WO2017148219A1 - 虚拟专用网业务实现方法、装置及通信系统 - Google Patents

虚拟专用网业务实现方法、装置及通信系统 Download PDF

Info

Publication number
WO2017148219A1
WO2017148219A1 PCT/CN2017/071062 CN2017071062W WO2017148219A1 WO 2017148219 A1 WO2017148219 A1 WO 2017148219A1 CN 2017071062 W CN2017071062 W CN 2017071062W WO 2017148219 A1 WO2017148219 A1 WO 2017148219A1
Authority
WO
WIPO (PCT)
Prior art keywords
network
wan
service
area network
model
Prior art date
Application number
PCT/CN2017/071062
Other languages
English (en)
French (fr)
Inventor
孙金伟
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2017148219A1 publication Critical patent/WO2017148219A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0803—Configuration setting
    • H04L41/0806—Configuration setting for initial configuration or provisioning, e.g. plug-and-play
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4641—Virtual LANs, VLANs, e.g. virtual private networks [VPN]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/14—Network analysis or design

Definitions

  • the present disclosure relates to the field of VPN (Virtual Private Network), and in particular, to a VPN service implementation method, apparatus, and communication system.
  • VPN Virtual Private Network
  • DC Data Center: Data Center
  • GW GateWay, Gateway
  • Public Network PE Operaator Edge Router
  • VxLAN virtual Extensible LAN
  • the application application, application, value-added application based on the network control plane and the forwarding plane
  • CLI command-line interface
  • the command line interface is configured.
  • RD Route-Distinguisher, routing specifier, which is used to indicate different VPN instances on the PE device
  • RT Route-Target, routing destination, deciding to send and receive VPN routes, and filtering
  • the VxLAN and Layer 3 VPN resources to be delivered by the PE cannot be generated uniformly.
  • the opening between different DCs cannot reflect the model creation of the service.
  • the present disclosure provides a method, an apparatus, and a communication system for implementing a VPN service, so as to solve the problem that the existing VPN service is not practical due to the tight coupling between the GW and the PE.
  • the present disclosure provides a method for implementing a virtual private network service, including:
  • a wide area network WAN orchestrator interacting with the WAN controller of the wide area network
  • a wide area network WAN orchestrator is configured to generate a wide area network WAN orchestration coupling network model
  • a data center DC orchestrator interacting with the data center DC controller is created. Configuring a data center DC orchestrator to generate a data center DC orchestration coupling network model
  • the wide area network WAN orchestration coupling network model is sent to the WAN WAN controller for the WAN controller to establish a virtual private network VPN service tunnel and realize the mapping of the virtual scalable local area network identifier VNI to the three-layer virtual private network L3vpn; the data center DC arrangement is delivered Coupling the network model to the data center DC controller for the data center DC controller to generate a virtual scalable LAN configuration table entry.
  • the method further includes: generating a model architecture based coupling The cloud service model package of the network; the creation of the WAN WAN orchestrator and the data center DC orchestrator include: calling the cloud service model package, and creating the WAN arranging device and the data center DC orchestrator according to the cloud service model package.
  • the component virtual private network VPN service model includes: creating a service template ServiceTemplate in the Winery environment, setting the service template name; creating nodes, node types and configuration parameters for the gateway GW, the device PE, the data center DC, and the WAN WAN; Logical relationship; use the business process to perform a voice description data transfer process.
  • the business template includes tight coupling and loose coupling.
  • the new service template in the Winery environment includes: determining whether the service template is tightly coupled or loosely coupled according to the combination or separation type of the gateway GW and the device PE in the networking.
  • the wide area network WAN orchestration coupling network model includes: setting a wide area network WAN orchestration coupling network model including device PE name, virtual scalable local area network identifier VNI, service level, port, port network segment address, routing specifier RT, routing target RD; data center DC
  • the orchestration coupling network model includes the gateway GW name, the virtual scalable local area network identifier VNI, the route specifier RT, the routing target RD, the port, and the network segment address of the port.
  • Generating a WAN WAN orchestration coupling network model includes: selecting a device PE to join the WAN WAN, setting a tenant name, a tenant network name, a joined data center DC name, an interface IP, a virtual scalable local area network identifier VNI, a route specifier RT, and a routing target RD Pre-configuring the tunnel and tunnel service level between the PEs of the device; generating a data center DC orchestration coupling network model includes: selecting different data center DCs, selecting devices in the data center DC as gateway GW, setting tenant names, configurations, and devices The PE-consistent virtual scalable LAN identifier VXLAN ID, the configuration and PE matching the inbound routing specifier RT, the routing destination RD, the interface IP, the service level of the tenant is selected, and mapped to the WAN WAN orchestration coupling network model. Tunnel service level.
  • the present disclosure provides a virtual private network service implementation apparatus, including:
  • the sending module is configured to send a wide area network WAN orchestration coupling network model to the WAN WAN controller, and the WAN controller establishes a virtual private network VPN service tunnel and implements mapping of the virtual scalable local area network identifier VNI to the three-layer virtual private network L3vpn;
  • the building module is further configured to generate a cloud service model package of the model-based coupling network; the creation module is set to invoke the cloud service model package, and the WAN arranger and data are created according to the cloud service model package.
  • Central DC arranger is set to invoke the cloud service model package, and the WAN arranger and data are created according to the cloud service model package.
  • the building module is set to create a service template ServiceTemplate in the Winery environment, set the business template name; create nodes, node types and configuration parameters for the gateway GW, the device PE, the data center DC, and the WAN WAN; create a logical relationship between the nodes;
  • the process performs a voice description data transfer process.
  • the service template includes tight coupling and loose coupling; the building module is configured to determine that the service template is tightly coupled or loosely coupled according to the combination or separation type of the gateway GW and the device PE in the networking.
  • the wide area network WAN orchestration coupling network model includes: setting a wide area network WAN orchestration coupling network model including device PE name, virtual scalable local area network identifier VNI, service level, port, port network segment address, routing specifier RT, routing target RD; data center DC
  • the orchestration coupling network model includes the gateway GW name, the virtual scalable local area network identifier VNI, the route specifier RT, the routing target RD, the port, and the network segment address of the port.
  • the creation module is set to select the device PE to join the WAN WAN, set the tenant name, tenant network name, joined data center DC name, interface IP, virtual scalable local area network identifier VNI, route specifier RT, route target RD, pre-configured device PE
  • the tunnel and tunnel service level between the two; the creation module is also set to select different data center DCs, select the device in the data center DC as the gateway GW, and set the virtual extended LAN identifier VXLAN ID of the tenant name and configuration PE.
  • the configuration is matched with the PE's outgoing/input route identifier RT, the route target RD, and the interface IP.
  • the tenant's service level is selected and mapped to the tunnel service level in the WAN WAN orchestration coupling network model.
  • the present disclosure provides a communication system including the virtual private network service implementation apparatus provided by the present disclosure.
  • the present disclosure provides a VPN service implementation method. After creating a VPN service model, a wide area network WAN orchestration coupling network model and a data center DC orchestration coupling network model are created, so that a network model of the WAN controller and the DC controller is combined to uniformly generate a DC.
  • the parameters required by the GW and the PE are used to open the end-to-end service between the PEs of the public network, and the process is modularized so that different DCs can communicate.
  • the process of implementing the VPN service there is no relationship between whether the entity GW and the PE are coupled. The problem that the existing VPN service is not practical due to the tight coupling between the GW and the PE is solved.
  • the APP selects different coupled service templates and input parameters according to the networking, and then generates and generates different VxLAN and L3VPN instances and access point information, and generates respective network models according to the mapping relationship.
  • the controller the entire process modular operation, the use of a unified interface, the realization of the business selection and creation of modeling operations, providing an efficient framework and way for the creation of various services.
  • FIG. 1 is a schematic structural diagram of a VPN service implementation apparatus according to a first embodiment of the present disclosure
  • FIG. 2 is a flowchart of a method for implementing a VPN service according to a second embodiment of the present disclosure
  • FIG. 3 is a schematic diagram of a networking of a communication system according to a third embodiment of the present disclosure.
  • FIG. 4 is a flowchart of a method for implementing a VPN service according to a third embodiment of the present disclosure
  • FIG. 5 is a flowchart of generating a service template in a third embodiment of the present disclosure.
  • FIG. 6 is a logic diagram of a loosely coupled model package in a third embodiment of the present disclosure.
  • FIG. 7 is a schematic diagram of a service template mapping generation network model in a third embodiment of the present disclosure.
  • FIG. 8 is a schematic diagram showing the internal functions of the layout layer in the third embodiment of the present disclosure.
  • FIG. 1 is a schematic structural diagram of a VPN service implementation apparatus according to a first embodiment of the present invention.
  • the VPN service implementation apparatus 1 provided by the present invention includes:
  • the building module 11 is configured to construct a virtual private network VPN service model based on a virtual scalable LAN-based cross-domain three-layer virtual private network (VxLAN over L3vpn);
