WO2006002598A1

WO2006002598A1 - A vpn system of a hybrid-site hybrid backbone network and an implementing method thereof

Info

Publication number: WO2006002598A1
Application number: PCT/CN2005/000959
Authority: WO
Inventors: Defeng Li
Original assignee: Huawei Technologies Co., Ltd.
Priority date: 2004-06-30
Filing date: 2005-06-30
Publication date: 2006-01-12
Also published as: CN100364292C; CN1716901A

Abstract

A VPN system of a hybrid-site hybrid backbone network and an implementing method thereof about VPN technology, which enables the sites based on different IP versions to access each other and to develop VPN service via the backbone network based on different IP versions. It can solve the develop problem of VPN service of hybrid network during the transition period. The VPN system of a hybrid-site hybrid backbone network and the implementing method thereof divide the autonomous domain of the multi-domain backbone network into the primary and the dependent, issue the route using the corresponding MP-IBGP according to the IP version of the own autonomous domain in the autonomous domains, and issue the route using Multi-hop MP-EBGP between the adjacent autonomous domains. Synchronously, they perform IPv4/IPv6 double routing list on CE and PE, and perform the tunnel forwarding of the VPN data according to their IP version distribution label in the autonomous domains. So it can implement VPN of the hybrid-site multi-domain backbone network.

Description

Virtual private network system of hybrid site hybrid backbone network and implementation method thereof

Technical field

The present invention relates to a virtual private network technology, and in particular, to a virtual network hybrid network of the Internet Protocol version 4 (IPv4) and the Internet Protocol version 6, IPv6 hybrid network. Private network system and its implementation method. Background of the invention

Virtual Private Networking (VPN) is a virtual private network built on the public network. It has the same excellent security, reliability and manageability as a private network. VPN replaces traditional dial-up access, using the Internet (Internet) public network or carrier network resources as a continuation of the enterprise-specific network, saving expensive leased line charges, while VPN can be guaranteed by tunneling protocols, authentication and data encryption technologies. The security of communication is welcomed by business users.

Through the construction of VPN, enterprises can bring many benefits. For example, by using VPN, enterprises can save a lot of daily communication costs of enterprises; can conduct distance education and remote monitoring to achieve unified management of enterprises; safety. It can be foreseen that VPN is an inevitable trend of enterprise internal network design, information management and circulation.

Currently, the applied VPNs are based on IPv4 networks, that is, the backbone networks and sites that make up the VPN are all in the IPv4 network. As a typical representative, the Request for Comments (RFC) standard 2547bis describes how to implement VPN. For details, refer to RFC 2547bis. It is a provider-provided VPN (Provider Provide VPN, PP VPN). The VPN device is located on the network side. The carrier provides VPN services for users. The user equipment does not need to be aware of VPN. It is only connected to the PE provided by the operator. Ready. The following is a brief introduction to the basic principles of implementing this solution.

The model of Multi-Protocol Label Switching (MPLS) Layer 3 (L3) VPN defined by RFC2547bis is shown in Figure 1. The model consists of three components: The edge of the user network at the edge of the customer premises network A Custom Edge Router (CE), a Provider Edge Router (PE) at the edge layer of the backbone network, and a Provider Router (P) at the core layer of the backbone network.

The CE router is an integral part of the customer premises network. The interface is directly connected to the carrier's backbone network. The CE router does not know the existence of the VPN and does not need to maintain the entire routing information of the VPN. The PE router is the carrier. The edge device of the network is directly connected to the CE router of the user. In the MPLS network, all processing of the VPN is performed on the PE router; the P router is in the carrier network and is not directly connected to the CE router, and the P. router has MPLS. Basic signaling capabilities and forwarding capabilities. Those skilled in the art can understand that the division of CE and PE is mainly divided by the management scope of operators and users, and CE and PE are the boundaries of the management scope of both.

An external border gateway protocol can be used between the CE router and the PE router (External

BGP, EBGP) or the Interior Gateway Protocol (IGP) routing protocol exchanges routing information. Static routes can also be used. The CE does not need to support MPLS. It does not need to perceive the entire network route of the VPN. The entire network route of the VPN is outsourced to the operator. The PE exchanges the entire network routing information of the VPN through the Multi-Protocol Border Gateway Protocol (MP-BGP).

As shown in Figure 1, the VPN is composed of multiple user sites (Site). On the PE, each site corresponds to a VPN routing/forwarding instance (VRF), which mainly includes: Protocol (Internet Protocol, IP) routing table, labeling of the forwarding table, a series of interfaces using the label forwarding table, and management information. The interface and management information includes a route distinguisher (RD), a route filtering policy, and Member interface list, etc. As can be seen from Figure 1, there is no one-to-one relationship between the user site and the VPN, and one site can belong to multiple VPNs at the same time. In the specific implementation, each site is associated with a separate VRF. The VRJF of the Site in the VPN actually integrates the VPN membership and routing rules of the site. The system maintains a separate routing table and label forwarding table for each VRF, and stores packet forwarding information in each VRF routing table and label forwarding table. This prevents data from leaking out of the VPN and prevents data from entering outside the VPN.

The routers use the Border Gateway Protocol (BGP) to advertise VPN routes. BGP communication is performed at two levels. The internal autonomous system (AS) uses the internal border gateway protocol (IBGP), AS. EBGP is used between. For example, a PE-PE session is an IBGP session, and IGP or BGP can be used between the PE and the CE. The VPN composition information and route propagation between BGP routers are implemented by BGP (Multiprotocol extensions BGP, MP-BGP). MP-BGP is backward compatible. It can support both traditional IPv4 address families and other address families, such as VPN-IPv4 address families. The route target carried by MP-BGP ensures that the route of a specific VPN can only be known by other members of the VPN, making communication between BGP MPLS VPN members possible. For details about MP-BGP, see RFC2283.

In the RFC2547bis standard, CE and PE communicate routing information through Interior Gateway Protocol (IGP) or EBGP.

The PE obtains the routing table of the VPN and stores it in a separate VRF. Each PE uses IGP to ensure normal IP connectivity, and IBGP is used to propagate VPN composition information and 'routes' and complete their VRF updates. The PE then updates the routing table of the CE through the routing exchange with the directly connected CE, thereby completing the routing exchange between the CEs.

Among them, when BGP is used to advertise VPN routes, a new address family - VPN-IPv4 address is used. A VPN-IPv4 address has 12 bytes, starting with an 8-byte RD, followed by ' 4-byte IPv4 address. The PE uses RD to identify routing information from different VPNs. Operators can allocate RDs independently, but they need to use their dedicated AS number as part of the RD to guarantee the global uniqueness of each RD. A VPN-IPv4 address with zero RD is synonymous with a globally unique IPv4 address. After this processing, the VPN-IPv4 address can remain globally unique even if the 4-byte IPv4 address contained in the VPN-IPv4 address overlaps. The route that the PE receives from the CE is an IPv4 route and needs to be imported into the VRF routing table. In this case, an R is required. In a typical implementation, the same RD is set for all routes from the same user site.

In the RFC 2547 bis standard, the Route Target attribute is used to identify the set of sites that can use a route, that is, which stations can be received by the site, and which PE routers can receive which routes are transmitted by the site. A PE router connected to the site specified in the Route Target will receive a route with this attribute. After receiving the route containing this attribute, the PE router adds it to the corresponding routing table. A PE router has two sets of Route Target attributes: one set is attached to the route received from a certain site, called Export Route Targets; the other set is used to determine which routes can be imported into the routing table of the site, You can obtain the VPN membership by using the Route Target attribute carried in the route. The matching route target attribute can be used to filter the routing information received by the PE router.

Figure 2 is a schematic diagram of filtering received routes by matching the Route Target attribute. When the MPLS VPN routing information enters the PE router, if the Export Route Targets collection has the same item as the Import Route Targets collection, the route is received. If the Export Route Targets collection has no identical items with the Import Route Targets collection, the route is rejected.

