WO2015098797A1

WO2015098797A1 - Communication system, control device, control method, and program

Info

Publication number: WO2015098797A1
Application number: PCT/JP2014/083837
Authority: WO
Inventors: 修平山口
Original assignee: 日本電気株式会社
Priority date: 2013-12-24
Filing date: 2014-12-22
Publication date: 2015-07-02

Abstract

The present invention improves redundancy and effectively uses the bandwidth between two networks. A communication system contains: two or more communication nodes disposed between a group of ports, which are link aggregated to a switch in a first network, and a group of ports, which are link aggregated to a switch in a second network, so that each communication node is connected to the switches of the first and second networks in parallel; and a control device which controls each communication node so that communication packets between the first and second networks are transferred after the transmission source address and reception address, to which each switch refers, are converted into a predetermined common address allocated to the communication nodes.

Description

COMMUNICATION SYSTEM, CONTROL DEVICE, COMMUNICATION METHOD, AND PROGRAM

[Description of related applications]
The present invention is based on a Japanese patent application: Japanese Patent Application No. 2013-265483 (filed on Dec. 24, 2013), and the entire description of the application is incorporated herein by reference.
The present invention relates to a communication system, a control device, a communication method, and a program, and more particularly, to a communication system, a control device, a communication method, and a program for connecting two networks.

Patent Document 1 discloses a system that realizes topological redundancy and tolerance between nodes of a plurality of data networks using (Multi-Chassis Link Aggregation: hereinafter “MCLAG”).

Patent Document 2 discloses an OpenFlow network system in which a redundant network device can be connected to a centralized control network called OpenFlow while maintaining a redundant configuration.

Patent Document 3 discloses a configuration in which a centralized control type network control device is added with a management function of a redundant link using a technique called trunking or link aggregation, and a path control function using these links. Has been.

Special table 2013-535922 gazette Japanese Patent Application Laid-Open No. 2013-21706 International Publication No. 2012/050071

The following analysis is given by the present invention. Generally, when two local area networks (hereinafter referred to as LANs) are connected, a device for terminating the L2 network, such as a router or a gateway, is installed between them. Similarly, when an L2 overlay network is constructed, a device for performing L2 encapsulation / decapsulation called a tunnel end point (TEP) or the like is installed between the underlay network and the overlay network.

When connecting two networks in this way, it is required to make these devices redundant so that they do not become a single point of failure (hereinafter referred to as SPOF). In this case, a function called multi-chassis link aggregation (hereinafter referred to as MCLAG) of Patent Document 1 or VRRP (Virtual Router Redundancy Protocol) used in Patent Document 2 is used.

In the case of VRRP, there is a restriction that both networks to be connected must be IP (Internet Protocol) networks. In addition, in the case of VRRP, since a plurality of devices are operated as Active / Standby, there is a problem that the bandwidth and resources of the Standby device are not effectively used.

On the other hand, in the case of MCLAG, processing is performed in a distributed manner in all redundant devices, so that the waste of bandwidth like VRRP is reduced. FIG. 10 shows an example in which two IP subnets are connected using an L3 switch having the MCLAG function. Hereinafter, in order to simplify the description, it is assumed that there is one terminal in both segments. In the example of FIG. 10, the LAGs of the L2 switches of the segments A and B are terminated with the MCLAG of the L3 switch. If it is desired to dynamically build a LAG with a protocol such as LACP (Link Aggregation Control Protocol), the L3 switch needs to have a function that can implement the MCLAG.

However, regardless of the normal LAG function, a device having the MCLAG function is generally very expensive. Further, since it is necessary to prepare a dedicated line (link between the L3 switches in FIG. 10) for connecting the redundant devices, it is inevitable that there is a waste of bandwidth and resources. Further, for example, since L2 communication such as EthernetOAM is terminated by an L3 switch, there is a problem that these functions cannot be utilized across segments.

The present invention provides a communication system, a control device, a communication method, and a program that can contribute to effective use of bandwidth between networks and improvement of redundancy when connecting two networks without using a device that implements the MCLAG function. The purpose is to do.

According to the first aspect, each communication node is connected in parallel between the link-aggregated port group of the switch of the first network and the link-aggregated port group of the switch of the second network. Two or more communication nodes arranged to be connected to a switch of the second network, and a source address and a destination address referred to by each of the switches for communication packets between the first and second networks. There is provided a communication system including a control device that controls each of the communication nodes so as to transfer the address after conversion to a predetermined address commonly assigned to the communication node.

According to the second aspect, each communication node is connected in parallel between the link-aggregated port group of the switch of the first network and the link-aggregated port group of the switch of the second network. A source address and a destination address that are connected to two or more communication nodes arranged to be connected to a switch of the second network and that are referred to by each of the switches for communication packets between the first and second networks. And a control device that controls each of the communication nodes to transfer the information to a predetermined address assigned in common to the communication nodes.

According to the third aspect, each communication node is connected in parallel between the link-aggregated port group of the switch of the first network and the link-aggregated port group of the switch of the second network. The control device connected to the two or more communication nodes arranged to be connected to the switch of the second network performs communication between the first and second networks based on the notification from the communication node. In the step of detecting the occurrence and the communication between the first and second networks, the source address and the destination address referred to by each switch are converted into a predetermined address assigned in common to the communication nodes. And then controlling each of the communication nodes to transfer it. This method is linked to a specific machine called a control device for controlling communication nodes arranged in parallel between the two networks.

According to the fourth aspect, each communication node is connected in parallel between the link-aggregated port group of the switch of the first network and the link-aggregated port group of the switch of the second network. The communication between the first and second networks occurs in a computer connected to two or more communication nodes arranged to be connected to the switch of the second network based on the notification from the communication node. For the process of detecting the communication and the communication between the first and second networks, the source address and the destination address referred to by each switch are converted into a predetermined address assigned in common to the communication nodes. And a process for controlling each of the communication nodes so as to transfer the data after the transfer. This program can be recorded on a computer-readable (non-transient) storage medium. That is, the present invention can be embodied as a computer program product.

According to the present invention, it is possible to contribute to effective utilization of bandwidth between two networks and improvement of redundancy without using a device equipped with the MCLAG function.

It is a figure which shows the structure of one Embodiment of this invention. It is a figure which shows the structure of the 1st Embodiment of this invention. It is a figure which shows the example of the control information (flow entry) set to the communication node of the 1st Embodiment of this invention. It is a figure for demonstrating operation | movement (new communication detection) of the communication system of the 1st Embodiment of this invention. It is a figure for demonstrating operation | movement (control information (flow entry) setting) of the communication system of the 1st Embodiment of this invention. FIG. 6 is a diagram for explaining the operation of the communication system (packet transfer operation between terminal X and terminal Y) according to the first embodiment of the present invention. It is a figure which shows the example of the control information (flow entry) set to the communication node in the deformation | transformation embodiment of this invention. It is a figure which shows the example of another control information (flow entry) set to the communication node in the deformation | transformation embodiment of this invention. It is a figure which shows the structure of the communication system of the 2nd Embodiment of this invention. It is a figure which shows the structure which connected between segments using the L3 switch with a MCLAG function.

First, an outline of an embodiment of the present invention will be described with reference to the drawings. Note that the reference numerals of the drawings attached to this summary are attached to the respective elements for convenience as an example for facilitating understanding, and are not intended to limit the present invention to the illustrated embodiment.

In one embodiment of the present invention, as shown in FIG. 1, the link-aggregated port group (LAG) of the switch 31 of the first network and the link-aggregated port group of the switch 32 of the second network, as shown in FIG. (LAG), two or

more communication nodes

11, 12 arranged so that each communication node is connected in parallel to the

switches

31, 32 of the first and second networks, and these

communication nodes

11, 12 can be realized.

More specifically, the control device 20 uses the transmission source address x (y) and the destination address α (β) referred to by the

switches

31 and 32 for the communication packet between the first and second networks. The

communication nodes

11 and 12 are controlled so as to be transferred after being converted into predetermined addresses β (α) and y (x) assigned in common to the communication nodes.

With the configuration described above, the

communication nodes

11 and 12 perform an operation of relaying packets transmitted and received between the LAGs of the

switches

31 and 32 of the first and second networks. At this time, since the

communication nodes

11 and 12 are arranged in parallel, communication can be continued even if a failure or the like occurs in one of them. Further, it is not necessary to use a device having an MCLAG function as a communication node, and a device having a function of rewriting a header of a designated packet in accordance with an instruction from the control device can be used. As such a device, for example, the open flow switch of Non-Patent Document 2 can be cited.

[First Embodiment]
Next, a first embodiment of the present invention will be described in detail with reference to the drawings. FIG. 2 is a diagram showing the configuration of the first exemplary embodiment of the present invention. Referring to FIG. 2, there is shown a configuration in which OpenFlow switches 11A and 12A are connected in parallel between two local area networks divided into segments A and B.

In addition, layer 2 switches (hereinafter referred to as “L2 switches”) each having a LAG function are arranged in segments A and B. The LAG configuration port # 1 of the segment A L2 switch 31A is connected to the port a of the OpenFlow switch 11A, and the LAG configuration port # 2 of the L2 switch 31A is connected to the port a of the OpenFlow switch 12A. Similarly, the LAG configuration port # 1 of the segment B L2 switch 32A is connected to the port b of the OpenFlow switch 11A, and the LAG configuration port # 2 of the L2 switch 32A is connected to the port b of the OpenFlow switch 12A. When the

L2 switch

31A, 32A receives a packet (frame) to be transmitted to the opposing segment side, the

L2 switch

31A, 32A transfers it to one of the OpenFlow switches 11A, 12A by the LAG function. Thereby, distributed use of the line is realized.

OpenFlow switches 11 </ b> A and 12 </ b> A are devices (communication nodes) compliant with the specifications of Non-Patent Document 2. Specifically, the OpenFlow switches 11A and 12A perform an operation of processing a received packet in accordance with a flow entry having a matching condition that matches the received packet from among the flow entries set by the OpenFlow controller 20A. In addition, when the OpenFlow switches 11A and 12A do not hold a flow entry having a matching condition that matches the received packet, the OpenFlow controller 11A transmits the received packet or information extracted from the received packet to the OpenFlow controller 20A (Non-patent Document 2). Packet-In message), requesting setting of a flow entry.

In addition, a common MAC address that terminates both segments is set in each of the ports a and b of the OpenFlow switches 11A and 12A. In the following description, the MAC address set for the port a on the segment A side is represented by “α”, and the MAC address set for the port b on the segment B side is represented by “β”. Further, the IP address and MAC address of the terminal X on the segment A side are represented as “X” and “x”, and the IP address and MAC address of the terminal Y on the segment B side are represented as “Y” and “y”, respectively.

The OpenFlow controller 20A is a device that controls a device (communication node) conforming to the specification of Non-Patent Document 2 by setting a flow entry for the OpenFlow switches 11A and 12A. The OpenFlow controller 20A according to the present embodiment sets the flow entry shown in FIG. 3 in both the OpenFlow switches 11A and 12A.

Entry No. in Fig. 3 A flow entry 1 indicates a process to be executed by the OpenFlow switches 11A and 12A when a packet having an input port = “a”, a destination MAC address = “α”, and a destination IP address = “Y” is received. In the example of FIG. 3, the destination MAC address is rewritten to the MAC address “y” of the terminal Y, the source MAC address is rewritten to the MAC address “β” of the port b of the OpenFlow switch, and then output from the port b on the segment B side Indicates what to do.

Entry No. in Fig. 3 The flow entry of No. 2 This corresponds to the flow in the reverse direction to the flow entry 1. Specifically, when a packet with input port = “b”, destination MAC address = “β”, and destination IP address = “X” is received, the OpenFlow switches 11A and 12A set the destination MAC address to the MAC of the terminal X. This indicates that after rewriting to the address “x” and rewriting the source MAC address to the MAC address “α” of the port a of the OpenFlow switch, it should be output from the port a on the segment A side.

The flow entry as shown in FIG. 3 may be set when the OpenFlow controller 20A detects the occurrence of communication between the terminal X and the terminal Y in response to a flow entry setting request from the OpenFlow switches 11A and 12A. . The example of FIG. 3 shows a flow entry for communication between the terminal X and the terminal Y. For example, when communication occurs between the terminal P of the segment A and the terminal Q of the segment B, the flow entry of FIG. The MAC address and IP address (X, x, Y, z) of the terminal may be replaced with (P, p, Q, q), respectively. Of course, if it is known in advance that communication will occur, a flow entry may be set in advance.

Note that the functions of the above OpenFlow controller can also be realized by a computer program that causes a computer constituting the OpenFlow controller to execute the above-described setting process of each flow entry by using the hardware thereof.

Subsequently, the operation of the present embodiment will be described in detail with reference to the drawings. For example, as shown in FIG. 4, when the terminal X transmits a packet addressed to the terminal Y, the L2 switch 31A selects a port from the LAG configuration ports according to a predetermined rule, and either the

OpenFlow switch

11A or 12A is selected. (Step S001). In the example of FIG. 4, a packet addressed to the terminal Y is transmitted from the terminal X to the OpenFlow switch 11A.

When the OpenFlow switch 11A receives a packet addressed to the terminal Y from the terminal X, the OpenFlow switch 11A searches the flow entry set from the OpenFlow controller 20A for a flow entry having a matching condition that matches the received packet. However, since the flow entry shown in FIG. 3 is not set at this point, the OpenFlow switch 11A requests the OpenFlow controller 20A to set the flow entry corresponding to the packet addressed to the terminal Y from the terminal X ( Step S002; Packet-In).

Upon receiving the flow entry setting request, the OpenFlow controller 20A creates a flow entry as shown in FIG. 3 and sets it in both the OpenFlow switches 11A and 12A in order to enable communication between the terminal X and the terminal Y. (Step S003 in FIG. 5). Further, the OpenFlow controller 20A instructs the requester of the flow entry setting request (in this case, the OpenFlow switch 11A) to output the packet received in step S002 from the port b. Note that when creating the flow entry, the OpenFlow controller 20A refers to a separately prepared access control list or the like, and confirms whether communication between the terminal X and the terminal Y may be permitted. Good.

After that, when the OpenFlow switches 11A and 12A receive a packet addressed to the terminal Y from the terminal X, the entry No. After rewriting the destination MAC address to the MAC address “y” of the terminal Y according to the flow entry of 1 and rewriting the source MAC address to the MAC address “β” of the port b of the OpenFlow switch, from the port b on the segment B side This is output (step S004 in FIG. 6).

When the L2 switch 32A on the segment B side receives the packet in which the destination / source MAC address has been rewritten, it aggregates these traffics by the LAG function and transfers them to the terminal Y.

The packet addressed from terminal Y to terminal X is the same operation, and the entry No. in FIG. It is delivered to the terminal X by the flow entry 2.

Thereafter, when any of the OpenFlow switches 11A and 12A fails for some reason, the L2 switches 31A and 32A continue communication using the remaining OpenFlow switch by the LAG function.

Further, when the port a (or port b) of the OpenFlow switches 11A and 12A becomes a failure, the OpenFlow controller 20A links down the port b (or port a) corresponding to the port a (or port b). It is also preferable to do. In this way, the LAG function of the L2 switch makes it possible to continue communication using the OpenFlow switch in which no failure has occurred in the port. As a mechanism for detecting the failure of the ports of the OpenFlow switches 11A and 12A, the Port Status message of Non-Patent Document 2 that notifies the OpenFlow controller of the OpenFlow switch to the OpenFlow controller can be used.

As described above, according to the present embodiment, it is possible to use the bandwidth of a plurality of OpenFlow switches without waste and to secure fault tolerance.

Also, in the present embodiment, by utilizing the one-to-one correspondence between the port a and the port b of the OpenFlow switch, it is possible to transmit a message of a specific protocol across the segments.

