WO2007033519A1

WO2007033519A1 - A method for updating the access of virtual private dial-network dynamically

Info

Publication number: WO2007033519A1
Application number: PCT/CN2005/001516
Authority: WO
Inventors: Jing Luo
Original assignee: Zte Corporation
Priority date: 2005-09-20
Filing date: 2005-09-20
Publication date: 2007-03-29
Also published as: CN101228765A; CN101228765B

Abstract

A method for updating the cut-in of VPDN dynamically comprises after detecting some faults in a master network server, the wideband accessing server of the said aggregation layer removes the tunnel connection with the master network server. The wideband accessing server transmits a tunnel connection estabilishing request to an backup network server according to the network server configuration information acquired by the authentication of a wideband VPDN subscriber. After receiving a network negotiation protocol message, the wideband accessing server of the said aggregation layer uses a local PPP to record an IP address assigned by the backup network server. The communication message of the subsequent wideband VPDN subscriber have been mapped between the a PPP port and the IP address, and then uses the L2TP to set up the tunnel connection. The method improves the reliability and QoS of the VPDN subscriber access connection, and reduces tunnel working load of the wideband cut-in server.

Description

Method for realizing dynamic update of access of virtual dial-up access network

The present invention relates to a method for maintaining and managing a service of a broadband virtual dial-up access network (VIP) in a communication field, and specifically relates to providing a broadband vpdn service dynamic in a broadband access network. How to refresh the service. Background technique

The broadband vpdn network structure in the prior art is divided according to the access layer, the aggregation layer and the backbone layer. As shown in FIG. 1, the broadband vpdn access network is accessed by the vpdn user access network, and the broadband access server of the convergence layer. The LAC is composed of an LNS server that accesses the public IP network. The access services of the broadband users are authenticated, the L2TP tunnel service selection and other access services are mainly performed by the broadband access server in the network. The LNS completes the L2TP tunnel termination and the configuration management of the private IP address of the vpdn user. The prior art broadband vpdn networks basically adopt a tunneling technology based on the L2TP (Layer 2 Tunneling Protocol) standard protocol. A broadband access server that can complete the LAC (L2TP access aggregation) function at the aggregation layer, completes various aggregation access services for vpdn users, and places a vpdn gateway that can complete the LNS (L2TP network server) function in the private network of the enterprise. In addition to completing the tunnel function, these vpdn gateways usually complete the security protection function for the user data stream, and the vpdn gateway directly accesses the IP public network. Generally, for large and medium-sized enterprise networks, in consideration of the number of vpdn users and the security and reliability of vpn services, multiple LNS servers are usually configured. These LNS servers use the load balancing or priority mode to implement tunnel termination processing for vpdn users. Currently, in the actual application of the service, basically, the networking application of multiple LNSs is implemented based on the priority mode.

As shown in FIG. 2, a typical broadband access server processes a vpdn user PPP session access service software processing flowchart, which mainly includes three stages of PPP link negotiation, A authentication authorization, L2TP tunnel establishment, and PPP data transmission, involving PPP. Protocol processing, three software modules such as AAA and vpdn. According to the current common practice, in the case of two LNS networking based on priority, one processing power is stronger as the primary LNS server, and one processing power is weaker as the standby LNS server, vpdn calls the user for the first time. During the vpdn call, the LAC first selects a tunnel connection with the high-priority LNS based on the configuration data of the LNS. After the connection is established, the vpdn user can access the private network. Then, if the LAC detects the tunnel connection with the LNS. An exception occurs. The LAC clears the tunnel connection with the LNS and notifies the vpdn dial-up user to disconnect the PPP (point-to-point protocol). After the user discovers that the PPP connection is disconnected, the user needs to initiate a vpdn call to the LAC again. When the LNS communication is abnormal, the tunnel connection is established with the standby LNS. The user can continue to access the enterprise private network service. The disadvantage of this method is that the event that the LAC establishes a tunnel connection with the standby LNS must be triggered by the vpdn user to call again, thereby causing vpdn user communication. Interrupt, the user needs to repeat the negotiation process of the ppp call multiple times. Even if the enterprise network is configured with multiple LNS servers, the user cannot implement the dynamic tunnel server selection function, and this method always needs to first and the abnormal primary LNS when each vpdn user initiates a new call. Establish a tunnel connection and establish a tunnel connection with the standby LNS after the establishment fails. This consumes LAC and network communication resources, and also makes the user vpdn call connection processing efficiency low. In the case of a large number of vpdn users, this situation more serious.

