WO2015131612A1 - 网络地址转换nat资源的分配方法及装置 - Google Patents

网络地址转换nat资源的分配方法及装置 Download PDF

Info

Publication number
WO2015131612A1
WO2015131612A1 PCT/CN2014/094142 CN2014094142W WO2015131612A1 WO 2015131612 A1 WO2015131612 A1 WO 2015131612A1 CN 2014094142 W CN2014094142 W CN 2014094142W WO 2015131612 A1 WO2015131612 A1 WO 2015131612A1
Authority
WO
WIPO (PCT)
Prior art keywords
network address
public network
port
current
user
Prior art date
Application number
PCT/CN2014/094142
Other languages
English (en)
French (fr)
Inventor
胡亿芬
蔡磊
鲍俊涛
杨涛
夷泓
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Priority to EP14884458.2A priority Critical patent/EP3197119A4/en
Publication of WO2015131612A1 publication Critical patent/WO2015131612A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/09—Mapping addresses
    • H04L61/25—Mapping addresses of the same type
    • H04L61/2503—Translation of Internet protocol [IP] addresses
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/09—Mapping addresses
    • H04L61/25—Mapping addresses of the same type
    • H04L61/2503—Translation of Internet protocol [IP] addresses
    • H04L61/2514—Translation of Internet protocol [IP] addresses between local and global IP addresses
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2101/00—Indexing scheme associated with group H04L61/00
    • H04L2101/60—Types of network addresses
    • H04L2101/695—Types of network addresses using masks or ranges of addresses
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/09—Mapping addresses
    • H04L61/25—Mapping addresses of the same type
    • H04L61/2503—Translation of Internet protocol [IP] addresses
    • H04L61/2557—Translation policies or rules

