WO2011147334A1

WO2011147334A1 - Method, device and system for providing virtual private network service

Info

Publication number: WO2011147334A1
Application number: PCT/CN2011/075208
Authority: WO
Inventors: 雷文阳
Original assignee: 华为技术有限公司
Priority date: 2010-11-30
Filing date: 2011-06-02
Publication date: 2011-12-01
Also published as: CN102480403A; CN102480403B

Abstract

A method for providing virtual private network service is disclosed in the embodiments of the present invention, and a corresponding device and system are also disclosed in the embodiments of the present invention. In the embodiments of the present invention, a back end device performs the procedure as follows: authenticating a request message which requests for accessing a virtual private network (VPN) from a site, and globally allocating the VPN configuration parameters of the access device when the authentication succeeds, and transmitting said VPN configuration parameters to the access device. Therefore, the whole procedure does not involve any manual operation, and the automatically distribution of the configuration parameters to the access device is implemented, so the access device could make the site access to the VPN quickly.

Description

Method, device and system for providing virtual private network service This application claims to be submitted to the Chinese Patent Office on November 30, 2010, the application number is 201010566397.2, and the Chinese patent entitled "Method, Equipment and System for Providing Virtual Private Network Service" Priority of the application, the entire contents of which are incorporated herein by reference. Technical field

The present invention relates to the field of communications technologies, and in particular, to a method, device, and system for providing a virtual private network service. Background technique

Virtual Private Network (VPN) is defined as a network that provides multiple logical networks on an existing single physical network. These logical networks are isolated from each other, and data traffic in one logical network does not enter another logical network. Currently, many basic network operators are able to provide VPN services. Generally, these basic network operators provide customers with Layer 2 VPN services (called VPLS services) based on Virtual Private LAN Service (VPLS) and boundary-based. Layer 3 VPN services (BGP, MPLS, Multi-Protocol Label Switching), which are called BGP/MPLS Layer 3 VPN services. In the prior art, these services are enabled. The process is as follows: The customer determines the VPN attribute information of the VPN service, including the number of sites, the location of the site, the traffic demand, the bandwidth requirement, etc., by the on-site communication with the basic network operator, and then the departments of the basic network operator (such as planning, network management, and accounting). Coordinating with each other The network planning and accounting schemes of the VPN service determine the VPN configuration parameters of the service provider's edge devices. Then, the network administrators of the basic network operators manually configure the VPN configuration parameters to the service provider edge devices. The network operator will notify the customer that the VPN service has been activated, and the service provider edge device can access the VPN to the customer.

In the research and practice of the prior art, the inventor of the present invention found that if there is a new site to open the VPN service, it is necessary to re-execute the above-mentioned cumbersome VPN service opening process, but with the rapid development of information technology, the customer The underlying network operator is required to quickly connect the new site to the VPN, but the prior art cannot meet this requirement. Summary of the invention

Embodiments of the present invention provide a method, device, and system for providing a virtual private network service. A method for providing a virtual private network service, including: receiving a request message sent by an access device to access a virtual private network VPN, where the request message carries authentication information;

And authenticating the request message according to the authentication information;

After the request message is authenticated, the VPN configuration parameter of the access device is globally allocated, and the VPN configuration parameter is sent to the access device.

A method for providing a virtual private network service, including: an access device receiving a request message sent by a site to access a virtual private network VPN, where the request message carries authentication information;

Sending the request message to a backend device;

Receiving the VPN configuration parameters sent by the backend device, and configuring according to the VPN configuration parameters.

A backend device, comprising: a receiving request message unit, configured to receive a request message sent by an access device to request access to a virtual private network VPN, where the request message carries authentication information; and an authentication unit, configured to perform the authentication according to the The information is used to authenticate the request message; the allocating unit is configured to globally allocate the VPN configuration parameter of the access device after the request message is authenticated;

And a sending parameter unit, configured to send the VPN configuration parameter to the access device.

An access device, comprising: a receiving unit, configured to receive, by the access device, a request message sent by the station to access the virtual private network VPN, where the request message carries the authentication information;

Sending a request message unit, configured to send the request message to a backend device;

And a configuration unit, configured to receive a VPN configuration parameter sent by the backend device, and perform configuration according to the VPN configuration parameter.

