WO2016150205A1

WO2016150205A1 - Method, device and system for processing vxlan message

Info

Publication number: WO2016150205A1
Application number: PCT/CN2015/097523
Authority: WO
Inventors: 查敏; 刘树成
Original assignee: 华为技术有限公司
Priority date: 2015-03-23
Filing date: 2015-12-15
Publication date: 2016-09-29
Also published as: CN106161225B; CN106161225A

Abstract

Provided are a method, device and system for processing a VXLAN message, which are helpful to a router between different data centres to obtain a VNI. In the method, a first router receives a VXLAN message sent by a VTEP, the VXLAN message comprising a VNI; the first router obtains an encapsulated message according to the VXLAN message, the encapsulated message being a message obtained after IPsec-ESP encapsulation is performed on the VXLAN message, and the encapsulated message comprising an IP header, the VNI, an ESP header and the encrypted VXLAN message, wherein the VNI is encapsulated between the IP header and the ESP header; and the first router sends the encapsulated message to a second router.

Description

Method, device and system for processing VXLAN messages

The present application claims priority to Chinese Patent Application No. 201510127449.9, entitled "Method, Apparatus and System for Processing VXLAN Messages", filed on March 23, 2015, the entire contents of which are incorporated by reference. Combined in this application.

Technical field

The present invention relates to communication technologies, and in particular, to a method, device, and system for processing a virtual extensible local area network (English name: VXLAN) message.

Background technique

VXLAN can be applied to the data center to enable virtual machines to migrate within a three-layer network that is connected to each other without changing the Internet Protocol (English full name: Internet Protocol, IP address) and media access control. : Media Access Control, English abbreviation: MAC) address, to ensure business continuity. The Internet Protocol Security (English Protocol: IPSec) protocol ensures secure and secure communication over IP networks by using encrypted security services. Encapsulating Security Payload (English full name: ESP) protocol is a major protocol in the IPsec protocol. IPsec-ESP can be applied to different data centers (English name: Data Center, English abbreviation: DC) Communication scenario.

In a different inter-DC communication scenario, such as a scenario in which DC1 and DC2 communicate, the first router belonging to DC1 can receive the virtual tunnel endpoint (English full name: virtual tunnel end point, English abbreviation: VTEP) that belongs to DC1. VXLAN message. The first router performs IPsec-ESP encapsulation on the received VXLAN packet to obtain an IPsec-ESP packet. The IPsec-ESP packet includes the encrypted VXLAN packet, the ESP header encapsulated in the encrypted VXLAN packet, and the IP header encapsulated in the ESP header. The IP header includes a source IP address and a destination IP address, the source IP address is the IP address of the first router, and the destination IP address is the IP address of the second router. The second router belongs to DC2. The first router sends an IPsec-ESP packet to the second router.

The router located between the first router and the second router can forward the IPsec-ESP packet. However, the router on the transmission path between the first router and the second router cannot detect the VXLAN packet included in the IPsec-ESP packet. The information related to VXLAN, such as the VXLAN network identifier (VXLAN Network Identifier, English abbreviation: VNI), can not perform service processing such as load sharing.

Summary of the invention

In view of this, the embodiments of the present invention provide a method, an apparatus, and a system for processing a VXLAN message, which are helpful for a router between different data centers to obtain a VNI.

The technical solutions provided by the embodiments of the present invention are as follows.

In a first aspect, a method for processing a VXLAN message is provided, including:

The first router receives the VXLAN message sent by the VTEP, where the VXLAN message includes a VNI;

The first router obtains the encapsulated packet according to the VXLAN packet, and the encapsulated packet is a packet obtained by performing IPsec-ESP encapsulation on the VXLAN packet, and the encapsulated packet is obtained. The file includes an IP header, the VNI, an ESP header, and the encrypted VXLAN message, and the VNI is encapsulated between the IP header and the ESP header;

The first router sends the encapsulated packet to the second router.

In a first possible implementation manner of the first aspect, the IP header includes first identifier information, where the first identifier information is used to identify that the encapsulated packet carries the VNI.

In conjunction with the foregoing first aspect, a second possible implementation manner of the first aspect is further provided, where the encapsulated packet further includes a user data packet protocol encapsulated between the IP header and the VNI (English full name : User Datagram Protocol (English abbreviation: UDP) header, the UDP header is a UDP header included in the VXLAN message from the VTEP;

The IP header includes first identifier information, where the first identifier information is used to identify that the encapsulated packet carries the UDP header, and the UDP header encapsulated between the IP header and the VNI The second identifier information is used to identify that the encapsulated packet carries the VNI.

In a second aspect, a method for processing a VXLAN message is provided, including:

The second router receives the encapsulated packet sent by the first router, and the encapsulated packet is a packet obtained by performing IPsec-ESP encapsulation on the VXLAN packet from the VTEP, and the encapsulated packet includes the IP packet. a header, a VNI, an ESP header, and the encrypted VXLAN message, the VNI being encapsulated between the IP header and the ESP header;

The second router obtains the VNI from the encapsulated message.

In a first possible implementation manner of the second aspect, the IP header includes first identifier information, where the first identifier information is used to identify that the encapsulated packet carries the VNI, and the second Obtaining the VNI from the encapsulated message by the router includes:

The second router determines, according to the first identifier information included in the IP header, that the encapsulated packet includes the VNI;

The second router obtains the VNI from between the IP header and the ESP header.

