WO2017107871A1

WO2017107871A1 - Access control method and network device

Info

Publication number: WO2017107871A1
Application number: PCT/CN2016/110471
Authority: WO
Inventors: 谢莹
Original assignee: 华为技术有限公司
Priority date: 2015-12-25
Filing date: 2016-12-16
Publication date: 2017-06-29
Also published as: CN106921610A

Abstract

Provided are an access control method and a network device. The access control method comprises: a network device receiving a first address resolution protocol (ARP) request sent by a first host, wherein the first ARP request is used to request a media access control (MAC) address of a second host, and the first ARP request comprises an Internet protocol (IP) address of the second host and an identifier of a first virtual local area network (VLAN) to which the first host belongs; the network device determining, according to the IP address of the second host, that the second host belongs to a second VLAN; and the network device determining, according to a pre-set access policy between the first VLAN and the second VLAN, whether to send an MAC address of the network device to the first host. In the embodiments of the present invention, a network device can selectively respond to an MAC address of the network device for a host under different VLANs according to a pre-set access policy, thereby achieving policy control over host access.

Description

Access control method and network device

The present application claims priority to Chinese Patent Application No. 201510989373.0, entitled "Access Control Method and Network Equipment", filed on Dec. 25, 2015, the entire disclosure of which is hereby incorporated by reference.

Technical field

The present invention relates to the field of communications and, more particularly, to an access control method and a network device.

Background technique

Virtual local area network aggregation (English: virtual aggregation), also known as super-network (super VLAN) technology, is a technology in which multiple VLANs share an IP address segment. For example, a gateway created in a super VLAN can be shared by multiple subnets (English: sub VLAN), and broadcast traffic between different sub VLANs is isolated from each other. If there is a need for traffic exchange between different sub-VLANs, the proxy address resolution protocol (proxy address resolution protocol (PROA) is enabled in the super VLAN or sub-VLAN to implement ARP pickup. For example, if the first host in the first sub VLAN wants to access the second host in the second sub VLAN, the gateway needs to respond to the gateway's media access control (MAC) address as the second through the gateway on the super VLAN. The MAC address of the host, and finally the access between the hosts is completed through the forwarding of the gateway.

In the prior art, the proxy ARP of the super VLAN can only provide the function of supporting ARP pickup. That is, the multiple sub-VLANs in the super VLAN support ARP pickup or neither ARP pickup nor tacticalization. Access control.

Summary of the invention

Embodiments of the present invention provide an access control method and a network device, which are capable of controlling access between hosts.

In a first aspect, an access control method is provided. Receiving, by the network device, a first address resolution protocol ARP request sent by the first host, where the first ARP request is used to request a media access control MAC address of the second host, and the first ARP request includes the first virtual entity to which the first host belongs The identifier of the local area network VLAN and the IP address of the second host; the network device determines, according to the IP address of the second host, that the second host belongs to the second VLAN; the network device is configured according to the preset first VLAN and the first The access policy between the two VLANs determines whether the MAC address of the network device is sent to the first host.

Host A wants to access host B with a known IP address, and first sends a first ARP request to host B to request access. The MAC address of the host B. The first ARP request carries the first VLAN to which the host A belongs. According to the IP address of the host B, the network device can determine the second VLAN to which the host B belongs. The network device may preset an access control relationship between the first VLAN and the second VLAN, for example, allowing the first VLAN to access the second VLAN or the first VLAN from accessing the second VLAN. In this way, after the network device enables the ARP proxy function between the sub-VLANs, the first ARP request is received, and the pre-set access control relationship between the first VLAN and the second VLAN is determined, thereby determining whether to the first The host sends the MAC address of the network device.

Therefore, in the access control method of the embodiment of the present invention, the network device receives an ARP request that is sent by the first host and carries the IP address of the second host and the identifier of the first VLAN to which the first host belongs, to request the MAC address of the second host. And determining, according to the IP address of the second host, that the second host belongs to the second VLAN, and determining whether to send the MAC address of the network device to the first host according to the preset access policy between the first VLAN and the second VLAN, so that The network device can selectively pick up the MAC address of the network device for the host in different VLANs according to the preset access policy, thereby implementing the strategic control of the host access.