A system for providing a virtual private network service, comprising: the foregoing back end device and the foregoing access device.

In the embodiment of the present invention, the process performed by the backend device is: authenticating the request message for requesting access to the VPN by the site, and assigning the VPN configuration parameter of the access device after the authentication is passed, and transmitting the VPN configuration parameter to the access device. Therefore, the entire process performed by the back-end device does not need to be manually operated, and the configuration parameter can be sent to the access device, so that the access device can quickly access the site to the VPN. DRAWINGS

1 is a schematic flowchart of Embodiment 1 of a method for providing a virtual private network service according to an embodiment of the present invention;

2 is a schematic flowchart of Embodiment 2 of a method for providing a virtual private network service according to an embodiment of the present invention;

3 is a schematic flowchart of Embodiment 3 of a method for providing a virtual private network service according to an embodiment of the present invention;

4 is a schematic flowchart of Embodiment 4 of a method for providing a virtual private network service according to an embodiment of the present invention;

5 is a schematic diagram showing the logical structure of the fifth embodiment of the backend device in the embodiment of the present invention; FIG. 6 is a schematic diagram showing the logical structure of the sixth embodiment of the access device according to the embodiment of the present invention; A logical structure diagram of Embodiment 7 of the system of the private network service. detailed description

Embodiments of the present invention provide a method for providing a virtual private network service. Embodiments of the present invention also provide corresponding devices and systems. The details are described below separately. Embodiment 1 Referring to FIG. 1 , an embodiment of a method for providing a virtual private network service in an embodiment of the present invention includes:

101. Receive a request message sent by an access device.

Before the basic network operator provides VPN services to the site, the basic network operator must complete the network connectivity configuration and network tunnel configuration of all access devices in the basic network. For example, the OSPF (Open Shortest Path First) routing protocol is configured in the network domain, the access device is configured with an MPLS tunnel, and the BGP is enabled with the VPN technology.

When the site needs to access the VPN, that is, when the site needs to open the VPN service, the access device receives the request message for the site requesting access to the VPN, and the request message carries the authentication information, and the access device sends the request message to the user. End device. The request message is typically sent to the access device through an edge device located at the site. It should be noted that the access device is usually located at the edge of the carrier's basic network. Generally, a customer has multiple sites that require access to the VPN.

102. Perform authentication on the request message. Since the VPN is a virtual private network, of course, only the legitimate site can be allowed to access the VPN provided for the client. Therefore, after receiving the request message of the site requesting access to the VPN, the backend device authenticates the request message according to the authentication information. .

103. Send configuration parameters to the access device.

After the request message of the site requesting access to the VPN passes the authentication of the backend device, the backend device can allocate the VPN configuration parameter of the access device, and then send the VPN configuration parameter to the access device, so that the access device can follow the Configure the parameters to complete the configuration and add the site to the VPN.

In this embodiment, the process performed by the backend device is: authenticating the request message for requesting access to the VPN by the site, and assigning the VPN configuration parameter of the access device after the authentication is passed, and transmitting the VPN configuration parameter to the access device, thereby It can be seen that the entire process does not need to be manually operated, and the configuration parameters are automatically sent to the access device, so that the access device joins the site to the VPN.

The following is a description of a method for providing a virtual private network service by using the VPLS service as an example. Embodiment 2: Referring to FIG. 2, another embodiment of the method for providing a virtual private network service according to the embodiment of the present invention includes:

201. Receive a virtual private network service application request.

The basic network operator usually provides a VPLS with private attribute information according to the requirements of the user. The VPLS attribute information includes the VPLS traffic type, the maximum number of sites allowed to access the VPLS, the access bandwidth, and so on. Users can provide VPLS attribute information to the basic network operator in various ways, such as face-to-face communication, phone calls, fax, and so on. However, in this embodiment, the user can provide attribute information to the basic network operator by itself, specifically:

The user can send a VPLS service request to the backend device. The VPLS service request carries the VPLS attribute information. The backend device globally assigns a unique identifier to the VPLS attribute information and saves the VPLS attribute information. The VPLS service application message. It should be noted that the unique identifier that the backend device globally assigns to the VPLS attribute information is an integer such as 32bits or 64bits.