With the second aspect, the second possible implementation of the second aspect is further provided, the encapsulated packet further includes a UDP header encapsulated between the IP header and the VNI, the UDP header For the UDP header included in the VXLAN packet from the VTEP, the IP header includes first identifier information, where the first identifier information is used to identify that the encapsulated packet carries the UDP header. The UDP header encapsulated between the IP header and the VNI includes second identifier information, where the second identifier information is used to identify that the encapsulated packet carries the VNI;

Obtaining, by the second router, the VNI from the encapsulated packet includes:

The second router obtains a UDP header encapsulated between the IP header and the VNI according to the first identifier information included in the IP header;

The second router determines that the encapsulated packet includes the VNI according to the second identifier information included in a UDP header encapsulated between the IP header and the VNI;

In a third aspect, a first router is provided, including:

a receiving unit, configured to receive a VXLAN message sent by the VTEP, where the VXLAN message includes VNI;

a processing unit, configured to obtain, according to the VXLAN packet, a encapsulated packet, where the encapsulated packet is a packet obtained by performing IPsec-ESP encapsulation on the VXLAN packet, and the encapsulated packet The file includes an IP header, the VNI, an ESP header, and the encrypted VXLAN message, and the VNI is encapsulated between the IP header and the ESP header;

And a sending unit, configured to send the encapsulated packet to the second router.

In a first possible implementation manner of the third aspect, the IP header includes first identifier information, where the first identifier information is used to identify that the encapsulated packet carries the VNI.

With the foregoing third aspect, a second possible implementation manner of the third aspect is further provided, the encapsulated packet further includes a UDP header encapsulated between the IP header and the VNI, the UDP header a UDP header included in the VXLAN message from the VTEP;

In a fourth aspect, a second router is provided, including:

The receiving unit is configured to receive the encapsulated packet sent by the first router, where the encapsulated packet is a packet obtained by performing IPsec-ESP encapsulation on the VXLAN packet from the VTEP, where the encapsulated packet is obtained. The packet includes an IP header, a VNI, an ESP header, and the encrypted VXLAN packet, where the VNI is encapsulated between the IP header and the ESP header;

And a processing unit, configured to obtain the VNI from the encapsulated message.

In a first possible implementation manner of the fourth aspect, the IP header includes first identifier information, where the first identifier information is used to identify that the encapsulated packet carries the VNI;

The processing unit is specifically configured to determine, according to the first identifier information that is included in the IP header, that the encapsulated packet includes the VNI;

The processing unit is specifically configured to obtain the VNI from between the IP header and the ESP header.

With the foregoing fourth aspect, a second possible implementation manner of the fourth aspect is further provided, the encapsulated packet further includes a UDP header encapsulated between the IP header and the VNI, and the UDP header For the UDP header included in the VXLAN packet from the VTEP, the IP header includes first identifier information, where the first identifier information is used to identify that the encapsulated packet carries the UDP header. The UDP header encapsulated between the IP header and the VNI includes second identifier information, where the second identifier information is used to identify that the encapsulated packet carries the VNI;

The processing unit is configured to obtain, according to the first identifier information included in the IP header, a UDP header encapsulated between the IP header and the VNI;

The processing unit is configured to determine, according to the second identifier information that is included in a UDP header that is encapsulated between the IP header and the VNI, that the encapsulated packet includes the VNI;

In a fifth aspect, a system for processing a VXLAN message is provided, including:

The first router provided by any one of the foregoing third aspect or the third aspect, and the second router provided by any one of the foregoing fourth or fourth possible implementation manners.

With the above solution, in the method, device, and system for processing a VXLAN message, the first router performs IPsec-ESP encapsulation on the VXLAN packet sent by the VTEP to obtain the encapsulated packet. The first router encapsulates the VNI included in the VXLAN message sent by the VTEP between the IP header and the ESP header included in the encapsulated packet. The first router sends the encapsulated packet to the second router. The second router obtains a VNI encapsulated between the IP header and the ESP header from the encapsulated packet. In this way, routers located between different data centers, such as the second router, can obtain the VNI from the received encapsulated message.

DRAWINGS

In order to more clearly illustrate the embodiments of the present invention or the prior art, the drawings used in the embodiments will be briefly described below. It is obvious that the drawings in the following description are some implementations of the present invention. For example, for those skilled in the art, without creative labor Further drawings can also be obtained from these drawings.

FIG. 1 is a flowchart of a method for processing a VXLAN message according to a first embodiment of the present invention;

2 is a flowchart of a method for processing a VXLAN message according to a second embodiment of the present invention;

FIG. 3 is a schematic diagram of a packaged packet according to an embodiment of the present disclosure;

FIG. 3b is a schematic diagram of another encapsulated packet according to an embodiment of the present disclosure;

4a is a schematic diagram of a packaged packet according to an embodiment of the present invention;

FIG. 4b is a schematic diagram of another encapsulated packet according to an embodiment of the present disclosure;

FIG. 5 is a schematic diagram of an IP header included in a encapsulated packet according to an embodiment of the present disclosure;

FIG. 6 is a schematic diagram of a UDP header included in a encapsulated packet according to an embodiment of the present disclosure;

FIG. 7 is a schematic structural diagram of a first router according to an embodiment of the present disclosure;

FIG. 8 is a schematic structural diagram of a first router according to another embodiment of the present disclosure;

FIG. 9 is a schematic structural diagram of a second router according to an embodiment of the present disclosure;

FIG. 10 is a schematic structural diagram of a second router according to another embodiment of the present invention;

FIG. 11 is a schematic structural diagram of a system for processing a VXLAN packet according to an embodiment of the present invention.

detailed description

The technical solutions in the embodiments of the present invention will be clearly and completely described in conjunction with the drawings in the embodiments of the present invention. It is a partial embodiment of the invention, and not all of the embodiments. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

FIG. 1 is a flowchart of a method for processing a VXLAN message according to a first embodiment of the present invention. The first embodiment of the present invention describes a method for processing a VXLAN message from the perspective of the first router. The first router may be an operator edge (English full name: provider edge, English abbreviation: PE) device. A method for processing a VXLAN message according to the first embodiment of the present invention will be described below with reference to FIG.

