WO2015143849A1

WO2015143849A1 - Vpn packet processing method and apparatus and storage medium

Info

Publication number: WO2015143849A1
Application number: PCT/CN2014/086667
Authority: WO
Inventors: 张宝亚
Original assignee: 中兴通讯股份有限公司
Priority date: 2014-03-24
Filing date: 2014-09-16
Publication date: 2015-10-01
Also published as: CN104954255B; CN104954255A

Abstract

Disclosed is a VPN packet processing method. The method comprises: for any PW interface or AC interface, separately configuring an access VSI and a forwarding VSI; and for a designated interface, performing access according to the access VSI and then performing forwarding according to the forwarding VSI. Also correspondingly disclosed is a VPN packet processing apparatus.

Description

VPN packet processing method and device, and storage medium

Technical field

The invention relates to the field of multi-protocol label switching (MPLS) virtual private network (VPN) packet communication technology, and in particular, to a VPN message processing method and device, and a storage medium.

Background technique

Virtual Private LAN Service (VPLS) is a widely used Layer 2 Virtual Private Networks (L2VPN) technology, which is commonly used for enterprise users' VPN interconnection. VPLS maintains a forwarding table for the different VPN users by the edge router (PE, Provider Edge) through the Virtual Switch Instance (VSI). The forwarding tables of the VSIs are independent of each other, thus ensuring service isolation and ensuring services. Private property.

VPLS implements the forwarding of services between different VPN users through a VSI. In the VPLS, some nodes cannot directly communicate with each other. When the VSI is queried between nodes, for example, during broadcast processing, the VPLS must exist. Many invalid broadcast copies, so not only waste system bandwidth, causing internal circuit blockage, but also reduce the forwarding performance of VPLS.

Summary of the invention

The technical problem to be solved by the present invention is to provide a VPN message processing method and device, and a storage medium.

To achieve the above objective, the technical solution of the embodiment of the present invention is implemented as follows:

A packet processing method for a virtual private network VPN, the method includes:

For any PW interface or AC interface, the VSI and the forwarding VSI are separately configured.

For the specified interface, the access processing is performed according to the access VSI, and then the forwarding process is performed according to the forwarding VSI.

In the foregoing solution, for the point-to-multipoint E-TREE service, the split configuration is configured to access the VSI and the VSI for forwarding, including:

The access VSI is bound to all members of the current E-TREE service, and includes index information of all members;

The forwarding VSI includes index information of the middle member.

In the foregoing solution, for the E-TREE service, the split configuration is configured to access the VSI and the VSI for forwarding, including:

The broadcast table of the access VSI includes broadcast information of all members of the E-TREE service; and the VSI for forwarding includes broadcast information of all the root members of the E-TREE service;

The MAC address of all members in the E-TREE service learns the access VSI; for the Root member in the E-TREE service, the MAC address that has learned to access the VSI is synchronized to the forwarding VSI.

In the foregoing solution, when the two or more VPNs communicate with each other, the split configuration is configured to access the VSI and the VSI for forwarding, including:

The access VSIs are two or more, each corresponding to each VPN that is inter-VPN-connected, and each access VSI includes common member index information that can only communicate with each other in the VPN to which it belongs, and a super-member index that can communicate with each other across VPNs. information;

The forwarding VSI includes member index information of all access VSIs.

All members of each access VSI are written into the broadcast table of the VSI for forwarding; each access VSI writes members of the VSI and other super-members of the access VSI into its own broadcast table;

The learned MAC address is synchronized to the forwarding VSI in each access VSI; each access VSI Synchronize the learned MAC addresses on its super members to other access VSIs.

In the foregoing solution, the split configuration is configured to access the VSI and the VSI for forwarding, including:

Configure a member attribute in the AC interface table or the PW attribute table. The member attribute is configured to identify whether the current interface is the specified interface.

The access VPN_ID and the forwarding VPN_ID are configured in the AC interface table or the PW attribute table, and the access VPN_ID corresponds to the access VSI, and the forwarding VPN_ID corresponds to the forwarding VSI;

When the member attribute identifies that the current interface is the designated interface, the access VPN_ID is different from the forwarding VPN_ID; otherwise, the access VPN_ID is the same as the forwarding VPN_ID.

In the above solution, the access processing is performed according to the access VSI, and the forwarding processing is performed according to the forwarding VSI, including:

The MAC address learning is performed according to the access VPN_ID, and the forwarding table is searched by using the VPN_ID for forwarding. If the destination address is found, the MAC address unicast processing is performed according to the forwarding VPN_ID of the corresponding forwarding VSI, and if the destination address is not found, the forwarding is performed according to the forwarding. Use the VPN_ID to find the broadcast table of the forwarding VSI and perform broadcast forwarding.

In the above solution, the method further includes:

For other interfaces except the specified interface, the access processing and forwarding processing are performed according to the access VSI.

In the above solution, the method includes:

For the E-TREE service, only the leaf members that can communicate with some members, or the super-cross-VPN interworking services that can communicate with each other across the VPN, perform access processing according to the access VSI, and perform forwarding processing according to the forwarding VSI;

For the root member in the E-TREE service or the ordinary member in the inter-VPN interworking service, the access processing and forwarding processing are performed according to the access VSI.

A packet processing device for a virtual private network VPN, the device includes:

The configuration unit is configured to access the VSI separately from any PW interface or AC interface. And forwarding with VSI;

The processing unit is configured to perform access processing according to the access VSI for the designated interface, and perform forwarding processing according to the forwarding VSI.

In the above solution, for the point-to-multipoint E-TREE service, the configuration unit is configured to separately configure the access VSI and the forwarding VSI, including:

The forwarding VSI includes index information of the middle member.

In the above scheme,

For the E-TREE service, the configuration unit is configured to separately configure the access VSI and the forwarding VSI, including: the broadcast table of the access VSI includes broadcast information of all members of the E-TREE service, and the forwarding VSI includes E - The broadcast information of all the root members of the TREE service; the MAC address of all members in the E-TREE service learns the access VSI, and the root member of the E-TREE service learns the MAC address of the access VSI. Synchronize to the forwarding VSI.