  • the creating module 12 is configured to create a wide area network WAN orchestrator interacting with the WAN controller in the virtual private network VPN service model, configure the WAN WAN orchestrator to generate a wide area network WAN orchestration coupling network model, and create a interaction with the data center DC controller.
  • Data center DC orchestrator configure data center DC orchestrator, generate data center DC orchestration coupling network model;
  • the sending module 13 is configured to send a wide area network WAN orchestration coupling network model to the wide area network WAN controller, and the WAN controller of the wide area network establishes a virtual private network VPN service tunnel and implements mapping of the virtual scalable local area network identifier VNI to the layer 3 virtual private network L3vpn;
  • the data center DC orchestration coupling network model is sent to the data center DC controller for the data center DC controller to generate a virtual scalable local area network configuration table entry.
  • the building module 11 in the foregoing embodiment is further configured to generate a cloud service model package of the model-based coupling network after the component virtual private network VPN service model; the creating module is configured to invoke the cloud service model package, Create a WAN WAN orchestrator and a data center DC orchestrator based on the cloud service model package.
  • the building module 11 in the above embodiment is configured to create a service template ServiceTemplate in the Winery environment, set the service template name, and create nodes, node types, and configurations for the gateway GW, the device PE, the data center DC, and the WAN WAN. Parameters; create logical relationships between nodes; perform voice description data transfer processes with business processes.
  • the service template in the foregoing embodiment includes tight coupling and loose coupling; and the building module is configured to determine that the service template is tightly coupled or loosely coupled according to the combination or separation type of the gateway GW and the device PE in the networking.
  • the wide area network WAN orchestration coupling network model in the foregoing embodiment includes: setting a wide area network WAN orchestration coupling network model including a device PE name, a virtual scalable local area network identifier VNI, a service level, a port, a network segment address of the port, and a route The specifier RT and the routing target RD; the data center DC orchestration coupling network model includes the gateway GW name, the virtual scalable local area network identifier VNI, the routing specifier RT, the routing target RD, the port, and the network segment address of the port.
  • the creation module 12 in the above embodiment is configured to select the device PE to join the wide area network WAN, set the tenant name, the tenant network name, the joined data center DC name, the interface IP, the virtual scalable local area network identifier VNI, and the route.
  • the identifier RT and the route target RD are used to pre-configure the tunnel and tunnel service level between the PEs.
  • the creation module is also set to select different data center DCs, select the devices in the data center DC as the gateway GW, and set the tenant name and configuration.
  • the virtual scalable LAN identifier VXLAN ID that is consistent with the device PE, the configuration of the outgoing and incoming route identifier RT, the routing target RD, the interface IP, the selected service level of the tenant, and the mapping to the WAN WAN orchestration coupling network.
  • the level of tunnel service in the model is consistent with the device PE, the configuration of the outgoing and incoming route identifier RT, the routing target RD, the interface IP, the selected service level of the tenant, and the mapping to the WAN WAN orchestration coupling network.
  • the present invention provides a communication system including the virtual private network service implementation apparatus 1 provided by the present invention.
  • FIG. 2 is a flowchart of a method for implementing a virtual private network service according to a second embodiment of the present invention. As shown in FIG. 2, in the embodiment, the method for implementing a virtual private network service provided by the present invention includes the following steps:
  • S201 Constructing a virtual private network VPN service model of a cross-domain three-layer virtual private network (VxLAN over L3vpn) based on a virtual scalable local area network;
  • S202 In the virtual private network VPN service model, create a wide area network WAN orchestrator that interacts with the WAN controller of the wide area network, configure a wide area network WAN orchestrator, generate a wide area network WAN orchestration coupling network model, and create a data center DC that interacts with the data center DC controller.
  • An orchestrator configured with a data center DC orchestrator, and generates a data center DC orchestration coupling network model;
  • S203 Delivering a wide area network WAN orchestration coupling network model to a wide area network WAN controller, and the WAN controller of the WAN establishes a virtual private network VPN service tunnel and implements mapping of the virtual scalable local area network identifier VNI to the Layer 3 virtual private network L3vpn;
  • the DC orchestration couples the network model to the data center DC controller for the data center DC controller to generate a virtual scalable LAN configuration table entry.
  • the method in the foregoing embodiment further includes: generating a cloud service model package of the model network-based coupled network; creating the wide area network WAN orchestrator and the data center DC orchestrator includes : Call the cloud service model package to create a wide area network WAN orchestrator and a data center DC orchestrator based on the cloud service model package.
  • the component virtual private network VPN service model in the foregoing embodiment includes: creating a service template ServiceTemplate in the Winery environment, setting a service template name, and creating a node for the gateway GW, the device PE, the data center DC, and the WAN WAN, Node type and configuration parameters; create logical relationships between nodes; perform voice description data transfer processes with business processes.
  • the service template in the foregoing embodiment includes tight coupling and loose coupling.
  • the new service template in the Winery environment includes: determining that the service template is tight according to the combination or separation type of the gateway GW and the device PE in the networking. Coupling or loose coupling.
  • the wide area network WAN orchestration coupling network model in the foregoing embodiment includes: setting a wide area network WAN orchestration coupling network model including a device PE name, a virtual scalable local area network identifier VNI, and a service Level, port, port network segment address, route specifier RT, routing target RD; data center DC orchestration coupling network model includes gateway GW name, virtual scalable local area network identifier VNI, route specifier RT, routing target RD, port, port Network segment address.
  • the generating a wide area network WAN orchestration coupling network model in the foregoing embodiment includes: selecting a device PE to join the wide area network WAN, setting a tenant name, a tenant network name, a joined data center DC name, an interface IP, and a virtual scalable local area network. Identify the VNI, the route specifier RT, the route target RD, and the tunnel and tunnel service level between the pre-configured devices PE.
  • the data center DC orchestration coupling network model includes: selecting different data center DCs and selecting devices in the data center DC As the gateway GW, set the virtual extended LAN identifier VXLAN ID of the tenant name, configuration, and device PE, configure the outgoing/input route identifier RT, the routing destination RD, and the interface IP that match the PE, and select the service of the tenant. Level, mapped to the tunnel service level in the WAN-coupling coupling network model.
  • the data center is an organic combination of venues, tools, and processes for the integration, integration, sharing, and analysis of business systems and data resources. From the application level, including business systems, data warehouse-based analysis systems; from the data level, including operational data and analytical data and data and data integration / integration process; from the infrastructure level, including servers, networks, Storage and overall IT operation and maintenance services.
  • SDN The ultimate goal of SDN networks is to serve a diverse range of business application innovations. Therefore, with the deployment and promotion of SDN technology, more and more business applications will be developed. Such applications will be able to easily call the underlying network capabilities through the SDN northbound interface and use network resources as needed.
  • server virtualization and storage virtualization have been widely used. They pool the underlying physical resources and allocate them to users on demand. In contrast, traditional network resources are far from achieving similar flexibility, and the introduction of SDN can solve this problem well.
  • the SDN shields the difference between the underlying physical forwarding devices through the standard southbound interface, implements resource virtualization, and opens a flexible northbound interface for upper-layer services to perform network configuration and call network resources as needed.
  • the SDN controller is an application in a Software Defined Network (SDN) that is responsible for flow control to ensure an intelligent network.
  • SDN controller is based on protocols such as OpenFlow, allowing the server to tell the switch where to send packets.
  • the controllers used here include DC controllers and WAN controllers.
  • Multi-tenancy Tenant is a collection of resources that can be accessed by each service. Customers who use system or computer computing resources share multiple instances. The tenant's data is both isolated and shared, thus solving the data storage. problem.
  • the implementation of multi-tenant technology focuses on application context isolation and data isolation between different tenants, so that applications between different tenants do not interfere with each other, and data confidentiality is strong enough. .
  • Multi-tenant technology is widely used to develop a variety of cloud services.
  • the VxLAN configuration of the DC GW gateway and the public network PE device is through the DC APP.
  • the creation of the GW and the PE is tightly coupled, and the practicability is not strong.
  • the device configuration of the PE Layer 3 VPN is configured through the CLI.
  • the parameters such as RD and RT must be manually input.
  • the VxLAN and Layer 3 VPN resources to be delivered by the PE cannot be uniformly generated.
  • the opening between different DCs does not reflect the modeling creation of the business.
  • the object of the present invention is to provide a method for uniformly arranging resources required for generating a WAN controller and a DC controller in an orchestrator, and using a unified orchestration layer to complete resource scheduling tasks of the WAN controller and the DC controller.
  • the service parameters are generated and the VxLAN over L3vpn service network is set up. This allows normal communication between different DCs belonging to the same tenant to implement end-to-end service of the tenant network.