With reference to the first aspect, in a first implementation manner of the first aspect, the network device determines, according to the IP address of the second host, that the second host belongs to the second VLAN, that the network device is configured according to the second host The IP address, the second ARP request is sent; the network device receives an ARP response that is sent by the second host to the second ARP request, where the ARP response includes an identifier of the second VLAN to which the second host belongs; the network device determines The second host belongs to the second VLAN.

The network device receives the first ARP request sent by the first host, where the first ARP request carries the IP address of the second host, and the network device can directly learn the second LVAN to which the second host belongs according to the IP address of the second host, for example, The second host may record the belonging second VLAN in the ARP forwarding table of the network device.

If the network device cannot directly learn the second VLAN to which the second host belongs, send a second ARP request to all the sub VLANs in the super VLAN except the first VLAN to determine the second host according to the IP address of the second host. The second VLAN to which it belongs. When receiving the second ARP request, the second host in the second VLAN replies to the gateway device of the network device with an ARP response for responding to the second ARP request, where the ARP response carries the second VLAN. Thus, the network device can determine the second VLAN to which the second host belongs.

With reference to the first aspect or the first possible implementation manner of the first aspect, in a second implementation manner of the first aspect, the network device is configured according to the preset access policy between the first VLAN and the second VLAN Determining whether to send the MAC address of the network device to the first host, including: if the network device presets the access policy to prohibit the first VLAN from accessing the second VLAN, the network device rejects the first Host sends this The MAC address of the network device.

The network device presets an access policy between the first VLAN and the second VLAN. For example, the network device allows the first VLAN to access the second VLAN, or the network device prohibits the first VLAN from accessing the second VLAN. According to the access policy, the network device may determine whether to send the MAC address of the network device to the first host instead of the MAC address of the second host. If the network device prohibits the first VLAN from accessing the second VLAN according to the requirement, determining to refuse to send the MAC address of the network device to the first host, so that the first host cannot receive the MAC address of the network device, and then the first The host cannot access the second host.

With reference to the first aspect or the first possible implementation manner of the first aspect, in a third possible implementation manner of the first aspect, the network device is configured according to a preset between the first VLAN and the second VLAN The access policy determines whether to send the MAC address of the network device to the first host, including:

If the access policy preset by the network device is to allow the first VLAN to access the second VLAN, the network device determines to send the MAC address of the network device to the first host.

The network device presets an access policy of the first VLAN to access the second VLAN, for example, the network device allows the first VLAN to access the second VLAN, or the network device prohibits the first VLAN from accessing the second VLAN. According to the access policy, the network device may determine whether to send the MAC address of the network device to the first host instead of the MAC address of the second host. If the network device is configured to allow the first VLAN to access the second VLAN according to requirements, determine to send the MAC address of the network device to the first host, so that the first host receives the MAC address of the network device, and then treats the MAC address as the MAC address. As the MAC address of the second host, the first host can access the second host through forwarding of the network device.

In conjunction with the third possible implementation of the first aspect, in a fourth possible implementation of the first aspect, the access control method further includes: the network device receiving an access message sent by the first host; the network device The access message is sent to the second host.

The first host receives the MAC address sent by the network device, and the MAC address is sent by the network device instead of the MAC address of the second host, so the first host considers the MAC address to be the MAC address of the second host, and then starts to access the second host. . The first host sends an access message according to the MAC address, and the access message first arrives at the network device, and reaches the second host by forwarding the network device, thereby implementing access by the first host to the second host.

In a second aspect, the present application provides a network device including a module for performing the access control method in the first aspect.

In a third aspect, a network device is provided, including: a processor and a memory;

The memory stores a program, the processor executing the program for performing the first aspect or the first An access control method as described in any of the possible implementations.

Based on the foregoing technical solution, in the embodiment of the present invention, the network device receives an ARP request that is sent by the first host and carries the IP address of the second host and the identifier of the first VLAN to which the first host belongs, to request the MAC address of the second host. Determining, according to the IP address of the second host, that the second host belongs to the second VLAN, and determining whether to send the MAC address of the network device to the first host according to the preset access policy between the first VLAN and the second VLAN. The network device can selectively select the MAC address of the network device for the host in different VLANs according to the preset access policy, thereby implementing the strategic control of the host access.

