WO2013139270A1

WO2013139270A1 - Method, device, and system for implementing layer3 virtual private network

Info

Publication number: WO2013139270A1
Application number: PCT/CN2013/072915
Authority: WO
Inventors: 徐小虎
Original assignee: 华为技术有限公司
Priority date: 2012-03-23
Filing date: 2013-03-20
Publication date: 2013-09-26
Also published as: CN103326915A

Abstract

Disclosed are a method, a device, and a system for implementing a Layer3 virtual private network, which relate to the field of communications technologies and may improve the automated configuration and automated operational capability of the VPN. The method in the embodiment of the present invention comprises: a first PE device receiving a virtual private network (VPN) neighbor discovery packet sent by a second PE device, the VPN neighbor discovery packet being an extended type length value (TLV) packet, and carrying an IP address, a VPN ID and a VPN label that correspond to the second PE device; determining whether the second PE device and the first PE device are connected to one same VPN according to a VPN ID corresponding to the first PE device and the VPN ID corresponding to the second PE device; and when the second PE device and the first PE device are connected to one same VPN, performing routing protocol packet interaction in the same VPN with the second PE device. Embodiments of the present invention are mainly used in an implementation process of the L3VPN.

Description

TECHNICAL FIELD The present invention relates to the field of communications technologies, and in particular, to a method, device, and system for implementing a three-layer virtual private network (VPN).

BACKGROUND A virtual private network (VPN) is a virtual private network provided by an operator to a user through its public network. The VPN member nodes that are geographically separated from each other are connected to the corresponding carrier border device through the client device, and form the customer's VPN network through the operator's public network. According to whether the carrier border device participates in the route calculation and delivery of the client, the VPN implementation is divided into the following two types: Layer 3 Virtual Private Network (L3VPN), which requires the operator's border device to participate in the calculation and delivery of the customer route. , and a Layer 2 Virtual Private Network (L2VPN;) that does not require carrier edge devices to participate in the calculation and delivery of customer routes.

In the L3VPN technology, the Provider Edge (PE) devices that belong to the same VPN exchange VPN routing information through the Border Gateway Protocol (BGP). Manually configure the BGP protocol on each PE. The VPN ID, VPN label, neighbor parameters, and an Internet Protocol (IP) address of the router. Each VPN has a global VPN ID. In a VPN, each PE device allocates a local VPN label to the VPN for data forwarding. The PE performs the VPN deployment by interacting with the PEs through the BGP packets carrying the VPN parameters. The number of PEs is generally very large, and the configuration of the BGP protocol is correspondingly cumbersome and complicated.

The existing L3VPN solution requires a large number of complex parameter configurations on the PEs, such as VPN-related parameter configuration and BGP neighbor parameter configuration.

SUMMARY OF THE INVENTION Embodiments of the present invention provide a method, device, and system for implementing a three-layer virtual private network. It can improve the automation configuration and automation operation capability of VPN.

In order to achieve the above object, embodiments of the present invention use the following technical solutions:

A method for implementing a three-layer virtual private network, comprising:

The first carrier edge PE device receives the virtual private network VPN neighbor discovery packet sent by the second PE device, where the VPN neighbor discovery packet is an extended type length value TLV packet, and the second PE device is carried. Corresponding IP address, VPN ID and VPN label;

Determining, according to the VPN ID corresponding to the first PE device, the VPN ID corresponding to the second PE device, whether the second PE device is connected to the same VPN as the first PE device;

When the second PE device is connected to the same VPN device, the second PE device performs a routing protocol interaction with the second VPN device to generate a VPN route corresponding to the same VPN. a forwarding table, the VPN routing forwarding table includes a VPN ID of the same VPN, an IP address of the second PE device, and a VPN label allocated by the second PE device to the same VPN.

A first carrier edge PE device, including:

The neighbor receiving unit is configured to receive the virtual private network VPN neighbor discovery packet sent by the second PE device, where the VPN neighbor discovery packet is an extended type length value TLV packet, and the second PE device is corresponding to the second PE device. IP address, VPN ID and VPN label;

a network determining unit, configured to determine, according to the VPN ID corresponding to the first PE device and the VPN ID corresponding to the second PE device, whether the second PE device is connected to the same VPN as the first PE device;

a routing interaction unit, configured to perform, when the second PE device and the first PE device are connected to the same VPN, perform the routing protocol packet exchange in the same VPN with the second PE device, to generate the same The VPN routing forwarding table corresponding to the VPN, wherein the VPN routing forwarding table includes a VPN ID of the same VPN, an IP address of the second PE device, and a VPN label allocated by the second PE device to the same VPN.

A system for implementing a three-layer virtual private network, comprising: a first PE device and a second PE device; The first PE device is configured to receive a virtual private network VPN neighbor discovery packet sent by the second PE device, where the VPN neighbor discovery packet is an extended type length value TLV packet, and the second Determining, by the PE device, the IP address, the VPN ID, and the VPN label; determining, according to the VPN ID corresponding to the first PE device, and the VPN ID corresponding to the second PE device, whether the second PE device is the first PE The device is connected to the same VPN; when the second PE device is connected to the same VPN as the first PE device, performing the same with the second PE device

The routing protocol packets in the VPN are exchanged, and the VPN routing forwarding table corresponding to the same VPN is generated, where the VPN routing forwarding table includes the VPN ID of the same VPN, the IP address of the second PE device, and the second The VPN label assigned by the PE device to the same VPN.

The method, the device and the system for implementing the three-layer virtual private network provided by the embodiment of the present invention add the VPN neighbor discovery message by extending the TLV^1, and carry the VPN ID and the VPN label in the VPN neighbor discovery message, so that Determine and the first by identifying the VPN ID in the VPN neighbor discovery message.