In the foregoing solution, when the two or more VPNs are connected to each other, the configuration unit is configured to separately configure the access VSI and the forwarding VSI, including:

The forwarding VSI includes member index information of all access VSIs.

Each learned VSI synchronizes the learned MAC address to the forwarding VSI; each access VSI Synchronize the learned MAC addresses on its super members to other access VSIs.

In the above solution, the configuration unit is configured to separately configure the access VSI and the forwarding VSI, including:

In the above solution, the processing unit is configured to perform access processing according to the access VSI, and perform forwarding processing according to the forwarding VSI, including:

In the above solution, the processing unit is further configured to: perform access processing and forwarding processing on the interfaces other than the designated interface according to the access VSI.

In the above solution, the processing unit is configured to:

A storage medium storing a computer program configured to execute the aforementioned VPN message processing method. VPN message provided by the embodiment of the present invention The method and the device can be configured to perform the forwarding processing based on the forwarding table in the forwarding VSI by using the VSI and the forwarding VSI on the interface. This can improve the processing of the members and the horizontal split in the VPLS network. Reduce the impact of invalid broadcast replication on the internal bandwidth of the device and improve VPLS forwarding performance.

DRAWINGS

FIG. 1 is a flowchart of a method for processing a VPN packet according to an embodiment of the present invention;

2 is a schematic diagram of constructing a forwarding entry in a VPN packet processing method according to an embodiment of the present invention;

3 is a schematic structural diagram of a structure of a VPN packet processing apparatus according to an embodiment of the present invention;

4 is a schematic diagram of a networking example of an E-TREE service;

FIG. 5 is a schematic diagram of an E-TREE networking structure and VPN packet processing according to an embodiment of the present invention;

FIG. 6 is a flowchart of a method for processing a VPN packet in an E-TREE service according to an embodiment of the present invention.

FIG. 7 is a schematic diagram of networking of a cross-VPN interworking service according to Embodiment 2 of the present invention;

FIG. 8 is a schematic diagram of processing VPN packets in a cross-VPN interworking service according to Embodiment 2 of the present invention;

FIG. 9 is a flowchart of a VPN packet processing method in a cross-VPN interworking service according to Embodiment 2 of the present invention.

detailed description

The invention will be further described in detail below with reference to the drawings and embodiments. It should be understood that described herein.

In various embodiments of the present invention, two VSIs are configured, one VSI is an access VSI and the other VSI is a forwarding VSI; that is, for any one PW interface or AC interface, it is connected to the VSI and The forwarding is configured by the VSI. The egress encapsulation information is determined by the access VSI. The forwarding VSI is configured to store the forwarding table, and the index egress encapsulation, but does not process the packet encapsulation. In the forwarding process, the MAC address is learned by the access VSI. Forwarding uses the VSI to save the forwarding table. In actual applications, whether the access VSI and the forwarding VSI are separated can be automatically determined according to the networking type. Generated or specified by command configuration.

In various embodiments of the present invention, as shown in FIG. 1, the VPN packet processing method may include the following steps:

Step 101: Separate and configure the VSI for access and the VSI for forwarding for any one of the PW interfaces or the AC interface.

For example, for the point-to-multipoint E-TREE service, the split configuration access VSI and the forwarding VSI, including: the access VSI binding all members of the current E-TREE service, including index information of all members; The forwarding VSI includes index information of the root member.

For the inter-VPN interworking service, when the two or more VPNs communicate with each other, the separate configuration is configured to access the VSI and the VSI for forwarding, including: the access VSI is two or more, respectively corresponding to each of the inter-VPN interworking In the VPN, each access VSI includes common member index information that can communicate with each other only in the VPN to which it belongs, and super member index information that can communicate with each other across the VPN. The forwarding VSI includes member index information of all access VSIs.

Step 102: Perform access processing according to the access VSI for the designated interface, and perform forwarding processing according to the forwarding VSI.

Specifically, the process of separately configuring the VSI and the VSI for forwarding may include: configuring a member attribute in the AC interface table or the PW attribute table, where the member attribute is configured to identify whether the current interface is the specified interface; in the AC interface table or PW The accessing VPN_ID and the forwarding VPN_ID are configured in the attribute table, and the access VPN_ID corresponds to the accessing VSI, and the forwarding VPN_ID corresponds to the forwarding VSI; when the member attribute identifies that the current interface is the designated interface, the access VPN_ID It is different from the VPN_ID for forwarding; otherwise, the access VPN_ID is the same as the VPN_ID for forwarding.

In step 102, performing access processing according to the access VSI, and performing forwarding processing according to the forwarding VSI may include: performing MAC address learning according to the access VPN_ID, and using the VPN_ID for forwarding to search for a forwarding table; if the destination address is found The MAC address unicast processing is performed according to the forwarding VPN_ID of the corresponding forwarding VSI, and if the destination address is not found, The broadcast table of the VSI for forwarding is searched according to the VPN_ID for forwarding, and broadcast forwarding is performed.

In addition, in step 102, the access processing and the forwarding processing are performed according to the access VSI for other interfaces except the specified interface. During the actual process, you can determine whether the interface is the specified interface based on the member attributes configured on the interface.

For example, a leaf member that can communicate with only a part of the E-TREE service, or a super member that can communicate with each other across the VPN in the inter-VPN interworking service, performs access processing according to the access VSI, and performs forwarding processing according to the VSI for forwarding; For the root member in the E-TREE service or the ordinary member in the inter-VPN interworking service, the access processing and forwarding processing are performed according to the access VSI.

As shown in FIG. 2, the interface table, the forwarding table, and the encapsulation table are configured according to FIG. 1 to implement the VPN packet in the embodiment of the present invention. deal with.

Specifically, as shown in FIG. 2, in the AC interface table or the PW attribute table, configure a flag flag to configure the member attributes of the current interface. At the same time, configure two VPN_IDs in the AC interface table or the PW attribute table, respectively. Access VPN_ID and forwarding VPN_ID, InVPN_ID in Figure 2 indicates access VPN_ID, corresponding to access VSI, FwVPN_ID indicates forwarding VPN_ID, corresponding to forwarding VSI. For the specified interface, you need to use FwVPN_ID to find the forwarding table when forwarding. At the same time, the egress encapsulation pointer in the forwarding table corresponding to the InVPN_ID and the egress encapsulation pointer of the forwarding table corresponding to the FwVPN_ID may be the same, and the identifier is forwarded from the same interface.

For example, the flag flag representing the member attribute can be set only on the specified interface. If the current interface is set with the flag flag, the current interface is the specified interface. If the current interface does not have the flag flag set, the current interface is not the specified interface. For example, the Flag flag can be set in the leaf member interface of the E-TREE service, and/or the super member interface in the inter-VPN interworking service, in the root member interface of the E-TREE service, and/or inter-VPN communication. The normal member interface in the service does not set this Flag flag. In this way, in the E-TREE service and the inter-VPN interworking service, it is only necessary to find whether the Flag flag bit exists in the AC interface table or the PW attribute table. It can be judged whether its interface is the specified interface.

The processing model of the E-TREE network and the cross-VPN network forwarding plane can be unified by the control table shown in Figure 2, and can be determined by the control plane whether it is E-TREE networking or cross-VPN networking. MAC address synchronization and control of the FwVPN_ID broadcast table.

In addition, if the device interface table cannot support the FwVPN_ID field, that is, if the device interface cannot support the split configuration access VSI and the forwarding VSI, the Flag flag of the above-mentioned identifier member attribute can be reset or deleted to be compatible with the normal VPLS forwarding. .

As shown in FIG. 3, in various embodiments of the present invention, the VPN packet processing apparatus may include:

The configuration unit 31 is configured to separate the VSI and the forwarding VSI for any one of the PW interfaces or the AC interfaces.

The processing unit 32 is configured to perform access processing according to the access VSI for the designated interface, and perform forwarding processing according to the forwarding VSI.

For the point-to-multipoint E-TREE service, the configuration unit 31 is configured to separately configure the access VSI and the forwarding VSI, including: the access VSI binding all members of the current E-TREE service, including indexes of all members Information: The forwarding VSI includes index information of the root member, and the root member can communicate with any other member of the current E-TREE service.

For the E-TREE service, the configuration unit 31 is configured to separately configure the access VSI and the forwarding VSI, including: the broadcast table of the access VSI includes broadcast information of all members of the E-TREE service, and the forwarding VSI includes The broadcast information of all the root members of the E-TREE service; the MAC address of all the members in the E-TREE service learns the access VSI, and the root member of the E-TREE service learns the MAC that accesses the VSI. The address is synchronized to the forwarding VSI.

When two or more VPNs are interconnected, the configuration unit 31 is configured to separately configure the access VSI and the forwarding VSI, including:

The access VSIs are two or more, which respectively correspond to VPNs that are inter-VPN-connected. Each access VSI includes common member index information that can only communicate with each other in the VPN to which it belongs. Super member index information of VPN mutual visits;

The forwarding VSI includes member index information of all access VSIs.

For the inter-VPN interworking service, when two or more VPNs are connected to each other, the configuration unit 31 is configured to separately configure the access VSI and the forwarding VSI, including:

Each learned VSI synchronizes the learned MAC address to the forwarding VSI; each access VSI synchronizes the learned MAC address of its super member to other access VSIs.

The configuration unit 31 is configured to separately configure the access VSI and the VSI for forwarding, and may include:

The processing unit 32 is configured to perform access processing according to the access VSI, and perform forwarding processing according to the forwarding VSI, including: performing MAC address learning according to the access VPN_ID, and using the VPN_ID for forwarding to look up the forwarding table; The destination address is subjected to MAC address unicast processing and forwarding according to the forwarding VPN_ID of the corresponding forwarding VSI. If the destination address is not found, the forwarding VSI broadcast table is searched according to the forwarding VPN_ID and broadcasted.

The processing unit 32 is further configured to perform access processing and forwarding processing on the interfaces other than the designated interface according to the access VSI.

The processing unit 32 is configured to: perform access processing according to the access VSI, and perform forwarding processing according to the access VSI for the leaf member that can communicate with only the member of the E-TREE service or the super-member that can communicate with each other across the VPN. Forward processing with VSI; for E-TREE service The access member and the normal member in the inter-VPN interworking service are both access processing and forwarding processing according to the access VSI.

The VPN packet processing method and device provided by the embodiments of the present invention can be configured as multiple scenarios such as a VPLS Hub-Spoke, multiple E-TREEs, and a cross-VPN interworking network. It should be noted that the separation of the access VSI and the forwarding VSI in the various embodiments of the present invention is also configured as a virtual Pseudo Wire Service (VPWS). The specific implementation process is similar and will not be described again.

Embodiment 1

In the point-to-multipoint (E-TREE) network, the Leaf node prevents member interworking through member isolation or PW horizontal splitting.

As shown in Figure 4, the flow diagram is an example of a plurality of E-TREE networks. The E-TREE network includes one Root-PE, two Leaf-PEs, and four CEs, of which CE11 and CE12 are The root CE, CE13 and CE14 are both leaf CEs. CE13 is connected to the root-PE through Leaf-PE11. The CE14 is connected to the root-PE through Leaf-PE12. Both CE11 and CE12 are connected to the root-PE. The CE and the PE communicate with each other through the AC interface. The PE and the PE communicate with each other through the PW interface. As shown in Figure 4, the AC11 interface is between CE11 and the root-PE. The AC12 interface is between CE12 and the local device. The AC13 interface is between CE11 and Leaf-PE11. The AC14 interface is between CE14 and Leaf-PE12. The PW11 interface is between the Leaf-PE11 and the Root-PE. The PW12 interface is between the Leaf-PE12 and the Root-PE. As can be seen from Figure 1, the Leaf interface is not interoperable. That is to say, in the E-TREE service, Leaf members cannot communicate with each other.