  • the method for generating a cross-domain VxLAN over L3vpn service includes the following steps:
  • This step is mainly to use the RESTCONF YANG language format to define the data model that interacts with the controller.
  • the REST interface provided by the WAN and DC orchestration module is invoked, and the YANG network model of the WAN controller and the DC controller is mapped.
  • the DC controller and the WAN controller are respectively converted into VxLAN configuration entries and L3VPN configurations and delivered to the GW and PE devices according to the obtained YANG network model.
  • the communication system provided in this embodiment is composed of five servers, an APP, a service orchestrator, two DC controllers, and a WAN controller.
  • the PE is composed of two T8000 devices, and two DCs are provided.
  • the internal GW consists of two M6000-S devices.
  • the layout layer has two sub-functions, namely DC programming module and WAN programming module, corresponding to their respective DC controllers and WAN controllers.
  • GW1 and GW2 are GWs in different DCs, and two PEs in the WAN.
  • the devices are connected to DC1 and DC2 respectively.
  • the PE consists of two T-8000 devices.
  • the GW consists of two M6000-s devices.
  • the method for generating an inter-domain Layer 3 VPN service includes the following steps:
  • step S401 is as shown in FIG. 5, which includes:
  • S501 Create a new service template ServiceTemplate in the Winery environment (including tight coupling, loose coupling, and create different templates according to different networking), and add a template name.
  • S502 Create a PE, GW, DC, and WAN (Wide Area Network) object node description, and set parameter attributes (including version, vendor, identifier, deployment specification, and so on) of each node.
  • S503 Create a topology relationship (including, dependency, connection, etc.) between the nodes.
  • the topology logical relationship of the template is as shown in FIG. 6, and describes the logical relationship and data flow direction of each node in the case of loose coupling.
  • S504 Create a PLAN package by using a business process execution language description data transfer process, and can use an XML file written by BPEL; specify the relationship between the interface of the model and the layout layer, call the interface of the two sub-modules; and import the business template after creating the PLAN package.
  • S505 Generate a CSARS package and store it in the OpenTOSCA file system for calling.
  • the process of creating a service template is divided into five steps.
  • the required service template is created in the WINERY environment.
  • PE-GW can be selected as one or PE-GW can be separated.
  • Creating a YANG network model for interaction between the WAN controller and the DC controller using RESTCONF YANG (Data Modeling Language, used to configure models and simulate business operations) language format definition and controller interaction data model, creating additions and deletions
  • the RPC interface defines the required fields for the two network models.
  • the main fields defined by the WAN model are PE name, VNI (VxLAN id), bandwidth, service level, port, port segment address, RT, RD; the main fields defined by the DC model are the selected GW name, VNI, RT. Network address of the RD, port, and port.
  • Use YANG TOOLS tool to convert to JAVA code, for the arranger to call the south interface interactively.
  • S403 Complete basic pre-configuration and build the basic environment: specify the WAN and the DC controller in the orchestrator, and respectively bind the network element in the two controllers, and the basic configuration part is shown in the monitoring and resource management in FIG. 8;
  • the controller creates the required TE tunnel, creates a bandwidth template, and binds the policy to different service levels for mapping purposes.
  • tentative tenants can be divided into 7 different levels, and the hierarchical relationship between DC and TE tunnels is established through mapping.
  • MPLS (Multi-Protocol Label Switching) label module and BGP for creating GE and PE are enabled. (Border Gateway Protocol) neighbor relationship.
  • the resource management part includes resource discovery, import, and storage; the resources are divided into tenant resources, physical resources, and service resources.
  • the tenant includes the tenant name and the corresponding level classification.
  • Physical resources include discovered devices, gw and pe, and service resources include links, tunnels, and template levels.
  • service orchestration functions include: logical relationships of networking, hierarchical mapping of dc to wan, rd, and rt. Assign, create service level templates, etc. 3.
  • Monitoring includes topology display, logging, alarms, and faults. diagnosis.
  • S404 Generating a loosely coupled network model for WAN and DC programming: in the ODL (Object Definition Language) framework, the workflow is generated according to different business models and network models, and the configuration parameters of the service are generated according to the mapping relationship, and converted into VxLAN YANG network.
  • the model and the L3VPN YANG network model are delivered to the DC controller and the WAN controller, respectively.
  • the mapping generation process is shown in Figure 7:
  • Map allocation to generate the required parameters set the tenant name, tenant network name, joined DC name, ERIB interface IP, VNI ID, RD, RT, etc.; pre-configure the tunnel between the PE and the service level above the tunnel, the tunnel level from The DC layout model map is obtained;
  • Generate a DC-coupled loose-coupling network model Select a different DC, select the device in the DC as the GW gateway, set the VXLAN ID of the tenant name, configuration, and PE, and configure the outgoing and incoming RT, RD, and ERIB interfaces that match the PE.
  • the IP selected to set the tenant's corresponding gold ⁇ silver ⁇ copper service level, maps to the tunnel level of the WAN orchestration model.
  • the service model is converted into a DC and WAN YANG model according to the service level and name created by the tenant service, and the same service level, port address, RD, and the like are matched.
  • RT and select the corresponding bandwidth, convert to the corresponding YANG model and then separate the respective controllers.
  • the basic configuration of PE-GW is as follows
  • GW1 ip: 20.1.1.1/24, vxlan 1, rd 2: 2, import rt 2: 2, export rt2: 2;
  • GW2 ip: 40.1.1.1/24, vxlan 1, rd 2:2, import rt 2:2, export rt2:2;
  • PE1 ip vrf pe1_vni1, rd 1:1, import rt 1:1, export rt1:1, and the remaining vxlan configurations are the same as GW1 configuration, and Ip is on the same network segment.
  • PE2 ip vrf pe1_vni1, rd 1:1, import rt 1:1, export rt1:1, and the remaining vxlan configurations are the same as GW2 configuration, and Ip is on the same network segment.
  • S405 The WAN programming loosely coupled network model and the DC programming loosely coupled network model are respectively sent to the WAN controller and the DC controller through the REST interface; the DC controller generates a VxLAN configuration entry according to the service data, and sends the VxLAN configuration entry to the openflow flow table to the M6000-S device; WAN controller establishes a VPN tunnel through PCEP according to the VPN link relationship, and matches different service levels; generates L3VPN configuration according to L3VPN service data, implements VNI to L3VPN mapping according to VNI mapping rules, and delivers T8000 through NETCONF interface device.
  • the method for creating a service provides a cross-domain life-cycle network service scheduling and management. Different service templates and network templates can be added according to different networking requirements and different service functions to generate different services.
  • the function provides a unified technical solution.
  • the OpenTOSCA business model is created, combined with the YANG network model of the WAN controller and the DC controller, the parameters required to generate the GW and the PE in the DC are uniformly arranged, and the end-to-end service between the public network PEs is opened, and the process is modularized. Different DCs can communicate.
  • the storage medium may be a ROM/RAM, a magnetic disk, an optical disk, or the like.
  • the present disclosure provides a non-transitory computer readable storage medium having stored therein instructions for performing a virtual private network service when one or more processors in a data recovery device execute the instructions
  • the method comprises: constructing a virtual private network VPN service model of a cross-domain three-layer virtual private network based on a virtual scalable local area network; and creating a wide area network (WAN) WAN interacting with the wide area network WAN controller in the virtual private network VPN service model
  • the orchestrator configures the wide area network WAN orchestrator to generate a wide area network WAN orchestration coupling network model; creates a data center DC orchestrator that interacts with the data center DC controller, configures the data center DC orchestrator, and generates a data center DC orchestration coupling network Modeling; delivering the wide area network WAN orchestration coupling network model to the wide area network WAN controller, for the WAN controller to establish a virtual private network VPN service tunnel and implementing a virtual scalable local area network identifier VNI to a three layer virtual private
  • the invention provides a VPN service implementation method. After creating a VPN service model, a wide area network WAN orchestration coupling network model and a data center DC arrangement coupling network model are created, so that a network model of the WAN controller and the DC controller is combined to uniformly generate a DC.
  • the parameters required by the GW and the PE are used to open the end-to-end service between the PEs of the public network, and the process is modularized so that different DCs can communicate.
  • the APP selects different coupled service templates and input parameters according to the networking, and then generates and generates different VxLAN and L3VPN instances and access point information, and generates respective network models according to the mapping relationship.
  • the controller the entire process modular operation, the use of a unified interface, the realization of the business selection and creation of modeling operations, providing an efficient framework and way for the creation of various services.
  • the implementation device of the VPN service provided by the embodiment of the present application and each module or unit in the communication system may pass through one or more digital signal processors (DSPs), application specific integrated circuits (ASICs), processors, microprocessors, controllers. Implemented by a microcontroller, field programmable array (FPGA), programmable logic device, or other electronic unit, or any combination thereof. Some of the functions or processes described in this application embodiment may also be implemented by software executing on a processor.
  • DSPs digital signal processors
  • ASICs application specific integrated circuits
  • FPGA field programmable array
  • programmable logic device or other electronic unit, or any combination thereof.
  • the present disclosure relates to the field of VPN (Virtual Private Network), which realizes the modeling operation of service selection and creation, and provides an efficient framework and manner for the creation of various services.
  • VPN Virtual Private Network

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本公开提供了一种虚拟专用网业务实现方法、装置及通信系统，该方法包括：构建基于VxLAN over L3vpn的VPN业务模型；在VPN业务模型中，配置并生成WAN编排耦合网络模型、DC编排耦合网络模型；下发WAN编排耦合网络模型至WAN控制器，供其建立VPN业务隧道及实现VNI到L3vpn的映射；下发DC编排耦合网络模型至DC控制器，供其生成VxLAN配置表项。通过本公开的实施，结合WAN控制器和DC控制器的网络模型，统一编排生成DC中GW和PE所需的参数，打通公网PE之间的端到端业务，流程模块化，使不同的DC可以通讯，解决了现有VPN业务因为GW和PE紧耦合导致的实用性不强的问题。 (图2)

Description

虚拟专用网业务实现方法、装置及通信系统 技术领域
本公开涉及VPN(Virtual Private Network，虚拟专用网)领域，尤其涉及一种VPN业务实现方法、装置及通信系统。
背景技术
在现有VPN业务技术中，DC(Data Center：数据中心)的GW(GateWay，网关)和公网PE(运营商边缘路由器)设备的VxLAN(virtual Extensible LAN，虚拟可扩展局域网)配置是通过DC的APP(Application，应用程序，基于网络控制面和转发面之上的增值应用)进行创建，GW和PE紧耦合，实用性不强；PE三层VPN的设备配置是通过CLI(command-lineinterface，命令行界面)进行配置，RD(Route-Distinguisher，路由区分符，用于标示PE设备上不同VPN实例)、RT(Route-Target，路由目标，决定VPN路由的收发和过滤)等参数需手工输入，PE要下发的VxLAN和三层VPN资源不能统一生成，不同DC之间的打通不能体现业务的模型化创建。
针对上述问题，提出一种解决现有VPN业务因为GW和PE紧耦合导致的实用性不强的VPN业务实现方法，是本领域技术人员亟待解决的技术问题。
发明内容
本公开提供了一种VPN业务实现方法、装置及通信系统，以解决现有VPN业务因为GW和PE紧耦合导致的实用性不强的问题。
本公开提供了一种虚拟专用网业务实现方法，其包括：
构建基于虚拟可扩展局域网的跨域三层虚拟专用网(VxLAN over L3vpn)的虚拟专用网VPN业务模型；
在虚拟专用网VPN业务模型中，创建与广域网WAN控制器交互的广域网WAN编排器，配置广域网WAN编排器，生成广域网WAN编排耦合网络模型；创建与数据中心DC控制器交互的数据中心DC编排器，配置数据中心DC编排器，生成数据中心DC编排耦合网络模型；
下发广域网WAN编排耦合网络模型至广域网WAN控制器，供广域网WAN控制器建立虚拟专用网VPN业务隧道及实现虚拟可扩展局域网标识VNI到三层虚拟专用网L3vpn的映射；下发数据中心DC编排耦合网络模型至数据中心DC控制器，供数据中心DC控制器生成虚拟可扩展局域网配置表项。
在构件虚拟专用网VPN业务模型之后，该方法还包括：生成基于模型构架的耦 合网络的云服务模型包；创建广域网WAN编排器及数据中心DC编排器包括：调用云服务模型包，根据云服务模型包创建广域网WAN编排器及数据中心DC编排器。
构件虚拟专用网VPN业务模型包括：在Winery环境中新建业务模板ServiceTemplate，设置业务模板名称；为网关GW、设备PE、数据中心DC和广域网WAN创建节点、节点类型及配置参数；创建节点之间的逻辑关系；用业务流程执行语音描述数据传递过程。
业务模板包括紧耦合和松耦合；在Winery环境中新建业务模板包括：根据组网中网关GW与设备PE的合一或者分开类型，确定业务模板为紧耦合或松耦合。
广域网WAN编排耦合网络模型包括：设置广域网WAN编排耦合网络模型包括设备PE名称、虚拟可扩展局域网标识VNI、服务等级、端口、端口的网段地址、路由区分符RT、路由目标RD；数据中心DC编排耦合网络模型包括网关GW名称、虚拟可扩展局域网标识VNI、路由区分符RT、路由目标RD、端口、端口的网段地址。
生成广域网WAN编排耦合网络模型包括：选取设备PE加入到广域网WAN，设置租户名称、租户网络名称、加入的数据中心DC名称、接口IP、虚拟可扩展局域网标识VNI、路由区分符RT、路由目标RD，预配置设备PE之间的隧道和隧道服务等级；生成数据中心DC编排耦合网络模型包括：选取不同的数据中心DC，将数据中心DC内的设备选作网关GW，设置租户名称、配置和设备PE一致的虚拟可扩展局域网标识VXLAN ID，配置和PE相匹配的出\入路由区分符RT、路由目标RD，接口IP，选定设置该租户的服务等级，映射到广域网WAN编排耦合网络模型中的隧道服务等级。
本公开提供了一种虚拟专用网业务实现装置，其包括：
构建模块，设置为构建基于虚拟可扩展局域网的跨域三层虚拟专用网(VxLAN over L3vpn)的虚拟专用网VPN业务模型；
创建模块，设置为在虚拟专用网VPN业务模型中，创建与广域网WAN控制器交互的广域网WAN编排器，配置广域网WAN编排器，生成广域网WAN编排耦合网络模型；创建与数据中心DC控制器交互的数据中心DC编排器，配置数据中心DC编排器，生成数据中心DC编排耦合网络模型；
发送模块，设置为下发广域网WAN编排耦合网络模型至广域网WAN控制器，供广域网WAN控制器建立虚拟专用网VPN业务隧道及实现虚拟可扩展局域网标识VNI到三层虚拟专用网L3vpn的映射；下发数据中心DC编排耦合网络模型至数据中心DC控制器，供数据中心DC控制器生成虚拟可扩展局域网配置表项。
构建模块在构件虚拟专用网VPN业务模型之后，还设置为生成基于模型构架的耦合网络的云服务模型包；创建模块设置为调用云服务模型包，根据云服务模型包创建广域网WAN编排器及数据中心DC编排器。
构建模块设置为在Winery环境中新建业务模板ServiceTemplate，设置业务模板名称；为网关GW、设备PE、数据中心DC和广域网WAN创建节点、节点类型及配置参数；创建节点之间的逻辑关系；用业务流程执行语音描述数据传递过程。
业务模板包括紧耦合和松耦合；构建模块设置为根据组网中网关GW与设备PE的合一或者分开类型，确定业务模板为紧耦合或松耦合。
广域网WAN编排耦合网络模型包括：设置广域网WAN编排耦合网络模型包括设备PE名称、虚拟可扩展局域网标识VNI、服务等级、端口、端口的网段地址、路由区分符RT、路由目标RD；数据中心DC编排耦合网络模型包括网关GW名称、虚拟可扩展局域网标识VNI、路由区分符RT、路由目标RD、端口、端口的网段地址。
创建模块设置为选取设备PE加入到广域网WAN，设置租户名称、租户网络名称、加入的数据中心DC名称、接口IP、虚拟可扩展局域网标识VNI、路由区分符RT、路由目标RD，预配置设备PE之间的隧道和隧道服务等级；创建模块还设置为选取不同的数据中心DC，将数据中心DC内的设备选作网关GW，设置租户名称、配置和设备PE一致的虚拟可扩展局域网标识VXLAN ID，配置和PE相匹配的出\入路由区分符RT、路由目标RD，接口IP，选定设置该租户的服务等级，映射到广域网WAN编排耦合网络模型中的隧道服务等级。
本公开提供了一种通信系统，其包括本公开提供的虚拟专用网业务实现装置。
本公开的有益效果：
本公开提供了一种VPN业务实现方法，创建VPN业务模型后，创建广域网WAN编排耦合网络模型及数据中心DC编排耦合网络模型，这样结合WAN控制器和DC控制器的网络模型，统一编排生成DC中GW和PE所需的参数，打通公网PE之间的端到端业务，流程模块化，使不同的DC可以通讯，在该VPN业务实现过程中，与实体GW和PE是否耦合没有关系，解决了现有VPN业务因为GW和PE紧耦合导致的实用性不强的问题。进一步的，APP发出创建租户业务的需求后，根据组网选择不同的耦合业务模板和输入参数，然后统一编排生成不同的VxLAN和L3VPN实例和接入点信息，根据映射关系生成各自的网络模型下发控制器，整个流程模块化操作，使用统一接口，实现了业务选择和创建的模型化操作，为各种业务的创建提供了高效的框架和方式。
附图说明
图1为本公开第一实施例提供的VPN业务实现装置的结构示意图；
图2为本公开第二实施例提供的VPN业务实现方法的流程图；
图3为本公开第三实施例提供的通信系统组网示意图；
图4为本公开第三实施例中VPN业务实现方法的流程图；
图5为本公开第三实施例中生成业务模板的流程图；
图6为本公开第三实施例中松耦合模型包逻辑图；
图7为本公开第三实施例中业务模板映射生成网络模型的示意图；
图8为本公开第三实施例中编排层内部功能示意图。
具体实施方式
现通过具体实施方式结合附图的方式对本发明做出进一步的诠释说明。
第一实施例：
图1为本发明第一实施例提供的VPN业务实现装置的结构示意图，由图1可知，在本实施例中，本发明提供的VPN业务实现装置1包括：
构建模块11，设置为构建基于虚拟可扩展局域网的跨域三层虚拟专用网(VxLAN over L3vpn)的虚拟专用网VPN业务模型；
创建模块12，设置为在虚拟专用网VPN业务模型中，创建与广域网WAN控制器交互的广域网WAN编排器，配置广域网WAN编排器，生成广域网WAN编排耦合网络模型；创建与数据中心DC控制器交互的数据中心DC编排器，配置数据中心DC编排器，生成数据中心DC编排耦合网络模型；
