunnel requirements Address form.

However, the transition from IPv4 to IPv6 is a gradual process. During the transition period, there will be both IPv4 and IPv6 networks. Both user networks and backbone networks may be IPv4 networks or IPv6 networks, or IPv4 / IPv6 mixed networks. This requires that the VPN services under the new generation network can adapt to complex network environments and can be applied to IPv4 networks, IPv6 networks, or mixed IPv4 / IPv6 networks.

The above solution is for the case where the backbone network is an IPv4 network and all VPN sites are IPv6 sites. DS-BGP used in this solution cannot support IPv4 sites. If you simply use ordinary BGP routers, you cannot achieve NLRI exchange and other functions. In addition, in the existing technical solutions, VPN route learning and publishing are performed in an IPv4 network, and cannot support router learning and publishing in a hybrid backbone network. Therefore, routing learning publishing and data forwarding of a VPN based on a hybrid backbone network are not supported. Summary of the invention

In view of this, a main object of the present invention is to provide a virtual private network system with a mixed-site hybrid backbone network. In this system, sites based on different IP versions can be The bone-thousand networks of different IP versions access each other and carry out VPN services.

Another main objective of the present invention is to provide a method for implementing a virtual private network of a mixed-site hybrid backbone network, which can enable sites based on different IP versions to access each other and develop VPN services through backbone networks based on different IP versions .

In order to achieve one aspect of the foregoing object, the present invention provides a virtual private network system of a hybrid site and hybrid backbone. The system includes a virtual private network user site, a user network edge router CE, a backbone network edge router PE, and a backbone network. The user site accesses the backbone network to transmit data to each other through the CE and the PE, and the virtual private network system includes a user site based on the internetworking protocol version 4 IPv4 and version 6 IPv6; The backbone network includes IPv4 single domain and IPv6 single domain;

The IPv4 single domain and the IPv6 single domain are connected to each other through an ASBR that supports IPv4 and IPv6 dual protocol stacks.

The CE supports an IPv4 protocol stack or an IPv6 protocol stack or an IPv4 and IPv6 dual protocol stack, which stores IPv4 routes and / or IPv6 routes;

The PE supports an IPv4 protocol stack or an IPv6 protocol stack or an IPv4 and IPv6 dual protocol stack, which stores IPv4 routes and IPv6 routes;

Data is transmitted between the user sites according to the routes stored by the CE and the PE.

Wherein, when the version of the internetworking protocol between the user site and the single domain is different, the CE and the PE connecting the user site and the single domain support the IPv4 and IPv6 dual protocol stacks.

For CEs of IPv4 user sites that need to access IPv6 user sites, store IPv4 routes and IPv6 routes; For CEs of IPv6 user sites that need to access IPv4 user sites, only IPv6 routes are stored; for CEs of IPv4 user sites that only access IPv4 user sites, only CE IPv4 routing.

In order to achieve one aspect of the foregoing objective, the present invention provides a hybrid site hybrid backbone A method for implementing a virtual private network of a network. The method uses the above-mentioned virtual private network system, and a process of implementing a virtual private network service includes the following steps:

A. Address IPv4 and IPv6 user sites to form a unified format of IPv4 and IPv6 address information;

B. The user site and the backbone network learn and advertise routes, and publish IPv4 routes and IPv6 routes to the PE in the system and the CE connected to the PE;

C. The backbone network distributes inner labels and outer labels;

D. According to the route learned by the CE and PE in step B, the data packet of the user site is encapsulated and forwarded through the backbone network by encapsulating the inner label and the outer label.

Wherein, the form of "route distinguisher + IPv4 address" is adopted between the IPv4 user sites to form an IPv4 address with an address family identifier of 1; between an IPv4 user site and an IPv6 user site. Between points, and between IPv6 user sites It takes the form of "route distinguisher + IPv6 address" to form an IPv6 address with an address family identifier of 2.

