WO2011054263A1 - 一种三层虚拟专用网（vpn）的接入方法和接入系统 - Google Patents

一种三层虚拟专用网（vpn）的接入方法和接入系统 Download PDF

Info

Publication number
WO2011054263A1
WO2011054263A1 PCT/CN2010/078124 CN2010078124W WO2011054263A1 WO 2011054263 A1 WO2011054263 A1 WO 2011054263A1 CN 2010078124 W CN2010078124 W CN 2010078124W WO 2011054263 A1 WO2011054263 A1 WO 2011054263A1
Authority
WO
WIPO (PCT)
Prior art keywords
layer
packet
vpn
pseudowire
information
Prior art date
Application number
PCT/CN2010/078124
Other languages
English (en)
French (fr)
Inventor
范亮
宋军
吴波
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2011054263A1 publication Critical patent/WO2011054263A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4641—Virtual LANs, VLANs, e.g. virtual private networks [VPN]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/58—Association of routers
    • H04L45/586—Association of routers of virtual routers

Definitions

  • the present invention relates to a virtual private network (VPN) access technology in network communication, and in particular, to a method and system for accessing a three-layer VPN.
  • VPN virtual private network
  • VPN Virtual Private Network
  • Layer 2 VPN technology provides users with Layer 2 connectivity
  • Layer 3 VPN technology provides Layer 3 connectivity
  • Layer 2 VPN technology has higher security and lower management complexity for operators.
  • users have higher requirements for maintaining their own virtual networks. They are suitable for maintaining network routes within VPNs.
  • Dedicated customers such as finance and public security.
  • the three-tier VPN technology is suitable for small and medium-sized enterprises that cannot manage their own intranet VPN.
  • the carrier maintains a virtual backbone network for customers, minimizes the workload of customers, and reduces the customer's equipment to the easiest, and for security reasons. , can also provide customers with Internet Protocol Security (IP Sec) package service. Therefore, the application of Layer 3 VPN technology has become more and more popular. It is not only widely used in education, transportation, health, energy and other industries.
  • IP Sec Internet Protocol Security
  • the current Layer 3 VPN technology is mainly applied at the aggregation layer or the core layer.
  • the traditional Layer 2 network It has not been able to meet the demand; how to solve the scalability, security and interoperability of the access network has become a key point in access network planning. Concerned about the problem.
  • the types of media used by access networks in various historical periods are also diverse. How to use VPNs with different media types to form a VPN is also a key issue to consider.
  • the existing solution is to deploy a Layer 2 VPN service on the access network, and connect the Layer 2 VPN service and the Layer 3 VPN service through one or two Carrier Edge (PE) devices.
  • PE Carrier Edge
  • the two PEs are connected to each other, that is, one PE device terminates the Layer 2 VPN, and the other PE device initiates the Layer 3 VPN.
  • the number of PEs required in this mode is large, and the media type of the line between the two PEs still needs to be the same as that of the Layer 2 VPN. This requires that the PEs on the Layer 3 VPN edge support multiple link types. The interface, the overall solution costs a lot.
  • the PE device is connected to each other, that is, the same PE device terminates the Layer 2 VPN and initiates Layer 3 VPN.
  • This method can be subdivided into two types.
  • the first type is the physical loopback mode of the PE.
  • the PE needs four physical ports.
  • the first port receives and terminates the packets of the Layer 2 VPN.
  • the second port sends the restored Layer 2 packet, and the third port receives the packet and removes the Layer 2 information of the packet.
  • the Layer 3 information is encapsulated into the packet and sent to the Layer 3 VPN.
  • the fourth port transmits the repackaged packet to the inside of the Layer 3 VPN.
  • This method is similar to the case of two PE devices. Although one PE device is saved, it does not save the number of physical ports, and still needs to support physical ports of various media types.
  • the second type is the internal loopback mode of the PE.
  • the PE needs to support two physical ports and two logical ports.
  • One physical port receives and terminates the Layer 2 VPN.
  • Layer 2 logical port (similar to the second port in the first mode) sends the restored Layer 2 packet to a Layer 3 logical port (similar to the third port in the first mode), and the Layer 3 logical port receives the Layer 2 packet and the Layer 2 information of the packet is removed.
  • the Layer 3 information is encapsulated into the packet and sent to the Layer 3 VPN.
  • Another physical port (similar to the fourth port in the first mode)
  • the repackaged packet is transmitted to the internal layer of the Layer 3 VPN.
  • the second method saves the number of PE devices and saves the number of physical ports.
  • the requirements for the two logical ports are very high, and the Layer 2 logical ports need to support the restoration of Layer 2 packets.
  • the Layer 2 logical port needs to support the decapsulation of the Layer 2 information of the packet. That is, the device still needs to support the decapsulation of Layer 2 packets corresponding to the physical network of the medium.
  • the processing capability of the PE device is still high.
  • the main purpose of the present invention is to provide a method and system for accessing a Layer 3 VPN to improve the scalability of the access network and reduce the complexity of the PE device.
  • the present invention provides a method for accessing a three-layer VPN.
  • the access network accesses a three-layer VPN through an IP pseudowire.
  • the method includes:
  • a mapping relationship between the IP pseudowire and the virtual routing table (VRF) is established on the carrier edge (PE) device that connects the Layer 3 VPN and the access network, and the packet is forwarded according to the mapping relationship.
  • PE carrier edge
  • the PE device When receiving the IP packet from the Layer 3 VPN, the PE device forwards the IP to the IP pseudowire corresponding to the destination IP address according to the destination IP address of the IP packet.
  • the method further includes:
  • the IP packet When the IP packet is received from the IP pseudowire, the IP packet is decapsulated and the pseudowire information is removed. Before the decapsulated IP packet is forwarded to the Layer 3 VPN, the IP packet is forwarded. Encapsulation of three layers of information;
  • the IP packet is decapsulated and the Layer 3 information is removed when the IP packet is received from the Layer 3 VPN.
  • the IP packet is spoofed before the decapsulated IP packet is forwarded to the IP pseudowire. Encapsulation of line information.
  • the method further includes: establishing, by using dynamic learning or static configuration, a correspondence between a destination IP address and an IP pseudowire used when the IP packet is forwarded from the Layer 3 VPN to the IP pseudowire.
  • the PE device that connects the Layer 3 VPN and the access network is a PE device or two PE devices. When two PE devices are connected, the two PE devices are interconnected through logical Layer 2 channels. And establishing the mapping relationship between the IP pseudowire and the VRF, specifically:
  • the mapping between the IP PB and the logical Layer 2 channel is established on the PE device that is directly connected to the access network.
  • the mapping between the logical Layer 2 channel and the VRF is established on the PE device 2 that is directly connected to the Layer 3 VPN.
  • the IP packets are forwarded from the IP pseudowire to the Layer 3 VPN.
  • the PE device When receiving the IP packet from the IP pseudowire, the PE device forwards the IP packet to the PE device through the logical Layer 2 channel according to the mapping relationship between the IP pseudowire and the logical Layer 2 channel; The PE device forwards the IP packet according to the VRF corresponding to the logical Layer 2 channel in the Layer 3 VPN according to the mapping relationship between the logical Layer 2 channel and the VRF and the destination IP address of the IP packet. .
  • the IP packets are forwarded from the Layer 3 VPN to the IP pseudowires.
  • the PE device When receiving the IP address from the Layer 3 VPN, the PE device decapsulates the IP address and removes the Layer 3 information, and then encapsulates the logical Layer 2 information, and encapsulates the IP packet encapsulated with the logical Layer 2 information. Transmitting a logical layer 2 channel to the PE device;
  • the pair of received IP packets of the PE device are decapsulated and the logical layer 2 information is removed, and then Encapsulating the pseudowire information, and forwarding the IP address of the encapsulated pseudowire information to the IP pseudowire corresponding to the destination IP address according to the destination IP address of the IP packet.
  • the present invention also provides a three-layer VPN access system, the system comprising: an access network, a three-layer VPN network, and a PE device connecting the three-layer VPN and the access network, wherein the access network
  • the IP device is connected to the PE device by using an IP pseudowire to perform IP packet exchange with the IP device and the PE device.
  • the Layer 3 VPN is configured to perform IP exchange interaction with the access network by using the PE device and the IP pseudowire;
  • the PE device is configured to establish a mapping relationship between the IP pseudowire and the VRF, and forward the packet according to the mapping relationship.
  • the PE device is further configured to: when receiving an IP packet from the IP pseudowire, searching for a VRF corresponding to the IP pseudowire in the mapping relationship, and determining the destination IP of the IP address
  • the IP address of the IP packet is forwarded to the destination IP address in the Layer 3 VPN.
  • the IP packet is forwarded to the destination IP address according to the destination IP address of the IP packet.
  • the IP pseudowire corresponding to the address is further configured to: when receiving an IP packet from the IP pseudowire, searching for a VRF corresponding to the IP pseudowire in the mapping relationship, and determining the destination IP of the IP address.
  • the PE device is further configured to: when receiving an IP packet from the IP pseudowire, decapsulating the IP packet and removing the pseudowire information; before forwarding the decapsulated IP packet to the Layer 3 VPN Encapsulating the IP packet with three layers of information;
  • the IP packet is decapsulated and the Layer 3 information is removed when the IP packet is received from the Layer 3 VPN.
  • the IP packet is spoofed before the decapsulated IP packet is forwarded to the IP pseudowire. Encapsulation of line information.
  • the PE device is further configured to establish, according to dynamic learning or static configuration, a correspondence between a destination IP address and an IP pseudowire used when the IP packet is forwarded from the Layer 3 VPN to the IP pseudowire.
  • the PE device that connects the Layer 3 VPN and the access network is connected to the PE directly connected to the access network.