It should be noted that the user can directly send a VPLS service request to the back-end device, so that the back-end device obtains the VPLS attribute information, and the VPLS service request is sent to the front-end device, and then the front-end device sends the VPLS attribute information. After receiving the response from the backend device, the front-end device feeds back to the user a message that the VPLS service request has been accepted, for example, The front-end device can be the user's computer. The user can log in to the VPLS service platform of the VPLS service application to apply for the VPLS service. The user can also input the required VPLS attribute information on the WEB service platform.

The back-end device can also provide the user with a VPLS access pass, such as the username and password for connecting to the VPLS. It should be noted that the username and password for connecting to the VPLS can also be entered by the user on the WEB service platform of the VPLS service application. The username and password for connecting to the VPLS are also carried in the VPLS service request, regardless of the username and password of the VPLS connected to the backend device or the username and password of the VPLS connection provided by the backend device to the user. They are stored in the authentication table, and their identifiers in the authentication table correspond to the identification of the attribute information of the VPLS.

202. Receive a request message sent by an access device.

When a site in the network needs to access the VPLS, the site runs an 802.1x client to send a request message for the site requesting access to the VPLS to the access device, and the request message carries the connection entered by the user using the site on the 802.1x client. VPLS username and password. It should be noted that the 802.1x client is usually located on the edge device of the site. Then, the access device acting as the Radius client forwards the request message to the backend device in the form of an AAA authentication packet. The end device uses the AAA server system, and the AAA server authenticates the AAA authentication packet. The 802.1x client is a type of VPN dial-up client.

203. Perform username and password authentication;

The AAA server parses the username and password of the VPLS connection entered by the user using the site on the 802.1x client from the received AAA authentication data packet, and resolves the username and password of the VPLS connection and the pre-existing authentication of the backend device. The username and password for connecting to the VPLS in the table are authenticated.

204. Perform attribute information authentication.

After the user name and password of the back-end device are authenticated, the back-end device finds the attribute information of the VPLS according to the identifier of the user name and password of the VPLS in the authentication table, and determines whether the attribute information of the VPLS can be authenticated, for example, The end device can check whether the number of sites currently accessing the VPLS has exceeded the maximum number of sites allowed to access the VPLS. Whenever one site successfully accesses the VPLS, the counter in the backend device is incremented by 1. If the data in the counter is No more than allowed The maximum number of sites accessing the VPLS is authenticated by the attribute information of the backend device. If the data in the counter exceeds the maximum number of sites allowed to access the VPLS, the device sends a failure message to the site.

205. Allocate virtual private network configuration parameters.

After the attribute information of the back-end device is authenticated, the back-end device globally allocates the VPLS configuration parameters of the access device. For example, the back-end device globally allocates unique route target parameters (RT, Route Target) and route specifier parameters for the access device. (RD, Route Distinguisher ),

RD is an 8-byte number, usually expressed in the form of 100:100, indicating that the first 4 bytes are 100 and the last 4 bytes are 100. Each VPN must have a unique RD, for example, the back end. The device can set the value of the first assigned RD to 100:101 based on 100:100, the value of the second allocated RD to 100:102, and so on. There is also a way to allocate RD: The access device can also preset the base of 100:100. When the backend device allocates RD for the first time, it only assigns a value of 4, and then sends the parameter 4 to the access device. When the device gets 4 plus the base, the RD value is 100:104. The allocation method of RD and RT is the same, and will not be described again.

It should be noted that the back-end device can also allocate the VPLS configuration parameters globally after the site successfully applies for the VPLS service. After the attribute information of the back-end device passes the authentication, the back-end device can extract the previously assigned VPLS configuration parameters.

206. Send configuration parameters to the access device.

The back-end device uses the AAA server system to configure the VPLS configuration parameters (such as the route target parameter and the route specifier parameter) as the packet payload based on the Radius protocol, and sends the configuration to the access device through the Radius protocol, so that the access device can receive these configurations. You can perform the configuration on the access device and add the site to the VPLS to allow the site to access the VPLS through the access device. Since the AAA server system has a charging function, when the site accesses the VPLS, the back-end device can start charging using the AAA server system.

