WO2013053122A1

WO2013053122A1 - Method and device for preventing loop in virtual private network

Info

Publication number: WO2013053122A1
Application number: PCT/CN2011/080745
Authority: WO
Inventors: 王鸾; 吴学智
Original assignee: 中兴通讯股份有限公司
Priority date: 2011-10-13
Filing date: 2011-10-13
Publication date: 2013-04-18

Abstract

The present invention provides a method and a device for preventing a loop in a virtual private network. The method comprises the following steps: gathering a statistic of MAC drift according to a MAC item reported by a subsystem of a PE, and obtaining a MAC drift frequency; comparing the MAC drift frequency and a preset maximum MAC drift frequency; if the MAC drift frequency is greater than or equal to the preset maximum MAC drift frequency, blocking an AC or a PW that transmits MACs to the PE. In the method and device for preventing a loop in a virtual private network provided by the present invention, MAC drift occur when a loop is formed, so a protection policy can be configured according to the user requirement and networking demand. When it is detected that the MAC drift frequency is greater than the preset maximum MAC drift frequency, the AC or PW configured with the protection policy is blocked, so as to release the loop. The present invention not only ensures the network stability and service requirement, but also provides a more flexible and more convenient implementation manner.

Description

Method and device for preventing loop in virtual private network

The present invention relates to the field of network communications, and more particularly to a method and apparatus for preventing loops in a virtual private network. Background technique

Virtual Private LAN Service (VPLS) is an implementation of Multi-Protocol Label Switching Layer 2 Virtual Private Network (MPLS L2VPN). VPLS is based on multi-protocol label switching (Multi- Protocol Label Switching (MPLS) and Ethernet technology's Layer 2 Virtual Private Network (VPN) technology, providing virtual Ethernet monthly services on existing WANs, through membership discovery, virtual links (Pseudo Wire , PW) Establish and maintain, Media Forward Control (MAC)-based forwarding in the Virtual Forwarding Instance (VFI) to enable interconnection of LAN sites across the WAN, thereby geographically dispersed across the Internet. The LANs are interconnected.

Figure 1 shows the structure of a typical VPLS network. Interfaces added to the VPLS support broadcast, forward, and filter Ethernet frames. As shown in Figure 1, the Provider Edge (PE) is connected to each other through the PW. The PW is a two-way virtual connection. It consists of a pair of unidirectional MPLS virtual circuits (VCs), and the client device ( The customer edge (CE) is connected to the PE through an access circuit (AC) to form a local area network (LAN). Each PE not only learns the MAC address of the Ethernet packet from the PW, but also learns the MAC address of the Ethernet packet from the connected CE.

In VPLS, MAC address forwarding is implemented across the LAN sites of the WAN. Therefore, if there is a loop in VPLS, there must be MAC drift, and the formation of the loop will lead. Broadcasting, multi-frame copying, etc., so there is a need to provide a way to prevent loop formation. Summary of the invention

In view of this, the main object of the present invention is to provide a method and apparatus for preventing loops in a virtual private network, and to achieve the purpose of releasing a loop according to user requirements.

In order to achieve the above object, the technical solution of the present invention is achieved as follows:

A method for preventing a loop in a virtual private network, the method comprising the steps of: performing statistics on MAC drift according to a MAC entry reported by a subsystem of a service provider device PE, and obtaining a MAC drift frequency;

Comparing the MAC drift frequency with a preset maximum MAC drift frequency; when the MAC drift frequency is greater than or equal to the maximum MAC drift frequency, accessing the MAC to the PE access circuit AC or virtual chain The road PW is blocked.

Specifically, the statistics of the MAC drift are obtained, and the MAC drift frequency is obtained by: obtaining interface information in the reported MAC entry, and obtaining the source AC or PW of the MAC according to the interface information, and The count value of the MAC of the AC or PW is incremented by one; when the preset timer expires, the count value of the MAC is divided by the timer duration of the timer to obtain the MAC drift frequency.

Specifically, the blocking of the AC or the PW that transmits the MAC to the PE is: when the source of the MAC is AC, and the pre-configured protection policy is an AC-side protection policy, the AC that applies the protection policy The flag of the blocked traffic is marked, and an update message is sent, and the status of the AC is updated. When the source of the MAC is a PW, and the pre-configured protection policy is a PW side tag, and an update message is sent, the VC corresponding to the PW is updated. The status of the entry.