An IPv4 user site that communicates with an IPv6 user site can map the IPv4 address ABCD to an IPv6 address of the form 0 :: A: B: C: D, and then combine it with a routing identifier to form a place. IPv6 with an address family identifier of 2 address.

The method for user site and backbone network 'learning and publishing described in step B may include:

Bl, CE advertises the aggregated IPv4 user site or IPv6 user site route to the connected PE;

B2. The PE advertises IPv4 routes and IPv6 routes learned from the CE to other PEs and ASBRs in the single domain.

B3. The ASBR advertises the IPv4 routes and IPv6 routes learned from the PE to the ASBR in another single domain.

B4. The ASBR in another single domain will learn IPv4 routes from the source ASBR in the single domain. And IPv6 routes are advertised to PEs in this single domain;

B5. The PE advertises IPv4 routes and IPv6 routes learned from other PEs and IPv4 routes and IPv6 routes learned from ASBR to the CEs connected to it.

The step B2 may further include:

The PE router learns the IPv4 route and IPv6 route learned from the CE router, plus the routing identifier RD, address family identifier AFI, and subsequent address family identifier SAFI according to the VPN and routing IP version to which it belongs; forming a routing target that includes RD, AFI, and SAFL Community attributes Route Target, a unified form of routing information for IPv4 addresses / IPv6 addresses.

In the step B2, between the PE and the PE, and between the PE and the ASBR, the internal border gateway protocol based on the single domain IP version may be used to publish the route of the user site of the CE connected to the PE;

In step B3, the ASBR publishes a route to another different version of the single-domain ASBR through the IPv6-based multi-protocol external border gateway protocol;

In step B4, the ASBR publishes the learned route to the peer PE in the domain through the internal border gateway protocol based on the IP version of the single domain.

For an IPv4 user site that needs to access an IPv6 user site, the step B5 may include the following sub-steps:

B51. The CE connected to the IPv4 user site and the PE connected to the CE run an IPv6-based routing protocol to learn routes; the PE converts the saved IPv4 user site route from the ABCD / n form to 0 :: A: B: C: D / (96 + n) IPv6 route, published to the CE through IPv6 routing protocol;

B52. After receiving the IPv6 route in the form of 0 :: A: B: C: D / (96 + n), the CE restores the IPv4 route in the form of ABCD / n, and saves the route of the IPv6 user site as IPv6. routing.

For an IPv6 user site that needs to access an IPv4 user site, the step B5 may include Include the following sub-steps:

B53. The CE connected to the IPv6 user site and the PE connected to the CE run a routing protocol based on IPv6 to learn routes;

B54. The CE directly stores the route of the IPv4 user site as an IPv6 route in the form of 0 :: A: B: C: D / (96 + n), and saves the route of the IPv6 user site in the original form.

For an IPv4 user site that only accesses an IPv4 user site, in step B, only a IPv4 routing protocol can be run between a CE connected to the IPv4 user site and a PE connected to the CE, and only learn and save other IPv4 users. IPv4 routes for the site, and IPv6 routes are discarded.

In the B5, after receiving the IPv4 route or the IPv6 route, the PE may decide whether to learn and publish to the user site according to the extended target community attribute of the multi-protocol border gateway protocol.

In step C, the inner label is allocated by the ingress PE, which is used to distinguish different user sites connected by the same ingress PE, and the inner label is distributed to the corresponding egress PE along with the route when the route is advertised;

The outer label is allocated in a single domain by running a label allocation protocol, a resource reservation protocol-traffic engineering, or a label allocation protocol that constrains routing. Between different single domains, it is an external border gateway protocol.

It is allocated for forwarding data packets in the backbone network.

The step D may include the following sub-steps:

Dl. Follow the normal Internetworking protocol forwarding process to perform Internetworking protocol data forwarding from the source user site to the ingress PE;

D2. Forward label data between the ingress PE and the egress PE.

