WO2016107392A1 - 连接实现方法、网络服务器和网关网元 - Google Patents

连接实现方法、网络服务器和网关网元 Download PDF

Info

Publication number
WO2016107392A1
WO2016107392A1 PCT/CN2015/097153 CN2015097153W WO2016107392A1 WO 2016107392 A1 WO2016107392 A1 WO 2016107392A1 CN 2015097153 W CN2015097153 W CN 2015097153W WO 2016107392 A1 WO2016107392 A1 WO 2016107392A1
Authority
WO
WIPO (PCT)
Prior art keywords
network element
gateway
gateway network
server
network
Prior art date
Application number
PCT/CN2015/097153
Other languages
English (en)
French (fr)
Inventor
安国春
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2016107392A1 publication Critical patent/WO2016107392A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks

Definitions

  • This application relates to, but is not limited to, the field of communication technology.
  • the DCN Data Communication Network
  • the DCN Data Communication Network system is used to provide network devices with communication functions for managing access and managing control information, so that remote deployment and management of each device can be completed in the network management server center.
  • the gateway network element and a plurality of non-gateway network elements directly or indirectly connected to each other form a system, and the gateway network element and the plurality of non-gateway network elements in the management domain can directly access each other.
  • PPP over Ethernet PPP over Ethernet
  • OSPF Open Shortest Path First
  • the workflow of the DCN system includes:
  • the network diagram of the DCN shown in FIG. 1 is a gateway network element directly connected to the DCN, and the network element 1 and the network element 2 not connected to the DCN are non-gateway network elements.
  • the network element 1 and the network element 2 are directly connected to the network management server through the non-gateway network element, which directly causes the network element to occupy too many IP addresses of the public network, resulting in shortage of IP resources;
  • Another related technique is to manage the network element 1 and the network element 2 through the gateway network element.
  • the port connected between the network server and the gateway NE is still involved in the direct route calculation of the NE. That is, there is still a route to the DCN and the gateway NE connected to the non-gateway NE. Nor can it completely make non-gateway network elements safe.
  • This paper provides a connection implementation method, a network server, and a gateway network element, which can solve the technical problem that the non-gateway network element is insecure in the DCM system of the related art.
  • a connection implementation method for a DCN system including:
  • the network element IP of the gateway network element and the network element IP of the non-network element IP and the non-gateway network element are configured on the network server, and the network element IP and the non-network element IP of the gateway network element are located on different network segments;
  • the network element IP of the gateway network element and the network element IP of the non-gateway network element are sent to the gateway network element, so that the gateway network element establishes a connection with the non-gateway network element.
  • the step of setting the non-network element IP not to participate in route calculation between the gateway network element and the non-gateway network element includes:
  • the gateway network element is configured to not add the non-network element IP to the route calculation between the gateway network element and the non-gateway network element when receiving the non-network element IP.
  • the step of setting the gateway network element to not add the non-network element IP to the route calculation between the gateway network element and the non-gateway network element when receiving the non-network element IP include:
  • the step of setting the identifier of the packet sent by the network server to the gateway network element and including the non-network element IP includes: enabling the gateway network element with the network server or DCN The network-connected port sets an identifier for the packet sent by the network server to the gateway network element and including the non-network element IP.
  • the identifier includes: vlanY.
  • the method further includes:
  • the gateway network element calculates a route between the gateway network element and the non-gateway network element according to the network element IP of the non-gateway network element and the network element IP of the gateway network element, and establishes a route according to the route A connection with the non-gateway network element.
  • the step of sending the network element IP of the gateway network element and the network element IP of the non-gateway network element to the gateway network element further includes:
  • the gateway network element calculates a route between the gateway network element and the non-gateway network element according to the network element IP of the non-gateway network element and the network element IP of the gateway network element, and establishes a route according to the route After the connection with the non-gateway network element, the method further includes:
  • the gateway network element generates a network address translation NAT table according to the network element ID of the non-gateway network element and the connection between the gateway network element and the non-gateway network element;
  • the network server sends a management packet to the gateway network element, where the management packet includes: a network element ID and management content of the non-gateway network element to be managed;
  • the gateway network element manages the non-gateway network element corresponding to the network element ID according to the management packet and the NAT table.
  • a connection implementation method for a DCN system including:
  • the gateway network element establishes a connection with the network server according to its non-network element IP and network server IP;
  • the gateway network element receives the non-network element IP of the gateway network element and the network element IP of the non-gateway network element sent by the network server;
  • the gateway network element calculates a route between the gateway network element and the non-gateway network element according to the network element IP of the non-gateway network element and the network element IP of the gateway network element, and establishes a route according to the route A connection with the non-gateway network element.
  • the method before the calculating the route between the gateway network element and the non-gateway network element, the method further includes:
  • the gateway network element sets an identifier to the packet when receiving the packet that is sent by the network server and includes the non-network element IP, where the identifier is used to indicate that the gateway network element does not use the non-
  • the network element IP is added to the route calculation between the gateway network element and the non-gateway network element.
  • the network element IP of the gateway network element and the network element IP of the non-network element IP and the non-gateway network element are configured on the network server, and the network element IP and the non-network element IP of the gateway network element are located on different network segments;
  • the gateway network element calculates a route between the gateway network element and the non-gateway network element according to the network element IP of the non-gateway network element and the network element IP of the gateway network element, and establishes a route according to the route A connection with the non-gateway network element.
  • a management method applied to DCN systems including:
  • the gateway network element is configured according to the network element ID of the non-gateway network element, and the gateway network element and the non-gateway The connection between the network elements generates a NAT table;
  • the network server sends a management packet to the gateway network element, where the management packet includes: a network element ID and management content of the non-gateway network element to be managed;
  • the gateway network element manages the non-gateway network element corresponding to the network element ID according to the management packet and the NAT table.
  • the setting module is configured to: set the non-network element IP not to participate in route calculation between the gateway network element and the non-gateway network element;
  • the first connection establishing module is configured to: establish a connection with the gateway network element according to the network server IP and the non-network element IP;
  • the sending module is configured to send, by using a packet, the network element IP of the non-gateway network element to the gateway network element, where the destination IP address of the packet is the non-network element IP, for the gateway network element Establish a connection with a non-gateway network element.
  • a gateway network element is applied to a DCN system, and includes: a second connection establishment module, a receiving module, and a route calculation module;
  • the receiving module is configured to: receive a network element IP of the gateway network element and a network element IP of a non-gateway network element sent by the network server;
  • the route calculation module is configured to calculate a route between the gateway network element and the non-gateway network element according to the network element IP of the non-gateway network element and the network element IP of the gateway network element.
  • a connection implementation system for use in a DCN system including a network server as described above and a gateway network element as described above.
  • a computer readable storage medium storing computer executable instructions for performing the method of any of the above.
  • the embodiment of the present invention provides a connection implementation method and system, a network server, a gateway network element, and a management method.
  • the connection implementation method of the embodiment of the present invention includes: configuring a network element IP and a non-network of a gateway network element on a network server.
  • the network element IP of the non-gateway network element, the network element IP and the non-network element IP of the gateway network element are located in different network segments; and the non-network element IP is not involved in the gateway network element and the non-gateway network.
  • Routing calculation between the elements configuring a network server IP on the same network segment as the non-network element IP on the network server, and establishing a connection with the gateway network element according to the network server IP and the non-network element IP; Transmitting the network element IP of the gateway network element and the network element IP of the non-gateway network element to the gateway network element, so that the gateway network element establishes a connection with the non-gateway network element, and is in the method of the embodiment of the present invention.
  • the gateway network element is configured with the network element IP and the non-network element IP on different network segments.
  • the non-network element IP of the gateway network element in the method of the embodiment of the present invention does not participate in the route calculation of the gateway network element, that is, the gateway network element and Network server or DCN connected end Do not participate in route calculation; make the network element IP only used to establish a connection with the non-gateway network element, the non-network element IP is only used to establish a connection with the network server; thus the connection between the gateway network element and the network server, and the gateway network element non-gateway network
  • the connection between the elements is not in the same network segment, and the non-gateway network element does not have a route to the network server or the DCN network, and the non-gateway network element cannot be directly accessed through the network server or the DCN network, compared with related technologies.
  • the connection implementation method of the embodiment of the present invention improves the security of the non-gateway network element.
  • the connection implementation method of the embodiment of the present invention can occupy only one public network IP, thereby saving the public network IP resource.
  • FIG. 1 is a schematic structural view of a DCN system in the related art
  • FIG. 2 is a schematic flowchart of a connection implementation method according to Embodiment 1 of the present invention.
  • FIG. 3 is a schematic flowchart of a connection implementation method according to Embodiment 2 of the present invention.
  • FIG. 4 is a schematic flowchart of a connection implementation method according to Embodiment 3 of the present invention.
  • FIG. 5 is a schematic flowchart of a management method according to Embodiment 4 of the present invention.
  • FIG. 6 is a schematic flowchart of implementing network element management according to Embodiment 4 of the present invention.