Definitions

  • the present invention relates to the field of communications, and in particular, to a network address translation (NAT) resource allocation method and apparatus.
  • NAT network address translation
  • IPv4 Internet Protocol version 4
  • IPv6 Internet Protocol version 6
  • NAT technology has spawned many drafts of Request For Comment (RFC). Mainly focused on various countermeasures in the process of IPv4 filtering to IPv6, such as NAT44, Dual-stack lite, NAT64, NAT46.
  • RRC Request For Comment
  • IPv4 to IPv4 conversion IPv4 and IPv6 interworking, NAT technology, and conversion of network addresses
  • stateful conversion is inevitable, that is, conversion equipment such as Carrier Grade NAT (CGN) must save conversion.
  • CGN Carrier Grade NAT
  • RFC6888 REQ-2 mentions that there must be the same address behavior.
  • RFC4787 REQ-2 mentions that there must be the same address behavior.
  • the present invention provides a method and apparatus for allocating network address translation NAT resources to at least solve the above problems.
  • a method for allocating a network address translation NAT resource includes: obtaining a current resource allocation situation of a public network address; and assigning a user corresponding to the current service according to the preset resource according to the current resource allocation situation
  • the NAT resource where the NAT resource includes: a public network address and/or a port that is required to be used by the current service.
  • the preset rule is determined according to at least one of the following parameters: a maximum number of private network addresses corresponding to the public network address, a number of ports allocated to the user corresponding to the current service, and a number of users corresponding to the public network address, The current usage of the port in the public network address and the corresponding relationship between the public network address and the user.
  • the NAT resource of the user corresponding to the current service is allocated according to the preset resource according to the current resource allocation situation, including: when the current usage of the port in the current public network address is lower than a preset threshold, A port is assigned to the user in the public network address.
  • the NAT resource of the current service is allocated according to the preset rule according to the resource allocation, including: determining, for each public network address, the port used by the user according to the number of ports allocated for the user corresponding to the current service. A set; in the set of ports, a port is allocated for the user in a sequence of port numbers from small to large.
  • the NAT resource of the user corresponding to the current service is allocated according to the preset rule according to the resource allocation, and the method further includes: assigning the same public network address to the user according to the principle of best effort.
  • the process of allocating the NAT resources of the user corresponding to the current service according to the preset rule according to the resource allocation manner further includes: prohibiting the user from assigning the well-known port of the application layer gateway ALG, and prohibiting the predefined service from being defined. The port used.
  • a device for allocating a network address translation NAT resource comprising: an obtaining module, configured to acquire a current resource allocation situation of a public network address; and an allocation module, configured to be configured according to the current resource The allocation is configured according to a preset rule to allocate a NAT resource of a user corresponding to the current service, where the NAT resource includes: a public network address and/or a port to be used by the current service.
  • the allocating module is configured to allocate a NAT resource of a user corresponding to the current service according to a predetermined rule determined by at least one of the following parameters: a maximum number of private network addresses corresponding to the public network address, and the current service Corresponding to the number of ports allocated by the user, the number of users corresponding to the public network address, the current usage of the port in the public network address, and the correspondence between the public network address and the user.
  • the allocating module is configured to allocate a port for the user in the current public network address when the current usage of the port in the current public network address is lower than a preset threshold.
  • the allocating module includes: a determining unit, configured to determine, for each public network address, a port set used by the user according to the number of ports allocated for the user corresponding to the current service; and the allocation unit is set to In the set of ports, ports are allocated for the user in a sequence of port numbers from small to large.
  • the technical solution for allocating the public network address and/or port of the current service according to the current allocation of the obtained NAT resources is solved by the present invention, and the technical problem of a perfect NAT resource allocation scheme in the related art is solved. , provides a better NAT resource allocation scheme, and the allocation method is simple and efficient.
  • FIG. 1 is a flowchart of a method for allocating a NAT resource according to an embodiment of the present invention
  • FIG. 2 is a schematic diagram of a resource usage state according to an embodiment of the present invention.
  • FIG. 3 is a schematic diagram of resource usage hopping according to an embodiment of the present invention.
  • FIG. 4 is a structural block diagram of a NAT resource allocation apparatus according to a preferred embodiment of the present invention.
  • FIG. 5 is a block diagram showing still another structure of a NAT resource allocating apparatus according to a preferred embodiment of the present invention.
  • FIG. 1 is a flowchart of a method for allocating a NAT resource according to an embodiment of the present invention. As shown in FIG. 1, the method includes the following steps:
  • Step S102 Obtain a current resource allocation situation of a public network address.
  • Step S104 Allocating a NAT resource of a user corresponding to the current service according to the current resource allocation situation according to the preset rule, where the NAT resource includes: a public network address and/or a port that is required to be used by the current service.
  • a technical solution for allocating the public network address and/or port of the current service according to the current allocation of the obtained NAT resources is adopted, and the technology of a complete NAT resource allocation scheme in the related art is solved.
  • the problem is that a preferred NAT resource allocation scheme is provided, and the allocation method is simple and efficient. That is, the present invention solves the problem that the NAT adversely affects applications such as P2P by standardizing the port assignment behavior of the NAT.
  • the preset rule is determined according to at least one of the following parameters: a maximum number of private network addresses corresponding to the public network address, a number of ports allocated to the user corresponding to the current service, and a number of users corresponding to the public network address. The current usage of the port in the network address and the correspondence between the public network address and the above users.
  • the NAT resource of the user corresponding to the current service is allocated according to the preset rule according to the current resource allocation, and the current usage of the port in the current public network address is lower than the preset.
  • the port is allocated to the user in the current public network address.
  • the preset threshold may refer to the port of the public network address being the least allocated, or the private network address currently using it is the least. This example does not limit this.
  • the public network address that is relatively idle (the current usage of the port is lower than the preset threshold) is used.
  • the traffic sharing is also uniform, and
  • the load of the public network address is basically balanced.
  • the use of relatively free public network addresses does not conflict with the sharing ratio, but can be combined.
  • a public network address is assigned, you can find the public network address allocation that matches the sharing ratio and is relatively idle.
  • the value of the share ratio can be enlarged to allow a public network address to be used by more users, allowing one user to use more ports.
  • the user who uses the address can no longer allocate the port from it, although other public network address ports still have many problems, the first stream flows from the user.
  • the current port or port block is assigned to it using a public network address that is relatively idle (extremely the most idle).
  • the embodiment of the present invention in order to make the provided NAT resource allocation manner more accurate and efficient, the embodiment of the present invention further provides a user sharing ratio and a per-user port number limitation, that is, how many users are allocated to a public network address, and How many public network address ports are used by users, the sharing ratio needs to be better planned by the relevant personnel: how many private network addresses correspond to the number of public network addresses, and how many public network ports each user allocates. That is to say, the sharing ratio allows a public network address to be occupied by a few users who use a small number of ports (even users who are not online), and restricts other users who use the port to use it again.
  • the number of ports of the public network address is compared.
  • the ports of the main protocol can be simply added up, for example, the number of port assignments of TCP and UDP is added up.
  • the PR divides the number of port blocks from the free IP, ensuring that the same user can be incrementally allocated from the IP to the port block.
  • AAA or NAT the user port-by-port block can follow this mode.
  • the NAT resource of the current service is allocated according to the preset rule according to the foregoing resource allocation, including: for each public network address, according to the number of ports allocated for the user corresponding to the current service. Determining a set of ports used by the above-mentioned users; in the above-mentioned port set, allocating ports for the above-mentioned users in a sequence of port numbers from small to large.
  • the distribution port is cycled in the order of the port number from small to large, that is, from the departure to the back, to the maximum value and then back. It solves the problem of not using the port just allocated, (of course, the port that is allocated is immediately reassigned after being recycled).
  • the basic idea is that the port remains: after the port is released, it can be re-allocated after a certain period of time.
