WO2007030970A1 - Systeme de gestion par grappe dans une couche de commutation ethernet et procede associe - Google Patents
Systeme de gestion par grappe dans une couche de commutation ethernet et procede associe Download PDFInfo
- Publication number
- WO2007030970A1 WO2007030970A1 PCT/CN2005/001464 CN2005001464W WO2007030970A1 WO 2007030970 A1 WO2007030970 A1 WO 2007030970A1 CN 2005001464 W CN2005001464 W CN 2005001464W WO 2007030970 A1 WO2007030970 A1 WO 2007030970A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- cluster
- topology
- switch
- protocol module
- local area
- Prior art date
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L45/00—Routing or path finding of packets in data switching networks
- H04L45/46—Cluster building
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L49/00—Packet switching elements
- H04L49/35—Switches specially adapted for specific applications
- H04L49/351—Switches specially adapted for specific applications for local area network [LAN], e.g. Ethernet switches
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L49/00—Packet switching elements
- H04L49/35—Switches specially adapted for specific applications
- H04L49/354—Switches specially adapted for specific applications for supporting virtual local area networks [VLAN]
Definitions
- the present invention relates to a management system and method for an Ethernet switch, and more particularly to a hierarchical management system and method for an Ethernet switch based on a Virtual Local Area Network (VLAN). Background technique
- local management mode using serial port
- remote management mode using the network port, through the Simple Network Management Protocol (SNMP) or Telnet protocol)
- cluster management using cluster management.
- IP Internet Protocol
- the cluster management method combines the advantages of the above two methods.
- a group of switches form a unified management domain, providing an external IP address and a management interface, and providing a pair.
- This management method does not require an IP address for each switch, which greatly saves the IP address resources and reduces the maintenance workload. It is the mainstream way of network device management in the future.
- this management method is based on the proprietary protocols of various vendors, and can only be applied to devices of specific vendors, and cannot implement unified management of devices of different vendors.
- the Chinese invention patent number 1369992A discloses a "low-end switch cluster management method and system", the technology of which is based on the network layer.
- the Chinese invention patent with the publication number 1411214A discloses a "network device management method based on Ethernet technology" and a Chinese invention patent with the publication number 1441569A, which discloses "a cluster management method for network devices", which are managed by the two clusters.
- the implementation of the method is basically the same, including the main contents of device topology discovery and cluster management.
- the device discovered by the otherid2ology can only be limited to the default VLAN that does not use the VLAN tag.
- the device in any specified VLAN cannot be found, and the subsequent cluster management function cannot be completed. This brings a lot of impact to the actual networking application.
- the limitation can not meet the management needs of telecom operators.
- the number of devices that can be managed by the command device is limited. It is impossible to increase without limit, and the requirements for hierarchical management of large-scale networking cannot be realized.
- An effective security authentication mechanism cannot prevent spoofing of illegal devices.
- US Patent No. 6,725,264 discloses a "device and method for redistributing network processing information in a cluster network device", which implements only a method for managing a separate cluster, and does not implement switches having different roles in different clusters. Implement hierarchical management of the cluster.
- US Patent No. 6,725,264 discloses a "device and method for redistributing network processing information in a cluster network device", which implements only a method for managing a separate cluster, and does not implement switches having different roles in different clusters. Implement hierarchical management of the cluster.
- 6,636,499 discloses a "Device and Method for Discovering Clustered Network Devices," which is a switch topology discovery that requires an artificial The process of joining the cluster is determined step by step, and the neighbor device information table of the next hop switch is obtained, and the complete switch topology is established; the patent realizes the discovery of the neighbor device, but the complete switch topology needs to be discovered by the switch (ie, the candidate switch) It is the support of the command machine that joins the cluster and initiates the topology request. It is impossible to automatically discover the complete switch topology when the discovered switch (that is, the independent switch) does not join the cluster. In the case of a cluster, the topology of the peripheral switch is automatically discovered, and the complete switch topology cannot be obtained on the non-command switch. The invention does not mention how to discover the topology in different VLANs. Summary of the invention
- an object of the present invention is to provide a hierarchical cluster management system and method capable of providing neighboring device discovery with a secure authentication mechanism and VLAN-based Ethernet switch.
- an Ethernet switch of the present invention can be a hierarchical cluster management system, including:
- a backbone cluster that is, a cluster with a public network protocol address and a management interface, where the command switch of the backbone cluster is a backbone command switch;
- a regional cluster that is, a sub-cluster connected to the above-mentioned backbone cluster, wherein the switch connecting the backbone cluster and the regional cluster is a cluster border switch;
- a Neighbor Discovery Protocol (NDP) module for implementing a switch to discover its neighbor switch is added to implement extension of other switches in a specified VLAN.
- the cluster is composed of multiple Ethernet switches in the same broadcast domain, that is, in the same VLAN, and the backbone cluster and the regional cluster are established in different VLANs, so that the role of the cluster border switch in the backbone cluster is Member switch, the role of the cluster in the zone to which it belongs is the command switch.
- the NDP protocol module is configured to periodically send neighbor discovery hello packets and perform authentication processing on the received hello packets, establish a corresponding neighbor device information table, and be responsible for status update and aging of the neighbor device information table.
- the TDP protocol module is responsible for In the specified VLAN, the neighbor device information table established by the NDP protocol module is used to send and forward TDP topology collection packets on the relevant ports of a specific VLAN, collect topology information in a certain range of networks, that is, hops, and establish VLAN-based information. Topology information table;
- the above GMP protocol module is responsible for maintaining and managing the cluster, creating/deleting clusters, and adding/removing members.
- the above switches are assigned to different clusters to establish a primary cluster and a backup cluster, thereby implementing cluster management with redundant backups, and preventing the control switch from losing control of the entire cluster once it fails.
