WO2014094287A1

WO2014094287A1 - Configuration method of virtual machine control policy and exchange

Info

Publication number: WO2014094287A1
Application number: PCT/CN2012/087123
Authority: WO
Inventors: 张恒梁; 宋哲炫; 李金成
Original assignee: 华为技术有限公司
Priority date: 2012-12-21
Filing date: 2012-12-21
Publication date: 2014-06-26
Also published as: CN103229489B; CN103229489A

Abstract

The present invention provides a configuration method of virtual machine control policy and an exchange. The method includes receiving a first control policy for a virtual machine; obtaining a MAC address of the virtual machine according to a virtual machine identifier in the first control policy; replacing the virtual machine identifier in the first control policy by using the MAC address of the virtual machine to get a second control policy. Therefore, the embodiment of the present invention realizes the configuration and management of control policy in MAC address level, and makes the implementation of policy control in MAC address level easier.

Description

Virtual machine control strategy configuration method and switch

The present invention relates to the field of communications, and in particular, to a method and a switch for configuring a virtual machine control policy. Background technique

Virtualization is the most important technical foundation for implementing cloud computing. Virtualization technology can improve resource utilization and enable rapid and flexible resource deployment based on changes in user business needs. Server virtualization enables well-separated workloads to share hardware again, dramatically reducing physical server footprint and power and cooling consumption, terminating server sprawl, and greatly speeding server provisioning.

Due to different server application scenarios and different server types, it is necessary to use a comprehensive virtualization software platform to achieve server virtualization, and also need to have multi-core, high-density, reliable memory, and scalable input / Output (Input/Output, I / O ) throughput of the hardware platform. However, common server virtualization technologies cannot protect and enforce policies at the virtual machine level, nor can they move policies with virtual machines.

In the prior art, a virtual switch that supports a virtual network card tag VN-Tag (a virtual network card used to identify a virtual machine) is configured to connect to a virtual network card of a virtual machine, and the virtual network card of the virtual machine has data entry. In the case of a virtual switch, the virtual switch adds VN-Tag to the data and forwards it to implement policy control at the virtual machine level. However, the disadvantage of the prior art is that the implementation of the solution requires the virtual switch, the access switch, and even the core network switch to support the technology at the same time. Therefore, the device that does not support the VNTag technology needs to be upgraded, which makes the application of the technical solution have limitations. Sex, and the cost of upgrading equipment is also high. Summary of the invention

In the prior art, the method for configuring a virtual machine control policy by using the VN-tag technology in the prior art has a high requirement and a high cost. The embodiment of the present invention provides a method and a switch for configuring a virtual machine control policy.

In a first aspect, an embodiment of the present invention provides a method for configuring a virtual machine control policy, where the method includes:

Receiving a first control policy for the virtual machine;

Obtaining a MAC address of the virtual machine according to the virtual machine identifier in the first control policy, and replacing the virtual machine identifier in the first control policy by using a MAC address of the virtual machine to obtain a second control policy. .

In a first possible implementation manner, after the obtaining the second control policy, the method further includes: receiving an address change message for the virtual machine, where the address change message carries an update MAC address; and replacing the updated MAC address The MAC address in the second control policy obtains a third control policy.

With reference to the first aspect, in a second possible implementation, after the obtaining the second control policy, the method further includes: receiving a first update control policy for the virtual machine, where the first update control policy includes Defining the virtual machine identifier of the virtual machine; obtaining the MAC address corresponding to the virtual machine identifier, replacing the virtual machine identifier in the first update control policy with the MAC address, to obtain a second update control policy And replacing the second control policy with the second update control policy.

With reference to the first aspect, in a third possible implementation manner, before the acquiring the MAC address of the virtual machine according to the virtual machine identifier in the first control policy, the method further includes: receiving the virtual machine identifier, And N MAC addresses corresponding to the virtual machine identifier, where N is greater than or equal to L

With reference to the third possible implementation manner of the first aspect, in a fourth possible implementation, the replacing, by using a MAC address of the virtual machine, the virtual machine identifier in the first control policy, The second control policy is specifically: replacing the first control policy one by one by using the N MAC addresses The N virtual machine identifiers are obtained, and N second control policies are obtained, where the N second control policies respectively correspond to the N MAC addresses.