In the RFC2547bis standard, VPN packet forwarding uses a two-layer labeling method. The first layer, that is, the outer label is exchanged inside the backbone network, and represents a Label Switched Path (LSP) from the PE to the peer (PEER) PE. The VPN packet uses this layer. The tag can then reach the peer PE along the LSP. The second layer, that is, the inner layer label, is used when the peer PE arrives at the CE. The inner label indicates which station the message arrives, or more specifically, which CE is reached. In this way, according to the inner label, the interface for forwarding the message can be found. In a special case, if two sites belonging to the same VPN are connected to the same PE, the problem of how to reach the peer PE does not exist. It only needs to be solved how to reach the peer CE.

With the development of communication network technology, the traditional IPv4 network has exposed a series of shortcomings, such as insufficient address space, poor mobility, poor security and complex configuration. Therefore, the Internet Engineering Task Force (IETF) IPv6 was proposed to address these issues. After several years of development, IPv6 technology has matured, and it has successfully solved the problems of IPv4 and become the standard of the next generation Internet.

In order to continue to provide various services in the IPv4 environment during the evolution from IPv4 to IPv6, the VPN solution on the IPv6 network must be studied simultaneously. Since IPv6 itself is still in the experimental stage, there is no formal large-scale commercial use, and there is no formal VPN service application under the IPv6 network.

For how to implement VPN in the case where the backbone network is an IPv4 network and the VPN sites are all IPv6 networks, a 6PE technical solution can be adopted, and the network composition of the technical solution is shown in FIG. 3 . The basic idea of the 6PE solution is: Each IPv6 site is connected to at least one dual stack of the IPv4 backbone network and supports MP-BGP PE routers, that is, the 6PE routers shown in FIG. The 6PE router is called a double stack BGP (DS-BGP) router, that is, a DS-BGP router. The DS-BGP router has at least one IPv4 address on the IPv4 side and at least one IPv6 address on the IPv6 side, and the IPv4 address must be routable in the IPv4 network. Routes in IPv6 sites follow standard IPv6 routing protocols, such as Open Shortest Path First Version 3 (OSPFv3), Information Society Initiatives in Standardization version 6, ISISv6, or Next Generation Routing Information Protocol Information Protocol next generation (RIPng), which does not need to be advertised to the IPv4 backbone network. It only needs to be terminated by BGP4+ on the DS-BGP router, but it needs to exchange IPv6 network layer reachability information through the MP-BGP4 between the DS-BGP routers. Network Layer Reachability Information (NLRI), the outgoing DS-BGP router uses its own address as the next hop for these routes when advertising routes to the ingress DS-BGP router; IPv6 data from the ingress DS-BGP router when the packet is forwarded The packet is transparently transmitted to the egress DS-BGP router through an MPLS tunnel, that is, an LSP. The DS-BGP router advertises its own address as the next hop of the BGP route. It can use the IPv4 address and use the MPLS tunnel or other IPv4 address-based tunnels, such as the Generic Route Encapsulation (GRE) protocol tunnel, and the IP security protocol. (IP Security Protocol, IPsec) tunnel; can also use IPv6 address, and use the corresponding tunnel, such as 6to4 tunnel, Intra-Site Automatic Tunnel Access Protocol (IASATAP) l3⁄4 channel, and use The form of the address required for these tunnels.

However, the transition from IPv4 to IPv6 is a gradual process. The transition period will exist at the same time. IPv4 networks and IPv6 networks, both user networks and backbone networks may be IPv4 networks or IPv6 networks, or IPv4/IPv6 hybrid networks. This requires VPN services under the new generation network to adapt to complex network environments and can be applied to IPv4 networks, IPv6 networks, or IPv4/IPv6 hybrid networks.

Because the above solution is for the IPv4 network of the backbone network and all the VPN sites are IPv6 sites, the DS-BGP used in this solution cannot support the IPv4 site. If the ordinary BGP router is used instead, the NLRI exchange cannot be implemented. The function and the routing learning and publishing of the VPN in the existing technical solution are performed in the IPv4 network, and the router learning and publishing in the hybrid backbone network cannot be supported, so the routing learning release of the VPN based on the hybrid backbone network is not supported and Data forwarding. Summary of the invention

In view of this, a main object of the present invention is to provide a virtual private network system of a hybrid site hybrid backbone network, in which sites based on different IP versions can access each other and perform VPN through backbone networks based on different IP versions. business.

Another main object of the present invention is to provide a method for implementing a virtual private network of a hybrid site hybrid backbone network, which enables sites based on different IP versions to access each other and perform VPN services through backbone networks based on different IP versions. .

In order to achieve the above objective, the present invention provides a virtual private network system of a hybrid site hybrid backbone network, including a virtual private network user site, a user network edge router CE, a backbone network edge router PE, and a bone network. The user sites transmit data to each other through the CE and the PE accessing the backbone network, and the virtual private network system includes a user site based on the Internetwork Interconnection Protocol version 4 IPv4 and the sixth version IPv6; The backbone network includes multiple IPv4 autonomous domains and IPv6 autonomous domains;

An autonomous domain in the backbone network is the primary autonomous domain PAS, and the non-PAS autonomous domain in the backbone network is the secondary autonomous domain DAS; the PAS and the DAS communicate with each other through an autonomous system border router ASBR supporting IPv4 and IPv6 dual protocol stacks. Connection

The ASBR of the PAS stores an inter-domain route established by the PE with the DAS; the CE supports an IPv4 protocol stack or an IPv6 protocol stack or an IPv4 and IPv6 dual protocol stack, which stores IPv4 routes or/and IPv6 routes;

The PE supports an IPv4 protocol stack or an IPv6 protocol stack or an IPv4 and IPv6 dual protocol stack, and the PE of the PAS stores an IPv4 route and an IPv6 route; the PE of the DAS stores an IPv4 route, an IPv6 route, and an ASBR established with the PAS. Cross-domain routing;

The user sites transmit data according to routes stored by the CE and the PE.

The primary autonomous domain may be an IPv6 autonomous domain that includes the most PEs connecting the sites in the backbone network. The DAS directly connected to the PAS in the backbone network may be a first layer of DAS; the system further includes one or more layers of DAS, and the next layer of DAS is connected to the upper layer of DAS through the ASBR;

The ASBR of the upper-layer DAS stores the inter-domain routes established with the PEs of the next-layer DAS. The PEs of the next-layer DAS store the IPv4 routes, IPv6 routes, and inter-domain routes established with the ASBRs of the upper-layer DAS.

When the version of the inter-network interconnection protocol of the user site and the autonomous domain are different, the CE and the PE that are connected to the user site and the autonomous domain support an IPv4 and IPv6 dual protocol stack.

The CE stores IPv4 routes and IPv6 routes for the IPv4 user sites that need to access the IPv6 user site.

The CE that stores IPv6 user sites that need to access IPv4 user sites only stores IPv6 routes.

For a IPv4 user site that only accesses an IPv4 user site, the CE only stores IPv4 routes. In order to achieve the above objective, the present invention provides a method for implementing a virtual private network of a hybrid site hybrid backbone network. The method uses the above-mentioned virtual private network system. The process of the virtual private network service includes the following steps:

A. Addressing IPv4 and IPv6 user sites to form IPv4 and IPv6 address information in a uniform format;

B. The user site and the backbone network learn and advertise the routes, and advertise the inter-domain routes established by the IPv4 routing, the IPv6 routing, and the ASBR of the PAS and the PE of the DAS to the PE in the system and the CE connected to the PE;

(where the backbone network distributes the inner and outer labels;

D. The data packet of the user site is based on the path learned by the CE and the PE in the step B. The method for addressing the IPv4 and IPv6 user sites in the step A may be: The IPv4 user site adopts a "router classifier + IPv4 address" form to form an IPv4 address with an address family identifier of 1; a route distinction is used between an IPv4 user site and an IPv6 user site, and between IPv6 user sites. The format of the character + IPv6 address, which constitutes an IPv6 address with an address family identifier of 2.