- a hierarchical cluster management method for an Ethernet switch of the present invention includes the following steps: Step 1: Using the NDP protocol module to perform neighbor discovery, and establishing a neighbor device information table according to the trust relationship of the neighbor device; Step 2: Use the TDP protocol module to send and forward TDP topology collection packets on the relevant ports of the specific VLAN in the specified VLAN, and collect a certain range of networks, that is, the hop count. Topology information, establishing a topology information table based on the virtual local area network;
- Step 3 Using the GMP protocol module to create/delete clusters, add IJs, and maintain and manage clusters in different VLANs according to the VLAN-based topology information table established by the above TDP protocol module, implement the cluster's command switch and member switches.
- the interactive communication function realizes hierarchical management of the cluster and management of the primary and backup clusters.
- the NDP protocol module is configured to periodically send neighbor discovery hello messages and perform authentication processing on the received hello packets, establish a corresponding neighbor device information table, and be responsible for status update and aging of the neighbor device information table.
- VLAN topology information table The above GMP protocol module is responsible for maintaining and managing clusters, creating/deleting clusters, and adding/removing members.
- the authentication process performed by the NDP protocol module on the received hello packet includes at least a checksum check on the packet and a message digest 5 (hereinafter referred to as MD5) authentication.
- MD5 message digest 5
- the TDP protocol module determines whether to perform 802. lq tag marking according to the VLAN tag of the port when sending the topology request packet, the topology response packet, or the topology request packet. Protocol module is not subject to Whether the discovered switch joins the cluster and the switch that initiates the topology request is a limitation of the command switch. It can automatically discover the switch topology in different VLANs without any switch joining the above cluster.
- the above GMP protocol module can apply different management modes and management policies in different clusters. For example, communication between switches within a cluster can be based on the physical address of the device.
- MAC address Media Access Control (MAC) address
- MAC address can also be based on the assigned private IP address, which provides great flexibility in management.
- the present invention mainly works on the data link layer, and the advantages of the present invention are:
- the neighbor discovers that the authentication mechanism is added, and the fraud of the illegal device is prevented in the initial stage of the cluster management, which establishes a good foundation for the effectiveness of the subsequent cluster management;
- the command switch acts as the unified management and maintenance interface of the cluster.
- the stability of the command switch is critical to the entire cluster. Once the command switch fails, the entire cluster loses contact.
- the cluster management method implemented by the present invention is In different VLANs, switch the switches to different clusters and establish a primary cluster and a backup cluster to implement cluster management with redundant backups. This prevents the command switch from losing control of the entire cluster once it fails. Therefore, the cluster management method implemented by the present invention can meet the management requirements of an actual complex network, and can effectively manage a large number of Ethernet switches.
- FIG. 1 is a typical network networking diagram of cluster management based on the present invention
- FIG. 3 is a packet structure of the NDP protocol, the TDP protocol, and the GMP protocol;
- FIG. 4 is a flowchart of the NDP protocol processing of the switch receiving the neighbor hello message;
- FIG. 5 is a flowchart of the TDP protocol processing of the switch receiving the topology request packet;
- 6 is a network networking diagram with redundant backup cluster management. detailed description
- FIG. 1 is a network diagram of a typical network management based on the cluster management of the present invention.
- a cluster that provides a public IP address and a management interface is called a backbone cluster.
- a sub-cluster connected to a backbone cluster is called a regional cluster.
- a switch with a regional cluster is called a cluster border switch.
- the role of the cluster border switch in the backbone cluster is a member switch.
- the role of the cluster in the area is the command switch.
- the cluster border switch serves as the regional cluster to manage and maintain the backbone cluster. interface.
- the other managed switches are transparent to the outside.
- the system of the present invention adds an NDP protocol module for implementing the switch to discover its neighbor switch based on the original switch protocol stack, and is used to implement the designation.
- FIG. 2 is a flow chart of cluster management of the method of the present invention. As shown in Figure 2, the steps of the cluster management method implemented by the present invention are as follows:
- Step 1 Each switch independently uses the NDP protocol module to discover the neighboring switches around it, and completes the authentication of the neighboring switch according to the configuration, and establishes a neighbor switch information table.
- Step 2 Configure the backbone command switch and configure the backbone command switch. For example, configure the VLAN where the backbone cluster resides.
- Step 3 In the specified VLAN, start the backbone command.
- the TDP protocol module of the switch collects the neighbor switch information discovered by each switch using the above NDP protocol module.
- Table establishing a topology information table;
- Step 4 The backbone command switch adds the candidate switches in the topology information table to the cluster and configures them to become member switches of the backbone cluster.
- Step 5 If necessary, configure the member switches of the backbone cluster as cluster border switches, model the process of establishing backbone clusters, collect switch information in the area, and establish corresponding regional clusters.
- Step 6 After the cluster is set up, the command switch acts as a relay device that interacts with external devices as a member switch of the clusters it manages. It provides a unified management and maintenance interface. All the external packets sent to the member switch are forwarded to the command switch. The switch is forwarded to the corresponding member switch. The response packets from the member switch are sent to the command switch. Give the corresponding external device.
- the core idea of the present invention is to enable clustering in any given VLAN, thereby completing hierarchical management and redundancy management of the cluster.
- the key technology is how to complete the device's neighbor authentication in a specified VLAN, and establish a device topology map based on the specified VLAN, instead of establishing a topology map of the entire network, thereby implementing cluster establishment and effective hierarchical management. It mainly depends on the NDP protocol of the NDP protocol module, the TDP protocol of the TDP protocol module, and the specific implementation of the GMP protocol of the GMP protocol module. As shown in FIG.
- the packet type is NDP or the sending port is not a tag, the tag is not marked.
- the NDP is responsible for periodically sending neighbor discovery hello packets and authenticating the received hello packets, establishing a neighbor device information table, and being responsible for status update and aging of the neighbor device information table.
- the switch sends a neighbor to discover the hello packet, it does not perform any 802.1q marking and sends the packet to the port of the Up link. It is not restricted by the Multiple Spanning Tree Protocol (MSTP) port blocking. It is information about other devices that are directly connected to the device.
