WO2016138813A1

WO2016138813A1 - Switch routing conflict processing method and apparatus

Info

Publication number: WO2016138813A1
Application number: PCT/CN2016/073604
Authority: WO
Inventors: 林宁
Original assignee: 中兴通讯股份有限公司
Priority date: 2015-03-05
Filing date: 2016-02-05
Publication date: 2016-09-09
Also published as: RU2017133755A; RU2714383C2; RU2017133755A3; CN105991428A; CN105991428B

Abstract

The present invention provides a switch routing conflict processing method and apparatus, the method including: obtaining information of a port through which a designated message enters into a switch, wherein the designated message carries identification information of a virtual local area network VLAN and each port has a corresponding virtual private network VPN; determining the VPN which the designated message routing belongs to according to the identification information and port information. The present invention solves the routing conflict problem in the related technology caused by determining the VPN which the message routing belongs to just by the identification information, thus achieving the effect of reducing the switch routing conflict.

Description

Method and device for processing switch routing conflict

Technical field

The present invention relates to the field of communications, and in particular, to a method and apparatus for processing a route conflict of a switch.

Background technique

The Layer 3 switch product of the routing function in the related art is based on a virtual local area network (VLAN) for Layer 3 interface configuration. All routing configurations and virtual private network (VPN) configurations are based on VLANs.

The routing sub-interface function of the Layer 3 switch is based on the configuration of one port and one VLAN. That is, one physical port can be configured with multiple routing sub-interfaces of different VLANs. Usually, the routing configuration of these sub-interfaces and the configuration of the VPN where the routes are located. They are all set based on the individual VLANs in which the sub-interface is located.

The steps of configuring the routing sub-interface of the switch product in the related art include:

Step S11: Configure a routing sub-interface and a VLAN to which the sub-interface belongs. The switch adds the physical port of the sub-interface to the VLAN to which the sub-interface belongs.

Step S12: Complete the configuration of the VLAN Layer 3 interface according to the configured routing sub-interface VLAN.

Step S13: The routing information and the VPN information of the route are configured on the Layer 3 interface where the VLAN is located.

The steps of forwarding the Layer 3 packet forwarding of the switch sub-interface of the switch in the related art include:

Step S21: The packet that needs to be forwarded by the sub-interface to carry the Layer 3 packet carries the VLAN tag corresponding to the sub-interface to enter the physical interface corresponding to the sub-interface;

Step S22: The switch searches for the Layer 3 interface of the corresponding VLAN according to the VLAN tag (VLAN identifier) carried in the packet, obtains the Layer 3 interface information, and finds the VPN information of the route according to the VLAN tag.

Step S23: According to the routing VPN information and the destination IP address in the Layer 3 packet, look up the routing table of the switch and perform route forwarding.

It can be seen that although the related art can implement the configuration and forwarding of the routing sub-interface on the switch, there is a limitation in the setting. If a routing sub-interface is configured and a VLAN is bound, then the VLAN is A Layer 3 interface is configured separately, and routing conflicts may occur on the forwarding.

For example, if the routing sub-interface subport1 is configured, the attribute is that physical port 1 is bound to VLAN 100 and configured. IP address 123.1.1.1/24.

A VLAN 100 Layer 3 interface is configured on the switch. This VLAN contains physical port 2 and is configured with route VPN A. In this case, the VLAN 100 Layer 3 interface is not in the same VPN as the subinterface 1 and therefore the VLAN 100 Layer 3 interface. The same IP address can be configured as 123.1.1.1/24.

At this time, if a packet carries the destination IP address 123.1.1.1 and VLAN tag 100 to enter port 1, we expect that this packet will hit the host route of interface address 123.1.1.1 of subport1, but the VPN attribute of VLAN 100 is It is configured in VPN A, and the sub-interface 1 of the routing sub-interface is also in the VLAN 100. Therefore, when the packet is forwarded, the packet is searched according to the VLAN tag 100 carried in the packet. Directly hit the VPN attribute of VLAN 100, that is, find that the VPN to which this route belongs should be A.

It can be seen that the desired packet forwarding cannot be completed in the related technology. This packet will hit the host route of the VLAN 100 Layer 3 interface, 123.1.1.1 under VPN A, and will not hit the host route of the subport1 to which the sub-interface belongs. In such a state, a route conflict will cause the sub-interface function to fail.