The IPv4 user site that communicates with the IPv6 user site, after mapping the IPv4 address A.B.C.D to the IPv6 address in the form of 0::A:B:C:D, combines with the route specifier to form an IPv6 address with an address family identifier of 2.

The method may further include: layering the backbone network when the backbone network further includes a DAS not directly connected to the PAS; setting the DAS directly connected to the PAS as the first layer DAS, and the DAS connected to the first layer DAS For the second layer, and so on;

The step B may include:

B1. The CE advertises the route of the aggregated IPv4 user site or IPv6 user site to the PE connected to it;

B2. The PE of the upper layer advertises the route learned by the CE to the PE and/or ASBR of the local domain. The PE of the next layer advertises the route from the CE or the learned PE to the PE in the local domain and the upper-layer autonomous domain and the local domain. Connected ASBR;

B3. The ASBR in the upper-layer autonomous domain advertises the route learned from the local domain to the PE of the lower-layer autonomous domain, and advertises the route learned from the lower-layer autonomous domain to the PE of the local domain.

B4. The PE routers in each autonomous domain advertise routes learned from other PE routers or / and ASBRs to the CE routers connected to them; the CE routers save them after receiving IPv4 routes or / and IPv6 routes.

The step B2 may further include:

In the ASBR that connects the local PE and the local domain in the upper-layer autonomous domain, the 'inter-area route between the next-layer PE and the ASBR connected to the local domain in the upper-layer autonomous domain is stored.

The step B2 may further include: The PE router learns the IPv4 route and the IPv6 route learned from the CE router according to the VPN and route IP version to which the route identifier D, the address family identifier AFL, and the subsequent address family identifier SAFI are formed. The RD, the AFL SAFI, and the route target group are formed. Route information of the route type, IPv4 address, or IPv6 address.

In the step B2, routing between the PE and the PE in the autonomous domain, and between the PE and the ASBR through the internal border gateway protocol based on the IP version of the local autonomous domain, and the user site of the CE connected to the PE;

The next-layer PE advertises the route to the ASBR connected to the local domain in the upper-layer autonomous domain by using the multi-protocol external border gateway protocol based on the IP version of the local autonomous domain.

In the step B3, the ASBR in the upper-layer autonomous domain advertises the route to the PE of the lower-layer autonomous domain through the multi-protocol external border gateway protocol based on the IP version of the next-layer autonomous domain; and the internal version based on the IP version of the local autonomous domain The border gateway protocol advertises the learned route to the PE of the local domain;

In the step B4, in each autonomous domain, the PE advertises the learned route to the peer PE in the domain through the internal border gateway protocol based on the IP version of the local autonomous domain.

For an IPv4 user site that needs to access an IPv6 user site, the step B4 may include the following substeps:

B41. The CE connected to the IPv4 user site and the PE connected to the CE, and run the IPv6-based routing protocol to learn the route; the PE converts the saved IPv4 user site route from the ABCD/H form to 0::A: B: C: D / (96 + n) IPv6 routing, issued to the CE through the IPv6 routing protocol;

B42. After receiving the IPv6 route in the form of 0::A:B:C:D/(96+n), the CE restores the IPv6 route to the IPv4 route in the form of ABCD/n, and saves the route of the IPv6 user site as IPv6. routing.

For an IPv6 user site that needs to access an IPv4 user site, the step B4 may be packaged. The following substeps are included:

B43. The CE connected to the IPv6 user site and the PE connected to the CE, and run an IPv6-based routing protocol to learn the route;

B44. The CE directly stores the route of the IPv4 user site as an IPv6 route in the form of 0::A:B:C:D/(96+n), and saves the route of the IPv6 user site to the original form.

For an IPv4 user site that only accesses the IPv4 user site, in the step B, only the IPv4 routing protocol is run between the CE connected to the IPv4 user site and the PE connected to the CE, and only other IPv4 user sites are learned and saved. IPv4 routes, dropping IPv6 routes.

In the B4, after receiving the IPv4 route, the IPv6 route, or the inter-domain route, the PE determines whether to learn and publish to the user site according to the route target extended community attribute of the multi-protocol border gateway protocol.

In step C, the inner label is allocated by the ingress PE, and is used to distinguish different user sites that are connected by the same ingress PE, and the inner label is advertised to the corresponding egress PE along with the route when the route is advertised;

The outer label is allocated in autonomous domain by a label distribution protocol running a label distribution protocol, a resource reservation protocol-traffic engineering or a constraint routing, and between different autonomous domains, the ASBR passes between the autonomous domains. The protocol external border gateway protocol is allocated for the bidirectional connection of the ASBR, and is used for forwarding data packets in the backbone network.

The step D may include the following sub-steps:

Dl. Follow the normal inter-network interconnection protocol forwarding process to perform data forwarding between the source user site and the ingress PE;

D2, performing label data forwarding between the ingress PE and the egress PE;

D3. The egress PE performs data forwarding of the inter-network interconnection protocol between the egress PE and the destination user site according to the inner layer label and the stored routing table.

The step D2 may include the following sub-steps: D21, after adding the inner layer label of the destination station to the data packet on the ingress PE, adding an outer label allocated in the autonomous domain where the ingress PE is located;

D22. Forward the data packet according to an outer label to an ASBR of an autonomous domain adjacent to the current autonomous domain;

D23. The ASBR forwards the data packet to an ASBR of a next adjacent autonomous domain according to an outer label allocated between the ASBRs;

D24. The ASBR forwards the data packet to the egress PE.

The topology relationship between the user sites can be implemented by matching route target community attributes.

It can be seen from the above technical solution that the virtual private network system of the hybrid site hybrid backbone network of the present invention and the implementation method thereof are different from the prior art in that: the present invention performs a master-slave relationship on the autonomous domain of the multi-domain backbone network. In the autonomous domain, the route is advertised by the corresponding MP-IBGP according to the IP version of the local autonomous domain. Multi-hop MP-EBGP is used to advertise routes between neighboring autonomous domains, and IPv4/IPv6 dual routes are run on the CE and PE. The VPN forwards the VPN data according to the IP address distribution label in the autonomous domain, so as to implement the VPN of the multi-domain backbone network of the hybrid site.

Therefore, by adopting the VPN of the hybrid site hybrid backbone network of the present invention and implementing the method, the VPN can be formed when the user network and the backbone network transition from IPv4 to IPv6, so that the solution of the VPN during the transition period has greater flexibility. Reduce the complexity of network equipment upgrades, make the transition from IPv4 to IPv6 smoother, and greatly improve the economics and feasibility of network upgrades. BRIEF DESCRIPTION OF THE DRAWINGS

1 is a schematic diagram of a system composition of an MPLS L3 VPN defined by RFC 2547 bis; FIG. 2 is a schematic diagram of filtering received routes by matching a Route Target attribute; 3 is a schematic diagram of a system configuration of a 6PE solution implementing BGP/MPLS VPN; FIG. 4 is a schematic diagram of a VPN system configuration of a hybrid site hybrid backbone network according to a first preferred embodiment of the present invention;

5 is a schematic diagram of a VPN system composition of a hybrid site hybrid backbone network according to a second preferred embodiment of the present invention;

6 is a schematic diagram of a VPN system composition of a hybrid site hybrid backbone network according to a third preferred embodiment of the present invention;

FIG. 7 is a schematic diagram of a VPN system composition of a hybrid site hybrid backbone network according to a fourth preferred embodiment of the present invention. Mode for carrying out the invention

The present invention will be further described in detail below with reference to the accompanying drawings.