  • the device 1 and the PE device directly connected to the Layer 3 VPN are configured, and the PE device 1 and the PE device 2 are interconnected through a logical Layer 2 channel; the PE device establishes a mapping between the IP pseudowire and the logical Layer 2 channel. Relationship: The mapping between the logical Layer 2 channel and the VRF is established on the PE device.
  • the PE device is further configured to forward the IP packet to the PE through a logical Layer 2 channel according to a mapping relationship between the IP pseudowire and the logical Layer 2 channel when receiving the IP packet from the IP pseudowire.
  • Equipment two is further configured to forward the IP packet to the PE through a logical Layer 2 channel according to a mapping relationship between the IP pseudowire and the logical Layer 2 channel when receiving the IP packet from the IP pseudowire.
  • the PE device 2 is further configured to: according to the mapping relationship between the logical Layer 2 channel and the VRF, and the destination IP address of the IP packet, the IP packet in the Layer 3 VPN according to the logic The VRF corresponding to the Layer 2 channel is forwarded.
  • the PE device 2 is further configured to: when receiving the IP packet from the Layer 3 VPN, decapsulating the IP packet and removing the Layer 3 information, and then encapsulating the logical Layer 2 information, and encapsulating the logical Layer 2 information
  • the IP packet is sent to the PE device through a logical Layer 2 channel.
  • the PE device is further configured to: decapsulate the received IP packet and remove the logical layer 2 information, encapsulate the pseudowire information, and encapsulate the pseudowire according to the destination IP address of the IP packet.
  • the IP packet after the information is forwarded to the IP pseudowire corresponding to the destination IP address.
  • the method and system for accessing a three-layer VPN accesses a Layer 3 VPN through an IP pseudowire, and implements IP pseudowire and virtual route forwarding on a PE device connected to the Layer 3 VPN and the access network.
  • the publication of (VRF) mapping enables various types of access links to access the Layer 3 VPN through a unified access network, which improves the access network scalability and security while reducing network construction costs and
  • FIG. 1 is a schematic diagram of connecting a Layer 2 VPN and a Layer 3 VPN through two PE devices in the prior art
  • FIG. 2 is a schematic diagram of connecting a Layer 2 VPN and three through a physical loopback mode of a PE device in the prior art.
  • FIG. 3 is a schematic diagram of connecting a Layer 2 VPN and a Layer 3 VPN through a loopback mode of a PE device in the prior art
  • FIG. 4 is a schematic diagram of a network topology for implementing Layer 3 VPN access in the present invention.
  • FIG. 5 is a schematic diagram of a network topology in which an IP pseudowire and a Layer 3 VPN are connected by two PE devices according to the present invention
  • FIG. 6 is a schematic diagram of a network topology according to Embodiment 1 of the present invention.
  • FIG. 7 is a schematic diagram of a network topology according to Embodiment 2 of the present invention.
  • FIG. 8 is a schematic diagram of a network topology according to Embodiment 3 of the present invention.
  • FIG. 9 is a schematic diagram of a network topology according to Embodiment 4 of the present invention. detailed description
  • the present invention is based on the mechanism of the Layer 2 VPN accessing the Layer 3 VPN, and proposes an IP pseudowire connection for the purpose of cost saving and equipment complexity reduction.
  • the method of entering a three-tier VPN The method is applied to the Layer 3 VPN through the IP pseudowire, and the mapping between the IP pseudowire and the virtual routing and forwarding table (VRF) is implemented on the PE device that connects the Layer 3 VPN and the access network.
  • VRF virtual routing and forwarding table
  • the device forwards the packet according to the mapping between the IP pseudowire and the VRF, so that various types of access links access the Layer 3 VPN through the unified access network, thereby improving the scalability and security of the access network. At the same time, it can reduce the cost of network construction and the complexity of the Layer 3 VPN network, simplify the packet processing process of PE devices, and improve processing efficiency.
  • the IP pseudowire type is OxOOOB, and the Internet Engineering Task Force (IEC) Request for Comments (RFC) is 4446.
  • FIG. 4 it is a schematic diagram of a network topology for implementing Layer 3 VPN access in the present invention. It can be seen that the access network accesses the Layer 3 VPN through IP pseudowires, and various types of access links are unified. The access network is connected to the Layer 3 VPN.
  • the access link can be of any type, including but not limited to Asynchronous Transfer Mode (AM), or Time Division Multiplexing (TDM), or Ethernet.
  • AM Asynchronous Transfer Mode
  • TDM Time Division Multiplexing
  • the method for accessing the Layer 3 VPN of the present invention is described in detail below with reference to the network topology diagram shown in FIG. 4, which mainly includes the following steps:
  • Step 1 Establish a mapping relationship between the IP pseudowire and the VRF on the PE device that connects the Layer 3 VPN and the access network.
  • the PE device that connects the Layer 3 VPN and the access network refers to the PE device that is located at the edge of the Layer 3 VPN and is used to forward IP packets between the access network and the Layer 3 VPN.
  • the PE device that connects the Layer 3 VPN and the access network is PE2.
  • the mapping between the IP pseudowire and the VRF is established on the PE device that connects the Layer 3 VPN and the access network.
  • the purpose is to enable the PE device to forward packets between the IP pseudowire and the Layer 3 VPN according to the established mapping relationship. .
  • Step 2 When receiving the IP packet from the IP pseudowire, the PE device searches for the VRF corresponding to the IP pseudowire in the mapping relationship, and according to the destination IP address of the IP packet, the IP packet is in the Layer 3 VPN. The discovered VRF is forwarded.
  • the PE device After the IP packet is forwarded from the IP pseudowire to the Layer 3 VPN, the PE device that connects the Layer 3 VPN and the access network needs to decapsulate the IP packet and remove the pseudowire information. Then, the Layer 3 information is encapsulated in the IP packet.
  • the PE device searches for the mapping relationship according to the IP pseudowire, obtains the VRF corresponding to the IP pseudowire, and sets the IP packet in the Layer 3 VPN according to the destination IP address of the IP packet. Forward according to the VRF found.
  • step 2 is applied to the network topology shown in FIG. 4, that is, PE1 receives an IP packet from the access link (the format of the packet is in frame format 1), and decapsulates the IP packet.
  • the pseudo-line information is encapsulated (the packet format is as shown in the frame format 2), it is sent to the PE2 through the IP pseudowire of the access network.
  • the packet format is as shown in the figure. Medium Frame format 3), and then encapsulate the three layers of information (the message format is as shown in frame format 4); Then, according to the IP pseudowire, find the corresponding VRF in the established mapping relationship, and according to the destination IP address of the IP packet.
  • the IP packets encapsulated by the Layer 3 information are forwarded in the Layer 3 VPN according to the discovered VRF.
  • Step 3 When receiving the IP packet from the Layer 3 VPN, the PE device forwards the IP ⁇ message to the IP pseudowire corresponding to the destination IP address according to the destination IP address of the IP packet.
  • the PE device When the IP packet is forwarded from the Layer 3 VPN to the IP pseudowire, the PE device that connects the Layer 3 VPN and the access network needs to decapsulate the IP packet and remove the Layer 3 information. Then, the IP packet is encapsulated with the pseudowire information. The PE device forwards the IP packet to the IP pseudowire corresponding to the destination IP address according to the destination IP address of the IP packet. Therefore, when the IP packet is forwarded from the Layer 3 VPN to the IP pseudowire, the mapping between the destination IP address and the IP pseudowire is required. The correspondence can be established on the PE device through static configuration. It is established on the PE device through dynamic learning. The dynamic learning is performed when IP packets are forwarded from the IP pseudowire to the Layer 3 VPN.
  • the PE device when the IP packet is forwarded from the IP pseudowire to the Layer 3 VPN, the PE device records the source IP address and IP address of the IP packet.
  • the correspondence between the source IP address and the IP pseudowire is applied when the IP packet is forwarded from the Layer 3 VPN to the IP pseudowire, which is the correspondence between the IP address and the IP pseudowire.
  • the operation of the step 3 is applied to the network topology shown in FIG. 4, that is, the PE3 performs three-layer information encapsulation on the IP " ⁇ message (the packet format is in the frame format 4), and then forwards the packet to the PE2 through the corresponding VRF;
  • the received IP packet is decapsulated to remove the Layer 3 information (the packet format is as shown in frame format 3), and the pseudowire information is encapsulated (the packet format is in frame format 2);
  • PE2 is based on the purpose of the IP packet.
  • the IP address is forwarded to the IP pseudowire corresponding to the destination IP address and received by the peer PE1.
  • the PE1 decapsulates the received IP packet and removes the pseudowire information and performs the access link encapsulation (the packet format). As shown in the frame format 1), it is forwarded through the access link.
  • a PE device for connecting a Layer 3 VPN and an access network can be a PE device (such as PE2 in Figure 4) or two PE devices. As shown in Figure 5, PE2 is the PE device directly connected to the access network. PE3 is the PE device directly connected to the Layer 3 VPN. PE2 and PE3 pass the logic II. Layer channels (shown as the link in the figure) are interconnected. The link can use any type of link without being consistent with the type of access link.
  • mapping relationship between the IP pseudowire and the VRF specifically: establishing an IP pseudowire and a logic II on the PE device (PE2) directly connected to the access network.
  • the mapping between the Layer 2 channel and the VRF is established on the PE 2 (PE3) directly connected to the Layer 3 VPN.
  • the specific operation is as follows:
  • the PE device (PE2) receives the IP packet from the IP pseudowire, it is based on the IP pseudo-
  • the mapping between the line and the logical Layer 2 channel forwards the IP packet to the PE device 2 (PE3) through the logical Layer 2 channel.
  • the PE device 2 (PE3) maps the relationship between the logical Layer 2 channel and the VRF and the IP packet.