For example, if the L2 switches 31A and 32A at both ends have the LACP (Link Aggregation Control Protocol; IEEE802.3ad) function, the OpenFlow controller 20A sets the flow entries shown in FIG. 7 in the OpenFlow switches 11A and 12A. Also good. In the example of FIG. 7, the LACP frame of EtherType = 0x8809 is instructed to be transferred to the opposite segment without converting the header or the like. Thus, it is possible to construct a dynamic MCLAG by transmitting the LACP frame.

Similarly, when the L2 switches 31A and 32A at both ends have the function of EtherOAM (operations, administration, maintenance), the OpenFlow controller 20A may set the flow entries shown in FIG. 8 in the OpenFlow switches 11A and 12A. . In the example of FIG. 8, an Ether-CC (continuity check) frame with EtherType = 0x8902 is instructed to be transferred to the opposite segment without converting the header or the like. In this way, it is possible to realize Ether-CC transmission and device monitoring across segments. Note that since Ether-CC depends on the VLAN, the VLAN-IDs of both segments must be equal when passing through as shown in FIG. Different cases can be dealt with by registering a flow entry that performs VLAN-ID conversion, rather than simple passage.

As described above, according to the present embodiment, some functions of the L2 switches 31A and 32A can be utilized across segments.

Although the embodiments of the present invention have been described above, the present invention is not limited to the above-described embodiments, and further modifications, substitutions, and adjustments may be made without departing from the basic technical idea of the present invention. Can be added. For example, the network configuration, the configuration of each element, and the expression form of a message shown in each drawing are examples for helping understanding of the present invention, and are not limited to the configuration shown in these drawings.

In the above-described embodiment, two OpenFlow switches are arranged to distribute traffic and ensure redundancy. However, as shown in FIG. 9, redundancy is achieved with a configuration in which three or more OpenFlow switches are arranged in parallel. (Multiplicity) can also be increased (second embodiment). The upper limit of redundancy depends on the LAG function of the L2 switches at both ends. As described above, each OpenFlow switch operates independently without depending on redundancy, and thus can be linearly scaled.

In the above-described embodiment, it has been described that the segments on both sides are IP networks. However, even if this is not the case, it can be handled by setting the flow entry corresponding to FIG. 3 according to the flow entry configuration and the network configuration. For example, in the case of an L2 overlay configuration in which segment A is an underlay network and segment B is an overlay network, a flow entry that encapsulates from port a to port b and a flow entry that decapsulates from port b to port a are set. Thus, the same effect can be exhibited.

Finally, a preferred form of the invention is summarized.
[First embodiment]
(Refer to the communication system according to the first viewpoint)
[Second form]
In the communication system of the first form,
The control device converts a transmission source MAC address of a communication packet between the first and second networks into a MAC address assigned to a port of the own device, and communicates between the first and second networks. A communication system that converts a destination MAC address of a destination device into a MAC address of a destination device learned in advance.
[Third embodiment]
In the communication system of the first or second form,
The control device, for each communication node,
By setting control information that associates a match condition for identifying a packet addressed to the other network from one of the first and second networks and a process to be applied to a packet that matches the match condition A communication system for controlling the first and second communication nodes.
[Fourth form]
In the communication system according to any one of the first to third aspects,
The control device further provides the first and second communication nodes with respect to the first and second communication nodes.
A communication system for setting control information for passing a management packet between the first and second networks.
[Fifth embodiment]
(Refer to the control device according to the second viewpoint)
[Sixth embodiment]
In the control device of the fifth aspect,
A source MAC address of a communication packet between the first and second networks is converted into a MAC address assigned to a port of the own device, and a destination MAC address of the communication packet between the first and second networks is converted. A control device that converts the MAC address of the destination device learned in advance.
[Seventh form]
In the control device of the fifth or sixth aspect,
For each communication node,
By setting control information that associates a match condition for identifying a packet addressed to the other network from one of the first and second networks and a process to be applied to a packet that matches the match condition A control device for controlling the first and second communication nodes.
[Eighth form]
In the control device according to any one of the fifth to seventh aspects,
Further, for each communication node,
A control device that sets control information for passing a management packet between the first and second networks.
[Ninth Embodiment]
(Refer to the communication method according to the third viewpoint)
[Tenth embodiment]
(Refer to the program from the fourth viewpoint above.)
Note that the ninth to tenth embodiments can be developed into the second to fourth embodiments as in the first embodiment.