S102. The first router receives the VXLAN packet sent by the VTEP, where the VXLAN packet is sent. Including VNI.

For example, in a communication scenario between different DCs, the first router may belong to DC1. The VTEP in DC1 can encapsulate the service packets sent by the virtual machine (English name: virtual machine, English abbreviation: VM) into VXLAN packets to obtain VXLAN packets. The VXLAN message obtained by the VTEP in DC1 includes the VNI. The VXLAN message obtained by the VTEP in DC1 needs to be sent to a VM in another DC, such as a VM in DC2. The first router can receive the VXLAN message sent by the VTEP in DC1. Among them, VNI can be used to distinguish between different VXLANs. For example: a VNI can be used to identify a tenant.

S104, the first router obtains the encapsulated packet according to the VXLAN packet, and the encapsulated packet is a packet obtained by performing IPsec-ESP encapsulation on the VXLAN packet, and the encapsulated packet is encapsulated. The message includes an IP header, the VNI, an ESP header, and the encrypted VXLAN message, and the VNI is encapsulated between the IP header and the ESP header.

For example, the first router may insert a VNI included in the VXLAN message between the IP header and the ESP header included in the encapsulated packet.

For example, the first router obtains the encapsulated packet according to the VXLAN packet, the first router obtains the VNI from the VXLAN packet, and the first router pairs the VXLAN packet. The IPsec-ESP encapsulation packet is obtained by the IPsec-ESP encapsulation packet, and the IPsec-ESP encapsulation packet includes an encrypted VXLAN packet, an ESP header encapsulated in the encrypted VXLAN packet, and an IP header encapsulated in the ESP header. The first router inserts the VNI into the encapsulated packet between the IP header included in the IPsec-ESP encapsulated packet and the ESP header. The encapsulated message may be the message shown in FIG. 3a or 3b. The packet shown in FIG. 3a is a encapsulated message sent by using the transmission (English name is transport) mode. The IP header included in the message shown in FIG. 3a can adopt the structure shown in FIG. The packet shown in Figure 3b is a encapsulated packet sent in the tunnel (English name tunnel) mode. The intranet IP header included in the packet shown in Figure 3b is the IP header included in the VXLAN packet sent by the VTEP to the first router. The IP header included in the message shown in FIG. 3b can adopt the structure shown in FIG. 5. The encrypted VXLAN message in Figure 3a and Figure 3b is VTEP. The packets obtained after the VXLAN is sent are encrypted. The content of the encrypted VXLAN packets is not described here.

For example, the first router obtains the encapsulated packet according to the VXLAN packet, the first router obtains the VNI from the VXLAN packet, and the first router pairs the VXLAN packet. Performing encryption to obtain an encrypted VXLAN message; the first router encapsulates the ESP header, the VNI, and the IP header layer by layer outside the encrypted VXLAN message. The encapsulated message may be the message shown in FIG. 3a or 3b.

Optionally, the IP header that is included in the encapsulated packet may further include first identifier information, where the first identifier information is used to identify that the encapsulated packet carries the VNI.

For example, if the encapsulated packet of FIG. 3a or FIG. 3b includes an IP header, the IP header shown in FIG. 5 is used. The first identification information shown may be carried in the protocol number field in the IP header shown in FIG. In this embodiment, the protocol number field in the IP header shown in FIG. 5 can be used to indicate the packet type after the IP header. For example, the protocol number field is defined as “ESP/VXLAN”, which is used to indicate the IP header. The packet type is an ESP packet that encapsulates the VXLAN header. The ESP packet encapsulating the VXLAN header may be a VXLAN header that includes the VNI in the ESP packet, or may be encapsulated in the ESP packet. The first router may update the information included in the IP header after adding the VNI between the ESP header and the IP header. As shown in FIG. 5, the first router may add a protocol number field, a total length field, and a head table to the IP header after the VNI is added between the ESP header and the IP header. The checksum field is updated so that the encapsulated message of the VNI is increased to meet the format requirement.

Optionally, the first router may obtain a VXLAN header from a VXLAN message from the VTEP, the VXLAN header including the VNI. The first router encapsulates the VXLAN header included in the VXLAN packet between the IP header and the ESP header to obtain a encapsulated packet. In this way, the first router can eliminate the need to identify and acquire the VNI from the VXLAN message from the VTEP, which helps to simplify the operation. The method for obtaining the encapsulated packet including the VXLAN header by the first router is the same as the method for obtaining the encapsulated packet including the VNI, and is not described here.

S106. The first router sends the encapsulated packet to the second router.

For example, the second router is a router between different DCs. For example, the first router belongs to DC1, and the third router belongs to DC2. The encapsulated packet is a packet that needs to be sent by the first router of DC1 to the third router of DC2. The second router is a router in a transport network between DC1 and DC2.

For example, if the encapsulated packet is a packet sent by the transport mode, the destination IP address in the IP header included in the encapsulated packet is the IP address of the third router. If the encapsulated packet is a packet sent by the tunnel mode, the destination IP address in the IP header included in the encapsulated packet is the destination address of the tunnel, and the destination address of the tunnel is the third router. IP address.

For example, the first correspondence may be pre-configured on the first router, where the first correspondence includes an IP address of the VNI and the third router. The first router may obtain an IP address of the third router according to the first correspondence and the VNI. The first router may use the IP address of the third router as the destination IP address included in the IP header in the encapsulated packet.

For example, the second router may be pre-configured with a second correspondence, where the second correspondence includes address information and an IP address of the third router. The address information may be any one or any combination of a source IP address, a destination IP address, a source MAC address, and a destination MAC address included in the VXLAN message sent by the VTEP.