With reference to the first aspect, in a fifth possible implementation, after the obtaining the second control policy, the method further includes: receiving, according to the second control policy, the destination address or source by using the MAC address The address of the packet is processed.

With reference to the fifth possible implementation manner of the first aspect, in a sixth possible implementation, the receiving, by the second control policy, the destination address or the source address The processing of the data packet specifically includes: receiving a data packet with the MAC address as a destination address or a source address; forwarding the data packet or rejecting forwarding the data packet according to the second control policy.

With reference to the first aspect, or the first, second, third, fourth, fifth, and sixth possible implementation manners of the first aspect, in a seventh possible implementation manner, A control strategy includes at least one of the following control policies: an access control policy, a resource reservation policy, a traffic priority policy, a maximum traffic delay policy, a maximum traffic loss rate policy, and a maximum traffic jitter policy.

In a second aspect, an embodiment of the present invention provides a switch, including a control module, where the control module includes a receiving submodule, an obtaining submodule, and a conversion submodule, and the receiving submodule is configured to receive a first for a virtual machine. a control sub-module, configured to acquire a MAC address of the virtual machine according to the virtual machine identifier in the first control policy, where the conversion sub-module is configured to replace the MAC address of the virtual machine The virtual machine identifier in the first control policy obtains a second control policy.

In a first possible implementation manner, the receiving submodule is further configured to: receive an address change message for the virtual machine, where the address change message carries an updated MAC address; The update MAC address replaces the MAC address in the second control policy to obtain a third control policy.

With reference to the second aspect, in a second possible implementation, the switch further includes a replacement submodule, where the receiving submodule is further configured to receive a first update control policy for the virtual machine, The first update control policy includes the virtual machine identifier of the virtual machine, and the conversion sub-module is further configured to acquire the MAC address corresponding to the virtual machine identifier, and replace the MAC address with the MAC address. The first update control policy is used to replace the virtual machine identifier to obtain a second update control policy; and the replacement submodule is configured to replace the second control policy by using the second update control policy.

With reference to the second aspect, in a third possible implementation, the receiving sub-module is further configured to: receive the virtual machine identifier, and the N MAC addresses corresponding to the virtual machine identifier, where N is greater than or equal to 1.

With reference to the third possible implementation manner of the second aspect, in a fourth possible implementation, the converting submodule is specifically configured to replace, by using the N MAC addresses, one of the first control policies The virtual machine identifier is obtained, and N second control policies are obtained, where the N second control policies respectively correspond to the N MAC addresses.

With reference to the second aspect, in a fifth possible implementation, the switch further includes a switching module, where the switching module is connected to the control module, and the switching module is configured to receive, by the control module, the And a second control policy, and according to the second control policy, forwarding or rejecting the forwarding process of the received data packet with the MAC address as the destination address or the source address.

With reference to the second aspect, or the first, second, third, fourth, and fifth possible implementation manners of the second aspect, in a sixth possible implementation manner, the control policy includes but not It is limited to one or any combination of the following: access control policy, resource reservation policy, traffic priority policy, maximum traffic delay policy, maximum traffic loss rate policy, maximum traffic jitter policy.