Further, the blocking of the access circuit AC or the virtual link PW that transmits the MAC to the PE further includes: deleting a count of the MAC originating from the AC or deleting a source originating from the PW The count of the MAC. The protection policy is deleted when the deletion protection policy information input by the user is received. If the protection policy is not blocked by the AC or the PW, the protection policy is deleted; or when the AC or PW of the protection policy is blocked, the protection policy is deleted, and the AC or the PW is corresponding. The flag of the blocked traffic of the VC entry is cleared, and an update message is sent, and the state of the AC or the state of the VC entry corresponding to the PW is updated.

An apparatus for preventing a loop in a virtual private network, where the apparatus includes a statistic module, a comparison module, and an execution module. The statistic module is configured to perform statistics on MAC drift according to a MAC entry reported by a subsystem of the PE, to obtain a MAC. a comparison module, configured to compare the MAC drift frequency with a preset maximum MAC drift frequency, where the MAC drift frequency is greater than or equal to the maximum MAC drift frequency, send trigger information to the execution module; And, when receiving the trigger information sent by the comparison module, blocking the AC or PW that transmits the MAC to the PE.

Further, the statistic module is specifically configured to obtain interface information in the reported MAC entry, and obtain a source AC or PW of the MAC according to the interface information, and obtain the MAC originating from the AC or PW. The count value is incremented by one; when the preset timer expires, the count value of the MAC is divided by the timer duration of the timer to obtain the MAC drift frequency.

Further, the execution module is specifically configured to: when the source of the MAC is an AC, and the pre-configured protection policy is an AC-side protection policy, the AC functioning as the protection policy is marked with the blocked traffic, and the update message is sent, and the update is performed. The state of the AC; when the source of the MAC is the PW, and the pre-configured protection policy is the PW-side protection policy, the VC entry corresponding to the PW that acts as the protection policy is marked with the blocking traffic, and an update message is sent. Update the status of the VC entry corresponding to the PW.

Specifically, the execution module is further configured to delete a count of the MAC originating from the AC, and delete a count of the MAC originating from the PW.

The device further includes a deletion module, configured to receive deletion protection policy information input by the user And deleting the protection policy according to the execution result of the execution module; the deleting is omitted; when the AC or PW functioning by the protection policy is blocked, deleting the protection policy, the AC or the The flag of the blocked traffic of the VC entry corresponding to the PW is cleared, and an update message is sent, and the state of the AC or the state of the VC entry corresponding to the PW is updated.

The present invention provides a method and a device for preventing a loop in a virtual private network. The MAC address drift phenomenon must exist according to the formation of the loop. The protection policy can be configured according to user requirements and networking requirements. When the MAC drift frequency is greater than or equal to the pre-detection When the maximum MAC address is set, the AC or PW that acts on the protection policy is blocked to achieve the purpose of loop cancellation. This ensures network stability and service requirements, and is more flexible and simple to implement. DRAWINGS

Figure 1 is a schematic structural diagram of a typical VPLS networking;

2 is a schematic flow chart of a method for preventing a loop in a virtual private network according to the present invention; schematic diagram; schematic diagram;

FIG. 5 is a schematic structural diagram of an apparatus for preventing a loop in a virtual private network according to the present invention. detailed description

The basic idea of the present invention is: according to the MAC entry reported by the subsystem of the PE, statistics of the MAC drift, to obtain the MAC drift frequency; comparing the MAC drift frequency with a preset maximum MAC drift frequency; When the drift frequency is greater than or equal to the maximum MAC drift frequency, the AC or PW that transmits the MAC to the PE is blocked.

In order to make the objects, technical solutions and advantages of the present invention more clear, the following embodiments are The invention will be described in further detail with reference to the accompanying drawings.

2 shows a flow of a method for preventing a loop in a virtual private network according to the present invention. As shown in FIG. 2, the method includes the following steps:

5201, the subsystem of the PE learns the MAC address of the Ethernet packet received from the PW, and the MAC address of the Ethernet packet received from the CE connected thereto, and reports the learned MAC entry;

In this step, when the PE subsystem receives a new Ethernet packet, it learns the MAC and reports it. The process is the same as the existing one, and is not described here.

It should be understood that the subsystem of the PE may be direct hardware accessed by a user such as a line card, and the main system of the PE is a main control board.