For example, the first router in DC1 obtains the encapsulated packet and sends the encapsulated packet to the third router in DC2 according to the destination IP address included in the IP header. After the message. The destination IP address included in the IP header in the encapsulated packet is the IP address of the third router in DC2. A second router is included between the first router in DC1 and the third router in DC2, that is, the path between the first router in DC1 and the third router in DC2 includes a second router. The second router may be a router capable of obtaining the VNI carried by the encapsulated packet. The first router in the DC1 sends the encapsulated packet to the third router in the DC2, and the encapsulated packet is forwarded to the path along the path between the first router and the third router. Two routers.

In the method for processing a VXLAN packet, the first router obtains the encapsulated packet according to the VXLAN packet and the VNI in the VXLAN packet, and the encapsulated packet includes an IP header. The VNI is packaged with the ESP header. The first router sends the encapsulated packet to the second router, and the second router is configured to perform further service processing, such as load balancing and other service processing, according to the VNI carried in the encapsulated packet. It helps to improve the efficiency of network operation.

Based on the method for processing a VXLAN message provided by the first embodiment of the present invention, another embodiment of the present invention provides a method for processing a VXLAN message. The method provided by another embodiment of the present invention is different from the method provided by the first embodiment of the present invention in that the first router may also insert a UDP header included in the VXLAN message into the encapsulated packet. Between the IP header and the VNI. That is, the method provided by another embodiment of the present invention includes S104 is different from S104 in the method provided by the first embodiment of the present invention, and the differences are described herein. For other content, refer to the method provided by the first embodiment of the present invention. The corresponding content in .

For example, in S104, the first router obtains the encapsulated packet according to the VXLAN packet, and the first router obtains the VNI and the UDP header from the VXLAN packet; A router performs IPsec-ESP encapsulation on the VXLAN packet to obtain an IPsec-ESP encapsulation packet, where the IPsec-ESP encapsulation packet includes an encrypted VXLAN packet and an ESP header and encapsulation encapsulated in the encrypted VXLAN packet. An IP header outside the ESP header; the first router inserts the VNI and the UDP header between the IP header included in the IPsec-ESP encapsulated packet and the ESP header to obtain the encapsulated packet. The encapsulated message may be the message shown in FIG. 4a or 4b. The message shown in Figure 4a is a encapsulated message sent in transport mode. The IP header included in the packet shown in FIG. 4a can adopt the structure shown in FIG. 5, and the UDP header included in the packet shown in FIG. 4a can adopt the structure shown in FIG. 6. The packet shown in Figure 4b is a encapsulated packet sent in tunnel mode. The intranet IP header included in the packet shown in Figure 4b is the IP header included in the VXLAN packet sent by the VTEP to the first router. The IP header included in the packet shown in FIG. 4b can adopt the structure shown in FIG. 5, and the UDP header included in the packet shown in FIG. 4b can adopt the structure shown in FIG. 6. Figure 4a and Figure 4b The dense VXLAN packet is the packet obtained after the VXLAN sent by the VTEP is encrypted. The content of the encrypted VXLAN packet is not described here.

For example, in S104, the first router obtains the encapsulated packet according to the VXLAN packet, and the first router obtains the VNI and the UDP header from the VXLAN packet; The router encrypts the VXLAN packet to obtain the encrypted VXLAN packet; the first router encapsulates the ESP header, the VNI, and the UDP header layer by layer outside the encrypted VXLAN packet. And the IP header. The encapsulated message may be the message shown in FIG. 4a or 4b.

For example, the IP header included in the encapsulated packet may further include first identifier information, where the first identifier information is used to identify that the encapsulated packet carries the UDP header, and the encapsulated in the The UDP header between the IP header and the VNI includes second identifier information, where the second identifier information is used to identify that the encapsulated packet carries the VNI.

For example, if the encapsulated packet of FIG. 4a or FIG. 4b includes an IP header, the IP header shown in FIG. 5 is used. The first identification information shown may be carried in the protocol number field in the IP header shown in FIG. In this embodiment, the protocol number field in the IP header shown in FIG. 5 may be defined as UDP, which is used to indicate that the IP header carries the UDP header. The first router may update the information included in the IP header after adding the VNI and the UDP header between the ESP header and the IP header. The IP header shown in FIG. 5, the first router may add a protocol number field and a total length to the IP header after the VNI and the UDP header are added between the ESP header and the IP header. The field and the header checksum field are updated so that the encapsulated message carrying the VNI and the UDP header satisfies the format requirement. The destination port number in the UDP header shown in FIG. 6 can be used to carry the second identifier information. The destination port number in the UDP header shown in Figure 6 is the ESP/VXLAN port number. That is, the ESP/VXLAN port number is used to identify the UDP header and carries the VNI. If the UDP header carries the VXLAN header that contains the VNI, the destination port number in the UDP header shown in Figure 6 is the ESP/VXLAN port number. That is, the ESP/VXLAN port number is used to identify the UDP header and is carried with the packaged VXLAN. Header ESP message. The packet shown in FIG. 6 includes a UDP checksum field included in the UDP header. If the IP header included in the message shown in Figure 5 is set When the "header checksum" is set, the "UDP checksum" in the UDP header included in the message shown in FIG. 6 can be set to 0.

For example, a plurality of paths may be included between the first router of DC1 and the third router of DC2. Each of the plurality of paths may include one or more routers. The source port number in the UDP header included in the encapsulated packet and the quintuple information included in the encapsulated packet may be used to determine one of the multiple paths to forward the encapsulated packet. The path of the text.

2 is a flow chart of a method for processing a VXLAN message according to a second embodiment of the present invention. A second embodiment of the present invention is a method for processing a VXLAN message according to an embodiment of the present invention. The second router may be an operator (English full name: provider, English abbreviation: P) device. The method for processing a VXLAN message according to the second embodiment of the present invention will be specifically described below with reference to FIG.