In the embodiment of the present invention, the switch acquires a first control policy for the virtual machine from the network management center; acquires a MAC address of the virtual machine according to the virtual machine identifier in the first control policy; and uses the MAC address of the virtual machine The address replaces the virtual machine identifier in the first control policy to obtain a second control policy. Therefore, the embodiment of the present invention implements the configuration and management of the control policy of the MAC address level, and solves the problem that the method for configuring the virtual machine control policy by using the VN-tag technology in the prior art has high requirements on equipment and high cost. It saves a lot of economic costs and makes virtual machine level policy control easier to implement. DRAWINGS

FIG. 1 is a schematic diagram of an application architecture of a method for configuring a virtual machine control policy according to an embodiment of the present disclosure;

2 is a flowchart of a method for configuring a virtual machine control policy according to an embodiment of the present invention; FIG. 3 is a schematic diagram of a switch according to an embodiment of the present invention;

FIG. 4 is a schematic diagram of another switch according to an embodiment of the present invention. detailed description

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is a partial embodiment of the invention, and not all of the embodiments. All other embodiments obtained by a person of ordinary skill in the art without departing from the inventive scope are intended to be within the scope of the invention.

FIG. 1 is a schematic diagram of an application architecture of a method for configuring a virtual machine control policy according to an embodiment of the present invention. As shown in Figure 1, the network management center can obtain the virtual MAC address corresponding to each network port of the virtual machine, and can associate the MAC address of the virtual network port of the virtual machine with the virtual machine (the corresponding relationship can be through the virtual machine). The virtual machine identifier (the virtual machine identifier in the present application refers to the virtual machine ID) and the corresponding relationship of the virtual machine's MAC address), and the control module sent to the data center access switch for the control policy of the virtual machine The switch may be an OpenFlow OpenF ow switch; after receiving the correspondence between the MAC address of the virtual network port and the virtual machine, and the control policy for the virtual machine, the control module may convert the control policy for the virtual machine. The control policy for the MAC address; when the switch receives a certain MAC address from the virtual machine or sends a packet to a MAC address of the virtual machine, according to the control policy for the MAC address, the data packet can be processed accordingly. Thus, policy control for the virtual machine is achieved.

FIG. 2 is a flowchart of a method for configuring a virtual machine control policy according to an embodiment of the present invention. The The execution body of the embodiment is a switch, and the method for converting the control policy for the virtual machine into the control policy for the MAC address after the switch obtains the control policy for the virtual machine from the network management center is described in detail. As shown in FIG. 2, this embodiment includes the following steps:

Step 201: Receive a first control policy for a virtual machine.

In order to implement the technical solution of the present invention, the switch includes a control module and a switch module, and the exchange module and the control module exchange information through the interface. The switch and the network management center can communicate through the management interface. The network management center can actively send the virtual MAC address corresponding to each network port of the virtual machine to the controller component, and the control policy for the virtual machine.

The first control policy obtained by the switch from the network management center is a control policy for the virtual machine, and the control policy package may include at least one of the following control policies: an access control policy, a resource reservation policy, and a traffic priority policy. Maximum traffic delay policy, maximum traffic loss rate policy, maximum traffic jitter policy.

For example, an access control policy for a virtual machine can be defined as denying forwarding of packets sent to a virtual machine.

Of course, the user can update the control policy of the virtual machine through the network management center. At this time, the network management center can send the updated control policy to the switch. After the virtual machine is migrated, the MAC address of the virtual machine also changes correspondingly. After obtaining the migration information, the management center may also actively send the updated update MAC address to the switch.

Step 202: Acquire a MAC address of the virtual machine according to the virtual machine identifier in the first control policy.

After the network management center sends the virtual machine ID of the virtual machine and the MAC address corresponding to the virtual machine ID to the switch, the switch can save the virtual machine identifier and the virtual machine MAC address in the local database.

A virtual machine may have one or more network ports, and each network port corresponds to one virtual MAC address. Therefore, one virtual machine may have one or more virtual MAC addresses, and the switch may obtain the one or more from the network management center. MAC address. After the network management center receives the first control policy of the virtual machine, after the switch extracts the virtual machine identifier of the virtual machine from the first control policy, the switch can query the corresponding MAC address in the local database according to the virtual machine identifier.

Step 203: Replace the virtual machine identifier in the first control policy by using a MAC address of the virtual machine to obtain a second control policy.