The virtual private network system of the hybrid site hybrid backbone network of the present invention and the implementation method thereof, the master-slave relationship is divided into multiple autonomous domains in the backbone network, and one IPv6 autonomous domain in multiple autonomous domains is determined to be autonomous. Domain (Primary AS, PAS), other autonomous domains are dependent Dependent ASs (DAS). In addition, if there is a DAS in the backbone network that is not directly connected to the PAS, the hierarchical relationship of each DAS can also be determined according to the connection relationship between the DAS and the PAS. For example, the DAS directly connected to the PAS is the first layer DAS, and the DAS connected to the first layer DAS and not directly connected to the PAS is the second layer DAS, and so on, determining the hierarchical relationship of each autonomous domain in the backbone network.

Multi-Probt External BGP (Multi-hop MP) is established between the Autonomous System Border Router (ASBR) in the PAS or the upper-layer DAS and the PE in the next-layer DAS. -EBGP) connection and inter-domain tunneling, and cross-domain VPN routing and VPN respectively Data forwarding, and the VPN route advertisement and data forwarding between the PEs in each autonomous domain respectively pass the multi-protocol internal border gateway protocol based on the IP protocol version (IPv4 or IPv6) of the local autonomous domain in the local autonomous domain (Multi- Protocol Internal BGP, MP-IBGP) and intra-domain tunneling. At the same time, in order to achieve interworking of different versions of addresses, a certain address and route conversion processing is also performed.

The virtual private network system of the hybrid site hybrid backbone network of the present invention comprises a backbone network and a user network. The backbone network is used to advertise VPN routes, establish switching paths, and complete data exchange. The backbone network consists of autonomous domains with different address families. The ASs are connected by ASBRs at the edge of the autonomous domain. That is, the backbone network may include one or more IPv4 autonomous domains and one or more IPv6 autonomous domains. The IPv4 autonomous domain and the IPv6 autonomous domain are connected by an ASBR that supports the IPv4 and IPv6 dual protocol stacks. In addition to ASBR, each autonomous domain also includes the original P router and PE router. The PE router configures the IPv4 protocol stack or the IPv6 protocol stack or the IPv4 and IPv6 dual protocol stacks according to the network connection.

In the present invention, the routes advertised by the backbone network include VPN-IPv4 routes and VPN-IPv6 routes. Route learning is performed on the backbone network to establish a VPN switching path.

Routing between the PAS and the PEs in the DAS through the MP-IBGP version of the IP protocol of the local autonomous domain, and routing between the user stations connected to the PE router; and passing between the DAS and the ASBR of the upper-level autonomous system. Based on the MP-IBGP version of the IP protocol version of the local autonomous domain, the route of the user site connected to the PE router is advertised. The PE of the upper-layer autonomous system and the ASBR also advertise the routes of the user sites connected to the PE routers based on the MP-IBGP version of the IP protocol of the local autonomous domain.

The ASBR of the upper-layer autonomous system advertises the received route to the PE of the local autonomous domain and the ASBR of the upper-layer autonomous system (if any), and then the ASBR of the upper-layer autonomous system advertises the received route to the PE of the local autonomous domain. The ASBR of the upper-level autonomous system (if any) is issued in turn until the PE and ASBR in the PAS. A PE that receives a route from the PE and the DAS that receives the route in the PAS, and advertises the received route to the CE connected to itself.

The method of routing is described in detail below.

The user network contains the CE router connected to the backbone network and the user stations connected to it. In the present invention, the user site has both an IPv4 site and an IPv6 site, and each user site contains multiple hosts with different addresses. The CE router supports the corresponding protocol stack according to the IP version of the user network and the IP version of the autonomous system to which it is connected. The PE router supports the corresponding protocol stack according to the IP version of the autonomous system to which it belongs and the IP version of the user site to which it is connected. For example, the CE router and the corresponding PE router of the IPv4 site connected to the IPv4 backbone network only need to support the IPv4 protocol stack. The CE and the corresponding PE of the IPv6 site connected to the IPv6 backbone network only need to support the IPv6 protocol stack and connect to the IPv4 backbone. The CE of the IPv6 site of the network and the CE of the IPv4 site connected to the IPv6 backbone network and the PE device accessing these CEs all need to support the IPv4/IPv6 dual protocol stack. In addition, because IPv4 sites and IPv6 sites in the same VPN may have mutual access, routers in IPv4 sites that need to access IPv6 sites need to save IPv6 routes. That is, these IPv4 sites need to support IPv4-IPv6 hybrid address scheme.

The following is a detailed description of the system in which the backbone network includes an IPv4 autonomous domain and an IPv6 autonomous domain two autonomous domains.

In this embodiment, for an IPv6 domain and an IPv4 domain, the IPv6 autonomous domain is the PAS, and the IPv4 autonomous domain is the DAS. The multi-hop MP-EBGP and the inter-domain tunnel are established between the ASBR in the PAS and the PE in the DAS. The route advertisement and VPN data forwarding of the inter-AS VPN are respectively performed, and the VPN route advertisement and data forwarding between the PEs in each autonomous domain respectively pass the IP protocol version (IPv4 or IPv6) based on the local autonomous domain. The MP-IBGP and intra-domain tunnels are completed.

Referring to FIG. 4, FIG. 4 is a hybrid site hybrid backbone network according to a first preferred embodiment of the present invention. Schematic diagram of the VPN system. The solid double arrow in Figure 4 indicates multi-hop MP-EBGP between the upper layer ASBR and the adjacent DAS domain PE; the dashed double arrow indicates MP-IBGP in the PAS or DAS domain, as shown in Figure 5 to Figure 7.

In the VPN system shown in Figure 4, the backbone network is dual-domain. It includes: a backbone network that includes an IPv4 autonomous domain and an IPv6 autonomous domain, and a PE router at the edge of the backbone network: PE1 ~ PE4; P router inside the backbone network. (not shown in Figure 1); CE router at the edge of the customer network: CE1 CE8; and user sites connected to the PE through the CE; each user site contains one or more hosts with different addresses.

In the backbone network, the IPv4 domain and the IPv6 domain are connected to each other through ASBR1 and ASBR2.

The system shown in Figure 4 contains two VPNs, VPNA and VPNB. The VPNA includes IPv4 and IPv6 sites: IPv6 stations connected to CE1, IPv4 stations connected to CE4, IPv6 stations connected to CE5, and IPv4 stations connected to CE8. The IPv4 site is included in the VPNB. The IPv4 site connected to CE2, the IPv4 site connected to CE3, the IPv4 site connected to CE6, and the IPv4 site connected to CE7. In this embodiment, only the VPNA and the VPNB are used as an example. The physical network may include only one IPv4 domain and one IPv6 domain. In actual applications, the system may include more than four VPNs, and the backbone network may also include multiple domains.

In this embodiment, the CE router and the corresponding PE router of the IPv4 site connected to the IPv4 backbone network support only the IPv4 protocol stack. The CE and the corresponding PE of the IPv6 site connected to the IPv6 backbone network only support the IPv6 protocol stack and connect to the IPv4 backbone. The CE of the IPv6 site of the network and the CE of the IPv4 site connected to the IPv6 backbone network and the PE device accessing these CEs all need to support the IPv4/IPv6 dual protocol stack.

The CE router that connects to the IPv4 site and connects to the IPv6 site also stores the IPv4 and IPv6 routes of other user sites in the VPN learned from the PE router, and performs routing matching when accessing other sites.

Referring to the VPN system of the embodiment shown in FIG. 4, the following embodiment implements hybrid site mixing. The method of the backbone network VPN is described in detail.

First, the user site addressing method of the VPN system of the embodiment shown in FIG. 4 will be described. In the present invention, only the VPN user is considered to perform unicast communication, and the hosts in each site of the VPN are required to use a unicast address, that is, only one IPv4 address or one IPv6 address is used.