Therefore, the prior art has drawbacks that need to be improved and developed. Summary of the invention

The object of the present invention is to provide a method for implementing dynamic update of a virtual dial-up access network, and to improve dynamic tunnel update and maintenance management for a broadband vpdn access user by improving the L2TP processing technology of the existing broadband access service device. The method of the present invention can complete the switching of the tunnel connection from the primary to the standby LNS in the event that the primary LNS is abnormal, without interrupting the ppp connection of the vpdn user, and providing a transparent tunnel selection function for the vpdn user. To improve the quality of the connection service of the vpdn user, to reduce the burden of the LAC tunnel connection processing, and to provide real-time high-reliability services to the vpdn users.

The technical solution of the present invention is as follows:

A method for implementing dynamic update of access of a virtual dial-up access network includes the following steps:

a), the broadband access server of the aggregation layer clears the tunnel connection established with the primary network server after detecting that the primary network server has a communication abnormality;

b), according to the network server configuration information obtained after the broadband virtual dial-up access network user authentication, initiate a tunnel connection establishment request with the standby network server;

c), after receiving the network negotiation protocol packet, the broadband access server of the aggregation layer processes the IP address of the standby network server by using a point-to-point protocol, and the communication of the subsequent broadband virtual dial-up access network user The packet is first mapped to the IP address through the point-to-point protocol port, and then the Layer 2 tunnel protocol tunnel connection is processed.

The method, wherein the step b) further comprises:

Bl), the broadband access server of the aggregation layer sends the proxy link negotiation protocol and the authentication information to the standby network server when negotiating the establishment of the layer 2 tunneling tunnel session with the standby network server;

B2), when receiving the point-to-point protocol negotiation information, the standby network server adopts a point-to-point protocol processing, completes a point-to-point protocol connection establishment for the user, and obtains broadband access to the aggregation layer The server sends a network negotiation protocol packet to complete the user's address allocation operation.

The method, wherein the step c) further comprises:

Cl), configuring service domain information, point-to-point protocol access, and AAA authentication information on the broadband access server of the aggregation layer; C2) When the broadband virtual dial-up access network user initiates a point-to-point protocol call, the broadband access server at the aggregation layer performs AAA authentication to obtain the tunnel configuration information of the layer 2 tunnel protocol, including configuration data of the primary and backup network servers. ;

C3), the broadband access server of the aggregation layer establishes a layer 2 tunnel protocol tunnel connection and session according to the priority according to the Layer 2 tunnel protocol tunnel information returned by the authentication, and after the tunnel establishment is completed, the broadband virtual dialing Access network users access services within the enterprise.

The method, wherein the step a) and the step b) further comprise:

During the access process of the user, the broadband access server of the aggregation layer detects whether the tunnel connection with the primary network server is normal. When the tunnel of the Layer 2 tunnel protocol is abnormal, the broadband access server of the aggregation layer is cleared and The tunnel connection information established by the primary network server is based on the standby network server configuration information returned by the A authentication, and the broadband access server at the aggregation layer initiates a tunnel connection establishment to the standby network server.

The method, wherein the step c) further comprises:

C4), during the negotiation process of the Layer 2 tunnel protocol session, the broadband access server of the aggregation layer forwards the proxy link negotiation protocol and the authentication information to the standby network server by using the incoming connection message, and the standby network server receives the proxy The link negotiation protocol and the authentication information are processed by using a point-to-point protocol, and the point-to-point protocol module on the standby network server completes the proxy link negotiation protocol and the authentication process, and then sends a network negotiation to the broadband access server at the aggregation layer. The protocol packet completes the configuration of the broadband virtual dial-up access network user IP address;

C5), the broadband access server of the aggregation layer uses the point-to-point protocol to process the INTERNET protocol control negotiation protocol message, and the local-to-point protocol module acts as the broadband virtual dial-up access network user INTERNET protocol control negotiation protocol proxy. Complete the network negotiation protocol negotiation process of the local-to-point protocol with the standby network server, and record the IP address corresponding to the point-to-point protocol port.

The method, wherein the step cl) further includes:

Cll), configure the broadband virtual dial-up access network user authentication mode as the remote radius authentication mode, open the point-to-point protocol call processing function on the user access port, and open the Layer 2 tunnel protocol function switch;

Cl2), configure the broadband virtual dial-up access network user account on the remote access dial-up user authentication server, and configure the configuration information of the primary and backup network servers bound to the account, including the network server IP address, tunnel password and priority. ;

Cl3), the proxy link negotiation protocol authentication function is enabled on the peer primary and backup network servers.

