WO2017167028A1 - 一种路由控制方法、网络设备及控制器 - Google Patents

一种路由控制方法、网络设备及控制器 Download PDF

Info

Publication number
WO2017167028A1
WO2017167028A1 PCT/CN2017/076963 CN2017076963W WO2017167028A1 WO 2017167028 A1 WO2017167028 A1 WO 2017167028A1 CN 2017076963 W CN2017076963 W CN 2017076963W WO 2017167028 A1 WO2017167028 A1 WO 2017167028A1
Authority
WO
WIPO (PCT)
Prior art keywords
routing entry
address prefix
address
state
control module
Prior art date
Application number
PCT/CN2017/076963
Other languages
English (en)
French (fr)
Inventor
庄顺万
王苌
吴楠
李振斌
倪辉
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP22207364.5A priority Critical patent/EP4199463A1/en
Priority to EP17773058.7A priority patent/EP3429140B1/en
Publication of WO2017167028A1 publication Critical patent/WO2017167028A1/zh
Priority to US16/147,179 priority patent/US10700973B2/en
Priority to US16/887,299 priority patent/US11349759B2/en
Priority to US17/746,199 priority patent/US11997016B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/74—Address processing for routing
    • H04L45/745—Address table lookup; Address filtering
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/02—Topology update or discovery
    • H04L45/04—Interdomain routing, e.g. hierarchical routing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/26—Route discovery packet
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/54—Organization of routing tables
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/74—Address processing for routing
    • H04L45/745—Address table lookup; Address filtering
    • H04L45/748—Address table lookup; Address filtering using longest matching prefix