Further, for the VPLS attribute information related to the configuration of the access device, for example, the access bandwidth, the backend device may use the AAA server system to use the access bandwidth parameter together with the route target parameter and the route specifier parameter as the Radius protocol-based report. The payload is sent to the access device through the Radius protocol. The access device can configure the upper limit bandwidth and limit the network speed on the access of the connected site.

It should be noted that, after the backend device performs all the processes in this embodiment, and the site accesses the VPLS, the user who uses the site can also modify the attribute information of the VPLS, for example, The user who uses the site logs in to the WEB service platform that modifies the required VPLS attribute information through the computer, and increases the maximum number of access sites or access bandwidth in the attribute information that is allowed to access the VPLS. The backend device receives the modified version sent by the computer. After the attribute information, the modified attribute information is used as the packet payload based on the Radius protocol by the AAA server system, and is sent to the access device through the Radius protocol.

In this embodiment, the user can provide the required information to the backend device by sending a service request.

The attribute information of the VPN improves the efficiency of the VPN service provided by the basic network operator, and the user can change the attribute information at any time during the running of the VPN, thereby increasing the flexibility of the VPN service. After a large number of VPN services are online, there is a certain The statistical multiplexing ratio enables the basic network operator's basic network to be fully utilized. The method for providing the virtual private network service in the embodiment of the present invention is described above from the perspective of the back-end device. The method for providing the virtual private network service in the embodiment of the present invention is described below from the perspective of the access device. Embodiment 3 Referring to FIG. 3, another embodiment of a method for providing a virtual private network service in the embodiment of the present invention includes:

This example takes the VPLS service provided by the basic network operator as an example.

301. Receive a request message.

When a site accesses the VPLS, the site runs an 802.1x client installed on the edge device of the site to send a request message carrying the authentication information to the access device. When the access device receives the request message, it is equivalent to Received information about the site requesting access to the VPLS.

302. Forward a request message to a backend device.

The access device forwards the request message to the backend device. After the request message is authenticated by the backend device, the backend device may generate a VPLS configuration parameter of the access device: a route target parameter and a route specifier parameter, and will include The packets of the configuration parameters are sent to the carrier edge device.

303. Configure according to the received configuration parameters.

The access device receives the route target parameter and the route specifier parameter sent by the backend device, and the access device allocates the virtual switch instance resource locally, and then configures the received route target parameter and the route specifier parameter to the allocated virtual switch. Instance and join the 802.1x port to the virtual switch instance. At this point, the access device connects the site to the VPLS.

In this embodiment, the access device may receive the configuration parameters of the VPN from the backend device, according to The configuration parameters are configured to connect the site to the VPN. The entire process does not require the manual operation of the network administrator, which improves the efficiency of the VPN service provided by the basic network operator. The BGP/MPLS Layer 3 VPN service is provided by the basic network operator as an example to describe the interaction process between the back-end device and the access device in a specific application scenario. Embodiment 4 Referring to FIG. 4, another embodiment of a method for providing a virtual private network service in the embodiment of the present invention includes:

401. The user requests to access the virtual private network.

The user sends a BGP/MPLS Layer 3 VPN service request to the front-end device. The front-end device sends the BGP/MPLS Layer 3 VPN attribute information to the back-end device. After receiving the response from the back-end device, the front-end device sends the request to the user. The feedback has accepted the message of BGP/MPLS Layer 3 VPN service application. The BGP/MPLS Layer 3 VPN attributes must be the same as the VPLS attribute information. However, the BGP/MPLS Layer 3 VPN attributes must carry the access IP address pool information and the loopback IP address pool information.

402. The station sends a request message.

When a site in the network needs to access the BGP/MPLS Layer 3 VPN, the pppoe client installed on the edge device of the site runs a request message to the operator edge device, and the request message carries the user who uses the site. The username and password for connecting to the BGP/MPLS Layer 3 VPN entered on the pppoe client. The carrier edge device, which is the Radius client, then forwards the request message to the backend device in the form of an AAA authentication packet. The backend device uses the AAA server system, and the AAA server authenticates the AAA authentication packet. The pppoe client is another type of VPN dial-up client.