  • FIG. 7 is a schematic diagram of establishing a connection between a gateway network element and a non-gateway network element according to Embodiment 4 of the present invention.
  • FIG. 8 is a schematic structural diagram of a network server according to Embodiment 5 of the present invention.
  • FIG. 9 is a schematic structural diagram of a gateway network element according to Embodiment 5 of the present invention.
  • FIG. 10 is a schematic structural diagram of a connection implementation system according to Embodiment 5 of the present invention.
  • Embodiment 1 is a diagrammatic representation of Embodiment 1:
  • the present embodiment provides a connection in view of the technical problem that the non-gateway network element in the related art DCM system has a route to the network server or the DCN, and the non-gateway network element is in a logged-in state at any time, thereby causing the non-gateway network element to be insecure.
  • the implementation method is applied to the network server side of the DCN system, as shown in FIG. 2, and includes the following steps:
  • the gateway network element is: a network element where a port connected to a network server or a DCN in the DCN system is located, for example, a gateway network element in the DCN system shown in FIG. 1;
  • the non-gateway network element in this embodiment is: a network element that can communicate with the gateway network element in the DCN system and that needs to be managed by the gateway network element, for example, the network element 1 and the network element 2 in the DCN system shown in FIG.
  • This step can include:
  • gateway NE port set the port connected to the DCN or the network server as the gateway NE port, set the network element where the gateway NE port is located as the gateway NE, and configure the non-network element IP, NE and non-NE IP of the gateway NE.
  • this is the network element IP and non-network element IP of the gateway NE
  • the network element that communicates with the gateway network element and meets the requirements of the gateway network element management is set to be a non-gateway network element.
  • the NE IP of the non-gateway NE is configured at this time).
  • Step 202 Set the non-network element IP to not participate in route calculation between the gateway network element and the non-gateway network element.
  • the gateway network element after receiving the packet sent by the network server, the gateway network element sends the packet to the route calculation module for routing calculation.
  • the packet sent by the network server to the gateway network element generally includes: the network server as the source IP. IP, the non-network element IP and the packet body of the destination IP. Therefore, the non-network element IP participates in the route calculation between the gateway network element and the non-gateway network element.
  • the non-network element IP is not allowed to participate in the route calculation between the gateway network element and the non-gateway network element.
  • the gateway network element may be configured not to add the non-network element IP to the route calculation between the gateway network element and the non-gateway network element when receiving the non-network element IP, for example, the gateway network element may be set. After receiving the packet sent by the network server, the non-network element IP is not added to the route calculation, so that the port connecting the gateway network element to the network server or the DCN does not participate in the route calculation, and the non-gateway network element does not exist. The route of the network server or DCN.
  • the settings in this step can be implemented by identification, including:
  • the method can set an identifier for the packet. After receiving the packet, the gateway network element does not send the packet to the route calculation module for routing calculation after the identifier is identified, that is, the gateway network element. After the identity is identified, the non-network element IP is not added to the route calculation.
  • the entity that sets the identifier in this embodiment may be a network server or a gateway network element.
  • the network server sets an identifier before sending a packet
  • the gateway network element sets an identifier after receiving the packet.
  • a port on the network server that is connected to the network server or the DCN network may be configured to send an identifier to a packet sent by the network server to the gateway network element and including the non-network element IP.
  • the gateway NE transmits the packet internally, the packet is not sent to the route calculation module for route calculation after the tag is identified.
  • Step 203 Configure a network server IP that is in the same network segment as the non-network element IP on the network server, and establish a connection with the gateway network element according to the network server IP and the non-network element IP.
  • the gateway network element is configured with the network element IP and the non-network element IP of different network segments, and the non-network element IP of the gateway network element in the method of the embodiment does not participate in the route calculation of the gateway network element. That is, the port connecting the gateway network element to the network server or the DCN does not participate in the route calculation; the network element IP is only used to establish a connection with the non-gateway network element, and the non-network element IP is only used to establish a connection with the network server;
  • the connection between the network server and the non-gateway network element of the gateway network element is not in the same network segment, and the non-gateway network element does not have a route to the network server or the DCN network, and cannot be directly accessed through the network server or the DCN network.
  • the connection implementation method of the embodiment improves the security of the non-gateway network element, and the connection implementation method of the embodiment of the present invention can occupy only one public network IP, thereby saving Public
  • Embodiment 2 is a diagrammatic representation of Embodiment 1:
  • This embodiment provides a connection implementation method, which is applied to the gateway network element side in the DCN system, as shown in FIG. 3, and includes the following steps:
  • Step 301 The gateway network element establishes a connection with the network server according to its own non-network element IP and network server IP.
  • This step can include:
  • the gateway network element After the receiving network server sends a request connection message according to the non-network element IP and its own IP, the gateway network element returns a connectable message to the network server;
  • the gateway network element then receives the connection establishment message sent by the network server, and establishes a connection with the network server according to the message.
  • Step 302 The gateway network element receives the non-network element IP of the gateway network element and the network element IP of the non-gateway network element sent by the network server.
  • the packet includes a non-network element IP as the destination IP and a corresponding list of the network element IP, the network element ID, and the network management ID of the non-gateway network element that is the content of the message.
  • Step 303 The gateway network element calculates a route between the gateway network element and the non-gateway network element according to the network element IP of the non-gateway network element and the network element IP of the gateway network element, and according to the The routing establishes a connection with the non-gateway network element.
  • the gateway network element After the gateway network element receives the corresponding list of the network element IP, the network element ID, and the network management ID of the non-gateway network element, the route between the non-gateway network element and the non-gateway network element is calculated according to the network element IP in the list and the IP address of the gateway network element; A connection to the non-gateway network element is then established based on the calculated route.
  • a NAT Network
  • IP IP
  • network element ID IP
  • network management ID IP
  • connection with the non-gateway network element Address Translation, Network Address Translation
  • This NAT table provides the basis for communication and maintenance between the network server and the non-gateway network element.
  • the step of establishing a connection with the non-gateway network element according to the route in this step includes:
  • the gateway network element sends a request connection message to the non-gateway network element by using the route;
  • the gateway network element initiates a connection request message to the non-gateway network element by using the route.
  • the connection method provided in this embodiment can enable the gateway network element to establish a connection with the non-gateway network element only according to the network element IP, and establish a connection with the network server according to the non-network element IP, because the non-network element IP does not participate in the route calculation,
  • the non-gateway network element does not have a route to the network server or the DCN.
  • the user cannot directly manage the non-gateway network element through the network server or the DCN, which improves the security of the non-gateway network element.
  • the implementation is performed.
  • the method further includes:
  • the gateway network element sets an identifier to the packet when receiving the packet that is sent by the network server and includes the non-network element IP, where the identifier is used to indicate that the gateway network element does not use the non-
  • the network element IP is added to the route calculation between the gateway network element and the non-gateway network element.
  • the port on the gateway network element sets an identifier to the packet when receiving the packet that is sent by the network server and includes the non-network element IP, where the port is the gateway network element and the The port to which the network server or DCN network is connected.
  • the port may set an identifier for the received message, so that the gateway network element does not replace the packet in the packet.
  • the NE IP is added to the route calculation.
  • the non-network element IP when the gateway NE is enabled on the network server, the non-network element IP is configured.
  • the non-network element IP cannot be in the same network segment as the network element IP, and the port connecting the gateway NE to the network server is enabled.
  • the gateway network element receives the packet sent by the network management server, the port will be tagged with the vlanY tag.
  • the application layer receives the packet of the VLAN tag, the non-network element IP will not be sent to the route calculation module. In this way, there will be no routes to this port (or to this non-network element IP) in other network elements. This ensures isolation between the non-network element IP and each network element IP. To ensure the security of the network element.
  • Embodiment 3 is a diagrammatic representation of Embodiment 3
  • This embodiment provides a connection implementation method, which is applied to both sides of a network server and a gateway network element in a DCN system, as shown in FIG. 4, and includes the following steps:
  • Step 401 Configure the network element IP of the gateway network element and the network element IP of the non-network element IP and the non-gateway network element on the network server.
  • the network element IP and the non-network element IP of the gateway network element are located in different network segments.
  • Step 402 Set the non-network element IP to not participate in route calculation between the gateway network element and the non-gateway network element.
  • Step 403 Configure a network server IP that is in the same network segment as the non-network element IP on the network server, and establish a connection with the gateway network element according to the network server IP and the non-network element IP.
  • Step 404 Send the network element IP of the gateway network element and the network element IP and the network element ID of the non-gateway network element to the gateway network element.
  • Step 405 The gateway network element calculates a route between the gateway network element and the non-gateway network element according to the network element IP of the non-gateway network element and the network element IP of the gateway network element, and according to the The routing establishes a connection with the non-gateway network element.
  • Embodiment 4 is a diagrammatic representation of Embodiment 4:
  • Step 501 Establish a connection between the gateway network element and the non-gateway network element by using the method described in Embodiment 3;
  • Step 502 The gateway network element generates a NAT table according to the network element ID of the non-gateway network element and the connection between the gateway network element and the non-gateway network element.