- MSTP Multiple Spanning Tree Protocol
- the switch When receiving the hello packet sent by the neighboring device, the switch performs checksum check on the packet, and then performs MD5 authentication on the packet to establish the trust relationship of the neighbor device. For the checksum check or MD5 authentication.
- the device extracts the related device information, establishes or updates the related neighbor device information table, and adopts the policy of directly discarding the packets that have not passed the checksum check or MD5 authentication and makes related records.
- Figure 4 shows the switch receiving neighbors. Flowchart of NDP protocol processing of hello packets.
- the TDP protocol is configured to send and forward TDP topology collection packets on the relevant ports of a specific VLAN in the specified VLANs, and collect topology information in a certain range of networks (that is, hop counts).
- the device that initiates the topology collection is responsible for sending the topology request packet with the specified number of hops to the neighboring device and the MSTP non-blocking port in the specified VLAN.
- the topology request packet is based on the port.
- the configuration of the specified VLAN is marked with the 802.1q tag.
- the discovered switch receives the topology request packet, it first determines the 802.1q tag of the packet and the port VLAN identification (PVID) of the port.
- PVID port VLAN identification
- the VLAN ID of the packet is checked. Then, the MSTP blocking status of the VLAN is checked. If the receiving port is a blocked interface of the MSTP, the packet is discarded. Otherwise, the checksum check is performed to extract the packet that passes the checksum check.
- the information of the topology requesting device is initiated, and the unicast reply is sent to the topology response packet in the VLAN, and then the topology request packet is forwarded to the other non-blocking port of the neighboring device in the VLAN.
- the VLAN tag determines whether the packet is tagged with 802.1q tags until it reaches a certain network range.
- the device that initiates the topology collection obtains the topology information table based on the specified VLAN by processing the topology response packet and extracting related device information.
- topology discovery is not limited by whether the discovered switch joins the cluster and the switch that initiates the topology request is a command switch. It is very flexible for the administrator to understand and analyze the network topology status and perform cluster management. Sex. Figure 4 shows the TDP protocol processing flow chart for the switch to receive topology request packets.
- the GMP protocol is responsible for maintaining and managing the cluster, creating/deleting clusters, adding lj members, and implementing the interactive communication functions of the command machine and member machines of the cluster.
- the commander uses the NDP protocol and the TDP protocol to establish a topology information table based on the specified VLAN
- the GMP protocol can be used to establish a cluster.
- the candidate switch is added to the cluster as a member switch through a certain security trust mechanism.
- the communication mechanism between the switches is
- the management interface can be unified on the operation interface of the command switch based on the physical address (MAC address) of the device or the assigned private IP address, just like operating the local switch, so that the management has Great flexibility.