In the embodiment of the present invention, for each E-TREE service, two types of VSIs are defined: Normal_VSI and Root_VSI. After configuring E-TREE, configure the specified Root_VSI for Normal_VSI. In this way, two VSIs are created for the VPN.

All members (including the root member A11, A12, and Leaf members PW11 and PW12) are bound to the Normal_VSI. The Normal_VSI contains all members (including the Root member and The leaf member is indexed, which is similar to the VSI used by the E-TREE service in the related art. The Root_VSI only contains all the root member index information and is not configured as a service binding. Specifically, for the root member, since it can communicate with any member, the forwarding VSI forwarding table includes all the root member indexes and the leaf member indexes, and the corresponding forwarding table is managed by Normal_VSI; for the Leaf member, since it can only Communicate with the Root member, and the corresponding forwarding table is managed by the Root_VSI.

For E-TREE services, for devices that only support one VSI, the device can forward based on Normal_VSI. For a device that supports access VSI and VSI separation for forwarding, that is, for devices supporting two types of VSI, forwarding can be performed based on the above two VSIs.

The normal_VSI is configured as the signaling management and is responsible for the maintenance of the PW. The Root_VSI is not responsible for the signaling management. The forwarding table member contains the PW of the root type established by the Normal_VSI, and is only the VPN of the local attribute.

The difference between Normal_VSI and Root_VSI is that the MAC address contained in the VSI is different from the broadcast table forwarding entry. The MAC address learning is determined by the access VSI of the AC or the PW. Therefore, in the embodiment of the present invention, the default MAC address is learned in the Normal_VSI to ensure compatibility with the normal E-TREE address learning. In the embodiment of the present invention, the broadcast table of the Normal_VSI includes broadcast information of all members in the E-TREE, whether for AC or PW; the broadcast table in the Root_VSI only contains broadcast information of all the root members. When the Root_VSI is specified for the Normal_VSI, the MAC address learned by the root member is synchronized to the Root_VSI. At the same time, a broadcast table containing all the root members is created for the Root_VSI. In the actual application, the root member learns the MAC address in the Normal_VSI and needs to synchronize with the Root_VSI through the control plane to forward the stream received by the Leaf interface. However, the Leaf member learns that the MAC address is the same as the normal VPLS MAC processing and does not need to be synchronized to the Root_VSI.

For the VPLS forwarding process of the E-TREE service, for the Leaf member, the access VSI is Normal_VSI, that is, the processing of MAC address learning is first learned into the Normal_VSI, but The forwarding VSI is Root_VSI; for Root members, the VSI for access and forwarding is Normal_VSI.

Specifically, for the MAC address table in the Normal_VSI and the Root_VSI, the cross-VSI synchronization processing of the MAC address table is uniformly processed by the control plane; the MAC aging is initiated by the Normal_VSI, and the MAC address of the associated Root_VSI is aging synchronized by the control plane.

Specifically, for the data forwarding layer of the Normal_VSI and the Root_VSI, the VPN_ID saved in the interface attribute table (the AC interface table and the PW attribute table) may be extended, and two types of IDs are saved: one is the access VPN_ID, and the other is the VPN_ID for forwarding; If the access VPN_ID is the same as the forwarding VPN_ID, the normal VPLS forwarding process is used. If the access VPN_ID is different from the forwarding VPN_ID, the VPLS forwarding process is performed by using the two VSIs in the embodiment of the present invention. That is, when the VPLS forwarding process is performed, if the access VPN_ID is the same as the forwarding VPN_ID, the normal VPLS forwarding process is used; if the access VPN_ID is different from the forwarding VPN_ID, the access member is processed based on the Normal_VSI and forwarded based on the Root_VSI. Processing; for Root members, their access and forwarding are based on Normal_VSI.

In actual applications, if the AC interface table and the PW attribute table of the device in the E-TREE network cannot support the VSI and the VSI for forwarding, you can specify the Root_VSI for the Normal_VSI and ensure that the E-TREE can be forwarded according to the traditional VPLS. .

In the embodiment of the present invention, the broadcast forwarding table of the leaf member only includes the information about the root member, which reduces the isolation filtering of the leaf member to the leaf member, and improves the broadcast performance. The root member is the same as the original forwarding, as long as the port is isolated. At the same time, the isolation processing between the above-mentioned processing Leaf members is also naturally supported, and the unicast does not need to be additionally subjected to member isolation processing. In addition, the switching process between normal E-TREE forwarding and efficient E-TREE forwarding is well guaranteed, and the handover process does not affect traffic forwarding.

As shown in FIG. 2, it is a schematic diagram of an E-TREE networking in the embodiment of the present invention, where the E-TREE network includes five CEs (CE21, CE22, CE23, CE24, CE25) and four PEs (PE21, PE21, PE23, and PE24), where CE21, CE22, and CE23 are Leaf CEs, CE24 and CE25 are Root CEs, and CE21, CE22, and CE23 are connected to PE23, PE21, and PE22 through AC interfaces. PE21 and PE22 are connected to PEs through PE interfaces. The PE23 is connected to the PW24. The PW23 is connected to the PW24 through the PW interface. The CE24 and CE25, which are the root nodes, are connected to the PE24 and PW23 through the AC interface. In the E-TREE network, two separate VSIs are configured: Normal_VSI and Root_VSI. All members (including the root member and the leaf member) are bound to the Normal_VSI. The Normal_VSI contains index information of all members (including the root member and the leaf member), similar to the VSI used by the E-TREE service in the related art. The Root_VSI only contains all the root member index information and is not configured as a service binding.

First, the normal E-TREE forwarding normal_VSI instance is set up, and the PE23 is configured as the E-TREE service. When the E-TREE service is configured, the AC interface table and the PW attribute table respectively set the member attribute flag (ie, the Leaf/Root attribute flag), E. - VPN identity of the TREE service (access VPN_ID and forwarding VPN_ID);

Specify the Root_VSI for the Normal_VSI. The Root_VSI includes all the Root members in the E-TREE and sets the Root_VPN_ID. If the Normal_VSI has learned the MAC address before configuring the Root_VSI, the MAC address learned by the Root member in the Normal_VSI is synchronized to the Root_VSI. ;

For the Leaf member, the forwarding VPN_ID is used as the Root_VPN_ID, and the access VPN_ID is used as the Normal_VSI_ID. For the Root member, the access VPN_ID and the forwarding VPN_ID are the same, and both are used as the Normal_VSI_ID.