发送模块13，设置为下发广域网WAN编排耦合网络模型至广域网WAN控制器，供广域网WAN控制器建立虚拟专用网VPN业务隧道及实现虚拟可扩展局域网标识VNI到三层虚拟专用网L3vpn的映射；下发数据中心DC编排耦合网络模型至数据中心DC控制器，供数据中心DC控制器生成虚拟可扩展局域网配置表项。
在一些实施例中，上述实施例中的构建模块11在构件虚拟专用网VPN业务模型之后，还设置为生成基于模型构架的耦合网络的云服务模型包；创建模块设置为调用云服务模型包，根据云服务模型包创建广域网WAN编排器及数据中心DC编排器。
在一些实施例中，上述实施例中的构建模块11设置为在Winery环境中新建业务模板ServiceTemplate，设置业务模板名称；为网关GW、设备PE、数据中心DC和广域网WAN创建节点、节点类型及配置参数；创建节点之间的逻辑关系；用业务流程执行语音描述数据传递过程。
在一些实施例中，上述实施例中的业务模板包括紧耦合和松耦合；构建模块设置为根据组网中网关GW与设备PE的合一或者分开类型，确定业务模板为紧耦合或松耦合。
在一些实施例中，上述实施例中的广域网WAN编排耦合网络模型包括：设置广域网WAN编排耦合网络模型包括设备PE名称、虚拟可扩展局域网标识VNI、服务等级、端口、端口的网段地址、路由区分符RT、路由目标RD；数据中心DC编排耦合网络模型包括网关GW名称、虚拟可扩展局域网标识VNI、路由区分符RT、路由目标RD、端口、端口的网段地址。
在一些实施例中，上述实施例中的创建模块12设置为选取设备PE加入到广域网WAN，设置租户名称、租户网络名称、加入的数据中心DC名称、接口IP、虚拟可扩展局域网标识VNI、路由区分符RT、路由目标RD，预配置设备PE之间的隧道和隧道服务等级；创建模块还设置为选取不同的数据中心DC，将数据中心DC内的设备选作网关GW，设置租户名称、配置和设备PE一致的虚拟可扩展局域网标识VXLAN ID，配置和PE相匹配的出\入路由区分符RT、路由目标RD，接口IP，选定设置该租户的服务等级，映射到广域网WAN编排耦合网络模型中的隧道服务等级。
对应的，本发明提供了一种通信系统，其包括本发明提供的虚拟专用网业务实现装置1。
第二实施例：
图2为本发明第二实施例提供的虚拟专用网业务实现方法的流程图，由图2可知，在本实施例中，本发明提供的虚拟专用网业务实现方法包括以下步骤：
S201：构建基于虚拟可扩展局域网的跨域三层虚拟专用网(VxLAN over L3vpn)的虚拟专用网VPN业务模型；
S202：在虚拟专用网VPN业务模型中，创建与广域网WAN控制器交互的广域网WAN编排器，配置广域网WAN编排器，生成广域网WAN编排耦合网络模型；创建与数据中心DC控制器交互的数据中心DC编排器，配置数据中心DC编排器，生成数据中心DC编排耦合网络模型；
S203：下发广域网WAN编排耦合网络模型至广域网WAN控制器，供广域网WAN控制器建立虚拟专用网VPN业务隧道及实现虚拟可扩展局域网标识VNI到三层虚拟专用网L3vpn的映射；下发数据中心DC编排耦合网络模型至数据中心DC控制器，供数据中心DC控制器生成虚拟可扩展局域网配置表项。
在一些实施例中，上述实施例中的方法在构件虚拟专用网VPN业务模型之后，还包括：生成基于模型构架的耦合网络的云服务模型包；创建广域网WAN编排器及数据中心DC编排器包括：调用云服务模型包，根据云服务模型包创建广域网WAN编排器及数据中心DC编排器。
在一些实施例中，上述实施例中的构件虚拟专用网VPN业务模型包括：在Winery环境中新建业务模板ServiceTemplate，设置业务模板名称；为网关GW、设备PE、数据中心DC和广域网WAN创建节点、节点类型及配置参数；创建节点之间的逻辑关系；用业务流程执行语音描述数据传递过程。
在一些实施例中，上述实施例中的业务模板包括紧耦合和松耦合；在Winery环境中新建业务模板包括：根据组网中网关GW与设备PE的合一或者分开类型，确定业务模板为紧耦合或松耦合。
在一些实施例中，上述实施例中的广域网WAN编排耦合网络模型包括：设置广域网WAN编排耦合网络模型包括设备PE名称、虚拟可扩展局域网标识VNI、服务 等级、端口、端口的网段地址、路由区分符RT、路由目标RD；数据中心DC编排耦合网络模型包括网关GW名称、虚拟可扩展局域网标识VNI、路由区分符RT、路由目标RD、端口、端口的网段地址。
在一些实施例中，上述实施例中的生成广域网WAN编排耦合网络模型包括：选取设备PE加入到广域网WAN，设置租户名称、租户网络名称、加入的数据中心DC名称、接口IP、虚拟可扩展局域网标识VNI、路由区分符RT、路由目标RD，预配置设备PE之间的隧道和隧道服务等级；生成数据中心DC编排耦合网络模型包括：选取不同的数据中心DC，将数据中心DC内的设备选作网关GW，设置租户名称、配置和设备PE一致的虚拟可扩展局域网标识VXLAN ID，配置和PE相匹配的出\入路由区分符RT、路由目标RD，接口IP，选定设置该租户的服务等级，映射到广域网WAN编排耦合网络模型中的隧道服务等级。
第三实施例：
现结合具体应用场景对本发明做进一步的诠释说明。
DC：数据中心是企业的业务系统与数据资源进行集中、集成、共享、分析的场地、工具、流程等的有机组合。从应用层面看，包括业务系统、基于数据仓库的分析系统；从数据层面看，包括操作型数据和分析型数据以及数据与数据的集成/整合流程；从基础设施层面看，包括服务器、网络、存储和整体IT运行维护服务。
SDN：SDN网络的最终目标是服务于多样化的业务应用创新。因此随着SDN技术的部署和推广，将会有越来越多的业务应用被研发，这类应用将能够便捷地通过SDN北向接口调用底层网络能力，按需使用网络资源。在当前的云计算业务中，服务器虚拟化、存储虚拟化都已经被广泛应用，它们将底层的物理资源进行池化共享，进而按需分配给用户使用。相比之下，传统的网络资源远远没有达到类似的灵活性，而SDN的引入则能够很好地解决这一问题。SDN通过标准的南向接口屏蔽了底层物理转发设备的差异，实现了资源的虚拟化，同时开放了灵活的北向接口供上层业务按需进行网络配置并调用网络资源。
控制器：SDN控制器是软件定义网络(SDN)中的应用程序，负责流量控制以确保智能网络。SDN控制器是基于如OpenFlow等协议的，允许服务器告诉交换机向哪里发送数据包。这里用到的控制器包括DC控制器和WAN控制器
多租户：租户(tenant)是各个服务中的一些可以访问的资源集合，使用系统或电脑运算资源的客户，多个租户共用一个实例，租户的数据既有隔离又有共享,从而解决数据存储的问题。多租户技术的实现重点，在于不同租户间应用程序环境的隔离(application context isolation)以及数据的隔离(data isolation)，以维持不同租户间应用程序不会相互干扰，同时数据的保密性也够强。多租户技术被广为运用于开发各式云服务。
在现有技术中DC的GW网关和公网PE设备的VxLAN配置是通过DC的APP 进行创建，GW和PE紧耦合，实用性不强；PE三层VPN的设备配置是通过CLI进行配置，RD、RT等参数需手工输入，PE要下发的VxLAN和三层VPN资源不能统一生成，不同DC之间的打通不能体现业务的模型化创建。本发明的目的就是提供一种在编排器中统一编排生成WAN控制器和DC控制器所需的资源的方法，使用统一的编排层来完成WAN控制器和DC控制器所需资源的编排任务，生成业务参数，组建VxLAN over L3vpn业务网络；从而可以在属于同一租户的不同DC间可以正常通讯，实现租户网络端到端业务。
具体的，本实施例提供的生成跨域VxLAN over L3vpn业务的方法包括如下步骤：
在WINERY环境中创建OPENTOSCA VxLAN over L3vpn业务模型：创建业务模型的CSAR包，里面包括业务的拓扑逻辑、工作流和各个WEB Service的定义描述，然后存入文件系统。根据设备的不同组网创建不同的业务模型。
创建WAN控制器交互和DC控制器交互的YANG网络模型：这个步骤主要是采用RESTCONF YANG语言格式定义和控制器交互的数据模型。
完成基本预配置和搭建基础环境：完成监控和资源管理功能，搭建一些基础配置，编排器中指定控制器等和网元，创建PE之间的隧道和使能标签分配。
根据业务模型定义的工作流，调用WAN和DC编排模块提供的REST接口，映射生成WAN控制器和DC控制器的YANG网络模型。
DC控制器和WAN控制器根据得到的YANG网络模型分别转换为VxLAN配置表项和L3VPN配置下发到GW和PE设备。
现以松耦合为例，结合图3-8对本发明进行详细说明。
如图3所示，本实施例提供的通信系统在硬件上，由五台服务器组成，APP、业务编排器、两个DC控制器和WAN控制器，PE由两台T8000设备组成，两个DC内部的GW由两台M6000-S设备组成。在图3中，编排层有两个子功能，分别为DC编排模块和WAN编排模块，分别对应各自的DC控制器和WAN控制器，GW1和GW2分别为不同DC中的GW，WAN里面两台PE设备分别连接DC1和DC2，PE由两台T-8000设备组成，GW由两台M6000-s设备组成。
如图4所示，本实施例提供的生成跨域三层VPN业务的方法，包括以下步骤：
S401：Winery环境中构建VxLAN over L3vpn业务模型；生成OpenTOSCA(一个基于模型的架构，将部署和管理定义成抽象的层次化的组件模式属性)的松耦合组网的CSARS(OpenTOSCA的云服务模型，CSAR类型的压缩包文件)包。