  • the foregoing allocation port process may further include the following technical solution: the allocation of the PAT is performed according to the entire port range of the public network address, and the allocation is also performed within the priority port range.
  • the PR is divided into the port segments according to the public network address.
  • the general behavior of port assignment is to follow the port assignment. After a round trip, the previously assigned ports can be used again with confidence. In this way, the port that is allocated from the time of the arrival is the end of the port; the port is randomly allocated; for the port after the priority of the public network address, the last port is divided.
  • a further improvement of the foregoing technical solution in the embodiment of the present invention is that, according to the resource allocation situation, the NAT resource of the user corresponding to the current service is allocated according to the preset rule, and the method further includes: allocating the same public network address to the user according to the best effort principle. That is, it is preferable to assign the same public network address to the same user using best effort, and the port assignment of the same user address is allocated as much as possible on the same public network address.
  • the user address can be a private network IPv4 address.
  • the user address can be a soft-line address.
  • the best-effort advantage is to ensure that the application needs to use the same public address, and the application without this requirement.
  • the public network address port used by the user is allocated, you can continue to allocate it on another public network address. For applications that do not have the same address requirement, the service will not be blocked.
  • the user uses two or more public network addresses, the user's The public network address used for best effort allocation should be up to date. For example, if the user uses IP1, the IP1 port is exhausted and then IP2 is used. The port allocation of subsequent users should be as far as possible on IP2.
  • IP1 has already allocated some ports, applications using these ports may require the same address, but it is costly to continue trying to allocate the same port on IP1, and it is not possible to balance the application on IP2.
  • the process of allocating the NAT resources of the user corresponding to the current service according to the preset rule according to the foregoing resource allocation includes: prohibiting the allocation of the well-known port of the application layer gateway ALG for the user, and prohibiting the predefined service from being defined.
  • the port used that is, the application layer gateway (ALG) port that does not allocate a public network address in the embodiment of the present invention, is not allowed to be allocated to the service represented by the non-known port.
  • the port 21 of the public network address, except the static mapping designation cannot be dynamically allocated to unknown services.
  • such a technical solution can effectively prevent the packets of the port from being used incorrectly, which may be the NAT device itself.
  • the prior art NAT does not suggest how resources should be allocated, and the resource allocation behavior is likely to be detrimental to the service.
  • the present invention provides a resource allocation method, which allows the same user to be assigned to the same public network address as much as possible. Therefore, the problem caused by the allocation of services such as P2P to different public network addresses is better solved.
  • the first stream of the user flows, and the address of the most idle port is divided; as the number of users increases, the traffic increases, and the public network address port is used more evenly, and a public network address does not appear prematurely.
  • the cross box represents the portion that has been used; in Figure 3, when the public network address used by the user is exhausted, the new traffic is allocated. Another public network address port, the subsequent traffic also uses the new public network address cross box to represent the used part.
  • the hardware part consists of a NAT device and 11 terminals with network communication functions.
  • Terminal 1 to terminal 10 are on the intranet;
  • terminal 11 is on the external network as a server.
  • Step 1 Configure NAT on the CGN device
  • Section 1 100.0.0.2 100.0.0.3
  • the second step the terminal 1 to the terminal 10 send packets to the server by fei-0/1/0/1, and each terminal sends one packet to observe the resource allocation.
  • the number of port assignments for public network addresses 100.0.0.2 and 100.0.0.3 should be basically the same.
  • the third step the terminal 1 to the terminal 10 send packets to the server by fei-0/1/0/1, and each terminal sends 100 packets to observe the resource allocation.
  • the number of port assignments for public network addresses 100.0.0.2 and 100.0.0.3 should be basically the same.
  • the fourth step the terminal 1 to the terminal 10 send packets to the server by fei-0/1/0/1, and each terminal sends 10000 packets to observe the resource allocation.
  • the number of port assignments for public network addresses 100.0.0.2 and 100.0.0.3 should be basically the same.
  • the hardware part consists of a NAT device and 11 terminals with network communication functions.
  • Terminal 1 to terminal 10 are on the intranet;
  • terminal 11 is on the external network as a server.
  • Step 1 Configure NAT on the CGN device
  • Section 1 100.0.0.2 100.0.0.3
  • the second step the terminal 1 to the terminal 10 send packets to the server by fei-0/1/0/1, and each terminal sends 1000 packets to observe the resource allocation.
  • the number of port assignments for public network addresses 100.0.0.2 and 100.0.0.3 should be basically the same.
  • Step 3 Select two terminals that use the public network address 100.0.0.2, such as terminal X and terminal Y.
  • Terminal X sends 60,000 packets to the server from fei-0/1/0/1 to observe the resource allocation.
  • the number of port allocations for the public network address 100.0.0.2 should be exhausted.
  • Step 4 Terminal Y sends 30,000 packets to the server from fei-0/1/0/1 to observe the resource allocation.
  • the number of port assignments of the public network address 100.0.0.2 is exhausted, and subsequent port assignments are allocated on 100.0.0.3 (even if 100.0.0.2 may release the port due to aging).
  • the hardware part consists of one NAT device and 17 terminals with network communication functions.
  • Terminal 1 to terminal 16 are on the intranet;
  • terminal 17 is on the external network as a server.
  • Step 1 Configure NAT on the CGN device
  • Section 1 100.0.0.2 100.0.0.3
  • the second step the terminal 1 to the terminal 16 send packets to the server by fei-0/1/0/1, and each terminal sends 1000 packets to observe the resource allocation.
  • the number of port block allocations for public network addresses 100.0.0.2 and 100.0.0.3 should be basically the same.
  • Step 3 Select a terminal that uses the public network address 100.0.0.2, such as terminal X.
  • Terminal X sends 10,000 packets to the server from fei-0/1/0/1 to observe the resource allocation.
  • the new port block of terminal X can also be allocated on the same public network address 100.0.0.2.
  • FIG. 4 is a structural block diagram of a NAT resource allocation apparatus according to an embodiment of the present invention. As shown in Figure 4, the device comprises:
  • the obtaining module 40 is configured to obtain a current resource allocation status of the public network address
  • the distribution module 42 is connected to the obtaining module 40, and is configured to allocate, according to the current resource allocation situation, a NAT resource of a user corresponding to the current service according to a preset rule, where the NAT resource includes: a public network address that is required to be used by the current service, and / or port.
  • the allocating module 42 is configured to allocate, according to a predetermined rule determined by at least one of the following parameters, a NAT resource of a user corresponding to the current service: a maximum number of private network addresses corresponding to the public network address, and an allocation for the user corresponding to the current service. Number of ports, number of users corresponding to the public network address, current usage of the port in the public network address, and the corresponding relationship between the public network address and the user.
  • the allocating module 42 is further configured to allocate a port for the user in the current public network address when the current usage of the port in the current public network address is lower than a preset threshold.
  • the allocating module 42 includes: a determining unit 420, configured to set, according to each public network address, the number of ports allocated according to the user corresponding to the current service. The port set used by the user is determined; the allocating unit 422 is connected to the determining unit 420, and is configured to allocate a port to the user in the order of the port number from small to large in the port set.
  • each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.
  • the embodiments of the present invention achieve the following beneficial effects: the foregoing technical solution of the embodiment of the present invention increases the ability of the router to be connected through any management network port, thereby making the management of the router more flexible and achieving a more flexible For a reliable effect, the user experience is further enhanced.
  • modules or steps of the present invention described above can be implemented by a general-purpose computing device that can be centralized on a single computing device or distributed across a network of multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device such that they may be stored in the storage device by the computing device and, in some cases, may be different from the order herein.
  • the steps shown or described are performed, or they are separately fabricated into individual integrated circuit modules, or a plurality of modules or steps thereof are fabricated as a single integrated circuit module.
  • the invention is not limited to any specific combination of hardware and software.
  • a technical solution for allocating a public network address and/or a port of a current service according to a current allocation situation of the obtained NAT resource is adopted, which solves a perfect technology in the related art.
  • the technical problem of the NAT resource allocation scheme provides a better NAT resource allocation scheme, and the allocation method is simple and efficient.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本发明提供了一种网络地址转换NAT资源的分配方法及装置，其中，所述分配方法包括：获取公网地址的当前资源分配情况；根据所述当前资源分配情况按照预设规则分配当前业务所对应用户的NAT资源，其中，所述NAT资源包括：所述当前业务所需要使用的公网地址和/或端口。采用本发明提供的上述技术方案，解决了相关技术中一种完善的NAT资源分配方案的技术问题，提供了一种较优的NAT资源分配方案，并且分配方式简单且高效。