  • the destination IP address forwards IP packets in the Layer 3 VPN according to the VRF corresponding to the logical Layer 2 channel.
  • the change in the message format is shown in the frame format in Figure 5.
  • PE device 2 receives the IP packet from the Layer 3 VPN. Decapsulating and removing the Layer 3 information, and then encapsulating the logical Layer 2 information, searching for the corresponding logical Layer 2 channel according to the IP packet forwarded by the Layer 3 VPN, and the IP packet encapsulating the logical Layer 2 information is searched.
  • the logical Layer 2 channel is sent to the PE device (PE2); the PE device (PE2) decapsulates the received IP packet and removes the logical Layer 2 information, encapsulates the pseudowire information, and according to the destination IP address of the IP packet.
  • the IP packet encapsulated with the pseudowire information is forwarded to the IP pseudowire corresponding to the destination IP address.
  • the change in the message format is shown in the frame format in Figure 5.
  • Embodiment 1 of the present invention is a backhaul scenario of a mobile base station, as shown in FIG.
  • the base station side gateway (PE1), the aggregation layer device (PE2), and the controller side gateway (PE3) are connected to the base station controller.
  • the mobile backhaul traffic of different mobile operators is supported in the same network, and different operators are supported to share the base station.
  • An IP pseudowire is established between the PE1 and the PE2, and in this embodiment, a pseudo-line of different priorities can be established for different types of services of the operator. In the scenario where the multi-operator shares the base station, it can also be used by different operators.
  • the business establishes different pseudowires.
  • PE2 and PE3 are in the same Layer 3 VPN. Create a mapping between IP pseudowires and VRFs on PE2. For example, map IP pseudowires of the same carrier to the same VRF.
  • the IP packet of the base station is transmitted to the PE2 through the PE1 in the manner of the IP pseudowire.
  • the PE2 searches for the corresponding VRF from the foregoing mapping relationship according to the IP pseudowire, and sends the IP4 packet to the Layer 3 VPN according to the found VRF.
  • PE3 The PE3 sends the received IP packet to the base station controller through the uplink.
  • the IP packet on the controller side is connected to the Layer 3 VPN on PE3 and forwarded to PE2 through the corresponding VRF.
  • PE2 terminates the Layer 3 VPN and encapsulates the corresponding pseudowire information. Then, according to the destination IP address of the IP address, After the pseudowire information is encapsulated, the IP packet is forwarded to the PE1 through the IP pseudowire.
  • the PE1 then sends the received IP packet to the mobile base station through the access link.
  • the second embodiment of the present invention is a scenario in which the enterprise network carries the bearer.
  • the gateways of the same enterprise access the Layer 3 VPN network through the access side PE device (PE1) and the convergence layer PE device (PE2).
  • Layer VPNs form the interconnection of gateways everywhere.
  • the PE2 may be a service router (SR, Service Router) or a broadband remote access server (BRAS).
  • SR service router
  • BRAS broadband remote access server
  • An IP pseudowire is set up between PE1 and PE2.
  • PE2 and PE3 are in the same Layer 3 VPN.
  • the mapping between the IP pseudowire and the VRF is established on the PE2.
  • the IP pseudowires of the same enterprise are mapped to the same VRF.
  • the IP packet sent by the enterprise gateway is transmitted to the PE2 through the PE1 in the manner of the IP pseudowire.
  • the PE2 searches for the corresponding VRF from the foregoing mapping relationship according to the IP pseudowire, and sends the IP packet to the Layer 3 VPN according to the discovered VRF.
  • the third embodiment of the present invention is a backhaul scenario of the mobile base station, which is different from the first embodiment in that
  • the mobile base station is connected to the base station controller through different operator networks or different management domains of the same carrier.
  • the mobile backhaul traffic of different mobile operators is supported to be transmitted in the same network, and different operators are supported to share the base station.
  • An IP pseudowire is established between the PE1 and the PE2, and in this embodiment, a pseudo-line of different priorities can be established for different types of services of the operator. In the scenario where the multi-operator shares the base station, it can also be used by different operators.
  • the business establishes different pseudowires.
  • a logical Layer 2 channel such as a virtual local area network (VLAN), is mapped between the PE2 and the PE3.
  • the logical Layer 2 channel is mapped to the IP pseudowire on the PE2.
  • the IP carrier of the same mobile operator corresponds to the IP pseudowire.
  • VLAN virtual local area network
  • the same carrier's pseudo-line outer VLAN is the same, the inner VLAN is different from the different pseudo-wires, and the logical Layer 2 channel is mapped to the VRF on PE3.
  • VLAN and VRF are corresponding to each other, or the outer VLAN of the above two-layer VLAN mode corresponds to VRF.
  • the IP packet of the base station is transmitted to the PE2 through the PE1 in the manner of the IP pseudowire.
  • the PE2 forwards the IP packet to the PE3 through the logical Layer 2 channel according to the mapping between the IP pseudowire and the logical Layer 2 channel.
  • the PE3 is based on the above logic.
  • the mapping between the Layer 2 channel and the VRF is connected to the Layer 3 VPN, and the IP packets are forwarded in the VRF corresponding to the logical Layer 2 channel.
  • the IP packet of the base station controller is connected to the Layer 3 VPN on the PE4 and forwarded to the PE3 through the corresponding VRF.
  • the PE3 terminates the Layer 3 VPN and encapsulates the logical Layer 2 channel information corresponding to the IP packet to PE2.
  • the logical Layer 2 channel or the destination IP address finds the corresponding IP pseudowire, and the IP packet is encapsulated according to the pseudowire information and sent to the PE1.
  • the fourth embodiment of the present invention is a traditional base station clock synchronization method in a backhaul scenario of a mobile base station.
  • the mobile base station passes through a base station side gateway (PE1) and an aggregation layer device of an access device (AN, Access Node).
  • the PE2) and the controller side gateway (PE3) are connected to the base station controller, wherein the AN and the PE1 may be the same device, and the clock source and the base station controller and/or the controller
  • the side gateways are connected.
  • the clock signal is transmitted in the network through the IP packet encapsulation format.
  • An IP pseudowire is established between PE1 and PE2.
  • the pseudowire can be a pseudowire configured for transmitting signals or a pseudowire shared with data packets and marking clock packets with high priority.
  • PE2 and PE3 are in the same Layer 3 VPN.
  • the mapping between the IP pseudowire and the VRF is established on the PE2. For example, the IP pseudowires corresponding to all the base stations sharing the same clock source are mapped to the same VRF.
  • the clock signal sent by the clock source is converted into an IP packet by the base station controller or the controller side gateway.
  • the packet is connected to the Layer 3 VPN on the PE3 and forwarded to the PE2 through the corresponding VRF.
  • the PE2 terminates the Layer 3 VPN and encapsulates the corresponding packet.
  • the pseudowire information is then forwarded to the PE1 through the IP pseudowire according to the destination IP address of the IP packet.
  • the PE1 then sends the received IP packet to the AN through the access link.
  • the IP packet is converted into a clock signal and sent to the base station.
  • the PE1 directly converts the IP packet into a clock signal and sends it to the base station.
  • the three-layer VPN access system is composed of an access network, a three-layer VPN network, and a PE device that connects the three-layer VPN and the access network.
  • the access network is connected to the PE device through an IP pseudowire, and is used to perform IP packet exchange through the IP pseudowire and the PE device and the Layer 3 VPN.
  • the Layer 3 VPN is used to exchange IP packets with the access device through the PE device and the IP pseudowire.
  • the PE device is configured to establish a mapping relationship between the IP pseudowire and the VRF, and forward the packet according to the mapping relationship. Specifically, when receiving an IP packet from the IP pseudowire, the device searches for the IP pseudowire in the mapping relationship.
  • the IP packet is forwarded according to the VRF in the Layer 3 VPN.
  • the IP address of the IP packet will be based on the destination IP address of the IP packet.
  • the IP " ⁇ " text is forwarded to the IP pseudowire corresponding to the destination IP address.
  • the PE device is further configured to decapsulate the IP packet and remove the pseudowire information when receiving the IP packet from the IP pseudowire; and before forwarding the decapsulated IP packet to the Layer 3 VPN, Packets are encapsulated in three layers of information; The IP packet is decapsulated and the Layer 3 information is removed when the IP packet is received from the Layer 3 VPN. The IP packet is encapsulated in the IP packet before being forwarded to the IP pseudowire. .
  • the PE device that connects the Layer 3 VPN and the access network is composed of a PE device directly connected to the access network and a PE device directly connected to the Layer 3 VPN.
  • the PE device 1 and the PE device 2 pass the logical Layer 2 The channel is interconnected.
  • the mapping between the IP pseudo-line and the logical Layer 2 channel is established on the PE device.
  • the mapping between the logical Layer 2 channel and the VRF is established on the PE device.
  • the PE device When receiving the IP packet from the IP pseudowire, the PE device forwards the IP packet to the PE device 2 through the logical Layer 2 channel according to the mapping between the IP pseudowire and the logical Layer 2 channel. Correspondingly, the PE device is based on the PE device. The mapping between the logical Layer 2 channel and the VRF and the destination IP address of the IP packet are forwarded in the Layer 3 VPN according to the VRF corresponding to the logical Layer 2 channel.
  • the PE device When receiving the IP packet from the Layer 3 VPN, the PE device decapsulates the IP packet and removes the Layer 3 information, and then encapsulates the logical Layer 2 information.
  • the IP packet encapsulated with the logical Layer 2 information passes through the logical Layer 2 channel.
  • the PE device decapsulates the received IP packet and removes the logical Layer 2 information, encapsulates the pseudowire information, and encapsulates the pseudowire information according to the destination IP address of the IP packet.
  • the IP packet is forwarded to the IP pseudowire corresponding to the destination IP address.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Description