If the virtual machine has only one network port, that is, there is only one MAC address, the virtual machine ID in the first control policy of the virtual machine is directly replaced with the MAC address, and the second control policy for the MAC address is obtained. If the virtual machine has multiple network ports, that is, multiple MAC addresses MAC1, MAC 2, MAC 3, ... MACn, the virtual machine identifier in the first control policy is replaced with MAC1, and then the MAC1 is obtained. a second control policy of the address; after replacing the virtual machine identifier in the first control policy with MAC2, the second control policy for the MAC 2 address is obtained; and the first control is replaced by each of the n MAC addresses After the virtual machine ID in the policy, you can get n second control policies.

For example, the virtual machine 1 has only one network port, that is, only one MAC address MAC1. If the first control policy is to refuse to forward all data packets sent to the virtual machine 1, the second control policy is to refuse to forward all the data packets sent to the MAC1. . If the virtual machine has multiple network ports, that is, multiple MAC addresses MAC1, MAC2, MAC 3, ... MACn, then if the first control policy is to refuse to forward all packets sent to the virtual machine 1, then the second The control policy is to refuse to forward all packets sent to MAC1, MAC2, MAC3... MACn.

After the control module in the switch converts the first control policy for the virtual machine to the second control policy for the MAC address, the second control policy may be sent to the switching module, where the switching module is configured according to the second control policy. Processing packets originating from or sent to the MAC address.

Specifically, when receiving the data packet with the MAC address as the destination address or the source address, the switching module may locally query the corresponding second control policy according to the source MAC address or the destination MAC address of the data packet, thereby The package is processed accordingly.

Of course, if the switching module receives the data packet with the MAC address as the destination address or the source address, and the local query determines that the corresponding second control policy is not configured locally, the control module may The second control policy is delivered to the switch component. If there is no corresponding second control policy in the control module, the first control policy for the virtual machine corresponding to the second control policy and the corresponding virtual machine MAC address may be obtained from the network management center, and the first control policy is converted. After being the second control policy, it is delivered to the switch module.

In an optional implementation manner of the embodiment of the present invention, after obtaining the second control policy, the method further includes: receiving an address change message for the virtual machine, where the address change message carries an update MAC address; Updating the MAC address to replace the MAC address in the second control policy, to obtain a third control policy. Specifically, after the virtual machine is migrated, the MAC address of the virtual machine changes correspondingly. After the network management center obtains the migration information, the network management center may also actively send the updated MAC address to the switch through the address change message, and the switch may use the switch. The updated MAC address is substituted for the MAC address in the saved second control policy to obtain a third control policy. If the number of updated MAC addresses is m, then each of the m MAC addresses is used to replace the original MAC address in the second control policy, so that m third control policies are obtained.

Optionally, after obtaining the updated MAC address, the virtual machine identifier corresponding to the MAC address may also obtain the first control policy for the virtual machine from the network management center, and replace each MAC address of the m MAC addresses. The virtual machine identifier in the first control policy can obtain m second control policies.

It should be noted here that since the second control policy for the original MAC address is also converted from the first control policy for the corresponding virtual machine identifier, after the MAC address of the virtual machine is changed, The second control policy deletion for the original MAC address can save space on the one hand, and prevent the other virtual machines from generating errors after the MAC address of other virtual machines becomes the original MAC address. Policy control.

Correspondingly, after obtaining the second control policy, the method further includes: receiving a first update control policy for the virtual machine, where the first update control policy includes the virtual machine identifier of the virtual machine; And the MAC address corresponding to the virtual machine identifier, the virtual machine identifier in the first update control policy is replaced by using the MAC address, to obtain a second update control policy; The second update control policy replaces the second control policy. Specifically, if the user updates the control policy for the virtual machine through the network management center, the network management center may send the updated control policy to the switch, and after receiving the updated control policy, the switch may perform the updated control. The policy is converted into a control policy for the corresponding MAC address, and the previously saved second control policy is replaced by the updated control policy for the MAC address, thereby realizing the configuration of the dynamic control policy.