Definitions

  • the embodiments of the present invention relate to the field of communications technologies, and in particular, to a routing control method, a network device, and a controller.
  • the forwarding device usually has a forwarding entry, which is also called a forwarding information base (English: Forwarding Information Base, FIB for short).
  • a forwarding entry which is also called a forwarding information base (English: Forwarding Information Base, FIB for short).
  • FIB Forwarding Information Base
  • the forwarding device is based on the longest matching principle when determining the route. That is, the forwarding device selects the forwarding entry with the longest mask from the forwarding entry matching the destination address, and the forwarding entry according to the longest mask. Determine the route of the packet.
  • the route of the packet is determined according to the longest forwarding entry of the mask, which is often not the optimal route.
  • the technical problem to be solved by the embodiment of the present invention is to provide a route control method, a network device, and a controller, which are configured to suppress a route corresponding to a long mask, thereby implementing a route corresponding to selecting a short mask.
  • the embodiment of the present invention provides a routing control method, where a network device has a first routing entry and a second routing entry, and an address prefix of the first routing entry is a first address prefix,
  • the address prefix of the second routing entry is a second address prefix,
  • the network segment to which the second address prefix belongs is a subset of the network segment to which the first address prefix belongs, and the mask in the second address prefix Greater than a mask in the first address prefix;
  • the control module of the network device obtains a route suppression request
  • the control module determines the second routing entry
  • the control module sets the state of the second routing entry to a non-distributed state, where the non-distributed state is used to indicate that the second routing entry is not used for delivery to the forwarding table.
  • the setting, by the control module, that the status of the second routing entry is a non-distributed state includes:
  • the control module sets the second routing entry to be in an inactive state, or sets the second routing entry to be a saved only state in an active state.
  • the route suppression request is a border gateway protocol BGP flow rule FlowSpec message, where the BGP The network layer reachability information NLRI of the FlowSpec message carries an address match, and the extended community attribute of the BGP FlowSpec message carries the suppression action corresponding to the address match; the address match is the first address prefix or the Describe the second address prefix;
  • the setting, by the control module, that the status of the second routing entry is a non-distributed state includes:
  • the control module sets the state of the second routing entry to a non-distributed state based on the suppression action.
  • the route suppression request is a configuration command, where the configuration command carries an address match and The address matching item corresponding to the suppression action, the address matching item is the first address prefix or the second address prefix;
  • the setting, by the control module, that the status of the second routing entry is a non-distributed state includes:
  • the control module sets the state of the second routing entry to a non-distributed state based on the suppression action.
  • control module sets a state of the second routing entry to a non-distributed state Previously, the method further includes:
  • the control module determines that the first routing entry is in a delivery state in an active state.
  • the control module sets the state of the second routing entry to a non-distributed state
  • the method also includes:
  • the control module delivers the first routing entry to the forwarding table.
  • the network device is a physical forwarding device, and the control module is the physical forwarding device The control module; or the network device is a first virtual machine deployed on a general physical server, the control module is a control module of the first virtual machine; or the network device includes a general physical server The second virtual machine, the control module is the second virtual machine.
  • an embodiment of the present invention provides a route control method, where the method includes:
  • the controller sends a first routing entry and a second routing entry to the control module of the network device, where the address prefix of the first routing entry is the first address prefix, and the address prefix of the second routing entry a second address prefix, the network segment to which the second address prefix belongs is a subset of the network segment to which the first address prefix belongs, and the mask in the second address prefix is greater than the first address prefix.
  • the controller determines the second routing entry
  • the controller sends a route suppression request to the control module, where the route suppression request is used to indicate that the control module sets the state of the second routing entry to a non-distributed state, and the non-distributed state is used.
  • the second routing entry is not used to be delivered to the forwarding table.
  • the route suppression request is used to indicate that the control module sets the second routing entry to be in an inactive state, or set the second routing entry to be active. Only save state in the state.
  • the route suppression request is a border gateway protocol BGP flow rule FlowSpec message
  • the BGP FlowSpec The network layer reachability information NLRI of the message carries an address match, and the extended community attribute of the BGP FlowSpec message carries the suppression action corresponding to the address match; the suppression action is used to indicate that the control module is based on the suppression
  • the action is to set the state of the second routing entry to a non-distributed state; the address matching item is the first address prefix or the second address prefix.
  • the route suppression request is a configuration command, where the configuration command carries an address match and The suppression action corresponding to the address matching item; the suppression action is used to instruct the control module to set the state of the second routing entry to a non-distributed state based on the suppression action; the address matching item is The first address prefix or the second address prefix.
  • the controller is a controller with a dedicated hardware structure, by using a general physical server Install a software-implemented controller or a virtual machine deployed on a general-purpose physical server.
  • the embodiment of the present invention provides a network device, where the network device has a first routing entry and a second routing entry, and the address prefix of the first routing entry is a first address prefix.
  • the address prefix of the second routing entry is a second address prefix, the network segment to which the second address prefix belongs is a subset of the network segment to which the first address prefix belongs, and the mask in the second address prefix The code is greater than a mask in the first address prefix;
  • the network device includes a control module, and the control module includes an obtaining unit, a determining unit, and a setting unit;
  • the obtaining unit is configured to obtain a route suppression request
  • the determining unit is configured to determine the second routing entry
  • the setting unit is configured to set the state of the second routing entry to be a non-distributed state, where the non-distributed state is used to indicate that the second routing entry is not used for being delivered to the forwarding table.
  • the setting unit is specifically configured to: set the second routing entry to be in an inactive state, or set the second routing entry to be only in an active state. Save the status.
  • the route suppression request is a border gateway protocol BGP flow rule FlowSpec message, where the BGP FlowSpec The network layer reachability information NLRI of the message carries an address match, and the extended community attribute of the BGP FlowSpec message carries the suppression action corresponding to the address match; the address match is the first address prefix or the Second address prefix;
  • the setting unit is specifically configured to set the state of the second routing entry to a non-distributed state based on the suppression action.
  • the route suppression request is a configuration command, where the configuration command carries an address match and The address matching item corresponding to the suppression action, the address matching item is the first address prefix or the second address prefix;
  • the setting unit is specifically configured to set the state of the second routing entry to a non-distributed state based on the suppression action.
  • the determining unit is further configured to: the setting unit set the second routing table Before the state of the item is the non-distributed state, the first routing entry is determined to be the delivered state in the active state.
  • the sending unit is configured to send the first routing entry to the forwarding table after the setting unit sets the state of the second routing entry to a non-distributed state.
  • the network device is a physical forwarding device, and the control module is the physical forwarding device Control module
  • the network device is a first virtual machine deployed on a general physical server, the control module is a control module of the first virtual machine; or the network device includes a second deployed on a general physical server. a virtual machine, where the control module is the second virtual machine.
  • an embodiment of the present invention provides a controller, including: a sending unit, a determining unit, and a sending unit;
  • the sending unit is configured to send a first routing entry and a second routing entry to the control module of the network device, where the address prefix of the first routing entry is a first address prefix, and the second The address prefix of the routing entry is a second address prefix, the network segment to which the second address prefix belongs is a subset of the network segment to which the first address prefix belongs, and the mask in the second address prefix is greater than a mask in the first address prefix;
  • the determining unit is configured to determine the second routing entry
  • the sending unit is configured to send a route suppression request to the control module, where the route suppression request is used to indicate that the control module sets the state of the second routing entry to a non-distributed state, and the non-distribution The status is used to indicate that the second routing entry is not used for delivery to the forwarding table.
  • the route suppression request is used to indicate that the control module sets the second routing entry to be in an inactive state, or set the second routing entry to be active. Only save state in the state.
  • the route suppression request is a border gateway protocol BGP flow rule FlowSpec message
  • the BGP FlowSpec The network layer reachability information NLRI of the message carries an address match, and the extended community attribute of the BGP FlowSpec message carries the suppression action corresponding to the address match; the suppression action is used to indicate that the control module is based on the suppression
  • the action is to set the state of the second routing entry to a non-distributed state; the address matching item is the first address prefix or the second address prefix.
  • the route suppression request is a configuration command, where the configuration command carries an address match and The suppression action corresponding to the address matching item; the suppression action is used to instruct the control module to set the state of the second routing entry to a non-distributed state based on the suppression action; the address matching item is The first address prefix or the second address prefix.
  • the controller is a controller with a dedicated hardware structure, by using a general physical server Install a software-implemented controller or a virtual machine deployed on a general-purpose physical server.
  • the embodiment of the present invention provides a network system, including any possible implementation manner of the foregoing network device, and any possible implementation manner of the foregoing controller.
  • the network device has a first routing entry and a second routing entry, and the address prefix of the first routing entry is a first address prefix, and the second route The address prefix of the entry is the second address prefix, where the mask in the second address prefix is larger than the mask in the first address prefix, and the network segment to which the second address prefix belongs is the A subset of the network segment to which an address prefix belongs.
  • the route corresponding to the second routing entry is a route corresponding to the long mask. Therefore, when a packet is forwarded, the packet does not select a route corresponding to the long mask based on the second routing entry.
  • the route corresponding to the short mask is selected by suppressing the route corresponding to the long mask.
  • FIG. 1 is a schematic diagram of a packet flow direction in the prior art
  • FIG. 2 is a schematic flowchart of a method embodiment according to an embodiment of the present disclosure
  • FIG. 3 is a schematic structural diagram of a forwarding system according to an embodiment of the present disclosure.
  • FIG. 4 is a schematic structural diagram of a forwarding scenario according to an embodiment of the present disclosure.
  • FIG. 5 is a schematic structural diagram of another forwarding scenario according to an embodiment of the present disclosure.
  • FIG. 6 is a schematic structural diagram of another forwarding scenario according to an embodiment of the present disclosure.
  • FIG. 7 is a schematic flowchart diagram of another method embodiment according to an embodiment of the present disclosure.
  • FIG. 8 is a schematic flowchart diagram of another method embodiment according to an embodiment of the present disclosure.
  • FIG. 9 is a schematic diagram of a packet flow direction according to an embodiment of the present invention.
  • FIG. 10 is a schematic structural diagram of an apparatus embodiment of a network device according to an embodiment of the present disclosure.
  • FIG. 11 is a schematic structural diagram of an apparatus embodiment of a controller according to an embodiment of the present disclosure.
  • FIG. 12 is a schematic structural diagram of an apparatus embodiment of a network system according to an embodiment of the present disclosure.
  • FIG. 13 is a schematic structural diagram of another apparatus embodiment of a network device according to an embodiment of the present disclosure.
  • FIG. 14 is a schematic structural diagram of another apparatus embodiment of a controller according to an embodiment of the present invention.
  • Routing tables also known as RIB tables
  • forwarding tables also known as FIB tables
  • RIB tables Routing tables
  • FIB tables forwarding tables
  • Table 1 shows the routing table calculated by the control plane.
  • the forwarding plane forwards the packet based on the forwarding table shown in Table 2, the destination address of the packet is matched with the address prefix of each forwarding entry in the forwarding table to determine a matching forwarding entry, according to the matching forwarding table.
  • Item determines the route of the message.
  • the forwarding plane is usually based on the longest match criterion when determining the route. That is, the forwarding plane determines the forwarding entry with the longest mask from the forwarding entry matching the destination address. The longest forwarding table according to the mask. The item determines the route of the packet, which is equivalent to selecting the route corresponding to the long mask.
  • the address prefix (English: prefix) can be composed of an address and a mask.
  • the format of the address prefix is: Internet Protocol Address (IP) address/mask.
  • the forwarding plane matches the address prefix of each entry in Table 2 in the order of the mask from long to short, and the address is determined. After the prefix 9.1.0.0/16 matches the destination address 9.1.1.18, the matching is no longer continued. The entry corresponding to the address prefix 9.1.0.0/16 is determined and determined according to the next hop 120.0.0.2 corresponding to the entry. Routing, that is, forwarding the message to the next hop 120.0.0.2.
  • the route of the packet determined according to the longest forwarding entry of the mask is often not the optimal route.
  • the metropolitan area network includes router A and router B.
  • Internet Service Provider (English: Internet Service Provider, ISP for short) 1 includes Router C and Router D
  • ISP 2 includes Router E and Router F.
  • the address prefix issued by ISP1 to the metropolitan area network is 9.0.0.0/8.
  • ISP1 also advertises the address prefix 9.1.0.0/16 to ISP2.
  • the address prefix is advertised to the metropolitan area network through ISP2.
  • the address prefix of the server is 9.1.1.18/24.
  • Router A When the user needs to send the packet with the destination address of 9.1.1.18, Router A sends the packet to Router B. Based on the forwarding table shown in Table 2, Router B will send the packet. The packet is sent to the corresponding next hop address 120.0.0.2, that is, the address of the router F, so that it is sent to the ISP2, and finally sent to the server hanged on the ISP1 through the router E, the router D, and the router C.
  • the route forwarded to ISP2 may not be the optimal route due to more route consumption values, higher charges, or worse transmission quality.
  • the technical problem to be solved by the embodiment of the present invention is to provide a route control method, a network device, and a controller, which are configured to suppress a route corresponding to a long mask, thereby implementing a route corresponding to selecting a short mask.
  • an embodiment of the present invention provides an embodiment of a method for routing control. This embodiment can be used in a network device.
  • the control module of the network device has a first routing entry and a second routing entry.
  • the address prefix of the first routing entry is a first address prefix; the address prefix of the second routing entry is a second address prefix.
  • the first address prefix and the second address prefix are both used to match the destination address of the packet.
  • the mask in the second address prefix is larger than the mask in the first address prefix, that is, the route corresponding to the first routing entry is a route corresponding to the short mask, and the second The route corresponding to the routing entry is the route corresponding to the long mask.
  • the network segment to which the second address prefix belongs is the network segment U1
  • the network segment to which the first address prefix belongs is the network segment U2.
  • the network segment U1 is a subset of the network segment U2, that is, the network segment U2 includes the network segment U1, that is, the IP address belonging to the network segment U2 must belong to the network segment U1, and the IP address belonging to the network segment U1 has It may belong to network segment U2, and may not belong to network segment U2.
  • the network segments mentioned in the embodiments of the present invention all refer to the network segment of the largest range to which they belong.
  • the first address prefix may be 9.0.0.0/8
  • the second address prefix may be 9.1.0.0/16.
  • the mask 16 is larger than the mask 8
  • the network segment to which 9.1.0.0/16 belongs is the network segment 9.1.0.0-9.1.255.255
  • the network segment to which 9.0.0.0/8 belongs is the network segment 9.0.0.0-9.255. .255.255
  • the network segment 9.1.0.0-9.1.255.255 is a subset of the network segment 9.0.0.0-9.255.255.255.255.
  • the network segment to which the second address prefix belongs is a subset of the network segment to which the first address prefix belongs
  • the destination address of the packet matches the second routing entry
  • the first routing entry matches.
  • the long mask and the short mask mentioned in the embodiments of the present invention refer to relatively long and short, for example, for the masks 8 and 16, 16 is a long mask, 8 Is a short mask.
  • the first routing entry and the second routing entry may have information such as a next hop address, an entry status, and the like in addition to the address prefix.
  • the next hop address is used to indicate the next hop route
  • the entry status is used to indicate whether to use the forwarding entry or the like.
  • the network device may be the forwarding device 01 shown in FIG. 3, and the forwarding device 01 is connected to the forwarding device 02 and the forwarding device 03, respectively.
  • the first routing entry and the second routing entry may be as shown in Table 3.
  • the next hop address of the first routing entry is the address of the forwarding device 02, that is, the first routing entry.
  • the next hop address of the second routing entry is the address of the forwarding device 03, that is, the second routing entry is used to indicate that the packet is forwarded to the forwarding device.
  • the status of the initial entry of the first routing entry and the second routing entry may both be in a delivery state in the active state, and is used to indicate that the forwarding entry is delivered.
  • the forwarding device 01, the forwarding device 02, and the forwarding device 03 may be border devices of different networks.
  • the forwarding device 01 may be a border device of a metropolitan area network or a data center (English: Data Center, DC).
  • Device 02 can be a border device of ISP1
  • forwarding device 03 can be a border device of ISP2.
  • the control module of the network device obtains a route suppression request.
  • the route suppression request may carry an address matching item.
  • the address matching item is used to determine the second routing entry from the first routing entry and the second routing entry, so as to determine a route corresponding to the long mask.
  • the address matching item may be the first address prefix or the second address prefix.
  • the route suppression request may be a message message sent by a routing control device such as a controller, or may be a configuration command configured by a user.
  • the control module determines the second routing entry.
  • the control module may determine, according to the address matching item, the second routing entry.
  • the determining rule when the control module determines the second routing entry may be a mask whose mask is larger than an address matching item, and the address prefix is identical or partially identical to the address matching item.
  • the address matching item is the second address prefix, for example, 9.1.0.0/16
  • the control module determines, according to 9.1.0.0/16, that the mask 16 is larger than the mask 8, and the second routing table
  • the address prefix of the entry is exactly the same as 9.1.0.0/16, so that the second routing entry is determined.
  • the determining rule may also be a mask whose mask is larger than the address matching item, and the network segment to which the address prefix belongs is a subset of the network segment to which the address matching item belongs.
  • the address matching item is the first address prefix, for example, 9.0.0.0/8
  • the control module determines that the mask 16 is larger than the mask 8
  • the network segment is a subset of the network segment to which 9.0.0.0/8 belongs, thereby determining the second routing entry.
  • the control module sets the state of the second routing entry to a non-distributed state, where the non-distributed state is used to indicate that the second routing entry is not used for being delivered to the forwarding table.
  • the second routing table is The status of the item is set. The routing of the routing entry is performed periodically. Therefore, after the second routing entry is set to the non-distributed state, the second routing is performed when the routing entry is delivered next time. The entry will not be delivered to the forwarding table.
  • the forwarding table is located in the forwarding module corresponding to the control module. Therefore, when the packet is forwarded, the forwarding module does not forward the packet based on the route corresponding to the second routing entry.
  • the second routing entry may be set to an inactive state (In-Active) or the second routing entry may be set when the state of the second routing entry is set to a non-distributed state. It is only the saved state (Rib-Only) in the active state. For example, as shown in Table 4, the second routing entry is set to In-Active or Rib-Only.
  • the Rib-Only refers to the state that is saved only in the routing table, and indicates that the routing entry is not used to be delivered to the forwarding table of the forwarding module.
  • the network device has a first routing entry and a second routing entry, and the address prefix of the first routing entry is a first address prefix, where the The address prefix of the second routing entry is the second address prefix.
  • the mask in the second address prefix is larger than the mask in the first address prefix. That is, the route corresponding to the second routing entry is a route corresponding to the long mask.
  • the network segment to which the second address prefix belongs is a subset of the network segment to which the first address prefix belongs.
  • the second routing entry can be determined, and the state of the second routing entry is set to be non-distributed, indicating that the second routing entry is not Will be sent to the forwarding table.
  • the route corresponding to the second routing entry is a route corresponding to the long mask. Therefore, when a packet is forwarded, the packet does not select a route corresponding to the long mask based on the second routing entry. The route corresponding to the short mask is selected by suppressing the route corresponding to the long mask.
  • the embodiments of the present invention can be used in multiple forwarding scenarios.
  • the network devices When used in different forwarding scenarios, the network devices respectively correspond to different devices, which are specifically described below.
  • the network device is a physical forwarding device
  • the physical forwarding device refers to a forwarding device having a dedicated hardware structure, such as a router or a switch having a dedicated hardware structure.
  • the control module is a control module of the physical forwarding device.
  • FIG. 4 shows an exemplary forwarding scenario in a first forwarding scenario, where the forwarding scenario includes a physical controller and a physical forwarding device, and the control module of the physical forwarding device receives a route suppression request sent by the physical controller.
  • the physical controller refers to a controller with a dedicated hardware structure, such as a main control board or a control card.
  • the network device is a first virtual machine deployed on a general physical server, and the control module is a control module of the first virtual machine.
  • the control module is the control module of the network device.
  • a general-purpose physical server can be virtualized into multiple logical computers through virtualization technology.
  • Each logical computer is a virtual machine on a general-purpose physical server, where each virtual machine can run different operations.
  • the system therefore, the applications of the individual virtual machines can run in the space of separate operating systems. That is, a virtual machine refers to a complete computer system that runs through a software and has full hardware system functionality running in a fully isolated environment.
  • FIG. 5 shows an exemplary forwarding scenario in a second forwarding scenario, where the forwarding scenario includes a virtual machine 01 running a program for providing controller functions, and a virtual machine 02 running for A program for forwarding the device function is provided, and the control module of the virtual machine 02 receives the route suppression request sent by the virtual machine 01.
  • virtual machine 01 and the virtual machine 02 can also be deployed on different general physical servers.
  • the network device includes a second virtual machine deployed on a general physical server, and the control module is the second virtual machine.
  • a virtualization machine is used to virtualize a virtual machine running a program for providing a function of a control module of a forwarding device, the virtual machine being the control module, and the network device including the control module