一种三层虚拟专用网 （VPN) 的接入方法和接入系统 技术领域
本发明涉及网络通信中的虚拟专用网 （VPN )接入技术， 尤其涉及一 种三层 VPN的接入方法和系统。 背景技术
虚拟专用网 （VPN, Virtual Private Network )技术已经在数据通信领域 广泛使用， 运营商通过 VPN技术为大型企业、 中小型企业、 政府、 教育行 业等提供专网业务。
当前普遍釆用的 VPN技术主要有两种， 分别是二层 VPN技术和三层 VPN技术， 二层 VPN技术为用户提供二层的连接， 三层 VPN技术则提供 三层的连接。 二层 VPN技术的安全性较高， 且对运营商来说管理复杂度较 低， 但对于用户对自身虚拟网络的维护能力的要求也较高， 其适用于有足 够能力自己维护 VPN内网络路由的专用客户， 如金融和公安等。 三层 VPN 技术适用于没有能力管理自己 VPN内网络的中小型企业， 运营商为客户维 护虚拟主干网络， 将客户的工作量减到最小， 将客户的设备降低到最简单， 同时出于安全考虑， 还可以为客户提供 Internet协议安全性（IP Sec )夕卜包 服务。 因此， 三层 VPN技术的应用已经越来越普遍， 不仅广泛应用于教育、 交通、 卫生、 能源等行业， 金融、 政府、 电信的行业的非核心业务也逐渐 釆用三层 VPN技术部署网络。
目前的三层 VPN技术主要应用在汇聚层或核心层， 而随着网络规模的 快速增长和网络安全威胁的日益严重， 接入网络的可扩展性和安全性显得 越发重要， 传统的二层网络已经不能满足需求； 如何解决接入网络的可扩 展性、 安全性及与汇聚网络的互通性， 已经成为接入网络规划时要重点考 虑的问题。 另外， 接入网络在各个历史时期所釆用的接入线路的介质类型 也多种多样， 如何釆用不同介质类型的接入线路组成 VPN也是一个需要重 点考虑的问题。
现有的解决方案是在接入网络中部署二层 VPN业务， 将二层 VPN业 务和三层 VPN业务通过一台或两台运营商边缘（ PE , Provider Edge )设备 衔接。
如图 1所示， 为通过两台 PE设备衔接的方式， 即一台 PE设备终结二 层 VPN, 另一台 PE设备发起三层 VPN。 这种方式需要的 PE设备数量多， 且两台 PE设备之间线路的介质类型仍然需要与二层 VPN的接入侧线路相 同， 这就要求三层 VPN边缘的 PE设备支持多种链路类型的接口， 整体方 案所需成本较大。
通过一台 PE设备衔接的方式，即同一台 PE设备终结二层 VPN并发起 三层 VPN。 这种方式又可以细分为两种， 第一种是 PE设备物理环回方式， 如图 2所示， 该 PE设备需要四个物理端口， 第一个端口接收并终结二层 VPN的报文， 第二个端口将还原出来的二层报文发送出来， 第三个端口接 收该报文并去除该报文的二层信息， 将三层信息封装进该报文并送入三层 VPN, 第四个端口将该重新封装后的报文向三层 VPN内部传送。 这种方式 类似两台 PE设备的情况， 虽然节省了一台 PE设备， 但并没有节约物理端 口数量， 而且仍然需要支持各种介质类型的物理端口。
第二种是 PE设备内部环回方式， 如图 3所示， 该 PE设备需要支持两 个物理端口和两个逻辑端口， 一个物理端口接收并终结二层 VPN的 4艮文， 并通过一个二层逻辑端口 （类似第一种方式的第二个端口）将还原出的二 层报文发送给一个三层逻辑端口 （类似第一种方式的第三个端口）， 该三层 逻辑端口接收该二层报文并去除该报文的二层信息， 将三层信息封装进该 文并送入三层 VPN, 另一个物理端口 （类似第一种方式的第四个端口） 将该重新封装后的报文向三层 VPN内部传送。 第二种方式既节约了 PE设 备的数量， 也节省了物理端口的数量， 但存在的问题是： 对两个逻辑端口 的要求很高， 二层逻辑端口需要支持二层报文的还原； 三层逻辑端口需要 支持对该报文二层信息的解封装， 即设备内部仍然需要支持对各种介质物 理网络对应的二层报文的解封装， 对 PE设备的处理能力要求仍然较高。
因此， 现有技术在实现接入网络连接到汇聚 /核心网络的三层 VPN时， 仍然存在接入网络的可扩展性较低， PE设备的复杂度较高等问题。 发明内容
有鉴于此， 本发明的主要目的在于提供一种三层 VPN的接入方法和系 统， 以提高接入网络的可扩展性， 降低 PE设备的复杂度。
为达到上述目的， 本发明的技术方案是这样实现的：
本发明提供了一种三层 VPN的接入方法，接入网络通过 IP伪线接入三 层 VPN, 该方法包括：
在衔接所述三层 VPN和接入网络的运营商边缘（ PE )设备上， 建立 IP 伪线与虚拟路由转发表（VRF ) 的映射关系， 并根据所述映射关系进行报 文转发。
所述根据映射关系进行 IP伪线与三层 VPN之间的报文转发， 具体为： 所述 PE设备从 IP伪线上接收到 IP报文时， 在所述映射关系中查找与 所述 IP伪线对应的 VRF, 并根据所述 IP报文的目的 IP地址， 将所述 IP报 文在三层 VPN中按照查找的 VRF进行转发；
所述 PE设备从三层 VPN接收到 IP报文时， 根据 IP报文的目的 IP地 址， 将所述 IP 转发到目的 IP地址对应的 IP伪线上。
该方法进一步包括：
在从 IP伪线上接收到 IP报文时， 对所述 IP报文进行解封装并去除伪 线信息； 在将解封装的 IP报文转发到三层 VPN之前， 对所述 IP报文进行 三层信息的封装；
在从三层 VPN接收到 IP报文时， 对所述 IP报文进行解封装并去除三 层信息； 在将解封装的 IP报文转发到 IP伪线之前， 对所述 IP报文进行伪 线信息的封装。
该方法进一步包括： 在 IP报文从三层 VPN转发到 IP伪线时所用到的 目的 IP地址与 IP伪线的对应关系， 通过动态学习或静态配置的方式建立。
所述衔接三层 VPN和接入网络的 PE设备， 为一台 PE设备、 或两台 PE设备； 当为两台 PE设备时， 所述两台 PE设备之间通过逻辑二层通道互 连， 且所述建立 IP伪线与 VRF的映射关系， 具体为：
在与接入网络直连的 PE设备一上建立 IP伪线与逻辑二层通道的映射 关系，在与三层 VPN直连的 PE设备二上建立逻辑二层通道与 VRF的映射 关系。
当衔接三层 VPN和接入网络的 PE设备为两台 PE设备时， IP报文从 IP伪线转发到三层 VPN具体为：
所述 PE设备一从 IP伪线上接收到 IP报文时，根据 IP伪线与逻辑二层 通道的映射关系， 将所述 IP报文通过逻辑二层通道转发到所述 PE设备二； 所述 PE设备二根据逻辑二层通道与 VRF的映射关系、 以及所述 IP报 文的目的 IP地址， 将所述 IP报文在三层 VPN中按照与所述逻辑二层通道 对应的 VRF进行转发。
当衔接三层 VPN和接入网络的 PE设备为两台 PE设备时， IP报文从 三层 VPN转发到 IP伪线具体为：
所述 PE设备二从三层 VPN接收到 IP 文时， 对所述 IP ^艮文进行解 封装并去除三层信息， 再封装逻辑二层信息， 将封装逻辑二层信息后的 IP 报文通过逻辑二层通道发送给所述 PE设备一；
所述 PE设备一对接收的 IP报文进行解封装并去除逻辑二层信息， 再 封装伪线信息，并根据所述 IP报文的目的 IP地址，将封装伪线信息后的 IP "^艮文转发到目的 IP地址对应的 IP伪线上。
本发明还提供了一种三层 VPN的接入系统， 该系统包括： 接入网络、 三层 VPN网络、 以及衔接所述三层 VPN和接入网络的 PE设备， 其中， 所述接入网络通过 IP伪线与所述 PE设备相连，用于通过所述 IP伪线， 以及 PE设备与所述三层 VPN进行 IP报文交互；
所述三层 VPN, 用于通过所述 PE设备， 以及 IP伪线与所述接入网络 进行 IP 艮文交互；
所述 PE设备， 用于建立 IP伪线与 VRF的映射关系， 并根据所述映射 关系进行报文转发。
所述 PE设备进一步用于， 从 IP伪线上接收到 IP报文时， 在所述映射 关系中查找与所述 IP伪线对应的 VRF,并才艮据所述 IP ^艮文的目的 IP地址， 将所述 IP报文在三层 VPN中按照查找的 VRF进行转发；从三层 VPN接收 到 IP报文时， 根据 IP报文的目的 IP地址， 将所述 IP报文转发到目的 IP 地址对应的 IP伪线上。
所述 PE设备进一步用于， 在从 IP伪线上接收到 IP报文时， 对所述 IP 报文进行解封装并去除伪线信息； 在将解封装的 IP报文转发到三层 VPN 之前， 对所述 IP报文进行三层信息的封装；
在从三层 VPN接收到 IP报文时， 对所述 IP报文进行解封装并去除三 层信息； 在将解封装的 IP报文转发到 IP伪线之前， 对所述 IP报文进行伪 线信息的封装。
所述 PE设备进一步用于，通过动态学习或静态配置的方式，建立在 IP 才艮文从三层 VPN转发到 IP伪线时所用到的目的 IP地址与 IP伪线的对应关 系。