In the embodiment of the present invention, the switch acquires a first control policy for the virtual machine from the network management center; acquires a MAC address of the virtual machine according to the virtual machine identifier in the first control policy; and uses the MAC address of the virtual machine The address replaces the virtual machine identifier in the first control policy to obtain a second control policy. Therefore, the embodiment of the present invention implements the configuration and management of the control policy of the MAC address level, and solves the problem that the method for configuring the virtual machine control policy by using the VN-tag technology in the prior art has high requirements on equipment and high cost. It saves a lot of economic costs and makes virtual machine level policy control easier to implement.

It should be noted that if the network interface adaptation module (physical network card) of the physical host where the virtual machine is located supports the Promi scuous Mode, the working state of the physical network card needs to be set to the hybrid mode. In the hybrid mode, the physical NIC does not modify the source MAC address of the sent data packet, so that the source MAC address of the data packet sent by the virtual network port of the virtual machine is not changed; When the NIC's packets are not filtered, the destination MAC address is not filtered. If the physical NIC of the switch does not support the hybrid mode, you need to upgrade the physical NIC so that the physical NIC does not modify the source MAC address when forwarding the data packets from the virtual machine. When receiving the data packet sent to the NIC. , the target MAC address will not be filtered.

Correspondingly, an embodiment of the present invention further provides a switch, which may be an OpenF ow switch. FIG. 3 is a schematic diagram of a switch according to an embodiment of the present invention. As shown in FIG. 3, the switch includes a control module 31 0 , and the control module 31 0 includes a receiving submodule 31 1 , an obtaining submodule 31 2 , and a transforming submodule 31 . The switch also includes a switch module 320. The switching module 320 and the control module 31 0 can be connected through an interface. For example, for OpenF ow switches, control The module 31 0 and the switch module 320 can be connected through an OpenF ow interface. The receiving submodule 31 1 is configured to receive a first control policy for the virtual machine.

The receiving submodule 312 is further configured to receive the virtual machine identifier and the N MAC addresses corresponding to the virtual machine identifier, where N is greater than or equal to 1.

The obtaining submodule 31 2 is configured to obtain a MAC address of the virtual machine according to the virtual machine identifier in the first control policy.

A virtual machine may have one or more network ports, and each network port corresponds to one virtual MAC address. Therefore, one virtual machine may have one or more virtual MAC addresses, and the switch may obtain the one or more from the network management center. MAC address.

After the network management center receives the first control policy of the virtual machine, after the switch extracts the virtual machine identifier of the virtual machine from the first control policy, the switch can query the corresponding MAC address in the local database according to the virtual machine identifier.

The conversion sub-module 31 3 is configured to replace the virtual machine identifier in the first control policy by using a MAC address of the virtual machine to obtain a second control policy.

The conversion sub-module 31 is specifically configured to replace the virtual machine identifiers in the first control policy one by one by using the N MAC addresses, to obtain N second control policies, where the N second control policies respectively The N MAC addresses - corresponding. If the virtual machine has only one network port, that is, only one MAC address, the virtual machine ID in the first control policy of the virtual machine is directly replaced with the MAC address, and the second control policy for the MAC address is obtained. If the virtual machine has multiple network ports, that is, multiple MAC addresses MAC1, MAC 2, MAC 3, ... MACn, the virtual machine identifier in the first control policy is replaced with MAC1, and then the MAC1 is obtained. a second control policy of the address; after replacing the virtual machine identifier in the first control policy with MAC2, the second control policy for the MAC 2 address is obtained; and the first control is replaced by each of the n MAC addresses After the virtual machine ID in the policy, you can get n second control policies.

After the control module 310 in the switch converts the first control policy for the virtual machine to the second control policy for the MAC address, the second control policy may be sent to the switch module, and the switch module 320 is configured according to the second The control policy processes packets originating or sent to the MAC address.

The switching module 320 is configured to receive the second control policy from the control module, and forward or reject the received data packet with the MAC address as the destination address or the source address according to the second control policy. Forward processing.