In the VPN, the communication between the IPv4 site and the IPv4 site still uses the IPv4 address. The Address Family Identifier (AFI) domain in the MP-BGP uses the value assigned by the RFC1700 to the IPv4 address family. The mutual communication between the IPv6 sites and the mutual communication between the two IPv6 sites uses the IPv6 address. The AFI domain in the MP-BGP can use the value 2 assigned by the RPC 1700 to the IPv6 address family. It should be noted that when an IPv4 site and an IPv6 site communicate with each other, the IPv4 address A.B.C.D in the IPv4 site is mapped to the corresponding IPv6 address in the form of 0::A:B:C:D. In the MP-BGP route advertisement process, in order to distinguish it from the routing of the backbone network, the Subsequence Address Family Identifier (SAFI) field of the subsequent VPN address uses 128, which indicates the VPN-IPv4 address or the VPN-IPv6 address.

Since IPv4 sites still exist in the VPN, in view of the shortage of public IPv4 addresses, in a preferred embodiment of the present invention, IPv4 sites in the VPN are allowed to continue to use private IPv4 addresses, and sites of different VPNs are allowed to use the same private. IPv4 address.

Specifically, in the embodiment shown in FIG. 4, since the private IPv4 address is used, in order to ensure the uniqueness of the VPN route and address in the backbone network, the concept of the RD in RFC 2547bis, that is, the IPv4 site and the IPv4 site, is used. A VPN-IPV4 address with AFI of 1 is formed by using RD+ (IPv4 address), and AFI is 2 by using RD+ (IPv6 address) between IPv4 sites and IPv6 sites or between two IPv6 sites. VPN-IPv6 address. It should be noted that the IPv4 address ABCD in the IPv4 site that communicates with the IPv6 site is mapped to the IPv6 address in the form of 0::A:B:C:D, and then combined with the RD to form the VPN-IPv6. address. In this embodiment, each MP-BGP speaker It can parse the corresponding IPv4/IPv6 routing entries according to AFI and support the simultaneous storage of IPv4/IPv6 routing tables. IPv4 routes and IPv6 routes can be stored in different routing tables respectively.

After the address of the user site is determined, each CE router aggregates the addresses of the user sites to form corresponding routing entries. Then, routing learning and distribution processing of the VPN site, processing of label distribution, and processing of VPN data forwarding can be performed. These processes are described in detail below.

Then, the routing learning and publishing processing methods of the VPN site are described in detail. In this embodiment, the method includes the following process:

Procedure 1. The CE router advertises the aggregated route to the PE router connected to it. In the present invention, the CE of the IPv6 site connected to the IPv4 backbone network and the CE of the IPv4 site connected to the IPv6 backbone network and the PE devices accessing the CEs all support the IPv4/IPv6 dual protocol stack. Therefore, PE can learn IPv4 or / and IPv6 routes issued by CE.

For example, in Figure 4, CE1 and CE2 advertise routes to PE1, CE3, and CE4 to advertise routes to PE2. CE5 and CE6 advertise the route to PE3, CE7, and CE8 to advertise the route to process 2. The egress PE adds a corresponding inner label to the route received from the CE. The inner label is allocated by the PE to the site connected to the CE. It is used to distinguish between different sites, and the routes carrying the labels are advertised to the ingress PE or ASBR in the local domain through the MP-IBGP or advertised to the ASBR in the upper-layer autonomous domain to connect to the local domain through the Multi-hop MP-EBGP.

Specifically:

The PE routers in the DAS send IPv4 routes and IPv6 routes learned from the CE routers to other PE routers in the AS and ASBRs of the upper-layer autonomous system. In this embodiment, there are only two layers, PAS is the upper layer, and DAS is the next layer.

The PE router in the PAS sends IPv4 routes and IPv6 routes learned from the CE router. Bring to other PE routers and ABSRs within the autonomous system.

For example, in Figure 4, PE1 of the DAS advertises the route to PE2 of the autonomous system and its upper-layer autonomous system: ASBR2 of the PAS; PE2 of the DAS advertises the route to the PE1 of the autonomous system and the ASBR2 of the PAS. PE3 in the PAS advertises routes to PE4 and ASBR2. PE4 advertises routes to PE3 and ASBR2.

In this process, the PE router learns the IPv4 routes and IPv6 routes learned from the CE routers based on the VPN and routing IP versions plus RD, AFI, and SAFI to form RD, AFI, SAFI, Route Target, and IPv4/IPv6 routes. Unified form of routing information.

In this embodiment, the PE router still uses the VRF to save routes of different VPNs. In the 'VRF, separate IPv4 routes and IPv6 routes are saved for different AFIs of each VPN.

For PE routers to advertise routes to PE routers: Since other PE routers also support dual protocol stacks, other PE routers can receive IPv4 routes and IPv6 routes.

The PE router advertises the route to the ASBR in the local AS: When the PE is an IPv4 network, the IPv4-based PE4 and the ASBR of the local AS pass the IPv4-based fully-connected multi-protocol internal border gateway protocol. Multi-Protocol Internal BGP, MP-IBGP) or route reflectors are used to advertise routes to VPN user sites connected to PEs of the IPv4 network; when the autonomous system where the PE is located is an IPv6 network, the PE routers and protocols in the IPv6 network The ASBRs within the autonomous domain advertise the routes of the VPN sites connected to the PE routers of the IPv6 network through the IPv6-based fully-connected MP-IBGP or the applicable route reflector.

Although the advertised route contains IPv4 routes and IPv6 routes, IPv4 routes and IPv6 routes are only sent as transmitted data when MP-IBGP is used to advertise routes. IPv4-based MP-IBGP or IPv6-based MP-IBGP is used. Only related to the version of the network is independent of the specific data, so no matter which data is transmitted, it is specifically IPv4 routing and

IPv6 routing, both MP-IBGP can be transmitted. The PE router advertises the route to the ASBR of the upper-layer autonomous domain. When the autonomous system of the PE is an IPv4 network, the PE router of the IPv4 network and the upper-layer ASBR advertise the PE connection with the IPv4 network through the IPv4-based Multi-hop MP-EBGP. Routing of the VPN user site; when the autonomous system of the PE is an IPv6 network, the VPN router connected to the PE router of the IPv6 network is advertised between the PE router and the upper-layer ASBR in the IPv6 network through the IPv6-based Multi-hop MP-EBGP. The route to the site.

Since the ASBRs in this embodiment support the IPv4 and IPv6 dual-stack protocols, you can advertise routes to each other by running Multi-hop MP-EBGP based on the IP version of the local domain.

In the ASBR2 of the present embodiment, the inter-domain route of the VPN to which the PE1 and the PE2 belong to the DAS in which the MP-EBGP PEER is established is reserved. Similarly, the inter-domain routes established by the ASBR2 with the PAS are also stored in the PE1 and the PE2.

Procedure 3: The ASBR in the upper-layer autonomous domain advertises the route learned from the local domain to the PE in the next-level autonomous domain, and advertises the route learned from the next-layer autonomous domain to the PE in the local domain.

The ASBR in the upper-layer autonomous domain can advertise routes to the PEs of the next-level autonomous domain based on the IP-based Multi-hop MP-EBGP of the next-layer autonomous domain. The MP-IBGP based on the local IP version is applied to the local domain. The PE issues routes.

For example, the ASBR2 of the PAS in Figure 4 advertises the routes learned from PE4 and PE3 to PE1 and PE2 in the DAS. The routes learned from PE1 and PE2 are advertised to PE3 and PE4.

Procedure 4. The PE routers in each autonomous domain advertise routes learned from other PE routers or / and ASBRs to the CE routers connected to them. The CE router saves after receiving IPv4 routing or / and IPv6 routes.

For example, in Figure 4, PE1 in the DAS advertises the routes received from ASBR2 of PE2 and PAS to CE1 and CE2. The PE2 in the DAS advertises the routes received from ASBR2 of PE1 and PAS to CE3 and CE4.

The PE3 in the PAS advertises the routes received from PE4 and ASBR2 to CE5 and CE6. PE4 in the PAS advertises the routes received from PE3 and ASBR2 to CE7 and CE8.