所述衔接三层 VPN和接入网络的 PE设备， 由与接入网络直连的 PE 设备一， 以及与三层 VPN直连的 PE设备二组成， 所述 PE设备一与 PE设 备二通过逻辑二层通道互连； 所述 PE设备一上建立 IP伪线与逻辑二层通 道的映射关系， 所述 PE设备二上建立逻辑二层通道与 VRF的映射关系。
所述 PE设备一进一步用于， 从 IP伪线上接收到 IP报文时， 根据 IP 伪线与逻辑二层通道的映射关系， 将所述 IP报文通过逻辑二层通道转发到 所述 PE设备二；
相应的， 所述 PE设备二进一步用于， 根据逻辑二层通道与 VRF的映 射关系、 以及所述 IP报文的目的 IP地址， 将所述 IP报文在三层 VPN中按 照与所述逻辑二层通道对应的 VRF进行转发。
所述 PE设备二进一步用于，从三层 VPN接收到 IP报文时， 对所述 IP 报文进行解封装并去除三层信息， 再封装逻辑二层信息， 将封装逻辑二层 信息后的 IP报文通过逻辑二层通道发送给所述 PE设备一；
相应的， 所述 PE设备一进一步用于， 对接收的 IP报文进行解封装并 去除逻辑二层信息， 再封装伪线信息， 并根据所述 IP报文的目的 IP地址， 将封装伪线信息后的 IP报文转发到目的 IP地址对应的 IP伪线上。
本发明所提供的一种三层 VPN的接入方法和系统，通过 IP伪线方式接 入三层 VPN,并在衔接三层 VPN和接入网络的 PE设备上实现 IP伪线与虚 拟路由转发表（VRF ) 的映射， 使得各种类型的接入链路通过统一的接入 网络接入到三层 VPN, 在提高接入网络可扩展性和安全性的同时， 还能降 低建网成本和三层 VPN中用于衔接接入网络和三层 VPN的 PE设备的复杂 度， 简化了 PE设备的报文处理流程， 提高了处理效率。 附图说明
图 1为现有技术中通过两台 PE设备衔接二层 VPN与三层 VPN的拓朴 示意图；
图 2为现有技术中通过一台 PE设备物理环回方式衔接二层 VPN与三 层 VPN的拓朴示意图；
图 3为现有技术中通过一台 PE设备内部环回方式衔接二层 VPN与三 层 VPN的拓朴示意图；
图 4为本发明中实现三层 VPN接入的网络拓朴示意图；
图 5为本发明中通过两台 PE设备衔接 IP伪线和三层 VPN的网络拓朴 示意图；
图 6为本发明实施例一的网络拓朴示意图；
图 7为本发明实施例二的网络拓朴示意图；
图 8为本发明实施例三的网络拓朴示意图；
图 9为本发明实施例四的网络拓朴示意图。 具体实施方式
下面结合附图和具体实施例对本发明的技术方案进一步详细阐述。 为实现通过接入网络连接到汇聚 /核心网络的三层 VPN, 本发明基于二 层 VPN接入三层 VPN的机制， 针对节约成本和降低设备复杂性的需求， 提出一种通过 IP伪线接入三层 VPN的方法。 该方法通过 IP伪线方式接入 三层 VPN,并在衔接三层 VPN和接入网络的 PE设备上实现 IP伪线与虚拟 路由转发表 ( VRF , Virtual Routing and Forwarding ) 的映射， 由该 PE设备 根据 IP伪线与 VRF的映射进行报文的转发，从而使得各种类型的接入链路 通过统一的接入网络接入到三层 VPN, 在提高接入网络可扩展性和安全性 的同时， 还能降低建网成本和三层 VPN网络的复杂度， 简化 PE设备的报 文处理流程， 提高处理效率。 其中， IP伪线的类型为 OxOOOB, 互联网工程 任务组 ( IETF, Internet Engineering Task Force )请求评议 ( RFC, Request For Comments ) 4446。
如图 4所示， 为本发明中实现三层 VPN接入的网络拓朴示意图。 可以 看出， 接入网络通过 IP伪线接入三层 VPN, 各种类型的接入链路通过统一 的接入网络接入到三层 VPN。 接入链路可以为任意类型， 包括但不限于异 步传输模式（ ATM, Asynchronous Transfer Mode )、或时分复用（ TDM, Time Division Multiplexing )、 或以太网。
下面结合图 4所示的网络拓朴示意图， 对本发明三层 VPN的接入方法 进行详细阐述， 该方法主要包括以下步骤：
步骤 1 ,在衔接三层 VPN和接入网络的 PE设备上，建立 IP伪线与 VRF 的映射关系。
所谓衔接三层 VPN和接入网络的 PE设备，是指位于三层 VPN边缘的， 用于执行 IP报文在接入网络和三层 VPN之间转发的 PE设备。 例如， 在图 4所示的网络拓朴中， 衔接三层 VPN和接入网络的 PE设备即为 PE2。
在衔接三层 VPN和接入网络的 PE设备上建立 IP伪线与 VRF的映射 关系， 其目的是使该 PE设备能够根据建立的映射关系进行 IP伪线与三层 VPN之间的报文转发。
步骤 2, PE设备从 IP伪线上接收到 IP报文时， 在映射关系中查找与 IP伪线对应的 VRF, 并根据 IP报文的目的 IP地址， 将 IP报文在三层 VPN 中按照查找的 VRF进行转发。
在 IP报文从 IP伪线转发到三层 VPN时，衔接三层 VPN和接入网络的 PE设备接收到 IP报文后， 需要对该 IP报文进行解封装， 去除其中的伪线 信息， 然后在 IP报文中封装三层信息； 该 PE设备根据 IP伪线查找映射关 系， 获取与 IP伪线对应的 VRF, 并根据 IP报文的目的 IP地址， 将 IP报文 在三层 VPN中按照查找的 VRF进行转发。
步骤 2的操作应用于图 4所示的网络拓朴中， 即 PE1从接入链路上接 收 IP报文（其报文格式如图中帧格式 1 ) , 对该 IP报文进行解封装并执行 伪线信息封装后 （报文格式如图中帧格式 2 )通过接入网络的 IP伪线发送 给 PE2; PE2对接收的 IP报文执行伪线信息的解封装后 （报文格式如图中 帧格式 3 ), 再执行三层信息的封装（报文格式如图中帧格式 4 ); 然后， 根 据 IP伪线在建立的映射关系中查找对应的 VRF, 并根据 IP报文的目的 IP 地址， 将三层信息封装后的 IP报文在三层 VPN中按照查找的 VRF进行转 发。
步骤 3 , PE设备从三层 VPN接收到 IP报文时， 根据 IP报文的目的 IP 地址， 将 IP ^文转发到目的 IP地址对应的 IP伪线上。
在 IP报文从三层 VPN转发到 IP伪线时，衔接三层 VPN和接入网络的 PE设备接收到 IP报文后， 需要对该 IP报文进行解封装， 去除其中的三层 信息， 然后在 IP报文中封装伪线信息； 该 PE设备根据 IP报文的目的 IP 地址， 将 IP报文转发到目的 IP地址对应的 IP伪线上。 由此， 在 IP报文从 三层 VPN转发到 IP伪线时， 需要用到目的 IP地址与 IP伪线的对应关系， 该对应关系可以通过静态配置的方式在 PE设备上建立， 当然也可以通过动 态学习的方式在 PE设备上建立。 所谓动态学习， 是在 IP报文从 IP伪线转 发到三层 VPN时学习， 即当 IP报文从 IP伪线转发到三层 VPN时， 该 PE 设备记录下 IP 文的源 IP地址与 IP伪线的对应关系； 该源 IP地址与 IP 伪线的对应关系应用在 IP报文从三层 VPN转发到 IP伪线时， 即为上述所 指目的 IP地址与 IP伪线的对应关系。
步骤 3的操作应用于图 4所示的网络拓朴中， 即 PE3对 IP "^文进行三 层信息封装（报文格式如图中帧格式 4 )后通过对应的 VRF转发到 PE2; PE2对接收的 IP报文进行解封装去除三层信息（报文格式如图中帧格式 3 ), 并进行伪线信息的封装（报文格式如图中帧格式 2 ); PE2根据 IP报文的目 的 IP地址，将 IP报文转发到目的 IP地址对应的 IP伪线并由对端的 PE1接 收， PE1对接收的 IP报文进行解封装去除伪线信息并执行接入链路封装后 (报文格式如图中帧格式 1 ), 通过接入链路转发。
需要指出的是， 本发明中用于衔接三层 VPN和接入网络的 PE设备， 可以为一台 PE设备（如图 4中的 PE2 ), 也可以为两台 PE设备。 为两台 PE设备时的网络拓朴如图 5所示， PE2为与接入网络直连的 PE设备一， PE3为与三层 VPN直连的 PE设备二， PE2和 PE3之间通过逻辑二层通道 (如图中的衔接链路所示） 互连。 该衔接链路可以釆用任意类型的链路， 而无需与接入链路的类型一致。
相应的，对应图 5所示的网络拓朴，在建立 IP伪线与 VRF的映射关系 时， 具体为： 在与接入网络直连的 PE设备一（PE2 )上建立 IP伪线与逻辑 二层通道的映射关系， 在与三层 VPN直连的 PE设备二（PE3 )上建立逻辑 二层通道与 VRF的映射关系。
对应图 5所示的网络拓朴， 当 IP报文从 IP伪线转发到三层 VPN时， 具体操作为： PE设备一 ( PE2 )从 IP伪线上接收到 IP报文时， 根据 IP伪 线与逻辑二层通道的映射关系， 将 IP报文通过逻辑二层通道转发到 PE设 备二（ PE3 ); PE设备二（ PE3 )根据逻辑二层通道与 VRF的映射关系、 以 及 IP报文的目的 IP地址，将 IP报文在三层 VPN中按照与逻辑二层通道对 应的 VRF进行转发。 报文格式的变化如图 5中的帧格式所示。