Of course, if the switching module 320 receives the data packet with the MAC address as the destination address or the source address, and the local query determines that the corresponding second control policy is not configured locally, the control module 310 may use the second control policy. Issued to the switch module 320. If there is no corresponding second control policy in the control module 310, the first control policy for the virtual machine corresponding to the second control policy and the corresponding virtual machine MAC address may be obtained from the network management center, and the first control policy is used. After being converted into the second control policy, the method is delivered to the switching module 320.

Preferably, when the address of the virtual machine is changed, the receiving sub-module 311 is further configured to: receive an address change message for the virtual machine, where the address change message carries an updated MAC address; and the transformation sub-module 313 is further configured to use The update MAC address replaces the MAC address in the second control policy to obtain a third control policy. Specifically, after the virtual machine is migrated, the MAC address of the virtual machine changes correspondingly. After the network management center obtains the migration information, the network management center may also actively send the updated MAC address to the switch through the address change message, and the switch may use the switch. The updated MAC address is substituted for the MAC address in the saved second control policy to obtain a third control policy. Its If there are m updated MAC addresses, then each of the m MAC addresses is used to replace the original MAC address in the second control policy, so that m third control policies are obtained.

Preferably, the switch further includes a replacement submodule 314. After the control policy for the virtual machine is changed, the receiving submodule 311 is further configured to receive a first update control policy for the virtual machine, where the first update control policy is The virtual machine identifier of the virtual machine is included; the transformation sub-module 313 is further configured to acquire the MAC address corresponding to the virtual machine identifier, and replace the first update control policy with the MAC address. The virtual machine identifier is obtained to obtain a second update control policy; and the replacement submodule 314 is configured to replace the second control policy by using the second update control policy. Specifically, if the user updates the control policy for the virtual machine through the network management center, the network management center may send the updated control policy to the switch, and after receiving the updated control policy, the switch may perform the updated control. The policy is converted into a control policy for the corresponding MAC address, and the previously saved second control policy is replaced by the updated control policy for the MAC address, thereby realizing the configuration of the dynamic control policy.

Therefore, the embodiment of the present invention implements the configuration and management of the control policy of the MAC address level, and solves the problem that the method for configuring the virtual machine control policy by using the VN-tag technology in the prior art has high requirements on equipment and high cost. It saves a lot of economic costs and makes virtual machine level policy control easier to implement. Correspondingly, an embodiment of the present invention further provides a switch, and FIG. 4 is a schematic diagram of another switch according to an embodiment of the present invention. As shown in FIG. 4, the switch provided in this embodiment includes a network interface 401, a processor 402, and a memory 403. System bus 404 is used to connect network interface 401, processor 402, and memory 403.

The network interface 401 can be used to communicate with the physical management host where the network management center and the virtual machine are located, respectively. Memory 403 can be a persistent storage, such as a hard drive and flash memory, with software modules and device drivers in memory 403, and a database for storing control policies. The software modules are capable of executing the various functional modules of the above described method of the present invention; the device drivers can be network and interface drivers.

At startup, these software components are loaded into memory 403 and then accessed by processor 402 and executed as follows:

Receiving a first control policy for the virtual machine;

The first control policy includes at least one of the following control policies: an access control policy, a resource reservation policy, a traffic priority policy, a maximum traffic delay policy, a maximum traffic loss rate policy, and a maximum traffic jitter policy.

After the network management center receives the first control policy of the virtual machine, after the switch extracts the virtual machine identifier of the virtual machine from the first control policy, the switch may be based on the virtual machine identifier in the local database. Query the corresponding MAC address.

Further, after obtaining the second control policy, the processor 402 accesses the software component of the memory 403, and executes an instruction of the following process:

Receiving an address change message for the virtual machine, where the address change message carries an updated MAC address;

And replacing the MAC address in the second control policy with the updated MAC address to obtain a third control policy.