步骤S401的具体实现流程如图5所示，其包括：
S501：Winery环境中新建业务模板ServiceTemplate(包括紧耦合、松耦合，根据不同的组网创建不同的模板)，添加模板名称。
S502：创建PE、GW、DC、WAN(Wide Area Network，广域网)对象节点描述，设置各个节点的参数属性(包括版本、厂商、标识、部署规格等)。
S503：创建节点之间的拓扑关系(包含、依赖、连接等)，本模板拓扑逻辑关系如图6所示，描述了松耦合情况下各个节点的逻辑关系和数据流向。
在图6中，描述了松耦合情况下各个节点的逻辑关系和数据流向，工作流中规定了各个节点模型对应的参数字段，规定了WAN编排功能和DC编排功能的REST接口调用顺序和对应的URL以及回调接口；完成DC需要下发的服务等级参数的映射传递，租户名称、网络名称、VNI的传递等，最终转换为各自的YANG网络模型下发控制器。
S504：用业务流程执行语言描述数据传递过程创建PLAN包，可以用BPEL写的XML文件；来指定模型和编排层的接口的关系，调用两个分模块的接口；创建PLAN包后导入业务模板。
S505：生成CSARS包存入OpenTOSCA文件系统供调用。
在图5中，创建业务模板流程图分为五个步骤，WINERY环境中创建所需的业务模板，根据组网不同，可以选择PE-GW合一的，也可以PE-GW分开的，本例以松耦合为例创建；创建GW、PE、WAN、DC、IROS、SDNO逻辑节点；为各个节点添加属性；BPEL语言创建工作流，编写对应的XML文件，导入业务模型，然后导出CSAR包供调用。
S402：创建WAN控制器交互和DC控制器交互的YANG网络模型：采用RESTCONF YANG(数据建模语言,用来配置模型和模拟业务操作)语言格式定义和控制器交互的数据模型，创建增删改的RPC接口，定义两个网络模型的所需的字段。WAN模型定为的主要字段为PE名称、VNI(VxLAN id)、带宽、服务等级、端口、端口的网段地址、RT、RD；DC模型定义的主要字段为选定的GW名称、VNI、RT、RD、端口、端口的网段地址。利用YANG TOOLS工具转换为JAVA代码，供编排器南向接口交互调用。
S403：完成基本预配置和搭建基础环境：在编排器中指定WAN和DC控制器，在两个控制器中分别绑定网元，基础配置部分如图8里面的监控和资源管理所示；在控制器上面创建所需的TE隧道、创建带宽模板和策略绑定到不同的服务等级上面，以供映射使用。目前暂定租户可以分7个不同的等级，通过映射后建立DC和TE隧道之间的等级关系；使能MPLS(Multi-Protocol Label Switching，多协议标签交换)标签模块和创建GE和PE的BGP(Border Gateway Protocol，边界网关协议)邻居关系。
在图8中，基本功能分三部分：一、资源管理部分，包括资源的发现，导入，存储入库；资源分为租户资源、物理资源、业务资源等，租户包括租户名称、对应的等级分类，物理资源包括发现的设备，gw和pe，业务资源包括链路、隧道、模板等级等配置；二、业务编排功能包括：组网耦合的逻辑关系、dc到wan的等级映射、rd、rt统一分配，创建服务等级模板等；三、监控包括拓扑展示、日志记录、告警和故障 诊断。
S404：生成WAN和DC编排松耦合网络模型：在ODL(Object Definition Language，对象定义语言)框架里面工作流根据不同的业务模型和网络模型，根据映射关系生成业务的配置参数，转换为VxLAN YANG网络模型和L3VPN YANG网络模型分别下发至DC控制器和WAN控制器。映射生成过程如图7所示：
生成WAN编排松耦合网络模型，选取两台PE设备加入到WAN网络。映射分配生成所需的参数：设置租户名称、租户网络名称、加入的DC名称、ERIB接口IP、VNI ID、RD、RT等；预配置PE之间的隧道和隧道上面的服务等级，隧道等级从DC编排模型映射获取到；
生成DC编排松耦合网络模型：选取不同的DC，将DC内的设备选作GW网关，设置租户名称、配置和PE一致的VXLAN ID，配置和PE相匹配的出\入RT、RD，ERIB接口的IP，选定设置该租户相应的金\银\铜服务等级，映射到WAN编排模型的隧道等级。
在图7中，说明了，三个模型之间的映射关系，业务模型根据租户业务创建的服务等级、名称等参数分别转换为DC和WAN YANG模型，匹配一样的服务等级、端口地址、RD、RT、并选择相对应的带宽，转换为对应的YANG模型后分别下各自的控制器。PE-GW基本配置如下
GW1：ip：20.1.1.1/24、vxlan 1、rd 2:2、import rt 2:2、export rt2:2；
GW2：ip：40.1.1.1/24、vxlan 1、rd 2:2、import rt 2:2、export rt2:2；
PE1：ip vrf pe1_vni1、rd 1:1、import rt 1:1、export rt1:1、其余vxlan配置同GW1配置，Ip在同一网段；
PE2：ip vrf pe1_vni1、rd 1:1、import rt 1:1、export rt1:1、其余vxlan配置同GW2配置，Ip在同一网段。
S405：将WAN编排松耦合网络模型和DC编排松耦合网络模型通过REST接口分别下发至WAN控制器和DC控制器；DC控制器根据业务数据生成VxLAN配置表项，通过openflow流表下发至M6000-S设备；WAN控制器根据VPN链接关系，通过PCEP建立VPN隧道，匹配不同的服务等级；根据L3VPN业务数据生成L3VPN配置，根据VNI映射规则实现VNI到L3VPN的映射，通过NETCONF接口下发T8000设备。
从以上这些实施步骤可以证明本发明是有效并且可行的。
本实施例提供的模型化创建业务的方法，实现跨域的全生命周期网络业务编排和管理，可以根据不同的组网需求、不同的业务功能添加不同的业务模板和网络模板，生成不同的业务功能提供统一的技术方案。在创建OpenTOSCA业务模型后，结合WAN控制器和DC控制器的YANG网络模型，统一编排生成DC中GW和PE所需的参数，打通公网PE之间的端到端业务，流程模块化，使不同的DC可以通讯。APP 发出创建租户业务的需求后，根据组网选择不同的耦合业务模板和输入参数，然后统一编排生成不同的VxLAN和L3VPN实例和接入点信息，根据映射关系生成各自的网络模型下发控制器，整个流程模块化操作，使用统一的YANG接口，实现了业务选择和创建的模型化操作，为各种业务的创建提供了高效的框架和方式。较老方法有两大优点：1.业务创建模型化2.生成资源统一化。
本领域普通技术人员可以理解，实现上述实施例方法中的全部或部分步骤是可以通过程序来指令相关的硬件来完成，所述的程序可以存储于计算机可读取存储介质中。其中，所述的存储介质可以为ROM/RAM、磁碟、光盘等。
例如，本公开提供一种非临时性计算机可读存储介质，其中存储有指令，当数据恢复装置中的一个或多个处理器执行所述指令时，所述VPN业务实现装置执行虚拟专用网业务实现方法，该方法包括：构建基于虚拟可扩展局域网的跨域三层虚拟专用网的虚拟专用网VPN业务模型；在所述虚拟专用网VPN业务模型中，创建与广域网WAN控制器交互的广域网WAN编排器，配置所述广域网WAN编排器，生成广域网WAN编排耦合网络模型；创建与数据中心DC控制器交互的数据中心DC编排器，配置所述数据中心DC编排器，生成数据中心DC编排耦合网络模型；下发所述广域网WAN编排耦合网络模型至所述广域网WAN控制器，供所述广域网WAN控制器建立虚拟专用网VPN业务隧道及实现虚拟可扩展局域网标识VNI到三层虚拟专用网L3vpn的映射；下发所述数据中心DC编排耦合网络模型至所述数据中心DC控制器，供所述数据中心DC控制器生成虚拟可扩展局域网配置表项。
综上可知，通过本发明的实施，至少存在以下有益效果：
本发明提供了一种VPN业务实现方法，创建VPN业务模型后，创建广域网WAN编排耦合网络模型及数据中心DC编排耦合网络模型，这样结合WAN控制器和DC控制器的网络模型，统一编排生成DC中GW和PE所需的参数，打通公网PE之间的端到端业务，流程模块化，使不同的DC可以通讯，在该VPN业务实现过程中，与实体GW和PE是否耦合没有关系，解决了现有VPN业务因为GW和PE紧耦合导致的实用性不强的问题。进一步的，APP发出创建租户业务的需求后，根据组网选择不同的耦合业务模板和输入参数，然后统一编排生成不同的VxLAN和L3VPN实例和接入点信息，根据映射关系生成各自的网络模型下发控制器，整个流程模块化操作，使用统一接口，实现了业务选择和创建的模型化操作，为各种业务的创建提供了高效的框架和方式。
本申请实施例提供的VPN业务的实现装置及通信系统中的各个模块或单元可以通过一个或多个数字信号处理器(DSP)、专用集成电路(ASIC)、处理器、微处理器、控制器、微控制器、现场可编程阵列(FPGA)、可编程逻辑器件或其他电子单元或其任意组合来实现。在本申请实施例中描述的一些功能或处理也可以通过在处理器上执行的软件来实现。
工业实用性
本公开涉及VPN(Virtual Private Network，虚拟专用网)领域，实现了业务选择和创建的模型化操作，为各种业务的创建提供了高效的框架和方式。
以上仅是本公开的具体实施方式而已，并非对本发明做任何形式上的限制，凡是依据本发明的技术实质对以上实施方式所做的任意简单修改、等同变化、结合或修饰，均仍属于本发明技术方案的保护范围。