403. The backend device performs authentication;

The AAA server parses out the username and password of the BGP/MPLS Layer 3 VPN connected to the pppoe client from the received AAA authentication packet, and resolves the username and password of the BGP/MPLS Layer 3 VPN. The password and the username and password of the BGP/MPLS Layer 3 VPN connected to the authentication table of the pre-existing device are authenticated, and the authentication process is encrypted transmission.

404. The backend device sends configuration parameters.

After passing the authentication, the backend device globally allocates the VPN configuration parameters of the access device. In the embodiment, the backend device globally allocates a route target parameter and a route specifier parameter.

After the back-end device globally allocates the route target parameter and the route specifier parameter, the back-end device sends the route target parameter and the route specifier parameter to the packet payload based on the Radius protocol through the AAA server system, and sends the packet to the access device through the Radius protocol. Enables the access device to join the BGP/MPLS Layer 3 VPN to the site.

405. The access device is configured according to configuration parameters.

After receiving the route target parameter and the route specifier parameter sent by the backend device, the access device allocates the VPN route forwarding table resource locally, and then configures the route target parameter and route specifier parameter of the received BGP/MPLS Layer 3 VPN. To the assigned VPN routing forwarding table, create a ppp interface locally, add the ppp interface to the VPN routing forwarding table, and enable the RIP routing protocol on the ppp interface. The access device connects the site to the BGP/MPLS Layer 3 VPN.

406. The access device sends a message that can access the virtual private network.

The access device sends a message to the edge device at the site that can access the VPN.

In this embodiment, the backend device can automatically send the VPN configuration parameter of the access device to the access device, and the access device can receive the VPN configuration parameter from the backend device, configure according to the VPN configuration parameter, and quickly make the site Accessing the VPN, the entire network operator's entire process of providing virtual private network services does not require manual operation by network administrators, which improves efficiency. The following is a description of the back-end device in the embodiment of the present invention. Embodiment 5: Referring to FIG. 5, an embodiment of the back-end device in the embodiment of the present invention includes:

The receiving request message unit 501 is configured to receive, by the access device, a request message for requesting access to the virtual private network VPN, where the request message carries the authentication information;

The authentication unit 502 is configured to authenticate the request message according to the authentication information, where the authentication information may be a username and a password for connecting to the virtual private network, and the authentication unit 502 may use the AAA server system to authenticate the request message according to the username and the password.

The allocating unit 503 is configured to globally allocate VPN configuration parameters of the access device after the request message is authenticated;

The sending parameter unit 504 is configured to send the VPN configuration parameter to the access device.

In order to provide the VPN service to the client, the access device in this embodiment may further have the following features: The service application unit 505 is configured to receive a VPN service request request message, where the VPN service request request message carries VPN attribute information, assigns a unique identifier to the VPN attribute information, and saves the VPN attribute information.

In order to improve the security of the connected VPN, the access device in this embodiment may further have the following features:

The determining unit 506 is configured to: after the request message passes the authentication, determine whether the site currently accessing the VPN exceeds the maximum number of sites allowed to access the VPN, and if yes, feed back a failure message to the site, and if not, allocate the access device globally The VPN configuration parameter sends the VPN configuration parameters to the access device.

The judging unit 506 extracts the maximum number of stations that are allowed to access the VPN from the attribute information of the VPN.

When the site currently accessing the VPN does not exceed the maximum number of sites allowed to access the VPN, the allocating unit 503 can globally allocate the routing target parameter and the routing specifier parameter; the sending parameter unit 504 sets the VPN attribute information, the routing destination, and the routing specifier. As a packet payload based on the Radius protocol, the device sends the packet to the access device through the Radius protocol. After receiving the packet from the Radius protocol, the access device allows the site to access the VPN. The access device in the embodiment of the present invention is described below. Embodiment 6 Referring to FIG. 6, an embodiment of the access device in the embodiment of the present invention includes:

The receiving unit 601 is configured to receive, by the access device, a request message sent by the station to request access to the virtual private network VPN, where the request message carries the authentication information;

Sending a message unit 602, configured to send the request message to a backend device;

The configuration unit 603 is configured to receive the VPN configuration parameter sent by the backend device, and configure according to the VPN configuration parameter.