Description

网络地址转换NAT资源的分配方法及装置 技术领域
本发明涉及通信领域，更具体地说，涉及一种网络地址转换(Network Address Translation，简称为NAT)资源的分配方法及装置。
背景技术
目前，随着网络业务的快速发展，客户对业务的质量提出了越来越高的要求。NAT业务是目前解决网际协议第4版(Internet Protocol version 4，简称为IPv4)地址缺乏的一种基本业务。完善它的功能，可以有效地平滑过渡到网际协议第6版(Internet Protocol version 6，简称为IPv6)阶段。
随着IPv4地址耗尽进程的加快，NAT技术催生了很多的认证请求(Request For Comment，简称为RFC)草案。主要集中在IPv4过滤到IPv6过程中的各种对策，如NAT44、Dual-stack lite、NAT64、NAT46。
无论是IPv4到IPv4转换，还是IPv4和IPv6互转，NAT技术，转换网络地址，都不可避免存在有状态转换，也就是转换设备如运营商级NAT(Carrier Grade NAT，简称为CGN)必须保存转换前后的信息。
RFC6888 REQ-2提到必须要有相同地址行为。RFC4787 REQ-2提到必须要有相同地址行为。
在端口地址转换(Port address translation，简称为PAT)和端口分配(Port-range，简称为PR)分配中，如何给用户分配公网地址及相应端口，相关技术中目前还没有统一规范。需要相同公网地址的业务在现网中大量存在，客户端服务器类型的应用存在(比如文件传输协议(File Transfer Protocol，简称为FTP)，控制链接和数据链接需要使用相同的公网地址)，网上支付存在，个人对个人(Person to Person，简称为P2P)当然也存在。不同的分配行为，对这类业务的影响重大。相对较差的资源分配行为，分配完一个公网地址的所有端口后才会分配另一个公网地址，这样会导致前一个公网地址端口耗尽，相同地址行为再也无法保障。
针对相关技术中尚未提出一种完善的NAT资源分配方案的问题，目前尚未提出有效的解决方案。
发明内容
本发明提供了一种网络地址转换NAT资源的分配方法及装置，以至少解决上述问题。
根据本发明的一个实施例，提供了一种网络地址转换NAT资源的分配方法，包括：获取公网地址的当前资源分配情况；根据所述当前资源分配情况按照预设规则分配当前业务所对应用户的NAT资源，其中，所述NAT资源包括：所述当前业务所需要使用的公网地址和/或端口。
优选地，所述预设规则根据以下至少之一参数确定：公网地址所对应的最大私网地址数量、为所述当前业务所对应用户分配的端口数量、公网地址所对应的用户数量、公网地址中端口的当前使用情况、公网地址与所述用户的对应关系。
优选地，根据所述当前资源分配情况按照预设规则分配当前业务所对应用户的NAT资源，包括：在当前所述公网地址中端口的当前使用情况低于预设阈值时，在当前所述公网地址中为所述用户分配端口。
优选地，根据所述资源分配情况按照预设规则分配当前业务的NAT资源，包括：对于每个公网地址，根据为所述当前业务所对应用户分配的端口数量确定所述用户所使用的端口集合；在所述端口集合中，按照端口号从小到大的顺序循环为所述用户分配端口。
优选地，根据所述资源分配情况按照预设规则分配当前业务所对应用户的NAT资源，还包括：按照尽力而为原则为所述用户分配同一个公网地址。
优选地，在根据所述资源分配情况按照预设规则分配当前业务所对应用户的NAT资源的过程中，还包括：禁止为所述用户分配应用层网关ALG知名端口，以及禁止预先定义被指定业务使用的端口。
根据本发明的另一个实施例，还提供了一种网络地址转换NAT资源的分配装置，包括：获取模块，设置为获取公网地址的当前资源分配情况；分配模块，设置为根据所述当前资源分配情况按照预设规则分配当前业务所对应用户的NAT资源，其中，所述NAT资源包括：所述当前业务所需要使用的公网地址和/或端口。
优选地，所述分配模块设置为根据以下至少之一参数确定的预定规则分配当前业务所对应用户的NAT资源：公网地址所对应的最大私网地址数量、为所述当前业务所 对应用户分配的端口数量、公网地址所对应的用户数量、公网地址中端口的当前使用情况、公网地址与所述用户的对应关系。
优选地，所述分配模块，设置为在当前所述公网地址中端口的当前使用情况低于预设阈值时，在当前所述公网地址中为所述用户分配端口。
优选地，所述分配模块，包括：确定单元，设置为对于每个公网地址，根据为所述当前业务所对应用户分配的端口数量确定所述用户所使用的端口集合；分配单元，设置为在所述端口集合中，按照端口号从小到大的顺序循环为所述用户分配端口。
通过本发明，采用在根据获取到的NAT资源的当前分配情况，对当前业务的公网地址和/或端口进行分配的技术方案，解决了相关技术中一种完善的NAT资源分配方案的技术问题，提供了一种较优的NAT资源分配方案，并且分配方式简单且高效。
附图说明
此处所说明的附图用来提供对本发明的进一步理解，构成本申请的一部分，本发明的示意性实施例及其说明用于解释本发明，并不构成对本发明的不当限定。在附图中：
图1为根据本发明实施例的NAT资源的分配方法的流程图；
图2为根据本发明实施例的资源使用状态示意图；
图3为根据本发明实施例的资源使用跳变示意图；
图4为根据本发明优选实施例的NAT资源的分配装置的结构框图；
图5为根据本发明优选实施例的NAT资源的分配装置的又一结构框图。
具体实施方式
下文中将参考附图并结合实施例来详细说明本发明。需要说明的是，在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互组合。
本发明的其它特征和优点将在随后的说明书中阐述，并且，部分地从说明书中变得显而易见，或者通过实施本发明而了解。本发明的目的和其他优点可通过在所写的说明书、权利要求书、以及附图中所特别指出的结构来实现和获得。
为了使本技术领域的人员更好地理解本发明方案，下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本发明一部分的实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都应当属于本发明保护的范围。
为了解决上述技术问题，本发明实施例提供了一种NAT资源的分配方法，图1为根据本发明实施例的NAT资源的分配方法的流程图，如图1所示，该方法包括如下步骤：
步骤S102：获取公网地址的当前资源分配情况；
步骤S104：根据上述当前资源分配情况按照预设规则分配当前业务所对应用户的NAT资源，其中，上述NAT资源包括：上述当前业务所需要使用的公网地址和/或端口。
通过上述各个步骤，采用在根据获取到的NAT资源的当前分配情况，对当前业务的公网地址和/或端口进行分配的技术方案，解决了相关技术中一种完善的NAT资源分配方案的技术问题，提供了一种较优的NAT资源分配方案，并且分配方式简单且高效，即本发明通过规范NAT的端口分配行为，来解决NAT对P2P等应用带来的不利影响问题。