  • the forwarding module provides the forwarding function of the packet, and can be separately deployed on the virtual machine of the general physical server, or directly deployed on the general physical server, or can be deployed on the dedicated physical hardware device.
  • FIG. 6 shows an exemplary forwarding scenario in a third forwarding scenario, which includes a virtual machine 03, a virtual machine 04, and a forwarding module.
  • the virtual machine 03 runs a program for providing controller functions
  • the virtual machine 04 A program for providing a function of the control module of the forwarding device is executed, and the virtual machine 04 receives the route suppression request sent by the virtual machine 03, and delivers a routing entry to the forwarding module.
  • the forwarding module can be a separate virtual machine.
  • the first routing entry may be sent to the In the forwarding table, if yes, proceed to 203.
  • the embodiment of the present invention may further include: before the 203, the control module determines the A routing entry is a delivery state in an active state. The control module may determine, according to the address matching, the first routing entry. The network segment to which the second address prefix belongs is a subset of the network segment to which the first address prefix belongs. Therefore, even if the second routing entry is not delivered to the forwarding table, the control module corresponds to forwarding. The module may also forward the packet based on the route corresponding to the first routing entry to prevent the packet from being forwarded.
  • the embodiment of the present invention may not Execution 203, so as to ensure that the forwarding of the message is not affected.
  • the address matching item obtained by the control module of the forwarding device 01 is the first address prefix, and the control module of the forwarding device 01 determines the first according to the first address prefix. Routing entry. If the control module of the forwarding device 01 determines that the first routing entry is in the active state, the 203 is performed, that is, the state of the second routing entry is set to a non-distributed state. Therefore, even if the destination address of the packet matches the second routing entry and the first routing entry, the forwarding module of the forwarding device 01 does not use the routing corresponding to the second routing entry.
  • the packet is forwarded to the forwarding device 03, and the packet is forwarded to the forwarding device 02 based on the forwarding entry corresponding to the first routing entry. If the control module of the forwarding device 01 determines that the first routing entry is In-Active or Rib-Only, 203 is not performed. Therefore, the forwarding module of the forwarding device 01 forwards the packet to the forwarding device 03 based on the route corresponding to the second routing entry.
  • control module in the 203 may further send the first routing entry to the forwarding table.
  • the second routing entry is not sent to the forwarding table, so that the forwarding module corresponding to the control module selects a route corresponding to the short mask based on the first routing entry.
  • the control module may receive the route suppression request sent by the routing control device.
  • the routing control device may be a controller.
  • the routing control device may be a network management device, a traffic analysis server, a synthesizer, or the like. Another embodiment of the routing control method will be described below with the controller side as the execution subject.
  • an embodiment of the present invention provides another method embodiment of a route control method. This embodiment can be used in a controller.
  • the controller sends a first routing entry and a second routing entry to the control module of the network device, where the address prefix of the first routing entry is the first address prefix, and the second routing entry is The address prefix is a second address prefix, the network segment to which the second address prefix belongs is a subset of the network segment to which the first address prefix belongs, and the mask in the second address prefix is greater than the first address The mask in the prefix.
  • the controller calculates the first routing entry and the second routing entry
  • the calculated entry may be sent to the control module.
  • the control module may save the first routing entry and the second routing entry in the network device.
  • the controller determines the second routing entry.
  • the controller may automatically determine that the second routing entry needs to be suppressed according to the first routing entry and the second routing entry, or may detect that the user performs a suppression operation to determine The second routing entry needs to be suppressed.
  • the controller sends a route suppression request to the control module, where the route suppression request is used to indicate that the control module sets the state of the second routing entry to a non-distributed state, and the non-distributed state It is used to indicate that the second routing entry is not used to be delivered to the forwarding table.
  • the route suppression request may carry an address matching item, where The control module determines the second routing entry according to the address matching item.
  • the controller may be a controller having a dedicated hardware structure
  • the controller having a dedicated hardware structure may be a device having a dedicated hardware structure, a main control board, or a control card.
  • the controller may also be a controller implemented by installing software on a general physical server, or a virtual machine deployed on a general physical server, that is, using a virtualization technology to virtualize a program for providing a controller function. virtual machine.
  • the controller can be used in any of the forwarding scenarios of FIG. 4-6.
  • the controller may not send a route suppression request to the control module, but after the controller determines the second routing entry, the second is not performed in 701.
  • the routing entry is sent to the control module to suppress the route corresponding to the long mask.
  • the message of the border gateway protocol (English: Flow Specification, hereinafter referred to as FlowSpec) is extended, and the address matching item is carried in the message.
  • FlowSpec International Flow Specification
  • RFC 5575 defines 12 common traffic matching rules, including, for example, destination address, source address, IP number, port number, etc. These 12 rules are encapsulated in the NLRI of the message.
  • RFC 5575 also defines four common traffic processing behaviors, such as: drop traffic, traffic rate limit, and redirect to a virtual private network (English: Virtual Private Network, VPN). Carry in the extended community attribute.
  • the route suppression request may be specifically a BGP FlowSpec message
  • the NLRI of the BGP FlowSpec message carries an address matching item
  • the extended community attribute of the BGP FlowSpec message carries the suppression corresponding to the address matching item.
  • the suppression action may indicate setting to In-Active or Rib-Only. Therefore, after receiving the BGP FlowSpec message, the control module can obtain the address matching item from the NLRI of the message, and obtain the suppression action from the extended community attribute of the message, so that, based on the suppression action, The state of the second routing entry is set to a non-distributed state.
  • the address matching item may be the first address prefix or the second address prefix.
  • the address matching item is the first address prefix
  • TBD1 indicates that the second routing entry is determined according to the first address prefix
  • the second The status of the routing entry is set to Rib-Only
  • the TBD2 indicates that the second routing entry is determined according to the first address prefix, and the state of the second routing entry is set to In-Active.
  • the route corresponding to the second routing entry is a detailed route of the route corresponding to the first routing entry.
  • the TBD indicates to be defined. After the Internet Engineering Task Force (IETF) is officially allocated, the value specified by the IETF is used.
  • IETF Internet Engineering Task Force
  • the route suppression request may also be a configuration command, where the configuration command carries an address matching item and a suppression action corresponding to the address matching item.
  • the configuration command may be obtained after the network device is locally configured, or may be sent by other devices to the control module.
  • the other device sends the configuration command to the control module through the Netconf protocol, as a policy when the control module sends a routing entry.
  • the control module sets the state of the second routing entry to a non-distributed state based on the suppression action in the configuration command.
  • the address matching item may be the first address prefix or the second address prefix.
  • the state of the second routing entry may be restored, so that the second routing entry is used to be delivered to the forwarding table.
  • the control module may restore the state of the second routing entry to the lower in Active. Status.
  • the control module restores the state of the second routing entry to the delivered state in Active according to the revocation suppression request or the configuration command.
  • the control module sets the state of the second routing entry to In-Active or Rib-Only, and after receiving the extended BGP Flow Spec revocation message. And setting the state of the second routing entry to a delivery state in Active.
  • the route corresponding to the third routing entry is determined to be a long mask. Routing, that is, the network device further has a third routing entry, the address prefix of the third routing entry is a third address prefix, and the network segment to which the third address prefix belongs is also A subset of the network segment to which the first address prefix belongs, and the mask in the third address prefix is also larger than the mask in the first address prefix.
  • the state of the third routing entry may be set to a non-distributed state, so that the third routing entry is not used for being delivered to the forwarding table, or may not be changed. The state of the routing entry is such that the third routing entry can still be delivered to the forwarding table. The following are explained separately.
  • the method further includes: the control module determines a third routing entry according to the address matching item; and the control module sets the state of the third routing entry to a non-distributed state, so that The third routing entry is not used to be delivered to the forwarding table.
  • the first address prefix is 9.0.0.0/8
  • the second address prefix is 9.1.0.0/16
  • the third address prefix is 9.2.0.0/16
  • the control module may further The three routing entries are set to In-Active or Rib-Only. That is, in the embodiment, when the route corresponding to the second routing entry and the third routing entry are both long path masks, the two routes can be suppressed at the same time. The route corresponding to the long mask.
  • the method further includes: the control module obtains a subnet range matching item; and the control module determines, according to the address matching item and the subnet range matching item, the second routing entry.
  • the first address prefix is 9.0.0.0/8
  • the second address prefix is 9.1.0.0/16
  • the third address prefix is 9.2.0.0/16
  • the subnet matching item may be 9.1. 0.0.
  • the second routing entry may be determined according to the first address prefix and the subnet matching.
  • the routing may be further specified.
  • the subnet is configured to suppress only the route corresponding to the second routing entry, and does not suppress the route corresponding to the third routing entry.
  • the embodiment of the present invention provides another method embodiment of a route control method. This embodiment can be used in the router B as shown in FIG.
  • the metropolitan area network includes router A and router B.
  • ISP1 includes router C and router D
  • ISP2 includes router E and router F.
  • the address prefix issued by ISP1 to the metropolitan area network is 9.0.0.0/8.
  • ISP1 also advertises the address prefix 9.1.0.0/16 to ISP2.
  • the address prefix is advertised to the metropolitan area network through ISP2.
  • Router B has a routing table as shown in Table 1.
  • the controller (not shown) identifies that an entry corresponding to 9.0.0.0/8 and 9.1.0.0/16 exists in Table 1 of Router B, and generates a prompt message to the user.
  • the message may indicate that the route corresponding to 9.1.0.0/16 is a detailed route of the route corresponding to 9.0.0.0/8.
  • the controller determines that the route corresponding to 9.1.0.0/16 needs to be suppressed, and generates an extended BGP Flow Spec update message, where the NLRI of the message carries 9.0.0.0/8, and the extended community attribute carries a suppression action, for example, TBD1 or TBD2 shown in Table 5.
  • the routing control policy can be formulated by the administrator according to the prompt message displayed by the 801, that is, the user accesses the destination address of the network segment 9.1.0.0-9.1.255.255 through the metropolitan area network, and the packet is forwarded from the ISP1 direction, that is, the 9.1 is suppressed.
  • the controller generates an extended BGP Flow Spec update message according to the policy.
  • the controller sends the generated message to the router B.
  • Router B After receiving the message, Router B obtains 9.0.0.0/8 and the suppression action from the message.
  • Router B traverses Table 1, and determines an entry corresponding to 9.0.0.0/8, and determines whether the state of the entry is a delivery state in Active. If yes, execute 806. If no, you can end the process or generate a forwarding table based on the local routing table.
  • Router B traverses Table 1, and determines the address 9.1.0.0/16 that satisfies the requirement according to 9.0.0.0/8.
  • the requirement is that the mask is greater than 8, and the network segment to which the address prefix belongs is a subset of the network segment to which 9.0.0.0/8 belongs.
  • Router B determines a routing entry corresponding to 9.1.0.0/16, and sets the state of the routing entry to In-Active or Rib-Only according to the suppression action.
  • the suppression action is TBD1
  • the state device of the routing entry is Rib-Only.
  • the router B sends the routing entry to the forwarding table according to the state of each routing entry in the modified table 1. Because the status of the routing entry corresponding to 9.1.0.0/16 is In-Active or Rib-Only, the routing entry will not be delivered to the forwarding table, but 9.0.0.0/8 corresponds to the modified table 1. The routing entry will be delivered to the forwarding table.
  • Router B receives the packet with the destination address of 9.1.1.18, and forwards the packet to the corresponding next hop address 20.0.0.2, that is, the address of the router C, based on the forwarding entry corresponding to 9.0.0.0/8. It is sent to ISP1 and finally sent to the server hanging on ISP1.
  • 804-808 is executed by the control module of Router B
  • 809 is executed by the forwarding module of Router B.
  • the user when the user accesses the destination address of the network segment 9.1.0.0-9.1.255.255 through the metropolitan area network, the user can forward the packet from the ISP1 direction, thereby implementing the suppression of the route corresponding to the long mask. Implement the route corresponding to the short mask.
  • the method embodiment of the routing control method in the embodiment of the present invention is described above.
  • the related device in the embodiment of the present invention will be described below from the perspective of a modular functional entity.
  • an embodiment of the present invention provides an apparatus embodiment of a network device.
  • the network device 100 of this embodiment has a first routing entry and a second routing entry, and the address prefix of the first routing entry is a first address prefix.
  • the address prefix of the second routing entry is a second address prefix, the network segment to which the second address prefix belongs is a subset of the network segment to which the first address prefix belongs, and the second address prefix
  • the mask is larger than the mask in the first address prefix.
  • Network device 100 includes a control module 101.
  • the control module 101 includes an obtaining unit 1011, a determining unit 1012, and a setting unit 1013.
  • the obtaining unit 1011 is configured to obtain a route suppression request.
  • the determining unit 1012 is configured to determine the second routing entry.
  • the setting unit 1013 is configured to set the state of the second routing entry to be a non-distributed state, where the non-distributed state is used to indicate that the second routing entry is not used for being delivered to the forwarding table.
  • the network device 100 shown in FIG. 10 can be used to perform the method shown in FIG. 2.
  • the obtaining unit 1011 can be used to execute 201 in FIG. 2
  • the determining unit 1012 can be used to execute 202 in FIG.
  • the setting unit 1013 can be used to execute 203 in FIG.
  • the setting unit 1013 is specifically configured to: set the second routing entry to be in an inactive state, or set the second routing entry to be a saved only state in an active state.
  • the route suppression request is a Border Gateway Protocol BGP flow rule FlowSpec message
  • the network layer reachability information NLRI of the BGP FlowSpec message carries an address match item, where the extended community attribute of the BGP FlowSpec message carries the The address matching item corresponding to the suppression action; the address matching item is the first address prefix or the second address prefix; the setting unit 1013 is specifically configured to set the state of the second routing entry based on the suppression action It is not issued.
  • the route suppression request is a configuration command, where the configuration command carries an address matching item and a suppression action corresponding to the address matching item; the setting unit 1013 is specifically configured to set the second according to the suppression action.
  • the status of the routing entry is not delivered.
  • the address match is the first address prefix or the second address prefix.
  • the determining unit 1012 is further configured to: before the setting unit 1013 sets the state of the second routing entry to be in a non-distributed state, determine that the first routing entry is a delivered state in an active state.
  • the network device 100 further includes a sending unit, where the sending unit is configured to: after the setting unit 1013 sets the state of the second routing entry to a non-distributed state, the first routing entry is Send to the forwarding table.
  • the network device 100 is a physical forwarding device, and the control module 101 is a control module of the physical forwarding device.
  • the network device 100 is a first virtual machine deployed on a general physical server, and the control module 101 is The control module of the first virtual machine; or the network device 100 includes a second virtual machine deployed on a general physical server, and the control module 101 is the second virtual machine.
  • an embodiment of the present invention provides an apparatus embodiment of a controller.
  • the controller 110 of this embodiment includes a sending unit 111, a determining unit 112, and a transmitting unit 113.
  • the sending unit 111 is configured to send the first routing entry and the second routing entry to the control module of the network device, where the address prefix of the first routing entry is the first address prefix, and the second routing table
  • the address prefix of the entry is a second address prefix
  • the network segment to which the second address prefix belongs is a subset of the network segment to which the first address prefix belongs
  • the mask in the second address prefix is greater than the first A mask in an address prefix.
  • the determining unit 112 is configured to determine the second routing entry.
  • the sending unit 113 is configured to send a route suppression request to the control module, where the route suppression request is used to indicate
  • the control module sets the state of the second routing entry to a non-distributed state, where the non-distributed state is used to indicate that the second routing entry is not used for delivery to the forwarding table.
  • the controller 110 shown in FIG. 11 can be used to perform the method shown in FIG. Specifically, the sending unit 111 can be used to execute 701 in FIG. 7, the determining unit 112 can be used to execute 702 in FIG. 7, and the sending unit 113 can be used to execute 703 in FIG.
  • the route suppression request is used to indicate that the control module sets the second routing entry to be in an inactive state, or set the second routing entry to be a saved only state in an active state.
  • the route suppression request is a Border Gateway Protocol BGP flow rule FlowSpec message
  • the network layer reachability information NLRI of the BGP FlowSpec message carries an address match item
  • the extended community attribute of the BGP FlowSpec message carries the a suppression action corresponding to the address matching
  • the suppression action is used to instruct the control module to set the state of the second routing entry to a non-distributed state based on the suppression action
  • the address matching item is the An address prefix or the second address prefix.
  • the route suppression request is a configuration command, where the configuration command carries an address matching item and a suppression action corresponding to the address matching item; and the suppression action is used to indicate that the control module is based on the suppression action. And setting a state of the second routing entry to a non-distributed state; the address matching item is the first address prefix or the second address prefix.
  • the controller is a controller with a dedicated hardware structure, a controller implemented by installing software on a general physical server, or a virtual machine deployed on a general physical server.
  • controller 110 in this embodiment, refers to the detailed description of the foregoing embodiment shown in FIG. 7 , and details are not described herein again.
  • an embodiment of the present invention provides a system embodiment of a network system.
  • the system includes a network device 100 and a controller 110.
  • the network device 100 may be the network device of any of the foregoing embodiments
  • the controller 110 may be the controller of any of the foregoing embodiments.
  • the related device in the embodiment of the present invention is described above from the perspective of a modular functional entity.
  • the related device in the embodiment of the present invention will be described below from the perspective of hardware processing.
  • an embodiment of the present invention provides another apparatus embodiment of a network device.
  • the network device 1300 has a first routing entry and a second routing entry, and the first routing entry
  • the address prefix is the first address prefix
  • the address prefix of the second routing entry is the second address prefix
  • the network segment to which the second address prefix belongs is a subset of the network segment to which the first address prefix belongs.
  • the mask in the second address prefix is larger than the mask in the first address prefix.
  • the network device 1300 of this embodiment specifically includes: a control module, a communication interface 1302, a memory 1303, and a communication bus 1304.
  • the control module includes a processor 1301.
  • the processor 1301, the communication interface 1302, and the memory 1303 complete communication with each other via the bus 1304.
  • the processor 1301 is configured to execute the program 1305.
  • program 1305 can include program code, the program code including computer operating instructions.
  • the processor 1301 may be a central processing unit CPU, or an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present application.
  • CPU central processing unit
  • ASIC application specific integrated circuit
  • the memory 1303 is configured to store the program 1305.
  • Memory 1303 may contain high speed RAM memory, or Also included is a non-volatile memory, such as at least one disk storage.
  • the program 1305 is used to perform the following steps:
  • the state of the second routing entry is set to be a non-distributed state, and the non-distributed state is used to indicate that the second routing entry is not used for being delivered to the forwarding table.
  • Each functional unit of the network device 1300 provided in this embodiment may be a specific implementation based on the method embodiment shown in FIG. 2 and the device embodiment shown in FIG. 10, and the definition and description of the term are as shown in FIG. 2 .
  • the illustrated method embodiment is consistent with the device embodiment shown in FIG. 10, and details are not described herein again.
  • an embodiment of the present invention provides another apparatus embodiment of a controller.
  • the controller 1400 of this embodiment specifically includes a processor 1401, a communication interface 1402, a memory 1403, and a communication bus 1404.
  • the processor 1401, the communication interface 1402, and the memory 1403 complete communication with each other through the bus 1404.
  • the processor 1401 is configured to execute the program 1405.
  • program 1405 can include program code, the program code including computer operating instructions.
  • the processor 1401 may be a central processing unit CPU, or an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present application.
  • CPU central processing unit
  • ASIC application specific integrated circuit
  • the memory 1403 is configured to store the program 1405.
  • the memory 1403 may include a high speed RAM memory and may also include a non-volatile memory such as at least one disk memory.
  • Program 1405 is used to perform the following steps:
  • the first routing entry and the second routing entry are sent to the control module of the network device, where the address prefix of the first routing entry is the first address prefix, and the address prefix of the second routing entry is a second address prefix, the network segment to which the second address prefix belongs is a subset of the network segment to which the first address prefix belongs, and the mask in the second address prefix is larger than the mask in the first address prefix code;
  • route suppression request is used to indicate that the control module sets the state of the second routing entry to a non-distributed state, and the non-distributed state is used to indicate the The two routing entries are not used for delivery to the forwarding table.
  • Each functional unit of the network device 1400 provided by this embodiment may be a specific implementation based on the method embodiment shown in FIG. 7 and the device embodiment shown in FIG. 11, and the definition and description of the term are as shown in FIG. 7.
  • the illustrated method embodiment is consistent with the device embodiment shown in FIG. 11, and details are not described herein again.
  • the disclosed system, apparatus, and method may be implemented in other manners.
  • the device embodiments described above are merely illustrative, for example, of the unit Partitioning is only a logical function partitioning. In actual implementation, there may be another way of dividing. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be in an electrical, mechanical or other form.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
  • each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.
  • the integrated unit if implemented in the form of a software functional unit and sold or used as a standalone product, may be stored in a computer readable storage medium.
  • the technical solution of the present invention which is essential or contributes to the prior art, or all or part of the technical solution, may be embodied in the form of a software product stored in a storage medium.
  • a number of instructions are included to cause a computer device (which may be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention.
  • the foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本发明实施例提供了一种路由控制方法、网络设备及控制器，网络设备上具有第一路由表项和第二路由表项，所述第一路由表项的地址前缀为第一地址前缀，所述第二路由表项的地址前缀为第二地址前缀，所述第二地址前缀所属的网段为所述第一地址前缀所属的网段的子集，并且所述第二地址前缀中的掩码大于所述第一地址前缀中的掩码；所述方法包括：所述网络设备的控制模块获得路由抑制请求；确定出所述第二路由表项；设置所述第二路由表项的状态为非下发状态，用于指示所述第二路由表项不用于下发到转发表中。可见，本发明实施例中通过对长掩码对应的路由的抑制，以实现选择短掩码对应的路由。