对应图 5所示的网络拓朴， 当 IP报文从三层 VPN转发到 IP伪线时， 具体操作为： PE设备二（ PE3 )从三层 VPN接收到 IP报文时， 对 IP报文 进行解封装并去除三层信息 ,再封装逻辑二层信息 ,根据 IP报文在三层 VPN 转发的 VRF查找对应的逻辑二层通道，并将封装逻辑二层信息后的 IP报文 通过查找的逻辑二层通道发送给 PE设备一（PE2 ); PE设备一 ( PE2 )对 接收的 IP报文进行解封装并去除逻辑二层信息， 再封装伪线信息， 并根据 IP报文的目的 IP地址， 将封装伪线信息后的 IP报文转发到目的 IP地址对 应的 IP伪线上。 报文格式的变化如图 5中的帧格式所示。
下面再结合具体实施例对上述三层 VPN的接入方法进一步详细阐述。 本发明的实施例一为移动基站的回程场景， 如图 6所示， 移动基站通 过基站侧网关（PE1 )、 汇聚层设备（PE2 )和控制器侧网关（PE3 )与基站 控制器相连。 在图 6所示的网络拓朴中， 支持不同移动运营商移动回程流 量在同一网络中的传送， 支持不同运营商共享基站。
在 PE1与 PE2之间建立 IP伪线，且该实施例中可以为运营商的不同类 型的业务建立不同优先级的伪线， 在多运营商共享基站的场景下， 还可以 为不同运营商的业务建立不同的伪线。 PE2与 PE3同处于一个三层 VPN中。 在 PE2上建立 IP伪线与 VRF的映射关系， 例如， 将同一运营商的 IP伪线 映射到同一个 VRF。基站侧的 IP报文以 IP伪线的方式通过 PE1传送到 PE2; PE2根据 IP伪线从前述映射关系中查找对应的 VRF,并将 IP 4艮文按照查找 的 VRF发送到三层 VPN中的 PE3; PE3再通过上行链路将接收的 IP报文 发送给基站控制器。控制器侧的 IP报文在 PE3接入三层 VPN, 并通过对应 的 VRF转发到 PE2; PE2终结三层 VPN并封装对应的伪线信息， 然后根据 IP ·^艮文的目的 IP地址，将封装伪线信息后的 IP ·^艮文通过 IP伪线转发到 PE1 ; PE1再通过接入链路将接收的 IP报文发送给移动基站。
本发明的实施例二为企业网承载的场景， 如图 7 所示， 同一企业的各 地网关通过接入侧 PE设备 ( PE1 )、 汇聚层 PE设备（ PE2 )接入三层 VPN 网络， 通过三层 VPN来形成各地网关的互联。 其中， PE2可以是业务路由 器（ SR, Service Router )、或宽带远端接入服务器（ BRAS, Broadband Remote Access Server )等设备。
在 PE1与 PE2之间建立 IP伪线， PE2与 PE3处于同一个三层 VPN中。 在 PE2上建立 IP伪线与 VRF的映射关系， 例如， 将同一企业的 IP伪线映 射到同一个 VRF。 企业网关发出的 IP报文以 IP伪线的方式通过 PE1传送 到 PE2, PE2根据 IP伪线从前述映射关系中查找对应的 VRF, 并将 IP报文 按照查找的 VRF发送到三层 VPN中的 PE3。
本发明的实施例三为移动基站的回程场景， 与实施例一不同的是， 实 施例三中用于衔接接入网络和三层 VPN的 PE设备有两台，即 PE2和 PE3。 如图 8所示， 移动基站通过不同运营商网络或同一运营商的不同管理域与 基站控制器连接。 在图 8所示的网络拓朴中， 支持不同移动运营商移动回 程流量在同一网络中的传送， 支持不同运营商共享基站。
在 PE1与 PE2之间建立 IP伪线，且该实施例中可以为运营商的不同类 型的业务建立不同优先级的伪线， 在多运营商共享基站的场景下， 还可以 为不同运营商的业务建立不同的伪线。 在 PE2与 PE3之间建立逻辑二层通 道， 如虚拟局域网 （VLAN, Virtual Local Area Network ); 在 PE2上将该逻 辑二层通道与 IP伪线映射， 如： 同一移动运营商的 IP伪线对应到同一个 VLAN, 或釆用两层 VLAN的方式， 同一运营商伪线外层 VLAN相同， 内 层 VLAN与不同的伪线——对应； 并在 PE3上将该逻辑二层通道与 VRF 映射， 如： VLAN与 VRF——对应， 或上述两层 VLAN方式下外层 VLAN 与 VRF——对应。
基站侧的 IP报文以 IP伪线的方式通过 PE1传送到 PE2, PE2根据 IP 伪线与逻辑二层通道的映射关系， 将该 IP 报文通过逻辑二层通道转发到 PE3 , PE3根据上述逻辑二层通道与 VRF的映射关系接入三层 VPN, 在与 逻辑二层通道对应的 VRF中转发 IP报文。
基站控制器侧的 IP报文在 PE4接入三层 VPN, 并通过对应的 VRF转 发到 PE3 , PE3终结三层 VPN并将 IP报文封装对应的逻辑二层通道信息后 发往 PE2, PE2根据该逻辑二层通道或目的 IP地址找到对应的 IP伪线， 根 据该伪线信息封装 IP报文并发往 PE1。
本发明的实施例四为移动基站的回程场景中的传统基站时钟同步方 法， 如图 9所示， 移动基站通过接入设备（AN, Access Node )的基站侧网 关（ PE1 )、 汇聚层设备 ( PE2 )和控制器侧网关（ PE3 )与基站控制器相连， 其中 AN与 PE1可以是同一台设备， 同时时钟源与基站控制器和 /或控制器 侧网关相连。 在图 9所示的网络拓朴中， 支持通过 IP报文封装格式在网络 中传递时钟信号。
在 PE1与 PE2之间建立 IP伪线，该伪线可以是专为传递信号配置的伪 线， 或与数据报文共享的伪线并对时钟报文标记高优先级。 PE2与 PE3 同 处于一个三层 VPN中。 在 PE2上建立 IP伪线与 VRF的映射关系， 例如， 将共享同一时钟源的所有基站所对应的 IP伪线映射到同一个 VRF。 时钟源 发出的时钟信号经过基站控制器或控制器侧网关转换为 IP报文， 该报文在 PE3接入三层 VPN, 并通过对应的 VRF转发到 PE2; PE2终结三层 VPN 并封装对应的伪线信息， 然后根据 IP报文的目的 IP地址，将封装伪线信息 后的 IP 文通过 IP伪线转发到 PE1 ; PE1再通过接入链路将接收的 IP才艮 文发送给 AN, AN将该 IP报文转换为时钟信号发送给基站（在 PE1与 AN 合一的场景下， PE1直接将该 IP报文转换为时钟信号发给基站 )。
为实现本发明三层 VPN 的接入方法， 本发明所提供的一种三层 VPN 的接入系统， 由接入网络、 三层 VPN网络、 以及衔接三层 VPN和接入网 络的 PE设备组成。 接入网络通过 IP伪线与该 PE设备相连， 用于通过 IP 伪线， 以及 PE设备与三层 VPN进行 IP 文交互。 三层 VPN用于通过该 PE设备， 以及 IP伪线与接入网络进行 IP报文交互。 PE设备， 用于建立 IP 伪线与 VRF的映射关系， 并根据该映射关系进行报文转发， 具体的： 从 IP 伪线上接收到 IP报文时， 在映射关系中查找与 IP伪线对应的 VRF, 并根 据 IP报文的目的 IP地址， 将 IP报文在三层 VPN中按照查找的 VRF进行 转发； 从三层 VPN接收到 IP报文时， 根据 IP报文的目的 IP地址， 将 IP "^艮文转发到目的 IP地址对应的 IP伪线上。
该 PE设备进一步用于，在从 IP伪线上接收到 IP报文时 ,对 IP报文进 行解封装并去除伪线信息；在将解封装的 IP报文转发到三层 VPN之前，对 IP报文进行三层信息的封装； 在从三层 VPN接收到 IP报文时， 对 IP报文进行解封装并去除三层信 息； 在将解封装的 IP报文转发到 IP伪线之前， 对 IP报文进行伪线信息的 封装。
其中， 衔接三层 VPN和接入网络的 PE设备， 由与接入网络直连的 PE 设备一， 以及与三层 VPN直连的 PE设备二组成， PE设备一与 PE设备二 通过逻辑二层通道互连； PE设备一上建立 IP伪线与逻辑二层通道的映射关 系， PE设备二上建立逻辑二层通道与 VRF的映射关系。
PE设备一从 IP伪线上接收到 IP报文时，根据 IP伪线与逻辑二层通道 的映射关系， 将 IP报文通过逻辑二层通道转发到 PE设备二； 相应的， PE 设备二根据逻辑二层通道与 VRF的映射关系、以及 IP报文的目的 IP地址， 将 IP报文在三层 VPN中按照与逻辑二层通道对应的 VRF进行转发。
PE设备二从三层 VPN接收到 IP报文时，对 IP报文进行解封装并去除 三层信息， 再封装逻辑二层信息， 将封装逻辑二层信息后的 IP报文通过逻 辑二层通道发送给 PE设备一； 相应的， PE设备一对接收的 IP报文进行解 封装并去除逻辑二层信息，再封装伪线信息，并根据 IP报文的目的 IP地址， 将封装伪线信息后的 IP报文转发到目的 IP地址对应的 IP伪线上。
以上所述， 仅为本发明的较佳实施例而已， 并非用于限定本发明的保 护范围。