S202. The second router receives the encapsulated packet sent by the first router, where the encapsulated packet is a packet obtained by performing IPsec-ESP encapsulation on the VXLAN packet from the VTEP, and the encapsulated packet is sent. The IP header, the VNI, the ESP header, and the encrypted VXLAN message are included, and the VNI is encapsulated between the IP header and the ESP header.

For example, the second router is in a path between the first router of the DC1 and the third router of the DC2, and the second router receives the encapsulated report sent by the first router to the third router. Text. The encapsulated packet is the same as the encapsulated packet in the first embodiment of the present invention, and details are not described herein again.

Optionally, the IP header that is included in the encapsulated packet further carries the first identifier information, where the first identifier information is used to identify that the encapsulated packet carries the VNI. If the encapsulated packet includes a VXLAN header encapsulated in the IP header and the ESP header, and the VXLAN header includes the VNI, the first identifier information may be used to identify the encapsulated packet. The VXLAN header is carried.

For example, the encapsulated packet received by the second router may be the packet shown in FIG. 3a or FIG. 3b, and details of the specific structure are not described herein.

S204. The second router obtains the VNI from the encapsulated packet.

For example, the obtaining, by the second router, the VNI from the encapsulated packet includes: the second router determining, according to the first identifier information carried in the IP header of the encapsulated packet, The encapsulated packet carries the VNI; the second router obtains the VNI carried by the encapsulated packet from the IP header of the encapsulated packet.

For example, the second router may perform service processing on the encapsulated packet by using the obtained VNI, for example, service processing such as QoS and load sharing. VNI is used to distinguish between different VXLANs. The second router may determine, by using the VNI, a tenant to which the VXLAN packet included in the encapsulated packet belongs. The second router may store a mapping table between the VNI and the tenant. The second router may perform a load sharing operation on the encapsulated packet according to the VNI carried in the encapsulated packet and the mapping relationship table, and details of the specific operation process are not described herein.

In the method for processing a VXLAN packet, the VNI encapsulated in the encapsulated packet is encapsulated between the IP header and the ESP header, and the second router can receive the encapsulated packet after the packet is received. The VNI carried in the encapsulated message is identified. The second router may obtain the VNI from the encapsulated message. In this way, the second router can use the obtained VNI for further service processing, which helps improve network operation efficiency.

On the basis of the method for processing a VXLAN message provided by the second embodiment of the present invention, another embodiment of the present invention provides a method for processing a VXLAN message. In another method of the present invention, the encapsulated packet received by the second router includes a VNI and a UDP header encapsulated between an IP header and an ESP header, or received by the second router. The encapsulated message includes a VXLAN header and a UDP header encapsulated between an IP header and an ESP header, the VXLAN header including the VNI. The method provided by another embodiment of the present invention is different from the method provided by the second embodiment of the present invention in S204, and only the differences are described below. For the same content, refer to the method provided by the second embodiment of the present invention. The corresponding content.

In S202, the encapsulated packet received by the second router includes an IP header, a UDP header, and VNI, ESP headers, and encrypted VXLAN messages. The encapsulated packet received by the second router may be the packet shown in FIG. 4a or FIG. 4b, and details of the specific structure are not described herein. In this embodiment, the IP header of the encapsulated packet may carry the first identifier information, where the first identifier information is used to identify that the encapsulated packet carries the UDP header, and the UDP header UDP header carried by the VXLAN packet sent by the VTEP to the first router. The UDP header encapsulated between the IP header and the VNI includes second identifier information, where the second identifier information is used to identify that the encapsulated packet carries the VNI. The VNI is usually carried in a VXLAN message sent by the VTEP to the first router, and if the encapsulated message includes a VXLAN header and a UDP header encapsulated in the IP header and the ESP header, The second identifier information may be used to identify that the encapsulated packet carries a VXLAN header.

For example, in S204, the obtaining, by the second router, the VNI from the encapsulated packet includes: obtaining, by the second router, the IP header carried by the IP header from the IP header of the encapsulated packet And the second router obtains, according to the first identifier information, the UDP header that is included in the encapsulated packet and that is located after the IP header; and the second router according to the purpose of the UDP header The port number is determined to be that the encapsulated packet carries the VNI; and the second router obtains the VNI after the UDP header of the encapsulated packet. If the VNI of the encapsulated packet is carried in the VXLAN header, and the VXLAN header is encapsulated between the UDP header and the ESP header of the encapsulated packet, the second router may be encapsulated from the encapsulated packet. The VXLAN header is obtained after the UDP header of the message, and the VNI is obtained from the VXLAN header.

The third router in the DC2 receives the encapsulated packet from the first router, that is, the encapsulated packet forwarded by the second router, and the third router can process the encapsulated packet to obtain the encapsulated packet. VXLAN message.

For example, if the encapsulated packet includes a VNI encapsulated in an IP header and an ESP header, the third router may process the encapsulated packet, and obtaining the VXLAN packet includes: the third The router may remove the VNI encapsulated in the IP header and the ESP header included in the encapsulated packet; the third router updates the IP header in the packet obtained after removing the VNI, and obtains the VXLAN message. The VXLAN packet is a packet that can be identified by the VTEP in DC2. The updating, by the third router, the IP header in the packet obtained after removing the VNI may include: a total length field and a protocol number of the IP header in the packet obtained by the third router pair after removing the VNI The field and header checksum fields are updated so that the VXLAN message can be identified and/or processed by the VTEP in DC2.