Description

一种路由控制方法、网络设备及控制器
本申请要求于2016年3月31日提交中国专利局、申请号为CN 201610204188.0、发明名称为“一种路由控制方法、网络设备及控制器”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明实施例涉及通信技术领域，尤其是涉及一种路由控制方法、网络设备及控制器。
背景技术
转发设备上通常具有转发表项，又称为转发信息库(英文：Forwarding Information Base，简称：FIB)表项。在转发报文时，转发设备将报文的目的地址与转发表项的地址前缀进行匹配，得到匹配的转发表项，从而根据匹配的转发表项确定报文的路由。
目前，转发设备在确定路由时通常基于最长匹配原则，即，转发设备从与目的地址匹配的转发表项中，选择掩码最长的转发表项，根据该掩码最长的转发表项确定出报文的路由。
然而经过发明人研究发现：在一些场景下，根据该掩码最长的转发表项确定出报文的路由，往往并不是最优路由。但是，目前并不存在一种对路由的控制方式，以实现选择短掩码对应的路由。
发明内容
本发明实施例解决的技术问题在于提供一种路由控制方法、网络设备及控制器，通过对长掩码对应的路由进行抑制，从而实现选择短掩码对应的路由。
为此，本发明实施例解决技术问题的技术方案是：
第一方面，本发明实施例提供了一种路由控制方法，网络设备上具有第一路由表项和第二路由表项，所述第一路由表项的地址前缀为第一地址前缀，所述第二路由表项的地址前缀为第二地址前缀，所述第二地址前缀所属的网段为所述第一地址前缀所属的网段的子集，并且所述第二地址前缀中的掩码大于所述第一地址前缀中的掩码；所述方法包括：
所述网络设备的控制模块获得路由抑制请求；
所述控制模块确定出所述第二路由表项；
所述控制模块设置所述第二路由表项的状态为非下发状态，所述非下发状态用于指示所述第二路由表项不用于下发到转发表中。
在第一方面的第一种可能的实现方式中，所述控制模块设置所述第二路由表项的状态为非下发状态包括：
所述控制模块设置所述第二路由表项为非活跃状态，或者设置所述第二路由表项为活跃状态中的仅保存状态。
结合第一方面或者第一方面的第一种可能的实现方式，在第一方面的第二种可能的实现方式中，所述路由抑制请求为边界网关协议BGP流规则FlowSpec消息，所述BGP  FlowSpec消息的网络层可达信息NLRI中携带地址匹配项，所述BGP FlowSpec消息的扩展团体属性中携带所述地址匹配项对应的抑制动作；所述地址匹配项为所述第一地址前缀或者所述第二地址前缀；
所述控制模块设置所述第二路由表项的状态为非下发状态包括：
所述控制模块基于所述抑制动作，设置所述第二路由表项的状态为非下发状态。
结合第一方面或者第一方面的第一种可能的实现方式，在第一方面的第三种可能的实现方式中，所述路由抑制请求为配置命令，所述配置命令中携带地址匹配项和所述地址匹配项对应的抑制动作，所述地址匹配项为所述第一地址前缀或者所述第二地址前缀；
所述控制模块设置所述第二路由表项的状态为非下发状态包括：
所述控制模块基于所述抑制动作，设置所述第二路由表项的状态为非下发状态。
结合第一方面或者第一方面的第一种可能的实现方式，在第一方面的第四种可能的实现方式中，所述控制模块设置所述第二路由表项的状态为非下发状态之前，所述方法还包括：
所述控制模块确定出所述第一路由表项为活跃状态中的下发状态。
结合第一方面的第四种可能的实现方式，在第一方面的第五种可能的实现方式中，所述控制模块设置所述第二路由表项的状态为非下发状态之后，所述方法还包括：
所述控制模块将所述第一路由表项下发到转发表中。
结合第一方面或者第一方面的第一种可能的实现方式，在第一方面的第六种可能的实现方式中，所述网络设备为物理转发设备，所述控制模块为所述物理转发设备的控制模块；或者，所述网络设备为部署在通用物理服务器上的第一虚拟机，所述控制模块为所述第一虚拟机的控制模块；或者，所述网络设备包括部署在通用物理服务器上的第二虚拟机，所述控制模块为所述第二虚拟机。
第二方面，本发明实施例提供了一种路由控制方法，所述方法包括：
控制器向网络设备的控制模块下发第一路由表项和第二路由表项，其中，所述第一路由表项的地址前缀为第一地址前缀，所述第二路由表项的地址前缀为第二地址前缀，所述第二地址前缀所属的网段为所述第一地址前缀所属的网段的子集，并且所述第二地址前缀中的掩码大于所述第一地址前缀中的掩码；
控制器确定出所述第二路由表项；
所述控制器向所述控制模块发送路由抑制请求，所述路由抑制请求用于指示所述控制模块设置所述第二路由表项的状态为非下发状态，所述非下发状态用于指示所述第二路由表项不用于下发到转发表中。
在第二方面的第一种可能的实现方式中，所述路由抑制请求用于指示所述控制模块设置所述第二路由表项为非活跃状态，或者设置所述第二路由表项为活跃状态中的仅保存状态。
结合第二方面或者第二方面的第一种可能的实现方式，在第一方面的第二种可能的实现方式中，所述路由抑制请求为边界网关协议BGP流规则FlowSpec消息，所述BGP FlowSpec消息的网络层可达信息NLRI中携带地址匹配项，所述BGP FlowSpec消息的扩展团体属性中携带所述地址匹配项对应的抑制动作；所述抑制动作用于指示所述控制模块基于所述抑制动作，设置所述第二路由表项的状态为非下发状态；所述地址匹配项为所述第一地址前缀或者所述第二地址前缀。
结合第二方面或者第二方面的第一种可能的实现方式，在第一方面的第三种可能的实现方式中，所述路由抑制请求为配置命令，所述配置命令中携带地址匹配项和所述地址匹配项对应的抑制动作；所述抑制动作用于指示所述控制模块基于所述抑制动作，设置所述第二路由表项的状态为非下发状态；所述地址匹配项为所述第一地址前缀或者所述第二地址前缀。
结合第二方面或者第二方面的第一种可能的实现方式，在第一方面的第四种可能的实现方式中，所述控制器为具有专用硬件结构的控制器、通过在通用物理服务器上安装软件实现的控制器、或者部署在通用物理服务器上的虚拟机。
第三方面，本发明实施例提供了一种网络设备，所述网络设备上具有第一路由表项和第二路由表项，所述第一路由表项的地址前缀为第一地址前缀，所述第二路由表项的地址前缀为第二地址前缀，所述第二地址前缀所属的网段为所述第一地址前缀所属的网段的子集，并且所述第二地址前缀中的掩码大于所述第一地址前缀中的掩码；
所述网络设备包括控制模块，所述控制模块包括获得单元、确定单元和设置单元；
所述获得单元用于，获得路由抑制请求；
所述确定单元用于，确定出所述第二路由表项；
所述设置单元用于，设置所述第二路由表项的状态为非下发状态，所述非下发状态用于指示所述第二路由表项不用于下发到转发表中。
在第三方面的第一种可能的实现方式中，所述设置单元具体用于，设置所述第二路由表项为非活跃状态，或者设置所述第二路由表项为活跃状态中的仅保存状态。
结合第三方面或者第三方面的第一种可能的实现方式，在第三方面的第二种可能的实现方式中，所述路由抑制请求为边界网关协议BGP流规则FlowSpec消息，所述BGP FlowSpec消息的网络层可达信息NLRI中携带地址匹配项，所述BGP FlowSpec消息的扩展团体属性中携带所述地址匹配项对应的抑制动作；所述地址匹配项为所述第一地址前缀或者所述第二地址前缀；
所述设置单元具体用于基于所述抑制动作，设置所述第二路由表项的状态为非下发状态。
结合第三方面或者第三方面的第一种可能的实现方式，在第三方面的第三种可能的实现方式中，所述路由抑制请求为配置命令，所述配置命令中携带地址匹配项和所述地址匹配项对应的抑制动作，所述地址匹配项为所述第一地址前缀或者所述第二地址前缀；
所述设置单元具体用于基于所述抑制动作，设置所述第二路由表项的状态为非下发状态。
结合第三方面或者第三方面的第一种可能的实现方式，在第三方面的第四种可能的实现方式中，所述确定单元还用于，所述设置单元设置所述第二路由表项的状态为非下发状态之前，确定出所述第一路由表项为活跃状态中的下发状态。
结合第三方面的第四种可能的实现方式，在第三方面的第五种可能的实现方式中，还包括下发单元，
所述下发单元用于，所述设置单元设置所述第二路由表项的状态为非下发状态之后，将所述第一路由表项下发到转发表中。
结合第三方面或者第三方面的第一种可能的实现方式，在第三方面的第六种可能的实现方式中，所述网络设备为物理转发设备，所述控制模块为所述物理转发设备的控制模块； 或者，所述网络设备为部署在通用物理服务器上的第一虚拟机，所述控制模块为所述第一虚拟机的控制模块；或者，所述网络设备包括部署在通用物理服务器上的第二虚拟机，所述控制模块为所述第二虚拟机。
第四方面，本发明实施例提供了一种控制器，包括：下发单元、确定单元和发送单元；
所述下发单元用于，向网络设备的控制模块下发第一路由表项和第二路由表项，其中，所述第一路由表项的地址前缀为第一地址前缀，所述第二路由表项的地址前缀为第二地址前缀，所述第二地址前缀所属的网段为所述第一地址前缀所属的网段的子集，并且所述第二地址前缀中的掩码大于所述第一地址前缀中的掩码；
所述确定单元用于，确定出所述第二路由表项；
所述发送单元用于，向所述控制模块发送路由抑制请求，所述路由抑制请求用于指示所述控制模块设置所述第二路由表项的状态为非下发状态，所述非下发状态用于指示所述第二路由表项不用于下发到转发表中。
在第四方面的第一种可能的实现方式中，所述路由抑制请求用于指示所述控制模块设置所述第二路由表项为非活跃状态，或者设置所述第二路由表项为活跃状态中的仅保存状态。
结合第四方面或者第四方面的第一种可能的实现方式，在第三方面的第二种可能的实现方式中，所述路由抑制请求为边界网关协议BGP流规则FlowSpec消息，所述BGP FlowSpec消息的网络层可达信息NLRI中携带地址匹配项，所述BGP FlowSpec消息的扩展团体属性中携带所述地址匹配项对应的抑制动作；所述抑制动作用于指示所述控制模块基于所述抑制动作，设置所述第二路由表项的状态为非下发状态；所述地址匹配项为所述第一地址前缀或者所述第二地址前缀。
结合第四方面或者第四方面的第一种可能的实现方式，在第三方面的第三种可能的实现方式中，所述路由抑制请求为配置命令，所述配置命令中携带地址匹配项和所述地址匹配项对应的抑制动作；所述抑制动作用于指示所述控制模块基于所述抑制动作，设置所述第二路由表项的状态为非下发状态；所述地址匹配项为所述第一地址前缀或者所述第二地址前缀。
结合第四方面或者第四方面的第一种可能的实现方式，在第三方面的第四种可能的实现方式中，所述控制器为具有专用硬件结构的控制器、通过在通用物理服务器上安装软件实现的控制器、或者部署在通用物理服务器上的虚拟机。
第四方面，本发明实施例提供了一种网络系统，包括上述网络设备的任一种可能的实现方式，和上述控制器的任一种可能的实现方式。
通过上述技术方案可知，在本发明实施例中，网络设备上具有第一路由表项和第二路由表项，所述第一路由表项的地址前缀为第一地址前缀，所述第二路由表项的地址前缀为第二地址前缀，其中，所述第二地址前缀中的掩码大于所述第一地址前缀中的掩码，并且所述第二地址前缀所属的网段为所述第一地址前缀所属的网段的子集。当所述网络设备的控制模块获得路由抑制请求后，能够确定出所述第二路由表项，通过设置所述第二路由表项的状态为非下发状态，指示所述第二路由表项不会下发到转发表中。由于所述第二路由表项对应的路由为长掩码对应的路由，因此，当有报文转发时，该报文不会基于所述第二路由表项选择长掩码对应的路由，从而通过对长掩码对应的路由的抑制，以实现选择短掩码对应的路由。
附图说明
为了更清楚地说明本发明实施例中的技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其它的附图。
图1为现有技术中一种报文流向的示意图；
图2为本发明实施例提供的一种方法实施例的流程示意图；
图3为本发明实施例提供的一种转发系统的结构示意图；
图4为本发明实施例提供的一种转发场景的结构示意图；
图5为本发明实施例提供的另一种转发场景的结构示意图；
图6为本发明实施例提供的另一种转发场景的结构示意图；
图7为本发明实施例提供的另一种方法实施例的流程示意图；
图8为本发明实施例提供的另一种方法实施例的流程示意图；
图9为本发明实施例提供的一种报文流向的示意图；
图10为本发明实施例提供的网络设备的一种装置实施例的结构示意图；
图11为本发明实施例提供的控制器的一种装置实施例的结构示意图；
图12为本发明实施例提供的网络系统的一种装置实施例的结构示意图；
图13为本发明实施例提供的网络设备的另一种装置实施例的结构示意图；
图14为本发明实施例提供的控制器的另一种装置实施例的结构示意图。
具体实施方式
路由表(又称为RIB表)和转发表(又称为FIB表)是转发过程中两种常用的表。其中，由控制面计算出路由表后，将路由表中的表项下发到转发面的转发表中，用于指示报文的转发。例如，表1示出了控制面计算出的路由表。
表1
Figure PCTCN2017076963-appb-000001
Figure PCTCN2017076963-appb-000002
将表1中的所有表项下发至转发面后，得到如表2所示的转发表。
表2
Figure PCTCN2017076963-appb-000003
转发面在基于例如表2所示的转发表转发报文时，将报文的目的地址与转发表中各个转发表项的地址前缀进行匹配，确定出匹配的转发表项，根据匹配的转发表项确定报文的路由。目前，转发面在确定路由时通常基于最长匹配原则，即，转发面从与目的地址匹配的转发表项中，确定出掩码最长的转发表项，根据该掩码最长的转发表项确定报文的路由，即相当于选择了长掩码对应的路由。其中，地址前缀(英文：prefix)可以由地址和掩码两部分构成，例如地址前缀的格式为：互联网协议(英文：Internet Protocol Address，简称：IP)地址/掩码。
举例说明，若报文的目的地址为9.1.1.18，转发面按照掩码从长到短的顺序，将目的地址9.1.1.18分别与表2中各个表项的地址前缀进行匹配，当确定出地址前缀9.1.0.0/16与目的地址9.1.1.18匹配后，不再继续匹配，而是确定出地址前缀9.1.0.0/16对应的表项，并根据该表项对应的下一跳120.0.0.2确定路由，也就是将该报文向下一跳120.0.0.2进行转发。
然而经过发明人研究发现：在一些场景下，根据掩码最长的转发表项确定出的报文的路由，往往并不是最优路由。例如在图1所示的场景中，城域网络包括路由器A和路由器B。因特网服务提供商(英文：Internet Service Provider，简称：ISP)1包括路由器C和路由器D，ISP2包括路由器E和路由器F。并且，ISP1向城域网络发布的地址前缀为9.0.0.0/8，ISP1同时向ISP2发布了地址前缀9.1.0.0/16，该地址前缀通过ISP2发布至城域网络。服务器的地址前缀为9.1.1.18/24，当用户端需要发送目的地址为9.1.1.18的报文时，路由器A将该报文发送至路由器B，路由器B基于表2所示的转发表，会将报文发送对应的下一跳地址120.0.0.2，即路由器F的地址，从而实现了发送至ISP2，最终通过路由器E、路由器D和路由器C发送到ISP1上挂着的服务器。然而，由于从ISP2转发的路由消耗值更多、收费更高、或者传输质量更差等原因，可能会造成向ISP2转发的路由并不是最优路由。但是，目前并不存在一种能够对路由的控制方式，以实现选择短掩码对应的路由。
本发明实施例解决的技术问题在于提供一种路由控制方法、网络设备及控制器，通过对长掩码对应的路由进行抑制，从而实现选择短掩码对应的路由。
下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域技术人员在没有作出创造性劳动前提下所获得的所有其他实施 例，都属于本发明保护的范围。
本发明的说明书和权利要求书及上述附图中的术语“第一”、“第二”、“第三”或“第四”等是用于区别类似的对象，而不用于描述特定的顺序或先后次序。应该理解这样使用的数据在适当情况下可以互换，以便这里描述的实施例能够以除了在这里图示或描述的内容以外的顺序实施。此外，术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含，例如，包含了一系列步骤或单元的过程、方法、系统、产品或设备不必限于清楚地列出的那些步骤或单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或单元。