DRAWINGS

In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings to be used in the embodiments of the present invention will be briefly described below.

FIG. 1 is a schematic diagram of an application scenario according to an embodiment of the present invention.

FIG. 2 is a schematic flowchart of an access control method according to an embodiment of the present invention.

FIG. 3 is a schematic flowchart of a specific embodiment of an access control method according to an embodiment of the present invention.

4 is a schematic block diagram of a network device in accordance with an embodiment of the present invention.

FIG. 5 is a schematic structural diagram of a network device according to an embodiment of the present invention.

detailed description

The technical solutions in the embodiments of the present invention will be described below with reference to the accompanying drawings in the embodiments of the present invention.

As shown in FIG. 1 , an application scenario is adopted in the embodiment of the present invention. A super VLAN is configured on a network, and multiple users are classified into different VLANs. The principle of virtual local area network aggregation is that a super VLAN contains multiple sub-VLANs, and each sub-VLAN is a broadcast domain. The two sub-VLANs are isolated from each other. A super VLAN can be configured with a Layer 3 interface. A sub VLAN cannot be configured with a Layer 3 interface. When the host in the sub-VLAN needs to perform Layer 3 communication, the IP address of the Layer 3 interface of the Super VLAN is used as the gateway address. In this way, multiple Sub VLANs share an Internet Protocol (IP) network segment. Therefore, the first VLAN and the second VLAN in the embodiment of the present invention are both Sub VLANs.

ARP is a Transmission Control Protocol (TCP)/IP protocol for obtaining physical addresses. After the first ARP request of the IP address of a node is broadcast to the network, the node receives a response confirming its MAC address, and such a packet can be transmitted. In the LAN, if you want to communicate between two hosts, you must know the IP address of the destination host, but the physical device network card that transmits data cannot directly identify the IP address, and can only identify its MAC address and MAC address. Is a globally unique order The column number is composed of 12 hexadecimal numbers. The communication between the hosts is generally the communication between the network cards, and the communication between the network cards is based on the MAC address of the other party, and the ARP protocol is to convert the IP address in the data packet into a MAC address. Network protocol.

Proxy ARP refers to responding to an ARP request from another device by using one host as the designated device. For example, although device 1 and device 2 belong to different broadcast domains, they are in the same network segment, so device 1 sends an ARP request broadcast packet to device 2, requesting to obtain the MAC address of device 2, because the router does not forward the broadcast packet. Therefore, the ARP request can only reach the router and cannot reach device 2. When the ARP proxy is enabled on the router, the router looks at the ARP request and finds that the destination IP address belongs to another network it is connected to. Therefore, the router replaces the MAC address of device 2 with its own interface MAC address and sends an ARP response to device 1. . After receiving the ARP reply, device 1 considers that the MAC address of device 2 is the interface MAC address of the router and does not sense the existence of the ARP proxy. In the next data communication, device 1 first sends the data to the router, which is forwarded to device 2 by the router.

For example, in Figure 1, host A compares the IP address of host B (10.1.1.12) with its own network segment 10.1.1.2-10.1.1.11, and finds that host B is on the same subnet as itself, but the ARP table of host A. There is no corresponding entry of host B, so host A sends an ARP request broadcast, requesting the MAC address of host B. Host A cannot receive this ARP request from host A because it is not in the broadcast domain of VLAN 2. However, since the ARP proxy function between the sub-VLANs is enabled on the gateway, and the gateway is in the super VLAN, the sub-VLAN packet is allowed to be received, so when the gateway receives the first ARP request from the host A, the gateway starts. If the IP address (10.1.1.12) of the host B in the first ARP request is a direct link route, the gateway sends an ARP request broadcast to all other sub VLAN interfaces to request the MAC address of the host B. . After receiving the ARP broadcast sent by the gateway, Host B performs an ARP reply to the request. After the gateway receives the response from Host B, it responds to Host A with its MAC address as the MAC address of B. After receiving the response from the gateway, host A considers that the MAC address of the gateway is the MAC address of host B. Then, the packet to be sent to host B after host A is sent to the gateway first, and the gateway performs Layer 3 forwarding.