When the request message sent by the site to access the VPN is sent by the site through the 802.1x client, and the VPN configuration parameter sent by the backend device is a route target parameter and a route specifier parameter, the configuration unit 603 can locally allocate the virtual switch instance resource. Configure the virtual switch instance according to the route target parameter and the route specifier parameter, and then add the 802.1x port to the virtual switch instance. The access device connects the site to the VPN.

Or,

When the request sent by the site to access the VPN is sent by the site through the pppoe client And the VPN configuration parameter sent by the backend device is a route target parameter and a route specifier parameter, and the configuration unit 603 can locally allocate the VPN route forwarding table resource, and configure the VPN route forwarding table according to the route target parameter and the route specifier parameter, Create a ppp interface locally, add the created ppp interface to the VPN routing forwarding table, and enable the routing information protocol on the ppp interface. The access device connects the site to the VPN. The system for providing a virtual private network service in the embodiment of the present invention is described below. Embodiment 7 Referring to FIG. 7, an embodiment of a system for providing a virtual private network service in the embodiment of the present invention includes:

Backend device 701 and access device 702.

The backend device 701 may be a series of devices that run VPN management management functions, including Web service functions for accepting VPN service requests; including global resource management functions, such as global allocation of VPN configuration parameters (such as globally assigning unique RD/RT parameters). And sending the VPN configuration parameter to the access device 702; and further including an access management function, such as maintaining the number of the uplink site of the VPN, recording the status of the online site; and including the authentication and charging function, authenticating the online site according to the user name and password, Counting traffic to the on-line sites to implement billing functions. These functions usually run on one or a group of servers and can be collectively referred to as back-end devices 701.

The access device 702 can send a request message for requesting access to the VPN of the sending station to the back end device 701, configure according to the VPN configuration parameter sent by the backend device 701, and connect the station to the VPN.

It should be noted that the backend device 701 in this embodiment may be the same as the backend device shown in FIG. 5, and the access device 702 in this embodiment may be the same as the access device shown in FIG. I will not repeat them here.

The system for providing virtual private network services further includes: a VPN dial-in device 703, and may also include a head-end device 704.

The VPN dial-in device 703, that is, the edge device located at the site, is used to run the network device of the VPN dial-up client, and is responsible for initiating an authentication request for the client site.

The front-end device 704 is configured to run a personal computer device installed with the WEB service platform, and the user uses the front-end device 704 device to perform an application operation of the VPN service. One of ordinary skill in the art can understand all or part of the various methods of the above embodiments. The steps may be completed by a program instructing related hardware, and the program may be stored in a computer readable storage medium, and the storage medium may include: a ROM, a RAM, a magnetic disk or an optical disk.

The method, device and system for providing virtual private network service provided by the embodiments of the present invention

It is to be noted that the description of the above embodiments is only for helping to understand the method of the present invention and its core ideas; at the same time, for those skilled in the art, according to the idea of the present invention, there will be a specific embodiment and application range. The details of the description are not to be construed as limiting the invention.

Claims

Rights request

A method for providing a virtual private network service, comprising:

Receiving, by the access device, a request message for requesting access to the virtual private network VPN, where the request message carries the authentication information;

The method according to claim 1, wherein before the step of receiving the request message carrying the authentication information sent by the access device, the method further includes:

Receiving a VPN service request request message, where the VPN service request request message carries VPN attribute information, assigns a unique identifier to the VPN attribute information, and saves the VPN attribute information.

The method according to claim 2, wherein the authentication information is a username and a password for connecting to the virtual private network, and the step of authenticating the request message according to the authentication information includes:

The request message is authenticated by the AAA server system according to the username and the password.

The method according to claim 3, wherein the VPN attribute information is a maximum number of sites that are allowed to access the VPN, and the request is performed according to the user name and the password by using an AAA server system. After the message is authenticated, it also includes:

After the request message passes the authentication, it is determined whether the site currently accessing the VPN exceeds the maximum number of sites allowed to access the VPN, and if yes, the failure message is fed back to the site, and if not, the global allocation is performed. The VPN configuration parameter of the access device is sent to the access device.