A PE device belongs to the same VPN PE device and exchanges routing protocol packets with the PE device in the same VPN. Compared with the existing technology, the PE device can discover the PEs of the same VPN and complete the routing protocol. The interaction of the text eliminates a lot of manual configuration work, and improves the automatic configuration and automatic operation capability of the VPN.

BRIEF DESCRIPTION OF THE DRAWINGS In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings to be used in the embodiments or the description of the prior art will be briefly described below, and obviously, in the following description The drawings are only some of the embodiments of the present invention, and those skilled in the art can obtain other drawings based on these drawings without any creative work.

1 is a flowchart of a method for implementing a three-layer virtual private network according to Embodiment 1 of the present invention; FIG. 2 is a flowchart of a method for implementing a three-layer virtual private network according to Embodiment 2 of the present invention; Another flowchart of a method for implementing a three-layer virtual private network in Embodiment 2 of the present invention; 4 is a flowchart of another method for implementing a three-layer virtual private network according to Embodiment 2 of the present invention;

FIG. 5 is a schematic diagram of a VPN connection situation according to an embodiment of the present invention;

6 is a schematic structural diagram of a first PE device according to Embodiment 3 of the present invention;

FIG. 7 is a schematic structural diagram of another first PE device according to Embodiment 3 of the present invention; FIG.

8 is a schematic structural diagram of another first PE device according to Embodiment 3 of the present invention;

9 is a schematic structural diagram of another first PE device according to Embodiment 3 of the present invention;

FIG. 10 is a schematic diagram of a system composition for implementing a three-layer virtual private network according to Embodiment 3 of the present invention.

When implementing L3VPN, the Provider Edge (PE) device and the Cus tomer Edge Router (CE) need to exchange routing information. The routing exchange between the PE and the CE may use static routing, or may use Routing Information Protocol (RIP), Open Shortest Path First (OSPF), and intermediate system to Dynamic Routing Protocols such as Intermediate System to Intermediate System (ISIS) and BGP. PEs belonging to the same VPN can exchange VPN routing information through the 0SPF protocol or the ISIS protocol. The Provider Router (P) does not need to know the routing information of the customer's VPN network. This transparency can effectively reduce the burden on the P router and improve the scalability of the network and the flexibility of service development. After receiving the IP data packet sent from the local CE, the PE searches for the best route matching the destination address of the IP data packet through the routing forwarding table corresponding to the VPN to which the CE belongs, and then uses the multi-protocol label switching (Mul t iprotocol Label Swi tching). , MPLS) or IP tunneling, transmitting the IP data packet to the next hop PE device across the carrier MPLS/IP network.

It should be noted that the embodiment of the present invention mainly improves the automatic configuration of the L3VPN technology. Therefore, the VPNs improved in the following refers to the L3VPN.

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention, and it is obvious that the described embodiments are only a part of the embodiments of the present invention. Rather than all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention. Example 1

An embodiment of the present invention provides a method for implementing a three-layer virtual private network. As shown in FIG. 1, the method includes:

The first PE device receives the virtual private network VPN neighbor discovery packet sent by the second PE device, where the VPN neighbor discovery packet is an extended type-Length-Value (TLV) packet. Carrying an IP address, a VPN ID, and a VPN label corresponding to the second PE device.

The VPN neighbor finds that the message is an extended TLV packet, for example, a TLV packet in the ISIS protocol or a TLV packet in the 0SPF protocol. Specifically, the VPN neighbor discovery packet under the ISIS protocol is shown in Table 1.

0 1 2 3

0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1

| Type=UPN |

Length

IPuU r IPu6 Next-hop Address

(128 bits)

Resy (12 bits) I UPN ID (2Θ bits)

Resu (12 bits) I UPN Label (20 bits) Resu (12 bits) I UPN ID (2Θ bits)

Resu (12 bits) I UPN Label (2Θ bits) Table 1

In Table 1, the extended ISIS TLV contains the message type identifier (type), the TLV packet length (length), and the TLV message content (value). A specific message type identifier (type) can be defined for a TLV dedicated to VPN neighbor discovery. So when any PE in the public network is set up When receiving the VPN neighbor discovery packet, the device can determine the usage of the TLV according to the type identifier. The Next-hop address field is used to fill in the IP address of the PE device that sends the VPN neighbor discovery message. Value contains the VPN ID and VPN label written in pairs. For example, a VPN ID can occupy 32 bits, of which 20 bits have a VPN ID, and 12 bits are reserved. Similarly, VPN tags can also occupy 32 bits, of which 20 are written with VPN tags and 12 bits are reserved. You can adjust the length of the reserved bits as needed. You can also write a 32-bit VPN ID or VPN label according to the VPN ID or VPN label. It can be understood that the specific division of the value field in the actual application scenario can be adjusted according to the needs of the actual VPN.

0 1 2 3 β 1 2 3 4 5 6 7 8 9 Β 1 2 3 3⁄4 5 6 7 8 9 Β 1 2 3 ΐι 5 6 7 8 9 β 1

Type 1 Length

IPu4 Next-hop Address

Resu (12 bits) 1 UPN ID (2Q bits)

Resu (12 bits) 1 UPN Label (20 bits) Resu (12 bits) 1 UPN ID (2Q bits)

Resu (12 bits) 1 UPN Label (20 bits) Table 2

Or, the VPN neighbor discovery packet under the 0SPF protocol is shown in Table 1. In Table 2, the extended OSPF TLV includes a packet type identifier (type), a TLV packet length (length), and a TLV packet content (value). ₀ A specific packet can be defined for a TLV dedicated to VPN neighbor discovery. A type identifier (type), such that when any one of the PE devices in the public network receives the VPN neighbor discovery message, the TLV can be determined according to the type identifier. For the method of filling in the value field, reference may be made to the method of filling the ISIS TLV, which is not described herein again.

For example, a VPN neighbor discovery packet can carry a pair of VPN IDs and VPN labels that exist in pairs. For example, if the second PE device is only connected to the VPN1, the second PE device can write the VPN ID of the VPN1 and the VPN label allocated by the second PE device to the VPN1 in the VPN neighbor discovery message. After receiving the VPN neighbor discovery packet, the first PE device may be configured according to the VPN. The neighbor finds the VPN ID carried in the text (that is, the VPN ID corresponding to the second PE device) and the VPN ID of the first PE device, and determines whether the second PE device is connected to the same VPN as the first PE device. The first PE device may perform the routing protocol protocol in the same VPN with the second PE device to complete the subsequent VPN configuration process. Alternatively, the VPN ID of the VPN1 carried in the VPN neighbor discovery packet may also be recorded. The second PE device allocates the VPN label of the VPN1 and the IP address of the second PE device, so as to perform subsequent routing protocol packet interaction.

Of course, in a VPN neighbor discovery >3⁄4 text, it is also possible to carry multiple pairs of VPN IDs and VPN tags in pairs. For example, if the second PE device is connected to VPN1 and VPN2 at the same time, the second PE device can write the VPN ID of the VPN1 and the VPN label allocated by the second PE device to the VPN1 in the VPN neighbor discovery message. The ID and the VPN label assigned by the second PE device to VPN2. After receiving the VPN neighbor discovery packet, the first PE device may use the VPN ID corresponding to the VPN (for example, VPN1) connected to the first PE device and the VPN ID carried in the received VPN neighbor discovery message (ie, The VPN ID corresponding to the VPN to which the second PE device is connected is compared to determine whether there is a matching VPN ID. After the first PE device determines that the second PE device and the first PE device are connected to the same VPN (VPN1), the second PE device can perform the routing protocol packet exchange in the same VPN with the second PE device to complete the subsequent VPN configuration process. Alternatively, the VPN ID of the VPN1 carried in the VPN neighbor discovery packet, the VPN label assigned by the second PE device to the VPN1, and the IP address of the second PE may be recorded, so as to perform subsequent routing protocol packet exchange.

102. Determine, according to the VPN ID corresponding to the first PE device, and the VPN ID corresponding to the second PE device, whether the second PE device is connected to the same VPN as the first PE device.

For example, before the first PE device determines which PE devices are connected to the same VPN, the first PE device may distinguish, by using the VPN ID, whether the sender of the VPN neighbor discovery message and the first A PE device belongs to the same VPN. Specifically, the VPN corresponds to the VPN ID, and the first PE device is configured as a member node of one or more VPNs. Therefore, the first PE device records the VPN ID of the VPN to which the first PE device belongs. And the second PE device that sends the VPN neighbor discovery packet allocates a VPN label to the VPN to which the second PE device belongs. After receiving the VPN neighbor discovery packet, the first PE device determines the report according to the type identifier. The packet is a VPN neighbor discovery packet, and the VPN ID in the va lue field is compared with the VPN ID of the first PE device to determine whether the second PE device and the first PE device are connected to the same VPN.

103. When the second PE device and the first PE device are connected to the same VPN, perform the routing protocol packet exchange in the same VPN with the second PE device, and generate the VPN corresponding to the same VPN. The routing forwarding table, the VPN routing forwarding table includes a VPN ID of the same VPN, an IP address of the second PE device, and a VPN label allocated by the second PE device to the same VPN.

For example, the routing information is written into the routing protocol packet in advance, and interacts with the determined second PE device that is connected to the same VPN as the first PE device. The routing protocol packet is a Link State Advertisement (LSSA) protocol packet under the 0SPF protocol, or a Link State Protocol Data Unit (LSP) protocol under the ISIS protocol. The LSA protocol document uses a specific destination multicast IP address, and the LSP protocol message uses a specific destination multicast media access control (MAC) address for the second PE device. After receiving the LSA protocol packet or the LSP protocol packet, the routing protocol packet is identified and sent to the CPU for protocol processing according to the specific destination multicast IP address or the specific destination multicast MAC address.

The method for implementing the three-layer virtual private network provided by the embodiment of the present invention defines the VPN neighbor discovery >3⁄4 text by extending the TLV message, and carries the VPN ID and the VPN label in the VPN neighbor discovery document, thereby identifying the VPN neighbor by identifying the VPN neighbor The VPN ID in the packet identifies the PE device that belongs to the same VPN as the first PE device, and performs the routing protocol packet exchange with the PE device in the same VPN. The device can automatically discover the PEs that belong to the same VPN and complete the routing protocol packet exchange. This eliminates a lot of manual configuration and improves the automatic configuration and automatic operation of the VPN. Example 2

An embodiment of the present invention provides a method for implementing a three-layer virtual private network, as shown in FIG. 2, include:

The first PE device sends a VPN neighbor discovery packet to the second PE device, so that the first PE device is discovered by the second PE device that is connected to the same PE device.

For example, the first PE device may be any PE device in a VPN. For example, as shown in FIG. 5, three PE devices are connected in the VPN1, namely, node A, node B, and node C, respectively. Any one of the PE devices (Node A) is taken as the first PE device. Nodes B and C are two neighboring nodes that are connected to the same VPN device as the first PE device (Node A). Node D is a PE device in the public network, but it is not a PE device connected to VPN1, so it is not a neighbor node of Node A in terms of VPN1. It should be noted that the VPN deployment may overlap, that is, the member nodes include nodes A and D for VPN2, so node D is the neighbor node of node A for VPN2. The remaining nodes in the public network, including nodes ^ C and D, can be used as the second PE device.

The VPN neighbor discovery packet sent by the node A to the other nodes in the public network (the second PE device) includes the VPN label assigned by the node A to the VPN1. The VPN label is unique in the same VPN and is used for identification. Issue the sender (node A) of the VPN neighbor discovery message. The VPN neighbor discovery packet further includes a VPN ID, where the VPN ID is an identifier of a VPN to which the node A is connected. For example, the VPN label assigned by node A to VPN1 is 100. The VPN ID (VPN1) and the VPN label (100) of node A can be written in the va lue field of the VPN neighbor discovery message, so the VPN ID and VPN label are in the neighbor. It is found that the messages exist in pairs. It can be understood that a VPN neighbor can find a pair of existing VPN IDs and VPN labels, and can also carry multiple pairs of VPN IDs and VPN labels at the same time.

202. The first PE device receives a VPN neighbor discovery packet sent by the second PE device.

The configuration of the VPN neighbor discovery packet is the same as that described in the step 201. The other nodes in the public network can also send the VPN configuration information to the first PE device by using the VPN neighbor discovery packet. The VPN neighbor discovery packet is an extended TLV packet, and carries an IP address corresponding to the second PE device that sends the VPN neighbor discovery message, a VPN ID, and a VPN assignment of the second PE device to which the second PE device is connected. VPN label. 203. Determine, according to the VPN ID corresponding to the first PE device, and the VPN ID corresponding to the second PE device, whether the second PE device is connected to the same VPN as the first PE device.

For example, because there are multiple VPNs in the public network, a VPN neighbor discovery packet can carry multiple pairs of VPN IDs and VPN labels at the same time, so the first PE device receives the VPN neighbor discovery. After the message, the message needs to be parsed and the VPN information of the first PE device is identified. As shown in Figure 5, node A (the first PE device) itself is connected to VPN1, so the VPN ID of VPN1 can be identified in the received VPN neighbor discovery message. For example, after receiving the VPN neighbor discovery message sent by the Node B, the VPN ID of the VPN1 is obtained, and thus the neighbor node (Node B) that belongs to the VPN1 is found, and the corresponding Node B is assigned the VPN label of the VPN1 (200). And the IP address of Node B is recorded. Or, if another VPN neighbor discovery message sent by the second PE device (node X) that is not connected to the same VPN by the node A is received, the matching VPN ID cannot be resolved from the node, and the node X is not used as the neighbor node. .

204. The VPN ID corresponding to the same VPN, the VPN label allocated by the second PE device to the same VPN, and the IP address of the second PE device are recorded in the VPN neighbor list.

For example, each VPN connected to the first PE device may have a VPN neighbor list, and the IP address of the second PE device belonging to the same VPN may be recorded in the VPN neighbor list and allocated for the same VPN. VPN label. For example, node A corresponds to the VPN neighbor list of VPN1, and the IP address of node B and the VPN label 200 assigned by node B to VPN1, and the IP address of node C and the VPN label 300 assigned by node C to VPN1. For example, if node A is connected to both VPN1 and VPN2, then two corresponding VPN neighbor lists can be generated on node A.

For another example, the first PE device may also generate a shared VPN neighbor list for multiple VPNs connected to the first device. In the shared VPN neighbor list, the VPN ID of each VPN to which the first PE device is connected, the IP address of the PE device included in each VPN, and the VPN label may be recorded. For example, the node A can identify the IP address of the Node B belonging to the VPN1 and the VPN label assigned by the Node B to the VPN1 from the shared VPN neighbor list according to the VPN ID of the VPN1. 205. Send a first routing protocol packet to the second PE device that is recorded in the VPN neighbor list by using a point-to-point tunnel.

The first routing protocol packet is sent by the first tunnel, and the first tunnel encapsulation information carries the VPN label allocated by the second PE device to the same VPN. The routing protocol packet is used to convey the reachability of the route, so that each member PE device in the same VPN generates a VPN routing forwarding table, and finds the best path according to the VPN routing forwarding table in the service communication to transmit the service data to the routing data. Next hop PE device.

For example, the VPN tag type to be carried in the first tunnel encapsulation information may be set as a downstream distribution tag type, so that the second PE device determines the identification manner of the VPN tag. For example, the node A sends the VPN label (200) allocated by the node B, which was previously obtained through the VPN neighbor discovery, to the VPN1, and writes it into the first tunnel encapsulation information, and sets it as a downstream allocation label, so that when the node B receives After the first routing protocol packet, the node B has been assigned to the VPN1, and the first routing protocol packet is determined to be a routing protocol packet belonging to the VPN1.

The receiving, by the point-to-point tunnel, the second routing protocol packet sent by the second PE device, and determining, according to the VPN label carried in the encapsulated second routing protocol packet, the VPN corresponding to the second routing protocol .

The second routing protocol packet is sent by the second tunnel, and the second tunnel encapsulation information carries the VPN label allocated by the first PE device to the same VPN.

For example, the node A (the first PE device) receives the encapsulated second routing protocol packet sent by the node B (the second PE device) through the point-to-point tunnel, and parses the VPN label (1 00) carried in the second tunnel encapsulation information. After determining which VPN (VPN1) the node A has assigned to the VPN, it can be determined that the currently received second routing protocol packet is a routing protocol packet belonging to the VPN1.

207. Generate a corresponding VPN routing forwarding table according to the content of the second routing protocol packet. If the VPN of the second routing protocol packet received by the first PE device through the point-to-point tunnel is determined, the routing information carried in the second routing protocol packet may be recorded to generate a VPN routing route. Published. For example, the VPN routing forwarding table may include a prefix, a next hop (that is, an IP address of each PE device in the same VPN), and the like. Information, in order to determine an optimal path according to the VPN routing forwarding table during service transmission. For example, the method of the embodiment shown in FIG. 2 may further include:

208. Perform service transmission according to the VPN routing forwarding table of the same VPN.

In the process of performing service transmission in the same VPN, the best transmission path can be determined according to the VPN routing forwarding table corresponding to the same VPN, and the service data is sent to the best next hop PE device.

In another application scenario of the embodiment of the present invention, the routing protocol packet interaction may be performed through a point-to-point tunnel, and the routing protocol packet interaction may be performed through a dedicated private network multicast tree dedicated to each VPN. As shown in FIG. 3, the method for implementing a three-layer virtual private network provided by an embodiment of the present invention may include:

301-304 are the same as steps 201-204.

305. The third routing protocol packet is encapsulated to obtain a first multicast packet, and is sent to another PE device in the private public network multicast tree by using the private public network multicast tree corresponding to the same VPN.

The private network multicast tree includes all the PE devices connected to the same VPN, and the destination address of the first multicast packet is a multicast group address corresponding to the private public network multicast tree. Each private public network multicast tree has a multicast group address, that is, the same VPN corresponds to a private public network multicast tree and corresponds to a multicast group address.

Specifically, the public network multicast tree is a carrier multicast tree, and the private public network multicast tree is a non-aggregated multicast tree, and the shared public network multicast tree is an aggregated multicast tree. A dedicated public network multicast tree can be pre-configured to set all member PEs belonging to the same VPN as leaf nodes of a private public network multicast tree. For example, VPN1 consisting of three member PE devices (nodes A, B, and C) corresponds to a private public network multicast tree 1, and the leaf nodes of the private public network multicast tree 1 include nodes A, B, and C. When the node A encapsulates the third routing protocol packet into the first multicast packet and sends it through the private public network multicast tree 1, the private public network multicast tree 1 sends the first multicast packet to the node B at the same time. C. When the first multicast packet is received by the node B, the node analyzes the multicast group address carried in the first multicast packet, so as to determine that the currently received first multicast packet belongs to the VPN1, and then the The routing information in the third routing protocol packet records and generates a VPN routing forwarding table corresponding to VPN1. 306. Receive, by the private public network multicast tree corresponding to the same VPN, a second multicast packet that is obtained by the second PE device and is encapsulated by the fourth routing protocol packet, according to the second multicast packet. The destination address determines the corresponding VPN.

The destination address of the second multicast packet is a multicast group address corresponding to the private public network multicast tree. The first PE device is a member node of the VPN and is also a leaf node of the public network multicast tree. Therefore, the received fourth routing protocol packet can be determined by receiving the multicast group address carried in the second multicast packet. Which VPN belongs to the corresponding VPN routing forwarding table.

307. Generate a corresponding VPN routing forwarding table according to the content of the fourth routing protocol packet. The routing information carried in the fourth routing protocol packet is recorded, and the VPN routing forwarding table corresponding to the VPN is generated. The VPN routing forwarding table may include information such as an IP address (next hop) and a prefix of each PE device connected to the same VPN, so as to determine an optimal path according to the VPN routing forwarding table in the service transmission process.

For example, the embodiment shown in FIG. 3 may further include step 308, which is the same as step 208. In another application scenario of the embodiment of the present invention, routing protocol packet interaction may also be performed by using a shared public network multicast tree shared by multiple VPNs. As shown in FIG. 4, the method for implementing a three-layer virtual private network provided by the embodiment of the present invention may include:

401-404 are the same as steps 201-204.

405. Encapsulate the fifth routing protocol packet to obtain a third multicast packet, and send the packet to the other PE device in the shared public network multicast tree through the shared public network multicast tree.

The third multicast packet carries the VPN label allocated by the first PE device to the same VPN, and the destination address of the third multicast packet is the multicast corresponding to the shared public network multicast tree. Group address. The shared public network multicast tree includes all the member PE devices in the at least two VPNs sharing the shared public network multicast tree, and the VPN label allocation is independent of each other for different VPNs, so The third multicast packet carries the VPN label allocated by the first PE device to the same VPN, and the VPN label is set as an upstream distribution label. In this way, when the other PEs in the public network multicast tree receive the third multicast packet, the VPN label carried in the third multicast packet can be processed as an upstream distribution label. The second PE device may determine that the VPN label is The first PE device allocates the VPN label as the VPN, that is, determines the VPN corresponding to the VPN label.

406. Receive, by using the public network multicast tree, a fourth multicast packet that is obtained by the second PE device and is encapsulated by the sixth routing protocol packet, according to the VPN and the carried by the fourth multicast packet. The source IP address of the fourth multicast packet is used to search the VPN neighbor list, and the label determines the VPN corresponding to the sixth routing protocol.

The fourth multicast packet carries the VPN label allocated by the second PE device to the same VPN, and the source IP address of the fourth multicast packet is the IP address of the second PE device, The destination address of the fourth multicast packet is the multicast group address corresponding to the shared public network multicast tree. The second PE device sets the type of the VPN label to be carried in the fourth multicast packet to the upstream allocation label type before the fourth multicast device sends the fourth multicast packet, so that the first PE device determines the identification manner of the VPN label. Specifically, the source IP address of the fourth multicast packet and the carried VPN tag are used to query the VPN neighbor list, and after finding an entry that matches both the source IP address and the VPN label, the matching entry is determined to belong. Which VPN can determine which VPN the fourth multicast packet containing the sixth routing protocol packet belongs to, so as to write the corresponding VPN routing forwarding table, so that the service communication in the same VPN. The VPN label recorded in the VPN neighbor list is the VPN label assigned to the VPN by the upstream PE device (for the first PE device, the upstream PE device is the second PE device).

407. Generate a corresponding VPN routing forwarding table according to the content of the sixth routing protocol packet. The routing information carried in the sixth routing protocol packet is recorded according to the VPN determined in step 406, and the VPN routing forwarding table corresponding to the VPN is generated. The VPN routing forwarding table may include information such as a prefix and a next hop (that is, an IP address of each member PE device in the same VPN), so as to determine an optimal path according to the VPN routing forwarding table in the service transmission process.

For example, the embodiment shown in FIG. 4 may further include step 408, which is the same as step 208. It should be noted that the specific description of some steps in the embodiments of the present invention may refer to the corresponding content in Embodiment 1, and the embodiments of the present invention will not be repeated here. The method for implementing the three-layer virtual private network provided by the embodiment of the present invention adds the VPN neighbor discovery>3⁄4 text by extending the TLV message, and carries the VPN ID and the VPN label in the VPN neighbor discovery, so that the VPN neighbor can be identified. The VPN IDs in the packets are determined to be the PEs of the same VPN, and the PEs in the same VPN are configured to exchange routing protocol packets. Compared with the technology in the prior art that requires a large number of complex manual configuration of PE devices, The VPN neighbor discovery packet automatically discovers the PEs that belong to the same VPN and completes the routing protocol packet exchange. This eliminates a lot of manual configuration and improves the automatic configuration and automatic operation of the VPN. Example 3

The embodiment of the present invention provides a first carrier edge (PE) device, as shown in FIG. 6, which may include: a neighbor receiving unit 51, a network determining unit 52, and a routing interaction unit 53.

The neighbor receiving unit 51 is configured to receive a virtual private network VPN neighbor discovery packet sent by the second PE device, where the VPN neighbor discovery packet is an extended type length value TLV packet, and the second PE device is carried. Corresponding IP address, VPN ID and VPN label.

The network determining unit 52 is configured to determine, according to the VPN ID corresponding to the first PE device and the VPN ID corresponding to the second PE device, whether the second PE device is connected to the same VPN as the first PE device.

The routing interaction unit 53 is configured to: when the network determining unit 52 determines that the second PE device and the first PE device are connected to the same VPN, perform the routing protocol in the same VPN with the second PE device. The packet exchanges the VPN routing forwarding table corresponding to the same VPN, where the VPN routing forwarding table includes the VPN ID of the same VPN, the IP address of the second PE device, and the second PE device. The VPN label assigned by the same VPN.

Optionally, as shown in FIG. 7, the first PE device may further include: a neighbor list unit 54. The neighboring list unit 54 is configured to: after the network determining unit 52 determines that the second PE device and the first PE device are connected to the same VPN, the VPN ID corresponding to the same VPN, and the second PE device a VPN label assigned to the same VPN and an IP of the second PE device The address is recorded in the VPN neighbor list.

Optionally, the routing interaction unit 53 includes: a first sending module 531. The first sending module 531 is configured to send, by using the point-to-point tunnel, the first routing protocol packet to the second PE device that is recorded in the VPN neighbor list, where the first routing protocol packet passes the first tunnel After being encapsulated, the first tunnel encapsulation information carries the VPN label allocated by the second PE device to the same VPN.

The type of the VPN label to be carried in the first tunnel encapsulation information is set to a downstream allocation label type, so that the second PE device determines the identification manner of the VPN label.

For example, the routing interaction unit 53 further includes: a first receiving module 532 and a first generating module 533.

The first receiving module 532 is configured to receive, by using the point-to-point tunnel, the second routing protocol packet sent by the second PE device, where the second routing protocol packet is encapsulated and sent by the second tunnel, and the second The tunnel encapsulation information carries the VPN label allocated by the first PE device to the same VPN.

The first generation module 533 is configured to determine, according to the VPN label carried in the encapsulated second routing protocol packet, the VPN corresponding to the second routing protocol packet, and generate, according to the content of the second routing protocol packet VPN routing forwarding table.

As shown in FIG. 8, in another application scenario of the embodiment of the present invention, the routing interaction unit 53 includes: a second sending module 534.

The second sending module 534 is configured to encapsulate the third routing protocol packet to obtain the first multicast packet, and send the same to the other public network multicast tree through the dedicated public network multicast tree corresponding to the same VPN. PE equipment.

The private network multicast tree includes all the PE devices connected to the same VPN, and the destination address of the first multicast packet is a multicast group address corresponding to the private public network multicast tree.

Further, the routing interaction unit 53 further includes: a second receiving module 535 and a second generating module 536.

The second receiving module 535 is configured to receive by using a dedicated public network multicast tree corresponding to the same VPN. a second multicast packet obtained by the second PE device, which is encapsulated by the fourth routing protocol packet, where the destination address of the second multicast packet is a multicast group corresponding to the private public network multicast tree. address.

The second generation module 536 is configured to determine a corresponding VPN according to the destination address of the second multicast packet, and generate a corresponding VPN routing forwarding table according to the content of the fourth routing protocol packet.

As shown in FIG. 9, in another application scenario of the embodiment of the present invention, the routing interaction unit 53 includes: a third sending module 537.

The third sending module 537 is configured to encapsulate the fifth routing protocol packet to obtain a third multicast packet, and send the packet to the other PE device in the shared public network multicast tree through the shared public network multicast tree. The third multicast packet carries the VPN label allocated by the first PE device to the same VPN, and the destination address of the third multicast packet is a multicast group corresponding to the shared public network multicast tree. address. The type of the VPN tag carried in the third multicast packet is set to the upstream distribution tag type, so that the second PE device determines the identification mode of the VPN tag.

Further, the routing interaction unit 53 further includes: a third receiving module 538 and a third generating module 539.

The third receiving module 538 is configured to receive, by using the public network multicast tree, a fourth multicast packet that is encapsulated by the second routing protocol packet sent by the second PE device, where the fourth multicast The packet carries the VPN label allocated by the second PE device to the same VPN, the source IP address of the fourth multicast packet is the IP address of the second PE device, and the destination address of the fourth multicast packet It is the multicast group address corresponding to the shared public network multicast tree.

The third generation module 539 is configured to search the VPN neighbor list according to the VPN label carried by the fourth multicast packet and the source IP address of the fourth multicast packet, and determine the corresponding message of the sixth routing protocol packet. The VPN generates a corresponding VPN routing forwarding table according to the content of the sixth routing protocol packet.

It should be noted that, in the embodiment 1-3, the routing protocol packet is an LSA protocol document of the 0SPF protocol or an LSP protocol text of the ISIS protocol, where the LSA protocol document uses a specific destination multicast IP address. The LSP protocol packet uses a specific destination multicast MAC address, so that the second PE device receives the LSA protocol packet or the LSP protocol packet according to the specific destination multicast IP address. Or a specific destination multicast MAC address, identifying the routing protocol The discussion is sent to the CPU for protocol processing.

The embodiment of the present invention further provides a system for implementing a three-layer virtual private network. As shown in FIG. 10, the system includes: a first PE device 61 and a second PE device 62.

The first PE device 61 is configured to receive a VPN neighbor discovery packet sent by the second PE device, where the VPN neighbor discovery packet is an extended type length value TLV packet, and the second PE device is carried. Corresponding IP address, VPN ID, and VPN label; determining, according to the VPN ID corresponding to the first PE device 61 and the VPN ID corresponding to the second PE device 62, whether the second PE device 62 and the first A PE device 61 is connected to the same VPN; when the second PE device 62 is connected to the same VPN as the first PE device 61, the routing protocol in the same VPN is performed with the second PE device 62. The interaction, the VPN routing forwarding table corresponding to the same VPN is generated, where the VPN routing forwarding table includes the VPN ID of the same VPN, the IP address of the second PE device 62, and the second PE device 62. The VPN label assigned by the same VPN.

It should be noted that the specific description of some of the functional modules in the embodiments of the present invention may refer to the corresponding content in Embodiment 1 and Embodiment 1, and the embodiments of the present invention will not be repeated here.

The system for implementing the three-layer virtual private network and the first PE device provided by the embodiment of the present invention, the VPN neighbor discovery packet is defined by the extended TLV packet, and the VPN ID and the VPN label are carried in the VPN neighbor discovery packet, so that By identifying the VPN IDs in the VPN neighbor discovery packets, the PEs that belong to the same VPN are identified, and the PEs in the same VPN are configured to exchange routing protocol packets. You can use the VPN neighbor discovery packets to automatically discover the PEs that belong to the same VPN and complete the routing protocol packet exchange. This eliminates a lot of personnel workload and improves the automatic configuration and automatic operation of the VPN.

Through the description of the above embodiments, those skilled in the art can clearly understand that the embodiments of the present invention can be implemented by means of software plus necessary general hardware, and of course, by hardware, but in many cases, the former is better. Implementation. Based on such understanding, the technical solution of the embodiments of the present invention may be embodied in the form of a software product in essence or in the form of a software product, which is stored in a readable storage medium, such as A floppy disk, hard disk or optical disk of a computer, including a number of instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to perform the methods described in various embodiments of the present invention.

The above is only the specific embodiment of the present invention, but the scope of the present invention is not limited thereto, and any person skilled in the art can easily think of changes or substitutions within the technical scope of the present invention. It should be covered by the scope of the present invention. Therefore, the scope of the invention should be determined by the scope of the appended claims.

Claims

Rights request

A method for implementing a three-layer virtual private network, comprising:

The method according to claim 1, wherein after the determining that the second PE device and the first PE device are connected to the same VPN, the method further includes:

The VPN ID corresponding to the same VPN, the VPN label allocated by the second PE device to the same VPN, and the IP address of the second PE device are recorded in the VPN neighbor list.

The method according to claim 2, wherein the performing, by the second PE device, the routing protocol packet exchange in the same VPN, the method includes:

Transmitting, by the point-to-point tunnel, the first routing protocol packet to the second PE device that is recorded in the VPN neighbor list, where the first routing protocol packet is encapsulated and sent by the first tunnel, and the first tunnel encapsulation is performed. The information carries the VPN label allocated by the second PE device to the same VPN.

The method according to claim 3, wherein the performing, by the second PE device, the routing protocol packet exchange in the same VPN, further comprising:

Receiving, by the point-to-point tunnel, the second routing protocol packet sent by the second PE device, where the second routing protocol packet is encapsulated and sent by the second tunnel, and the second tunnel encapsulation information carries the a VPN label assigned by the PE device to the same VPN;

Correspondingly, the generating the VPN routing forwarding table corresponding to the same VPN includes: Determining, according to the VPN label carried in the encapsulated second routing protocol packet, the VPN corresponding to the second routing protocol

And generating a corresponding VPN routing forwarding table according to the content of the second routing protocol packet.

The method according to claim 1, wherein the performing, by the second PE device, the routing protocol packet exchange in the same VPN, the method includes:

Encapsulating the third routing protocol packet to obtain the first multicast packet, and sending the packet to the other PE device in the private network of the private public network through the private public network multicast tree corresponding to the same VPN; The network multicast tree includes all the PEs connected to the same VPN, and the destination address of the first multicast packet is a multicast group address corresponding to the private public network multicast tree.

The method according to claim 5, wherein the performing, by the second PE device, the routing protocol packet exchange in the same VPN, further comprising:

Receiving, by the private public network multicast tree corresponding to the same VPN, a second multicast packet that is obtained by the second PE device and encapsulated by the fourth routing protocol packet, where the destination address of the second multicast packet is a multicast group address corresponding to the private public network multicast tree;

Correspondingly, the generating the VPN routing forwarding table corresponding to the same VPN includes: determining, according to the destination address of the second multicast packet, a corresponding VPN;

And generating a corresponding VPN routing forwarding table according to the content of the fourth routing protocol packet.

The method according to claim 2, wherein the performing, by the second PE device, the routing protocol packet exchange in the same VPN includes:

Encapsulating the fifth routing protocol packet to obtain a third multicast packet, and sending the packet to the other PE device in the shared public network multicast tree through the shared public network multicast tree, where the third multicast packet carries the The first PE device is a VPN label allocated by the same VPN, the source IP address of the third multicast packet is an IP address of the first PE device, and the destination address of the third multicast packet is the shared The multicast group address corresponding to the public network multicast tree.