  • Step 503 The network server sends a management packet to the gateway network element, where the management packet includes: a network element ID and management content of the non-gateway network element to be managed;
  • the network element of the non-gateway network element that needs to be managed is sent by the network server, and the network element to be managed can be managed by the gateway network element.
  • Step 601 Create a network element on the network server, where the network element includes the network element IP, the network element ID, and the network management ID.
  • the port that connects with the DCN or the network server is set as the gateway network element port, so that the gateway network is used.
  • the meta port puts a tag of vlanY on the packet.
  • the network server When the network server is not configured with the gateway NE, the network server will be tagged with vlanX on the port. The communication between the NEs will also be vlanX. When the route between the NEs is calculated, the packets will be distinguished from different ports. Vlantag, in order to prevent routing calculation errors, causing network elements to be taken off.
  • the gateway NE When the gateway NE is enabled on the network server, the non-network element IP address is configured. The non-network element IP address cannot be in the same network segment as the network element IP address, and vlanY is enabled on the port where the gateway network element is connected to the network server. When receiving the packet sent by the network management server, the port will be tagged with vlanY.
  • the application layer When the application layer receives the packet from the VLAN tag, it will not send the IP to the route calculation module. In this way, there will be no such port (or route to the non-NE IP) in other network elements. This ensures isolation between the non-network element IP and each network element IP. To ensure the security of the network element.
  • Step 602 After setting the port as the gateway network element port, set the network element where the port is located as the gateway network element (that is, the network element connected to the DCN or the network server) on the network server; and configure the non-network element IP, this non The IP address of the NE and the IP address of the NE cannot be in the same network segment.
  • Step 604 Set, by using a setting command on the network server, all other network elements that meet the requirements of the gateway network element and meet the requirements of the gateway network element are set as the non-gateway network element of the gateway network element.
  • Step 605 The network server sends a corresponding list of the network element IP, the network element ID, and the network management ID of all non-gateway network elements to the gateway network element according to the setting of step 604.
  • Step 606 The gateway network element according to its own network element IP and the network element IP of the non-gateway network element in the list Calculate the route, form a routing table, and then establish a TCP connection between the gateway NE and all non-gateway NEs according to the routing table.
  • the process of establishing a TCP connection between the gateway network element and all non-gateway network elements according to the routing table in this step 606 is as follows:
  • the gateway network element initiates a request for establishing a connection by using a route in the routing table to the non-gateway network element;
  • the non-gateway network element After receiving the packet, the non-gateway network element queries the routing table and returns the packet that can be connected to the gateway NE.
  • the gateway network element saves the connection at the local application layer, and forms a NAT table with the network element IP, the network element ID, and the network management ID.
  • the application layer includes the network element IP, the network element ID, and the network management ID.
  • the application layer establishes a TCP connection on all non-gateway network elements according to the routing table of the network element IP through the protocol stack, so that the application layer is formed at the application layer.
  • a list of network element IP, network element ID, network management ID, and TCP connection. This NAT table provides the basis for communication and maintenance between the network server and the non-gateway network element.
  • Step 607 The network server only needs to send all the packets including the network element ID to the gateway network element, and the application layer of the gateway network element can correctly transmit the packet to the non-gateway network element according to the network element ID. Management of non-gateway network elements.
  • the network server in step 603 is a gateway network element managed by the non-network element IP, and performs data communication in the VLANY; the route calculation between the network element IPs in the step 606 is to establish a point-to-point connection through the PPPOE. And based on the routing calculation protocol.
  • This solution saves a lot of IP resources and makes the network element IP completely shielded by the gateway network element.
  • the process of establishing a TCP connection between the gateway network element and all non-gateway network elements according to the routing table in step 606 in this embodiment may include, as shown in FIG. 7:
  • the gateway network element sends a source IP (gateway network element IP), a source port number (randomly generated, for example, 1111), a destination IP (non-gateway network element IP), and a destination port number to the non-gateway network element through the route in the routing table. (9998) request to establish a connected message;
  • the non-gateway network element After receiving the packet, the non-gateway network element queries its own routing table and returns it to the gateway network element.
  • the gateway network element sends a source IP (gateway network element IP), a source port number (randomly generated, for example, 1111), a destination IP (non-gateway network element IP), and a destination port number to the non-gateway network element through the route in the routing table. (9998) the connection to establish the message;
  • the gateway network element saves the connection at the local application layer, and forms a NAT table with the network element IP, the network element ID, and the network management ID.
  • the address communicated by the DCN or the network server and the gateway network element system is only the non-network element IP, which ensures the saving of IP resources, and because the non-network element IP does not participate in the calculation of the routing protocol, this will All IPs of the NE are not visible in the DCN or the network server, thus greatly eliminating the security risks of the NE.
  • Embodiment 5 is a diagrammatic representation of Embodiment 5:
  • the embodiment provides a network server 80, which is applied to the DCN system, as shown in FIG. 8, comprising: an address configuration module 81, a setting module 82, a first connection establishing module 83, and a sending module 84;
  • the address configuration module 81 is configured to: configure a network element IP and a non-network element IP of the gateway network element, and a network element IP of the non-gateway network element, the network element IP and the non-network element of the gateway network element
  • the IP is located in different network segments; the network server configures the network server IP in the same network segment as the non-network element IP;
  • the setting module 82 is configured to: set the non-network element IP not to participate in route calculation between the gateway network element and the non-gateway network element;
  • the first connection establishing module 83 is configured to: establish a connection with the gateway network element according to the network server IP and the non-network element IP;
  • the sending module 84 is configured to: send the network element IP of the non-gateway network element to the gateway network element by using a packet, where the destination IP address of the packet is the non-network element IP, for the gateway network
  • the meta-establishment establishes a connection with a non-gateway network element.
  • This embodiment further provides a gateway network element 90, which is applied to the DCN system, as shown in FIG.
  • the method includes: a second connection establishing module 91, a receiving module 92, and a route calculating module 93;
  • the second connection establishing module 91 is configured to: establish a connection with the network server according to the non-network element IP and the network server IP, and establish a connection between the gateway network element and the non-gateway network element according to the route calculated by the route calculation module. Connection;
  • the receiving module 92 is configured to: receive the network element IP of the gateway network element and the network element IP of the non-gateway network element sent by the network server;
  • the route calculation module 93 is configured to calculate a route between the gateway network element and the non-gateway network element according to the network element IP of the non-gateway network element and the network element IP of the gateway network element.
  • the embodiment further provides a connection establishment system, which is applied to the DCN system, as shown in FIG. 10, comprising: the network server 80 as described above and the gateway network element 90 as described above.
  • the network server and the gateway network element provided in this embodiment cooperate with each other, so that the gateway network element is configured with the network element IP and the non-network element IP of different network segments, and the non-network element IP of the gateway network element is not involved in the gateway.
  • the route calculation of the network element that is, the port connecting the gateway network element to the network server or the DCN does not participate in the route calculation; the network element IP is only used to establish a connection with the non-gateway network element, and the non-network element IP is only used to establish a connection with the network server.
  • connection between the gateway network element and the network server, and the connection between the gateway network element and the non-gateway network element are not in the same network segment, and the non-gateway network element does not have a route to the network server or the DCN network, and cannot reach the network.
  • the server or the DCN network directly accesses the non-gateway network element, and the security of the non-gateway network element is improved compared with the related technology.
  • the connection establishment system in this embodiment can occupy only one public network IP, thereby saving the public network. IP resources make the application scenario more extensive.
  • the address that the DCN or the network server communicates with the gateway network element system is only the non-network element IP, thus ensuring the saving of the IP resources.
  • all or part of the steps of the above embodiments may also be implemented by using an integrated circuit. These steps may be separately fabricated into individual integrated circuit modules, or multiple modules or steps may be fabricated into a single integrated circuit module. achieve.
  • the device/function module/functional unit in the above embodiment When the device/function module/functional unit in the above embodiment is implemented in the form of a software function module and sold or used as a stand-alone product, it can be stored in a computer readable storage medium.
  • the above mentioned computer readable storage medium may be a read only memory, a magnetic disk or an optical disk or the like.
  • the gateway network element is configured with the network element IP and the non-network element IP of the network segment, and the non-network element IP of the gateway network element is not involved in the route calculation of the gateway network element.
  • the port connecting the gateway NE to the network server or the DCN does not participate in the route calculation; the network element IP is only used to establish a connection with the non-gateway network element, and the non-network element IP is only used to establish a connection with the network server; thus the gateway network element and the network
  • the connection between the server and the non-gateway network element of the gateway network element is not in the same network segment, and the non-gateway network element does not have a route to the network server or the DCN network, and cannot directly access the non-network through the network server or the DCN network.
  • the purpose of the gateway network element The security of the non-gateway network element is improved by the embodiment of the present invention.
  • the embodiment of the present invention can occupy only one public network IP, which saves the public network IP resource.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本文公布一种连接实现方法及系统、网络服务器和网关网元、管理方法。所述连接实现方法，包括：在网络服务器上配置网关网元的网元IP和非网元IP、非网关网元的网元IP，网关网元的网元IP和非网元IP位于不同的网段；设置所述非网元IP不参与所述网关网元与非网关网元之间的路由计算；在网络服务器上配置与非网元IP在同一个网段的网络服务器IP，并根据网络服务器IP和所述非网元IP与网关网元建立连接；将所述网关网元的网元IP和所述非网关网元的网元IP发送给所述网关网元，以供网关网元与非网关网元建立连接。

Description

连接实现方法、网络服务器和网关网元 技术领域
本申请涉及但不限于通讯技术领域。
背景技术
采用DCN(Data Communication Network，数据通信网络)系统来为网络设备提供管理接入、管理控制信息的通信功能，从而可以在网络管理服务器中心就完成对每个设备的远程部署和管理。
一个DCN系统网络由网络管理服务器、网关网元和非网关网元及它们之间的连接线路或网络构成；其中，网络管理服务器与网关网元实现连接且互相之间可以直接访问；
网关网元与多个与之直接或者间接连接的非网关网元构成一个系统，管理域内中的网关网元与多个非网关网元互相之间可以直接访问。
DCN系统内每个设备间直接互连的物理链路上，采用PPPOE(PPP over Ethernet，以太网上的点对点)协议，建立点到点逻辑链路通道，并在直连的端口上分配不同网段IP地址，然后在这些点到点链路通道通过OSPF(Open Shortest Path First，开放式最短路径优先)路由协议计算使每个网元得到到其他网元的路由信息。DCN系统内的网关网元和非网关网元之间通过所述路由信息实现DCN报文的传输。
在相关技术中，DCN系统的工作流程包括：
图1所示的DCN组网图，图中与DCN直接连接的为网关网元，未与DCN连接的网元1、网元2为非网关网元。在相关技术一种是网元1和网元2通过非网关网元在逻辑上与网管服务器直接连接，这样直接导致网元占用公网IP数量太多，导致IP资源紧缺；并且需要在网管服务器上配置多条路由，才能达到所有网元的同时管理，此时所有的网元都是处于随时可以登录的状态中，非常不安全。
另外一种相关技术是，通过网关网元管理网元1和网元2。在网络服务 器上直接配置一条静态路由即可以管理上网关网元，在通过网关网元管理非网关网元的网元1和网元2。但是此时网络服务器和网关网元连接的端口仍然参与网元直接的路由计算，即在非网关网元上仍然有到DCN和网关网元连接的路由。也没能完全使非网关网元处于安全之中。
发明内容
以下是对本文详细描述的主题的概述。本概述并非是为了限制权利要求的保护范围。
本文提供一种连接实现方法、网络服务器和网关网元,能够解决相关技术的DCM系统中非网关网元不安全的技术问题。
一种连接实现方法，应用于DCN系统，包括：
在网络服务器上配置网关网元的网元IP和非网元IP、非网关网元的网元IP，所述网关网元的网元IP和非网元IP位于不同的网段；
设置所述非网元IP不参与所述网关网元与非网关网元之间的路由计算；
在网络服务器上配置与所述非网元IP在同一个网段的网络服务器IP，并根据网络服务器IP和所述非网元IP与所述网关网元建立连接；
将所述网关网元的网元IP和所述非网关网元的网元IP发送给所述网关网元，以供网关网元与非网关网元建立连接。
可选地，所述设置所述非网元IP不参与所述网关网元与非网关网元之间的路由计算的步骤包括：
设置所述网关网元在接收到所述非网元IP时不将所述非网元IP添加到所述网关网元与非网关网元之间的路由计算中。
可选地，所述设置所述网关网元在接收到所述非网元IP时不将所述非网元IP添加到所述网关网元与非网关网元之间的路由计算中的步骤包括：
对所述网络服务器发送给所述网关网元且包含所述非网元IP的报文设置标识，所述标识用于指示所述网关网元不将所述非网元IP添加到所述网关网元与非网关网元之间的路由计算中。
可选地，所述对所述网络服务器发送给所述网关网元且包含所述非网元IP的报文设置标识的步骤包括：使能所述网关网元上与所述网络服务器或者DCN网络连接的端口对所述网络服务器发送给所述网关网元且包含所述非网元IP的报文设置标识。
可选地，所述标识包括：vlanY。
可选地，所述将所述网关网元的网元IP和所述非网关网元的网元IP发送给所述网关网元之后，所述方法还包括：
所述网关网元根据所述非网关网元的网元IP和所述网关网元的网元IP计算所述网关网元与所述非网关网元之间的路由，并根据所述路由建立与所述非网关网元之间的连接。
可选地，所述将所述网关网元的网元IP和所述非网关网元的网元IP发送给所述网关网元的步骤中，还包括：
将所述非网关网元的网元ID发送给所述网关网元；
所述网关网元根据所述非网关网元的网元IP和所述网关网元的网元IP计算所述网关网元与所述非网关网元之间的路由，并根据所述路由建立与所述非网关网元之间的连接之后，所述方法还包括：
所述网关网元根据所述非网关网元的网元ID、和所述网关网元与非网关网元之间的连接生成网络地址转换NAT表；
所述网络服务器发送管理报文给所述网关网元，所述管理报文包括:需要管理的非网关网元的网元ID和管理内容；
所述网关网元根据管理报文和所述NAT表对与所述网元ID对应的非网关网元进行管理。
一种连接实现方法，应用于DCN系统，包括：
网关网元根据自身的非网元IP和网络服务器IP，与所述网络服务器建立连接；
所述网关网元接收所述网络服务器发送的所述网关网元的非网元IP和所述非网关网元的网元IP；
所述网关网元根据所述非网关网元的网元IP和所述网关网元的网元IP计算所述网关网元与所述非网关网元之间的路由，并根据所述路由建立与所述非网关网元之间的连接。
可选地，在计算所述网关网元与所述非网关网元之间的路由之前，所述方法还包括：
所述网关网元在接收到所述网络服务器发送的且包含所述非网元IP的报文时对所述报文设置标识，所述标识用于指示所述网关网元不将所述非网元IP添加到所述网关网元与非网关网元之间的路由计算中。
可选地，所述网关网元在接收到所述网络服务器发送的且包含所述非网元IP的报文时对所述报文设置标识的步骤包括：
所述网关网元上的端口在接收到所述网络服务器发送的且包含所述非网元IP的报文时对所述报文设置标识，所述端口为所述网关网元上与所述网络服务器或者DCN网络连接的端口。
一种连接实现方法，应用于DCN系统，包括：
在网络服务器上配置网关网元的网元IP和非网元IP、非网关网元的网元IP，所述网关网元的网元IP和非网元IP位于不同的网段；
设置所述非网元IP不参与所述网关网元与非网关网元之间的路由计算；
在网络服务器上配置与所述非网元IP在同一个网段的网络服务器IP，并根据网络服务器IP和所述非网元IP与所述网关网元建立连接；
将所述网关网元的网元IP和所述非网关网元的网元IP、网元ID发送给所述网关网元；
所述网关网元根据所述非网关网元的网元IP和所述网关网元的网元IP计算所述网关网元与所述非网关网元之间的路由，并根据所述路由建立与所述非网关网元之间的连接。
一种管理方法，应用于DCN系统，包括：
利用如上所述的方法建立所述网关网元与非网关网元之间的连接；
所述网关网元根据所述非网关网元的网元ID、和所述网关网元与非网关 网元之间的连接生成NAT表；
所述网络服务器发送管理报文给所述网关网元，所述管理报文包括:需要管理的非网关网元的网元ID和管理内容；
所述网关网元根据管理报文和所述NAT表对与所述网元ID对应的非网关网元进行管理。
一种网络服务器，应用于DCN系统，包括：地址配置模块、设置模块、第一连接建立模块和发送模块；
所述地址配置模块，设置为：在网络服务器上配置网关网元的网元IP和非网元IP、非网关网元的网元IP，所述网关网元的网元IP和非网元IP位于不同的网段；在网络服务器配置与所述非网元IP在同一个网段的网络服务器IP；
所述设置模块，设置为：设置所述非网元IP不参与所述网关网元与非网关网元之间的路由计算；
所述第一连接建立模块，设置为：根据网络服务器IP和所述非网元IP与所述网关网元建立连接；
所述发送模块，设置为：通过报文将所述非网关网元的网元IP发送给所述网关网元，所述报文的目的IP为所述非网元IP，以供网关网元建立与非网关网元建立连接。
一种网关网元，应用于DCN系统，包括：第二连接建立模块、接收模块和路由计算模块；
所述第二连接建立模块，设置为：与所述网络服务器建立连接，和根据路由计算模块计算的路由建立与所述非网关网元之间的连接；
所述接收模块，设置为：接收所述网络服务器发送的所述网关网元的网元IP和非网关网元的网元IP；
所述路由计算模块，设置为：根据所述非网关网元的网元IP和所述网关网元的网元IP计算所述网关网元与所述非网关网元之间的路由。
一种连接实现系统，应用于DCN系统，包括如上所述的网络服务器和如上所述的网关网元。
一种计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令用于执行上述任一项的方法。
本发明实施例提供了一种连接实现方法及系统、网络服务器和网关网元、管理方法；本发明实施例的连接实现方法，包括：在网络服务器上配置网关网元的网元IP和非网元IP、非网关网元的网元IP，所述网关网元的网元IP和非网元IP位于不同的网段；设置所述非网元IP不参与所述网关网元与非网关网元之间的路由计算；在网络服务器上配置与所述非网元IP在同一个网段的网络服务器IP，并根据网络服务器IP和所述非网元IP与所述网关网元建立连接；将所述网关网元的网元IP和所述非网关网元的网元IP发送给所述网关网元，以供网关网元建立与非网关网元建立连接；本发明实施例的方法中网关网元配置有位于不同网段的网元IP和非网元IP，同时，本发明实施例方法中设置网关网元的非网元IP不参与网关网元的路由计算，即网关网元与网络服务器或者DCN连接的端口不参与路由计算；使得网元IP只用于与非网关网元建立连接，非网元IP只用于与网络服务器建立连接；这样网关网元与网络服务器的连接、和网关网元非网关网元之间的连接不在同一个网段中，且非网关网元不存在到网络服务器或者DCN网络的路由，达到无法通过网络服务器或者DCN网络直接访问非网关网元的目的，与相关技术相比，本发明实施例的连接实现方法提高了非网关网元的安全性；另外应用本发明实施例的连接实现方法可以只占用一个公网IP，节约了公网IP资源。