5202, the primary system of the PE performs statistics on the MAC drift according to the MAC entry of the PE subsystem, and obtains the MAC drift frequency.

In this step, the MAC entry reported by the subsystem of the PE is obtained, where the MAC entry includes information such as the MAC and the interface information, where the interface information refers to the interface information corresponding to the AC or PW of the MAC, that is, according to the interface information. The interface information may be used to learn which AC or PW the MAC flows into the PE, that is, the source AC or PW of the MAC.

Specifically, when a MAC entry is obtained, the interface information corresponding to the AC or PW of the learned MAC address may be obtained, and the MAC address of the MAC entry acquired by the primary system of the PE already exists in the primary system, but exists in the primary In the system, when the interface information in the MAC entry that includes the MAC is inconsistent with the interface information in the obtained MAC entry, the AC or PW corresponding to the interface information in the acquired MAC entry is used. The count value of the MAC is increased by 1; when the MAC address of the MAC entry acquired by the primary system of the PE first appears in the primary system, the AC or PW corresponding to the interface information in the obtained MAC entry is started. The MAC counts.

When the preset timer expires, the interface information in the MAC entry is corresponding to the The count value of the MAC of the AC or the PW is divided by the time duration of the timer, and the number of times of the MAC drift in the unit time is obtained as the MAC drift frequency, wherein the preset timer can start according to the trigger information input by the user. Timing. The timer duration can be set according to the user's needs and network performance.

5203, the main system of the PE determines whether the MAC drift frequency is less than a preset maximum MAC drift frequency, and if so, executes S204, otherwise, executes S205;

In this step, the maximum MAC drift frequency can be set according to user requirements and network performance, and a maximum MAC drift frequency can be set for AC and PW. When the MAC drift frequency is less than the maximum MAC drift frequency, the MAC is indicated by the MAC. When the drift frequency is drifting in the VPLS, the network can also meet the user's needs. When the MAC drift frequency is greater than or equal to the maximum MAC drift frequency, it indicates that the network cannot meet the user's needs at this time, and the loop needs to be broken.

5204, the PE continues to forward traffic through the AC or PW, and continues to execute S201;

5205. The primary system of the PE obtains a pre-configured protection policy.

In this step, the content of the pre-configured protection policy is blocked. In this step, when the source of the MAC address whose MAC address is greater than or equal to the maximum MAC drift frequency is AC, and the AC side protection policy is configured in advance, the pre-configured AC side protection policy is obtained, and then S206 is performed; If the source of the MAC address whose MAC address is greater than or equal to the maximum MAC address is PW, and the PW side protection policy is pre-configured, the pre-configured PW side protection policy is obtained, and then S208 is performed.

In this step, the AC-side protection policy is configured to pre-configure the protection policy on the AC according to the needs of the user or the network, that is, when the VPLS with the AC-side protection policy is looped, the configuration will be configured. The AC with the protection policy is blocked to break the loop. The PW protection policy is configured on the PW according to the requirements of the user or the network, that is, when the PW protection policy is configured. When a loop occurs in VPLS, a protection policy is configured. The PW is blocked to break the loop.

5206, when the protection policy is an AC-side protection policy, the primary system of the PE is marked with a blocking traffic for the AC configured with the protection policy. When the user is deleted and the protection policy is re-configured, the protection policy is effectively operated. .

5207, the primary system of the PE sends an update message to the subsystem of the PE, and the subsystem updates the state of the AC to a blocked state, and then executes S210;

5208. When the protection policy is a PW-side protection policy, the primary system of the PE adds a blocking traffic flag to the VC entry corresponding to the PW configured with the protection policy.

In this step, the PW is composed of a pair of unidirectional VCs, wherein the flow of the pair of unidirectional VCs is reversed, and the flow of the PWs is obtained according to the VC entries corresponding to the PWs. Therefore, the PW flows that need to be blocked are generated. If the corresponding VC entry is marked with the blocking traffic, the purpose of blocking the flow of the PW can be implemented. When the user deletes the protection policy and reconfigures the protection policy, the protection policy is effectively operated.

5209, the primary system of the PE sends an update message to the subsystem of the PE, and the subsystem updates the state of the VC entry corresponding to the PW to a blocked state;

5210: When receiving the deletion protection policy information input by the user, the primary system of the PE deletes the protection policy and performs traffic recovery processing.