The invention provides a method for realizing dynamic update of access of a virtual dial-up access network. In the broadband vpdn network structure, the method for dynamic update of the L2TP tunnel is used to realize real-time access to the internal network service of the vpdn user. Protection, L2TP is completed without the terminal vpdn user re-initiating a ppp call The active/standby switchover of the tunnel connection. The LNS is completely transparent to the terminal vpdn user when an abnormality occurs. The user access service is not affected. Therefore, the reliability of the vpdn user access connection and the connection service quality are improved, and the broadband is reduced. The tunnel processing load of the access server has no special requirements for the LNS, and has no impact on the architecture of the existing vpdn network; its implementation is simple and does not increase the cost of the original product. DRAWINGS

1 is a schematic diagram of a typical broadband vpdn access network structure network topology;

2 is a flowchart of a typical broadband access server processing a vpdn user PPP session access service software; FIG. 3 is a broadband access server software for a vpdn user supporting a dynamic L2TP tunnel update operation to complete a PPP session access service in the method of the present invention; Process flow chart. detailed description

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings.

The method for realizing the dynamic update of the access of the virtual dial-up access network, which implements the dynamic update of the L2TP tunnel, the core idea is: as the broadband access server of the LAC, after detecting the communication abnormality of the active LNS, clear and The tunnel connection established by the primary LNS is used to initiate a tunnel connection establishment request with the standby LNS according to the LNS configuration information obtained by the previous vpdn user authentication. When the L2TP tunnel session is negotiated with the standby LNS, the proxy LCP (link negotiation) is performed. The protocol and the authentication information are sent to the standby LNS. When receiving the PPP negotiation information, the standby LNS completes the ppp connection establishment of the user through the local ppp protocol, and completes the address allocation operation of the user by sending the NCP packet to the LAC.

After receiving the NCP (Network Negotiation Protocol) packet, the LAC forwards it to the local PPP of the LAC for processing. The PPP records the IP address of the standby LNS. The subsequent communication packets of the vpdn user are first mapped to the IP address through the ppp port, and then the L2TP is performed. Handling of tunnel connections. Other ppp control messages in the communication process only need L2TP tunnel processing. The technical solution requires the LAC to support the priority-based LNS group function and the proxy LCP authentication processing function. The LNS supports the proxy LCP and the authentication processing function. Currently, most LNS devices support this function. Others have no special requirements and are processed by the standard LNS. The same way.

The implementation scheme for implementing dynamic update of the L2TP tunnel on the LAC in the method of the present invention includes:

Configure the service DOMAIN information, PPP access, and AAA authentication information on the LAC of the aggregation layer. If the local authentication is required, you need to configure the VPDN user account information and related primary and backup LNS configuration data on the LAC. It is the remote access dial-up user authentication radius authentication. Configure the vpdn user account and LNS information on the remote access dial-up user authentication server (radius server). - When the Vpdn user initiates a PPP call, the aggregation layer LAC performs AAA authentication to obtain L2TP tunnel configuration information, including the configuration data of the primary and backup LNS.

The LAC establishes an L2TP tunnel connection and session with the internal LNS server based on the priority of the L2TP tunnel information returned by the authentication. After the tunnel is established, the vpdn user can access the internal services of the enterprise. During the user access service, the LAC The L2TP hello packet is sent to check whether the tunnel connection with the peer LNS is normal. When the L2TP tunnel is abnormal, the LAC clears the tunnel connection information established with the active LNS and returns the standby LNS configuration information according to the MA authentication. The LAC initiates a tunnel connection to the standby LNS. During the L2TP session negotiation, the LAC forwards the proxy LCP and the authentication information to the standby LNS through the incoming CNCN packet. When the standby LNS receives the proxy LCP and authentication information, the LAC delivers the authentication information to the standby LNS. After the local PPP is processed, the PPP on the standby LNS completes the LCP and the authentication process, and sends an NCP packet to the LAC to complete the configuration of the vpdn user IP address. When the LAC receives the IPCP packet from the Internet Protocol Control Negotiation Protocol, the LAC sends the packet to the local PPP. , local ppp as the vpdn user IPCP proxy completes with the local LNS of the standby LNS The pp NCP negotiation process records the IP address corresponding to the ppp port. When the vpdn user accesses the private network, the ppp packet is processed by the PPP port and IP address mapping processing and L2TP protocol encapsulation on the LAC. Other PPP keepalives, LCP control packets only need to be processed by the L2TP protocol on the LAC.

The service subsystem of the broadband access server of the method of the present invention mainly includes the following parts: The PPP protocol is used to terminate the PPP session connection initiated by the user, and the AAA (Authentication and Accounting Authorization) authentication and authorization module is used. It is used to authenticate and charge users. The L2TP-based vpdn protocol processing module is used to maintain vpdn user L2TP tunnels and session connections.