It should be noted that the disclosures of the above patent documents and non-patent documents are incorporated herein by reference. Within the scope of the entire disclosure (including claims) of the present invention, the embodiments and examples can be changed and adjusted based on the basic technical concept. Further, various combinations or selections of various disclosed elements (including each element of each claim, each element of each embodiment or example, each element of each drawing, etc.) within the scope of the claims of the present invention. Is possible. That is, the present invention of course includes various variations and modifications that could be made by those skilled in the art according to the entire disclosure including the claims and the technical idea. In particular, with respect to the numerical ranges described in this document, any numerical value or small range included in the range should be construed as being specifically described even if there is no specific description.

11, 12 Communication node 20

Controller

31, 32

switch

11A, 12A, 13A OpenFlow switch

20A OpenFlow controller

31A, 32A L2 switch

Claims

Between the link aggregated port group of the switch of the first network and the link aggregated port group of the switch of the second network, each communication node is connected to the switch of the first network and the second network in parallel. Two or more communication nodes arranged to be connected;
For each communication packet between the first and second networks, the source address and the destination address referred to by each switch are converted into a predetermined address commonly assigned to the communication node and then transferred. And a control device for controlling the communication node.
The control device converts a transmission source MAC address of a communication packet between the first and second networks into a MAC address assigned to a port of the own device, and communicates between the first and second networks. The communication system according to claim 1, wherein the destination MAC address is converted into a MAC address of a destination device learned in advance.
The control device, for each communication node,
By setting control information that associates a match condition for identifying a packet addressed to the other network from one of the first and second networks and a process to be applied to a packet that matches the match condition The communication system according to claim 1 or 2, wherein the first and second communication nodes are controlled.
The control device further provides the first and second communication nodes with respect to the first and second communication nodes.
The communication system according to any one of claims 1 to 3, wherein control information for passing a management packet between the first and second networks is set.
Between the link aggregated port group of the switch of the first network and the link aggregated port group of the switch of the second network, each communication node is connected to the switch of the first network and the second network in parallel. Connected to two or more communication nodes arranged to be connected,
For each communication packet between the first and second networks, the source address and the destination address referred to by each switch are converted into a predetermined address commonly assigned to the communication node and then transferred. A control device that controls a communication node.
A source MAC address of a communication packet between the first and second networks is converted into a MAC address assigned to a port of the own device, and a destination MAC address of the communication packet between the first and second networks is converted. 6. The control device according to claim 5, wherein the control device converts the MAC address of the destination device learned in advance.
For each communication node,
By setting control information that associates a match condition for identifying a packet addressed to the other network from one of the first and second networks and a process to be applied to a packet that matches the match condition The control device according to claim 5 or 6, which controls the first and second communication nodes.
Further, for each communication node,
The control device according to claim 5, wherein control information for passing a management packet between the first and second networks is set.
Between the link aggregated port group of the switch of the first network and the link aggregated port group of the switch of the second network, each communication node is connected to the switch of the first network and the second network in parallel. A control device connected to two or more communication nodes arranged to be connected,
Detecting the occurrence of communication between the first and second networks based on a notification from the communication node;
For each communication between the first and second networks, the communication is performed such that a transmission source address and a destination address referred to by each switch are converted into a predetermined address commonly assigned to the communication node and then transferred. Controlling the node.
Between the link aggregated port group of the switch of the first network and the link aggregated port group of the switch of the second network, each communication node is connected to the switch of the first network and the second network in parallel. To a computer connected to two or more communication nodes arranged to be connected,
A process for detecting that communication between the first and second networks has occurred based on a notification from the communication node;
For each communication between the first and second networks, the communication is performed such that a transmission source address and a destination address referred to by each switch are converted into a predetermined address commonly assigned to the communication node and then transferred. A program for executing a process for controlling a node.