In the prior art, the proxy ARP function of the VLAN aggregation can only provide the function of supporting ARP pickup for a certain VLAN, and supports the control without the tactical control. Therefore, the MAC address of the peer can be obtained for a certain VLAN. Either you can't get the MAC address of the peer.

For example, if VLAN 2 supports ARP pickup in Figure 1, all other VLANs that VLAN 2 wants to access can get the super VLAN pickup. In this way, VLAN 2 can access VLAN 3 or VLAN 4. It is impossible to allow VLAN 2 to access VLAN 3 and VLAN 2 to access VLAN 4.

FIG. 2 shows a schematic diagram of an access control method 100 in accordance with an embodiment of the present invention. As shown in FIG. 2, the access control method 100 can be performed by a network device, where the access control method includes:

S110. The network device receives a first address resolution protocol ARP request sent by the first host, where the first ARP request is used to request a media access control MAC address of the second host, and the first ARP request includes the first host to which the first host belongs. An identifier of a virtual local area network VLAN and an internet protocol IP address of the second host;

S120. The network device determines, according to the IP address of the second host, that the second host belongs to the second VLAN.

S130. The network device determines, according to the preset access policy between the first VLAN and the second VLAN, whether to send the MAC address of the network device to the first host.

Specifically, the host A needs to access the host B of the known IP address, and first sends a first ARP request to the host B to request the MAC address of the host B. The first ARP request carries the first VLAN to which the host A belongs. . According to the IP address of the host B, the network device can determine the second VLAN to which the host B belongs. The network device may preset an access control relationship between the first VLAN and the second VLAN, for example, allowing the first VLAN to access the second VLAN or the first VLAN from accessing the second VLAN. In this way, after the network device enables the ARP proxy function between the sub-VLANs, the first ARP request is received, and the pre-set access control relationship between the first VLAN and the second VLAN is determined, thereby determining whether to the first The host sends the MAC address of the network device.

It should be understood that the network device may be a Layer 3 switch, or may be a router, which is not limited by the present invention. It should also be understood that the gateway, the super VLAN, and the Layer 3 switch are on the same device, wherein the gateway and the super VLAN are equivalent to the functional modules of the Layer 3 switch. For the convenience of description, the following embodiments are described by taking a three-layer switch as an example, but the present invention is not limited thereto.

In S110, the network device receives an address resolution protocol first ARP request sent by the first host, where the first ARP request is used to request access to the second host, and the first ARP request includes the first virtual local area network to which the first host belongs. The ID of the VLAN and the IP address of the second host.

Specifically, when the first host wants to access the second host with itself in a different broadcast domain, only the IP address of the second host is known, and the MAC address of the second host cannot be known. Thus, the first host sends the first message in the manner of a message. The ARP request acquires the MAC address of the second host, and the MAC address in the packet header of the packet is the MAC address of the first host. Since the first host and the second host are in different VLANs, the second host cannot receive the first ARP request of the first host. Therefore, the ARP proxy function between the sub-VLANs is enabled on the network device. The host device can send the first ARP request to the network device because the network device is in the super VLAN and is allowed to receive the packets sent by the sub-sub VLANs. .

In S120, the network device determines, according to the IP address of the second host, that the second host belongs to the second VLAN.

Specifically, after the ARP proxy function between the sub-VLANs is enabled on the network device, the network device receives the first ARP request from the host A, and can start searching in the ARP forwarding table, so as to directly discover the second in the first ARP request. The second VLAN to which the host's IP address belongs and the MAC address of the second host. If the second VLAN to which the second host belongs and the MAC address of the second host are not found in the ARP forwarding table, the second ARP request broadcast may be sent to all other sub VLAN interfaces to request the MAC address of the second host and the second host. The second VLAN to which it belongs.