Claims

权利要求书
1、 一种三层虚拟专用网 （VPN ) 的接入方法， 其特征在于， 接入网络 通过 IP伪线接入三层 VPN , 该方法包括：
在衔接所述三层 VPN和接入网络的运营商边缘（ PE )设备上， 建立 IP 伪线与虚拟路由转发表（VRF ) 的映射关系， 并根据所述映射关系进行报 文转发。
2、 根据权利要求 1所述三层 VPN的接入方法， 其特征在于， 所述根 据映射关系进行报文转发， 具体为：
所述 PE设备从 IP伪线上接收到 IP报文时， 在所述映射关系中查找与 所述 IP伪线对应的 VRF, 并根据所述 IP报文的目的 IP地址， 将所述 IP报 文在三层 VPN中按照查找的 VRF进行转发；
所述 PE设备从三层 VPN接收到 IP报文时， 根据 IP报文的目的 IP地 址， 将所述 IP 转发到目的 IP地址对应的 IP伪线上。
3、 根据权利要求 1所述三层 VPN的接入方法， 其特征在于， 该方法 进一步包括：
在从 IP伪线上接收到 IP报文时， 对所述 IP报文进行解封装并去除伪 线信息； 在将解封装的 IP报文转发到三层 VPN之前， 对所述 IP报文进行 三层信息的封装；
在从三层 VPN接收到 IP报文时， 对所述 IP报文进行解封装并去除三 层信息； 在将解封装的 IP报文转发到 IP伪线之前， 对所述 IP报文进行伪 线信息的封装。
4、 根据权利要求 1、 2或 3所述三层 VPN的接入方法， 其特征在于， 该方法进一步包括： 在 IP报文从三层 VPN转发到 IP伪线时所用到的目的 IP地址与 IP伪线的对应关系， 通过动态学习或静态配置的方式建立。
5、 根据权利要求 1、 2或 3所述三层 VPN的接入方法， 其特征在于， 所述衔接三层 VPN和接入网络的 PE设备 , 为一台 PE设备、 或两台 PE设 备； 当为两台 PE设备时， 所述两台 PE设备之间通过逻辑二层通道互连， 且所述建立 IP伪线与 VRF的映射关系， 具体为：
在与接入网络直连的 PE设备一上建立 IP伪线与逻辑二层通道的映射 关系，在与三层 VPN直连的 PE设备二上建立逻辑二层通道与 VRF的映射 关系。
6、 根据权利要求 5所述三层 VPN的接入方法， 其特征在于， 当衔接 三层 VPN和接入网络的 PE设备为两台 PE设备时， IP报文从 IP伪线转发 到三层 VPN具体为：
所述 PE设备一从 IP伪线上接收到 IP报文时，根据 IP伪线与逻辑二层 通道的映射关系， 将所述 IP报文通过逻辑二层通道转发到所述 PE设备二； 所述 PE设备二根据逻辑二层通道与 VRF的映射关系、 以及所述 IP报 文的目的 IP地址， 将所述 IP报文在三层 VPN中按照与所述逻辑二层通道 对应的 VRF进行转发。
7、 根据权利要求 5所述三层 VPN的接入方法， 其特征在于， 当衔接 三层 VPN和接入网络的 PE设备为两台 PE设备时， IP报文从三层 VPN转 发到 IP伪线具体为：
所述 PE设备二从三层 VPN接收到 IP 文时， 对所述 IP ^艮文进行解 封装并去除三层信息， 再封装逻辑二层信息， 将封装逻辑二层信息后的 IP 报文通过逻辑二层通道发送给所述 PE设备一；
所述 PE设备一对接收的 IP报文进行解封装并去除逻辑二层信息， 再 封装伪线信息，并根据所述 IP报文的目的 IP地址，将封装伪线信息后的 IP "^艮文转发到目的 IP地址对应的 IP伪线上。
8、 一种三层 VPN的接入系统， 其特征在于， 该系统包括： 接入网络、 三层 VPN网络、 以及衔接所述三层 VPN和接入网络的 PE设备， 其中， 所述接入网络通过 IP伪线与所述 PE设备相连，用于通过所述 IP伪线， 以及 PE设备与所述三层 VPN进行 IP报文交互；
所述三层 VPN, 用于通过所述 PE设备， 以及 IP伪线与所述接入网络 进行 IP 艮文交互；
所述 PE设备， 用于建立 IP伪线与 VRF的映射关系， 并根据所述映射 关系进行报文转发。
9、 根据权利要求 8所述三层 VPN的接入系统， 其特征在于， 所述 PE 设备进一步用于，从 IP伪线上接收到 IP报文时， 在所述映射关系中查找与 所述 IP伪线对应的 VRF, 并根据所述 IP报文的目的 IP地址， 将所述 IP报 文在三层 VPN中按照查找的 VRF进行转发；从三层 VPN接收到 IP报文时， 根据 IP报文的目的 IP地址， 将所述 IP报文转发到目的 IP地址对应的 IP 伪线上。
10、根据权利要求 8所述三层 VPN的接入系统， 其特征在于， 所述 PE 设备进一步用于， 在从 IP伪线上接收到 IP报文时， 对所述 IP报文进行解 封装并去除伪线信息；在将解封装的 IP报文转发到三层 VPN之前，对所述 IP报文进行三层信息的封装；
在从三层 VPN接收到 IP报文时， 对所述 IP报文进行解封装并去除三 层信息； 在将解封装的 IP报文转发到 IP伪线之前， 对所述 IP报文进行伪 线信息的封装。
11、根据权利要求 8、 9或 10所述三层 VPN的接入系统， 其特征在于， 所述 PE设备进一步用于， 通过动态学习或静态配置的方式， 建立在 IP报 文从三层 VPN转发到 IP伪线时所用到的目的 IP地址与 IP伪线的对应关系。
12、根据权利要求 8、 9或 10所述三层 VPN的接入系统， 其特征在于， 所述衔接三层 VPN和接入网络的 PE设备，由与接入网络直连的 PE设备一， 以及与三层 VPN直连的 PE设备二组成， 所述 PE设备一与 PE设备二通过 逻辑二层通道互连； 所述 PE设备一上建立 IP伪线与逻辑二层通道的映射 关系， 所述 PE设备二上建立逻辑二层通道与 VRF的映射关系。
13、 根据权利要求 12所述三层 VPN的接入系统， 其特征在于， 所述 PE设备一进一步用于， 从 IP伪线上接收到 IP报文时， 根据 IP伪线与逻辑 二层通道的映射关系， 将所述 IP报文通过逻辑二层通道转发到所述 PE设 备二；
相应的， 所述 PE设备二进一步用于， 根据逻辑二层通道与 VRF的映 射关系、 以及所述 IP报文的目的 IP地址， 将所述 IP报文在三层 VPN中按 照与所述逻辑二层通道对应的 VRF进行转发。
14、 根据权利要求 12所述三层 VPN的接入系统， 其特征在于， 所述 PE设备二进一步用于， 从三层 VPN接收到 IP报文时， 对所述 IP报文进行 解封装并去除三层信息， 再封装逻辑二层信息， 将封装逻辑二层信息后的 IP报文通过逻辑二层通道发送给所述 PE设备一；
相应的， 所述 PE设备一进一步用于， 对接收的 IP报文进行解封装并 去除逻辑二层信息， 再封装伪线信息， 并根据所述 IP报文的目的 IP地址， 将封装伪线信息后的 IP报文转发到目的 IP地址对应的 IP伪线上。
PCT/CN2010/078124 2009-11-03 2010-10-26 一种三层虚拟专用网（vpn）的接入方法和接入系统 WO2011054263A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN200910207430.X 2009-11-03
CN200910207430XA CN102055647A (zh) 2009-11-03 2009-11-03 一种三层vpn的接入方法和系统