For the related art, the problem of routing conflicts occurs when the VPN tag is found by the VLAN tag, and an effective solution has not been proposed yet.

Summary of the invention

The main purpose of the embodiment of the present invention is to provide a method and a device for processing a route conflict of a switch, so as to at least solve the problem that a route conflict occurs when a VPN is found by using a VLAN tag to search for a VPN.

According to an aspect of the embodiments of the present invention, a method for processing a switch routing conflict is provided, which includes: obtaining port information of a specified packet entering a switch, where the specified packet carries identifier information of a virtual local area network VLAN, and each The port has a corresponding virtual private network VPN; and the VPN to which the specified packet route belongs is determined according to the identifier information and the port information.

Optionally, the port information includes first physical port information corresponding to the sub-interface, and second physical port information corresponding to the third-layer interface.

Optionally, when the port information is the first physical port information, determining, according to the identifier information and the port information, the VPN to which the specified packet route belongs includes: configuring the first physical port information according to a predetermined rule. Corresponding relationship with the identifier information; modifying the route VPN of the specified packet to the VPN to which the specified packet route belongs according to the corresponding relationship.

Optionally, the manner of configuring the correspondence between the first physical port information and the identifier information according to a predetermined rule includes: configuring the first physical port information according to an access control list ACL and the Corresponding relationship between the first physical port information and the identification information is configured according to the VLAN translation; and the first physical port information and the identification information are pre-configured by the microcode chip Correspondence.

Optionally, when the port information is the second physical port information, determining, according to the identifier information and the port information, the VPN to which the specified packet route belongs includes: determining the specified according to the identifier information The VPN to which the packet route belongs.

According to another aspect of the present invention, a device for processing a switch route conflict is provided, including: an obtaining module, configured to obtain port information of a specified packet entering a switch, where the specified packet carries a virtual local area network VLAN The identifier information, each port has a corresponding virtual private network VPN; the determining module is configured to determine, according to the identifier information and the port information, the VPN to which the specified packet route belongs.

Optionally, when the port information is the first physical port information, the determining module includes: a configuration unit, configured to configure a correspondence between the first physical port information and the identifier information according to a predetermined rule The relationship unit is configured to modify the route VPN of the specified packet to be the VPN to which the specified packet route belongs according to the correspondence.

Optionally, the configuration unit includes one of the following: a first configuration unit, configured to configure a correspondence between the first physical port information and the identification information according to an access control list ACL; and a second configuration unit, The third configuration unit is configured to pre-configure between the first physical port information and the identifier information by using a microcode chip, to configure a correspondence between the first physical port information and the identifier information according to the VLAN translation. Correspondence.

Optionally, when the port information is the second physical port information, the determining module is further configured to determine, according to the identifier information, a VPN to which the specified packet route belongs.

In the embodiment of the present invention, the port information of the specified packet entering the switch and the identification information of the VLAN of the specified packet are used to determine the VPN to which the specified packet belongs, because each port has a corresponding VPN. The VPN to which the packet belongs can be uniquely determined, thereby solving the problem that the related technology only determines the VPN to which the packet route belongs by using the identification information, and thus the routing conflict occurs, thereby achieving the effect of reducing the routing conflict of the switch.

DRAWINGS

The drawings described herein are intended to provide a further understanding of the invention, and are intended to be a part of the invention. In the drawing:

1 is a flowchart of a method for processing a switch route conflict according to an embodiment of the present invention;

2 is a structural block diagram of a processing apparatus for a switch route conflict according to an embodiment of the present invention;

3 is a block diagram of an optional structure of a processing device for routing conflicts of a switch according to an embodiment of the present invention;

4 is a block diagram 2 of an optional structure of a processing device for routing conflicts of a switch according to an embodiment of the present invention;

5 is a schematic diagram of a route conflict between a routing sub-interface and a VLAN Layer 3 interface in the related art;

6 is a schematic diagram of avoiding route conflict between a routing sub-interface and a VLAN Layer 3 interface according to an alternative embodiment of the present invention;

7 is a flow chart of a method for preventing a route collision by a routing sub-interface according to an alternative embodiment of the present invention.

detailed description

It should be noted that the embodiments in the present application and the features in the embodiments may be combined with each other without conflict. The invention will be described in detail below with reference to the drawings in conjunction with the embodiments.