Optionally, the network device determines, according to the IP address of the second host, that the second host belongs to the second VLAN, and includes:

The network device sends a second ARP request according to the IP address of the second host;

The network device receives an ARP response that is sent by the second host to the second ARP request, where the ARP response includes an identifier of the second VLAN to which the second host belongs;

The network device determines that the second host belongs to the second VLAN.

Specifically, the network device receives the first ARP request sent by the first host, where the first ARP request carries the IP address of the second host, and the network device can directly learn the second host according to the IP address of the second host. The second LVAN, for example, the second host may record the associated second VLAN in the ARP forwarding table of the network device.

In S130, the network device is configured according to a preset access policy between the first VLAN and the second VLAN. Slightly, it is determined whether the MAC address of the network device is sent to the first host.

Specifically, the network device may preset an access policy between the virtual local area networks according to user requirements or through access statistics between the networks. For example, VLAN 2 can access VLAN 3, VLAN 3 can access VLAN 4, and VLAN 2 cannot access VLAN 4. According to the access policy between the virtual local area networks, it can be determined whether the MAC address of the network device is sent to the first host. If the first host can receive the MAC address of the network device, the first host sends the access message by using the MAC address of the network device as the MAC address of the second host, that is, the first host to the second host is completed by forwarding the access message through the network device. Access.

It should be noted that the access policy can also be directly configured to allow the first VLAN and the second VLAN to access each other, so that it is not necessary to independently set whether the first VLAN allows access to the second VLAN, and further whether the second VLAN is allowed to access. A VLAN is not limited by the present invention.

Optionally, the network device determines, according to the preset access policy between the first VLAN and the second VLAN, whether to send the MAC address of the network device to the first host, including:

If the access policy preset by the network device prohibits the first VLAN from accessing the second VLAN, the network address of the network device is refused to be sent to the first host.

Specifically, the network device presets an access policy between the first VLAN and the second VLAN, for example, the network device allows the first VLAN to access the second VLAN, or the network device prohibits the first VLAN from accessing the second VLAN. According to the access policy, the network device may determine whether to send the MAC address of the network device to the first host instead of the MAC address of the second host. If the network device prohibits the first VLAN from accessing the second VLAN according to the requirement, determining to refuse to send the MAC address of the network device to the first host, so that the first host cannot receive the MAC address of the network device, and then the first The host cannot access the second host.

If the access policy preset by the network device is to allow the first VLAN to access the second VLAN, determine to send the MAC address of the network device to the first host.

Specifically, the network device presets an access policy of the first VLAN to access the second VLAN, for example, the network device allows the first VLAN to access the second VLAN, or the network device prohibits the first VLAN from accessing the second VLAN. According to the access policy, the network device may determine whether to send the MAC address of the network device to the first host instead of the MAC address of the second host. If the network device is configured to allow the first VLAN to access the second VLAN according to requirements, determine to send the MAC address of the network device to the first host, so that the first host receives the MAC address of the network device, and then treats the MAC address as the MAC address. As the MAC address of the second host, which can be set through the network. The forwarding of the backup completes the access of the first host to the second host.

It should be understood that, as described above, the packet header of the first host that sends the first ARP request packet includes the MAC address of the first host. Therefore, the network device can set the MAC address of the network device according to the MAC address of the first host. Sent to the first host.

Optionally, the access control method further includes:

Receiving, by the network device, an access message sent by the first host;

The network device sends the access message to the second host.

Specifically, the first host receives the MAC address sent by the network device, where the MAC address is sent by the network device instead of the MAC address of the second host, so the first host considers the MAC address to be the MAC address of the second host, and thus Access the second host. The first host sends an access message according to the MAC address, and the access message first arrives at the network device, and reaches the second host by forwarding the network device, thereby implementing access by the first host to the second host.

It should be understood that, as described above, the network device can learn the MAC address of the second host according to the ARP forwarding table, or obtain the MAC address of the second host by sending the second ARP request. Therefore, the network device can be configured according to the second host. The MAC address is forwarded to the access message sent by the first host.

Embodiments of the present invention are described in detail below in conjunction with FIG. It should be noted that this is only to assist those skilled in the art to better understand the embodiments of the present invention and not to limit the scope of the embodiments of the present invention.