请参阅图2，本发明实施例提供了路由控制方法的一种方法实施例。本实施例可以用于网络设备中。
所述网络设备上，例如所述网络设备的控制模块上具有第一路由表项和第二路由表项。所述第一路由表项的地址前缀为第一地址前缀；所述第二路由表项的地址前缀为第二地址前缀。所述第一地址前缀和所述第二地址前缀均用于与报文的目的地址进行匹配。其中，所述第二地址前缀中的掩码大于所述第一地址前缀中的掩码，也就是说，所述第一路由表项对应的路由为短掩码对应的路由，所述第二路由表项对应的路由为长掩码对应的路由。并且，所述第二地址前缀所属的网段为网段U1，所述第一地址前缀所属的网段为网段U2。其中，网段U1为网段U2的子集，也就是说，网段U2中包括网段U1，即，属于网段U2的IP地址一定属于网段U1，而属于网段U1的IP地址有可能属于网段U2，也有可能不属于网段U2。本发明实施例中提及的所属网段均指的是所属的最大范围的网段。
举例说明，所述第一地址前缀可以为9.0.0.0/8，所述第二地址前缀可以为9.1.0.0/16。可以看出，掩码16大于掩码8，并且9.1.0.0/16所属的网段为网段9.1.0.0-9.1.255.255，9.0.0.0/8所属的网段为网段9.0.0.0-9.255.255.255，而网段9.1.0.0-9.1.255.255为网段9.0.0.0-9.255.255.255的子集。并且，由于所述第二地址前缀所属的网段为所述第一地址前缀所属的网段的子集，因此若报文的目的地址与所述第二路由表项匹配，则一定也与所述第一路由表项匹配。例如，若报文的目的地址为9.1.1.18，则该报文与9.0.0.0/8和9.1.0.0/16均匹配。需要说明的是，本发明实施例中所提及的长掩码和短掩码，指的是相对而言的长和短，例如对于掩码8和16来说，16为长掩码，8为短掩码。
在本发明实施例中，所述第一路由表项和所述第二路由表项除了地址前缀之外，还可以具有下一跳地址、表项状态等信息。其中，下一跳地址用于指示下一跳路由，表项状态用于指示是否用于下发转发表项等。
举例说明，所述网络设备可以为图3所示的转发设备01，转发设备01分别与转发设备02和转发设备03连接。所述第一路由表项和所述第二路由表项可以如表3所示，所述第一路由表项的下一跳地址为转发设备02的地址，即，所述第一路由表项用于指示将报文转发至转发设备02；所述第二路由表项的下一跳地址为转发设备03的地址，即，所述第二路由表项用于指示将报文转发至转发设备03。所述第一路由表项和所述第二路由表项的初始表项状态可以均为Active中的下发状态，用于指示下发转发表项。其中，转发设备01、转发设备02和转发设备03可以为不同网络的边界设备，例如，转发设备01可以为城域网络或者数据中心(英文：Data Center，简称：DC)网络的边界设备，转发设备02可以为ISP1的边界设备，转发设备03可以为ISP2的边界设备。
表3
地址前缀 下一跳 表项状态
第一地址前缀 转发设备02的地址 Active中的下发状态
第二地址前缀 转发设备03的地址 Active中的下发状态
本实施例的所述方法包括：
201：所述网络设备的控制模块获得路由抑制请求。
其中，所述路由抑制请求中可以携带地址匹配项。所述地址匹配项用于从所述第一路由表项和所述第二路由表项中确定出所述第二路由表项，从而确定出长掩码对应的路由。其中，所述地址匹配项可以为所述第一地址前缀，也可以为所述第二地址前缀。
其中，所述路由抑制请求既可以是控制器等路由控制设备发送的报文消息；也可以是用户配置的配置命令等。
202：所述控制模块确定出所述第二路由表项。
其中，所述控制模块可以是根据所述地址匹配项确定出所述第二路由表项。
所述控制模块在确定所述第二路由表项时的确定规则可以是掩码大于地址匹配项的掩码，地址前缀与地址匹配项完全相同或者部分相同。举例说明，所述地址匹配项为所述第二地址前缀，例如9.1.0.0/16，所述控制模块根据9.1.0.0/16确定出掩码16大于掩码8，并且所述第二路由表项的地址前缀与9.1.0.0/16完全相同，从而确定出所述第二路由表项。
所述确定规则也可以是掩码大于地址匹配项的掩码，地址前缀所属的网段为地址匹配项所属的网段的子集。举例说明，所述地址匹配项为所述第一地址前缀，例如9.0.0.0/8，所述控制模块确定出掩码16大于掩码8，并且所述第二路由表项的地址前缀所属的网段，为9.0.0.0/8所属的网段的子集，从而确定出所述第二路由表项。
203：所述控制模块设置所述第二路由表项的状态为非下发状态，所述非下发状态用于指示所述第二路由表项不用于下发到转发表中。
在本发明实施例中，所述控制模块确定出所述第二路由表项后，为了抑制所述第二路由表项对应的路由，即长掩码对应的路由，对所述第二路由表项的状态进行设置。由于将路由表项下发到转发表中是周期性执行的，因此，在设置所述第二路由表项的状态为非下发状态之后，在下一次下发路由表项时所述第二路由表项不会下发到转发表中。其中，转发表位于所述控制模块对应的转发模块中，因此，当有报文转发时，所述转发模块不会基于所述第二路由表项对应的路由转发该报文。
其中，在设置所述第二路由表项的状态为非下发状态时，既可以设置所述第二路由表项为非活跃状态(In-Active)，也可以设置所述第二路由表项为活跃状态中的仅保存状态(Rib-Only)。例如表4所示，将所述第二路由表项设置为In-Active或者Rib-Only。其中，Rib-Only指的是仅在路由表中进行保存的状态，表示路由表项不用于下发到转发模块的转发表中。
表4
地址前缀 下一跳 表项状态
第一地址前缀 转发设备02的地址 Active中的下发状态
第二地址前缀 转发设备03的地址 In-Activ或者Rib-Only
通过上述技术方案可知，在本发明实施例中，所述网络设备上具有第一路由表项和第二路由表项，所述第一路由表项的地址前缀为第一地址前缀，所述第二路由表项的地址前缀为第二地址前缀。其中，所述第二地址前缀中的掩码大于所述第一地址前缀中的掩码， 即，所述第二路由表项对应的路由为长掩码对应的路由。并且所述第二地址前缀所属的网段为所述第一地址前缀所属的网段的子集。当所述网络设备的控制模块获得路由抑制请求后，能够确定所述第二路由表项，通过设置所述第二路由表项的状态为非下发状态，指示所述第二路由表项不会下发到转发表中。由于所述第二路由表项对应的路由为长掩码对应的路由，因此，当有报文转发时，该报文不会基于所述第二路由表项选择长掩码对应的路由，从而通过对长掩码对应的路由的抑制，以实现选择短掩码对应的路由。
本发明实施例可以用于多种转发场景中，当用于不同的转发场景时，网络设备分别对应不同的设备，下面具体说明。
第一种转发场景中，所述网络设备为物理转发设备，物理转发设备指的是具有专用硬件结构的转发设备，例如为具有专用硬件结构的路由器或者交换机等。所述控制模块为所述物理转发设备的控制模块。图4示出了第一种转发场景中的一种示例性转发场景，该转发场景包括物理控制器和物理转发设备，物理转发设备的控制模块接收物理控制器发送的路由抑制请求。其中，物理控制器指的是具有专用硬件结构的控制器，例如为主控板或者控制卡等。
第二种转发场景中，所述网络设备为部署在通用物理服务器上的第一虚拟机，所述控制模块为所述第一虚拟机的控制模块。实际上，这种场景中利用虚拟化技术，虚拟出运行有用于提供转发设备功能的程序的虚拟机(英文：Virtual Machine，简称：VM)，该虚拟机即为所述网络设备，该虚拟机的控制模块即为所述网络设备的控制模块。
下面简要说明虚拟化技术：一个通用物理服务器通过虚拟化技术能够被虚拟成多个逻辑计算机，每一个逻辑计算机即是通用物理服务器上的一个虚拟机，其中，每个虚拟机可以运行不同的操作系统，因此，各个虚拟机的应用程序可以运行在互相独立的操作系统的空间内。即，一个虚拟机指的是通过软件模拟的具有完整硬件系统功能的、运行在一个完全隔离环境中的一个完整计算机系统。
图5示出了第二种转发场景中的一种示例性转发场景，该转发场景包括虚拟机01和虚拟机02，虚拟机01运行有用于提供控制器功能的程序，虚拟机02运行有用于提供转发设备功能的程序，虚拟机02的控制模块接收虚拟机01发送的路由抑制请求。
值得说明的是，该虚拟机01和该虚拟机02也可以部署在不同的通用物理服务器上。
第三种转发场景中，所述网络设备包括部署在通用物理服务器上的第二虚拟机，所述控制模块为所述第二虚拟机。实际上，这种场景中利用虚拟化技术，虚拟出运行有用于提供转发设备的控制模块的功能的程序的虚拟机，该虚拟机即为所述控制模块，所述网络设备包括所述控制模块和转发模块，所述转发模块提供报文的转发功能，可以单独部署在通用物理服务器的虚拟机上，也可以直接部署在通用物理服务器上，还可以部署在专用的物理硬件设备上。
图6示出了第三种转发场景中的一种示例性转发场景，该转发场景包括虚拟机03、虚拟机04和转发模块，虚拟机03运行有用于提供控制器功能的程序，虚拟机04运行有用于提供转发设备的控制模块功能的程序，虚拟机04接收虚拟机03发送的路由抑制请求，并且向转发模块下发路由表项。其中，该转发模块可以为单独的虚拟机。
本发明实施例中，为了不影响报文的转发，还可以在203中设置所述第二路由表项的状态为非下发状态之前，判断所述第一路由表项是否用于下发到转发表中，如果是，则继续执行203。具体地，本发明实施例在203之前还可以包括：所述控制模块确定出所述第 一路由表项为活跃状态中的下发状态。其中，所述控制模块可以是根据所述地址匹配性确定出所述第一路由表项。由于所述第二地址前缀所属的网段为所述第一地址前缀所属的网段的子集，因此，即使所述第二路由表项不下发到转发表中，所述控制模块对应的转发模块也可以至少基于所述第一路由表项对应的路由转发报文，避免出现报文无法转发的情况。此外，若本发明实施例判断出所述第一路由表项不用于下发到转发表中，例如所述第一路由表项为In-Active或者Rib-Only，本发明实施例中还可以不执行203，从而保证不影响报文的转发。
举例说明，在图3所示的拓扑中，转发设备01的控制模块获得的地址匹配项为所述第一地址前缀，转发设备01的控制模块根据所述第一地址前缀确定出所述第一路由表项。若转发设备01的控制模块确定出所述第一路由表项为活跃状态中的下发状态，则执行203，即设置所述第二路由表项的状态为非下发状态。因此，即使报文的目的地址分别与所述第二路由表项和所述第一路由表项均匹配，转发设备01的转发模块也不会基于所述第二路由表项对应的路由将所述报文转发至转发设备03，而可以基于所述第一路由表项对应的转发表项将所述报文转发至转发设备02。若转发设备01的控制模块确定出所述第一路由表项为In-Active或者Rib-Only，则不执行203。因此，转发设备01的转发模块会基于所述第二路由表项对应的路由将所述报文转发至转发设备03。
本发明实施例中，203中所述控制模块设置所述第二路由表项的状态之后，还可以包括：所述控制模块将所述第一路由表项下发到转发表中。而所述第二路由表项并不会下发到转发表中，从而使得所述控制模块对应的转发模块基于所述第一路由表项选择短掩码对应的路由。
在本发明实施例中，所述控制模块可以接收到由路由控制设备发送的路由抑制请求，在软件定义网络(英文：Software Defined Network,简称：SDN)中，该路由控制设备可以为控制器，在非SDN中，该路由控制设备可以为网络管理设备、流量分析服务器、协同器等。下面以控制器侧为执行主体说明路由控制方法的另一种实施例。
请参阅图7，本发明实施例提供了路由控制方法的另一种方法实施例。本实施例可以用于控制器中。
701：控制器向网络设备的控制模块下发第一路由表项和第二路由表项，其中，所述第一路由表项的地址前缀为第一地址前缀，所述第二路由表项的地址前缀为第二地址前缀，所述第二地址前缀所属的网段为所述第一地址前缀所属的网段的子集，并且所述第二地址前缀中的掩码大于所述第一地址前缀中的掩码。
其中，所述控制器计算出所述第一路由表项和第二路由表项后，可以将计算出的表项下发到所述控制模块。所述控制模块接收到所述第一路由表项和所述第二路由表项后，可以将所述第一路由表项和所述第二路由表项保存在所述网络设备中。
702：所述控制器确定出所述第二路由表项。
其中，所述控制器可以根据所述第一路由表项和所述第二路由表项，自动确定出需要抑制所述第二路由表项；也可以是检测到用户执行的抑制操作，确定出需要抑制所述第二路由表项。
703：所述控制器向所述控制模块发送路由抑制请求，所述路由抑制请求用于指示所述控制模块设置所述第二路由表项的状态为非下发状态，所述非下发状态用于指示所述第二路由表项不用于下发到转发表中。其中，所述路由抑制请求中可以携带地址匹配项，所 述控制模块根据所述地址匹配项确定出所述第二路由表项。关于本实施例的相关内容，请参阅图2对应的实施例，这里不再赘述。
本发明实施例中，所述控制器可以为具有专用硬件结构的控制器，具有专用硬件结构的控制器可以为具有专用硬件结构的设备、主控板或者控制卡等。所述控制器还可以为在通用物理服务器上通过安装软件实现的控制器、或者为部署在通用物理服务器上的虚拟机，即利用虚拟化技术，虚拟出运行有用于提供控制器功能的程序的虚拟机。所述控制器可以用于图4-图6任一种转发场景中。
在本发明实施例中，所述控制器也可以不向所述控制模块发送路由抑制请求，而是所述控制器确定出所述第二路由表项后，在701中不将所述第二路由表项下发到所述控制模块中，也能够实现对长掩码对应的路由进行抑制。
本发明实施例中可以通过对边界网关协议(英文：Border Gateway Protocol，简称：BGP)流规则(英文：Flow Specification，简称：FlowSpec)消息进行扩展，在所述消息中携带所述地址匹配项。下面具体说明。
目前，BGP Flow Spec消息用于控制攻击流量，该消息包括网络层可达信息(英文：Network Layer Reachability Information，简称：NLRI)和扩展团体属性(英文：extended community)。其中，RFC(Request For Comments)5575中定义了12种常用的流量匹配规则，例如包括目的地址、源地址、IP号、端口号等，这12种规则封装在该消息的NLRI中。此外，RFC 5575还定义了4种常用的流量处理行为，例如包括：丢弃流量、流量限速、重定向到虚拟专用网络(英文：Virtual Private Network，简称：VPN))，这4种处理行为在扩展团体属性中携带。
而本发明实施例中，所述路由抑制请求为可以具体为BGP FlowSpec消息，在BGP FlowSpec消息的NLRI中携带地址匹配项，在BGP FlowSpec消息的扩展团体属性中携带所述地址匹配项对应的抑制动作。例如所述抑制动作可以指示出设置为In-Active或者Rib-Only。因此，所述控制模块接收到所述BGP FlowSpec消息后，能够从该消息的NLRI中获得所述地址匹配项，从该消息的扩展团体属性中获得所述抑制动作，从而基于所述抑制动作，设置所述第二路由表项的状态为非下发状态。其中，所述地址匹配项可以为所述第一地址前缀或者所述第二地址前缀。
例如表5所示，当类型为TBD1时，所述地址匹配项为所述第一地址前缀，TBD1指示出根据所述第一地址前缀确定出所述第二路由表项，将所述第二路由表项的状态设置为Rib-Only。TBD2指示出根据所述第一地址前缀确定出所述第二路由表项，将所述第二路由表项的状态设置为In-Active。
表5
Figure PCTCN2017076963-appb-000004
Figure PCTCN2017076963-appb-000005
其中，所述第二路由表项对应的路由为所述第一路由表项对应的路由的明细路由。TBD表示待定义(to be defined)，在国际互联网工程任务组(英文：The Internet Engineering Task Force，简称:IETF)正式分配后，会使用IETF指定的数值。
另外，所述路由抑制请求还可以为配置命令，所述配置命令中携带地址匹配项和所述地址匹配项对应的抑制动作。该配置命令可以是对所述网络设备进行本地配置后获得，也可以是由其它设备发送给所述控制模块。例如，其它设备通过Netconf协议将所述配置命令发送至所述控制模块，作为所述控制模块下发路由表项时的策略。所述控制模块基于该配置命令中的抑制动作，设置所述第二路由表项的状态为非下发状态。其中，所述地址匹配项可以为所述第一地址前缀或者所述第二地址前缀。