D3. The egress PE forwards the data of the Internet Protocol between the egress PE and the destination user site according to the inner label and the routing table stored by the egress PE. The step D2 may include the following sub-steps:

D21. After adding the inner label of the destination site to the data packet on the ingress PE, add the outer label assigned in the single domain where the ingress PE is located;

D22, forwarding the data packet to an ASBR in a single domain adjacent to the current single domain according to the outer label;

D23, the ASBR forwards the data packet to the next adjacent single-domain ASBR according to the outer label allocated between the ASBRs;

D24. The ASBR forwards the data packet to the egress PE.

The topology relationship between the user sites can be achieved by matching the routing target community attributes.

As can be seen from the above technical solution, the virtual private network system of the mixed-site hybrid backbone network of the present invention and the implementation method thereof differ from the prior art in that the present invention runs IPv4 / IPv6 dual routing on CE routers and PE routers. Table, configure IPv4 and IPv6 protocol stacks according to the network connection between CE routers and PE routers, perform VPN addressing and necessary IPv4 address and IPv6 address translation for VPN user sites, and then advertise and assign routes, and use multiple layers The label realizes the data forwarding, so as to realize the VPN in the case of the mixed site mixed backbone network.

Therefore, by adopting the solution for implementing a hybrid site hybrid backbone network VPN of the present invention, a VPN can be formed in the case where the user network and the backbone network transition from IPv4 to IPv6, so that the VPN solution in the network transition period has greater flexibility and reduces The complexity of small network equipment upgrades makes the transition from IPv4 to IPv6 smoother and greatly improves the economics and feasibility of network upgrades. Brief description of the drawings

Figure 1 is a schematic diagram of the system composition of MPLS L3 VPN defined by RFC2547bis; FIG. 2 is a schematic diagram of filtering received routes by matching Route Target attributes; FIG. 3 is a schematic diagram of a system composition for implementing a BGP / MPLS VPN with a 6PE solution; FIG. 4 is a schematic diagram of a hybrid site hybrid backbone network VPN system composition according to a preferred embodiment of the present invention . Mode of Carrying Out the Invention

In order to make the objectives, technical solutions, and advantages of the present invention clearer, the present invention is further described in detail below with reference to the accompanying drawings and embodiments.

The virtual private network system of the mixed-site hybrid backbone network of the present invention and an implementation method thereof run an IPv4 / IPv6 dual routing table on a CE router and a PE router, and configure IPv4 and IPv6 based on the network connection between the CE router and the PE router. A protocol stack that performs VPN addressing and necessary IPv4 and IPv6 address translation for VPN user sites, and then publishes and distributes routes, and implements data forwarding through the use of multi-layer labels. This is achieved in the case of mixed-site hybrid backbone networks. VPN.

The virtual private network system of the hybrid site hybrid backbone network of the present invention includes a backbone network and a user network. The backbone network is used to advertise VPN routes, establish switching paths, and complete data exchange. The backbone network includes autonomous systems using different address families. The autonomous systems are connected through an autonomous system border router (ASBR) at the edge of the autonomous system. A single domain can be considered as an autonomous system, that is, the backbone network can include one or more IPv4 single domains and one or more IPv6 single domains. The IPv4 single domain and IPv6 single domain support IPv4 and IPv6 dual protocols. The ASBRs of the stack are connected. In addition to ASBR, each single domain also contains the original P router and PE router. The PE router configures the IPv4 protocol stack or IPv6 protocol stack or the IPv4 and IPv6 dual protocol stacks according to the network connection.

In the present invention, the routes published by the backbone network include VPN-IPv4 routes and VPN-IPv6 routes. When the backbone network performs route learning to establish a VPN switching path, the routes of user sites connected to PE routers in the autonomous system are first advertised between PEs and ASBRs in the autonomous system, and then ASBRs publish the learned routes to each other through EBGP. The route is then advertised by the ASBR to the peer inside the autonomous system to which it belongs through the IBGP, that is, the PE router, and finally the PE router advertises the route to the CE router. The route advertisement method will be described in detail below.