This embodiment provides a method for processing a route conflict of a switch. FIG. 1 is a flowchart of a method for processing a route conflict of a switch according to an embodiment of the present invention. As shown in FIG. 1 , the steps of the method include:

Step S102: Obtain port information of the specified packet entering the switch.

The specified packet carries the identification information of the VLAN of the virtual local area network, and each port has a corresponding virtual private network VPN;

Step S104: Determine, according to the identifier information and the port information, the VPN to which the specified packet route belongs.

In this embodiment, the port information of the specified packet entering the switch and the identification information of the VLAN of the specified packet are used to determine the VPN to which the specified packet belongs, because each port has a corresponding VPN, so that The problem is that the VPN to which the packet belongs is uniquely determined, thereby solving the problem that the routing information is determined by the identification information to determine the VPN to which the packet route belongs, thereby reducing the routing conflict of the switch.

The port information related to the embodiment may include: the first physical port information corresponding to the sub-interface and the second physical port information corresponding to the Layer 3 interface. The following examples are used to describe the embodiment in the following two types of port information:

When the port information is the physical port information corresponding to the sub-interface, the method for determining the virtual private network VPN to which the packet routing belongs according to the identifier information and the port information in step S104 in this embodiment is an optional implementation in this embodiment. In the manner, it can be implemented in the following manner, the steps of the method include:

Step S31: Configure a correspondence between the first physical port information and the identification information according to a predetermined rule.

Step S32: Modify the route VPN of the specified packet to be the VPN to which the specified packet route belongs according to the correspondence.

The manner of configuring the correspondence between the first physical port information and the identification information according to the predetermined rule in the foregoing step S31 can be implemented in the following manner in one embodiment:

Manner 1: The correspondence between the first physical port information and the identification information is configured according to an access control list (ACL).

For example, the switch first sets the ports 1, 2, and 3 in the VLAN 100. Secondly, the ACL rule is used to match the ingress port 1 and carry the VLAN tag 100. Then, the action of setting the ACL rule is to modify the route. The VPN is VPN 0. It should be noted that the VPN is not set on the sub-interface here, so the default is that the global route VPN is 0. Finally, the VPN to which the VLAN 100 belongs is set to VPN A.

Manner 2: The correspondence between the first physical port information and the identification information is configured according to the VLAN translation.

For example, first, the switch sets ports 1, 2, and 3 in VLAN 100. Secondly, using VLAN translation, setting VLAN translation port 1 and VLAN 100, the translation action is routing VPN to VPN 0. It should be noted that the sub-interface is not Set the VPN, so the default is to set the global route VPN to 0. Then, set the VPN to which the VLAN 100 belongs to be VPN A. When a packet carrying VLAN tag 100 enters the switch from port 1, the matching ACL rule is captured. The action of entering the ACL changes the route VPN to VPN 0. When a packet carrying VLAN tag 100 enters the switch from port 2 or 3, it directly matches the VPN A to which VLAN 100 belongs. After the above mode, the sub-interface routes are forwarded to the VLAN. There is no conflict in route forwarding.

Manner 3: pre-configure a correspondence between the first physical port information and the identification information by using the microcode chip;

For example, first, the switch sets ports 1, 2, and 3 in VLAN 100. Secondly, establishes a forwarding relationship table of port1+VLAN100 pointing to route VPN 0 in the microcode chip, so that the packet carrying VLAN tag 100 entering from port 1 is obtained. The routing VPN is 0. It should be noted that the VPN is not set on the sub-interface. Therefore, the default is that the global routing VPN is 0. Then, the VPN with the VLAN 100 route is set to VPN A. When there is a packet carrying the VLAN tag 100, When port 1 enters the switch, the matching ACL rule is captured. The action of entering the ACL changes the route VPN to VPN 0. When a packet carrying VLAN tag 100 enters the switch from port 2 or 3, it directly matches VLAN 100. VPN A. According to the above method, there is no conflict between sub-interface routing forwarding and VLAN routing forwarding.

In another optional implementation manner of this embodiment, when the port information is the second physical port information, The step S104 in the embodiment determines the manner of the virtual private network VPN to which the specified message route belongs according to the identification information and the port information, and can be implemented as follows:

The virtual private network VPN to which the specified packet route belongs is determined according to the identification information. That is to say, packets that need to be forwarded by the Layer 3 interface of the VLAN will still use the VLAN tag carried in the original packet to find the VLAN information of the switch to determine the route VPN.