在本发明实施例中，对所述第二路由表项的状态进行设置之后，还可以恢复所述第二路由表项的状态，以使得所述第二路由表项用于下发到转发表中。例如，所述第一路由表项的状态从Active中的下发状态改变为In-Active或者Rib-Only时，所述控制模块可以将所述第二路由表项的状态恢复成Active中的下发状态。又例如，所述控制模块根据撤销抑制请求或者配置命令，将所述第二路由表项的状态恢复成Active中的下发状态。举例说明，所述控制模块接收到扩展后的BGP Flow Spec更新消息后，将所述第二路由表项的状态设置为In-Active或者Rib-Only，接收到扩展后的BGP Flow Spec撤销消息后，将所述第二路由表项的状态设置为Active中的下发状态。
在本发明实施例中，当所述地址匹配项为所述第一地址前缀，若除了所述第二路由表项之外，还能确定出第三路由表项对应的路由为长掩码对应的路由，也就是说，所述网络设备上还具有第三路由表项，所述第三路由表项的地址前缀为第三地址前缀，所述第三地址前缀所属的网段也为所述第一地址前缀所属的网段的子集，并且所述第三地址前缀中的掩码也大于所述第一地址前缀中的掩码。则本发明实施例中既可以设置将所述第三路由表项的状态为非下发状态，使得所述第三路由表项不用于下发到转发表中，也可以不改变所述第三路由表项的状态，使得所述第三路由表项仍然能够下发到转发表中。下面分别说明。
可选的，所述方法还包括：所述控制模块根据所述地址匹配项确定出第三路由表项；所述控制模块设置所述第三路由表项的状态为非下发状态，使得所述第三路由表项不用于下发到转发表中。例如所述第一地址前缀为9.0.0.0/8，所述第二地址前缀为9.1.0.0/16，所述第三地址前缀为9.2.0.0/16，所述控制模块还可以将所述第三路由表项设置为In-Active或者Rib-Only。也就是说，本实施例中根据所述第一地址前缀确定出所述第二路由表项和所述第三路由表项对应的路由均为长掩码对应的路由时，可以同时抑制这两个长掩码对应的路由。
可选的，所述方法还包括：所述控制模块获得子网范围匹配项；202中所述控制模块根据所述地址匹配项和所述子网范围匹配项确定出所述第二路由表项。例如所述第一地址前缀为9.0.0.0/8，所述第二地址前缀为9.1.0.0/16，所述第三地址前缀为9.2.0.0/16，所述子网匹配项可以是9.1.0.0，可以根据所述第一地址前缀和所述子网匹配项确定出所述第二路由表项。也就是说，本实施例中根据所述第一地址前缀确定出所述第二路由表项和所述第三路由表项对应的路由均为长掩码对应的路由时，还可以指定更明细的子网，从而只对所述第二路由表项对应的路由进行抑制，而不抑制所述第三路由表项对应的路由。
下面通过一个具体的场景对本发明实施例进行说明。
请参与图8，本发明实施例提供了路由控制方法的另一种方法实施例。本实施例可以用于如图9所示的路由器B中。
在图9所示的拓扑中，城域网络包括路由器A和路由器B。ISP1包括路由器C和路由器D，ISP2包括路由器E和路由器F。并且，ISP1向城域网络发布的地址前缀为9.0.0.0/8，ISP1同时向ISP2发布了地址前缀9.1.0.0/16，该地址前缀通过ISP2发布至城域网络。路由器B上具有如表1所示的路由表。
801：控制器(图中未示出)识别出路由器B的表1中存在9.0.0.0/8和9.1.0.0/16对应的表项，向用户生成提示消息。
其中，该消息可以指示出9.1.0.0/16对应的路由为9.0.0.0/8对应的路由的明细路由。
802：所述控制器确定出需要抑制9.1.0.0/16对应的路由，生成扩展后的BGP Flow Spec更新消息，该消息的NLRI中携带9.0.0.0/8，扩展团体属性中携带抑制动作，例如表5所示的TBD1或者TBD2。
其中，可以由管理者根据801显示的提示消息，制定出路由控制策略，即用户通过城域网络访问9.1.0.0-9.1.255.255网段的目的地址，要从ISP1方向转发报文，即抑制9.1.0.0/16对应的路由。所述控制器根据该策略生成扩展后的BGP Flow Spec更新消息。
803：所述控制器将生成的该消息发送至路由器B。
804：路由器B接收到该消息后，从该消息中获取到9.0.0.0/8和所述抑制动作。
805：路由器B遍历表1，确定出9.0.0.0/8对应的表项，判断该表项的状态是否是Active中的下发状态，如果是，则执行806。如果否，则可以结束流程，或者根据本地的路由表生成转发表。
806：路由器B遍历表1，根据9.0.0.0/8确定出满足要求的地址9.1.0.0/16。所述要求为：掩码大于8，并且地址前缀所属的网段为9.0.0.0/8所属的网段的子集。
807：路由器B确定出9.1.0.0/16对应的路由表项，并根据所述抑制动作将该路由表项的状态设置为In-Active或者Rib-Only。例如所述抑制动作为TBD1，将该路由表项的状态设备为Rib-Only。
808：路由器B根据修改后的表1中各个路由表项的状态，将路由表项下发到转发表中。由于修改后的表1中，9.1.0.0/16对应的路由表项的状态为In-Active或者Rib-Only，因此该路由表项不会下发到转发表中，而9.0.0.0/8对应的路由表项会下发到转发表中。
809：路由器B接收到目的地址为9.1.1.18的报文，基于9.0.0.0/8对应的转发表项将该报文转发至对应的下一跳地址20.0.0.2，即路由器C的地址，从而实现了发送至ISP1，最终发送至ISP1上挂着的服务器上。
其中，804-808由路由器B的控制模块执行，809由路由器B的转发模块执行。
可见，本实施例中，用户通过城域网络访问9.1.0.0-9.1.255.255网段的目的地址时，能够从ISP1方向转发报文，从而实现了通过对长掩码对应的路由的抑制，以实现选择短掩码对应的路由。
上面对本发明实施例中的路由控制方法的方法实施例进行了描述，下面将从模块化功能实体的角度对本发明实施例中的相关装置进行描述。
请参阅图10，本发明实施例提供了网络设备的一种装置实施例。本实施例的网络设备100上具有第一路由表项和第二路由表项，所述第一路由表项的地址前缀为第一地址前缀， 所述第二路由表项的地址前缀为第二地址前缀，所述第二地址前缀所属的网段为所述第一地址前缀所属的网段的子集，并且所述第二地址前缀中的掩码大于所述第一地址前缀中的掩码。
网络设备100包括控制模块101。控制模块101包括获得单元1011、确定单元1012和设置单元1013。
获得单元1011用于获得路由抑制请求。
确定单元1012用于确定出所述第二路由表项。
设置单元1013用于设置所述第二路由表项的状态为非下发状态，所述非下发状态用于指示所述第二路由表项不用于下发到转发表中。
举例来说，图10所示的网络设备100可以用于执行图2所示的方法。具体地，获得单元1011可以用于执行图2中的201，确定单元1012可以用于执行图2中的202。设置单元1013可以用于执行图2中的203。
可选的，设置单元1013具体用于，设置所述第二路由表项为非活跃状态，或者设置所述第二路由表项为活跃状态中的仅保存状态。
可选的，所述路由抑制请求为边界网关协议BGP流规则FlowSpec消息，所述BGP FlowSpec消息的网络层可达信息NLRI中携带地址匹配项，所述BGP FlowSpec消息的扩展团体属性中携带所述地址匹配项对应的抑制动作；所述地址匹配项为所述第一地址前缀或者所述第二地址前缀；设置单元1013具体用于基于所述抑制动作，设置所述第二路由表项的状态为非下发状态。
可选的，所述路由抑制请求为配置命令，所述配置命令中携带地址匹配项和所述地址匹配项对应的抑制动作；设置单元1013具体用于基于所述抑制动作，设置所述第二路由表项的状态为非下发状态。所述地址匹配项为所述第一地址前缀或者所述第二地址前缀。
可选的，确定单元1012还用于，设置单元1013设置所述第二路由表项的状态为非下发状态之前，确定出所述第一路由表项为活跃状态中的下发状态。
可选的，网络设备100还包括下发单元，所述下发单元用于，设置单元1013设置所述第二路由表项的状态为非下发状态之后，将所述第一路由表项下发到转发表中。
可选的，网络设备100为物理转发设备，所述控制模块101为所述物理转发设备的控制模块；或者，网络设备100为部署在通用物理服务器上的第一虚拟机，所述控制模块101为所述第一虚拟机的控制模块；或者，网络设备100包括部署在通用物理服务器上的第二虚拟机，所述控制模块101为所述第二虚拟机。
需要说明的是，关于本实施例中网络设备100的各种具体实施方式，均可以参见前述图2所示的实施例的详细介绍，此处不再赘述。
请参阅图11，本发明实施例提供了控制器的一种装置实施例。
本实施例的控制器110包括：下发单元111、确定单元112和发送单元113。
下发单元111用于向网络设备的控制模块下发第一路由表项和第二路由表项，其中，所述第一路由表项的地址前缀为第一地址前缀，所述第二路由表项的地址前缀为第二地址前缀，所述第二地址前缀所属的网段为所述第一地址前缀所属的网段的子集，并且所述第二地址前缀中的掩码大于所述第一地址前缀中的掩码。
确定单元112用于确定出所述第二路由表项。
发送单元113用于向所述控制模块发送路由抑制请求，所述路由抑制请求用于指示所 述控制模块设置所述第二路由表项的状态为非下发状态，所述非下发状态用于指示所述第二路由表项不用于下发到转发表中。
举例来说，图11所示的控制器110可以用于执行图7所示的方法。具体地，下发单元111可以用于执行图7中的701，确定单元112可以用于执行图7中的702，发送单元113可以用于执行图7中的703。
可选的，所述路由抑制请求用于指示所述控制模块设置所述第二路由表项为非活跃状态，或者设置所述第二路由表项为活跃状态中的仅保存状态。
可选的，所述路由抑制请求为边界网关协议BGP流规则FlowSpec消息，所述BGP FlowSpec消息的网络层可达信息NLRI中携带地址匹配项，所述BGP FlowSpec消息的扩展团体属性中携带所述地址匹配项对应的抑制动作；所述抑制动作用于指示所述控制模块基于所述抑制动作，设置所述第二路由表项的状态为非下发状态；所述地址匹配项为所述第一地址前缀或者所述第二地址前缀。
可选的，所述路由抑制请求为配置命令，所述配置命令中携带地址匹配项和所述地址匹配项对应的抑制动作；所述抑制动作用于指示所述控制模块基于所述抑制动作，设置所述第二路由表项的状态为非下发状态；所述地址匹配项为所述第一地址前缀或者所述第二地址前缀。
可选的，所述控制器为具有专用硬件结构的控制器、通过在通用物理服务器上安装软件实现的控制器、或者部署在通用物理服务器上的虚拟机。
需要说明的是，关于本实施例中控制器110的各种具体实施方式，均可以参见前述图7所示的实施例的详细介绍，此处不再赘述。
请参阅图12，本发明实施例提供了网络系统的一种系统实施例。本实施例中，所述系统包括网络设备100和控制器110。其中，网络设备100可以为前述任意一种实施方式的网络设备，控制器110可以为前述任意一种实施方式的控制器。
本实施例中网络设备100和控制器110的各种具体实施方式，可以参见前述图2、图7、图10-11所示的实施例的详细介绍，本实施例在此不再赘述。
上面从模块化功能实体的角度对本发明实施例中的相关装置进行描述。下面将从硬件处理的角度对本发明实施例中的相关装置进行描述。
请参阅图13，本发明实施例提供了网络设备的另一种装置实施例，本实施例中，网络设备1300上具有第一路由表项和第二路由表项，所述第一路由表项的地址前缀为第一地址前缀，所述第二路由表项的地址前缀为第二地址前缀，所述第二地址前缀所属的网段为所述第一地址前缀所属的网段的子集，并且所述第二地址前缀中的掩码大于所述第一地址前缀中的掩码。
本实施例的网络设备1300具体包括：控制模块、通信接口(Communications Interface)1302、存储器(memory)1303和通信总线1304。控制模块包括处理器(processor)1301。
处理器1301，通信接口1302，存储器1303通过总线1304完成相互间的通信。
处理器1301，用于执行程序1305。
具体地，程序1305可以包括程序代码，所述程序代码包括计算机操作指令。
处理器1301可能是一个中央处理器CPU，或者是专用集成电路ASIC(Application Specific Integrated Circuit)，或者是被配置成实施本申请实施例的一个或多个集成电路。
存储器1303，用于存放程序1305。存储器1303可能包含高速RAM存储器，也可能 还包括非易失性存储器(non-volatile memory)，例如至少一个磁盘存储器。程序1305用于执行以下步骤：
获得路由抑制请求；
确定出所述第二路由表项；
设置所述第二路由表项的状态为非下发状态，所述非下发状态用于指示所述第二路由表项不用于下发到转发表中。
程序1305中各步骤的具体实现参见图2所示实施例中的相应步骤的实现方式，在此不赘述。
本实施例提供的网络设备1300的各功能单元，可以是基于图2所示的方法实施例和图10所示的装置实施例所具备的功能的具体实现，术语的定义和说明与图2所示的方法实施例和图10所示的装置实施例保持一致，此处不再赘述。
请参阅图14，本发明实施例提供了控制器的另一种装置实施例。
本实施例的控制器1400具体包括：处理器(processor)1401、通信接口(Communications Interface)1402、存储器(memory)1403和通信总线1404。
处理器1401，通信接口1402，存储器1403通过总线1404完成相互间的通信。
处理器1401，用于执行程序1405。
具体地，程序1405可以包括程序代码，所述程序代码包括计算机操作指令。
处理器1401可能是一个中央处理器CPU，或者是专用集成电路ASIC(Application Specific Integrated Circuit)，或者是被配置成实施本申请实施例的一个或多个集成电路。
存储器1403，用于存放程序1405。存储器1403可能包含高速RAM存储器，也可能还包括非易失性存储器(non-volatile memory)，例如至少一个磁盘存储器。程序1405用于执行以下步骤：
向网络设备的控制模块下发第一路由表项和第二路由表项，其中，所述第一路由表项的地址前缀为第一地址前缀，所述第二路由表项的地址前缀为第二地址前缀，所述第二地址前缀所属的网段为所述第一地址前缀所属的网段的子集，并且所述第二地址前缀中的掩码大于所述第一地址前缀中的掩码；
确定出所述第二路由表项；
向所述控制模块发送路由抑制请求，所述路由抑制请求用于指示所述控制模块设置所述第二路由表项的状态为非下发状态，所述非下发状态用于指示所述第二路由表项不用于下发到转发表中。
程序1405中各步骤的具体实现参见图7所示实施例中的相应步骤的实现方式，在此不赘述。
本实施例提供的网络设备1400的各功能单元，可以是基于图7所示的方法实施例和图11所示的装置实施例所具备的功能的具体实现，术语的定义和说明与图7所示的方法实施例和图11所示的装置实施例保持一致，此处不再赘述。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统，装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统，装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的 划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本发明各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本发明的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本发明各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，以上实施例仅用以说明本发明的技术方案，而非对其限制；尽管参照前述实施例对本发明进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本发明各实施例技术方案的精神和范围。