Specifically, when the AC or PW functioning by the protection policy is not blocked, the protection policy is deleted and updated; when the AC or PW functioning by the protection policy is blocked, the protection policy is deleted, and the AC is removed. Or the flag of the blocked traffic of the VC entry corresponding to the PW is cleared, and an update message is sent, and the state of the AC or the state of the VC entry corresponding to the PW is updated. As shown in Figure 3, PE1, PE2, and PE3 in VPLS create a VPLS instance on PE1. In the VPN1, when the network is faulty or the network is attacked, the PE1, PE2, and PE3 are in the loop state. For the convenience of the description, the VC that points from PE1 to PE2 in the PW between PE1 and PE2 is marked as PW12. The VC marked by PE2 to PE1 is labeled as PW21, and so on. The six PWs are: PW12, PW21, PW23, PW32, PW13, and PW31. Each PE has a CE connected to VPN1 through the AC.

For PE1, when CE1 sends an Ethernet packet with an unknown MAC address, the unknown MAC address is the source MAC address and is marked as SMAC. The subsystem of PE1 performs SMAC learning and reports the MAC entry to the primary system. The MAC entry includes SMAC and Interface information, etc., where the interface information refers to the AC that learns the SMAC, that is, the SMAC flows into the PE through the AC, that is, the source AC of the SMAC, and then the PE broadcasts the Ethernet packet in the VPLS VPN1 through the PW12 and the PW13. The Ethernet packets that go out of the PW12 will be looped along the path PE1—PE2—PE3—PE1, and then enter the PE1 from the PW31. The PE1 broadcasts through the AC and PW12. The Ethernet packets sent out from the PW13 are similar, along the path PE1. — PE3—PE2—PE1, then enters PE1 from PW21, and PE1 broadcasts through AC and PW13. A similar situation occurs on PE2 and PE3, so that SMAC frequently drifts on AC, PW12, PW13, PW21, PW23, PW31, and PW32 of PE1, PE2, and PE3.

Assume that the user has made such a requirement for the above-mentioned loops: To ensure that Ethernet packets are transparently transmitted in VPLS, they cannot be blocked to the CE side port and can protect PW12, PW21, PW23, and PW32.

If the PW13 and PW31 are configured to be blocked, the PW side protection policy applied to the PW31 can be configured on the PE1. The following attributes are added: When the PE1 learns that the MAC drift frequency from the PW31 is greater than or When the preset maximum MAC address is equal to the frequency, the PW31 is blocked. Correspondingly, the PW side protection policy applied to the PW13 is configured on the PE3. Specifically, when the PW side protection policy applied to the PW31 is configured on the PE1, when the CE1 sends an Ethernet packet with an unknown MAC address, the subsystem of the PE1 learns the SMAC. The MAC address reported by the PE1 includes the SMAC and the interface information. The AC corresponding to the interface information is the AC between CE1 and PE1. When the SMAC frequently fluctuates on the AC, PW12, PW13, PW21, PW23, PW31, and PW32 of the devices PE1, PE2, and PE3, the subsystem of the PE1 continuously reports the SMAC entries learned from the PW31, and the sub-PE1 is reported. Each time the system receives the SMAC from the PW31 and reports it, the primary system of the PE1 increases the count value of the SMAC from the PW31 by one. When the timer expires, the count value is divided by the timer. The SMAC drift frequency is obtained. When the SMAC drift frequency is greater than the preset maximum MAC drift frequency, the VC entry corresponding to the PW31 is marked with blocking traffic, and the SMAC count from the PW31 is deleted. After the update message is sent to the subsystem of the PE1, the subsystem of the PE1 receives the update message, blocks the PW31, and updates the state of the PW31 to the blocked state. Similarly, the PW side protection policy applied to the PW13 is configured on the PE3. When the execution process is similar to the above, the PW13 is blocked to meet the user's needs to protect the PW and CE that are expected to be protected, and the loop is released, and the stability of the network is maintained.

When the PW13 and PW31 are not blocked, the protection policies configured on PE1 and PE3 are deleted and updated. When PW13 and PW31 are blocked, they are not only required. The protection policy is configured to be deleted on the PE1 and the PE3, and the flag of the blocked traffic of the VC entry is cleared, and an update message is sent to update the state of the VC entry corresponding to the PW. As shown in Figure 4, when there are cases such as improper networking or network attacks, the A, B, and C devices have loops, and B and C belong to the VPN1 of a VPLS. The PW is the PWbc and the A is the CE. The two ports of the A are connected to the B and C through the ACab and the ACac. The three ports of the A belong to the same virtual LAN to broadcast Ethernet packets to the AC.