Claims (13)

  1. 一种虚拟专用网VPN业务实现方法，包括：
    构建基于虚拟可扩展局域网的跨域三层虚拟专用网的虚拟专用网VPN业务模型；
    在所述虚拟专用网VPN业务模型中，创建与广域网WAN控制器交互的广域网WAN编排器，配置所述广域网WAN编排器，生成广域网WAN编排耦合网络模型；创建与数据中心DC控制器交互的数据中心DC编排器，配置所述数据中心DC编排器，生成数据中心DC编排耦合网络模型；
    下发所述广域网WAN编排耦合网络模型至所述广域网WAN控制器，供所述广域网WAN控制器建立虚拟专用网VPN业务隧道及实现虚拟可扩展局域网标识VNI到三层虚拟专用网L3vpn的映射；下发所述数据中心DC编排耦合网络模型至所述数据中心DC控制器，供所述数据中心DC控制器生成虚拟可扩展局域网配置表项。
  2. 如权利要求1所述的虚拟专用网业务实现方法，其中，在构件虚拟专用网VPN业务模型之后，所述方法还包括：生成基于模型构架的耦合网络的云服务模型包；所述创建广域网WAN编排器及数据中心DC编排器包括：调用所述云服务模型包，根据所述云服务模型包创建广域网WAN编排器及数据中心DC编排器。
  3. 如权利要求1所述的虚拟专用网业务实现方法，其中，所述构件虚拟专用网VPN业务模型包括：在Winery环境中新建业务模板ServiceTemplate，设置业务模板名称；为网关GW、设备PE、数据中心DC和广域网WAN创建节点、节点类型及配置参数；创建节点之间的逻辑关系；用业务流程执行语音描述数据传递过程。
  4. 如权利要求3所述的虚拟专用网业务实现方法，其中，所述业务模板包括紧耦合和松耦合；所述在Winery环境中新建业务模板包括：根据组网中网关GW与设备PE的合一或者分开类型，确定所述业务模板为紧耦合或松耦合。
  5. 如权利要求1至4任一项所述的虚拟专用网业务实现方法，其中，所述广域网WAN编排耦合网络模型包括：设置所述广域网WAN编排耦合网络模型包括设备PE名称、虚拟可扩展局域网标识VNI、服务等级、端口、端口的网段地址、路由区分符RT、路由目标RD；所述数据中心DC编排耦合网络模型包括网关GW名称、虚拟可扩展局域网标识VNI、路由区分符RT、路由目标RD、端口、端口的网段地址。
  6. 如权利要求5所述的虚拟专用网业务实现方法，其中，所述生成广域网WAN编排耦合网络模型包括：选取设备PE加入到广域网WAN，设置租户名称、租户网络名称、加入的数据中心DC名称、接口IP、虚拟可扩展局域网标识VNI、路由区分符RT、路由目标RD，预配置设备PE之间的隧道和隧道服务等级；所述生成数据中心DC编排耦合网络模型包括：选取不同的数据中心DC，将数据中心DC内的设 备选作网关GW，设置租户名称、配置和设备PE一致的虚拟可扩展局域网标识VXLAN ID，配置和PE相匹配的出\入路由区分符RT、路由目标RD，接口IP，选定设置该租户的服务等级，映射到所述广域网WAN编排耦合网络模型中的隧道服务等级。
  7. 一种虚拟专用网业务实现装置，包括：
    构建模块，设置为构建基于虚拟可扩展局域网的跨域三层虚拟专用网的虚拟专用网VPN业务模型；
    创建模块，设置为在所述虚拟专用网VPN业务模型中，创建与广域网WAN控制器交互的广域网WAN编排器，配置所述广域网WAN编排器，生成广域网WAN编排耦合网络模型；创建与数据中心DC控制器交互的数据中心DC编排器，配置所述数据中心DC编排器，生成数据中心DC编排耦合网络模型；
    发送模块，设置为下发所述广域网WAN编排耦合网络模型至所述广域网WAN控制器，供所述广域网WAN控制器建立虚拟专用网VPN业务隧道及实现虚拟可扩展局域网标识VNI到三层虚拟专用网L3vpn的映射；下发所述数据中心DC编排耦合网络模型至所述数据中心DC控制器，供所述数据中心DC控制器生成虚拟可扩展局域网配置表项。
  8. 如权利要求7所述的虚拟专用网业务实现装置，其中，所述构建模块在构件虚拟专用网VPN业务模型之后，还设置为生成基于模型构架的耦合网络的云服务模型包；所述创建模块设置为调用所述云服务模型包，根据所述云服务模型包创建广域网WAN编排器及数据中心DC编排器。
  9. 如权利要求7所述的虚拟专用网业务实现装置，其中，所述构建模块设置为在Winery环境中新建业务模板ServiceTemplate，设置业务模板名称；为网关GW、设备PE、数据中心DC和广域网WAN创建节点、节点类型及配置参数；创建节点之间的逻辑关系；用业务流程执行语音描述数据传递过程。
  10. 如权利要求9所述的虚拟专用网业务实现装置，其中，所述业务模板包括紧耦合和松耦合；所述构建模块设置为根据组网中网关GW与设备PE的合一或者分开类型，确定所述业务模板为紧耦合或松耦合。
  11. 如权利要求7至10任一项所述的虚拟专用网业务实现装置，其中，所述广域网WAN编排耦合网络模型包括：设置所述广域网WAN编排耦合网络模型包括设备PE名称、虚拟可扩展局域网标识VNI、服务等级、端口、端口的网段地址、路由区分符RT、路由目标RD；所述数据中心DC编排耦合网络模型包括网关GW名称、虚拟可扩展局域网标识VNI、路由区分符RT、路由目标RD、端口、端口的网段地址。
  12. 如权利要求11所述的虚拟专用网业务实现方法，其中，所述创建模块设置为选取设备PE加入到广域网WAN，设置租户名称、租户网络名称、加入的数据中 心DC名称、接口IP、虚拟可扩展局域网标识VNI、路由区分符RT、路由目标RD，预配置设备PE之间的隧道和隧道服务等级；所述创建模块还设置为选取不同的数据中心DC，将数据中心DC内的设备选作网关GW，设置租户名称、配置和设备PE一致的虚拟可扩展局域网标识VXLAN ID，配置和PE相匹配的出\入路由区分符RT、路由目标RD，接口IP，选定设置该租户的服务等级，映射到所述广域网WAN编排耦合网络模型中的隧道服务等级。
  13. 一种通信系统，包括：如权利要求7至12任一项所述的虚拟专用网业务实现装置。
PCT/CN2017/071062 2016-03-01 2017-01-13 虚拟专用网业务实现方法、装置及通信系统 WO2017148219A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610114929.6 2016-03-01
CN201610114929.6A CN107147509B (zh) 2016-03-01 2016-03-01 虚拟专用网业务实现方法、装置及通信系统

Publications (1)

Publication Number Publication Date
WO2017148219A1 true WO2017148219A1 (zh) 2017-09-08

Family

ID=59742525

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/071062 WO2017148219A1 (zh) 2016-03-01 2017-01-13 虚拟专用网业务实现方法、装置及通信系统

Country Status (2)