Publications (1)

Publication Number Publication Date
WO2011054263A1 true WO2011054263A1 (zh) 2011-05-12

Family

ID=43959598

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2010/078124 WO2011054263A1 (zh) 2009-11-03 2010-10-26 一种三层虚拟专用网（vpn）的接入方法和接入系统

Country Status (2)

Country Link
CN (1) CN102055647A (zh)
WO (1) WO2011054263A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103457817A (zh) * 2012-05-30 2013-12-18 中兴通讯股份有限公司 一种pw+l3vpn的保护方法和系统

Families Citing this family (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2013078683A1 (zh) * 2011-12-02 2013-06-06 中兴通讯股份有限公司 一种l3vpn端到端业务形成的方法和装置
CN102546416A (zh) * 2012-01-13 2012-07-04 中兴通讯股份有限公司 L3vpn业务报文的传输方法和装置
CN103685026A (zh) * 2012-08-31 2014-03-26 中兴通讯股份有限公司 一种虚拟网络的接入方法和系统
CN103227745B (zh) * 2013-04-26 2015-12-02 杭州华三通信技术有限公司 最短路径桥网和三层虚拟专网互通方法及公共边缘设备
CN103326918B (zh) * 2013-05-17 2016-08-03 杭州华三通信技术有限公司 一种报文转发方法和设备
CN106209553B (zh) * 2015-04-30 2019-07-23 华为技术有限公司 报文处理方法、设备及系统
CN105049316B (zh) * 2015-08-26 2018-08-14 华为技术有限公司 通信方法和通信设备
CN105610672B (zh) * 2016-01-14 2019-04-26 中国联合网络通信集团有限公司 一种信息传输的方法及装置
CN108881013B (zh) * 2018-06-29 2021-05-07 新华三技术有限公司 控制网关模式的方法、系统、sdn控制器和接入设备

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20070086448A1 (en) * 2005-10-17 2007-04-19 Sbc Knowledge Ventures Lp Integrated pseudo-wire and virtual routing and forwarding on a single provider edge router
CN101110745A (zh) * 2007-08-14 2008-01-23 华为技术有限公司 衔接二层网络和三层网络的方法、装置和系统
CN101848161A (zh) * 2010-05-31 2010-09-29 杭州华三通信技术有限公司 一种mpls l2vpn和mpls l3vpn的通信方法和设备

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN100471162C (zh) * 2007-04-28 2009-03-18 杭州华三通信技术有限公司 一种发布及处理虚线路信息的方法和供应商边缘设备
US7948900B2 (en) * 2007-05-10 2011-05-24 Alcatel Lucent Method and system for verifying connectivity of multi-segment pseudo-wires
CN101217470B (zh) * 2007-12-29 2012-11-21 华为技术有限公司 转发报文的方法和设备
CN101355514B (zh) * 2008-09-03 2011-03-16 中兴通讯股份有限公司 一种带vlan标签的数据报文在二层vpn中的传输方法

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20070086448A1 (en) * 2005-10-17 2007-04-19 Sbc Knowledge Ventures Lp Integrated pseudo-wire and virtual routing and forwarding on a single provider edge router
CN101110745A (zh) * 2007-08-14 2008-01-23 华为技术有限公司 衔接二层网络和三层网络的方法、装置和系统
CN101848161A (zh) * 2010-05-31 2010-09-29 杭州华三通信技术有限公司 一种mpls l2vpn和mpls l3vpn的通信方法和设备

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
JIN, LIZHONG ET AL.: "The research on the interconnection of the layer 2 VPN", ZTE COMMUNICATIONS, vol. 11, no. 6, December 2005 (2005-12-01) *

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103457817A (zh) * 2012-05-30 2013-12-18 中兴通讯股份有限公司 一种pw+l3vpn的保护方法和系统
CN103457817B (zh) * 2012-05-30 2018-03-16 中兴通讯股份有限公司 一种pw+l3vpn的保护方法和系统

Also Published As

Publication number Publication date
CN102055647A (zh) 2011-05-11

Similar Documents

Publication Publication Date Title
WO2011054263A1 (zh) 一种三层虚拟专用网（vpn）的接入方法和接入系统
US9225640B2 (en) Intra-domain and inter-domain bridging over MPLS using MAC distribution via border gateway protocol
EP1875365B1 (en) A comprehensive model for vpls
US8661525B2 (en) Implementation method and system of virtual private network
EP1713197B1 (en) A method for implementing the virtual leased line
EP3595248A1 (en) Static route advertisement
WO2019129236A1 (zh) 基于隧道传输数据的方法及装置
US9100213B1 (en) Synchronizing VPLS gateway MAC addresses
US20050190757A1 (en) Interworking between Ethernet and non-Ethernet customer sites for VPLS
EP2466817A1 (en) Virtual private network implementation method and system
US20040202199A1 (en) Address resolution in IP interworking layer 2 point-to-point connections
WO2009021458A1 (fr) Procédé, appareil et système de connexion d'un réseau de couche 2 à un réseau de couche 3
WO2008092357A1 (fr) Procédé et dispositif pour établir un tunnel pseudocâblé et transmettre un message à l'aide de celui-ci
WO2011103764A1 (zh) 一种以太树业务中以太网帧的发送方法和运营商边缘设备
KR20040019129A (ko) 레이블 분배 프로토콜의 확장을 이용한 ＱｏＳ지원 2계층가상 사설 망 양방향 터널 설정 및 구성정보 분배방법
WO2012155867A1 (zh) 一种报文发送方法及接入控制器
WO2014194711A1 (zh) 报文处理方法、设备标签处理方法及设备
WO2014186978A1 (zh) 用于以太虚拟专用网的方法和设备
WO2007062592A1 (fr) Systeme, procede et routeur de l2vpn d'interconnexions point a multipoints, et multipoints a multipoints
WO2007112691A1 (fr) Système, procédé et dispositif réseau permettant à un client de réseau privé virtuel (vpn) d'accéder à un réseau public
WO2008046359A1 (fr) Procédé et appareil destinés à isoler les différents services d'un réseau local virtuel
US20160323184A1 (en) Generic Packet Encapsulation For Virtual Networking
WO2013120427A1 (zh) 一种mpls vpn的实现方法、系统及客户边缘设备
WO2013139270A1 (zh) 实现三层虚拟专用网络的方法、设备及系统
US7715310B1 (en) L2VPN redundancy with ethernet access domain

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 10827877

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 10827877

Country of ref document: EP

Kind code of ref document: A1