For example, if the encapsulated packet includes a VNI and a UEP header encapsulated in an IP header and an ESP header, the third router may process the encapsulated packet to obtain a VXLAN packet, including: The third router may remove the VNI and UDP headers encapsulated in the IP header and the ESP header included in the encapsulated packet; the third router removes the IP header in the packet obtained after the VNI and the UDP header The update is performed to obtain the VXLAN message. The VXLAN packet is a packet that can be identified by the VTEP in DC2. The updating, by the third router, the IP header in the packet obtained after removing the VNI and the UDP header may include: the IP header in the packet obtained by the third router pair after removing the VNI and the UDP header The total length field, the protocol number field, and the header checksum field are updated so that the VXLAN message can be identified and/or processed by the VTEP in DC2.

FIG. 7 is a schematic structural diagram of a first router according to an embodiment of the present invention. The first router corresponding to FIG. 7 can perform the method provided by the embodiment corresponding to FIG. 1. The first router corresponding to FIG. 7 may be the first router in the embodiment corresponding to FIG. 2. The first router provided by the embodiment of the present invention includes a receiving unit 702, a processing unit 704, and a sending unit 706.

The receiving unit 702 is configured to receive a VXLAN message sent by the VTEP, where the VXLAN message includes a VNI.

The processing unit 704 is configured to obtain, according to the VXLAN packet, a encapsulated packet, where the encapsulated packet is a packet obtained by performing IPsec-ESP encapsulation on the VXLAN packet, after the encapsulation The message includes an IP header, the VNI, an ESP header, and the encrypted VXLAN message, and the VNI is encapsulated between the IP header and the ESP header.

The sending unit 706 is configured to send the encapsulated packet to the second router.

Optionally, the IP header includes first identifier information, where the first identifier information is used to identify The encapsulated message carries the VNI.

Optionally, the encapsulated packet further includes a UDP header encapsulated between the IP header and the VNI, where the UDP header is a UDP header included in the VXLAN packet from the VTEP. The IP header includes first identifier information, where the first identifier information is used to identify that the encapsulated packet carries the UDP header, and the UDP header encapsulated between the IP header and the VNI The second identifier information is used to identify that the encapsulated packet carries the VNI.

In the first router provided by the embodiment of the present invention, the processing unit obtains the encapsulated packet according to the VXLAN packet and the VNI in the VXLAN packet, and the encapsulated packet includes an IP header and an ESP header. There is the VNI. The sending unit sends the encapsulated packet to the second router, and the second router is configured to perform further service processing, such as load balancing and other service processing, according to the VNI carried in the encapsulated packet. Helps improve the efficiency of network operation.

FIG. 8 is a schematic structural diagram of a first router according to another embodiment of the present invention. The first router may perform the method provided by the embodiment corresponding to FIG. 1. The first router may be the first router in the embodiment corresponding to FIG. 2. The first router provided by the embodiment of the present invention includes a processor 801, a memory 802, an interface 803, and a bus 804. The interface 803 can be implemented in a wireless or wired manner. For example, the interface 803 can be a network interface card (English name: Network Interface Card, NIC) or other components for implementing communication. The processor 801, the memory 802, and the interface 803 can be connected by the bus 804.

The memory 802 is for storing program code. Optionally, the program code can include an operating system program and an application.

The processor 801 performs the following operations in accordance with executable instructions included in a program read from the memory 802.

The processor 801 receives the VXLAN packet sent by the VTEP through the interface 803, where the VXLAN packet includes a VXLAN network identifier VNI, and the processor 801 obtains the encapsulated packet according to the VXLAN packet. The encapsulated message is for the VXLAN The packet obtained after the IPsec-ESP encapsulation is performed, the encapsulated packet includes an IP header, the VNI, an ESP header, and the encrypted VXLAN packet, where the VNI is encapsulated in the IP header and the The processor 801 sends the encapsulated packet to the second router through the interface 803.

Optionally, the IP header includes first identifier information, where the first identifier information is used to identify that the encapsulated packet carries the VNI.

In the first router provided by the embodiment of the present invention, the processor 801 obtains the encapsulated packet according to the VXLAN packet and the VNI in the VXLAN packet, and the encapsulated packet includes an IP header and an ESP header. The VNI is packaged. The processor 801 sends the encapsulated packet to the second router through the interface 803, which helps the second router to perform further service processing, such as load, according to the VNI carried in the encapsulated packet. Sharing and other business processes can help improve network operation efficiency.

FIG. 9 is a schematic structural diagram of a second router according to an embodiment of the present invention. The second router shown in FIG. 9 can perform the method provided by the embodiment corresponding to FIG. 2. The second router shown in FIG. 9 may be the second router in the embodiment corresponding to FIG. 1. The second router provided by the embodiment of the present invention includes a receiving unit 902 and a processing unit 904.

The receiving unit 902 is configured to receive the encapsulated packet sent by the first router. The encapsulated packet is obtained by performing IPsec-ESP encapsulation on the VXLAN packet from the VTEP, and the encapsulated packet includes an IP header, a VNI, an ESP header, and the encrypted VXLAN packet. The VNI is encapsulated between the IP header and the ESP header.

The processing unit 904 is configured to obtain the VNI from the encapsulated message.

For example, if the IP header includes the first identifier information, and the first identifier information is used to identify that the encapsulated packet carries the VNI, the processing unit 904 is specifically configured to use the IP header according to the IP header. The first identifier information is included to determine that the encapsulated packet includes the VNI; and the processing unit 904 is specifically configured to obtain the VNI from between the IP header and the ESP header.

For example, if the encapsulated packet further includes a UDP header encapsulated between the IP header and the VNI, the UDP header is a UDP header included in the VXLAN packet from the VTEP. The IP header includes first identifier information, where the first identifier information is used to identify that the encapsulated packet carries the UDP header, and the UDP header encapsulated between the IP header and the VNI includes a second identifier information, where the second identifier information is used to identify that the encapsulated packet carries the VNI, and the processing unit 904 is specifically configured to use, according to the first identifier information included in the IP header, Obtaining a UDP header encapsulated between the IP header and the VNI; the processing unit 904 is specifically configured to: according to the second identifier information included in a UDP header encapsulated between the IP header and the VNI, Determining that the encapsulated message includes the VNI; the processing unit 904 is specifically configured to obtain the VNI from between the IP header and the ESP header.