In an embodiment of the present invention, the network device receives the first ARP request sent by the first host, where the first ARP request is used to request the MAC address of the second host, and the first ARP request carries the first host to which the first host belongs. The identifier of a VLAN and the IP address of the second host may be determined according to the IP address of the second host, and the second VLAN to which the second host belongs may be determined according to the predetermined access policy between the first VLAN and the second VLAN. Determine whether to send the MAC address of the network device to the first host. If the pre-set access policy is to allow the first VLAN to access the second VLAN, the network device sends the MAC address of the network device to the first host, and the first host uses the MAC address of the network device as the second host. MAC address, visit with the second host Ask for communication, the access communication still needs to be forwarded through the network device. If the preset access policy is to prohibit the first VLAN from accessing the second VLAN, the network device refuses to send the MAC address of the network device to the first host, so that the first host cannot access the second host.

FIG. 3 is a schematic flowchart diagram of a specific embodiment of an access control method according to an embodiment of the present invention. The meanings of the various terms in the embodiments of the present invention are the same as those of the foregoing embodiments.

S301. The network device receives, by the first host, a first ARP request that carries an identifier of the first virtual local area network VLAN to which the first host belongs and an IP address of the second host, where the first ARP request is used to request to access the second host. .

S302. The network device determines, according to the IP address of the second host, a second VLAN to which the second host belongs.

S303. The network device determines, according to the preset access policy between the first VLAN and the second VLAN, whether to send the MAC address of the network device to the first host.

The network device presets an access policy of the first VLAN to access the second VLAN, where the access policy includes the network device allowing the first VLAN to access the second VLAN, or the network device prohibiting the first VLAN from accessing the second VLAN. If the network device allows the first VLAN to access the second VLAN, and sends the MAC address of the network device to the first host, so that the first host can access the second host, step S304 is performed.

If the network device prohibits the first VLAN from accessing the second VLAN, the MAC address of the network device is refused to be sent to the first host, so that the first host cannot access the second host, that is, step S305 is performed.

S304. The first host is capable of accessing the second host.

Accessing the second host of the first host pair is achieved by forwarding of the network device.

S305. The first host cannot access the second host.

It should be understood that the foregoing specific manners of the corresponding information may refer to the foregoing embodiments, and are not described herein for brevity.

Therefore, in the access control method of the embodiment of the present invention, the network device receives the second host that is sent by the first host. The IP address and the ARP request of the identifier of the first VLAN to which the first host belongs to request the MAC address of the second host, and determine that the second host belongs to the second VLAN according to the IP address of the second host, and then according to the preset The access policy between the first VLAN and the second VLAN determines whether the MAC address of the network device is sent to the first host, so that the network device can selectively pick up the network device of the host in different VLANs according to a preset access policy. MAC address, which enables strategic control of host access.

It should be understood that, in various embodiments of the present invention, the size of the sequence numbers of the above processes does not mean the order of execution, and the order of execution of each process should be determined by its function and internal logic, and should not be directed to the embodiments of the present invention. The implementation process constitutes any limitation.

The access control method according to an embodiment of the present invention has been described in detail above, and a network device according to an embodiment of the present invention will be described below.

FIG. 4 shows a schematic block diagram of a network device 500 in accordance with an embodiment of the present invention. As shown in FIG. 4, the network device 500 includes:

The first receiving module 510 is configured to receive a first address resolution protocol ARP request sent by the first host, where the first ARP request is used to request a media access control MAC address of the second host, and the first ARP request includes the first The identifier of the first virtual local area network VLAN to which the host belongs and the internet protocol IP address of the second host;

The first determining module 520 is configured to determine, according to the IP address of the second host, that the second host belongs to the second VLAN;

The second determining module 530 is configured to determine whether to send the MAC address of the network device to the first host according to the preset access policy between the first VLAN and the second VLAN.