The user network includes a CE router connected to the backbone network and user stations connected to it. In the present invention, the user site includes both an IPv4 site and an IPv6 site, and each user site includes multiple hosts with different addresses. The CE router supports a corresponding protocol stack according to the IP version of the user network and the IP version of the autonomous system connected to the CE router. The PE router supports the corresponding protocol stack according to the IP version of the autonomous system to which it belongs and the IP version of the user site to which it is connected. For example, a CE router and a corresponding PE router connected to an IPv4 site of an IPv4 backbone network need only support the IPv4 protocol stack, and a CE and a corresponding PE connected to an IPv6 site of the IPv6 backbone network only need to support the IPv6 protocol stack and connect to the IPv4 backbone The CEs of the IPv6 sites of the network, the CEs of the IPv4 sites connected to the IPv6 backbone network, and the PE equipment accessing these CEs need to support the IPv4 / IPv6 dual protocol stack. In addition, since IPv4 sites and IPv6 sites in the same VPN may have a mutual access relationship, routers in IPv4 sites that need to access IPv6 sites need to save IPv6 routes, that is, these IPv4 sites need to support IPv4-IPv6 mixed address schemes.

Referring to FIG. 4, FIG. 4 is a schematic diagram of a composition of a VPN system for a hybrid site hybrid backbone network according to a preferred embodiment of the present invention. The backbone network in the VPN system shown in FIG. 4 is a dual domain, which includes: a backbone network including an IPv4 single domain and an IPv6 single domain, PE routers at the edge of the backbone network: PE1 ~ PE4; P routers inside the backbone network (Not shown in Figure 1); CE routers at the edge of the user network: CE1 ~ CE8; and user sites connected to the PE through the CE; each user site contains one or more hosts with different addresses. In the backbone network, the IPv4 domain and the IPv6 domain are connected to each other through ASBR1 and ASBR2. The system shown in Figure 4 includes two VPNs, VPNA and VPNB. Among them, VPNA includes IPv4 and IPv6 sites: an IPv6 site connected by CE1, an IPv4 site connected by CE4, an IPv6 site connected by CE5, and an IPv4 site connected by CE8. VPNB contains only IPv4 sites: IPv4 sites connected by CE2, IPv4 sites connected by CE3, IPv4 sites connected by CE6, and IPv4 sites connected by CE7. In this embodiment, only VPNA and VPNB are taken as examples, and the backbone network includes only one IPv4 domain and one IPv6 domain as an example. In actual applications, the system may include many VPNs, and the backbone network may also include multiple domains.

Referring to the VPN system of the embodiment shown in FIG. 4, a method for implementing a hybrid site hybrid backbone network VPN according to the present invention will be described in detail below.

First, the user site addressing method of the VPN system of the embodiment shown in FIG. 4 will be described. In the present invention, only a case where a VPN user performs unicast communication is considered, and a host in each VPN site is required to use a unicast address, that is, only an IPv4 address or an IPv6 address is adopted.

In VPNs, the communication between IPv4 sites and IPv4 sites still uses IPv4 addresses. The Address Family Identifier (AFI) domain in MP-BGP uses the value 1 assigned to the IPv4 address family by RFC 1700; IPv4 sites The mutual communication with the IPv6 site and the mutual communication between the two IPv6 sites use IPv6 addresses. The AFI domain in MP-BGP can use the value 2 assigned to the IPv6 address family by RFC 1700. It should be noted that when the IPv4 site and the IPv6 site communicate with each other, the IPv4 address A.B.C.D in the IPv4 site is mapped to the corresponding IPv6 address in the form of 0 :: A: B: C: D. During the MP-BGP route advertisement process, in order to distinguish it from the backbone network route, the subsequent VPN address address family identifier (SAFI) domain uses 128, which represents the VPN-IPv4 address or VPN-IPv6 address.