- clusters based on specified VLANs can be established.
- backbones and regional clusters of different VLANs hierarchical management of clusters can be realized. It relieves the burden of the command switch, breaks through the limitation of the number of switch management, and can also implement different management modes and management strategies for different cluster applications.
- the switch can be assigned to different clusters. Establish a primary cluster and a backup cluster to implement cluster management with redundant backups to prevent the command switch from losing control of the entire cluster once it fails. Therefore, the cluster management method implemented by the present invention can meet the management requirements of the actual complex networking, and can effectively manage the Ethernet switch.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Small-Scale Networks (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Description
一种以太网交换机可分层次的集群管理系统及方法
技术领域
本发明涉及以太网交换机的管理系统及方法,尤其涉及一种基于 虚拟局域网 (Virtual Local Area Network) (以下简称 VLAN) 的以太 网交换机可分层次的集群管理系统及方法。 背景技术
在目前的数据网络环境下, 交换机的管理方式主要分为三种: 本 地管理方式 (利用串口)、 远程管理方式 (利用网口, 通过简单网络 管理协议 ( Simple Network Management Protocol, 简称 SNMP协议) 或者 Telnet协议) 和集群管理方式。
对于本地管理方式, 只需通过串口与管理平台直接相连, 管理手 段相对比较简单, 不需要对交换机配置相应的网际协议 (Internet Protocol) (以下简称 IP) 地址, 节省了宝贵的 IP地址资源。 其缺点 是以太网交换机设备较多 (尤其是低端设备), 地域分散, 每台设备 都需要现场维护, 工作量较大。
对于远程管理方式, 虽然便于远程的管理, 但是需要对每台交换 机配置不同的 IP地址, 在目前 IP地址资源越来越缺乏的情况下, 其 缺陷是不言而喻的。
集群管理方式集中了上述两种方式的优点,由一组交换机构成一 个统一的管理域, 对外提供一个 IP地址和一个管理接口, 并提供对
每个集群成员的管理和访问能力。这种管理方式不需要对每个交换机 都配置 IP地址, 从而大大节省了 IP地址资源, 而且也降低了维护的 工作量, 是未来网络设备管理的主流方式。但目前这种管理方式均是 建立在各家厂商的私有协议的基础上, 只能适用于特定厂商的设备, 还不能实现不同厂商设备的统一管理。
公开号为 1369992A的中国发明专利公布了一种 "低端交换机集 群管理方法和系统", 其技术基于网络层。
公开号为 1411214A的中国发明专利公布了一种 "基于以太网技 术的网络设备管理方法"和公开号为 1441569A的中国发明专利公布 了 "一种网络设备的集群管理方法", 这两种集群管理方法的实现内 容基本相同, 均包括设备拓扑发现和集群管理两部分主要内容。但其 拓扑发现的设备只能局限在不打 VLAN标记的缺省 VLAN中, 不能 发现任意指定的 VLAN 内的设备, 从而无法完成后续的集群管理功 能, 这给实际组网应用带来了很大的局限性, 无法满足电信运营商的 管理需求; 其次其命令设备所能管理的设备数目是有限的, 不可能无 限制的增加, 无法实现大规模组网的分层次管理的需求; 设备发现缺 乏有效的安全认证机制, 无法防止非法设备的欺骗。
专利号为 6,725,264的美国专利公布了一种 "集群网络设备中网 络处理信息重新分布的设备与方法", 其只实现了管理单独集群的方 法, 没有实现交换机在不同集群中具有不同的角色, 不能实现集群的 分层次管理。 专利号为 6,636,499的美国专利公布了一种 "集群网络 设备发现的设备与方法", 该专利的交换机拓扑发现是一个需要人为
逐级确定加入集群, 再获得下一跳交换机邻居设备信息表, 建立完整 的交换机拓扑结构的过程; 该专利实现了邻居设备的发现,但获得完 整的交换机拓扑结构需要被发现交换机(即候选交换机)加入本集群 和发起拓扑请求的是命令机的支持, 无法实现在被发现交换机(即独 立交换机)不加入集群的情况下自动发现完整的交换机拓扑结构, 无 法实现在中间交换机加入非本命令交换机集群的情况下自动发现外 围交换机的拓扑结构,无法在非命令交换机获得完整的交换机拓扑结 构, 该发明对如何发现不同的 VLAN内的拓扑结构没有提及。 发明内容
针对上述集群管理方法的不足和缺陷,本发明的目的是提供一种 能够提供具有安全认证机制邻居设备发现、 基于 VLAN的以太网交 换机可分层次的集群管理系统及方法。
为实现上述目的, 本发明的一种以太网交换机可分层次的集群 管理系统, 包括:
骨干集群, 即对外提供一个公网网际协议地址和一个管理接口 的集群, 其中该骨干集群的命令交换机为骨干命令交换机;
区域集群, 即与上述骨干集群相连的子集群, 其中连接上述骨 干集群与该区域集群的交换机为集群边界交换机; 及
在上述系统的交换机协议栈中增加用于实现交换机发现其邻居 交换机的邻居发现协议 (Neighbor Discovery Protocol ) (以下简称 NDP协议) 模块、 用于实现在指定的 VLAN内对其它交换机进行拓
扑发现的拓扑发现协议 (Topology Discovery Protocol ) (以下简称 TDP协议) 模块和用于集群内部交换机管理的集群管理协议 (Group Management Protocol) (以下简称 GMP协议) 模块。
其中, 上述集群由处于同一广播域中的, 即相同的 VLAN中的 多台以太网交换机组成, 且通过对不同的 VLAN建立骨干集群和区 域集群,使得上述集群边界交换机在上述骨干集群的角色为成员交换 机, 在所属的区域集群的角色为命令交换机。
上述 NDP协议模块负责定时发送邻居发现 hello报文和对接收 到的 hello报文进行认证处理, 建立相应的邻居设备信息表, 并负责 邻居设备信息表的状态更新和老化; 上述 TDP协议模块负责在指定 的 VLAN内, 利用上述 NDP协议模块建立的邻居设备信息表, 在特 定的 VLAN的相关端口发送和转发 TDP拓扑收集报文, 收集一定范 围网络, 即跳数内的拓扑信息, 建立基于 VLAN的拓扑信息表; 上 述 GMP协议模块负责维护和管理集群, 创建 /删除集群, 添加 /删除 成员。