在阅读并理解了附图和详细描述后，可以明白其他方面。
附图概述
图1为相关技术中一种DCN系统的结构示意图；
图2为本发明实施例一提供的一种连接实现方法的流程示意图；
图3为本发明实施例二提供的一种连接实现方法的流程示意图；
图4为本发明实施例三提供的一种连接实现方法的流程示意图；
图5为本发明实施例四提供的一种管理方法的流程示意图；
图6为本发明实施例四提供的一种实现网元管理的流程示意图；
图7为本发明实施例四提供的一种网关网元与非网关网元建立连接的示意图；
图8为本发明实施例五提供的一种网络服务器的结构示意图；
图9为本发明实施例五提供的一种网关网元的结构示意图；
图10为本发明实施例五提供的一种连接实现系统的结构示意图。
本发明的实施方式
下面结合附图对本发明的实施方式进行说明。
实施例一：
考虑到相关技术的DCM系统中非网关网元存在到网络服务器或者DCN的路由导致非网关网元随时处于可登录状态从而致使非网关网元不安全的技术问题，本实施例提供了一种连接实现方法，应用于DCN系统中网络服务器侧，如图2所示，包括如下步骤：
步骤201：在网络服务器上配置网关网元的网元IP和非网元IP、非网关网元的网元IP，所述网关网元的网元IP和非网元IP位于不同的网段。
本实施例中网关网元是：与DCN系统中网络服务器或者DCN连接的端口所在的网元，例如图1所示DCN系统中的网关网元；
本实施例中非网关网元是：在DCN系统中可以与网关网元通信又满足需要网关网元管理的网元，例如图1所示DCN系统中网元1和网元2。
本步骤可以包括：
首先在网络服务器上配置DCN系统中所有网元的网元IP；
然后设置与DCN连接或者网络服务器连接的端口为网关网元端口，设置网关网元端口所在的网元为网关网元，并且配置网关网元的非网元IP，网元IP和非网元IP位于不同的网段；(此时即配置完了网关网元的网元IP和非网元IP)
最后设置与网关网元通信又满足需要网关网元管理的网元为非网关网元 (此时即配置完了非网关网元的网元IP)。
步骤202：设置所述非网元IP不参与所述网关网元与非网关网元之间的路由计算。
相关技术中网关网元在接收到网络服务器发送的报文之后，会将报文发送给路由计算模块进行路由计算，网络服务器发给网关网元的报文一般包括：作为源IP的网络服务器的IP、作为目的IP的非网元IP和报文体，因此非网元IP会参与网关网元与非网关网元之间的路由计算。
本实施例方法为不让报文中非网元IP参与路由计算，可以在网络服务器上设置所述非网元IP不参与所述网关网元与非网关网元之间的路由计算；
可以设置所述网关网元在接收到所述非网元IP时不将所述非网元IP添加到所述网关网元与非网关网元之间的路由计算中，例如可以设置网关网元在接收到网络服务器发送的报文之后，不将非网元IP添加到路由计算中，这样使得网关网元与网络服务器或者DCN连接的端口不参与路由计算，非网关网元就不会存在到网络服务器或者DCN的路由。
本步骤的设置可以通过标识来实现，包括：
对所述网络服务器发送给所述网关网元且包含所述非网元IP的报文设置标识，所述标识用于指示所述网关网元不将所述非网元IP添加到所述网关网元与非网关网元之间的路由计算中。
本实施例方法可以对报文设置标识，网关网元在接收到报文之后，识别到所述标识之后就不会将该报文发送至路由计算模块进行路由计算，也就是说，网关网元在识别到该标识之后，不会将非网元IP添加到路由计算中。
本实施例中设置标识的主体可以为网络服务器或者网关网元，例如网络服务器在发送报文之前设置标识，或者网关网元在接收到报文之后设置标识。
在网络服务器上可以使能所述网关网元上与所述网络服务器或者DCN网络连接的端口对所述网络服务器发送给所述网关网元且包含所述非网元IP的报文设置标识。
例如在网络服务器上使能网关网元与网络服务器连接的端口对接收到的 报文打上vlanY标签；网关网元在内部传输该报文时，识别到该标签后就不会将该报文发送至路由计算模块进行路由计算。
步骤203：在网络服务器上配置与所述非网元IP在同一个网段的网络服务器IP，并根据网络服务器IP和所述非网元IP与所述网关网元建立连接。
为了能够使得网络服务器与网关网元相互访问，本步骤是在配置一个与网关网元的非网元IP位于同一个网段的IP，这样就可以利用这两个IP计算网络服务器与网关网元之间的路由，然后根据路由建立连接。
步骤204：将所述网关网元的网元IP和所述非网关网元的网元IP发送给所述网关网元，以供网关网元与非网关网元建立连接。
本实施例的方法中网关网元配置有位于不同网段的网元IP和非网元IP，同时，本实施例方法中设置网关网元的非网元IP不参与网关网元的路由计算，即网关网元与网络服务器或者DCN连接的端口不参与路由计算；使得网元IP只用于与非网关网元建立连接，非网元IP只用于与网络服务器建立连接；这样网关网元与网络服务器的连接、和网关网元非网关网元之间的连接不在同一个网段中，且非网关网元不存在到网络服务器或者DCN网络的路由，达到无法通过网络服务器或者DCN网络直接访问非网关网元的目的，与相关技术相比，本实施例的连接实现方法提高了非网关网元的安全性；另外应用本发明实施例的连接实现方法可以只占用一个公网IP，节约了公网IP资源。
实施例二：
本实施例提供了一种连接实现方法，应用于DCN系统中网关网元侧，如图3所示，包括如下步骤：
步骤301：网关网元根据自身的非网元IP和网络服务器IP，与所述网络服务器建立连接。
本步骤可以包括：
网关网元在接收网络服务器根据非网元IP和其自身的IP发送请求连接报文之后，返回可以连接的报文给网络服务器；
之后网关网元接收网络服务器发送的建立连接报文，并根据该报文与网络服务器建立连接。
步骤302：所述网关网元接收所述网络服务器发送的所述网关网元的非网元IP和所述非网关网元的网元IP。
所述报文包含作为目的IP的非网元IP和作为报文内容的非网关网元的网元IP、网元ID和网管ID的对应列表。
步骤303：所述网关网元根据所述非网关网元的网元IP和所述网关网元的网元IP计算所述网关网元与所述非网关网元之间的路由，并根据所述路由建立与所述非网关网元之间的连接。
当网关网元接收到非网关网元的网元IP、网元ID和网管ID的对应列表之后，根据列表中的网元IP和网关网元的IP计算与非网关网元之间的路由；然后根据计算的路由建立与非网关网元之间的连接。
在建立与非网关网元之间的连接之后，还可以根据非网关网元的网元IP、网元ID和网管ID的对应列表，和与非网关网元之间的连接生成一个NAT(Network Address Translation，网络地址转换)表。此NAT表为网络服务器与非网关网元的通信与维护提供依据。
本步骤中根据所述路由建立与所述非网关网元之间的连接的步骤包括：
所述网关网元通过所述路由给所述非网关网元发送请求连接报文；
所述网关网元接收所述非网关网元返回的可以连接的报文；
所述网关网元通过所述路由对非网关网元发起建立连接请求报文。
本实施例提供的连接方法，可以使得网关网元仅仅根据网元IP建立与非网关网元的连接，根据非网元IP建立与网络服务器的连接，由于非网元IP不参与路由计算，所以非网关网元不存在与网络服务器或者DCN的路由，用户无法通过网络服务器或者DCN直接对非网关网元进行管理，提升了非网关网元的安全性。
在网络服务器使所述网关网元上与所述网络服务器或者DCN网络连接的端口对所述网络服务器发送给所述网关网元且包含所述非网元IP的报文设置标识时，本实施例方法，在步骤303之前，步骤301之后还包括：
所述网关网元在接收到所述网络服务器发送的且包含所述非网元IP的报文时对所述报文设置标识，所述标识用于指示所述网关网元不将所述非网元IP添加到所述网关网元与非网关网元之间的路由计算中。
所述网关网元上的端口在接收到所述网络服务器发送的且包含所述非网元IP的报文时对所述报文设置标识，所述端口为所述网关网元上与所述网络服务器或者DCN网络连接的端口。
本实施例方法中，根据网络服务器对于与所述网络服务器或者DCN网络连接的端口的设置，该端口可以对接收到报文设置标识，用以指示网关网元不将所述报文中的非网元IP添加到路由计算中。
例如，在网络服务器上使能网关网元时，会配置非网元IP，此非网元IP不能与网元IP在同一个网段，同时在网关网元与网络服务器连接的端口使能vlanY，这样在网关网元接收网管服务器发送的报文时，在此端口会打上vlanY的tag，应用层接受到此VLANtag的报文时，就不会将非网元IP发往路由计算模块。这样其他网元中就不会有到此端口(或者到此非网元IP)的路由。以此保证非网元IP与每个网元IP之间的隔离。以保证网元的安全。
实施例三：
本实施例提供了一种连接实现方法，应用于DCN系统中网络服务器和网关网元两侧，如图4所示，包括如下步骤：
步骤401：在网络服务器上配置网关网元的网元IP和非网元IP、非网关网元的网元IP，所述网关网元的网元IP和非网元IP位于不同的网段。
步骤402：设置所述非网元IP不参与所述网关网元与非网关网元之间的路由计算。
使所述网关网元上与所述网络服务器或者DCN网络连接的端口对所述网络服务器发送给所述网关网元且包含所述非网元IP的报文设置标识，所述标识用于指示所述网关网元不将所述非网元IP添加到所述网关网元与非网关网元之间的路由计算中。例如使网关网元端口对接收到的报文打上vlanY的tag，这样网关网元在内部数据传输时，就不会将该报文发送给路由计算模 块，即非网元IP不参与路由计算。
步骤403：在网络服务器上配置与所述非网元IP在同一个网段的网络服务器IP，并根据网络服务器IP和所述非网元IP与所述网关网元建立连接。
步骤404：将所述网关网元的网元IP和所述非网关网元的网元IP、网元ID发送给所述网关网元。
步骤405：所述网关网元根据所述非网关网元的网元IP和所述网关网元的网元IP计算所述网关网元与所述非网关网元之间的路由，并根据所述路由建立与所述非网关网元之间的连接。