Since there are still IPv4 sites in the VPN, considering the shortage of public IPv4 addresses, in a preferred embodiment of the present invention, IPv4 sites in the VPN are allowed to continue to use private IPv4 addresses, and allow sites of different VPNs to use the same private IPv4 address.

Specifically, in the embodiment shown in FIG. 4, since a private IPv4 address is used, in order to ensure the uniqueness of VPN routes and addresses in the backbone network, the concept of RD in RFC 2547bis is used, that is, at the IPv4 site and the IPv4 site The RD + (IPv4 address) is used to form a VPN-IPV4 address with an AFI of 1, and the IPv4 and IPv6 sites or between two IPv6 sites are formed using an RD + (IPv6 address) to form an AFI of 2. VPN-IPv6 address. It should be noted that the IPv4 address ABCD in the IPv4 site communicating with the IPv6 site is mapped into an IPv6 address of the form 0 :: A: B: C: D, and then combined with the RD to form VPN-IPv6. address.

After the address of the user site is determined, each CE router aggregates the address of each user site to form a corresponding routing entry. Then, the routing learning and distribution processing of VPN sites, the processing of label distribution, and the processing of VPN data forwarding can be performed. These processes are explained in detail below.

The processing of VPN site routing learning and publishing includes the following processes:

Process 1. CE routers distribute the aggregated routes to PE routers connected to them. In the present invention, the CEs of the IPv6 sites connected to the IPv4 backbone network, the CEs of the IPv4 sites connected to the IPv6 backbone network, and the PE devices accessing these CEs all support the IPv4 / IPv6 dual protocol stack. Therefore, the PE here can learn the IPv4 or / and IPv6 routes published by the CE.

Step 2: The PE router distributes the IPv4 routes and IPv6 routes learned from the CE router to other PE routers and ASBRs in the autonomous system.

VPN and routing IP version plus RD, AFI, SAFI and other information form a unified form of routing information including RD, AFI, SAFI, Route Target and IPv4 / IPv6 routing.

In this embodiment, the PE router still uses VRF to save routes of different VPNs. In the VRF, an IPv4 route and an IPv6 route are separately saved for different AFIs of each VPN. For PE routers to publish routes to PE routers: Since other PE routers also support dual protocol stacks, other PE routers can receive IPv4 routes and IPv6 routes.

For PE router to ASBR routing: When the autonomous system is an IPv4 network, the IPv4 based PE router and ASBR are routed through a fully-connected IPv4-based multi-protocol internal border gateway protocol (Multi-Protocol Internal BGP, MP-IBGP) or Use a route reflector to advertise the route of the VPN user site connected to the PE of the IPv4 network. When the autonomous system is an IPv6 network, the PE router in the IPv6 network and its ASBR pass through a fully-connected IPv6-based MP-IBGP or The route reflector advertises the route of the VPN site connected to the PE router of the IPv6 network.

Although the routes advertised include IPv4 routes and IPv6 routes, because when MP-IBGP is used to advertise routes, IPv4 routes and IPv6 routes are only sent as transmitted data. IPv4-based MP-IBGP or IPv6-based MP-IBGP is used only. It is related to the version of the network and has nothing to do with the specific data in it, so regardless of whether the data transmitted in it is an IPv4 route or an IPv6 route, both MP-IBGP can be transmitted.

Process 3. The ASBR advertises the learned route to the ASBR of another autonomous system. ASBRs between IPv4 and IPv6 networks publish corresponding routes to their peers through an IPv6-based Multi-Protocol External Border Gateway Protocol (Multi-Protocol External BGP, MP-IBGP). Since the ASBRs in this embodiment both support IPv4 and IPv6 dual stack protocols, no matter whether the two autonomous systems are IPv4 or IPv6, they can advertise routes to each other by running IPv6 based on MP-IBGP.

Process 4. The ASBR of another autonomous system advertises the learned route to the PE of the autonomous system. The ASBR runs the MP-IBGP protocol of the autonomous system version, and distributes the learned routes IPv4 and IPv6 to the PE of the autonomous system.