In the present invention, the corresponding IPv4 route and the IPv6 route are saved in the CE router in the IPv4 site of the VPN, and the CE router is used as a proxy (Proxy) when the VPN site accesses other sites. When performing route matching, according to Rout Target The destination user site included in the access is an IPv4 user site or an IPv6 user site that matches IPv4 routes or IPv6 routes, respectively. The CE router of the IPv6 user site in the VPN only saves the IPv6 route. Before the PE router accessing the IPv6 site advertises the routes of other IPv4 sites to the site, the IPv4 route ABCD/n needs to be converted to 0::A: B: C: D / (96 + n) IPv6 route.

Specifically, in this embodiment, the CE router and the PE router that need to access the IPv4 user site of the IPv6 VPN user site run IPv6-based routing protocols to learn IPv6 routes and IPv4 routes simultaneously, and route IPv4 in the VRF of the PE router. ABCD/n is converted to 0::A:B:C:D/(96+n) IPv6 routes, which are advertised to the CE router through the IPv6 routing protocol, and restored to the ABCD/n IPv4 route in the CE router. The IPv6 routes of other IPv6 user sites are still saved as IPv6 routes in the CE router. The IPv4 route is matched when the IPv4 user site accesses the IPv4 site, and the IPv6 route is matched when the IPv6 site is accessed.

In this embodiment, an IPv6 user site that needs to access an IPv4 VPN user site is also required to run an IPv6-based routing protocol between the CE router and the PE router to learn routes of other sites, and directly store the routes of other IPv4 user sites as 0::A:B:C:D/(96+n). The form of IPv6 route is saved to the original IPv6 user site. It should be noted that in A.B.C.D/n mentioned above, A.B.C.D is the network segment address, and n is the mask.

In addition, if the user site connected by the CE includes a router in addition to the host, in process V., the CE also routes the router to the user site, and is stored by the router of the user site. The routing table of the user site; if the user site connected by the CE does not include a router, in process five, the CE stores the routing table of the user site.

In an actual application, if some IPv4 user sites do not need to access other IPv6 user sites in the topology relationship determined by the Route Target attribute, only the IPv4-based routing protocol needs to be run between the CE router and the PE router, and only the learning protocol is required. And save IPv4 routes of other IPv4 user sites, and discard them for IPv6 routes.

After receiving the VPN route, the PE router determines whether to learn and publish to the corresponding user site according to the MP-BGP route target extension community attribute. When the egress PE advertises a VPN route to its BGP peer (BGP PEER), it carries the corresponding Export Route Target and Egress PE for the VPN site. The inner layer label is allocated, and the BGP PEER receives the corresponding route. The Import Route Target configured on the BGP PEER is matched. If the match is successful, the route is received and advertised to the corresponding VRF site. If the BGP PEER is an ASBR between the two ASs, the route needs to be advertised. To the Multi-hop MP-EBGP. PEER in the DAS domain, and the MP-IBGP PEER in the PAS domain, these PEERs perform Route Target matching to determine whether to accept and publish these cross-domain VPN routes to the connected sites. This process is the same as the prior art and will not be described here.

In the present embodiment, the processing of label distribution can be performed in the manner described below.

During the forwarding process, different VPN sites connected to the same egress PE are assigned to different PEs by the egress PE. The inner label is advertised to the corresponding PE when the route is advertised through MP-BGP. It does not change when forwarding in the backbone network (PAS and DAS).

In RFC 2547, packets are forwarded in the backbone network based on the outer label. In the present invention, the distribution of the outer label is the same as in the prior art, and includes label distribution in the autonomous domain and label distribution between the autonomous domains. The outer label in the PAS domain and the DAS domain can be followed by the Label Distribution Protocol (LDP) or the Resource Reservation Protocol (RSVP)-Traffic Engineering (TE)/Constrained Routing A label assignment protocol such as a Constraint-Routing Label Distribution Protocol (CR-LDP) is allocated. Each next-hop router in the autonomous domain distributes outer labels for its previous hop router, including label distribution between P routers, label distribution between P routers and PEs, and label distribution between PE routers and ASBRs. The assignment of the outer labels of the two ASBRs between adjacent autonomous domains is allocated through the BGP protocol between the autonomous domains.

The present invention adopts label forwarding. Therefore, a tunnel is determined between the PE routers in each domain or between the PE routers and the ASBRs and between the ASBRs in the adjacent domains through the exchange relationship of the outer labels. The data forwarding between the VPN sites connected to the PE routers in the domain is performed through the intra-domain tunnels. The data forwarding between the VPN sites connected to the PE routers of different autonomous domains passes through the intra-domain tunnels of the ingress PE and the egress PE. The ASBR between the two autonomous domains is completed by the inter-domain tunnel determined by the label allocated by MP-BGP.

In this embodiment, the specific data forwarding process is also basically the same as the prior art, including the following types of forwarding: IP data forwarding between the source user site to the ingress PE router; the Ingress PE router to the Egress PE router. Label data forwarding between; Egress PE to IP data forwarding between destination user sites. The following are described separately.

Source User Site to Ingress The IP packet forwarding between PE routers follows the 'normal IP forwarding process. As described above, the IPv4/IPv6 routing table is saved in the user site. For the source user site that needs to access the IPv4/IPv6 destination user site, the destination user site can be IPv4 or IPv6. The site queries the corresponding routing table and forwards the packet to the Ingress PE according to the corresponding routing table.

There are two kinds of conditions for label data forwarding between the ingress PE router and the egress PE router. The access between the VPN sites in a single autonomous domain can be forwarded by using the intra-domain data forwarding mode in the prior art. After the Egress PE is added to the inner label of the site where the destination is located on the ingress PE, The outer label of the label distribution protocol (LDP/RSVP-TE/CR-LDP) in the autonomous domain of the ingress PE forwards the data packet to the Egress PE along the outer label of the LSR of the LSP.

After the access between the VPN sites in the different autonomous domains, the ingress PE adds the egress PE to the inner label of the site where the destination is located, and then adds the label distribution protocol (LDP RSVP) in the autonomous domain where the ingress PE resides. -TE/CR-LDP ) The outer label is allocated, and the data packet is forwarded along the outer label of the LSP according to the outer label to the local ASBR of the neighboring autonomous domain, and then according to the ASBR of the neighboring autonomous domain. The outer label assigned by the MP-EBGP between the ASBRs is forwarded to the ASBR of the next neighboring autonomous domain, and then the LSP is forwarded to the egress PE along the LSP in the next neighboring autonomous domain.

After the IP data forwarding between the egress PE and the destination user site is received, the egress PE determines the destination user site by distinguishing the inner layer label after receiving the data packet containing the inner layer label, and follows the corresponding source user site and destination user site type. The routing table is forwarded to the destination host. In this step, the IPv4 routing table is queried only when the source user site and the destination user site are both IPv4 sites. In other cases, the IPv6 routing table is queried.

In addition, it should be noted that if the topology relationship between the sites of the VPN is implemented > such as full mesh networking, partial mesh, etc., the method in RFC 2547bis can still be used, that is, by matching Route Target is implemented. This is the same as the mechanism for routing and learning between the PEs mentioned above. That is, according to the topology relationship of the VPN, it is determined whether to learn the routing table, and the topology relationship of the VPN is implemented according to the routing table.

The technical solution of the VPN of two or more autonomous domains can be described based on the technical solutions of the above two autonomous domains (IPv4/IPv6), which are called Basic Hybrid Network (BHN). In this case, one of the IPv6 domains containing a large number of PE devices will be included. For PAS, the other autonomous domains are DAS. The DAS in BHN is the first layer of DAS, and the DAS connected to it and not directly connected to the PAS is the Layer 2 DAS.

The following is an example of a VPN system that includes a hybrid site with three autonomous domains and a hybrid backbone network. There are two cases for a VPN system with a hybrid site with three autonomous domains: The first one: A DAS is connected to a DAS in the BHN and is not directly connected to the PAS in the BHN. The second type: A DAS is connected to the PAS in the BHN and is not directly connected to the 'DAS in the BHN. The following description will be respectively made.