本实施例提供的连接方法中网关网元配置有位于不同网段的网元IP和非网元IP，同时，本实施例方法中设置网关网元的非网元IP不参与网关网元的路由计算，即网关网元与网络服务器或者DCN连接的端口不参与路由计算；使得网元IP只用于与非网关网元建立连接，非网元IP只用于与网络服务器建立连接；这样网关网元与网络服务器的连接、和网关网元非网关网元之间的连接不在同一个网段中，且非网关网元不存在到网络服务器或者DCN网络的路由，达到无法通过网络服务器或者DCN网络直接访问非网关网元的目的，与相关技术相比，本实施例的连接实现方法提高了非网关网元的安全性；另外应用本实施例的连接实现方法可以只占用一个公网IP，节约了公网IP资源，使得应用场景更加广泛。
实施例四：
本实施例提供了一种管理方法，应用于DCN系统，如图5所示，包括下步骤：
步骤501：利用实施例三所述的方法建立所述网关网元与非网关网元之间的连接；
步骤502：所述网关网元根据所述非网关网元的网元ID、和所述网关网元与非网关网元之间的连接生成NAT表；
步骤503：所述网络服务器发送管理报文给所述网关网元，所述管理报文包括:需要管理的非网关网元的网元ID和管理内容；
步骤504：所述网关网元根据管理报文和所述NAT表对与所述网元ID对应的非网关网元进行管理。
利用本实施例方法，只需在网络服务器下发需要管理的非网关网元的网元ID，即可通过网关网元对需要管理的网元进行管理。
下面介绍应用本实施例管理方法的过程，如图6所示，包括如下步骤：
步骤601：在网络服务器上创建网元，此网元包含网元IP、网元ID和网管ID，创建网元后设置与DCN连接或者网络服务器的连接的端口为网关网元端口，使网关网元端口对报文打上vlanY的tag。
在未配置网关网元时网络服务器在与网元通信时，报文在端口会打上vlanX的标签，网元间通信同样走的是vlanX，网元间路由计算时，会区分从不同端口来的vlantag，这样以便防止路由计算错误，导致网元脱管。在网络服务器上使能网关网元时，会配置非网元IP，此非网元IP不能与网元IP在同一个网段，同时在网关网元与网络服务器连接的端口使能vlanY，这样在接收到网管服务器发送的报文时，在此端口会打上vlanY的tag，应用层接受到此VLANtag的报文时，就不会将此IP发往路由计算模块。这样其他网元中就不会有到此端口(或者到此非网元IP的路由)。以此保证非网元IP与每个网元IP之间的隔离。以保证网元的安全。
步骤602：设置端口为网关网元端口后，在网络服务器上，设置此端口所在的网元为网关网元(即与DCN或者网络服务器连接的网元)；并且配置非网元IP，此非网元IP与网元IP不能在同一个网段。
步骤603：在网络服务器上设置与非网元IP在同一个网段的IP，使网络服务器与网关网元可以相互访问。
步骤604：在网络服务器上通过设置命令，将其他所有即满足可以与网关网元通信又满足需要网关网元管理的网元，设置为此网关网元的非网关网元。
步骤605：网络服务器根据步骤604的设置，给网关网元下发所有非网关网元的网元IP、网元ID和网管ID的对应列表。
步骤606：网关网元根据自身的网元IP和此列表中非网关网元的网元IP 计算路由，形成路由表，然后根据路由表建立网关网元与所有非网关网元的TCP连接。
本步骤606中根据路由表建立网关网元与所有非网关网元的TCP连接的过程如下：
首先网关网元通过路由表内的路由给非网关网元发起一个请求建立连接的报文；
然后非网关网元接收到此报文后，查询自己的路由表后返回给网关网元可以连接的报文；
最后网关网元通过路由表内的路由给非网关网元发起建立连接的报文；
此时网关网元同时在本地应用层保存此连接，并且同网元IP、网元ID和网管ID形成一个NAT表。
应用层根据此列表，此列表包含网元IP、网元ID和网管ID，应用层根据网元IP通过协议栈的路由表，来建立于所有非网关网元TCP连接，这样在应用层会形成一个列表，其中包含网元IP、网元ID、网管ID及TCP连接。此NAT表为网络服务器与非网关网元的通信与维护提供依据。
步骤607：网络服务器只需将包含网元ID的所有报文下发给网关网元即可，网关网元的应用层就可以根据此网元ID将报文正确传递给非网关网元，实现对非网关网元的管理。
整个过程中，步骤603中网络服务器是通过非网元IP管理的网关网元，并且是在VLANY中进行数据通信；步骤606中的网元IP之间的路由计算，是通过PPPOE点对点建链，并根据路由计算协议运算得来。该方案节省了大量的IP资源，并且使网元IP完全被网关网元屏蔽掉。
本实施例中步骤606中根据路由表建立网关网元与所有非网关网元的TCP连的过程可以包括，如图7所示：
首先网关网元通过路由表内的路由给非网关网元发起一个包含源IP(网关网元IP)、源端口号(随机生成例如1111)、目的IP(非网关网元IP)、目的端口号(9998)的请求建立连接的报文；
然后非网关网元接收到此报文后，查询自己的路由表后返回给网关网元 一个包含源IP(非网关网元IP)、源端口号(9998)、目的IP(网关网元IP)、目的端口号(随机生成1111)的接收到请求并且可以连接的报文；
最后网关网元通过路由表内的路由给非网关网元发起一个包含源IP(网关网元IP)、源端口号(随机生成例如1111)、目的IP(非网关网元IP)、目的端口号(9998)的建立连接的报文；
此时网关网元同时在本地应用层保存此连接，并且同网元IP、网元ID和网管ID形成一个NAT表。
通过以步骤我们可以看出，DCN或者网络服务器与网关网元系统通信的地址只有非网元IP，这样保证了IP资源的节省，同时由于非网元IP不参与路由协议的计算，这样会使网元所有IP在DCN或者网络服务器内都不可见，从而大大消除了网元的安全隐患。
实施例五：
本实施例提供了一种网络服务器80，应用于DCN系统，如图8所示，包括：地址配置模块81、设置模块82、第一连接建立模块83和发送模块84；
所述地址配置模块81，设置为：在网络服务器上配置网关网元的网元IP和非网元IP、非网关网元的网元IP，所述网关网元的网元IP和非网元IP位于不同的网段；在网络服务器配置与所述非网元IP在同一个网段的网络服务器IP；
所述设置模块82，设置为：设置所述非网元IP不参与所述网关网元与非网关网元之间的路由计算；
所述第一连接建立模块83，设置为：根据网络服务器IP和所述非网元IP与所述网关网元建立连接；
所述发送模块84，设置为：通过报文将所述非网关网元的网元IP发送给所述网关网元，所述报文的目的IP为所述非网元IP，以供网关网元建立与非网关网元建立连接。
本实施例还提供了一种网关网元90，应用于DCN系统，如图9所示， 包括：第二连接建立模块91、接收模块92和路由计算模块93；
所述第二连接建立模块91，设置为：根据自身的非网元IP和网络服务器IP与网络服务器建立连接，以及根据路由计算模块计算的路由建立所述网关网元与非网关网元之间的连接；
所述接收模块92，设置为：接收所述网络服务器发送的所述网关网元的网元IP和非网关网元的网元IP；
所述路由计算模块93，设置为：根据所述非网关网元的网元IP和所述网关网元的网元IP计算所述网关网元与所述非网关网元之间的路由。
本实施例还提供了一种连接建立系统，应用于DCN系统，如图10所示，包括：如上所述的网络服务器80和如上所述的网关网元90。
本实施例提供的网络服务器与网关网元相互配合，可以使网关网元配置有位于不同网段的网元IP和非网元IP，同时，本设置网关网元的非网元IP不参与网关网元的路由计算，即网关网元与网络服务器或者DCN连接的端口不参与路由计算；使得网元IP只用于与非网关网元建立连接，非网元IP只用于与网络服务器建立连接；这样网关网元与网络服务器的连接、和网关网元非网关网元之间的连接不在同一个网段中，且非网关网元不存在到网络服务器或者DCN网络的路由，达到无法通过网络服务器或者DCN网络直接访问非网关网元的目的，与相关技术相比，提高了非网关网元的安全性；另外应用本实施例的连接建立系统可以只占用一个公网IP，节约了公网IP资源，使得应用场景更加广泛。DCN或者网络服务器与网关网元系统通信的地址只有非网元IP，这样保证了IP资源的节省。
本领域普通技术人员可以理解上述实施例的全部或部分步骤可以使用计算机程序流程来实现，所述计算机程序可以存储于一计算机可读存储介质中，所述计算机程序在相应的硬件平台上(如系统、设备、装置、器件等)执行，在执行时，包括方法实施例的步骤之一或其组合。
可选地，上述实施例的全部或部分步骤也可以使用集成电路来实现，这些步骤可以被分别制作成一个个集成电路模块，或者将它们中的多个模块或步骤制作成单个集成电路模块来实现。
上述实施例中的装置/功能模块/功能单元可以采用通用的计算装置来实 现，它们可以集中在单个的计算装置上，也可以分布在多个计算装置所组成的网络上。
上述实施例中的装置/功能模块/功能单元以软件功能模块的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。上述提到的计算机可读取存储介质可以是只读存储器，磁盘或光盘等。
工业实用性
本发明实施例中网关网元配置有位于不同网段的网元IP和非网元IP，同时，本发明实施例中设置网关网元的非网元IP不参与网关网元的路由计算，即网关网元与网络服务器或者DCN连接的端口不参与路由计算；使得网元IP只用于与非网关网元建立连接，非网元IP只用于与网络服务器建立连接；这样网关网元与网络服务器的连接、和网关网元非网关网元之间的连接不在同一个网段中，且非网关网元不存在到网络服务器或者DCN网络的路由，达到无法通过网络服务器或者DCN网络直接访问非网关网元的目的。通过本发明实施例提高了非网关网元的安全性；另外，应用本发明实施例可以只占用一个公网IP，节约了公网IP资源。