Process 5. The PE router advertises the routes learned from the ASBR and other PE routers to the CE routers connected to it. After CE router receives IPv4 route and / or IPv6 route Save.

In the present invention, the corresponding IPv4 route and IPv6 route are stored in the CE router in the IPv4 site of the VPN, and the CE router is used as a proxy (Proxy) when the VPN site accesses other sites. When routing matching is performed, according to the Rout Target Whether the destination user site included in the visit is an IPv4 user site or an IPv6 user site matches an IPv4 route or an IPv6 route, respectively. The CE router of the IPv6 user site in the VPN only saves IPv6 routes. Before the PE router connected to the IPv6 site advertises the routes of other IPv4 sites to the site, it needs to convert the IPv4 route ABCD / n to 0 :: A: B: C: D / (96 + n) IPv6 routing.

Specifically, in this embodiment, a CE router and a PE router that need to access an IPv4 user site of an IPv6 VPN user site run an IPv6-based routing protocol to learn both an IPv6 route and an IPv4 route at the same time. ABCD / n is converted into an IPv6 route of 0 :: A: B: C: D / (96 + n), which is advertised to the CE router through the IPv6 routing protocol, and restored to the IPv4 route of ABCD / n in the CE router. The IPv6 routes of other IPv6 user sites are still saved as IPv6 routes in the CE router. Match the IPv4 route when the IPv4 user site visits the IPv4 site, and match the IPv6 route when the IPv6 site is visited.

In an embodiment, an IPv6 user site that needs to access an IPv4 VPN user site. The CE router and the PE router also run IPv6-based routing protocols to learn the routes of other sites. For the routes of other IPv4 user sites, they are directly stored as 0. :: A: B: C: D / (96 + n) forms of IPv6 routes. For routes of other IPv6 user sites, the original form is saved. It should be noted that in A.B.C.D / n described above, A.B.C.D is the network segment address and n is the mask.

In addition, if the user site to which the CE is connected includes a router in addition to the host, in the fifth process, the CE also advertises the route to the router at the user site, which is stored by the router at the user site. The routing table of the user site; if the user site to which the CE connects does not include a router, then in step 5, the CE stores the routing table of the user site.

In practical applications, if some IPv4 user sites do not need to access other IPv6 user sites in the topology relationship determined by the Route Target attribute, their CE routers and PE routers need only run IPv4-based routing protocols, and only Learn and save IPv4 routes of other IPv4 user sites, and discard IPv6 routes.

In the process of route learning and publishing, after receiving the VPN route, the PE router decides whether to learn and publish it to the corresponding user site according to the MP-BGP Route Target extended community attribute. In a preferred embodiment of the present invention, when an egress PE router advertises a VPN route to its BGP peer, it carries the corresponding Export Route Target and the inner label assigned by the egress PE to the VPN site. If the BGP peer is not an ASBR, the received VPN route is matched with the Import Route Target configured on the BGP peer. If the match is successful, the route is received and published to the user site corresponding to the corresponding VRF. If BGP The peer is an ASBR between two autonomous systems, and is sent to the peer ASBR through EBGP. The peer ASBR advertises the route to the IBGP peer in the local domain, and performs route target matching on the IBGP peer to determine whether to accept it. And publish the route to the corresponding user site.

In this embodiment, the process of label distribution may be performed in a manner described below. Different VPN sites connected to the same egress PE are distinguished by the egress PE assigning different inner labels. The inner labels are advertised to the corresponding PE along with the routes when the routes are advertised through MP-BGP. For the outer label, both the IPv4 backbone network and the IPv6 backbone network run a Label Distribution Protocol (LDP) or a Resource Reservation Protocol (RSVP)-Traffic Engineering (TE) / Constrained Routing. Label Distribution Protocol (Constraint-Routing Label Distribution Protocol, CR-LDP) for label distribution, but runs between ASBRs in two autonomous domains MP-EBGP, and uses MP-EBGP to allocate the outer label of this LSP for the two-way ASBR connection. This outer label is only used for forwarding between the two ASBRs. Among them, how to assign the outer label of the LSP to the ASBR bidirectional connection through MP-EBGP can refer to RFC3107 »

In this embodiment, the data forwarding process includes the following types of forwarding: IP data forwarding between the source user site and the ingress (Ingress) PE router; label data forwarding between the Ingress PE router and the Egress PE router; and Egress PE to IP data forwarding between destination user sites. They are described separately below.