In the second router provided by the embodiment of the present invention, the packaged VNI is encapsulated between the IP header and the ESP header, and the processing unit 904 may, after receiving the encapsulated packet, the encapsulated packet. The VNI carried by the document is identified. The processing unit 904 can obtain the VNI from the encapsulated message. In this way, the second router can use the obtained VNI for further service processing, which helps improve network operation efficiency.

FIG. 10 is a schematic structural diagram of a second router according to another embodiment of the present invention. The second router may perform the method provided by the embodiment corresponding to FIG. 2. The second router may be the second router in the corresponding embodiment. The second router provided by the embodiment of the present invention includes: a processor 1001, a memory 1002, an interface 1003, and a bus 1004. The interface 1003 can be implemented by wireless or wired, such as a NIC or other component for implementing communication. The processor 1001, the memory 1002, and the interface 1003 are connected by the bus 1004.

The memory 1002 is for storing program code. Optionally, the program code can include an operating system program and an application.

The processor 1001 performs the following operations in accordance with executable instructions included in a program read from the memory 1002.

The processor 1001 receives, by using the interface 1003, the encapsulated packet sent by the first router. The encapsulated packet is obtained by performing IPsec-ESP encapsulation on the VXLAN packet from the VTEP, and the encapsulated packet includes an IP header, a VNI, an ESP header, and the encrypted VXLAN packet. The VNI is encapsulated between the IP header and the ESP header; the processor 1001 obtains the VNI from the encapsulated message.

For example, if the IP header includes first identifier information, where the first identifier information is used to identify that the encapsulated packet carries the VNI, the processor 1001 includes, according to the IP header, Determining the first identification information, determining that the encapsulated message includes the VNI; and the processor 1001 obtains the VNI from between the IP header and the ESP header.

For example, if the encapsulated packet further includes a UDP header encapsulated between the IP header and the VNI, the UDP header is a UDP header included in the VXLAN packet from the VTEP. The IP header includes first identifier information, where the first identifier information is used to identify that the encapsulated packet carries the UDP header, and the UDP header encapsulated between the IP header and the VNI includes a second identifier information, where the second identifier information is used to identify that the encapsulated packet carries the VNI, and the processor 1001 obtains the encapsulation according to the first identifier information included in the IP header. a UDP header between the IP header and the VNI; the processor 1001 determines the encapsulated according to the second identifier information included in a UDP header encapsulated between the IP header and the VNI The message includes the VNI; the processor 1001 obtains the VNI from between the IP header and the ESP header.

In the second router provided by the embodiment of the present invention, the packaged VNI is encapsulated between the IP header and the ESP header, and the processor 1001 may, after receiving the encapsulated packet, the encapsulated packet. The VNI carried by the document is identified. The processor 1001 may receive the encapsulated message The VNI is obtained. In this way, the second router can use the obtained VNI for further service processing, which helps improve network operation efficiency.

FIG. 11 is a schematic diagram of a system for processing a VXLAN message according to an embodiment of the present invention. The system provided by the embodiment of the present invention may include the first router provided by the foregoing embodiment corresponding to FIG. 7 or FIG. 8 and the second router provided by the embodiment corresponding to FIG. 9 or FIG. 10, where the first router and the second router are no longer used. The second router will go into details.

Those of ordinary skill in the art will appreciate that various aspects of the present invention, or possible implementations of various aspects, may be embodied as a system, method, or computer program product. Thus, aspects of the invention, or possible implementations of various aspects, may be in the form of an entirely hardware embodiment, an entirely software embodiment (including firmware, resident software, etc.), or a combination of software and hardware aspects, They are collectively referred to herein as "circuits," "modules," or "systems." Furthermore, aspects of the invention, or possible implementations of various aspects, may take the form of a computer program product, which is a computer readable program code stored in a computer readable medium.

The computer readable medium can be a computer readable signal medium or a computer readable storage medium. The computer readable storage medium includes, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or any suitable combination of the foregoing, such as a random access memory (English full name: random access memory, English abbreviation: RAM ), read-only memory (English full name: read-only memory, English abbreviation: ROM), erasable programmable read-only memory (English full name: erasable programmable read only memory (EPROM) or flash memory), Optical fiber, portable read-only memory (English full name: compact disc read-only memory, English abbreviation: CD-ROM).

The processor in the computer reads the computer readable program code stored in the computer readable medium such that the processor is capable of performing the various functional steps specified in each step of the flowchart, or a combination of steps; A device that functions as specified in each block, or combination of blocks.

The computer readable program code can execute entirely on the user's local computer, partly on the user's local computer, as a separate software package, partly on the user's local computer and partly on the remote computer, or entirely on the remote computer or Executed on the server. It should also be noted that in some alternative implementations, the functions noted in the various steps in the flowcharts or in the blocks in the block diagrams may not occur in the order noted. For example, two steps, or two blocks, shown in succession may be executed substantially concurrently or the blocks may be executed in the reverse order.