Claims (13)

  1. 一种连接实现方法，应用于数据通信网络DCN系统，包括：
    在网络服务器上配置网关网元的网元IP和非网元IP、非网关网元的网元IP，所述网关网元的网元IP和非网元IP位于不同的网段；
    设置所述非网元IP不参与所述网关网元与非网关网元之间的路由计算；
    在网络服务器上配置与所述非网元IP在同一个网段的网络服务器IP，并根据网络服务器IP和所述非网元IP与所述网关网元建立连接；
    将所述网关网元的网元IP和所述非网关网元的网元IP发送给所述网关网元，以供网关网元与非网关网元建立连接。
  2. 如权利要求1所述的方法，其中，所述设置所述非网元IP不参与所述网关网元与非网关网元之间的路由计算的步骤包括：
    设置所述网关网元在接收到所述非网元IP时不将所述非网元IP添加到所述网关网元与非网关网元之间的路由计算中。
  3. 如权利要求2所述的方法，其中，所述设置所述网关网元在接收到所述非网元IP时不将所述非网元IP添加到所述网关网元与非网关网元之间的路由计算中的步骤包括：
    对所述网络服务器发送给所述网关网元且包含所述非网元IP的报文设置标识，所述标识用于指示所述网关网元不将所述非网元IP添加到所述网关网元与非网关网元之间的路由计算中。
  4. 如权利要求3所述的方法，其中，所述对所述网络服务器发送给所述网关网元且包含所述非网元IP的报文设置标识的步骤包括：
    使能所述网关网元上与所述网络服务器或者DCN网络连接的端口对所述网络服务器发送给所述网关网元且包含所述非网元IP的报文设置标识。
  5. 如权利要求4所述的方法，其中，所述标识包括：vlanY。
  6. 如权利要求1所述的方法，其中，所述将所述网关网元的网元IP和所述非网关网元的网元IP发送给所述网关网元之后，所述方法还包括：
    所述网关网元根据所述非网关网元的网元IP和所述网关网元的网元IP计算所述网关网元与所述非网关网元之间的路由，并根据所述路由建立与所 述非网关网元之间的连接。
  7. 如权利要求6所述的方法，其中，所述将所述网关网元的网元IP和所述非网关网元的网元IP发送给所述网关网元的步骤中，还包括：
    将所述非网关网元的网元ID发送给所述网关网元；
    所述网关网元根据所述非网关网元的网元IP和所述网关网元的网元IP计算所述网关网元与所述非网关网元之间的路由，并根据所述路由建立与所述非网关网元之间的连接之后，所述方法还包括：
    所述网关网元根据所述非网关网元的网元ID、和所述网关网元与非网关网元之间的连接生成网络地址转换NAT表；
    所述网络服务器发送管理报文给所述网关网元，所述管理报文包括:需要管理的非网关网元的网元ID和管理内容；
    所述网关网元根据管理报文和所述NAT表对与所述网元ID对应的非网关网元进行管理。
  8. 一种连接实现方法，应用于DCN系统，包括：
    网关网元根据自身的非网元IP和网络服务器IP，与所述网络服务器建立连接；
    所述网关网元接收所述网络服务器发送的所述网关网元的非网元IP和所述非网关网元的网元IP；
    所述网关网元根据所述非网关网元的网元IP和所述网关网元的网元IP计算所述网关网元与所述非网关网元之间的路由，并根据所述路由建立与所述非网关网元之间的连接。
  9. 如权利要求8所述的方法，其中，在计算所述网关网元与所述非网关网元之间的路由之前，所述方法还包括：
    所述网关网元在接收到所述网络服务器发送的且包含所述非网元IP的报文时对所述报文设置标识，所述标识用于指示所述网关网元不将所述非网元IP添加到所述网关网元与非网关网元之间的路由计算中。
  10. 如权利要求9所述的方法，其中，所述网关网元在接收到所述网络服务器发送的且包含所述非网元IP的报文时对所述报文设置标识的步骤包括：
    所述网关网元上的端口在接收到所述网络服务器发送的且包含所述非网元IP的报文时对所述报文设置标识，所述端口为所述网关网元上与所述网络服务器或者DCN网络连接的端口。
  11. 一种网络服务器，应用于DCN系统，包括：地址配置模块、设置模块、第一连接建立模块和发送模块；
    所述地址配置模块，设置为：在网络服务器上配置网关网元的网元IP和非网元IP、非网关网元的网元IP，所述网关网元的网元IP和非网元IP位于不同的网段；在网络服务器配置与所述非网元IP在同一个网段的网络服务器IP；
    所述设置模块，设置为：设置所述非网元IP不参与所述网关网元与非网关网元之间的路由计算；
    所述第一连接建立模块，设置为：根据网络服务器IP和所述非网元IP与所述网关网元建立连接；
    所述发送模块，设置为：通过报文将所述非网关网元的网元IP发送给所述网关网元，所述报文的目的IP为所述非网元IP，以供网关网元建立与非网关网元建立连接。
  12. 一种网关网元，应用于DCN系统，包括：第二连接建立模块、接收模块和路由计算模块；
    所述第二连接建立模块，设置为：根据自身的非网元IP和网络服务器IP与网络服务器建立连接，以及根据路由计算模块计算的路由建立所述网关网元与非网关网元之间的连接；
    所述接收模块，设置为：接收所述网络服务器发送的所述网关网元的网元IP和非网关网元的网元IP；
    所述路由计算模块，设置为：根据所述非网关网元的网元IP和所述网关网元的网元IP计算所述网关网元与所述非网关网元之间的路由。
  13. 一种计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令用于执行权利要求1-10任一项的方法。
PCT/CN2015/097153 2014-12-30 2015-12-11 连接实现方法、网络服务器和网关网元 WO2016107392A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201410853267.5A CN105812166B (zh) 2014-12-30 2014-12-30 连接实现方法及系统、网络服务器和网关网元、管理方法
CN201410853267.5 2014-12-30

Publications (1)

Publication Number Publication Date
WO2016107392A1 true WO2016107392A1 (zh) 2016-07-07

Family

ID=56284204

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/097153 WO2016107392A1 (zh) 2014-12-30 2015-12-11 连接实现方法、网络服务器和网关网元

Country Status (2)

Country Link
CN (1) CN105812166B (zh)
WO (1) WO2016107392A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111917621B (zh) * 2019-05-10 2021-09-07 烽火通信科技股份有限公司 通信设备的网管服务器与网元的通信方法及系统

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101141281A (zh) * 2006-09-06 2008-03-12 中兴通讯股份有限公司 一种网管和非网关网元通讯的方法
US7694021B1 (en) * 2003-05-28 2010-04-06 Cisco Technology, Inc. Firewall for gateway network elements between IP based networks
CN102308523A (zh) * 2011-07-27 2012-01-04 华为技术有限公司 数据通信网络配置方法、网关网元及数据通信系统
US20130232251A1 (en) * 2012-03-01 2013-09-05 Justin Pauley Network Appliance for Monitoring Network Requests for Multimedia Content

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN100571223C (zh) * 2006-07-28 2009-12-16 中兴通讯股份有限公司 网关网元倒换的方法
EP2141884B1 (en) * 2008-07-04 2011-01-12 Alcatel Lucent Anti-intrusion method and system for a communication network
CN101764703B (zh) * 2009-09-16 2011-12-21 深圳市震有科技有限公司 一种基于虚拟技术的网元管理系统的实现方法
CN102594608B (zh) * 2012-03-16 2014-08-20 华为技术有限公司 一种网元管理方法、装置及系统
CN104104553A (zh) * 2013-04-09 2014-10-15 中兴通讯股份有限公司 一种网元检测方法及装置

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7694021B1 (en) * 2003-05-28 2010-04-06 Cisco Technology, Inc. Firewall for gateway network elements between IP based networks
CN101141281A (zh) * 2006-09-06 2008-03-12 中兴通讯股份有限公司 一种网管和非网关网元通讯的方法
CN102308523A (zh) * 2011-07-27 2012-01-04 华为技术有限公司 数据通信网络配置方法、网关网元及数据通信系统
US20130232251A1 (en) * 2012-03-01 2013-09-05 Justin Pauley Network Appliance for Monitoring Network Requests for Multimedia Content

Also Published As

Publication number Publication date
CN105812166A (zh) 2016-07-27
CN105812166B (zh) 2020-06-12

Similar Documents

Publication Publication Date Title
JP7004405B2 (ja) 仮想ネットワークにおける分散型フロー状態ｐ２ｐ設定のためのシステムおよび方法
US11863625B2 (en) Routing messages between cloud service providers
US20130185446A1 (en) Method and device for connecting to virtual private network across domains
US9007945B2 (en) Automated network service discovery and communication
CN106452857B (zh) 生成配置信息的方法和网络控制单元
WO2018028606A1 (zh) 转发策略配置
TWI538461B (zh) 用於在虛擬區域網路中管理雲端裝置之管理伺服器及其管理方法
US12021699B2 (en) Software defined access fabric without subnet restriction to a virtual network
CN104468368B (zh) 配置bgp邻居的方法及装置
WO2017028398A1 (zh) 通信处理方法和装置
WO2009149646A1 (zh) 端口切换方法、网络设备及网络系统
US11522754B2 (en) Systems and methods for Zero-Touch Provisioning of a switch in intermediate distribution frames and main distribution frames
WO2018171722A1 (zh) Mac地址同步
US10257118B2 (en) Implementation method and device for VLAN to access VF network, and FCF
CN112688817B (zh) 基于政务云的网络业务下发方法、系统、装置及存储介质
JP2020522202A (ja) レイヤ３通信実施
CN108512737B (zh) 一种数据中心ip层互联的方法和sdn控制器
WO2016107392A1 (zh) 连接实现方法、网络服务器和网关网元
WO2024108493A1 (zh) 基于sdn与ndn的虚实结合动态流量调度方法及装置
US20240244029A1 (en) Controller-based distributed remote access with static public ip avoidance
US20210051076A1 (en) A node, control system, communication control method and program
CN104518937A (zh) 虚拟局域网vlan多设备间通信的方法及装置
JP6270383B2 (ja) アクセス制御装置、アクセス制御方法、及びプログラム
WO2016065769A1 (zh) 一种路由设备管理方法、主用主控单元和线卡单元
WO2012122824A1 (zh) 报文注册的方法、交换机

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15875070

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 15875070

Country of ref document: EP

Kind code of ref document: A1