Therefore, the network device in the embodiment of the present invention receives the first ARP request of the second host by the IP address of the second host and the first VLAN to which the first host belongs, and requests the MAC address of the second host according to the The IP address of the second host determines that the second host belongs to the second VLAN, and determines whether to send the MAC address of the network device to the first host instead of the MAC address of the second host according to a preset access policy, so that the network device The host in different VLANs can selectively reply to the ARP pickup according to the preset access policy, thereby implementing the strategic control of the host access.

In the embodiment of the present invention, the first determining module 520 is specifically configured to:

Sending a second ARP request according to the IP address of the second host;

Receiving, by the second host, an ARP response in response to the second ARP request, where the ARP response includes an identifier of the second VLAN to which the second host belongs;

It is determined that the second host belongs to the second VLAN.

Optionally, in the embodiment of the present invention, the second determining module 530 is specifically configured to:

In the embodiment of the present invention, the second determining module 530 is specifically configured to:

Optionally, in the embodiment of the present invention, the network device 500 further includes:

a second receiving module, configured to receive an access message sent by the first host;

And a sending module, configured to send the access message to the second host.

Therefore, the network device of the embodiment of the present invention requests the ARP request of the second host by sending an IP address of the second host and an identifier of the first VLAN to which the first host belongs, and requests the MAC address of the second host according to the The IP address of the second host determines that the second host belongs to the second VLAN, and determines whether to send the MAC address of the network device to the first host according to the preset access policy between the first VLAN and the second VLAN, so that the network device The MAC address of the network device can be selectively picked up by the host in different VLANs according to a preset access policy, thereby implementing centralized control of host access.

FIG. 5 shows a structure of a network device according to an embodiment of the present invention, including at least one processor 702 (for example, a CPU), at least one network interface 705 or other communication interface, a memory 706, and at least one communication bus 703 for Achieve connection communication between these devices. The processor 702 is configured to execute executable instructions, such as a computer program, stored in the memory 706. The memory 706 may include a high speed random access memory (RAM), and may also include a non-volatile memory (English: non-volatile memory), such as at least one disk memory. A communication connection with at least one other network element is achieved by at least one network interface 705 (which may be wired or wireless).

In some embodiments, the memory 706 stores a program 7061, and the processor 702 executes the program 7061 for performing some operations:

Receiving a first address resolution protocol ARP request sent by the first host, where the first ARP request is used to request a media access control MAC address of the second host, and the first ARP request includes the first virtual local area network VLAN to which the first host belongs The identifier and the internet protocol IP address of the second host;

Determining that the second host belongs to the second VLAN according to the IP address of the second host;

And determining, according to the preset access policy between the first VLAN and the second VLAN, whether to send the MAC address of the network device to the first host.

Optionally, the processor 702 is specifically configured to:

Sending a second ARP request according to the IP address of the second host;

It is determined that the second host belongs to the second VLAN.

Optionally, the processor 702 is specifically configured to:

Optionally, the processor 702 is further configured to:

Receiving an access message sent by the first host;

The access message is sent to the second host.

The foregoing technical solution provided by the embodiment of the present invention can be used to request the MAC address of the second host by receiving an ARP request that is sent by the first host and carries the IP address of the second host and the identifier of the first VLAN to which the first host belongs. An address, and determining, according to the IP address of the second host, that the second host belongs to the second VLAN, and determining whether to send the MAC address of the network device to the first host according to the preset access policy between the first VLAN and the second VLAN. The network device can selectively select the MAC address of the network device for the host in different VLANs according to the preset access policy, thereby implementing the strategic control of the host access.

It should be understood that the term "and/or" herein is merely an association relationship describing an associated object, indicating that there may be three relationships, for example, A and/or B, which may indicate that A exists separately, and A and B exist simultaneously. There are three cases of B alone. In addition, the character "/" in this article generally indicates that the contextual object is an "or" relationship.

Those of ordinary skill in the art will appreciate that the elements and algorithm steps of the various examples described in connection with the embodiments disclosed herein can be implemented in electronic hardware or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the solution. Professionals can use different methods to implement the described functions for each specific application, but this implementation should not recognize It is outside the scope of the invention.

A person skilled in the art can clearly understand that for the convenience and brevity of the description, the specific working process of the system, the device and the unit described above can refer to the corresponding process in the foregoing method embodiment, and details are not described herein again.