The forwarding of IP data packets from the source user site to the ingress PE router follows a normal IP forwarding process. As mentioned above, the CE router at the user site stores two types of IPv4 / IPv6 routing tables. When the source user site that needs to access the IPv4 / IPv6 destination user site performs IP data forwarding, it can be based on the destination user site being IPv4. The station or IPv6 station queries the corresponding routing table and forwards the data packet to the Ingress PE according to the corresponding routing table.

The label data forwarding between the Ingress PE router and the Egress PE router requires adding an Egress PE as the destination site's inner label to the packet on the Ingress PE, and then adding a label distribution protocol in the autonomous domain where the Ingress PE is located. LDP RSVP-TE / CR-LDP), and then forward the data packet along the LSR of the LSP to the autonomous system to the ASBR of the next neighboring autonomous system based on the outer label, and then according to the next neighboring autonomous system The outer label assigned by MP-EBGP between the ASBR of the system and the local ASBR is forwarded to the ASBR of the next neighboring autonomous system, and then the data packet is forwarded to the egress PE along the LSP in the next neighboring autonomous system.

The IP data forwarding from the egress PE to the destination user site requires that the egress PE determine the destination user site by distinguishing the inner tags after receiving the data packet containing the inner tag, and follow the corresponding rules based on the source user site and the destination user site type. The routing table is forwarded to the destination master Machine. In this step, the IPv4 routing table is queried only when the source user site and the destination user site are both IPv4 sites, and in other cases, the IPv6 routing table is queried.

In addition, it should be noted that, in order to achieve the topology relationship between VPN sites, such as full mesh networking, partial mesh control, and other topology shapes, the method in RFC 2547bis can still be used, that is, by matching This is achieved by using Route Target. This is exactly the same as the mechanism for advertising and learning routes between PEs, that is, determining whether to learn the routing table based on the topology of the VPN, and implementing the topology of the VPN according to the routing table.

Those skilled in the art can understand that for the case where the VPN backbone network includes multiple IPv4 / IPv6 autonomous systems, the principles described above can be used to implement address allocation, route learning, data packet forwarding, and VPN topology relationships, that is, MP-BGP is used to advertise VPN routes between the newly added autonomous system and the ASBR between the newly added autonomous system and the existing network, and distribute outer labels to connect the labels in the VPN backbone network. Forward.

Although the present invention has been illustrated and described with reference to certain preferred embodiments of the present invention, those skilled in the art should understand that various changes can be made in form and details, and Without departing from the spirit and scope of the invention as defined by the appended claims.

Claims

Claim

1. A virtual private network system of a mixed-site hybrid backbone network, comprising a virtual private network user site, a user network edge router CE, a backbone network edge router PE, and a backbone network, wherein the user site passes the CE and the The PE accesses the backbone network to transmit data to each other, and is characterized in that: the virtual private network system includes user sites based on the internetworking protocol version 4 IPv4 and version 6 IPv6; the backbone network includes an IPv4 single domain and an IPv6 single area;

2. The virtual private network system according to claim 1, wherein: when the version of the inter-network interconnection protocol of the user site and the single domain is different, the CE connecting the user site and the single domain And the PE supports IPv4 and IPv6 dual protocol stacks.

3. The virtual private network system according to claim 1, wherein: the CEs of the IPv4 user site that needs to access the IPv6 user site store IPv4 routes and IPv6 routes; and the CEs of the IPv6 user site that need to access the IPv4 user site only Store IPv6 routes;

CEs for IPv4 user sites that only access IPv4 user sites store only IPv4 routes.