In the embodiment, a processing device for the switch routing conflict is further provided, and the device is used to implement the foregoing embodiment and the optional implementation manner, and details are not described herein. As used below, the term "module" "unit" may implement a combination of software and/or hardware of a predetermined function. Although the apparatus described in the following embodiments is preferably implemented in software, hardware, or a combination of software and hardware, is also possible and contemplated.

2 is a structural block diagram of a device for processing a route conflict of a switch according to an embodiment of the present invention. As shown in FIG. 2, the device includes: an obtaining module 22, configured to obtain port information of a specified packet entering a switch, where a specified packet is carried. There is identification information of the virtual local area network (VLAN) VLAN; the determining module 24 is configured to determine, according to the identification information and the port information, the virtual private network VPN to which the specified message route belongs.

In this embodiment, the port information includes port information of the sub-interface and port information of the layer 3 interface.

3 is a block diagram of an optional structure of a processing device for routing conflicts of a switch according to an embodiment of the present invention. As shown in FIG. 3, when the port information is the first physical port information, the determining module 24 includes: a configuration unit 32, configured as The predetermined rule configures the correspondence between the port information and the identification information of the sub-interface; the modifying unit 34 is configured to modify the routing VPN of the specified packet to be the VPN to which the specified packet route belongs according to the correspondence.

4 is a block diagram 2 of an optional structure of a processing device for routing conflicts of a switch according to an embodiment of the present invention. As shown in FIG. 4, the configuration unit 32 includes one of the following: a first configuration unit 42 configured to be configured according to an access control list ACL. Corresponding relationship between the first physical port information and the identification information; the second configuration unit 44 is configured to configure a correspondence between the first physical port information and the identification information according to the VLAN translation; the third configuration unit 46 is configured to pass the micro The code chip pre-configures a correspondence between the first physical port information and the identification information.

In addition, in the embodiment, when the port information is the second physical port information, the module 24 is further determined to determine, according to the identifier information, the virtual private network VPN to which the specified packet route belongs.

The present invention is exemplified by an optional embodiment of the embodiment of the present invention;

The optional embodiment uses the physical port and the VLAN value of the attributes of the sub-interface to uniquely determine the characteristics of a sub-interface to ensure that the configuration of the sub-interface does not conflict with the Layer 3 interface of the VLAN.

In the related art, the sub-interface and the VLAN-layer interface use the VLAN tag carried in the packet to match the VPN to which the VLAN belongs to determine the VPN for routing and forwarding. Therefore, the routing conflict in the above case occurs. In this In an alternative embodiment, not only the VLAN tag but also the physical interface and the VLAN tag to which the sub-interface belongs are used to determine the VPN to which the route forwarding belongs.

In an application scenario of the present embodiment, physical port information is available when a packet is entered into the switch. In this case, the physical port information of the obtained packet entering the switch is added. The VLAN tag carried in the packet is used to determine the VPN to which the route belongs. These two properties just happen to be able to uniquely identify a subinterface.

In the above manner of the optional embodiment, the VPN of each sub-interface can be uniquely determined, and the VPN information of all sub-interfaces is uniquely determined by the port+VLAN mode, and the VPN information of the VLAN-layer interface still passes. The VLAN value is determined, so that the VPN information selection of the sub-interface can be completed without an incorrect routing conflict due to the configuration of the VPN attribute of the VLAN Layer 3 interface.

In this alternative embodiment, if a switch using an ASIC chip implements a port+VLAN to determine a routed VPN, the access control list ACL can be used to match the input port of the packet and the VLAN carried by the packet, and then modify the The routing of the packet forwards the VPN information. You can also use the VLAN translation method to match the special field of the port+VLAN to change the VPN information of the route. It should be noted that the above two methods are only used for illustration. If the switch uses other network processors, other methods can be used to match the two key values of port+VLAN to determine the sub-interface three. Layer forwarding routing VPN information.

The above manner of this alternative embodiment may include the following steps:

Step S202: The switch needs to use the port information to which the sub-interface belongs and the VLAN information configured on the sub-interface to form a port+VLAN to determine the relationship table of the route VPN to which the sub-interface belongs.

Step S204: When the packet enters the sub-interface, it searches for the VPN to which the route to which the packet belongs, according to the physical port information of the packet entering the switch and the VLAN tag information to which the packet belongs.

Step S206: The packet forwarded by the Layer 3 interface of the VLAN still uses the VLAN tag carried in the original packet to find the VLAN information of the switch to determine the route VPN.