When B receives the Ethernet packet transmitted from the ACab, it first learns the SMAC, but After the Ethernet packet is broadcasted through the PWbc in the VPLS VPN1, the Ethernet packet sent out from the PWbc will be looped around the loop, and the ACCA will enter the A through the ACAC. Similarly, C will also receive the transmission from the ACac. Ethernet packets, along the path ACBA through ACab and then enter A, so that SMAC will frequently drift on devices 8, B, C.

Suppose that for the above loop, the user has put forward such a requirement: To ensure that the data stream is normally transparently transmitted in the VPLS, the ACab and the PWbc are protected once the loop is formed.

The AC user is blocked on the ACac. The AC side protection policy applied to the ACac can be configured on C. The following attributes are added: When C learns that the MAC drift frequency from ACac is greater than or equal to When the preset maximum MAC drift frequency is used, ACac is blocked. Specifically, when A sends an Ethernet message of unknown MAC address, it broadcasts and forwards in VPLS VPN1, and the subsystem of C reports the situation of learning SMAC. When SMAC is drifting between B and C, the child of C The system continuously reports the MAC entries learned from the ACac. The subsystem of the C receives the SMAC once and receives the report from the ACac, and the primary system of C increases the count value of the SMAC from the ACac by one. When the timing of the timer expires, the count value is divided by the duration of the timer to obtain the SMAC drift frequency. When the SMAC drift frequency is greater than the preset maximum MAC drift frequency, the ACac is marked with blocking traffic, and Deleting the count of the SMACs from the ACac, and sending an update message to the subsystem of C. After receiving the update message, the subsystem of C blocks the ACac, and updates the state of the ACac to a blocked state to meet user requirements protection. The ACab and PWbc that are expected to be protected, while releasing the loop, maintain the stability of the network.

When receiving the deletion protection policy information input by the user, when the ACac is not blocked, the protection policy configured on C is deleted and updated; when the ACac is blocked, not only is the configuration The protection policy on C is deleted, and the flag of the blocked traffic of the ACac is also cleared, and an update message is sent to update the state of the ACac.

FIG. 5 is a diagram showing the structure of an apparatus for preventing a loop in a virtual private network according to the present invention, as shown in FIG. The device includes a statistic module 11, a comparison module 12, and an execution module 13, wherein the statistic module 11 is configured to perform statistics on MAC drift according to MAC entries reported by the subsystem of the PE, and obtain a MAC drift frequency; the comparison module 12 is configured to compare Transmitting the trigger information to the execution module 13 when the MAC drift frequency is greater than or equal to the maximum MAC drift frequency, and the executing module 13 is configured to receive the When the trigger information sent by the module 12 is compared, the AC or PW that transmits the MAC to the PE is blocked.

Further, the statistic module 11 is specifically configured to obtain the source AC or PW of the MAC in the reported MAC entry, and add the count value of the MAC originating from the AC or PW to 1; when the preset timer expires, The MAC value is obtained by dividing the count value of the MAC by the timer duration of the timer.

Further, the execution module 13 is specifically configured to: when the source of the MAC is AC, and the pre-configured protection policy is an AC-side protection policy, the AC functioning as the protection policy is marked with a blocked traffic, and the update message is sent, and the update is performed. When the source of the MAC is the PW, and the pre-configured protection policy is the PW-side protection policy, the VC entry corresponding to the PW that acts as the protection policy is marked with the blocked traffic, and the update message is sent and updated. Status of the VC entry corresponding to the PW.

Further, the execution module 13 is further configured to delete the MAC originating from the AC. Further, the apparatus further includes a deleting module 14 configured to receive the deletion protection policy information input by the user according to the execution module 13 As a result of the execution, the protection policy is deleted.

Specifically, when the deletion protection policy information input by the user is received, when the AC or PW functioning by the protection policy is not blocked, the deletion module 14 deletes the protection policy; when the AC or PW functioning by the protection policy is blocked, the module is deleted. 14 deleting the protection policy, the AC or The flag of the blocked traffic of the vc entry corresponding to the PW is cleared, and an update message is sent, and the state of the AC or the state of the VC entry corresponding to the PW is updated.