Claims (21)

  1. 一种路由控制方法，其特征在于，网络设备上具有第一路由表项和第二路由表项，所述第一路由表项的地址前缀为第一地址前缀，所述第二路由表项的地址前缀为第二地址前缀，所述第二地址前缀所属的网段为所述第一地址前缀所属的网段的子集，并且所述第二地址前缀中的掩码大于所述第一地址前缀中的掩码；所述方法包括：
    所述网络设备的控制模块获得路由抑制请求；
    所述控制模块确定出所述第二路由表项；
    所述控制模块设置所述第二路由表项的状态为非下发状态，所述非下发状态用于指示所述第二路由表项不用于下发到转发表中。
  2. 根据权利要求1所述的方法，其特征在于，所述控制模块设置所述第二路由表项的状态为非下发状态包括：
    所述控制模块设置所述第二路由表项为非活跃状态，或者设置所述第二路由表项为活跃状态中的仅保存状态。
  3. 根据权利要求1或2所述的方法，其特征在于，
    所述路由抑制请求为边界网关协议BGP流规则FlowSpec消息，所述BGP FlowSpec消息的网络层可达信息NLRI中携带地址匹配项，所述BGP FlowSpec消息的扩展团体属性中携带所述地址匹配项对应的抑制动作；所述地址匹配项为所述第一地址前缀或者所述第二地址前缀；
    所述控制模块设置所述第二路由表项的状态为非下发状态包括：
    所述控制模块基于所述抑制动作，设置所述第二路由表项的状态为非下发状态。
  4. 根据权利要求1或2所述的方法，其特征在于，所述路由抑制请求为配置命令，所述配置命令中携带地址匹配项和所述地址匹配项对应的抑制动作，所述地址匹配项为所述第一地址前缀或者所述第二地址前缀；
    所述控制模块设置所述第二路由表项的状态为非下发状态包括：
    所述控制模块基于所述抑制动作，设置所述第二路由表项的状态为非下发状态。
  5. 根据权利要求1或2所述的方法，其特征在于，所述控制模块设置所述第二路由表项的状态为非下发状态之前，所述方法还包括：
    所述控制模块确定出所述第一路由表项为活跃状态中的下发状态。
  6. 根据权利要求5所述的方法，其特征在于，所述控制模块设置所述第二路由表项的状态为非下发状态之后，所述方法还包括：
    所述控制模块将所述第一路由表项下发到转发表中。
  7. 一种路由控制方法，其特征在于，所述方法包括：
    控制器向网络设备的控制模块下发第一路由表项和第二路由表项，其中，所述第一路由表项的地址前缀为第一地址前缀，所述第二路由表项的地址前缀为第二地址前缀，所述第二地址前缀所属的网段为所述第一地址前缀所属的网段的子集，并且所述第二地址前缀中的掩码大于所述第一地址前缀中的掩码；
    控制器确定出所述第二路由表项；
    所述控制器向所述控制模块发送路由抑制请求，所述路由抑制请求用于指示所述控制模块设置所述第二路由表项的状态为非下发状态，所述非下发状态用于指示所述第二路由 表项不用于下发到转发表中。
  8. 根据权利要求7所述的方法，其特征在于，所述路由抑制请求用于指示所述控制模块设置所述第二路由表项为非活跃状态，或者设置所述第二路由表项为活跃状态中的仅保存状态。
  9. 根据权利要求7或8所述的方法，其特征在于，所述路由抑制请求为边界网关协议BGP流规则FlowSpec消息，所述BGP FlowSpec消息的网络层可达信息NLRI中携带地址匹配项，所述BGP FlowSpec消息的扩展团体属性中携带所述地址匹配项对应的抑制动作；所述抑制动作用于指示所述控制模块基于所述抑制动作，设置所述第二路由表项的状态为非下发状态；所述地址匹配项为所述第一地址前缀或者所述第二地址前缀。
  10. 根据权利要求7或8所述的方法，其特征在于，所述路由抑制请求为配置命令，所述配置命令中携带地址匹配项和所述地址匹配项对应的抑制动作；所述抑制动作用于指示所述控制模块基于所述抑制动作，设置所述第二路由表项的状态为非下发状态；所述地址匹配项为所述第一地址前缀或者所述第二地址前缀。
  11. 一种网络设备，其特征在于，所述网络设备上具有第一路由表项和第二路由表项，所述第一路由表项的地址前缀为第一地址前缀，所述第二路由表项的地址前缀为第二地址前缀，所述第二地址前缀所属的网段为所述第一地址前缀所属的网段的子集，并且所述第二地址前缀中的掩码大于所述第一地址前缀中的掩码；
    所述网络设备包括控制模块，所述控制模块包括获得单元、确定单元和设置单元；
    所述获得单元用于，获得路由抑制请求；
    所述确定单元用于，确定出所述第二路由表项；
    所述设置单元用于，设置所述第二路由表项的状态为非下发状态，所述非下发状态用于指示所述第二路由表项不用于下发到转发表中。
  12. 根据权利要求11所述的网络设备，其特征在于，所述设置单元具体用于，设置所述第二路由表项为非活跃状态，或者设置所述第二路由表项为活跃状态中的仅保存状态。
  13. 根据权利要求11或12所述的网络设备，其特征在于，所述路由抑制请求为边界网关协议BGP流规则FlowSpec消息，所述BGP FlowSpec消息的网络层可达信息NLRI中携带地址匹配项，所述BGP FlowSpec消息的扩展团体属性中携带所述地址匹配项对应的抑制动作；所述地址匹配项为所述第一地址前缀或者所述第二地址前缀；
    所述设置单元具体用于基于所述抑制动作，设置所述第二路由表项的状态为非下发状态。
  14. 根据权利要求11或12所述的网络设备，其特征在于，所述路由抑制请求为配置命令，所述配置命令中携带地址匹配项和所述地址匹配项对应的抑制动作，所述地址匹配项为所述第一地址前缀或者所述第二地址前缀；
    所述设置单元具体用于基于所述抑制动作，设置所述第二路由表项的状态为非下发状态。
  15. 根据权利要求11或12所述的网络设备，其特征在于，所述确定单元还用于，所述设置单元设置所述第二路由表项的状态为非下发状态之前，确定出所述第一路由表项为活跃状态中的下发状态。
  16. 根据权利要求15所述的网络设备，其特征在于，还包括下发单元，
    所述下发单元用于，所述设置单元设置所述第二路由表项的状态为非下发状态之后， 将所述第一路由表项下发到转发表中。
  17. 一种控制器，其特征在于，包括：下发单元、确定单元和发送单元；
    所述下发单元用于，向网络设备的控制模块下发第一路由表项和第二路由表项，其中，所述第一路由表项的地址前缀为第一地址前缀，所述第二路由表项的地址前缀为第二地址前缀，所述第二地址前缀所属的网段为所述第一地址前缀所属的网段的子集，并且所述第二地址前缀中的掩码大于所述第一地址前缀中的掩码；
    所述确定单元用于，确定出所述第二路由表项；
    所述发送单元用于，向所述控制模块发送路由抑制请求，所述路由抑制请求用于指示所述控制模块设置所述第二路由表项的状态为非下发状态，所述非下发状态用于指示所述第二路由表项不用于下发到转发表中。
  18. 根据权利要求17所述的控制器，其特征在于，所述路由抑制请求用于指示所述控制模块设置所述第二路由表项为非活跃状态，或者设置所述第二路由表项为活跃状态中的仅保存状态。
  19. 根据权利要求17或18所述的控制器，其特征在于，所述路由抑制请求为边界网关协议BGP流规则FlowSpec消息，所述BGP FlowSpec消息的网络层可达信息NLRI中携带地址匹配项，所述BGP FlowSpec消息的扩展团体属性中携带所述地址匹配项对应的抑制动作；所述抑制动作用于指示所述控制模块基于所述抑制动作，设置所述第二路由表项的状态为非下发状态；所述地址匹配项为所述第一地址前缀或者所述第二地址前缀。
  20. 根据权利要求17或18所述的控制器，其特征在于，所述路由抑制请求为配置命令，所述配置命令中携带地址匹配项和所述地址匹配项对应的抑制动作；所述抑制动作用于指示所述控制模块基于所述抑制动作，设置所述第二路由表项的状态为非下发状态；所述地址匹配项为所述第一地址前缀或者所述第二地址前缀。
  21. 一种网络系统，其特征在于，包括如权利要求11至16任一项所述的网络设备和如权利要求17至20任一项所述的控制器。
PCT/CN2017/076963 2016-03-31 2017-03-16 一种路由控制方法、网络设备及控制器 WO2017167028A1 (zh)