可选地，上述预设规则根据以下至少之一参数确定：公网地址所对应的最大私网地址数量、为上述当前业务所对应用户分配的端口数量、公网地址所对应的用户数量、公网地址中端口的当前使用情况、公网地址与上述用户的对应关系。
在本发明实施例的一个可选示例中，根据上述当前资源分配情况按照预设规则分配当前业务所对应用户的NAT资源，包括：在当前上述公网地址中端口的当前使用情况低于预设阈值时，在当前上述公网地址中为上述用户分配端口，在具体实施过程中，预设阈值可以指公网地址的端口当前分配出去最少，或当前使用它的私网地址最少，本发明实施例对此不作限定。
而采用上述技术方案，使用比较空闲(端口的当前使用情况低于预设阈值)的公网地址，在分布式下，当公网地址分散在不同CPU上，也有助于流量分担均匀，并且，在用户数、公网地址数一定情况下，公网地址的负荷基本平衡。
此外，使用比较空闲的公网地址，并不和共享比例冲突，相反可以结合起来。分配公网地址时，可以查找符合共享比例，且比较空闲的公网地址分配。共享比例的值可以放大些，允许一个公网地址被较多用户使用，允许一个用户使用较多端口。
即在具体实施过程中，为了解决个别公网地址过早耗尽端口，使用该地址的用户再也无法从它分配端口，虽然其它公网地址端口还很多的问题，在用户第一条流过来时，当前端口或端口块使用比较空闲(极端情况是最空闲)的公网地址分配给它。在本发明实施例中，为了使得提供的NAT资源分配方式更加准确高效，本发明实施例还提供了用户共享比例和每用户端口数限制，即限定一个公网地址最多分配给多少个用户，一个用户最多使用多少公网地址端口，共享比例需要相关人员进行较好的规划：多少公网地址对应多少私网地址，每个用户大概分配多少公网端口。也就是说共享比例允许一个公网地址被几个使用端口不多的用户占据着(甚至是没上线的用户)，限制了其它使用端口过多用户再使用它。
需要说明的是，PAT技术中分配比较的是该公网地址的端口数，对于按协议分配的端口的，可以将主要协议的端口简单加起来比较，比如TCP和UDP的端口分配数加起来。PR从端口块数比较空闲的IP中分块，保证同一用户后续能再从该IP中增量分配到端口块。在AAA或NAT上，用户分端口块可遵循该方式。
在本发明实施例的另一个可选实例中，根据上述资源分配情况按照预设规则分配当前业务的NAT资源，包括：对于每个公网地址，根据为上述当前业务所对应用户分配的端口数量确定上述用户所使用的端口集合；在上述端口集合中，按照端口号从小到大的顺序循环为上述用户分配端口。
如上本发明实施例提供的技术方案，分配端口按端口号从小到大的顺序循环，即按从前往后分，到最大值后再迂回。其解决了尽量不使用刚分配出去的端口，(当然也包括分配出去的端口回收后立即被再分配)。其基本思想是端口保持：释放端口后保持一定时间后才能再分配。
当然，上述分配端口过程还可以包含如下技术方案：PAT的分配按公网地址的整个端口范围从前往后分，优先端口范围内分配也行。PR按公网地址的端口段从前往后分；从前往后分配遵循端口分配的一般行为，较大程度保证一个迂回后，前面分配过的端口可以放心再次使用；从前往后分配，可以结合端口保持，这种方式可以是从前往后分配的端口都是端口保持结束的；对端口随机分配；对于优先分公网地址后一段端口，最后分前一段端口。
本发明实施例对上述技术方案的进一步改进在于，根据上述资源分配情况按照预设规则分配当前业务所对应用户的NAT资源，还包括：按照尽力而为原则为上述用户分配同一个公网地址，即对同一用户优选使用尽力而为分配同一公网地址，同一用户地址的端口分配尽量分配在同一公网地址上。对于Dual-stack lite，当软线中私网IPv4地址过多时，用户地址可以是私网IPv4地址；当软线中私网IPv4地址比较少时，用户地址可以是软线地址。
使用尽力而为的好处是既保证了使用同一公网地址的应用需求，又兼顾了没有这一需求的应用。当用户使用的公网地址端口分配完，可以在另一个公网地址上继续分配，对于没有相同地址需求的应用，业务不会被阻塞；当用户使用2个或以上公网地址时，用户的尽力而为分配所使用的公网地址应当是最新的。比如用户使用IP1，IP1端口耗尽后再使用IP2，后续用户的端口分配应当尽量在IP2上。虽然IP1已经分配了一些端口，使用这些端口的应用可能要求相同地址，但是在IP1上继续尝试分配相同端口的代价很大，也无法兼顾IP2上的应用。
在实际应用中，在根据上述资源分配情况按照预设规则分配当前业务所对应用户的NAT资源的过程中，还包括：禁止为上述用户分配应用层网关ALG知名端口，以及禁止预先定义被指定业务使用的端口，即本发明实施例不分配公网地址的应用层网关(Application layer gateway，简称为ALG)知名端口，不让它分配给非知名端口所代表的业务。比如公网地址21号端口，除了静态映射指定，不能动态分配给不知名业务，而采用这样的技术方案能够有效防止该端口的报文被错误使用，有可能就是NAT设备本身。
综上所述，现有技术NAT没有建议资源应当怎么分配，资源的分配行为很可能不利于业务，而本发明提供了一种资源分配方法，可以让同一用户尽可能分配到同一公网地址，因此较好地解决了P2P等业务分配到不同公网地址所带来的问题。提供了资源分配的一些最佳实践建议。
为了更好的理解上述在用户数、流量增加情况下公网地址使用情况以及用户所使用公网地址变化后的再分配情况，以下结合实施例进行说明：
下面结合图2、图3对技术方案的实施作进一步的详细描述：
需要说明的是，图2中：用户第1条流过来，分最空闲端口的地址；随着用户数目增加，流量增加，公网地址端口使用较均匀，不会出现某个公网地址过早耗尽，交叉框代表已经使用(used)的部分；图3中当用户使用的公网地址耗尽，新流量分配 另一个公网地址端口，后续流量也使用新的公网地址交叉框代表已经使用(used)的部分.
硬件部分由一台NAT设备、11台具有网络通信功能的终端组成。终端1到终端10在内网；终端11在外网，作为服务器。
软件部分的处理步骤如下：
第一步：在CGN设备上进行NAT的相关配置
(1)配置入接口，比如：
interface fei-0/1/0/1
ip nat inside
ip address 172.0.0.1 255.255.255.0
(2)配置NAT，比如：
cgn 1
cgn-pool 1
section 1 100.0.0.2 100.0.0.3
ip nat inside source list 1 pool 1 overload
第二步：终端1到终端10由fei-0/1/0/1向服务器发送报文，每个终端发送1个报文，观察资源分配情况。公网地址100.0.0.2和100.0.0.3的端口分配数应当基本相同。
第三步：终端1到终端10由fei-0/1/0/1向服务器发送报文，每个终端发送100个报文，观察资源分配情况。公网地址100.0.0.2和100.0.0.3的端口分配数应当基本相同。