It is apparent that those skilled in the art can make various modifications and variations to the invention without departing from the spirit and scope of the invention. Thus, it is intended that the present invention cover the modifications and modifications of the invention

Claims

A method for processing a virtual scalable local area network (VXLAN) packet, the method comprising:

The first router receives the VXLAN message sent by the virtual tunnel endpoint VTEP, where the VXLAN message includes a VXLAN network identifier VNI;

The first router obtains the encapsulated packet according to the VXLAN packet, and the encapsulated packet is obtained by performing an Internet Protocol security-encapsulation security payload IPsec-ESP encapsulation on the VXLAN packet. The encapsulated packet includes an Internet Protocol IP header, the VNI, an encapsulated secure payload protocol ESP header, and the encrypted VXLAN packet, and the VNI is encapsulated between the IP header and the ESP header. ;

The first router sends the encapsulated packet to the second router.
The method according to claim 1, wherein the IP header includes first identifier information, and the first identifier information is used to identify that the encapsulated packet carries the VNI.
The method according to claim 1, wherein the encapsulated message further comprises a User Data Packet Protocol UDP header encapsulated between the IP header and the VNI, the UDP header being from the a UDP header included in the VXLAN packet of the VTEP;

The IP header includes first identifier information, where the first identifier information is used to identify that the encapsulated packet carries the UDP header, and the UDP header encapsulated between the IP header and the VNI The second identifier information is used to identify that the encapsulated packet carries the VNI.
A method for processing a virtual scalable local area network (VXLAN) packet, the method comprising:

The second router receives the encapsulated packet sent by the first router, and the encapsulated packet is obtained by performing an Internet Protocol security-encapsulated security payload IPsec-ESP encapsulation on the VXLAN packet from the virtual tunnel endpoint VTEP. The encapsulated message includes an internet protocol IP header, a VXLAN network identifier VNI, an encapsulated secure payload protocol ESP header, and the encrypted a VXLAN packet, the VNI being encapsulated between the IP header and the ESP header;

The second router obtains the VNI from the encapsulated message.
The method according to claim 4, wherein the IP header includes first identifier information, and the first identifier information is used to identify that the encapsulated packet carries the VNI, the second router Obtaining the VNI from the encapsulated message includes:

The second router determines, according to the first identifier information included in the IP header, that the encapsulated packet includes the VNI;

The second router obtains the VNI from between the IP header and the ESP header.
The method according to claim 4, wherein the encapsulated message further comprises a User Data Packet Protocol UDP header encapsulated between the IP header and the VNI, the UDP header being from the The UDP header of the VXLAN packet of the VTEP, the IP header includes first identifier information, where the first identifier information is used to identify that the encapsulated packet carries the UDP header, and the encapsulated in the The UDP header between the IP header and the VNI includes second identifier information, where the second identifier information is used to identify that the encapsulated packet carries the VNI;

Obtaining, by the second router, the VNI from the encapsulated packet includes:

The second router obtains a UDP header encapsulated between the IP header and the VNI according to the first identifier information included in the IP header;

The second router determines that the encapsulated packet includes the VNI according to the second identifier information included in a UDP header encapsulated between the IP header and the VNI;

The second router obtains the VNI from between the IP header and the ESP header.
A first router, wherein the first router comprises:

a receiving unit, configured to receive a virtual scalable local area network VXLAN message sent by the virtual tunnel endpoint VTEP, where the VXLAN message includes a VXLAN network identifier VNI;

The processing unit is configured to obtain, according to the VXLAN packet, a encapsulated packet, where the encapsulated packet is obtained by performing an Internet Protocol security-encapsulation security payload IPsec-ESP encapsulation on the VXLAN packet. The encapsulated message includes an internet protocol IP header and a file. a VNI, an encapsulated secure payload protocol ESP header, and the encrypted VXLAN message, the VNI being encapsulated between the IP header and the ESP header;

And a sending unit, configured to send the encapsulated packet to the second router.
The first router according to claim 7, wherein the IP header includes first identifier information, and the first identifier information is used to identify that the encapsulated packet carries the VNI.
The first router according to claim 7, wherein the encapsulated message further comprises a User Data Packet Protocol UDP header encapsulated between the IP header and the VNI, the UDP header is from a UDP header included in the VXLAN packet of the VTEP;

The IP header includes first identifier information, where the first identifier information is used to identify that the encapsulated packet carries the UDP header, and the UDP header encapsulated between the IP header and the VNI The second identifier information is used to identify that the encapsulated packet carries the VNI.
A second router, wherein the second router comprises:

The receiving unit is configured to receive the encapsulated packet sent by the first router, where the encapsulated packet is an Internet Protocol security-encapsulated security payload IPsec-ESP encapsulation of the VXLAN packet from the virtual tunnel endpoint VTEP After the obtained packet, the encapsulated message includes an Internet Protocol IP header, a VXLAN network identifier VNI, an encapsulated secure payload protocol ESP header, and the encrypted VXLAN packet, where the VNI is encapsulated in the IP header and Between the ESP heads;

And a processing unit, configured to obtain the VNI from the encapsulated message.
The second router according to claim 10, wherein the IP header includes first identifier information, and the first identifier information is used to identify that the encapsulated packet carries the VNI;

The processing unit is specifically configured to determine, according to the first identifier information that is included in the IP header, that the encapsulated packet includes the VNI;

The processing unit is specifically configured to obtain the VNI from between the IP header and the ESP header.
The second router according to claim 10, wherein the encapsulated message further comprises a User Data Packet Protocol UDP header encapsulated between the IP header and the VNI, wherein the UDP header is from The UDP header of the VXLAN packet of the VTEP, the IP header includes first identifier information, where the first identifier information is used to identify that the encapsulated packet carries the UDP header, and the encapsulation The UDP header between the IP header and the VNI includes second identifier information, where the second identifier information is used to identify that the encapsulated packet carries the VNI;

The processing unit is configured to obtain, according to the first identifier information included in the IP header, a UDP header encapsulated between the IP header and the VNI;

The processing unit is configured to determine, according to the second identifier information that is included in a UDP header that is encapsulated between the IP header and the VNI, that the encapsulated packet includes the VNI;

The processing unit is specifically configured to obtain the VNI from between the IP header and the ESP header.
A system for processing a virtual scalable local area network (VXLAN) message, the system comprising the first router of any one of claims 7 to 9 and the Two routers.