The present invention provides a method and a device for preventing a loop in a virtual private network. The MAC address drift phenomenon must exist in the loop formation. The protection policy can be configured according to user requirements and networking requirements. When the MAC drift frequency is greater than or equal to the pre-detection When the maximum MAC address is set, the AC or PW that applies the protection policy is blocked to achieve the purpose of loop cancellation. This ensures network stability and service requirements, and is more flexible and simple to implement.

The above is only the preferred embodiment of the present invention and is not intended to limit the scope of the present invention.

Claims

Claim

A method for preventing a loop in a virtual private network, the method comprising: performing statistics on MAC drift according to a MAC entry reported by a subsystem of a service provider device PE, and obtaining a MAC drift frequency;

2. The method according to claim 1, wherein the counting of the MAC drift is performed, and the MAC drift frequency is:

Obtaining the interface information in the reported MAC entry, and obtaining the source AC or PW of the MAC according to the interface information, and adding the count value of the MAC originating from the AC or PW to 1;

When the preset timer expires, the count value of the MAC is divided by the timer duration of the timer to obtain the MAC drift frequency.

The method according to claim 1, wherein the blocking of the AC or PW transmitting the MAC to the PE is:

When the source of the MAC is AC, and the pre-configured protection policy is an AC-side protection policy, the AC applying the protection policy is marked with a blocked traffic, and an update message is sent to update the state of the AC.

When the source of the PW is a PW, and the pre-configured protection policy sends an update message to the PW side protection policy, the status of the VC entry corresponding to the PW is updated.

The method of claim 3, wherein the blocking the access circuit AC or the virtual link PW that transmits the MAC to the PE further comprises: deleting the originating from the AC The counting or deletion of the MAC is derived from the count of the MAC of the PW.

The method according to any one of claims 1 to 4, wherein the method further comprises:

The deletion protection policy information input by the user is received, and the protection policy is deleted.

6. The method according to claim 5, wherein the deleting the protection policy is:

If the protection policy is not blocked by the AC or the PW, the protection policy is deleted; or when the AC or PW of the protection policy is blocked, the protection policy is deleted, and the AC or the PW is corresponding. The flag of the blocked traffic of the VC entry is cleared, and an update message is sent, and the state of the AC or the state of the VC entry corresponding to the PW is updated.

A device for preventing a loop in a virtual private network, wherein the device includes a statistical module, a comparison module, and an execution module;

The statistics module is configured to perform statistics on MAC drift according to the MAC entries reported by the subsystem of the PE, and obtain a MAC drift frequency;

a comparison module, configured to compare the MAC drift frequency with a preset maximum MAC drift frequency, where the MAC drift frequency is greater than or equal to the maximum MAC drift frequency, send trigger information to the execution module;

The execution module is configured to block the AC or PW that transmits the MAC to the PE when receiving the trigger information sent by the comparison module.

The device according to claim 7, wherein the statistic module is configured to obtain interface information in the reported MAC entry, and obtain the source AC or PW of the MAC according to the interface information, and The count value of the MAC originating from the AC or PW is incremented by one; when the preset timer expires, the count value of the MAC is divided by the timer duration of the timer to obtain the MAC drift frequency.

The device according to claim 7, wherein the execution module is specifically configured to: when the source of the MAC is AC, and the pre-configured protection policy is an AC side protection policy, The AC functioning as the protection policy is marked with the blocking traffic, and an update message is sent to update the state of the AC. When the source of the MAC is a PW and the pre-configured protection policy is a PW-side protection policy, the protection policy functions. The VC entry corresponding to the PW is marked with the blocking traffic, and sends an update message to update the state of the VC entry corresponding to the PW.

The apparatus according to claim 9, wherein the executing module is further configured to delete a count of the MAC originating from the AC, and delete a count of the MAC originating from the PW.

The device according to any one of claims 7 to 10, further comprising a deletion module, configured to receive, according to an execution result of the execution module, a deletion protection policy information input by a user, The protection policy is deleted.

The device according to claim 11, wherein the deleting module is specifically configured to: when the AC or PW functioning as the protection policy is not blocked, deleting the protection policy; When the PW is blocked, the protection policy is deleted, the label of the blocked traffic of the AC or the VC entry corresponding to the PW is cleared, and an update message is sent, and the status of the AC or the VC corresponding to the PW is updated. The status of the entry.