Specifically, after the virtual machine is migrated, the MAC address of the virtual machine changes accordingly. After the network management center obtains the migration information, the network management center can also actively send the updated MAC address to the switch through the address change message. The switch can be used. The updated MAC address is substituted for the MAC address in the saved second control policy to obtain a third control policy. If there are m MAC addresses after the update, the original MAC address in the second control policy is replaced by each of the m MAC addresses, and the m third control policy is obtained.

Receiving a first update control policy for the virtual machine, where the first update control policy includes the virtual machine identifier of the virtual machine; Obtaining the MAC address corresponding to the virtual machine identifier, and replacing the virtual machine identifier in the first update control policy with the MAC address, to obtain a second update control policy;

The second control policy is replaced with the second update control policy.

Specifically, if the user updates the control policy for the virtual machine through the network management center, the network management center may send the updated control policy to the switch, and after receiving the updated control policy, the switch may perform the updated control. The policy is converted into a control policy for the corresponding MAC address, and the previously saved second control policy is replaced by the updated control policy for the MAC address, thereby realizing the configuration of the dynamic control policy.

Further, after the processor 402 accesses the software component of the memory 403 according to the virtual machine identifier in the first control policy, and after querying the MAC address of the virtual machine, the processor 402 executes an instruction of the following process: The virtual machine identifier, and the N MAC addresses corresponding to the virtual machine identifier, where N is greater than or equal to 1.

The processor 402 performs the process of replacing the virtual machine identifier in the first control policy by using the MAC address of the virtual machine, and the process of obtaining the second control policy is specifically: replacing the one of the N MAC addresses one by one The virtual machine identifier in the first control policy obtains N second control policies, where the N second control policies respectively correspond to the N MAC addresses.

Further, after the switch receives the data packet through the network interface 401, after the processor 402 accesses the software component of the memory 403, the processor 402 executes an instruction of: following the second control policy, the received and the MAC address Processing packets for the destination address or source address. Specifically, the data packet with the MAC address as the destination address or the source address is received; according to the second control policy, the data packet is forwarded or the data packet is refused to be forwarded.

Therefore, the embodiment of the present invention implements the configuration and management of the control policy of the MAC address level, and solves the problem that the method for configuring the virtual machine control policy by using the VN-tag technology in the prior art has high requirements on equipment and high cost. It saves a lot of economic costs and makes virtual machine level policy control easier to implement.

A person skilled in the art should further appreciate that it is described in connection with the embodiments disclosed herein. The example units and algorithm steps can be implemented in electronic hardware, computer software, or a combination of both. In order to clearly illustrate the interchangeability of hardware and software, the examples have been generally described in terms of function in the above description. Composition and steps. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the solution. A person skilled in the art can use different methods to implement the described functions for each particular application, but such implementation should not be considered to be beyond the scope of the present invention.

The steps of a method or algorithm described in connection with the embodiments disclosed herein can be implemented in hardware, a software module executed by a processor, or a combination of both. Software modules can be placed in random access memory (RAM), memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or technical field Any other form of storage medium known.

The above described embodiments of the present invention are further described in detail, and the embodiments of the present invention are intended to be illustrative only. The scope of the protection, any modifications, equivalents, improvements, etc., made within the spirit and scope of the invention are intended to be included within the scope of the invention.

Claims

claims

1. A method for configuring a virtual machine control policy, characterized in that the method includes: receiving a first control policy for the virtual machine;

According to the virtual machine identifier in the first control policy, obtain the MAC address of the virtual machine; use the MAC address of the virtual machine to replace the virtual machine identifier in the first control policy to obtain a second control policy .

2. The configuration method of a virtual machine control policy according to claim 1, characterized in that after obtaining the second control policy, it further includes:

Receive an address change message for the virtual machine, where the address change message carries an updated MAC address;

Use the updated MAC address to replace the MAC address in the second control policy to obtain a third control policy.