The physical port of the Layer 3 interface of the VLAN cannot be in conflict with the physical port of the sub-interface. Therefore, the physical port to which the Layer 3 interface belongs does not appear in the relationship table of the route-to-VLAN.

Through the above steps S202 to S206, the routing forwarding between the routing sub-interface of the switch and the Layer 3 VLAN interface can be completed without any conflict.

With the optional embodiment, the physical port information of the packet entering the switch and the VLAN information carried in the packet are simultaneously determined by the routing and forwarding VPN of the packet, and the sub-interface and the VLAN are connected. There is no longer any conflict in the routed VPN forwarding of the port, and no evasive configuration and configuration restrictions are required.

The following describes the optional embodiment by using three specific application scenarios:

Application scenario 1: Use ACL rules to avoid setting conflicts on sub-interface routes.

First, the switch sets ports 1, 2, and 3 in VLAN 100. Secondly, the ACL rules are used to match the ingress port 1 and carry the VLAN tag 100. Then, the action of setting the ACL rule is to modify the route VPN. For VPN 0, it should be noted that the VPN is not set on the sub-interface here, so the default is that the global route VPN is 0. Finally, the VPN with the route to which VLAN 100 belongs is set to VPN A.

Application scenario 2: Using VLAN translation to complete the setting of avoiding sub-interface routing conflicts;

First, the switch sets ports 1, 2, and 3 in VLAN 100. Secondly, VLAN translation is used to set VLAN translation port 1 and VLAN 100. The translation action is route VPN to VPN 0. It should be noted that VPN is not set on the sub-interface. Therefore, the default is that the global route VPN is 0. Then, the VPN with the route to which VLAN 100 belongs is set to VPN A. When a packet carrying VLAN tag 100 enters the switch from port 1, the matching ACL rule is captured and entered. The action of the ACL is to modify the route VPN to be VPN 0. When a packet carrying VLAN tag 100 enters the switch from port 2 or 3, it directly matches the VPN A to which VLAN 100 belongs. After the above mode, the sub-interface routes are forwarded and VLAN-routed. There will be no conflicts.

Application scenario 3: using a microcode chip to complete the setting of avoiding sub-interface routing conflicts;

First, the switch sets the ports 1, 2, and 3 in the VLAN 100. Secondly, the port1+VLAN 100 is set to the forwarding relationship table of the route VPN 0 in the microcode chip, so that the packet carrying the VLAN tag 100 entering the port 1 is routed to the VPN. It is 0. It should be noted that the VPN is not set on the sub-interface, so the default is that the global route VPN is 0. Then, the VPN with the VLAN 100 route is set to VPN A; when there is a packet carrying the VLAN tag 100, the packet enters the switch from port 1. The matching ACL rule is captured. The action of entering the ACL changes the route VPN to VPN 0. When a packet carrying VLAN tag 100 enters the switch from port 2 or 3, it directly matches the VPN A to which VLAN 100 belongs. According to the above method, there is no conflict between sub-interface route forwarding and VLAN routing forwarding.

It can be seen from the technical solution of the foregoing optional embodiment that, compared with the method for implementing the routing sub-interface by the switch in the related art, the optional embodiment uses the port and the VLAN to form a unique correspondence method with the routing VPN, so that the switch The interface configuration no longer has any constraints. It can exist at the same time as the common VLAN configuration of the switch, and there is no conflict and interference between routing and forwarding. Therefore, the configuration of the routing sub-interface can be more flexible and unconstrained, eliminating the switch. The usage limit of the routing sub-interface improves the usage range of the routing sub-interface of the switch.

5 is a schematic diagram of a route conflict between a routing sub-interface and a VLAN Layer 3 interface in the related art, as shown in FIG. 5, The two ports are configured with a Layer 3 interface VLAN and the other one is configured with a sub-interface VLAN. When the two VLANs are the same, if the corresponding processing is not performed, the packets entering the two ports will be routed according to the VLAN. VPNs can cause VPN conflicts in routing, because any one of them configures a different VPN, and the other one will be affected.

FIG. 6 is a schematic diagram of avoiding route conflict between a routing sub-interface and a VLAN Layer 3 interface according to an alternative embodiment of the present invention. As shown in FIG. 6 , a corresponding processing method, such as any one of the application scenarios 1 to 3 above, is used. The processing method is to make a corresponding decision on the VPN of the sub-interface. The port and the VLAN of the sub-interface jointly determine the VPN, and the VPN can be distinguished from the VPN of the three-layer interface, so that the VPNs of the two modes do not affect each other. There is no routing conflict.