The method according to claim 2 or 3, wherein the step of globally allocating the VPN configuration parameters of the access device, and sending the VPN configuration parameter to the access device is specifically:

Globally allocating route target parameters and route specifier parameters of the access device;

The VPN attribute information, the route target parameter, and the route specifier parameter are used as the packet payload based on the Radius protocol, and are sent to the access device by using the Radius protocol.

6. A method for providing a virtual private network service, the method comprising: The access device receives a request message sent by the station to access the virtual private network VPN, where the request message carries the authentication information;

Sending the request message to a backend device;

7. The method of claim 6 wherein:

The access device receives the request message carrying the authentication information sent by the station through the 802.1x client, where the VPN configuration parameter is a route destination parameter and a route specifier parameter, and the steps of configuring according to the VPN configuration parameter are:

The virtual switch instance resource is allocated locally, and the virtual switch instance is configured according to the route target parameter and the route identifier parameter, and the 802.1x port is added to the virtual switch instance.

Or,

The access device receives the request message carrying the authentication information sent by the pppoe client, and the VPN configuration parameter is a route target parameter and a route specifier parameter, and the step of configuring according to the configuration parameter of the VPN is:

Allocating a VPN routing forwarding table resource locally, configuring the VPN routing forwarding table according to the routing target parameter and the routing speculative parameter, locally creating a ppp interface, and adding the ppp interface to the VPN routing forwarding table. And initiating a routing information protocol on the ppp interface.

8. A backend device, comprising:

Receiving a request message unit, configured to receive a request message sent by the access device and requesting access to the virtual private network VPN, where the request message carries the authentication information;

An authentication unit, configured to perform authentication on the request message according to the authentication information, and an allocation unit, configured to globally allocate a VPN configuration parameter of the access device after the request message is authenticated;

9. The backend device of claim 8, further comprising:

The service application unit is configured to receive a VPN service request request message, where the VPN service request request message carries VPN attribute information, allocates a unique identifier to the VPN attribute information, and saves the VPN attribute information.

10. The backend device of claim 9, wherein:

The authentication information is a username and a password for connecting to the virtual private network, and the authentication unit uses the AAA server system to authenticate the request message according to the username and the password.

The back-end device according to claim 9, wherein the VPN attribute information is a maximum number of sites that are allowed to access the VPN, and further includes:

a judging unit, configured to determine, after the request message passes the authentication, whether the site currently accessing the VPN exceeds a maximum number of sites allowed to access the VPN, and if yes, feeding back a failure message to the site, if not And globally allocating the VPN configuration parameter of the access device, and sending the VPN configuration parameter to the access device.

12. A backend device according to claim 9 or 10, characterized in that

The allocating unit globally allocates a routing target parameter and a routing specifier parameter of the access device;

The sending parameter unit sends the VPN attribute information, the routing target parameter, and the routing specifier parameter as a packet payload based on the Radius protocol, and sends the packet to the access device through the Radius protocol.

13. An access device, comprising:

a receiving unit, configured to receive, by the access device, a request message that is sent by the station and is requested to access the virtual private network VPN, where the request message carries the authentication information;

The access device according to claim 13, comprising:

The receiving unit is configured to receive, by the access device, a request message that carries the authentication information that is sent by the station through the 802.1x client, where the VPN configuration parameter is a route target parameter and a route specifier parameter, and the configuration unit locally allocates the virtual exchange instance resource. And configuring the virtual switch instance according to the route target parameter and the route specifier parameter, and adding the 802.1x port to the virtual switch instance;

Or,

The receiving unit is configured to receive, by the access device, a request message that carries the authentication information that is sent by the station through the pppoe client, where the VPN configuration parameter is a route target parameter and a route specifier parameter, and the configuration unit locally allocates a VPN routing forwarding table resource. According to the routing target parameters and The routing specifier parameter configures the VPN routing forwarding table, locally creates a ppp interface, adds the ppp interface to the VPN routing forwarding table, and starts a routing information protocol on the ppp interface.

A system for providing a virtual private network service, comprising:

A backend device according to any one of claims 8 to 12, and an access device according to any one of claims 13 and 14.