When you delete the Root_VSI of the Normal_VSI, you only need to change the forwarding VPN_ID set in the interface attribute of the Leaf member in the E-TREE to Normal_VPN_ID. Root_VSI's own MAC address and broadcast table can be deleted slowly.

During the E-TREE service forwarding process, as shown in Figure 3,

Indicates the data flow path forwarded between Leaf members.

Indicates the data flow path forwarded by the root member. For the leaf member, the normal VSI is used as the access VSI for data forwarding and MAC address learning, and then the Root_VSI is used as the forwarding VSI for MAC address unicast forwarding or broadcast forwarding. The normal_VSI performs the outbound interface encapsulation to complete the packet forwarding. In the case of the root member, the normal_VSI is used as the access VSI and the forwarding VSI, and the data forwarding and MAC address learning, MAC address unicast processing, or broadcast forwarding are performed according to the Normal_VSI. The packet forwarding is complete. Here, both the Leaf member and the Root member learn MAC address from the Normal_VSI, perform MAC synchronization to the Root_VSI, and synchronize the MAC addresses of all the Root members to the Root_VSI.

In the embodiment of the present invention, the process of forwarding the E-TREE service is as follows: When the traffic is received on the interface, the AC interface table or the PW attribute table is obtained to obtain the Leaf/Root attribute of the interface; the Leaf/Root attribute is used to determine the leaf. The member is also a member of the root. If the packet is received from the root member, the interface attribute of the root attribute table is the same as the VPN_ID for forwarding. The corresponding parameter is Normal_VPN_ID. If the traffic is received by the leaf member, the leaf interface attribute table has two VPN_IDs. , a Normal_VPN_ID, a Root_VPN_ID;

For the root member, MAC address learning is performed according to SMAC+Normal_VPN_ID. If it is a new MAC address, it is synchronized to the Root_VSI through the control plane; for the Leaf member, the MAC address also learns the MAC address according to the SMAC+Normal_VPN_ID, but the MAC address is not synchronized to the Root_VSI;

If the destination address is found, for the Root member, the MAC address is unicast and forwarded according to the DMAC+Normal_VPN_ID; if it is a Leaf member, the MAC address is unicast and forwarded according to the DMAC+Root_VPN_ID;

If the destination address is not found, the broadcast table of the normal_VSI is forwarded and broadcasted according to the Normal_VPN_ID. For the packets received by the leaf member, the broadcast table of the Root_VSI is searched according to the Root_VPN_ID and broadcasted.

Specifically, as shown in FIG. 6, in combination with FIG. 5, the specific implementation process of the E-TREE service forwarding process may include the following steps:

Step 601, receiving a message on the AC or PW;

Step 602: Search for an AC interface table or a PW attribute table. If the packet is received on the AC, the AC interface table is searched. If the packet is received on the PW, the PW attribute table is searched.

Step 603, it is determined whether the member of the received message is a Leaf member, if yes, proceed to step 604, if not, proceed to step 605;

Specifically, the member attribute flag (ie, the Leaf/Root attribute flag) set in the AC interface table and the PW attribute table may be used to determine whether the member of the received packet is a Leaf member.

Step 604, performing MAC address learning according to SMAC (Source MAC, Media Access Control) + Normal_VPN_ID, and using the associated DMAC + Root_VPN_ID in the AC or PW to find the forwarding table, continue to step 606;

Step 605: Perform MAC address learning according to the SMAC+Normal_VPN_ID, and the control plane synchronizes the MAC address to the Root_VSI, and searches the forwarding table according to the DMAC (destination MAC)+Normal_VPN_ID;

Step 606: Has the destination address been found in the forwarding table? If no, proceed to step 607, and if yes, proceed to step 608;

Step 607: For the root member, look for the Normal_VSI; for the Leaf member, look for the Root_VSI, and copy the packet to the member one by one;

Step 608, whether the exit is PW, if it is to continue to step 609, if not continue to step 610;

Step 609: Perform AC forwarding. Specifically, the local AC is forwarded for the packets received by the AC, and the PW label is forwarded to the AC for the packets received by the PW, and the process ends.

Step 610: The PW packet is encapsulated and forwarded. Specifically, the PW label is forwarded and forwarded by the PW, and the process ends.

Embodiment 2

If some members of the VPN instance are required to access not only the members of the VPN but also other VPN members, other members can only communicate with each other within the VPN, which is called cross-VPN interworking.

In the embodiment of the present invention, in order to solve the problem of inter-VPN interworking, a Super_VSI is defined for two or more VSIs that are inter-VPN interworking, and the Super_VSI is different from the VSI corresponding to different VPNs, and the difference is that the included forwarding members are different. Each VPN of the VPN interworking includes the forwarding members in the VPN and the super members that can communicate with each other across the VPN. The Super_VSI includes all the members in all the VSIs. Here, the member means Member. For a VPN, The corresponding logical exit is AC or PW. Members have the root/leaf in TREE according to their attributes. In cross-VPN interworking, there are members that can communicate with each other across VPNs and non-cross-VPN members.

The VSI in each VPN is configured as signaling management and is responsible for the maintenance of the PW. The Super_VSI is not responsible for signaling management. The forwarding table contains the PW established by each VSI, but only a local attribute VPN.

For the broadcast table, the VSI broadcast table in each VPN includes the super members of other VPNs in addition to the members in the VPN; the broadcast table of the Super_VSI includes indexes of all members in each VSI.

For MAC address learning, the MAC address learns the MAC address learned by the members in VSI and VSI2 of each VPN, and simultaneously synchronizes with the Super_VSI for the super-member to forward the unicast forwarding of the flow. This ensures compatibility with normal VPLS processing.

Specifically, when the Super_VSI corresponding to each VSI is specified, the MAC address table learned by each VSI member is synchronized to the Super_VSI, and a broadcast table including all member indexes in each VSI is established for the Super_VSI. The MAC address learned by each VSI super member is synchronized with the specified Super_VSI and synchronized with the VSIs of other VPNs to provide an ordinary member's response processing for the super member to cross VPN access. The cross-VPN synchronization processing of the MAC address table is uniformly processed through the control plane. All MAC aging is initiated by the VSI to which the member belongs. The system plane aging synchronization of the associated VPN and the MAC address in the Super_VSI.

At the data forwarding level, the VPN_ID saved in the AC interface table and the PW attribute table is extended to store two VSI information: one is access VPN_ID, and the other is forwarding VPN_ID. If the two VPN_IDs are the same, it is normal VPLS forwarding processing; If the access VPN_ID is different from the forwarding VPN_ID, the VPLS forwarding process is performed in the following manner according to the embodiment of the present invention.

All members are bound to their own VPN, ensuring that devices can be forwarded according to the normal VSI. For a device that supports access VSI and VSI separation for forwarding, specify one Super_VSI for each VSI configuration. Super_VSI includes all members in each VSI by default. For a super-member, the access VSI is the VSI in which the VSI is located, that is, the processing of the MAC address learning first learns the VSI in which it is located, and the VSI for forwarding is Super_VSI; for the ordinary member, the VSI for access and forwarding is where it is located. VPN VSI. The so-called super member is the member with the most privilege. It can be considered in any VSI, but in reality, it is often in a certain VSI, but it has a large privilege. In the networking, you can select the VSI that it is based on its attributes.

Take two VPN interworkings as an example. The network architecture of cross-VPN mutual access shown in Figure 4 includes two VPNs, namely VPN1 and VPN2. In VPN1, there are CE31, CE32, CE33, CE34, and VPN2. CE35, CE36, and CE37, PEs include PE31, PE32, PE33, and PE34. PE31 is connected to PE32, PE33, and PE34 through PW31, PW32, PW33, and PW34. The PE30 and CE35 are connected to each other through AC30. Between PE31 and CE31, PE33 and CE34 are connected through AC31. The PE31 and CE32 are connected to each other through AC32. The PE31 and CE36 are connected through AC33. Among them, PE31 is a super member of PW32 and AC31 in VPN1, and other members of VPN1 include PW31, PW33, PW34, AC30, AC32, and AC33 are common members. PW33, PW34, and AC33 in VPN2 on PE31 are common members; The so-called members in the VSI are just a local concept, not for different devices. The number is just a local concept, and the CE and PE numbers are divided for the network, but the CE and PE are different devices. The number can be repeated.

For Figure 4, if the PW34 of the VPN2 exists between the PE31 and the PE33, if the PW32 is also configured as the Super attribute, there is double traffic for the traffic sent by the CE34 to the CE36. At this time, CE34 is configured as the super-member on PE33, and the traffic is sent to PE31 through PW32 and PW33. The PW32 is configured as the common member attribute on PE31. The traffic received by PW32 on PE31 is forwarded in VSI1, and the traffic received by PW34 is received. Forwarding in VSI2;

VPN1 and VPN2 need to communicate with each other across VPNs. VPN1 is configured with VSI1, VPN2 is configured with VSI2, and VSI1 and VSI2 are common VSIs. Here, a Super_VSI is also defined. The main difference between the Super_VSI and the VSI1 and the VSI2 is that the forwarding members are different. The VSI1 and the VSI2 respectively manage the ordinary members of the VPN, namely VPN1 and VPN2, and the super members who can exchange visits between VPN1 and VPN2. The Super_VSI contains all members of both VPNs (VPN1 and VPN2). As shown in Figure 4, VSI1 and VSI2 are established. On the PE31, VPN1 and VPN2 are connected to each other. The VSI1 on the PE31 includes four members: AC1, AC2, PW1, and PW2. VSI2 includes two members, AC3 and PW3.

The configuration process includes: configuring super-member attributes in VSI1 and VSI2 (that is, accessing members across VPNs). In Figure 4, VSI1 has super members AC1 and PW2, and VSI2 has no super members. In the AC interface table and the PW attribute table, the cross-VPN access flag, the access VPN_ID, and the forwarding VPN_ID are set. When the cross-VPN access flag is not set, the access VPN_ID and the forwarding VPN_ID are the same, that is, the respective Local_VPN_ID, The broadcast member only contains the members of its own instance. When the cross-VPN access flag is not set, the configuration is as follows: Super_VSI is configured for VSI1 and VSI2, and the VPN_ID corresponding to Super_VSI is Super_VPN_ID. The AC interface table or PW attribute table of the super-member is modified. Modify the forwarding with the VPN_ID to the Super_VPN_ID, and write the members of the VSI1 and VSI2 to the broadcast table of the Super_VSI. For the VSI1 and VSI2, write the super member of the other party to the broadcast table; VSI1 and VSI2 will be configured with the Super_VSI. I have learned about MAC address synchronization to Super_VSI before, and VSI1 synchronizes the MAC address learned by the super member to VSI2. In this way, the configuration of the entire cross-VPN forwarding instance is completed. In this way, the address learned by the super-members in VSI1 is synchronized to VSI2, and the address learned by the super-members in VSI2 is synchronized to VSI1; the broadcast table of Super_VSI contains all member indexes of two VPNs; the flow received by ordinary members Forwarding processing is similar to normal VPLS forwarding, except that its forwarding table also contains super-members across VPNs, enabling communication control across VPNs.

If the Super_VSI needs to be deleted, the interface attribute of the super-member in the VSI is changed to the Local_VPN_ID by the forwarding VPN_ID, the cross-VPN access flag is reset, and the super-members of other VPNs included in the broadcast table of the VSI1 and VSI2 are deleted. The service is forwarded according to ordinary VPLS. The MAC address and broadcast table of the Super_VSI itself can be deleted slowly.

As shown in FIG. 5, it is a schematic diagram of a VPLS forwarding process in the cross-VPN mutual access example shown in FIG. among them,

Representing a super member,

Means ordinary members,

Indicates the stream received by ordinary members in VPN1.