其中,在不同的虚拟局域网内,将上述交换机划归不同的集群, 建立主集群和备份集群, 从而实现具有冗余备份的集群管理, 防止命 令交换机一旦失效, 失去对整个集群的控制。
为实现上述目的, 本发明的一种以太网交换机可分层次的集群 管理方法, 包括以下步骤- 步骤 1 : 利用 NDP协议模块进行邻居发现, 根据邻居设备的信 任关系, 建立邻居设备信息表;
步骤 2:利用 TDP协议模块在指定的 VLAN内,利用上述 NDP 协议模块建立的邻居设备信息表, 在特定的 VLAN的相关端口发送 和转发 TDP拓扑收集报文, 收集一定范围网络, 即跳数内的拓扑信 息, 建立基于虚拟局域网的拓扑信息表;
步骤 3 : 利用 GMP协议模块根据上述 TDP协议模块建立的基 于 VLAN的拓扑信息表, 在不同的 VLAN内, 创建 /删除集群、 添加 IJ除成员、 维护和管理集群, 实现集群的命令交换机和成员交换机 的交互通讯功能, 实现集群的分层次管理和主、 备集群管理。
其中, 上述 NDP协议模块负责定时发送邻居发现 hello报文和 对接收到的 hello报文进行认证处理, 建立相应的邻居设备信息表, 并负责邻居设备信息表的状态更新和老化; 上述 TDP协议模块负责 在指定的 VLAN内,利用上述 NDP协议模块建立的邻居设备信息表, 在特定的 VLAN的相关端口发送和转发 TDP拓扑收集报文, 收集一 定范围网络, 即跳数内的拓扑信息, 建立基于 VLAN的拓扑信息表; 上述 GMP协议模块负责维护和管理集群, 创建 /删除集群, 添加 /删 除成员。
上述 NDP协议模块对接收到的 hello报文进行的认证处理至少 包括对报文进行校验和检查及对报文进行报文整理 5 (Message Digest 5 ) (以下简称 MD5) 认证。
其中,上述 TDP协议模块在发送拓扑请求报文及拓扑响应报文 或转发上述拓扑请求报文时,均需根据端口的 VLAN Tag标记情况决 定上述各报文是否进行 802. lq Tag标记; 上述 TDP协议模块不受被
发现的交换机是否加入集群和发起拓扑请求的交换机是否是命令交 换机的限制,其能在没有任何交换机加入上述集群的情况下自动发现 不同 VLAN内的交换机拓扑结构。
上述 GMP协议模块在不同的集群内能应用不同的管理方式和管 理策略, 例如集群内部交换机间的通讯既可以基于设备的物理地址
(即介质访问控制(Media Access Control) (以下简称 MAC)地址), 也可以基于分配的私有 IP地址, 使管理上具有很大的灵活性。
与现有的集群管理技术相比, 本发明主要工作在数据链路层上, 其本发明优点是:
( 1 ) 能够实现在任意指定的 VLAN内进行交换机的拓扑发现, 不受被发现的交换机是否加入集群和发起拓扑请求的交换机是否是 命令交换机的限制, 进而可以在任意指定的 VLAN 内建立集群, 而 不是仅仅局限在交换机不打 VLAN标记的缺省 VLAN中, 能够满足 电信运营商的管理需求;
(2) 建立骨干集群和区域集群, 允许交换机在不同集群内具有 不同的角色, 从而可以实现交换机集群的分层次管理, 这样不仅减轻 了命令交换机的负担, 突破了交换机管理数量的限制, 而且还可以实 现不同的集群应用不同的管理方式和管理策略,如集群内部交换机间 的通讯既可以基于设备的物理地址 (MAC地址) 也可以基于分配的 私有 IP地址, 使管理上具有很大的灵活性;
(3 ) 邻居发现加入了认证机制, 在集群管理的最初阶段防止了 非法设备的欺骗, 为后续集群管理的有效性建立了良好的基础;
(4) 命令交换机作为集群的统一的管理、 维护接口, 其稳定性 对于整个集群是至关重要的, 命令交换机一旦失效, 整个集群也就失 去了联系, 利用本发明实现的集群管理方法, 在不同的 VLAN 内, 将交换机划归不同的集群, 建立主集群和备份集群, 从而实现具有冗 余备份的集群管理, 防止命令交换机一旦失效, 失去对整个集群的控 制。 因此, 采用本发明实现的集群管理方法, 可以满足实际复杂组网 的管理需求, 能够对数量众多的以太网交换机进行行之有效的管理。
为让本发明的上述和其它目的、特征和优点能更明显易懂, 下文 特举较佳实施例, 并配合说明书附图, 作详细说明如下。
附图说明
图 1是典型的基于本发明集群管理的网络组网图;
图 2是本发明所述方法的集群管理流程图;
图 3是 NDP协议、 TDP协议和 GMP协议的报文帧结构; 图 4是交换机接收邻居 hello报文的 NDP协议处理流程图; 图 5是交换机接收拓扑请求报文的 TDP协议处理流程图; 图 6是具有冗余备份集群管理的网络组网图。 具体实施方式
下面结合附图对本发明的核心内容作进一步的详细说明。
在本发明所提供的以太网交换机可分层次的集群管理系统中,集 群由处于同一广播域中(即相同的 VLAN )的多台以太网交换机组成, 其中管理交换机称为命令交换机,其它被管理的交换机称为成员交换
机, 集群的唯一标识由该集群的命令交换机的设备物理地址 (MAC 地址) 和该集群所处的 VLAN两部分组成。 图 1是典型的基于本发 明集群管理的网络组网图。 如图 1所示, 对外提供一个公网 IP地址 和一个管理接口的集群称为骨干集群,骨干集群的命令交换机称为骨 干命令交换机, 与骨干集群相连的子集群称为区域集群, 连接骨干集 群与区域集群的交换机称为集群边界交换机,其中集群边界交换机在 骨干集群的角色为成员交换机,在所属的区域集群的角色为命令交换 机,集群边界交换机作为区域集群对骨干集群的统一的管理与维护接 口。 除了骨干命令交换机外, 其它被管理的交换机对外均是透明的, 本发明所述系统在原有的交换机协议栈基础上增加了用于实现交换 机发现其邻居交换机的 NDP协议模块、 用于实现在指定的 VLAN内 对其它交换机进行拓扑发现的 TDP协议模块和用于集群内部交换机 管理的 GMP协议模块。
图 2是本发明所述方法的集群管理流程图。如图 2所示, 利用本 发明实现的集群管理方法步骤如下:
步骤 1:各交换机独立利用 NDP协议模块发现其周围的邻居交换 机, 并根据配置的情况完成对邻居交换机的认证, 建立邻居交换机信 息表;
步骤 2: 指定骨干命令交换机, 并对骨干命令交换机进行相应的 配置, 如配置骨干集群所处的 VLAN等;
步骤 3 : 在指定的 VLAN内, 启动骨干命令交换机的 TDP协议 模块收集各交换机利用上述 NDP 协议模块发现的邻居交换机信息
表, 建立拓扑信息表;
步骤 4: 骨干命令交换机将其拓扑信息表内的候选交换机加入到 集群, 并进行相应的配置, 使其成为骨干集群的成员交换机;
步骤 5: 如有需要, 将骨干集群的成员交换机配置成集群边界交 换机, 仿照建立骨干集群的过程, 收集其区域内的交换机信息, 建立 相应的区域集群;
步骤 6: 集群建立后, 命令交换机作为其所辖集群的成员交换机 与外部设备进行交互的中继设备, 对外提供统一的管理、 维护接口。 所有针对成员交换机的外部报文均先发往命令交换机,由命令交换机 解析后再转发给相应的成员交换机;所有来自成员交换机的回应报文 也先发往命令交换机, 由命令交换机解析后再转发给相应的外部设 备。
本发明的核心思想是能够实现在任意指定的 VLAN内建立集群, 从而能够完成集群的分层次的管理与冗余管理。其关键技术在于如何 能在指定的 VLAN内,完成设备的邻居认证,建立基于指定的 VLAN 的设备拓扑图, 而不是建立全网的拓扑图, 从而实现集群的建立和有 效的分层管理,这主要依赖于 NDP协议模块的 NDP协议、 TDP协议 模块的 TDP协议和 GMP协议模块的 GMP协议的具体实现方式。 如 图 3所示是 NDP协议、 TDP协议和 GMP协议的报文帧结构, 其中 上述各报文帧的报文数据内容的长度可变,此外上述各报文帧还包括 目的 MAC地址 (占 6字节)、 源 MAC地址 (即本地交换机的 MAC 地址, 占 6字节)、 802.1q标记域(占 4字节)、 协议类型域(占 2字