3. The configuration method of a virtual machine control policy according to claim 1, characterized in that, after obtaining the second control policy, it further includes:

Receive a first update control policy for the virtual machine, where the first update control policy includes the virtual machine identification of the virtual machine;

Obtain the MAC address corresponding to the virtual machine identification, use the MAC address to replace the virtual machine identification in the first update control policy, and obtain a second update control policy;

The second control policy is replaced with the second updated control policy.

4. The method for configuring a virtual machine control policy according to claim 1, wherein before obtaining the MAC address of the virtual machine according to the virtual machine identifier in the first control policy, the method further includes: receiving The virtual machine identifier, and N MAC addresses corresponding to the virtual machine identifier, where N is greater than or equal to 1.

5. The configuration method of a virtual machine control policy according to claim 4, wherein the virtual machine identifier in the first control policy is replaced with the MAC address of the virtual machine to obtain the second control policy. The specific strategies are: Use the N MAC addresses to replace the virtual machine identifiers in the first control policy one by one to obtain N second control policies. The N second control policies correspond one-to-one to the N MAC addresses respectively. .

6. The method for configuring a virtual machine control policy according to claim 1, characterized in that after obtaining the second control policy, further comprising: according to the second control policy, Packets whose address is the destination address or source address are processed.

7. The configuration method of a virtual machine control policy according to claim 6, characterized in that, according to the second control policy, the received data packet with the MAC address as the destination address or source address The specific processing includes:

Receive data packets with the MAC address as the destination address or source address;

According to the second control policy, the data packet is forwarded or the data packet is refused to be forwarded.

8. The configuration method of a virtual machine control policy according to any one of claims 1 to 7, characterized in that the first control policy includes at least one of the following control policies: access control policy, resource reservation policy , traffic priority strategy, maximum traffic delay strategy, maximum traffic packet loss rate strategy, maximum traffic jitter strategy.

9. A switch, characterized in that the switch includes a control module, and the control module includes a receiving sub-module, an obtaining sub-module, and a converting sub-module;

The receiving submodule is used to receive the first control policy for the virtual machine;

The acquisition sub-module is used to acquire the MAC address of the virtual machine according to the virtual machine identification in the first control policy;

The conversion submodule is used to replace the virtual machine identifier in the first control policy with the MAC address of the virtual machine to obtain a second control policy.

10. The switch according to claim 9, wherein the receiving sub-module is further configured to receive an address change message for the virtual machine, the address change message carrying an updated MAC address;

The conversion sub-module is also used to replace the second control policy with the updated MAC address. The MAC address in , the third control policy is obtained.

11. The switch according to claim 9, characterized in that the switch further includes a replacement sub-module;

The receiving sub-module is further configured to receive a first update control policy for the virtual machine, where the first update control policy includes the virtual machine identification of the virtual machine;

The conversion sub-module is also configured to obtain the MAC address corresponding to the virtual machine identifier, use the MAC address to replace the virtual machine identifier in the first update control policy, and obtain a second update control policy;

The replacement sub-module is used to replace the second control strategy with the second update control strategy.

12. The switch according to claim 9, wherein the receiving sub-module is further configured to receive the virtual machine identifier and N MAC addresses corresponding to the virtual machine identifier, wherein N is greater than or equal to 1.

13. The switch according to claim 12, wherein the conversion sub-module is specifically configured to use the N MAC addresses to replace the virtual machine identifiers in the first control policy one by one to obtain N There are two second control strategies, and the N second control strategies respectively correspond to the N MAC addresses.

14. The switch according to claim 9, characterized in that, the switch further includes a switching module, and the switching module is connected to the control module;

The switching module is configured to receive the second control policy from the control module, and forward the received data packets with the MAC address as the destination address or source address according to the second control policy. or refuse forwarding processing.

15. The switch according to any one of claims 9-14, characterized in that the control policy includes but is not limited to one or a combination of the following: access control policy, resource reservation policy, traffic priority policy , maximum traffic delay strategy, maximum traffic packet loss rate strategy, maximum traffic jitter strategy.