Referring to FIG. 5, FIG. 5 is a schematic structural diagram of a VPN system of a hybrid site hybrid backbone network according to a second preferred embodiment of the present invention. This embodiment is the first case described above.

The backbone network includes three autonomous domains: two IPv4 autonomous domains and one IPv6 autonomous domain. In this embodiment, the IPv6 autonomous domain that has many PEs connected to the VPN site is set to PAS, and the other two IPv4 autonomous domains are set to DAS1 and DAS2. PAS and DAS2 are included in the BHN, and DAS1 is only connected to DAS2 and not connected to PAS. That is to say, this embodiment is divided into three layers: the highest layer is PAS, the first layer is DAS2, and the second layer is DAS1.

The user site addressing method of the VPN system of this embodiment is exactly the same as that of the embodiment shown in FIG. 4, and the repeated description is not repeated here.

After the address of the user site is determined, each CE router aggregates the addresses of the user sites to form corresponding routing entries. Then, it is possible to perform routing learning and processing of the VPN site, processing of label distribution, and processing of VPN data forwarding.

First, the routing learning and publishing processing methods of the VPN site are described in detail. In this embodiment, the principle of routing learning and publishing of the VPN site is the same as that of the embodiment shown in FIG. 4, and the method includes the following processes:

Procedure 1: The CE router advertises the aggregated route to the PE router connected to it. For example, in Figure 5, CE1 and CE2 advertise the route to PE1, CE3, and CE4 to advertise the route to PE2. CE5 advertises the route to PE3, CE6, and CE7 to advertise the route to PE4. CE8 And CE9 issues the route to PE5.

Procedure 2: The egress PE adds a corresponding inner label to the route received from the CE, where the inner label is allocated by the PE to the station connected to the CE, and is used to distinguish different sites, and route the labels. It is advertised to the ingress PE or ASBR in the local domain through MP-IBGP or advertised to the ASBR in the upper-layer autonomous domain through the Multi-hop MP-EBGP.

For example, in Figure 5, PE1 in DAS1 advertises the routes received from CE1 and CE2 to ASBR2 of PE2 and DAS2. PE2 advertises the routes received from CE3 and CE4 to ASBR2 of PE1 and DAS2.

PE3 advertises the routes learned from CE5 to ASBR4 in ABSR2 and PAS. ASBR2 advertises the routes learned from PE1 and PE2 to ASBR4 in PAS.

PE4 advertises the routes learned from CE6 and CE7 to PE5 and ASBR4. PE5 advertises the routes learned from CE8 and CE9 to PE4 and ASBR4.

In the ASBR2 of the DAS2 in this embodiment, the inter-domain route of the VPN established with the PE1 and the PE2 in the DAS1 is stored. Similarly, the inter-domain routes established by the ASBR2' of the PAS are also stored in the PE1 and the PE2. The ASBR4 in the PAS stores the inter-domain routes established between it and the ASBR4. The PE3 and the ASBR2 store the inter-AS routes established with ASBR4.

The ASBR in the upper-layer autonomous domain advertises the route learned from the local domain to the PE in the lower-layer autonomous domain, and advertises the route learned from the lower-layer autonomous domain to the PE in the local domain.

For example, DAS2 in Figure 5 is used as the upper-layer domain of DAS1. The routes learned from PE3 and ASBR4 are advertised to PE1 and PE2. The routes learned from PE1 and PE2 are advertised to PE3.

As the upper-layer domain of the DAS2, the PAS advertises the routes learned from PE4 and PE5 to PE3 and ABSR2. The routes learned from PE3 and ABSR2 are advertised to PE5 and PE4.

Procedure 4. PE routers in each autonomous domain will be from other PE routers or/and ASBs. The learned route is published to the CE router connected to it. The CE router saves after receiving IPv4 routes or / and IPv6 routes.

For example, in Figure 5, PE1 advertises the routes learned from PE2 and ASBR2 to CE1 and CE2. PE2 advertises the routes learned from PE1 and ASBR2 to CE3 and CE4.

PE3 advertises the routes learned from ASBR2 and ASBR4 to PE3.

PE4 advertises the routes learned from PE5 and ASBR4 to CE6 and CE7. PE5 advertises the routes learned from PE4 and ASBR4 to CE8 and CE9.

The processing of the label distribution and the processing of the VPN data forwarding in this embodiment are basically the same as those in the embodiment shown in FIG. 4, and those skilled in the art can refer to the process for processing, and the description is not repeated here.

Figure 6 is a schematic diagram showing the composition of a VPN system of a hybrid site hybrid backbone network according to a preferred embodiment of the present invention. This embodiment is the first case described above.

The backbone network includes three autonomous domains: two IPv4 autonomous domains and one IPv6 autonomous domain. In this embodiment, the IPv6 autonomous domain that has many PEs connected to the VPN site is set to PAS, and the other two IPv4 autonomous domains are set to DAS1 and DAS2. PAS and DAS2 are included in the BHN, and DAS1 is connected to the PAS. That is to say, the embodiment is divided into two layers: The highest layer is PAS, DAS1 and DAS2 are the first layer DAS.

After the address of the user site is determined, each CE router aggregates the addresses of the user sites to form corresponding routing entries. Then, routing learning and distribution processing of the VPN site, processing of label distribution, and processing of VPN data forwarding can be performed.

First, the routing learning and publishing processing methods of the VPN site are described in detail. In this embodiment, the principle of routing learning and publishing of the VPN site is the same as that of the embodiment shown in FIG. 4, and the method includes the following processes: Procedure 1: The CE router advertises the aggregated route to the PE router connected to it. This process is the same as the previous two embodiments and will not be repeated here.

Process 2: The egress PE adds a corresponding inner label to the route received from the CE. The inner label is allocated by the PE to the site connected to the CE, and is used to distinguish different sites, and the routes carrying the labels are passed. The MP-IBGP is advertised to the ingress PE or the ASBR in the local domain or advertised to the ASBR in the upper-layer autonomous domain through the Multi-hop MP-EBGP.

For example, in Figure 6, PE1 in DAS1 advertises the routes received from CE1 and CE2 to ASBR2 of PE2 and DAS2. PE2 advertises the routes received from CE3 and CE4 to ASBR2 of PE1 and DAS2.

PE4 in the PAS advertises the routes learned from CE7 to PE3, ASBR2, and ASBR3; ASBR2 and ASBR3.

On DAS2, PE5 advertises the routes learned from CE8 and CE9 to ASBR3.

In Figure 6, only PAS is the upper domain. In this process, ASBR2 advertises the routes learned from PE3, PE4, and ASBR3 to PE1 and PE2 in DAS1. ASBR3 advertises the routes learned from PE3, PE4, and ASBR2 to PE5 in DAS2. ASBR3 advertises the routes learned from PE5 to PE3, PE4, and ASBR2. ASBR2 advertises routes learned from PE1 and PE2 to PE3, PE4, and ASBR3.

Process 4: The PE routers in each autonomous domain advertise routes learned from other PE routers or/and ASBRs to the CE routers connected to them. The CE router saves after receiving IPv4 routes or / and IPv6 routes. This process is basically the same as that shown in Figure 5 and will not be repeated here. The illustrated embodiment is basically the same, and those skilled in the art can refer to the process for processing, and the description is not repeated here.

In an actual application, an autonomous domain can be connected to multiple adjacent autonomous domains through multiple ports of one ASBR. In this manner, the present invention can also be implemented. Referring to FIG. 7, FIG. 7 is a schematic diagram showing the composition of a VPN system of a hybrid site hybrid backbone network according to a fourth preferred embodiment of the present invention.