第四步：终端1到终端10由fei-0/1/0/1向服务器发送报文，每个终端发送10000个报文，观察资源分配情况。公网地址100.0.0.2和100.0.0.3的端口分配数应当基本相同。
实施例2：
下面结合图2、图3对技术方案的实施作进一步的详细描述：
硬件部分由一台NAT设备、11台具有网络通信功能的终端组成。终端1到终端10在内网；终端11在外网，作为服务器。
软件部分的处理步骤如下：
第一步：在CGN设备上进行NAT的相关配置
(1)配置入接口，比如：
interface fei-0/1/0/1
ip nat inside
ip address 172.0.0.1 255.255.255.0
(2)配置NAT，比如：
cgn 1
cgn-pool 1
section 1 100.0.0.2 100.0.0.3
ip nat inside source list 1 pool 1 overload
第二步：终端1到终端10由fei-0/1/0/1向服务器发送报文，每个终端发送1000个报文，观察资源分配情况。公网地址100.0.0.2和100.0.0.3的端口分配数应当基本相同。
第三步：挑选使用公网地址100.0.0.2的2个终端，比如终端X和终端Y。终端X由fei-0/1/0/1向服务器发送60000个报文，观察资源分配情况。公网地址100.0.0.2的端口分配数应当快耗尽。
第四步：终端Y由fei-0/1/0/1向服务器发送30000个报文，观察资源分配情况。公网地址100.0.0.2的端口分配数耗尽，后续端口分配都在100.0.0.3上分配(即使100.0.0.2可能由于老化释放了端口)。
实施例3：
下面结合图2、图3对技术方案的实施作进一步的详细描述：
硬件部分由一台NAT设备、17台具有网络通信功能的终端组成。终端1到终端16在内网；终端17在外网，作为服务器。
软件部分的处理步骤如下：
第一步：在CGN设备上进行NAT的相关配置
(1)配置入接口，比如：
interface fei-0/1/0/1
ip nat inside
ip address 172.0.0.1 255.255.255.0
(2)配置NAT，比如：
cgn 1
cgn-pool 1
section 1 100.0.0.2 100.0.0.3
port-range size 2048
ip nat inside source list 1 pool 1 overload
第二步：终端1到终端16由fei-0/1/0/1向服务器发送报文，每个终端发送1000个报文，观察资源分配情况。公网地址100.0.0.2和100.0.0.3的端口块分配数应当基本相同。
第三步：挑选使用公网地址100.0.0.2的1个终端，比如终端X。终端X由fei-0/1/0/1向服务器发送10000个报文，观察资源分配情况。终端X的新端口块还能在同一公网地址100.0.0.2上分配到。
在本实施例中还提供了一种NAT资源的分配装置，用于实现上述实施例及优选实施方式，已经进行过说明的不再赘述，下面对该装置中涉及到的模块进行说明。如以下所使用的，术语“模块”可以实现预定功能的软件和/或硬件的组合。尽管以下实施例所描述的装置较佳地以软件来实现，但是硬件，或者软件和硬件的组合的实现也是可能并被构想的。图4为根据本发明实施例的NAT资源的分配装置的结构框图。如图4所示，该装置包括：
获取模块40，设置为获取公网地址的当前资源分配情况；
分配模块42，与获取模块40连接，设置为根据上述当前资源分配情况按照预设规则分配当前业务所对应用户的NAT资源，其中，上述NAT资源包括：上述当前业务所需要使用的公网地址和/或端口。
通过上述各个步骤的综合作用，采用在根据获取到的NAT资源的当前分配情况，对当前业务的公网地址和/或端口进行分配的技术方案，解决了相关技术中一种完善的NAT资源分配方案的技术问题，提供了一种较优的NAT资源分配方案，并且分配方式简单且高效。
可选地，分配模块42设置为根据以下至少之一参数确定的预定规则分配当前业务所对应用户的NAT资源：公网地址所对应的最大私网地址数量、为上述当前业务所对应用户分配的端口数量、公网地址所对应的用户数量、公网地址中端口的当前使用情况、公网地址与上述用户的对应关系。
并且，分配模块42还设置为在当前上述公网地址中端口的当前使用情况低于预设阈值时，在当前上述公网地址中为上述用户分配端口。
本发明实施例对上述技术方案的进一步改进在于，如图5所示，分配模块42，包括：确定单元420，设置为对于每个公网地址，根据为上述当前业务所对应用户分配的端口数量确定上述用户所使用的端口集合；分配单元422，与确定单元420连接，设置为在上述端口集合中，按照端口号从小到大的顺序循环为上述用户分配端口。
另外，在本发明各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
需要说明的是，本发明的说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的对象在适当情况下可以互换，以便这里描述的本发明的实施例能够以除了在这里图示或描述的那些以外的顺序实施。此外，术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含，例如，包含了一系列步骤或单元的过程、方法、系统、产品或设备不必限于清楚地列出的那些步骤或单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或单元。
综上所述，本发明实施例实现了以下有益效果：本发明实施例的上述技术方案，通过增加了通过任意管理网口可以连接路由器的能力，使对路由器的管理更为灵活，达到了更为可靠的效果，进一步提高了用户使用的体验。
显然，本领域的技术人员应该明白，上述的本发明的各模块或各步骤可以用通用的计算装置来实现，它们可以集中在单个的计算装置上，或者分布在多个计算装置所组成的网络上，可选地，它们可以用计算装置可执行的程序代码来实现，从而，可以将它们存储在存储装置中由计算装置来执行，并且在某些情况下，可以以不同于此处的顺序执行所示出或描述的步骤，或者将它们分别制作成各个集成电路模块，或者将它们中的多个模块或步骤制作成单个集成电路模块来实现。这样，本发明不限制于任何特定的硬件和软件结合。
以上仅为本发明的优选实施例而已，并不用于限制本发明，对于本领域的技术人员来说，本发明可以有各种更改和变化。凡在本发明的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本发明的保护范围之内。
工业实用性
基于本发明实施例提供的上述技术方案，采用在根据获取到的NAT资源的当前分配情况，对当前业务的公网地址和/或端口进行分配的技术方案，解决了相关技术中一种完善的NAT资源分配方案的技术问题，提供了一种较优的NAT资源分配方案，并且分配方式简单且高效。