节)、 报文类型域 (分为 NDP、 TDP、 GMP, 占 4字节)、 报文长度 (占 2字节) 和报文校验和 (占 2字节), 其中上述 802.1q标记域包 括 VLAN标识(VLAN ID)和优先级, 且当报文类型是 NDP或发送 端口不是 Tag端口时, 不进行 Tag标记。
上述 NDP协议负责定时发送邻居发现 hello报文和对接收到的 hello报文进行认证处理, 建立相应的邻居设备信息表, 并负责邻居 设备信息表的状态更新和老化。 交换机定时发送邻居发现 hello报文 时不进行任何的 802.1q标记, 向链路 Up的端口进行发送, 并且不受 多生成树协议 (Multiple Spanning Tree Protocol) (以下简称 MSTP) 端口阻塞的限制, 目的是获得与设备直接相连的其它设备的相关信 息。 交换机接收到邻居设备发送来的 hello报文时, 首先对报文进行 校验和检查, 然后再对报文进行 MD5认证以确立邻居设备的信任关 系, 对于通过校验和检査或 MD5认证的报文提取相关的设备信息, 建立或更新相关的邻居设备信息表, 对于没有通过校验和检查或 MD5认证的报文采用直接丢弃的策略并作相关的记录, 图 4给出了 交换机接收邻居 hello报文的 NDP协议处理流程图。
上述 TDP协议负责在指定的 VLAN内,利用上述 NDP协议建立 的邻居设备信息表, 在特定的 VLAN的相关端口发送和转发 TDP拓 扑收集报文, 收集一定范围网络(即跳数) 内的拓扑信息, 建立基于 VLAN的拓扑信息表, 用于了解网络拓扑状态和集群管理。发起拓扑 收集的设备负责在指定的 VLAN内, 向有邻居设备相连且 MSTP非 阻塞端口发送指定跳数的拓扑请求报文,拓扑请求报文根据端口在指
定的 VLAN的配置情况进行 802.1q Tag标记; 当被发现的交换机收 到拓扑请求报文后, 首先根据报文的 802.1q Tag情况和端口的端口 VLAN标识 (Port VLAN Identification) (简称 PVID) 确定报文的 VLAN ID, 然后对该 VLAN的 MSTP阻塞状态进行检査, 如果接收 端口是 MSTP的阻塞端口则对报文进行丢弃, 否则进行校验和检查, 对通过校验和检查的报文提取发起拓扑请求设备的信息,在该 VLAN 内直接进行单播回复发送拓扑响应报文, 然后向该 VLAN 内的其它 有邻居设备且 MSTP非阻塞的端口进行拓扑请求报文的转发,转发时 根据端口的 VLAN Tag情况决定报文是否进行 802.1q Tag标记,直至 达到一定的网络范围。这样发起拓扑收集的设备通过对拓扑响应报文 的处理, 提取相关的设备信息, 从而建立起基于指定的 VLAN的拓 扑信息表。由此可见拓扑发现的过程不受被发现的交换机是否加入集 群和发起拓扑请求的交换机是否是命令交换机的限制,给管理员用于 了解分析网络拓扑状态和进行集群管理带来了很大的灵活性。图 4给 出了交换机接收拓扑请求报文的 TDP协议处理流程图。
GMP协议负责维护和管理集群,创建 /删除集群,添加 lj除成员, 实现集群的命令机和成员机的交互通讯功能。 命令机利用 NDP协议 和 TDP协议建立的基于指定的 VLAN的拓扑信息表后, 就可以利用 GMP 协议建立集群, 通过一定的安全信任机制将候选交换机加入集 群成为成员交换机,交换机之间的通讯机制既可以基于设备的物理地 址(MAC地址)也可以基于分配的私有 IP地址, 管理界面统一在命 令交换机的操作界面上, 如同操作本地交换机一样, 使得管理上具有
很大的灵活性。
通过将 NDP协议、 TDP协议和 GMP协议三者有力的结合, 能 够实现基于指定的 VLAN的集群的建立; 通过对不同的 VLAN的骨 干、 区域集群的建立, 能够实现集群的分层次管理, 这样不仅减轻了 命令交换机的负担, 突破了交换机管理数量的限制, 而且还可以实现 不同的集群应用不同的管理方式和管理策略; 在不同 VLAN 内, 如 图 6所示, 可将交换机划归不同的集群, 建立主集群和备份集群, 从 而实现具有冗余备份的集群管理, 防止命令交换机一旦失效, 失去对 整个集群的控制。 因此, 采用本发明实现的集群管理方法, 可以满足 实际复杂组网的管理需求, 能够对以太网交换机进行有效的管理。
以上详细说明了本发明的工作原理,但这只是为了便于理解而举 的一个形象化的实例, 不应被视为是对本发明范围的限制。 同样, 根 据本发明的技术方案及其较佳实施例的描述,可以做出各种可能的等 同改变或替换,而所有这些改变或替换都应属于本发明的权利要求的 保护范围。
Claims
1、一种以太网交换机可分层次的集群管理系统, 其特征在于包 括:
骨干集群, 即对外提供一个公网网际协议地址和一个管理接口 的集群, 其中该骨干集群的命令交换机为骨干命令交换机;
区域集群, 即与上述骨干集群相连的子集群, 其中连接上述骨 干集群与该区域集群的交换机为集群边界交换机; 及
在上述系统的交换机协议栈中增加邻居发现协议模块、 拓扑发 现协议模块和集群管理协议模块。
2、根据权利要求 1所述的系统,其特征在于上述集群由处于同 一广播域中的, 即相同的虚拟局域网中的多台以太网交换机组成, 且 通过对不同的虚拟局域网建立骨干集群和区域集群,使得上述集群边 界交换机在上述骨干集群的角色为成员交换机,在所属的区域集群的 角色为命令交换机。
3、 根据权利要求 2所述的系统, 其特征在于
上述邻居发现协议模块负责定时发送邻居发现 hello报文和对 接收到的 hello报文进行认证处理, 建立相应的邻居设备信息表, 并 负责邻居设备信息表的状态更新和老化;
上述拓扑发现协议模块负责在指定的虚拟局域网内, 利用上述 邻居发现协议模块建立的邻居设备信息表,在特定的虚拟局域网的相 关端口发送和转发拓扑发现协议拓扑收集报文, 收集一定范围网络,
即跳数内的拓扑信息, 建立基于虚拟局域网的拓扑信息表;
上述集群管理协议模块负责维护和管理集群, 创建 /删除集群, 添加 ί除成员。
4、根据权利要求 2所述的系统,其特征在于还包括在不同的虚 拟局域网内,将上述交换机划归不同的集群,建立主集群和备份集群。
5、一种以太网交换机可分层次的集群管理方法,其特征在于包 括以下步骤:
步骤 1 : 利用邻居发现协议模块进行邻居发现, 根据邻居设备 的信任关系, 建立邻居设备信息表;
步骤 2: 利用拓扑发现协议模块在指定的虚拟局域网内, 利用 上述邻居发现协议模块建立的邻居设备信息表,在特定的虚拟局域网 的相关端口发送和转发拓扑发现协议拓扑收集报文,收集一定范围网 络, 即跳数内的拓扑信息, 建立基于虚拟局域网的拓扑信息表;
步骤 3 : 利用集群管理协议模块根据上述拓扑发现协议模块建 立的基于虚拟局域网的拓扑信息表, 在不同的虚拟局域网内, 创建 / 删除集群、 添加 /删除成员、 维护和管理集群。
6、 根据权利要求 5所述的方法, 其特征在于
上述邻居发现协议模块负责定时发送邻居发现 hello 报文和对 接收到的 hello报文进行认证处理, 建立相应的邻居设备信息表, 并 负责邻居设备信息表的状态更新和老化;
上述拓扑发现协议模块负责在指定的虚拟局域网内, 利用上述 邻居发现协议模块建立的邻居设备信息表,在特定的虚拟局域网的相
关端口发送和转发拓扑发现协议拓扑收集报文, 收集一定范围网络, 即跳数内的拓扑信息, 建立基于虚拟局域网的拓扑信息表;
上述集群管理协议模块负责维护和管理集群, 创建 /删除集群, 添加 ί除成员。
7、根据权利要求 6所述的方法,其特征在于上述邻居发现协议 模块对接收到的 hello报文进行的认证处理至少包括对报文进行校验 和检査及对报文进行报文整理 5认证。
8、 根据权利要求 6所述的方法, 其特征在于
上述拓扑发现协议模块在发送拓扑请求报文及拓扑响应报文或 转发上述拓扑请求报文时,均需根据端口的虚拟局域网标记情况决定 上述各报文是否进行 802. lq Tag标记;
上述拓扑发现协议模块不受被发现的交换机是否加入集群和发 起拓扑请求的交换机是否是命令交换机的限制,其能在没有任何交换 机加入上述集群的情况下自动发现不同虚拟局域网内的交换机拓扑 结构。
9、根据权利要求 6所述的方法,其特征在于上述集群管理协议 模块在不同的集群内能应用不同的管理方式和管理策略。
Priority Applications (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN2005800513590A CN101238684B (zh) | 2005-09-12 | 2005-09-12 | 一种以太网交换机可分层次的集群管理系统及方法 |
PCT/CN2005/001464 WO2007030970A1 (fr) | 2005-09-12 | 2005-09-12 | Systeme de gestion par grappe dans une couche de commutation ethernet et procede associe |
Applications Claiming Priority (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
PCT/CN2005/001464 WO2007030970A1 (fr) | 2005-09-12 | 2005-09-12 | Systeme de gestion par grappe dans une couche de commutation ethernet et procede associe |
Publications (1)
Publication Number | Publication Date |
---|---|
WO2007030970A1 true WO2007030970A1 (fr) | 2007-03-22 |
Family
ID=37864608
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/CN2005/001464 WO2007030970A1 (fr) | 2005-09-12 | 2005-09-12 | Systeme de gestion par grappe dans une couche de commutation ethernet et procede associe |
Country Status (2)
Country | Link |
---|---|
CN (1) | CN101238684B (zh) |
WO (1) | WO2007030970A1 (zh) |
Cited By (5)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
WO2009062352A1 (fr) * | 2007-11-13 | 2009-05-22 | Zte Corporation | Procédé de routage de commutateurs par mise en file d'attente |
CN104917719A (zh) * | 2014-03-10 | 2015-09-16 | 国基电子(上海)有限公司 | 用户端网络设备及远程登录的方法 |
CN103731349B (zh) * | 2012-10-16 | 2017-10-03 | 新华三技术有限公司 | 一种以太网虚拟化互联邻居间报文转发方法和边缘设备 |
CN108881412A (zh) * | 2018-05-31 | 2018-11-23 | 郑州云海信息技术有限公司 | 分布式存储集群的统一管理方法、系统、设备及存储介质 |
CN110830301A (zh) * | 2019-11-11 | 2020-02-21 | 国网江苏省电力有限公司检修分公司 | 基于安全加密的电力二次系统站控层拓扑扫描方法及装置 |
Families Citing this family (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN101621417B (zh) * | 2009-08-11 | 2012-01-11 | 中兴通讯股份有限公司 | 管理集群中成员机的方法及交换机 |
CN102036185B (zh) * | 2009-09-29 | 2014-07-09 | 华为技术有限公司 | 设备群组管理的方法、网络节点和通信系统 |
CN104821917B (zh) * | 2015-03-27 | 2018-10-09 | 上海博达数据通信有限公司 | 一种用于虚拟交换机系统的拓扑发现方法 |
Citations (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
JP2003110598A (ja) * | 2001-10-01 | 2003-04-11 | Nippon Telegr & Teleph Corp <Ntt> | スイッチクラスタおよびその構成方法 |
US6654796B1 (en) * | 1999-10-07 | 2003-11-25 | Cisco Technology, Inc. | System for managing cluster of network switches using IP address for commander switch and redirecting a managing request via forwarding an HTTP connection to an expansion switch |
US6856591B1 (en) * | 2000-12-15 | 2005-02-15 | Cisco Technology, Inc. | Method and system for high reliability cluster management |
Family Cites Families (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US6725264B1 (en) * | 2000-02-17 | 2004-04-20 | Cisco Technology, Inc. | Apparatus and method for redirection of network management messages in a cluster of network devices |
CN1213567C (zh) * | 2002-02-27 | 2005-08-03 | 华为技术有限公司 | 一种网络设备的集群管理方法 |
-
2005
- 2005-09-12 CN CN2005800513590A patent/CN101238684B/zh active Active
- 2005-09-12 WO PCT/CN2005/001464 patent/WO2007030970A1/zh active Application Filing
Patent Citations (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US6654796B1 (en) * | 1999-10-07 | 2003-11-25 | Cisco Technology, Inc. | System for managing cluster of network switches using IP address for commander switch and redirecting a managing request via forwarding an HTTP connection to an expansion switch |
US6856591B1 (en) * | 2000-12-15 | 2005-02-15 | Cisco Technology, Inc. | Method and system for high reliability cluster management |