This embodiment also includes two slave domains of DAS1 and DAS2, and the hierarchical relationship between DAS and PAS is the same as that of the embodiment shown in FIG. 6. The difference between this embodiment and the embodiment shown in FIG. 6 is that in the PAS, the two ports of the ASBR2 are connected to the ASBR1 of the DAS1 and the ASBR4 of the DAS2, respectively. In this case, PE2 in DAS1 and ASBR2 in PAS establish MP-EBGP connections through one port of ASBR2, and pass VPN routes to each other, and pass data to each other through the port; PE5 in DAS2 and ASB 2 in PAS pass through ASBR2. A port establishes an MP-EBGP connection, passes VPN routes to each other, and passes data to each other through the port.

It can be seen from the above embodiments that the virtual private network system of the hybrid site hybrid backbone network of the present invention and the implementation method thereof can form a VPN when the user network and the backbone network transition from IPv4 to IPv6, so that the network transition period The VPN solution has greater flexibility, reduces the complexity of network equipment upgrades, smoothes the transition from IPv4 to IPv6, and greatly improves the economics and feasibility of network upgrades.

Although the present invention has been illustrated and described with reference to the preferred embodiments of the present invention, it will be understood The spirit and scope of the invention is defined by the appended claims.

Claims

Claim

A virtual private network system of a hybrid site hybrid backbone network, comprising a virtual private network user site, a user network edge router CE, a backbone network edge router PE, and a backbone network, wherein the user sites pass the CE and the The HE accesses the backbone network to transmit data to each other, wherein: the virtual private network system includes a user site based on the Internetwork Interconnection Protocol version 4 IPv4 and the sixth edition IPv6; the backbone network includes multiple IPv4 autonomous domains and An IPv6 autonomous domain; an autonomous domain in the backbone network is the primary autonomous domain PAS, and the non-PAS autonomous domain in the backbone network is the secondary autonomous domain DAS; and the autonomous system supporting the IPv4 and IPv6 dual protocol stacks between the PAS and the DAS The border routers ASBR are connected to each other;

The user sites transmit data according to routes stored by the CE and the PE.

The virtual private network system according to claim 1, wherein the primary self-administration domain is an IPv6 autonomous domain in which a PE that connects to a site is connected to the backbone network.

The virtual private network system according to claim 1, wherein: the DAS directly connected to the PAS in the backbone network is a first layer DAS; the system further comprises one or more layers of DAS, and the next layer of DAS Connected to the upper layer DAS through the ASBR;

The ASBR of the upper-layer DAS stores the inter-domain route established with the PE of the next-layer DAS; the PE of the next-layer DAS stores the IPv4 route, the IPv6 route, and the inter-domain route established with the ASBR of the upper-layer DAS.

The virtual private network system according to claim 1, wherein: when the version of the inter-network interconnection protocol of the user site and the autonomous domain is different, connecting the user site and the CE of the autonomous domain And the PE supports IPv4 and IPv6 dual protocol stacks.

The virtual private network system according to claim 1, wherein: the IPv4 user site of the IPv4 user site that needs to access the IPv6 user site stores IPv4 routes and IPv6 routes; and the CE of the IPv6 user site that needs to access the IPv4 user site only Store IPv6 routes;

For a IPv4 user site that only accesses an IPv4 user site, the CE only stores IPv4 routes.

A method for implementing a virtual private network of a hybrid site hybrid backbone network, characterized in that: the virtual private network system according to claim 1, wherein the process of implementing the virtual private network service comprises the following steps:

C. The backbone network distributes the inner label and the outer label;

D. The data packet of the user site is forwarded by the backbone network according to the route learned by the CE and the PE in the step B, and the inner label and the outer label are encapsulated.

The implementation method according to claim 6, wherein the method for addressing the IPv4 and IPv6 user sites in step A is:

The IPv4 user site adopts a "routing identifier + IPv4 address" form to form an IPv4 address with an address family identifier of 1; between the IPv4 user site and the IPv6 user site, and between the IPv6 user sites, "routing" The format of the specifier + IPv6 address, which constitutes an IPv6 address with an address family identifier of 2.

8. The implementation method according to claim 7, wherein: the IPv4 user station that communicates with the IPv6 user site maps the IPv4 address ABCD to an IPv6 address in the form of 0::A:B:C:D, and routes. The specifiers are combined to form an IPv6 address with an address family identifier of 2.

The method according to claim 6, wherein the method further comprises: layering the backbone network when the backbone network further includes a DAS that is not directly connected to the PAS; and directly connecting to the PAS The DAS is set to the first layer DAS, the DAS connected to the first layer DAS is the second layer, and so on;

10. The implementation method according to claim 9, wherein the step B includes:

Bl and CE advertise the aggregated IPv4 user site or IPv6 user site route to the PE connected to it;

B2. The PE of the upper layer advertises the route learned from the CE to the PE and/or the ASBR of the local domain. The next-layer PE advertises the route from the CE or the learned route to the PE in the local domain and the upper-layer autonomous domain. Domain-connected ASBR;

B4. The PE routers in each autonomous domain advertise routes learned from other PE routers or / and ASBs to the CE routers connected to them; the CE routers save them after receiving IPv4 routes or / and IPv6 routes.

The implementation method according to claim 10, wherein the step Β2· further comprises:

The inter-AS routes between the next-layer ΡΕ and the ASBRs connected to the local domain in the upper-layer autonomous domain are stored in the ASBR of the next-layer autonomous domain.

12. The implementation method according to claim 10 or 11, wherein: the step Step B2 further includes:

The PE router learns the IPv4 route and the IPv6 route learned from the CE router according to the VPN and route IP version to which the route identifier RD, the address family identifier AFI, and the subsequent address family identifier SAFI are formed. The RD, AFI, SAFI, and route are formed. Route information of the target group attribute Route Target, IPv4 address/IPv6 address.

13. The method according to claim 10, wherein:

In the step B2, the routing of the user site of the CE connected to the PE is published between the PE and the PE in the autonomous domain, and between the PE and the ASBR through the internal border gateway protocol based on the IP version of the local autonomous domain;

The implementation method according to claim 10, wherein: for an IPv4 user site that needs to access an IPv6 user site, the step B4 includes the following sub-steps:

B41. The CE connected to the IPv4 user site and the PE connected to the CE, and run the IPv6-based routing protocol to learn the route; the PE converts the saved IPv4 user site route from the ABCD/n form to 0::A: B: C: D / (96 + n) IPv6 routing, issued to the CE through the IPv6 routing protocol;

The implementation method of claim 0, wherein: for an IPv6 user site that needs to access an IPv4 user site, the step B4 includes the following sub-steps:

The implementation method according to claim 10, wherein for the IPv4 user site that only accesses the IPv4 user site, in the step B, the CE connected to the IPv4 user site and the PE connected to the CE are connected. Only IPv4 routing protocols are run, and only IPv4 routes of other IPv4 user sites are learned and saved, and IPv6 routes are discarded.

17. The method according to claim 10, wherein:

The implementation method according to claim 6, wherein: in step C, the inner layer label is allocated by the ingress PE, and is used to distinguish different user sites connected by the same ingress PE, The inner label is advertised to the corresponding egress PE along with the route when the route is advertised; the outer label is allocated in an autonomous domain by using a label distribution protocol, a resource reservation protocol, a traffic engineering, or a constrained routing label distribution protocol. Among the different autonomous domains, the ASBR between the autonomous domains is allocated by the multi-protocol external border gateway protocol for the bidirectional connection of the ASBR, which is used for forwarding data packets in the backbone network.

19. The method according to claim 6, wherein the step D comprises the following substeps:

Dl, follow the normal inter-network interconnection protocol forwarding process for the source user site to the ingress PE Data forwarding between internetworking protocols;

D2, performing label data forwarding between the ingress PE and the egress PE;

20. The implementation method according to claim 19, wherein: the step D2 comprises the following sub-steps:

D21, after adding the inner layer label of the destination station to the data packet on the ingress PE, adding an outer label allocated in the autonomous domain where the ingress PE is located;

D24. The ASBR forwards the data packet to the egress PE.

The implementation method according to claim 6, wherein: the topology relationship between the user sites is implemented by matching route target community attributes.