The software processing flow of the specific embodiment for implementing the L2TP tunnel dynamic update function in the method of the present invention is as follows -

1. Configure the vpdn service domain on the aggregation layer broadband access server LAC. Configure the vpdn user authentication mode as the remote radius authentication mode. Open the ppp call processing function on the user access port and enable the L2TP function switch. Configure the vpdn user account on the dial-up user authentication server (raid) server, and configure the primary and backup LNS configuration information, including the LNS IP address, tunnel password, and priority. The proxy LCP authentication function is enabled on the peer primary and backup LNS. This completes the configuration of vpdn on the LAC and LNS.

2. A vpdn user initiates a PPP session connection request. When the PPP session connection is started, the PPP module requests the AAA to perform the authentication. The AAA sends the user account information to the radius server radius server according to the DOMAIN value in the user name USERNAME@DOMAIN to obtain the primary and backup LNS configurations bound to the user according to the user information. Information, then sent to LA (:.

3. After determining that the vpdn access request service is based on the return information, the PPP requests the vpdn protocol processing module to establish L2TP. Tunnel and session connections. At the same time, the proxy LCP and authentication information negotiated by the PPP module and the vpdn user are handed over to the vpdn module.

4. The Vpdn module first establishes a tunnel and session connection with the active LNS based on the L2TP tunnel configuration information (mainly the IP address of the remote LNS). The primary LNS assigns an IP1 address to the user.

5. The Vpdn module periodically sends an L2TP hello packet to the primary LNS to detect the status of the tunnel connection with the active LNS.

6. After detecting the failure of the primary LNS tunnel connection, the Vpdn module clears the tunnel connection established with the active LNS, and then establishes an L2TP tunnel connection with the standby LNS according to the standby LNS configuration information returned by the authentication. When the vpdn module sends the ICCN to the LNS, the proxy LCP and the authentication information are encapsulated in a packet and sent to the standby LNS. 7. After receiving the ICCN packet, the standby LNS forwards the proxy LCP and authentication information to its own PPP protocol. After completing the proxy LCP and authentication information processing, the PPP protocol sends an IPCP control packet to the LAC, and assigns the new IP2 address to the vpdn user.

8. The vpdn module on the LAC forwards the IPCP packet to the PPP module. The PPP module serves as the user IPCP proxy to negotiate with the IPCP of the PNS on the LNS. Finally record the IP2 assigned by the alternate LNS.

address. The PPP module establishes a mapping of ppp ports to IP2 addresses.

9. After the vpdn user accesses the internal data packet of the enterprise, the LAC needs to go through the LAC.

The PPP port of the PPP module is mapped to the IP2 address. The source IP address of the IP packet is translated from IP1 to IP2 and sent to the LNS. The downstream direction needs to be mapped from the tunnel to the IP1 address through the vpdn module. The IP2 address is restored to the IP1 address. For the vpdn user, the L2TP tunnel encapsulation of the vpdn module is handled in the same way as the general case.

10. The ppp control packet sent by the vpdn user only needs to complete the L2TP tunnel encapsulation process of the vpdn module when passing through the LAC.

Generally, when a vpdn service is implemented in a large and medium-sized enterprise network, in order to meet the needs of more vpdn users to access the intranet, two LNS servers are configured. The general LAC is required to disconnect the L2TP from the active LNS. The vpdn user is notified to disconnect the ppp connection, and then the vpdn user initiates the ppp call again, triggering the LAC to complete the L2TP tunnel connection with the standby LNS.

The technical solution of the present invention utilizes the proxy LCP and the authentication function defined in the L2TP standard to complete the dynamic update of the L2TP tunnel from the primary LNS to the standby LNS through the mapping between the ppp port and the IP address.

As shown in Figure 3, the vpdn access domain is configured on the broadband access server LAC, and the AAA authentication mode is set to the radius remote mode. The PPP call processing function is enabled on the interface accessed by the user, and the vpdn call processing function is enabled. Configure the vpdn account information on the related radius server, and use the account information with the primary LNS and backup. LNS configuration information is bound. The proxy LCP and authentication function switches are turned on on the primary and backup LNSs.

As shown in Figure 3, the PPP0E access user is used as an example. The software processing steps on the broadband access server are as follows:

1. The user performs LCP negotiation with the PPP module.

2. In the user authentication phase, PPP passes the USERNAME@DOMAIN from the user to the MA module for authentication. 3. The AAA module sends the user account USERNAME@DOMAIN information to the remote radius server according to DOMAIN. The radius server obtains the configuration information of the primary LNS and the standby LNS according to the user input DOMAIN, including the ip address, tunnel password and priority. The information is returned to the AAA module, and the AAA module is forwarded to the PPP module.