FIG. 7 is a flowchart of a method for preventing a route conflict by a routing sub-interface according to an alternative embodiment of the present invention. As shown in FIG. 7, the steps of the method include:

Step S702: Configure a routing sub-interface;

Step S704: setting a preset routing VPN decision policy by using the port information and the VLAN information of the routing sub-interface;

The preset VPN-determined policy can be implemented by using ACL, VLAN translation, and microcode.

Step S706: If a packet that needs to be forwarded by the Layer 3 packet enters the routing sub-interface, the VPN information is determined by the port information and the VLAN information carried in the packet.

With the optional embodiment, when the sub-interface and the VLAN interface are configured at the same time, no evasive configuration is required, and the two interfaces can be used normally without interference.

Obviously, those skilled in the art should understand that the above modules or steps of the present invention can be implemented by a general-purpose computing device, which can be concentrated on a single computing device or distributed over a network composed of multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device such that they may be stored in the storage device for execution by the computing device and, in some cases, may be performed in a different order than herein. The steps shown or described are either made separately into individual integrated circuit modules, or a plurality of modules or steps are fabricated as a single integrated circuit module. Thus, the invention is not limited to any specific combination of hardware and software.

The above is only an alternative embodiment of the present invention, and is not intended to limit the present invention, and various modifications and changes can be made to the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and scope of the present invention are intended to be included within the scope of the present invention.

Industrial applicability

Claims

A method for processing a switch route conflict includes:

Obtaining the port information of the specified packet entering the switch, where the specified packet carries the identification information of the VLAN of the virtual local area network, and each port has a corresponding virtual private network VPN;

Determining, according to the identifier information and the port information, a VPN to which the specified packet route belongs.
The method of claim 1, wherein the port information comprises first physical port information corresponding to the sub-interface and second physical port information corresponding to the third-layer interface.
The method according to claim 2, wherein, when the port information is the first physical port information, determining, according to the identifier information and the port information, the VPN to which the specified packet route belongs includes:

And configuring a correspondence between the first physical port information and the identifier information according to a predetermined rule;

Modifying, by the corresponding relationship, the route VPN of the specified packet to the VPN to which the specified packet route belongs.
The method according to claim 3, wherein the manner of configuring the correspondence between the first physical port information and the identification information according to a predetermined rule comprises one of the following:

And configuring, according to the access control list ACL, a correspondence between the first physical port information and the identifier information;

And configuring, according to the VLAN translation, a correspondence between the first physical port information and the identifier information;

Corresponding relationship between the first physical port information and the identification information is pre-configured by a microcode chip.
The method of claim 2, wherein, when the port information is the second physical port information, determining, according to the identifier information and the port information, the VPN to which the specified packet route belongs includes:

Determining, according to the identifier information, the VPN to which the specified packet route belongs.
A processing device for routing conflicts of a switch includes:

The obtaining module is configured to obtain the port information of the specified packet entering the switch, where the specified packet carries the identification information of the virtual local area network VLAN, and each port has a corresponding virtual private network VPN;

And a determining module, configured to determine, according to the identifier information and the port information, a VPN to which the specified packet route belongs.
The apparatus according to claim 6, wherein the port information comprises a first physical end corresponding to the sub-interface Port information and second physical port information corresponding to the Layer 3 interface.
The apparatus according to claim 7, wherein when the port information is the first physical port information, the determining module comprises:

a configuration unit, configured to configure a correspondence between the first physical port information and the identifier information according to a predetermined rule;

The modifying unit is configured to modify the routing VPN of the specified packet to be the VPN to which the specified packet routing belongs according to the corresponding relationship.
The apparatus of claim 8 wherein said configuration unit comprises one of:

a first configuration unit, configured to configure a correspondence between the first physical port information and the identifier information according to an access control list ACL;

a second configuration unit, configured to configure, according to the VLAN translation, a correspondence between the first physical port information and the identifier information;

The third configuration unit is configured to pre-configure a correspondence between the first physical port information and the identification information by using a microcode chip.
The apparatus according to claim 7, wherein when said port information is said second physical port information,

The determining module is further configured to determine, according to the identifier information, a VPN to which the specified packet route belongs.