JP2003110598A (ja) * | 2001-10-01 | 2003-04-11 | Nippon Telegr & Teleph Corp <Ntt> | スイッチクラスタおよびその構成方法 |
Cited By (7)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
WO2009062352A1 (fr) * | 2007-11-13 | 2009-05-22 | Zte Corporation | Procédé de routage de commutateurs par mise en file d'attente |
CN103731349B (zh) * | 2012-10-16 | 2017-10-03 | 新华三技术有限公司 | 一种以太网虚拟化互联邻居间报文转发方法和边缘设备 |
CN104917719A (zh) * | 2014-03-10 | 2015-09-16 | 国基电子(上海)有限公司 | 用户端网络设备及远程登录的方法 |
CN104917719B (zh) * | 2014-03-10 | 2018-03-20 | 国基电子(上海)有限公司 | 用户端网络设备及远程登录的方法 |
CN108881412A (zh) * | 2018-05-31 | 2018-11-23 | 郑州云海信息技术有限公司 | 分布式存储集群的统一管理方法、系统、设备及存储介质 |
CN108881412B (zh) * | 2018-05-31 | 2020-09-04 | 郑州云海信息技术有限公司 | 分布式存储集群的统一管理方法、系统、设备及存储介质 |
CN110830301A (zh) * | 2019-11-11 | 2020-02-21 | 国网江苏省电力有限公司检修分公司 | 基于安全加密的电力二次系统站控层拓扑扫描方法及装置 |
Also Published As
Publication number | Publication date |
---|---|
CN101238684A (zh) | 2008-08-06 |
CN101238684B (zh) | 2010-08-18 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
EP3188409B1 (en) | Oam mechanisms for evpn active-active services | |
KR101340495B1 (ko) | 가상 전용 네트워크의 구현 방법 및 시스템 | |
EP2624525B1 (en) | Method, apparatus and virtual private network system for issuing routing information | |
US7489700B2 (en) | Virtual access router | |
US6167052A (en) | Establishing connectivity in networks | |
CN101022394B (zh) | 一种实现虚拟局域网聚合的方法及汇聚交换机 | |
US7835367B2 (en) | Network connection method, network connection system, and, layer 2 switch and management server forming the network connection system | |
WO2007030970A1 (fr) | Systeme de gestion par grappe dans une couche de commutation ethernet et procede associe | |
US20110002240A1 (en) | System and method for creating a transitive optimzed flow path | |
WO2006019536A2 (en) | Obtaining path information related to a virtual private lan services (vpls) based network | |
WO2008037159A1 (fr) | Procédé et dispositif de réseau pour communiquer entre différents composants | |
WO2008119300A1 (fr) | Procédé et dispositif de protection pour service d'arborescence ethernet | |
WO2007076621A1 (fr) | Procede de decouverte automatique de topologie d'echangeur dans un reseau ethernet | |
WO2013020459A1 (zh) | 分布式集群处理系统及其报文处理方法 | |
WO2009082978A1 (fr) | Procédé de protection de réseau d'accès, système et nœud de bord d'accès | |
WO2009082905A1 (fr) | Procédé système et dispositif commutateur permettant l'établissement dynamique de réseau local virtuel de multidiffusion | |
EP3817293B1 (en) | Bulk discovery of devices behind a network address translation device | |
WO2007104201A1 (fr) | Procédé d'acheminement de messages dans un tunnel de services | |
JP4011528B2 (ja) | ネットワーク仮想化システム | |
US10944665B1 (en) | Auto-discovery and provisioning of IP fabric underlay networks for data centers | |
Kuliesius et al. | Sdn/legacy hybrid network control system | |
JP2003324468A (ja) | データ転送システム及びノード装置 | |
Cisco | Cisco IOS Commands | |
Cisco | Creating and Maintaining VLANs | |
Cisco | Creating and Maintaining VLANs |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
121 | Ep: the epo has been informed by wipo that ep was designated in this application | ||
WWE | Wipo information: entry into national phase |
Ref document number: 200580051359.0 Country of ref document: CN |
|
NENP | Non-entry into the national phase |
Ref country code: DE |
|
122 | Ep: pct application non-entry in european phase |
Ref document number: 05784004 Country of ref document: EP Kind code of ref document: A1 |