4. The PPP judges that after the L2TP access service, the vpdn module is requested to establish an L2TP session connection, and the primary LNS and the alternate LNS configuration information and the proxy LCP and the authentication information are forwarded to the vpdn module.

The Vpdn module first establishes a tunnel connection with the active LNS according to the tunnel configuration information. After the tunnel is established, the vpdn user completes the IPCP negotiation process with the active LNS to obtain the IP1 address. The user uses the IP1 address to access the internal service.

The Vpdn module can detect the abnormality of the tunnel connection of the primary LNS by sending an L2TP hello packet periodically. After the connection is abnormal, the vpdn actively clears the tunnel information with the active LNS and the configuration information of the standby LNS tunnel forwarded by the ppp. Initiate a tunnel connection request with the alternate LNS.

7. After the standby LNS receives the proxy LCP and the authentication information from the ICCN packet, it starts the IPCP negotiation operation. -

8. After receiving the IPCP negotiation packet, the Ppp module starts the IPCP proxy function and completes the IPCP negotiation process with the standby LNS. Finally, the standby LNS allocates the IP2 address to the ppp module.

9. The PPP module records the IP2 address and completes the binding of the ppp port to the IP2 address.

10. Subsequent Vpdn users send ppp packets through the PPP port of the PPP module to the IP2 address mapping and tunneling to the IP1 address mapping process, and the L2TP encapsulation process of the vpdn module.

10. The Ppp control packet sent by the Vpdn user can be sent to the standby LNS only after being processed by the L2TP encapsulation of the vpdn module.

12. In the case that the first call of the vpdn user is successful, the vpdn connection can be continued without changing the user's private IP1 address.

By adopting the L2TP tunnel dynamic update method of the invention, the broadband vpdn service is provided to large and medium-sized enterprises, and the existing access service equipment does not involve hardware changes, but the software method is improved, and there is no special for the LNS server. The change request is implemented. The vpdn user completes the switchover of the L2TP tunnel connection from the active LNS to the standby LNS without interrupting the service, which improves the reliability of the service connection of the vpdn user to some extent. It also reduces the burden on the access server to handle the L2TP tunnel connection. This L2TP tunnel dynamic maintenance management method is a cost-effective and practical broadband vpdn service implementation management method.

It is to be understood that the above description of the specific embodiments is intended to be illustrative, and the scope of the invention is intended to be limited.

Claims

Rights request

A method for implementing dynamic update of a virtual dial-up access network, comprising the following steps: a), the broadband access server at the aggregation layer clears the primary network server after detecting that the primary network server has a communication abnormality Established tunnel connection;

2. The method according to claim 1, wherein the step b) further comprises:

B2), when receiving the point-to-point protocol negotiation information, the standby network server adopts a point-to-point protocol process to complete a point-to-point protocol connection establishment to the user, and at the same time, through a broadband access server to the aggregation layer The network negotiation protocol packet is sent to complete the user's address allocation operation.

3. The method according to claim 2, wherein the step c) further comprises:

Cl), the service domain information, the point-to-point protocol access and the AAA authentication information are configured on the broadband access server of the aggregation layer; c2), the broadband virtual dial-up access network user initiates the point-to-point protocol call, the convergence layer broadband The access server performs AAA authentication to obtain Layer 2 tunneling protocol configuration information, including configuration data of the primary and backup network servers;

The method according to claim 3, wherein the step a) and the step b) further comprise: during the user accessing the service, the broadband access server of the aggregation layer detects the peer primary network If the tunnel connection of the server is abnormal, the broadband access server of the aggregation layer clears the tunnel connection information established with the primary network server according to the configuration information of the standby network server returned by the A authentication. The broadband access server of the aggregation layer initiates a tunnel connection establishment to the standby network server.

The method according to claim 4, wherein the step c) further comprises:

C4) During the negotiation of the Layer 2 tunnel protocol session, the broadband access server at the aggregation layer connects the packets through the incoming call. Forwarding the proxy link negotiation protocol and the authentication information to the standby network server, where the standby network server processes the proxy link negotiation protocol and the authentication information by using a point-to-point protocol, and the standby network server is point-to-point After completing the proxy link negotiation protocol and the authentication process, the protocol module sends a network negotiation protocol packet to the broadband access server of the aggregation layer to complete the configuration of the broadband virtual dial-up access network user IP address;

The method according to claim 5, wherein the step cl) further comprises: