WO2011157126A2

WO2011157126A2 - Packet forwarding method and inter-network routing apparatus

Info

Publication number: WO2011157126A2
Application number: PCT/CN2011/074975
Authority: WO
Inventors: 杨新江; 高鹏; 滕新东; 佟兴; 向海洲
Original assignee: 华为技术有限公司
Priority date: 2011-05-31
Filing date: 2011-05-31
Publication date: 2011-12-22
Also published as: WO2011157126A3; CN102204191A

Abstract

A packet forwarding method and an inter-network routing apparatus are provided, wherein the inter-network routing apparatus includes at least two sub-cards used for packet forwarding. The packet forwarding method includes: receiving, by each sub-card of the inter-network routing apparatus, a first packet sent from a transmitting end at the private network side; inquiring, according to the private network IP address and the private network transmission protocol port number carried in the first packet, a corresponding relationship table, which is preset in the sub-card, between the private network address and port and the public network address and port for mapping, and obtaining the public network IP address and the transmission protocol port number for mapping corresponding to the private network IP address and the private network transmission protocol port number; substituting the private network IP address and the private network transmission protocol port number with the public network IP address for mapping and the transmission protocol port number for mapping, and generating a second packet; sending the second packet to the public network side. The present invention improves the packet forwarding speed by disposing the network address translation function into each sub-card.

Description

Message forwarding method and network routing device

The present invention relates to the field of networks, and in particular, to a packet forwarding method and an inter-network routing device. Background technique

NAT (Ne twork Addres s Trans l a t i on, network address translation) technology is a technology for realizing the conversion between private IP addresses and public IP addresses. In the context of the current depletion of legitimate IPv4 addresses, NAT technology can be used to convert private I Pv4 addresses and IPv6 addresses of a large number of private network users into a small number of public IP Pv4 addresses, so that private network users can use I Pv4 addresses. The connection to the public network is connected.

Currently, the conversion of a private IP address and an IPv6 address to a public network IP address is usually performed by an inter-network routing device as shown in FIG. In Figure 1, the packet on the private network side is sent to the private network side interface card through the private network side subcard. After the packet is processed, the private network side interface board forwards the packet to the service board. The service board performs NAT address mapping to complete the conversion from the private IP address to the public IP address. The packets of the NAT address mapping are forwarded to the public network side interface card and sent to the public network through the public network side subcard.

In the actual application, when the traffic of the NAT mapping is large, the performance of the processing chip of the service board is limited, so that the processing performance of the service board is degraded, which becomes a bottleneck in the entire packet forwarding process. The processing speed of the text is significantly higher than the speed at which the service board performs NAT address mapping. In this case, the processing speed of the entire network routing device is limited by the processing speed of the service board, which wastes the processing capability of the interface board, making the overall processing speed difficult to further improve, and greatly affecting the packet forwarding speed. , is not conducive to large-scale commercial applications.

Summary of the invention

The embodiment of the invention provides a packet forwarding method and an inter-network routing device, which improves the speed of packet forwarding. To achieve the above objective, the embodiment of the present invention adopts the following technical solution: A packet forwarding method is applied to an inter-network routing device, where the inter-network routing device includes at least two sub-cards for forwarding packets. The methods include:

Each of the sub-cards receives the first packet sent by the transmitting end of the private network side; the first packet carries the private network IP address of the transmitting end of the private network side and the transmission protocol port number of the transmitting end of the private network side; The private network IP address of the sender on the private network side and the transport protocol port number of the sender on the private network side. Query the correspondence between the private network address and port pre-configured in the subcard and the public network address and port for mapping. The mapping public network IP address and the mapping transmission protocol port number corresponding to the private network IP address of the transmitting end of the private network side and the transmission protocol port number of the transmitting end of the private network side;

And replacing the private network IP address of the private network side sender end and the transport protocol port number of the private network side sender end in the first 艮艮为所述Carrying the second message of the mapping public network IP address and the mapping transmission protocol port number;

Send the second packet to the public network side.

An inter-network routing device includes at least two sub-cards for packet forwarding, and each sub-card further includes:

The first packet receiving unit is configured to receive the first packet sent by the sending end of the private network side; the first text carries the private network IP address of the sending end of the private network side and the transmission protocol port number of the sending end of the private network side;

The public network address obtaining unit is configured to query the private network address, port, and mapping pre-set in the sub-card according to the private network IP address of the sending end of the private network side and the transmission protocol port number of the sending end of the private network side. Corresponding relationship table between the network address and the port, and obtaining the mapping public network IP address and the mapping transmission protocol port number corresponding to the private network IP address of the transmitting end of the private network side and the transmission protocol port number of the transmitting end of the private network side;

a public network address replacing unit, configured to send the private network side sender end in the first packet The private network IP address and the transport protocol port number of the private network side sender are replaced by the mapping public network IP address and the mapping transport protocol port number, and the public network IP address for mapping and the transport protocol port number for mapping are generated. Second message;

The second packet sending unit is configured to send the second packet to the public network side.

The embodiment of the present invention provides a packet forwarding method and an inter-network routing device, which perform network address translation processing on a packet passing through the sub-card directly on each sub-card of the inter-network routing device, without The network address translation processing is performed on the service board, which not only reduces the processing load of the service board, but also avoids the limitation of the processing speed of the entire network routing device by the service board to the network address translation processing speed of the service board. The speed of message forwarding.

DRAWINGS

1 is a schematic diagram of an inter-network routing device responsible for packet forwarding provided by the prior art; FIG. 2 is a flowchart of a method for forwarding a packet according to Embodiment 1 of the present invention;

3 is a block diagram of a subcard of an inter-network routing device in Embodiment 1 of the present invention;

4 is a schematic diagram of an inter-network routing apparatus according to Embodiment 2 of the present invention;

5 is a flowchart of a method for forwarding a packet according to Embodiment 2 of the present invention;

6 is a schematic diagram of another inter-network routing apparatus according to Embodiment 2 of the present invention;

7 is a schematic diagram of an inter-network routing apparatus provided in Embodiment 3 of the present invention;

8 is a flowchart of a method for forwarding a packet according to Embodiment 3 of the present invention;

9 is a block diagram of a subcard of an inter-network routing device according to Embodiment 4 of the present invention;

Figure 10 is a block diagram of the daughter card of the inter-network routing device based on Figure 9.

detailed description

The technical solutions of the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings of the embodiments of the present invention. It is obvious that the described embodiments are only a part of the embodiments of the present invention, but not all of the embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention. Example 1:

The embodiment of the invention provides a packet forwarding method. As shown in FIG. 2, the method includes the following steps:

101. The subcard receives the first packet sent by the sending end of the private network side.

The daughter card is located on an inter-network routing device between the private network and the public network. The inter-network routing device usually includes a plurality of sub-cards, a plurality of interface boards corresponding to the sub-cards, and at least one switching network board for connecting to the interface board. Each subcard receives the first message sent by the sender on the private network side. The first file carries the private network IP address of the private network side transmitting end and the transmission protocol port number of the private network side transmitting end. The first packet carries the public network IP address of the receiving end of the public network side, the transmission protocol port number of the receiving end of the public network side, and the transmission protocol used by the first packet.

102. Obtain a mapping public network IP address and a mapping transmission protocol port number corresponding to the private network IP address of the transmitting end of the private network side and the transmission protocol port number of the transmitting end of the private network side.

Querying the correspondence between the private network address and the port pre-set in the sub-card and the public network address and port for mapping according to the private network IP address of the transmitting end of the private network side and the transmission protocol port number of the transmitting end of the private network side And obtaining a mapping public network IP address and a mapping transmission protocol port number corresponding to the private network IP address of the transmitting end of the private network side and the transmission protocol port number of the receiving end of the public network side.

103. Replace the private network IP address of the private network side sending end and the transport protocol port number of the private network side sending end in the first packet with the mapping public network IP address and the mapping transport protocol port number. And generating a second packet carrying the public IP address of the mapping and the transport protocol port number of the mapping.

When a device on the private network sends a packet to a device on the public network, it first needs to translate the address and port through the NAT translation device. Specifically, in the embodiment of the present invention, the conversion of the address and the port is performed in the sub-card: by querying the corresponding relationship table, obtaining a private network IP address and a private network with the sending end of the private network side The mapping of the transmission protocol port number of the side transmitting end uses the public network IP address and the mapping transmission protocol port number, and replaces the private network IP address of the transmitting end of the private network side and the transmission protocol port number of the transmitting end of the private network side. The private network IP address of the private network side transmitting end and the transmission protocol port number of the private network side transmitting end recorded in the first text are replaced and changed to the second message. The second packet still carries the data information in the first packet. 1 04. Send the second packet to the public network side.

The second packet carries the public network IP address for mapping and the transport protocol port number for mapping, the public network IP address of the receiving end of the public network side, and the transport protocol port number of the receiving end of the public network side, and the The transport protocol used by the first message. The second packet is finally sent to the receiving end of the public network side.

For example, a TCP (Transmit s i on Cont ro l Pro toco l) connection is established between device A in the private network and device B in the public network. The device sends a first packet based on the TCP to the device B, and the IP address of the private network of the device A and the public IP address of the device B are recorded in the IP packet header of the first packet. In addition, in the TCP packet header, the TCP port number of the device A and the TCP port number of the device B of the receiver are recorded. After receiving the first packet based on the TCP, the sub-card of the inter-network routing device obtains a mapping IP address corresponding to the private network IP address of the device A by searching the corresponding relationship table, and the The TCP port number corresponding to the TCP port number of the device A uses the TCP port number, and the mapping IP address and the mapping TCP port number are used to replace the private IP address of the original device A and the TCP port number of the device A, thereby generating a TCP-based Second message. The second TCP-based packet is finally transmitted to the device B in the public network.

The embodiment of the present invention further provides an inter-network routing device, where the inter-network routing device includes at least two sub-cards for packet forwarding. The structure of the subcard is as shown in FIG. 3, and includes: a first packet receiving unit 31, a public network address obtaining unit 32, a public network address replacing unit 33, and a second packet transmitting unit 34.

The first packet receiving unit 31 is configured to receive the first packet sent by the sending end of the private network side, where the first packet carries the private network IP address of the transmitting end of the private network side and the transmission protocol of the transmitting end of the private network side. The port number.

The public network address obtaining unit 32 is configured to query, according to the private network IP address of the sending end of the private network side and the transmission protocol port number of the sending end of the private network side, the private network address, the port, and the mapping preset in the subcard. The mapping table between the public network address and the port obtains the mapping public network IP address and the mapping transmission protocol port number corresponding to the private network IP address of the private network side transmitting end and the transmission protocol port number of the private network side transmitting end.

The public network address replacing unit 33 is configured to replace the private network IP address of the private network side transmitting end and the transport protocol port number of the private network side sending end in the first packet with the mapping public network IP address. And mapping with the transport protocol port number, generating a public network IP carrying the mapping The address and mapping are the second text of the transport protocol port number.

The second packet sending unit 34 is configured to send the second packet to the public network side.

The embodiment of the invention provides a packet forwarding method and an inter-network routing device. The address and port number mapping function is deployed on the daughter card of the inter-network routing device, and the distributed processing of the network address translation is performed by the daughter card to mitigate The processing load of the service board avoids the limitation of the processing speed of the entire network routing device by the service board to perform network address translation processing on the packet, which greatly improves the packet forwarding speed.

Example 2:

In a common network deployment, the network on the private network side is more complex than the network on the public network side. Correspondingly, the number of subcards on the private network side is larger than the number of subcards on the public network side. Considering the cost of the equipment, you can The network address translation function is migrated from the service board to the public network side daughter card, and the public network side daughter card is set as the service acceleration daughter card, as shown in Figure 4. In this scenario, the embodiment of the present invention provides a packet forwarding method. As shown in FIG. 5, the method includes the following steps:

201. The service acceleration subcard receives the first packet sent by the sending end of the private network side.

The first packet is first transmitted to the private network side sub-card and forwarded by the private network side sub-card to the private network side interface board. After the private network side interface board performs corresponding processing on the first packet, The first packet is forwarded to the public network side interface board, and is forwarded by the public network side interface board to the service power port speed daughter card.

For the first packet sent by the sending end of the private network, a part of the packet that needs to be processed in the service board (for example, the parsing of the application layer information) is forwarded to the private network side interface board. After the service board completes the related processing on the service board, the service board forwards the information to the public network side interface board.

The first message sent by the sending end of the private network side includes the private network IP address of the sending end of the private network side and the transmission protocol port number of the sending end of the private network side, the transmission protocol used by the first file, and the public A quintuple consisting of the public network IP address of the receiving end of the network side and the transport protocol port number of the receiving end of the public network side. The device of the private network side transmitting end of the private network IP address establishes a message transmission path with the device of the public network side receiving end of the public network IP address, and the transmission protocol port of the transmitting end of the private network side is used. The transmission protocol port of the receiving end of the public network side sends the corresponding message processing and address mapping through the inter-network routing device, and transmits the corresponding data to the destination of the receiving end of the public network side.

202. The service acceleration subcard determines whether there is a first one sent by the sending end of the private network side. Corresponding relationship table corresponding to the text.

When the correspondence table exists in the service acceleration daughter card, the process goes to step 203; otherwise, the process goes to step 205.

203. The service acceleration sub-card obtains the mapping public network IP address and the mapping transmission protocol port number in the correspondence table corresponding to the first packet according to the quintuple of the first packet.

The first packet is transmitted to the service acceleration subcard of the inter-network routing device, and the service acceleration subcard searches the correspondence table according to the quintuple of the first packet to obtain the first ^ The mapping of the quintuple's quintuple uses the public network IP address and the mapping protocol port number.

204. Replace the private network IP address of the private network side sending end and the transport protocol port number of the private network side sending end in the first packet with the mapping public network IP address and the mapping transmission protocol port number. And generating a second message carrying the mapping public network IP address and the mapping transmission protocol port number.

The quintuple in the second packet is a public network IP address for mapping and a transport protocol port number for mapping, a transport protocol used by the first packet, and a public network IP address of the receiving end of the public network side. The transmission protocol port number of the receiving end of the public network side.

After step 204 is performed, the process proceeds to step 206.

205. The service acceleration subcard allocates the public network IP address of the mapping and the transmission protocol protocol for the public network IP address of the private network side transmitting end and the transmission protocol port number of the private network side transmitting end in the first message. The port number.

The service acceleration subcard records the mapping with the public network IP address and the mapping transmission protocol port number to the correspondence table. The correspondence table records the correspondence between the quintuple of the first packet and the public IP address of the mapping and the transport protocol port number of the mapping, and has the same five-tuple as the first packet. When the subsequent packet is sent by the private network side and transmitted to the service acceleration daughter card, the mapping public network IP address and the mapping transmission protocol port number can be obtained by directly searching the corresponding relationship table, without performing the steps again. 205.

206. Send the second packet to the public network side.

The second packet is sent to the public network side by the service acceleration subcard and finally transmitted to the public network side receiving end. 207. The service acceleration subcard receives the third packet returned by the public network side.

The receiving end of the public network side receives the second packet, and performs a related process on the public network side of the second packet to generate a third packet. The third packet carries the public IP address for mapping and the transport protocol port number for mapping, the transport protocol used by the third packet (same as the transport protocol used by the first packet), and the public network. A quintuple consisting of the public network IP address of the side receiving end and the transport protocol port number of the receiving end of the public network side. The third packet performs corresponding packet processing and network address translation by using the inter-network routing device.

208. The service acceleration subcard queries the corresponding relationship table, and obtains a private network IP address of the private network side sender end and a private network side sender end corresponding to the mapping public network IP address and the mapping transmission protocol port number. Protocol port number.

The third packet returned from the public network side is transmitted to the service acceleration daughter card of the network routing device, and the service acceleration daughter card searches for the correspondence table according to the quintuple of the third packet. And obtaining a private network IP address of the private network side sender end and a transport protocol port number of the private network side sender end corresponding to the third packet.

In an actual application, the correspondence table may be one, that is, the first text and the third text respectively obtain an address through the same correspondence table; optionally, two correspondence tables may also be set. They are a forward correspondence table and a reverse correspondence table, respectively. The service acceleration subcard allocates the public IP address of the mapping and the transmission protocol port number of the mapping by the private network IP address of the private network side transmitting end and the transmission protocol port number of the private network side transmitting end in the first message. And the service acceleration subcard records the mapping of the public network IP address and the mapping transmission protocol port number to the forward correspondence table, and in the forward correspondence table, the foregoing A four-tuple quintuple can uniquely determine the corresponding public network for mapping

The IP address and the transport protocol port number for mapping; while generating the forward correspondence table, the reverse correspondence table is also generated, and in the reverse correspondence table, the quintuple of the third object is passed The private network IP address of the corresponding private network side sender and the transport protocol port number of the private network side sender end can be uniquely determined.

In the above description of the embodiment of the present invention, the private network IP addresses of the different private network side senders are different, so that the mapping public IP address corresponding to the mapping may be uniquely determined by the quintuple of the first packet. The address and the mapping protocol port number are used, and the private network IP address of the corresponding private network side transmitting end and the transmission protocol port number of the private network side transmitting end are uniquely determined by the quintuple of the third message. In other application scenarios, for example, there are at least two In the private network side of the VPN (V ir tua l Pr i va te Ne twork, virtual private network), the computers in different VPNs can use the same private IP address, and the different private network side senders The quintuple of a message can be identical. In this case, the corresponding public IP address and mapping of the mapping are determined by the quintuple of the first packet and the identifier of the VPN where the transmitting end of the private network side of the first packet is sent. Using the transmission protocol port number; correspondingly, the quintuple of the third packet and the identifier of the VPN where the sender of the private network side of the first packet are sent are jointly determined to be sent by the corresponding private network side. The private IP address of the end and the transport protocol port number of the sender on the private network side.

209. The service acceleration subcard replaces the mapping between the public network IP address and the mapping transmission protocol port number in the third file with the private network IP address of the private network side sending end and the private network side sending end. Transmitting a protocol port number to generate a private network carrying the sender on the private network side

The fourth address of the IP address and the transmission protocol port number of the sender on the private network side.

210. Send the fourth packet to the private network side sending end.

The fourth packet is forwarded to the public network side interface board by the service acceleration subcard, and is forwarded by the public network side interface board to the private network side interface board, and then sent to the private network through the private network side subcard. The side sender transmits. A part of the packet that needs to be processed in the service packet (for example, the parsing of the application layer information) in the fourth packet is forwarded to the service board after being sent to the service board in the service board. After the related processing is complete, the service board forwards the packet to the private network side interface board.

In the prior art, a sub-card routing table is usually stored on the service board, and the routing relationship between the private network side sub-card and the public network side sub-card is recorded on the sub-card routing table. In the embodiment of the present invention, the service board may send the sub-card routing table to the private network side sub-card and the service acceleration sub-card respectively. According to the routing relationship recorded on the sub-card routing table, the private network side sub-card forwards the first packet received by the private network side interface board to the public network side interface board and finally to the sub-card routing. Correspondingly, the service acceleration subcard forwards the third packet received by the service acceleration card to the interface board of the public network side and the interface board of the private network side, and finally sends the packet to the subcard routing table record. Corresponding to the private network side of the subcard.

Specifically, in a scenario where the network address translation is performed when the packet is sent from the IPv4 private network to the IPv4 public network, the service acceleration daughter card of the inter-network routing device queries the corresponding relationship table to send the first report sent by the IPv4 private network. In the IPv4 format, the private network IP address of the private network side sender and the transport protocol port number of the private network side sender end are replaced with the IPv4 format mapping public. The network IP address and the mapping protocol port number are used, and the second packet that completes the network address translation is sent to the IPv4 public network. In the scenario of performing network address translation when the packet is returned from the IPv4 public network to the I Pv4 private network, the service acceleration daughter card of the inter-network routing device queries the corresponding relationship table to return the third packet returned by the IPv4 public network. The mapping in the IPv4 format is replaced with the public network IP address of the private network side sender and the transport protocol port number of the private network side sender end in the IPv4 format by using the public network IP address and the mapping transport protocol port number.

Further, in a scenario where the network address is translated when the packet is sent from the IPv6 private network to the IPv4 public network, the method provided by the embodiment of the present invention may also be performed. For example, for an IPv6 address that uses the NAT64 technology for address construction, the IP address of the IPv6 address is prefixed with the NAT64 prefix, and the remaining part of the I Pv6 address with the NAT64 prefix removed is the corresponding IP address. After receiving the first packet sent by the IPv6 private network, the service acceleration subcard replaces the private network IP address in the IPv6 format and the transport protocol port number of the private network side sender with the public network IP address in the IPv4 format according to the mapping table. The address and the mapping protocol port number are used. The NAT64 prefix in the public network IP address of the public network side of the IPv6 format is also deleted. The public network IP address of the public network side receiving end in IPv4 format is obtained. When the service acceleration subcard receives the third packet returned by the IPv4 public network, the mapping in the IPv4 format is replaced with the public network IP address and the mapping transmission protocol port number in the IPv6 format according to the correspondence table. The private network IP address of the side sender and the transport protocol port number of the sender on the private network side. At the same time, the public network IP address of the public network side of the IPv4 format is prefixed with NAT64, and the IPv6 format is restored. The text is sent to the corresponding destination in the IPv6 private network.

For IPv6 addresses that use IVI technology for network address translation, the IPv6 address has an I VI prefix, and the rest of the IPv6 address with the IVI prefix removed is the corresponding IPv4 address. The address translation between the IPv6 address and the IPv4 address of the service-accelerated daughter card is similar to the address translation between the IP address and the IPv4 address of the NAT prefix, and is not described here.

In an embodiment of the present invention, as an optional implementation manner, the function of allocating the mapping public network IP address and the mapping transmission protocol port number and the function of creating the correspondence relationship table may be retained in the service board. When the corresponding relationship table does not exist in the service acceleration subcard, the service acceleration subcard forwards the first packet sent by the private network side to the service board, so that the service board is the first one sent by the private network side. Packet allocation mapping uses public IP address and mapping transmission The protocol port number is created, and the corresponding correspondence table is created, and the corresponding relationship table is configured on the service acceleration daughter card. The service acceleration subcard sends the second packet generated after the network address translation on the service board to the public network side. When the subsequent packet having the same five-tuple group as the first packet with the public network IP address and the mapping transport protocol port number mapped by the service board is transmitted from the private network side to the service acceleration daughter card, the device may directly search for the Correspond to the relationship table, and perform the corresponding network address translation. It is not necessary to forward the packet to the service board for processing.

In addition, as an alternative implementation manner of the embodiment of the present invention, all the functions of the service board can be integrated into the service acceleration sub-card, and the service board is cancelled in the inter-network routing device, as shown in FIG. 6.

In addition, the service acceleration daughter card divides the corresponding relationship table J of the saved access that has been saved by itself. t匕: 3⁄4 port, for a message based on UDP (Us er Da tag ram Pro t oco l, User Data Protocol), when the correspondence table is not accessed within a predetermined aging time, deleting the Correspondence table; For a TCP-based packet, when the service acceleration subcard receives the F IN/RST packet, it directly initiates rapid aging and deletes the corresponding relationship table of the corresponding TCP packet.

When the number of the subnet cards on the public network side is large, each public network subcard can be configured as the service acceleration subcard to share part of the network address translation function and improve the network address translation efficiency of the entire device. .

The embodiment of the present invention provides a packet method, where the address and port number mapping function is deployed on the sub-card, which reduces the processing load of the service board, and avoids the processing speed of the packet flow processing by the entire network routing device. The board limits the speed of network address translation processing on packets, which greatly improves the speed of packet forwarding and is beneficial to large-scale commercial applications. In addition, the method provided by the embodiment of the present invention can be applied to address mapping between I Pv4 and address mapping between I Pv6 and IPv4 at the same time.

Example 3:

The service acceleration sub-card of the inter-network routing device in the second embodiment of the present invention is located on the public network side, and is applicable to an application environment with stable networking conditions. When the networking status is in a state of constant change (for example, when the network complexity on the private network side is lower than the network complexity on the public network side, installing the service acceleration daughter card on the private network side can save the cost of the device). The service acceleration daughter card in the second embodiment of the invention needs to be frequently disassembled and changed in the installation position, resulting in cumbersome operation and insufficient flexibility of the entire device. To this end, the network address translation function can be integrated on the public network side subcard and the private network side subcard, respectively, to form a private network side service acceleration subcard and a public network side service acceleration subcard, as shown in FIG. 7. Shown. In this scenario, the embodiment of the present invention provides a packet forwarding method. As shown in FIG. 8, the method includes the following steps:

301. The private network side service acceleration subcard receives the first packet sent by the sending end of the private network side. The first message sent by the sending end of the private network side includes the private network IP address of the transmitting end of the private network side and the transmission protocol port number of the transmitting end of the private network side, and the transmission protocol used by the first file and the public network. A quintuple consisting of the public network IP address of the side receiving end and the transport protocol port number of the receiving end of the public network side.

302. The private network side service acceleration subcard determines whether there is a correspondence table corresponding to the first message sent by the sending end of the private network side.

When the correspondence table exists in the private network side service acceleration daughter card, the process goes to step 303; otherwise, the process goes to step 305.

303. The private network side service acceleration subcard obtains the mapping public network IP address and the mapping transport protocol port number in the correspondence table corresponding to the first packet according to the quintuple of the first packet.

304. Replace the private network IP address of the private network side sending end and the transport protocol port number of the private network side sending end in the first packet with the mapping public network IP address and the mapping transport protocol port number. And generating a second message carrying the mapping public network IP address and the mapping transmission protocol port number.

After performing step 304, the process proceeds to step 306.

305. The private network side service acceleration subcard forwards the first packet to the service board.

The service board allocates the public network IP address of the private network side of the first network and the transport protocol port number of the private network side of the first network to allocate the public IP address for mapping and the transport protocol port number for mapping. Second message. At the same time, the service board records the mapping of the public network IP address and the mapping transmission protocol port number to the corresponding relationship table, and sends the corresponding relationship table to the private network side service acceleration daughter card and the public network respectively. Side service acceleration daughter card.

Optionally, the service board can generate two correspondence tables, which are positive correspondences. The table and the reverse correspondence table are sent to the private network side service acceleration daughter card, and the reverse correspondence table is sent to the public network side service acceleration daughter card. For descriptions of the forward correspondence table and the reverse correspondence table, refer to the description in Embodiment 2, and details are not described herein again.

306. Send the second packet to the public network side.

The private network side service acceleration subcard forwards the second packet to the public network side interface board through the private network side interface board, and forwards the second packet to the public network side service acceleration daughter card by the public network side interface board, and then The public network side service acceleration subcard is transmitted to the receiving end of the public network side.

307. The service network acceleration subcard of the public network side receives the third packet returned by the receiving end of the public network side. The receiving end of the public network side receives the second packet, and performs a related process on the public network side of the second packet to generate a third packet. The third packet carries the public IP address for mapping and the transport protocol port number for mapping, the transport protocol used by the third packet (same as the transport protocol used by the first packet), and the public network. A quintuple consisting of the public network IP address of the side receiving end and the transport protocol port number of the receiving end of the public network side.

308. The public network side service acceleration subcard queries the corresponding relationship table, and obtains a private network IP address and a private network side of the private network side sending end corresponding to the mapping public network IP address and the mapping transmission protocol port number. The transmission protocol port number of the sender.

309. The public network side service acceleration subcard replaces the mapping in the third packet with the public network IP address and the mapping transmission protocol port number with the private network IP address and the private network of the private network side sending end. The transmission protocol port number of the side transmitting end generates a fourth packet carrying the private network IP address of the transmitting end of the private network side and the transmission protocol port number of the transmitting end of the private network side.

31 0. Send the fourth packet to the private network side sending end.

The public network side service acceleration subcard forwards the fourth packet to the private network side interface board through the public network side interface board, and forwards the private network side interface board to the private network side service acceleration subcard, and then privately The network side service acceleration subcard sends the fourth packet to the private network side.

The fourth packet is forwarded to the public network side interface board by the service acceleration subcard, and is forwarded by the public network side interface board to the private network side interface board, and then sent to the private network through the private network side subcard. The side sender transmits. A part of the packet that needs to be processed in the service packet (for example, the parsing of the application layer information) in the fourth packet is forwarded to the service board after being sent to the service board in the service board. After the related processing is complete, the service board forwards the packet to the private network side interface board. In the prior art, a sub-card routing table is usually stored on the service board, and the routing relationship between the private network side sub-card and the public network side sub-card is recorded on the sub-card routing table. In the embodiment of the present invention, the service board may send the sub-card routing table to the private network side service acceleration sub-card and the service acceleration sub-card respectively. According to the routing relationship recorded on the sub-card routing table, the private network-side service sub-card forwards the first packet received by the private network side interface board to the public network side interface board and the public network side interface board, and finally sends the packet to the sub-card. Correspondingly, the service acceleration subcard forwards the third packet received by the service acceleration card to the interface card of the public network side and the interface board of the private network side, and finally sends the packet to the subcard routing table. Record the corresponding private network side subcard.

Specifically, the method in the embodiment of the present invention may be applied to network address translation between an IPv4 private network and an IPv4 public network, and network address translation between an I Pv6 private network and an IPv4 public network (including NAT64 technology and IV I technology), and the specific description may be Reference is made to the description in Embodiment 2 of the present invention, and details are not described herein again.

In the above description of the embodiment of the present invention, the private network IP addresses of the different private network side senders are different, so that the mapping public IP address corresponding to the mapping may be uniquely determined by the quintuple of the first packet. The address and the mapping protocol port number are used, and the private network IP address of the corresponding private network side transmitting end and the transmission protocol port number of the private network side transmitting end are uniquely determined by the quintuple of the third message. In other application scenarios, for example, in a private network side network environment where at least two VPNs (V ir tua pr va te Ne twork, virtual private network) exist, computers in different VPNs can be used. The same private IP address, the quintuple of the first packet on the different private network side senders can be identical. In this case, the corresponding public IP address and mapping of the mapping are determined by the quintuple of the first packet and the identifier of the VPN where the transmitting end of the private network side of the first packet is sent. Using the transmission protocol port number; correspondingly, the quintuple of the third packet and the identifier of the VPN where the sender of the private network side of the first packet are sent are jointly determined to be sent by the corresponding private network side. The private IP address of the end and the transport protocol port number of the sender on the private network side.

In an embodiment of the present invention, as an optional implementation manner, the function of allocating the mapping public network IP address and the mapping transmission protocol port number and the function of creating the correspondence relationship table may be integrated into the public network side service acceleration. The sub-card and the private network side service acceleration sub-card; further, the other processing functions of the service board can be integrated into the public network side service acceleration sub-card and the private network side service acceleration sub-card, thereby being in the network The service board is canceled in the routing device. For a detailed description, refer to the description in Embodiment 2 of the present invention, and details are not described herein again. The embodiment of the present invention provides a packet forwarding method, in which the address and port number mapping function is deployed on the sub-card, which reduces the processing load of the service board, and avoids the processing speed of the packet processing by the entire network routing device. The service board limits the speed of network address translation processing of packets, which greatly improves the speed of packet forwarding and is beneficial to large-scale commercial applications. In addition, the method provided by the embodiment of the present invention can be applied to address mapping between IPv4 and address mapping between IPv6 and IPv4. In the embodiment of the present invention, the service acceleration sub-card is deployed on both the public network side and the private network side, which is applicable to a scenario in which the networking situation is complex and variable, and the flexibility of the entire device is improved.

Example 4:

An embodiment of the present invention provides an inter-network routing device, where the inter-network routing device includes at least two sub-cards for packet forwarding. The structure of the subcard is as shown in FIG. 9, and includes: a first packet receiving unit 41, a public network address obtaining unit 42, a public network address replacing unit 43, a second packet sending unit 44, and a third packet receiving unit. 45. A private network address obtaining unit 46, a private network address replacing unit 47, and a fourth message sending unit 48.

The first packet receiving unit 41 is configured to receive the first packet sent by the sending end of the private network side, where the first packet carries the private network IP address of the transmitting end of the private network side and the transmission protocol of the transmitting end of the private network side. The port number.

The public network address obtaining unit 42 is configured to query, according to the private network IP address of the transmitting end of the private network side and the transmission protocol port number of the sending end of the private network side, the private network address, the port, and the mapping preset in the subcard. The mapping table between the public network address and the port obtains the mapping public network IP address and the mapping transmission protocol port number corresponding to the private network IP address of the private network side transmitting end and the transmission protocol port number of the private network side transmitting end. .

The public network address replacing unit 43 is configured to replace the private network IP address of the private network side transmitting end and the transport protocol port number of the private network side sending end in the first packet with the mapping public network IP address. And mapping the transport protocol port number to generate a second packet carrying the public IP address of the mapping and the transport protocol port number of the mapping.

The second packet sending unit 44 is configured to send the second packet to the public network side.

The third packet receiving unit 45 is configured to receive the third packet returned by the public network side.

The receiving end of the public network side receives the second packet, and performs related processing on the public network side of the second packet, and then generates a third packet and sends the packet to the inter-network routing device. The third packet carries the public IP address for mapping and the transport protocol port number for mapping. The private network address obtaining unit 46 is configured to query the correspondence relationship table according to the mapping public network IP address and the mapping transmission protocol port number, and obtain the mapping public network IP address and the mapping transmission protocol port number. The private network IP address of the sender on the private network side and the transport protocol port number of the sender on the private network side.

The private network address replacing unit 47 is configured to replace the mapping with the public network IP address and the mapping transmission protocol port number in the third packet with the private network IP address and the transmission protocol of the private network side transmitting end. The port number is generated to generate a fourth packet carrying the private network IP address and the transmission protocol port number of the private network side sender.

The fourth packet sending unit 48 is configured to send the fourth packet to the private network side sending end.

Further, as shown in FIG. 10, the apparatus further includes: a public network address assigning unit 49, a correspondence relationship recording unit 410, a message forwarding unit 41 1 , a public network address receiving unit 412, a correspondence relationship table receiving unit 41 3, and Correspondence table deletion unit 414.

The public network address assigning unit 49 is configured to: when the corresponding relationship table does not exist in the subcard, the private network IP address of the private network side transmitting end and the private network side sending end of the first packet The transport protocol port number assigns the mapping public network IP address and the mapping transport protocol port number.

The correspondence relationship recording unit 410 is configured to record the mapped public network IP address and the mapping transmission protocol port number after the mapping public network IP address and the mapping transmission protocol port number are allocated in the child card. Go to the correspondence table.

The message forwarding unit 411 is configured to: when the sub-card does not have the corresponding relationship table, the sub-card forwards the first packet sent by the private network side to the service board.

The service board allocates the public network IP address of the mapping and the transmission protocol port number of the mapping by the private network IP address of the private network side transmitting end and the transmission protocol port number of the private network side transmitting end in the first message. And mapping the allocated mapping to the correspondence relationship table by using a public network IP address and a mapping transmission protocol port number.

The public network address receiving unit 412 is configured to receive the mapping public IP address and the mapping transmission protocol port number allocated by the service board, to replace the private network IP address of the private network side sending end and the private network side sending The transport protocol port number of the end.

The correspondence relationship receiving unit 41 3 is configured to receive the record from the service board when receiving the mapping public network IP address and the mapping transmission protocol port number allocated by the service board. The mapping uses the correspondence table of the public network IP address and the mapping transmission protocol port number. The correspondence table deleting unit 414 is configured to delete the correspondence table that has been accessed in the child card.

For other application scenarios and related descriptions of the embodiments of the present invention, reference may be made to Embodiment 2 and Embodiment 3 of the present invention, and details are not described herein again.

The embodiment of the invention provides an inter-network routing device, which reduces the processing load of the service board by using the function of mapping the address and port number on the sub-card of the device, and avoids the flow of the entire network routing device. The processing speed is limited by the speed at which the service board performs network address translation processing on the packet, which greatly improves the speed of packet forwarding and is beneficial to large-scale commercial applications.

Through the description of the above embodiments, those skilled in the art can clearly understand that the present invention can be implemented by means of software plus necessary general hardware, and of course, by hardware, but in many cases, the former is a better implementation. . Based on such understanding, the technical solution of the present invention, which is essential or contributes to the prior art, may be embodied in the form of a software product stored in a readable storage medium, such as a floppy disk of a computer. A hard disk or optical disk, etc., includes instructions for causing a computer device (which may be a personal computer, server, or network device, etc.) to perform the methods described in various embodiments of the present invention.

The above is only the specific embodiment of the present invention, but the scope of the present invention is not limited thereto, and any person skilled in the art can easily think of changes or substitutions within the technical scope of the present invention. It should be covered by the scope of the present invention. Therefore, the scope of the invention should be determined by the scope of the claims.

Claims

Claim

A text forwarding method is applied to an inter-network routing device, where the inter-network routing device includes at least two sub-cards for forwarding packets, and the method includes:

Each of the sub-cards receives the first packet sent by the transmitting end of the private network side; the first packet carries the private network IP address of the transmitting end of the private network side and the transmission protocol port number of the transmitting end of the private network side; The private network IP address of the sender on the private network side and the transport protocol port number of the sender on the private network side. Query the correspondence between the private network address and port pre-configured in the daughter card and the public network address and port for mapping. The mapping between the private network IP address of the transmitting end of the private network side and the transmission protocol port number of the transmitting end of the private network side is a public network IP address and a mapping transmission port number;

And replacing the private network IP address of the private network side sender end and the transport protocol port number of the private network side sender end in the first 艮艮为所述映射映射映射映射映射映射映射映射Carrying the second message of the mapping public network IP address and the mapping transmission protocol port number;

Send the second packet to the public network side.

2. The method according to claim 1, further comprising:

The subcard receives the third packet returned by the public network side; the third packet carries the public IP address of the mapping and the transport protocol port number for mapping;

Querying the correspondence relationship table according to the mapping public network IP address and the mapping transmission protocol port number, and acquiring the private network side transmitting end corresponding to the mapping public network IP address and the mapping transmission protocol port number The private network IP address and the transmission protocol port number of the sender on the private network side; the mapping in the third packet is replaced by the public network IP address and the mapping transmission protocol port number as the private end of the private network side The network IP address and the transmission protocol port number of the transmitting end of the private network side, and the fourth packet containing the private network IP address of the transmitting end of the private network side and the transmission protocol port number of the transmitting end of the private network side is generated;

And sending the fourth packet to the private network side sending end.

The method according to claim 1, wherein when the correspondence table does not exist in the subcard, the method further includes:

The subcard is configured to allocate a public network IP address and a mapping for the mapping of the private network side transmitting end to the private network IP address of the private network side transmitting end and the private network side transmitting end of the first network. Use the transport protocol port number.

4. The method according to claim 3, wherein said subcard is allocated said After mapping the public network IP address and mapping the transport protocol port number, it also includes:

The subcard records the assigned mapping with the public network IP address and the mapping transmission protocol port number to the correspondence table.

5. The method according to claim 1, further comprising:

When the corresponding relationship table does not exist in the subcard, the subcard forwards the packet flow sent by the private network side to the service board, so that the service board is the one in the first packet. The private network IP address of the transmitting end of the private network side and the transport protocol port number of the transmitting end of the private network side are allocated with the public network IP address for mapping and the transport protocol port number for mapping, and the assigned mapping is made with the public network IP address and mapping. Recording to the corresponding relationship table by using a transport protocol port number;

The subcard receives the mapping public IP address and the mapping transmission protocol port number allocated by the service board, so as to replace the private network IP address of the private network side transmitting end and the transmission protocol port number of the private network side transmitting end. .

6. The method according to claim 5, further comprising:

When receiving the mapping public network IP address and the mapping transmission protocol port number allocated by the service board, the slave card further receives and records the mapping public network IP address and mapping transmission from the service board. The correspondence table of the protocol port numbers.

The method according to any one of claims 1 to 6, further comprising:

8. An inter-network routing device, comprising at least two sub-cards for packet forwarding, wherein each sub-card further comprises:

The first packet receiving unit is configured to receive the first packet sent by the sending end of the private network side; the first packet carries the private network IP address of the sending end of the private network side and the transmission protocol port of the sending end of the private network side number;

The public network address obtaining unit is configured to query, according to the private network IP address of the transmitting end of the private network side and the transmission protocol port number of the sending end of the private network side, the private network address, port, and mapping publicly set in the subcard Corresponding relationship table between the network address and the port, and obtaining the mapping public network IP address and the mapping transmission protocol port number corresponding to the private network IP address of the transmitting end of the private network side and the transmission protocol port number of the transmitting end of the private network side;

a public network address replacing unit, configured to replace the private network IP address of the private network side sending end and the transport protocol port number of the private network side sending end in the first packet with the public IP address of the mapping and Mapping uses the transport protocol port number to generate a public network IP address and mapping that carries the mapping Transmitting a second message of the transmission protocol port number;

9. The device according to claim 8, further comprising:

a third packet receiving unit, configured to receive a third packet returned by the public network side; the third packet carries the public IP address of the mapping and a transport protocol port number for mapping;

The private network address obtaining unit is configured to query the correspondence relationship table according to the mapping public network IP address and the mapping transmission protocol port number, and obtain the public network IP address and the mapping transmission protocol port number corresponding to the mapping The private network IP address of the sender on the private network side and the transport protocol port number of the sender on the private network side;

The private network address replacing unit is configured to replace the mapping with the public network IP address and the mapping transmission protocol port number in the third packet with the private network IP address and the transmission protocol port of the private network side transmitting end. No., generating a fourth packet carrying the private network IP address of the transmitting end of the private network side and the transmission protocol port number of the transmitting end of the private network side;

And a fourth packet sending unit, configured to send the fourth packet to the private network side sending end.

The device according to claim 8, further comprising:

a public network address allocation unit, configured to: when the corresponding relationship table does not exist in the child card, the private network IP address of the private network side transmitting end and the private network side transmitting end of the first The protocol port number assigns the mapping with the public network IP address and the mapping transport protocol port number.

The device according to claim 10, further comprising:

Corresponding relationship recording unit, configured to record the mapped public network IP address and the mapping transmission protocol port number to the subcard after the mapping public network IP address and the mapping transmission protocol port number are allocated to the subcard The correspondence table.

12. The device according to claim 8, further comprising:

a packet forwarding unit, configured to: when the sub-card does not have the corresponding relationship table, the sub-card forwards the first packet sent by the private network side to the service board; The private network IP address of the private network side sender and the transport protocol port number of the private network side sender end in the first message are assigned to the public network IP address for mapping and the transport protocol port number for mapping, and the assigned The mapping is recorded to the correspondence relationship table by using a public network IP address and a mapping transmission protocol port number;

a public network address receiving unit, configured to receive the mapping public IP address and the mapping transmission protocol port number allocated by the service board, to replace the private network IP address of the private network side sending end and the private network side sending end Transport protocol port number.

The device according to claim 12, further comprising:

a correspondence relationship receiving unit, configured to receive, when receiving the mapping public network IP address and the mapping transmission protocol port number allocated by the service board, the public IP address and the mapping public address from the service board Mapping the correspondence table of the transport protocol port number.

The apparatus according to any one of claims 8 to 13, characterized by further comprising: deleting the correspondence table.