Country Link
CN (1) CN107147509B (zh)
WO (1) WO2017148219A1 (zh)

Cited By (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111030970A (zh) * 2019-03-21 2020-04-17 哈尔滨安天科技集团股份有限公司 一种分布式访问控制方法、装置及存储设备
CN111464341A (zh) * 2020-03-19 2020-07-28 烽火通信科技股份有限公司 一种Overlay业务配置方法及装置
CN111464334A (zh) * 2020-03-10 2020-07-28 中移（杭州）信息技术有限公司 软件定义广域网系统下实现终端设备管理的系统、方法、及服务器
CN111970242A (zh) * 2020-07-15 2020-11-20 深信服科技股份有限公司 云安全防护方法、装置及存储介质
CN114125596A (zh) * 2021-10-21 2022-03-01 中盈优创资讯科技有限公司 一种pon-sdwan智能终端归一化控制方法及装置
CN114338500A (zh) * 2021-12-30 2022-04-12 北京青云科技股份有限公司 一种数据转发方法、装置、设备及存储介质
CN114826953A (zh) * 2022-04-13 2022-07-29 浪潮通信信息系统有限公司 基于流程和cfs/rfs模型的业务编排方法
WO2024099200A1 (zh) * 2022-11-07 2024-05-16 中移(苏州)软件技术有限公司 一种云服务的接入方法、平台、设备和存储介质

Families Citing this family (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109660372B (zh) * 2017-10-10 2021-12-14 中兴通讯股份有限公司 一种sdn的业务配置的方法及装置
CN110324159B (zh) * 2018-03-28 2020-11-03 华为技术有限公司 链路配置方法、控制器和存储介质
CN110708178B (zh) * 2018-07-09 2022-06-21 中兴通讯股份有限公司 网络部署方法及装置
CN109379268B (zh) * 2018-11-27 2021-05-07 新华三技术有限公司合肥分公司 虚拟专用网络的创建方法、装置和服务器
CN109495314B (zh) * 2018-12-07 2020-12-18 达闼科技（北京）有限公司 云端机器人的通信方法、装置、介质及电子设备
CN110519253B (zh) * 2019-08-21 2020-08-28 浙江大学 拟态防御中的虚拟专用网拟态方法
CN110855488B (zh) * 2019-11-13 2022-04-05 迈普通信技术股份有限公司 一种虚拟机接入方法及装置
CN111245715B (zh) * 2019-12-31 2022-02-22 亚信科技（中国）有限公司 报文传输方法和系统
CN114050966B (zh) * 2020-07-22 2023-01-06 华为技术有限公司 业务模板的生成方法、装置、设备及存储介质
CN114244712B (zh) * 2021-12-08 2023-12-05 中盈优创资讯科技有限公司 一种sdn控制器协议状态管理方法及装置
CN115022126B (zh) * 2022-05-23 2023-09-01 苏州思萃工业互联网技术研究所有限公司 分布式边缘网关的实现方法和系统

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20050188106A1 (en) * 2004-02-11 2005-08-25 Alcatel Managing L3 VPN virtual routing tables
CN101146015A (zh) * 2006-09-13 2008-03-19 华为技术有限公司 一种实现一层虚拟专用网l1 vpn的方法和装置
CN105247826A (zh) * 2013-01-11 2016-01-13 华为技术有限公司 网络设备的网络功能虚拟化

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN100514912C (zh) * 2005-08-19 2009-07-15 华为技术有限公司 一种基于区分服务的Pipe模型实现方法
CN102891789B (zh) * 2011-07-20 2015-08-05 北京华为数字技术有限公司 虚拟专用网络实例配置方法及装置、路由器和网络系统
US20150295781A1 (en) * 2012-12-03 2015-10-15 Hewlett-Packard Development Company, L.P. Cloud object
CN103905508B (zh) * 2012-12-28 2017-07-28 华为技术有限公司 云平台应用部署方法及装置
WO2015060683A1 (ko) * 2013-10-24 2015-04-30 주식회사 케이티 언더레이 네트워크와 연동하여 오버레이 네트워크를 제공하는 방법 및 이를 수행하는 시스템
US10225327B2 (en) * 2014-08-13 2019-03-05 Centurylink Intellectual Property Llc Remoting application servers

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20050188106A1 (en) * 2004-02-11 2005-08-25 Alcatel Managing L3 VPN virtual routing tables
CN101146015A (zh) * 2006-09-13 2008-03-19 华为技术有限公司 一种实现一层虚拟专用网l1 vpn的方法和装置
CN105247826A (zh) * 2013-01-11 2016-01-13 华为技术有限公司 网络设备的网络功能虚拟化

Cited By (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111030970A (zh) * 2019-03-21 2020-04-17 哈尔滨安天科技集团股份有限公司 一种分布式访问控制方法、装置及存储设备
CN111030970B (zh) * 2019-03-21 2023-04-18 安天科技集团股份有限公司 一种分布式访问控制方法、装置及存储设备
CN111464334A (zh) * 2020-03-10 2020-07-28 中移（杭州）信息技术有限公司 软件定义广域网系统下实现终端设备管理的系统、方法、及服务器
CN111464341B (zh) * 2020-03-19 2022-11-18 烽火通信科技股份有限公司 一种Overlay业务配置方法及装置
CN111464341A (zh) * 2020-03-19 2020-07-28 烽火通信科技股份有限公司 一种Overlay业务配置方法及装置
CN111970242A (zh) * 2020-07-15 2020-11-20 深信服科技股份有限公司 云安全防护方法、装置及存储介质
CN111970242B (zh) * 2020-07-15 2022-09-30 深信服科技股份有限公司 云安全防护方法、装置及存储介质
CN114125596A (zh) * 2021-10-21 2022-03-01 中盈优创资讯科技有限公司 一种pon-sdwan智能终端归一化控制方法及装置
CN114125596B (zh) * 2021-10-21 2023-12-05 中盈优创资讯科技有限公司 一种pon-sdwan智能终端归一化控制方法及装置
CN114338500A (zh) * 2021-12-30 2022-04-12 北京青云科技股份有限公司 一种数据转发方法、装置、设备及存储介质
CN114338500B (zh) * 2021-12-30 2023-10-31 北京青云科技股份有限公司 一种数据转发方法、装置、设备及存储介质
CN114826953A (zh) * 2022-04-13 2022-07-29 浪潮通信信息系统有限公司 基于流程和cfs/rfs模型的业务编排方法
WO2024099200A1 (zh) * 2022-11-07 2024-05-16 中移(苏州)软件技术有限公司 一种云服务的接入方法、平台、设备和存储介质

Also Published As

Publication number Publication date
CN107147509B (zh) 2022-03-11
CN107147509A (zh) 2017-09-08

Similar Documents

Publication Publication Date Title
WO2017148219A1 (zh) 虚拟专用网业务实现方法、装置及通信系统
CN111371706B (zh) 跨物理和虚拟化工作负载使用虚拟化覆盖的具有多个协议的云网络
AU2018236712B2 (en) Interconnection platform for real-time configuration and management of a cloud-based services exchange
JP6495949B2 (ja) クラウドベースのサービス交換用のプログラム可能なネットワークプラットフォーム
CN103997414B (zh) 生成配置信息的方法和网络控制单元
US11070396B2 (en) Virtual cloud exchange system and method
CN106953848B (zh) 一种基于ForCES的软件定义网络实现方法
WO2018000890A1 (zh) 用于实现组合虚拟专用网vpn的方法与装置
US11218424B1 (en) Remote port for network connectivity for non-colocated customers of a cloud exchange
Huang et al. Automatical end to end topology discovery and flow viewer on SDN
CN110035012A (zh) 基于sdn的vpn流量调度方法以及基于sdn的vpn流量调度系统
Wu et al. A framework for automating service and network management with yang
US11997011B2 (en) Virtual port group
Ventre et al. Sdn-based ip and layer 2 services with an open networking operating system in the geant service provider network
Mambretti et al. Creating a Worldwide Network For The Global Environment for Network Innovations (GENI) and Related Experimental Environments
Arezoumand et al. Hyperexchange: A protocol-agnostic exchange fabric enabling peering of virtual networks
Na et al. Inter-connection automation for OF@ TEIN multi-point international OpenFlow islands
Lopez et al. RFC 8969: A Framework for Automating Service and Network Management with YANG
Rasi The Evolution of Network Automation on Internet eXchange Point (IXP) by Software-Based Solutions
Xi Implementing application centric infrastructure to build a scalable secure data center
Zahradníček Multi-Domain SDN Tools for Creation of Virtual Private Networks
Xiong et al. Architecture Design of SDN Operating System Based on Linux Kernel
Aznar et al. Deliverable D14. 1 Future Services PoCs: Implementation and Dissemination
Baldine et al. ExoGENI: Principles and Design of a Multi-Domain Infrastructure-as-a-Service Testbed

Legal Events

Date Code Title Description
NENP Non-entry into the national phase

Ref country code: DE

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17759070

Country of ref document: EP

Kind code of ref document: A1

122 Ep: pct application non-entry in european phase

Ref document number: 17759070

Country of ref document: EP

Kind code of ref document: A1