Indicates the stream received by ordinary members in VPN2.

Indicates the stream received by the super member, and the black arrow line indicates the MAC address synchronization process.

As shown in Figure 8, when receiving traffic on the inbound interface, look up the AC table or the tag attribute table to obtain whether the interface is a super member, and obtain the Local_VPN_ID from the AC interface table or the PW attribute table, and forward the VPN_ID (if yes) The super member corresponds to Super_VPN_ID, otherwise it corresponds to Local_VPN_ID);

Then, the MAC address learning is performed by using the SMAC+Local_VPN_ID, and the MAC address of the member is learned by the VSI of the member. Specifically, the MAC addresses of the AC31, AC32, PW31, and PW32 are learned into the VSI1, and the MAC addresses of the AC33 and PW33 are learned into the VSI2. For the super-member, the learned MAC address is synchronized to the Super_VSI and another VSI through the control plane; for ordinary members, the MAC address is only synchronized to the Super_VSI, but is not synchronized to another VSI;

If a MAC address is found, for a super member, according to DMAC+Super_VPN_ID Performing MAC address unicast processing; for ordinary members, performing MAC address unicast processing according to DMAC+Local_VPN_ID; if no MAC address is found, for the stream received by the super member, the Super_VSI broadcast table is searched according to Super_VPN_ID and broadcasted; For the traffic received by ordinary members, the broadcast table is searched according to the VSI and broadcasted.

As shown in FIG. 9, the specific implementation process of the cross-VPN service processing may include the following steps:

Step 901: Receive a message.

Step 902: Search for an AC interface table or a PW attribute table to obtain a super member attribute of the access side.

Specifically, the AC table or the tag attribute table is obtained to obtain whether the interface is a super member, and the Local_VPN_ID is obtained from the AC interface table or the PW attribute table, and the VPN_ID is forwarded (if the super member interface corresponds to the Super_VPN_ID, otherwise the local_VPN_ID is corresponding) ;

Step 903, it is determined whether it is a super member; if not, continue to step 904, otherwise, continue to step 905;

Step 904, learning the MAC address with the SMAC+Local_VPN_ID, the control plane synchronizes the SMAC address to the VSI associated with the other VPN, and synchronizes with the Super_VSI, and searches the forwarding table according to the DMAC+Super_VPN_ID, and proceeds to step 906;

Step 905: Learning the MAC address by using SMAC+Local_VPN_ID, synchronizing the MAC address to the Super_VSI, and searching for the forwarding table according to the DMAC+Local_VPN_ID;

Step 906, whether the destination address is found in the forwarding table, if not, proceed to step 907, otherwise continue to step 908;

Step 907: Search for a broadcast table by using Super_VPN_ID, and copy the message and send it to the members one by one;

Step 908, whether the exit is PW, if it is to continue to step 909, otherwise continue to step 910;

Step 909, the packet is forwarded locally by the AC, and the current process ends.

Step 910: After the PW encapsulation is performed, the packet is forwarded, and the current process ends.

For mutual access across VPNs, the above method only uses two VPNs as an example, but not The limit is only two. In the case of more than two VPN exchange visits, the above method can also be implemented.

The embodiment of the invention further describes a storage medium, wherein the storage medium stores a computer program, and the computer program is configured to execute the VPN message processing method of the foregoing embodiments.

Those skilled in the art will appreciate that embodiments of the present invention can be provided as a method, system, or computer program product. Accordingly, the present invention can take the form of a hardware embodiment, a software embodiment, or a combination of software and hardware. Moreover, the invention can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) including computer usable program code.

The present invention has been described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (system), and computer program products according to embodiments of the invention. It will be understood that each flow and/or block of the flowchart illustrations and/or FIG. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing device to produce a machine for the execution of instructions for execution by a processor of a computer or other programmable data processing device. Means for implementing the functions specified in one or more of the flow or in a block or blocks of the flow chart.

The computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device. The apparatus implements the functions specified in one or more blocks of a flow or a flow and/or block diagram of the flowchart.

These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device. The instructions provide steps for implementing the functions specified in one or more of the flow or in a block or blocks of a flow diagram.

Industrial applicability

The invention can implement the forwarding processing based on the forwarding table in the forwarding VSI by using the forwarding VSI and the forwarding VSI on the interface, and can improve the processing of the members and the horizontal splitting in the VPLS networking, and reduce the invalid broadcast replication. Impact on the internal bandwidth of the device and improve VPLS forwarding performance.

The above is only the preferred embodiment of the present invention and is not intended to limit the scope of the present invention.

Claims

A packet processing method for a virtual private network VPN, where the method includes:

For any PW interface or AC interface, the VSI and the forwarding VSI are separately configured.

For the specified interface, the access processing is performed according to the access VSI, and then the forwarding process is performed according to the forwarding VSI.
The method of claim 1, wherein for the point-to-multipoint E-TREE service, the separate configuration access VSI and forwarding VSI comprises:

The access VSI is bound to all members of the current E-TREE service, and includes index information of all members;

The forwarding VSI includes index information of the middle member.
The method according to claim 1 or 2, wherein, for the E-TREE service, the separate configuration access VSI and forwarding VSI includes:

The broadcast table of the access VSI includes broadcast information of all members of the E-TREE service; and the VSI for forwarding includes broadcast information of all the root members of the E-TREE service;

The MAC address of all members in the E-TREE service learns the access VSI; for the Root member in the E-TREE service, the MAC address that has learned to access the VSI is synchronized to the forwarding VSI.
The method of claim 1, wherein, for the inter-VPN interworking service, when the two or more VPNs are interconnected, the separate configuration accesses the VSI and the VSI for forwarding, including:

The access VSIs are two or more, each corresponding to each VPN that is inter-VPN-connected, and each access VSI includes common member index information that can only communicate with each other in the VPN to which it belongs, and a super-member index that can communicate with each other across VPNs. information;

The forwarding VSI includes member index information of all access VSIs.
The method according to claim 1 or 4, wherein, for the inter-VPN interworking service, when the two or more VPNs communicate with each other, the separate configuration accesses the VSI and the VSI for forwarding, including:

All members of each access VSI are written into the broadcast table of the VSI for forwarding; each access VSI writes members of the VSI and other super-members of the access VSI into its own broadcast table;

The learned MAC addresses are synchronized to the forwarding VSIs in each access VSI; each access VSI synchronizes the learned MAC addresses on its super members to other access VSIs.
The method according to claim 1, 2 or 4, wherein the split configuration access VSI and forwarding VSI comprises:

Configure a member attribute in the AC interface table or the PW attribute table. The member attribute is configured to identify whether the current interface is the specified interface.