The method according to claim 7, wherein the performing, by the second PE device, the routing protocol packet exchange in the same VPN, further comprising:

Receiving, by the shared public network multicast tree, the sixth routing protocol sent by the second PE device a fourth multicast packet obtained by the packet encapsulation, wherein the fourth multicast packet carries a VPN label allocated by the second PE device to the same VPN, and a source IP address of the fourth multicast packet is the The IP address of the second PE device, and the destination address of the fourth multicast packet is a multicast group address corresponding to the shared public network multicast tree;

Correspondingly, the generating the VPN routing forwarding table corresponding to the same VPN includes: searching the VPN neighbor list according to the VPN label carried by the fourth multicast packet and the source IP address of the fourth multicast packet, Determining a VPN corresponding to the sixth routing protocol packet;

Generating a corresponding VPN routing forwarding table according to the content of the sixth routing protocol packet.

The method according to claim 1, wherein the routing protocol message is a link state advertisement LSA protocol message under the 0SPF protocol or a link state protocol data unit LSP protocol message under the ISIS protocol; The LSA protocol document uses a specific destination multicast IP address, and the LSP protocol message uses a specific destination multicast MAC address, so that the second PE device receives the LSA protocol>3⁄4 text or After the LSP protocol is described, the routing protocol is identified and sent to the CPU for protocol processing according to the specific destination multicast IP address or the specific destination multicast MAC address.

10. A first carrier edge PE device, comprising:

a routing interaction unit, configured to: when the network determining unit determines that the second PE device and the first PE device are connected to the same VPN, perform routing protocol packets in the same VPN with the second PE device The VPN routing forwarding table corresponding to the same VPN is generated, where the VPN routing forwarding table includes the VPN ID of the same VPN, the IP address of the second PE device, and the second PE device are the same VPN assigned VPN label.

The first PE device according to claim 10, further comprising: a neighbor list unit, configured to determine, at the network determining unit, that the second PE device is connected to the first PE device After the VPN, the VPN ID corresponding to the same VPN, the VPN label allocated by the second PE device for the same VPN, and the IP address of the second PE device are recorded in the VPN neighbor list.

The first PE device according to claim 1, wherein the routing interaction unit comprises:

a first sending module, configured to send, by using a point-to-point tunnel, the first routing protocol packet to the second PE device that is recorded in the VPN neighbor list, where the first routing protocol packet is encapsulated by the first tunnel After the first tunnel encapsulation information carries the VPN label allocated by the second PE device to the same VPN.

The first PE device according to claim 12, wherein the routing interaction unit further comprises:

a first receiving module, configured to receive, by using the point-to-point tunnel, a second routing information packet sent by the second PE device, where the second routing protocol packet is encapsulated and sent by the second tunnel, and the second tunnel is sent The encapsulation information carries the VPN label allocated by the first PE device to the same VPN. The first generation module is configured to determine the second routing protocol according to the VPN label carried in the encapsulated second routing protocol packet. The VPN corresponding to the packet generates a corresponding VPN routing forwarding table according to the content of the second routing protocol packet.

The first PE device according to claim 10, wherein the routing interaction unit comprises:

a second sending module, configured to encapsulate the third routing protocol packet to obtain the first multicast packet, and send the packet to the other PEs in the private public network by using the private public network multicast tree corresponding to the same VPN Equipment

The first PE device according to claim 14, wherein the routing is performed The mutual unit also includes:

a second receiving module, configured to receive, by using a dedicated public network multicast tree corresponding to the same VPN, a second multicast packet that is encapsulated by the second routing information packet sent by the second PE device, where the The destination address of the second multicast packet is the multicast group address corresponding to the private multicast network; the second generation module is configured to determine a corresponding VPN according to the destination address of the second multicast packet; The content of the four routing protocol packets generates a corresponding VPN routing forwarding table.

The first PE device according to claim 11, wherein the routing interaction unit comprises:

a third sending module, configured to encapsulate the fifth routing protocol packet to obtain a third multicast packet, and send the packet to the other PE device in the shared public network multicast tree through the shared public network multicast tree; The third multicast packet carries the VPN label allocated by the first PE device to the same VPN, and the source IP address of the third multicast packet is an IP address of the first PE device, and the third multicast The destination address of the packet is the multicast group address corresponding to the shared public network multicast tree.

The first PE device according to claim 16, wherein the routing interaction unit further comprises:

a third receiving module, configured to receive, by using the public network multicast tree, a fourth multicast packet that is encapsulated by the second routing protocol packet sent by the second PE device, where the fourth multicast packet is Carrying the VPN label assigned by the second PE device to the same VPN, the source IP address of the fourth multicast packet is an IP address of the second PE device, and the destination address of the fourth multicast packet is The multicast group address corresponding to the shared public network multicast tree;

a third generation module, configured to search the VPN neighbor list according to the VPN label carried by the fourth multicast packet and the source IP address of the fourth multicast packet, and determine the VPN corresponding to the sixth routing protocol packet And generating a corresponding VPN routing forwarding table according to the content of the sixth routing protocol packet.

The first PE device according to claim 10, wherein the routing protocol message is a link state advertisement LSA protocol message under the 0SPF protocol or a link state protocol data unit LSP protocol under the ISIS protocol. a packet, where the LSA protocol packet uses a specific destination multicast IP address, and the LSP protocol packet uses a specific destination multicast MAC address, so as to After receiving the LSA protocol packet or the LSP protocol packet, the second PE device identifies the routing protocol packet according to the specific destination multicast IP address or a specific destination multicast MAC address. Send the CPU for protocol processing.

A system for implementing a three-layer virtual private network, comprising: the first PE device and the second PE device according to any one of claims 10-18.