4. A method for implementing a virtual private network of a hybrid site hybrid backbone network, characterized in that: the virtual private network system of claim 1 is adopted, and the process of implementing the virtual private network service includes the following steps: A. Addressing IPv4 and IPv6 user sites to form a unified format of IPv4 and IPv6 address information;

C. The backbone network distributes inner labels and outer labels;

D. According to the route learned by the CE and PE in step B, the data packet of the fan site is encapsulated and forwarded through the backbone network by encapsulating the inner label and the outer label.

5. The implementation method according to claim 4, characterized in that: the form of "route distinguisher + IPv4 address" is used between the IPv4 user sites to form an IPv4 address with an address family identifier of 1; an IPv4 user site The form of "route distinguisher + IPv6 address" is used between the IPv6 user site and the IPv6 user site to form an IPv6 address with an address family identifier of 2.

6. The implementation method according to claim 5, wherein: the IPv4 user site communicating with the IPv6 user site maps the IPv4 address ABCD to an IPv6 address in the form of 0 :: A: B: C: D, and then The identifiers are combined to form an IPv6 address with an address family identifier of 2.

7. The implementation method according to claim 4, wherein the method for learning and publishing the route between the user site and the backbone network in step B comprises:

8. The method according to claim 7, wherein the step B2 further comprises:

The PE router will learn the IPv4 route and IPv6 route learned from the CE router, plus the route distinguisher RD, address family identifier AFI, and subsequent address family identifier SAFI according to the VPN and routing IP version to which it belongs; form RD, AFI, SAFI, and route The target community attribute is Route Target, a unified form of routing information for IPv4 addresses / IPv6 addresses.

9. The method according to claim 7, wherein:

In step B2, between the PE and the PE, and between the PE and the ASBR, an internal border gateway protocol based on the single domain IP version is used to publish the route of the user site of the CE connected to the PE;

10. The method according to claim 7, wherein for an IPv4 user site that needs to access an IPv6 user site, the step B5 includes the following sub-steps:

11. The method according to claim 7, wherein for an IPv6 user site that needs to access an IPv4 user site, the step B5 includes the following sub-steps:

12. The implementation method according to claim 7, characterized in that: for an IPv4 user site accessing only an IPv4 user site, in the step B, the CE connected to the IPv4 user site and the PE connected to the CE It only runs IPv4 routing protocols, and only learns and saves IPv4 routes from other IPv4 user sites, and discards IPv6 routes.

13. The implementation method according to claim 7, characterized in that:

In the B5, after receiving the IPv4 route or the IPv6 route, the PE decides whether to learn and publish to the user site according to the route target extended community attribute of the multi-protocol border gateway protocol.

14. The method according to claim 4, characterized in that: in step C, the inner label is allocated by the ingress PE, and is used to distinguish different user sites connected by the same ingress PE, the The inner label is distributed to the corresponding egress PE along with the route when the route is advertised; the outer label is allocated in a single domain by running a label allocation protocol, a resource reservation protocol-traffic engineering, or a label allocation protocol that constrains routing, It is allocated between different single domains and is used to forward data packets in the backbone network.

15. The method according to claim 4, wherein: said step D comprises the following sub-steps:

Dl. Follow the common internetworking protocol forwarding process from the source user site to the ingress PE Inter-Internet Protocol data forwarding between the networks;

D2. Forward label data between the ingress PE and the egress PE.

D3. The egress PE forwards the data of the Internet Protocol between the egress PE and the destination user site according to the inner label and the routing table stored by the egress PE.

16. The method according to claim 15, wherein the step D2 comprises the following sub-steps:

D24. The ASBR forwards the data packet to the egress PE.

17. The implementation method according to claim 4, wherein: the topology relationship between the user sites is implemented by matching a routing target community attribute.