The access VPN_ID and the forwarding VPN_ID are configured in the AC interface table or the PW attribute table, and the access VPN_ID corresponds to the access VSI, and the forwarding VPN_ID corresponds to the forwarding VSI;

When the member attribute identifies that the current interface is the designated interface, the access VPN_ID is different from the forwarding VPN_ID; otherwise, the access VPN_ID is the same as the forwarding VPN_ID.
The method according to claim 6, wherein the performing the access processing according to the access VSI, and performing the forwarding processing according to the forwarding VSI, includes:

The MAC address learning is performed according to the access VPN_ID, and the forwarding table is searched by using the VPN_ID for forwarding. If the destination address is found, the MAC address unicast processing is performed according to the forwarding VPN_ID of the corresponding forwarding VSI, and if the destination address is not found, the forwarding is performed according to the forwarding. Use the VPN_ID to find the broadcast table of the forwarding VSI and perform broadcast forwarding.
The method of claim 1 or 7, wherein the method further comprises:

For other interfaces except the specified interface, the access processing and forwarding processing are performed according to the access VSI.
The method of claim 1 or 7, wherein the method comprises:

For the E-TREE service, only the leaf members that can communicate with some members, or the super-cross-VPN interworking services that can communicate with each other across the VPN, perform access processing according to the access VSI, and perform forwarding processing according to the forwarding VSI;

For the root member in the E-TREE service or the ordinary member in the inter-VPN interworking service, the access processing and forwarding processing are performed according to the access VSI.
A packet processing device for a virtual private network VPN, where the device includes:

The configuration unit is configured to connect to the VSI and the VSI for forwarding on any PW interface or AC interface.

The processing unit is configured to perform access processing according to the access VSI for the designated interface, and perform forwarding processing according to the forwarding VSI.
The apparatus according to claim 10, wherein, for the point-to-multipoint E-TREE service, the configuration unit is configured to separately configure the access VSI and the forwarding VSI, including:

The access VSI is bound to all members of the current E-TREE service, and includes index information of all members;

The forwarding VSI includes index information of the middle member.
The apparatus according to claim 10 or 11, wherein

For the E-TREE service, the configuration unit is configured to separately configure the access VSI and the forwarding VSI, including: the broadcast table of the access VSI includes broadcast information of all members of the E-TREE service, and the forwarding VSI includes E - The broadcast information of all the root members of the TREE service; the MAC address of all members in the E-TREE service learns the access VSI, and the root member of the E-TREE service learns the MAC address of the access VSI. Synchronize to the forwarding VSI.
The device according to claim 10, wherein, for the inter-VPN interworking service, when two or more VPNs are interconnected, the configuration unit is configured to separately configure the access VSI and the forwarding VSI, including:

The access VSIs are two or more, each corresponding to each VPN that is inter-VPN-connected, and each access VSI includes common member index information that can only communicate with each other in the VPN to which it belongs, and a super-member index that can communicate with each other across VPNs. information;

The forwarding VSI includes member index information of all access VSIs.
The device according to claim 10 or 13, wherein, for the inter-VPN interworking service, when two or more VPNs are interconnected, the configuration unit is configured to separately configure the access VSI and the forwarding VSI, including:

All members of each access VSI are written into the broadcast table of the VSI for forwarding; each access VSI writes members of the VSI and other super-members of the access VSI into its own broadcast table;

Each learned VSI synchronizes the learned MAC address to the forwarding VSI; each access VSI synchronizes the learned MAC address of its super member to other access VSIs.
The apparatus according to claim 10, 11 or 13, wherein the configuration unit is configured to separately configure the access VSI and the forwarding VSI, including:

Configure a member attribute in the AC interface table or the PW attribute table. The member attribute is configured to identify whether the current interface is the specified interface.

The access VPN_ID and the forwarding VPN_ID are configured in the AC interface table or the PW attribute table, and the access VPN_ID corresponds to the access VSI, and the forwarding VPN_ID corresponds to the forwarding VSI;

When the member attribute identifies that the current interface is the designated interface, the access VPN_ID is different from the forwarding VPN_ID; otherwise, the access VPN_ID is the same as the forwarding VPN_ID.
The apparatus according to claim 15, wherein the processing unit is configured to perform access processing according to the access VSI, and perform forwarding processing according to the forwarding VSI, including:

The MAC address learning is performed according to the access VPN_ID, and the forwarding table is searched by using the VPN_ID for forwarding. If the destination address is found, the MAC address unicast processing is performed according to the forwarding VPN_ID of the corresponding forwarding VSI, and if the destination address is not found, the forwarding is performed according to the forwarding. Use the VPN_ID to find the broadcast table of the forwarding VSI and perform broadcast forwarding.
The apparatus according to claim 10 or 16, wherein the processing unit is further configured to perform access processing and forwarding processing according to the access VSI for other interfaces than the designated interface.
The apparatus of claim 10 or 16, wherein the processing unit is configured to:

For the E-TREE service, only the leaf members that can communicate with some members, or the super-cross-VPN interworking services that can communicate with each other across the VPN, perform access processing according to the access VSI, and perform forwarding processing according to the forwarding VSI;

For the root member in the E-TREE service or the ordinary member in the inter-VPN interworking service, the access processing and forwarding processing are performed according to the access VSI.
A storage medium storing a computer program, the computer program being configured to execute the VPN message processing method according to any one of claims 1 to 9.