In the several embodiments provided by the present application, it should be understood that the disclosed systems, devices, and methods may be implemented in other manners. For example, the device embodiments described above are merely illustrative. For example, the division of the unit is only a logical function division. In actual implementation, there may be another division manner, for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be in an electrical, mechanical or other form.

The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.

In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

The functions may be stored in a computer readable storage medium if implemented in the form of a software functional unit and sold or used as a standalone product. Based on such understanding, the technical solution of the present invention, which is essential or contributes to the prior art, or a part of the technical solution, may be embodied in the form of a software product, which is stored in a storage medium, including The instructions are used to cause a computer device (which may be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention.

The above is only a specific embodiment of the present invention, but the scope of the present invention is not limited thereto, and any person skilled in the art can easily think of changes or substitutions within the technical scope of the present invention. It should be covered by the scope of the present invention. Therefore, the scope of the invention should be determined by the scope of the appended claims.

Claims

An access control method, comprising:

Receiving, by the network device, a first address resolution protocol ARP request sent by the first host, where the first ARP request is used to request a media access control MAC address of the second host, and the first ARP request includes the second host a protocol IP address and an identifier of the first virtual local area network VLAN to which the first host belongs;

Determining, by the network device, that the second host belongs to the second VLAN according to the IP address of the second host;

And determining, by the network device, whether to send the MAC address of the network device to the first host according to a preset access policy between the first VLAN and the second VLAN.
The access control method according to claim 1, wherein the network device determines that the second host belongs to the second VLAN according to the IP address of the second host, and includes:

The network device sends a second ARP request according to the IP address of the second host;

Receiving, by the network device, an ARP response that is sent by the second host in response to the second ARP request, where the ARP response includes an identifier of the second VLAN to which the second host belongs;

The network device determines that the second host belongs to the second VLAN.
The access control method according to claim 1 or 2, wherein the network device determines whether to go to the first host according to a preset access policy between the first VLAN and the second VLAN. Sending the MAC address of the network device, including:

If the access policy preset by the network device is to prohibit the first VLAN from accessing the second VLAN, the network device refuses to send the MAC address of the network device to the first host.
The access control method according to claim 1 or 2, wherein the network device determines whether to go to the first host according to a preset access policy between the first VLAN and the second VLAN. Sending the MAC address of the network device, including:

If the access policy preset by the network device is to allow the first VLAN to access the second VLAN, the network device determines to send the MAC address of the network device to the first host.
The access control method according to claim 4, wherein the access control method further comprises:

Receiving, by the network device, an access message sent by the first host;

The network device sends the access message to the second host.
A network device, comprising:

a first receiving module, configured to receive a first address resolution protocol ARP request sent by the first host, where the first The ARP request is used to request the media access control MAC address of the second host, and the first ARP request includes an Internet Protocol IP address of the second host and an identifier of the first virtual local area network VLAN to which the first host belongs;

a first determining module, configured to determine, according to the IP address of the second host, that the second host belongs to the second VLAN;

And a second determining module, configured to determine, according to the preset access policy between the first VLAN and the second VLAN, whether to send the MAC address of the network device to the first host.
The network device according to claim 6, wherein the first determining module is specifically configured to:

Sending a second ARP request according to the IP address of the second host;

Receiving, by the second host, an ARP response in response to the second ARP request, where the ARP response includes an identifier of the second VLAN to which the second host belongs;

Determining that the second host belongs to the second VLAN.
The network device according to claim 6 or 7, wherein the second determining module is specifically configured to:

If the access policy preset by the network device is to prohibit the first VLAN from accessing the second VLAN, the MAC address of the network device is refused to be sent to the first host.
The network device according to claim 6 or 7, wherein the second determining module is specifically configured to:

And if the access policy preset by the network device is to allow the first VLAN to access the second VLAN, determining to send the MAC address of the network device to the first host.
The network device according to claim 9, wherein the network device further comprises:

a second receiving module, configured to receive an access message sent by the first host;

And a sending module, configured to send the access message to the second host.