Claims (10)

  1. 一种网络地址转换NAT资源的分配方法，包括：
    获取公网地址的当前资源分配情况；
    根据所述当前资源分配情况按照预设规则分配当前业务所对应用户的NAT资源，其中，所述NAT资源包括：所述当前业务所需要使用的公网地址和/或端口。
  2. 根据权利要求1所述的方法，其中，所述预设规则根据以下至少之一参数确定：
    公网地址所对应的最大私网地址数量、为所述当前业务所对应用户分配的端口数量、公网地址所对应的用户数量、公网地址中端口的当前使用情况、公网地址与所述用户的对应关系。
  3. 根据权利要求1所述的方法，其中，根据所述当前资源分配情况按照预设规则分配当前业务所对应用户的NAT资源，包括：
    在当前所述公网地址中端口的当前使用情况低于预设阈值时，在当前所述公网地址中为所述用户分配端口。
  4. 根据权利要求1所述的方法，其中，根据所述资源分配情况按照预设规则分配当前业务的NAT资源，包括：
    对于每个公网地址，根据为所述当前业务所对应用户分配的端口数量确定所述用户所使用的端口集合；
    在所述端口集合中，按照端口号从小到大的顺序循环为所述用户分配端口。
  5. 根据权利要求1所述的方法，其中，根据所述资源分配情况按照预设规则分配当前业务所对应用户的NAT资源，还包括：
    按照尽力而为原则为所述用户分配同一个公网地址。
  6. 根据权利要求1-5任一项所述的方法，其中，在根据所述资源分配情况按照预设规则分配当前业务所对应用户的NAT资源的过程中，还包括：禁止为所述用户分配应用层网关ALG知名端口，以及禁止预先定义被指定业务使用的端口。
  7. 一种网络地址转换NAT资源的分配装置，包括：
    获取模块，设置为获取公网地址的当前资源分配情况；
    分配模块，设置为根据所述当前资源分配情况按照预设规则分配当前业务所对应用户的NAT资源，其中，所述NAT资源包括：所述当前业务所需要使用的公网地址和/或端口。
  8. 根据权利要求7所述的装置，其中，所述分配模块设置为根据以下至少之一参数确定的预定规则分配当前业务所对应用户的NAT资源：公网地址所对应的最大私网地址数量、为所述当前业务所对应用户分配的端口数量、公网地址所对应的用户数量、公网地址中端口的当前使用情况、公网地址与所述用户的对应关系。
  9. 根据权利要求7所述的装置，其中，所述分配模块，设置为在当前所述公网地址中端口的当前使用情况低于预设阈值时，在当前所述公网地址中为所述用户分配端口。
  10. 根据权利要求7所述的装置，其中，所述分配模块，包括：
    确定单元，设置为对于每个公网地址，根据为所述当前业务所对应用户分配的端口数量确定所述用户所使用的端口集合；
    分配单元，设置为在所述端口集合中，按照端口号从小到大的顺序循环为所述用户分配端口。
PCT/CN2014/094142 2014-09-17 2014-12-17 网络地址转换nat资源的分配方法及装置 WO2015131612A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
EP14884458.2A EP3197119A4 (en) 2014-09-17 2014-12-17 Method and device for allocating network address translation (nat) resources

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201410475189.X 2014-09-17
CN201410475189.XA CN105491171A (zh) 2014-09-17 2014-09-17 网络地址转换nat资源的分配方法及装置

Publications (1)

Publication Number Publication Date
WO2015131612A1 true WO2015131612A1 (zh) 2015-09-11

Family

ID=54054484

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2014/094142 WO2015131612A1 (zh) 2014-09-17 2014-12-17 网络地址转换nat资源的分配方法及装置

Country Status (3)

Country Link
EP (1) EP3197119A4 (zh)
CN (1) CN105491171A (zh)
WO (1) WO2015131612A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112688886A (zh) * 2020-12-21 2021-04-20 中国联合网络通信集团有限公司 一种确定方法和设备
CN113141420A (zh) * 2021-05-17 2021-07-20 中国信息安全测评中心 网络地址变更方法、装置以及设备

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105939404B (zh) * 2016-05-04 2019-02-19 杭州迪普科技股份有限公司 Nat资源的获取方法及装置
CN106506724B (zh) * 2016-11-23 2020-10-30 新华三技术有限公司 一种分配端口块的方法及装置
CN107547689B (zh) * 2017-09-20 2020-12-04 新华三技术有限公司 一种运营商级的网络地址转换cgn方法和装置
CN108924272B (zh) * 2018-06-26 2021-09-17 新华三信息安全技术有限公司 一种端口资源分配方法及装置
CN109639580B (zh) * 2019-02-03 2021-05-14 新华三信息安全技术有限公司 一种报文转发方法及装置

Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1777194A (zh) * 2005-12-16 2006-05-24 中国科学院计算技术研究所 Pat模式下支持多会话应用层协议的网络地址转换方法

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20070162968A1 (en) * 2005-12-30 2007-07-12 Andrew Ferreira Rule-based network address translation
US9083587B2 (en) * 2009-08-21 2015-07-14 Cisco Technology, Inc. Port chunk allocation in network address translation

Patent Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1777194A (zh) * 2005-12-16 2006-05-24 中国科学院计算技术研究所 Pat模式下支持多会话应用层协议的网络地址转换方法

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112688886A (zh) * 2020-12-21 2021-04-20 中国联合网络通信集团有限公司 一种确定方法和设备
CN113141420A (zh) * 2021-05-17 2021-07-20 中国信息安全测评中心 网络地址变更方法、装置以及设备
CN113141420B (zh) * 2021-05-17 2022-04-26 中国信息安全测评中心 网络地址变更方法、装置以及设备

Also Published As

Publication number Publication date
CN105491171A (zh) 2016-04-13
EP3197119A1 (en) 2017-07-26
EP3197119A4 (en) 2017-07-26

Similar Documents

Publication Publication Date Title
WO2015131612A1 (zh) 网络地址转换nat资源的分配方法及装置
US10652202B2 (en) Network address translating router for mobile networking
US9641450B1 (en) Resource placement templates for virtual networks
CN102664972B (zh) 一种虚拟网络中地址映射方法和装置
US9876756B2 (en) Network access method and device for equipment
US9917729B2 (en) Methods, systems, and computer readable media for multi-layer orchestration in software defined networks (SDNs)
CN111770028A (zh) 用于计算机网络的方法和网络设备
CN101729500B (zh) 一种ip会话标识方法、装置和系统
KR101320962B1 (ko) 네트워크 어드레스 변환을 위한 관리 방법 및 관리 장치
CN107046506B (zh) 一种报文处理方法、流分类器和业务功能实例
US20070078955A1 (en) Service quality management in packet networks
EP3111596A1 (en) Dynamic allocation of network bandwidth
CN103797774A (zh) 一种网络地址转换设备及方法
CN106534394B (zh) 用于管理端口的设备、系统和方法
WO2014114097A1 (zh) 一种负载分担方法及装置
CN107809386B (zh) Ip地址转换方法、路由设备和通信系统
US20140351448A1 (en) Effective network identity pairing
WO2014036885A1 (zh) 一种实现地址共享的方法、装置和系统
US20200045012A1 (en) Resolving Uplink Interface Overlap for a Network Switching Device
US20180262389A1 (en) Advertising method and system in network functions virtualization environment
CA2974353A1 (en) System and method for identifying a communication for routing purposes using internet protocol addresses that are allocated by and shared amongst internet service provider networks
US20160149807A1 (en) System for the routing of data to computer networks
CN113014680B (zh) 一种宽带接入的方法、装置、设备和存储介质
US20230231815A1 (en) Multi-tenant resource management in a gateway
CN105357332B (zh) 一种网络地址转换方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 14884458

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

REEP Request for entry into the european phase

Ref document number: 2014884458

Country of ref document: EP

WWE Wipo information: entry into national phase

Ref document number: 2014884458

Country of ref document: EP