Priority Applications (5)

Application Number Priority Date Filing Date Title
EP22207364.5A EP4199463A1 (en) 2016-03-31 2017-03-16 Routing control method, network device, and controller
EP17773058.7A EP3429140B1 (en) 2016-03-31 2017-03-16 Routing control method, network device and controller
US16/147,179 US10700973B2 (en) 2016-03-31 2018-09-28 Routing control method, network device, and controller
US16/887,299 US11349759B2 (en) 2016-03-31 2020-05-29 Routing control method, network device, and controller
US17/746,199 US11997016B2 (en) 2016-03-31 2022-05-17 Routing control method, network device, and controller

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610204188.0 2016-03-31
CN201610204188.0A CN105721303B (zh) 2016-03-31 2016-03-31 一种路由控制方法、网络设备及控制器

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/147,179 Continuation US10700973B2 (en) 2016-03-31 2018-09-28 Routing control method, network device, and controller

Publications (1)

Publication Number Publication Date
WO2017167028A1 true WO2017167028A1 (zh) 2017-10-05

Family

ID=56159492

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/076963 WO2017167028A1 (zh) 2016-03-31 2017-03-16 一种路由控制方法、网络设备及控制器

Country Status (4)

Country Link
US (3) US10700973B2 (zh)
EP (2) EP3429140B1 (zh)
CN (1) CN105721303B (zh)
WO (1) WO2017167028A1 (zh)

Families Citing this family (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105721303B (zh) 2016-03-31 2018-05-18 华为技术有限公司 一种路由控制方法、网络设备及控制器
CN107147581B (zh) * 2017-06-26 2020-09-08 杭州迪普科技股份有限公司 路由表项的维护方法和装置
CN108259324B (zh) * 2017-10-30 2019-09-17 新华三技术有限公司 一种路由管理方法和装置
CN108924049B (zh) * 2018-06-27 2020-12-25 新华三技术有限公司合肥分公司 流规格路由调度方法及装置
CN110661711B (zh) * 2018-06-29 2021-01-29 华为技术有限公司 生成标签转发表的方法、报文发送方法、装置及设备
CN111147371B (zh) * 2018-11-02 2022-03-11 华为技术有限公司 处理路由事件记录表项的方法、网络设备和控制设备
US12095660B2 (en) * 2020-02-13 2024-09-17 Futurewei Technologies, Inc. Method for multi-segment flow specifications
CN111865804B (zh) * 2020-06-15 2022-03-11 烽火通信科技股份有限公司 一种通过硬件发包机制提升路由下发效率的方法及系统
US11621910B1 (en) * 2020-06-23 2023-04-04 Juniper Networks, Inc. Concurrent routing for network devices
CN112118186B (zh) * 2020-08-28 2022-11-01 深圳市风云实业有限公司 一种交换芯片路由表项存储方法、转发方法及配置方法

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2002061625A2 (en) * 2001-01-30 2002-08-08 Nokia Intelligent Edge Routers Inc. Method and apparatus for routing table management
CN1402488A (zh) * 2002-10-14 2003-03-12 北京港湾网络有限公司 一种路由表压缩方法
CN1949746A (zh) * 2006-10-31 2007-04-18 成都迈普产业集团有限公司 路由表查找方法
WO2011021145A1 (en) * 2009-08-20 2011-02-24 Telefonaktiebolaget L M Ericsson (Publ) Link state identifier collision handling
CN105721303A (zh) * 2016-03-31 2016-06-29 华为技术有限公司 一种路由控制方法、网络设备及控制器

Family Cites Families (20)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8074256B2 (en) * 2000-01-07 2011-12-06 Mcafee, Inc. Pdstudio design system and method
US20040006640A1 (en) * 2002-07-03 2004-01-08 Inderieden Daniel W. Notification to routing protocols of changes to routing information base
US7746865B2 (en) * 2004-12-07 2010-06-29 Intel Corporation Maskable content addressable memory
US7602796B2 (en) * 2005-03-04 2009-10-13 Cisco Technology, Inc. Method and apparatus for border gateway protocol route management and routing policy modeling
US7630392B2 (en) * 2005-05-31 2009-12-08 Cisco Technology, Inc. Multi-homing using controlled route leakage at a backup service provider
US7639688B2 (en) * 2005-07-18 2009-12-29 Cisco Technology, Inc. Automatic protection of an SP infrastructure against exterior traffic
JP4995125B2 (ja) * 2008-03-12 2012-08-08 株式会社アイピーティ 固定長データの検索方法
US8391303B2 (en) * 2009-04-16 2013-03-05 Futurewei Technologies, Inc. Border gateway protocol (BGP) grouped route withdrawals
CN104079478B (zh) * 2013-03-25 2017-06-16 新华三技术有限公司 报文转发方法和装置
US9525638B2 (en) * 2013-10-15 2016-12-20 Internap Corporation Routing system for internet traffic
US9825857B2 (en) * 2013-11-05 2017-11-21 Cisco Technology, Inc. Method for increasing Layer-3 longest prefix match scale
JP5967173B2 (ja) * 2014-01-31 2016-08-10 株式会社バッファロー ネットワーク中継装置、ネットワーク中継装置が有するパケット中継処理部の動作モードを設定する方法、およびコンピュータープログラム
JP6241319B2 (ja) * 2014-02-28 2017-12-06 富士通株式会社 情報処理装置、通信経路決定プログラム及び通信経路決定方法
US9912577B2 (en) * 2014-04-17 2018-03-06 Cisco Technology, Inc. Segment routing—egress peer engineering (SP-EPE)
US9882964B2 (en) * 2014-08-08 2018-01-30 Cisco Technology, Inc. Explicit strategy feedback in name-based forwarding
US20160182300A1 (en) * 2014-12-17 2016-06-23 Cisco Technology, Inc., A Corporation Of California Selective Configuring of Throttling Engines for Flows of Packet Traffic
US10805110B2 (en) * 2015-03-27 2020-10-13 Akamai Technologies, Inc. Traffic delivery using anycast and end user-based mapping in an overlay network
US9942140B2 (en) * 2015-10-08 2018-04-10 Arista Networks, Inc. Dynamic forward information base prefix optimization
US20170155587A1 (en) * 2015-11-30 2017-06-01 Netflix, Inc Forwarding table compression
US10193804B2 (en) * 2016-06-15 2019-01-29 Huawei Technologies Co., Ltd. Method of forwarding data packets, method of creating merged FIB key entry and method of creating a search key

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2002061625A2 (en) * 2001-01-30 2002-08-08 Nokia Intelligent Edge Routers Inc. Method and apparatus for routing table management
CN1402488A (zh) * 2002-10-14 2003-03-12 北京港湾网络有限公司 一种路由表压缩方法
CN1949746A (zh) * 2006-10-31 2007-04-18 成都迈普产业集团有限公司 路由表查找方法
WO2011021145A1 (en) * 2009-08-20 2011-02-24 Telefonaktiebolaget L M Ericsson (Publ) Link state identifier collision handling
CN105721303A (zh) * 2016-03-31 2016-06-29 华为技术有限公司 一种路由控制方法、网络设备及控制器

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3429140A4 *

Also Published As

Publication number Publication date
EP3429140A4 (en) 2019-02-20
US20230111267A1 (en) 2023-04-13
US20190036822A1 (en) 2019-01-31
EP4199463A1 (en) 2023-06-21
EP3429140A1 (en) 2019-01-16
EP3429140B1 (en) 2022-12-07
CN105721303B (zh) 2018-05-18
US20200366605A1 (en) 2020-11-19
US11997016B2 (en) 2024-05-28
US10700973B2 (en) 2020-06-30
CN105721303A (zh) 2016-06-29
US11349759B2 (en) 2022-05-31

Similar Documents

Publication Publication Date Title
WO2017167028A1 (zh) 一种路由控制方法、网络设备及控制器
US12047286B2 (en) Route advertisement by managed gateways
US10116559B2 (en) Operations, administration and management (OAM) in overlay data center environments
US8953441B2 (en) Re-routing network traffic after link failure
US9596159B2 (en) Finding latency through a physical network in a virtualized network
US10237179B2 (en) Systems and methods of inter data center out-bound traffic management
EP2645646B1 (en) Reduced traffic loss for border gateway protocol sessions in multi-homed network connections
CN106134137B (zh) 受管理网关的路由通告
CN113261240A (zh) 使用可编程客户机进行多租户隔离
US20150263899A1 (en) Managed gateways peering with external router to attract ingress packets
US20130332602A1 (en) Physical path determination for virtual network packet flows
US10924385B2 (en) Weighted multipath routing configuration in software-defined network (SDN) environments
US9860170B2 (en) Method, device, and system for packet routing in a network
US20180131619A1 (en) Load Balancing Method and Related Apparatus
US10608869B2 (en) Handling control-plane connectivity loss in virtualized computing environments
CN117857414A (zh) 一种路由控制方法、设备及计算设备集群

Legal Events

Date Code Title Description
NENP Non-entry into the national phase

Ref country code: DE

WWE Wipo information: entry into national phase

Ref document number: 2017773058

Country of ref document: EP

ENP Entry into the national phase

Ref document number: 2017773058

Country of ref document: EP

Effective date: 20181011

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17773058

Country of ref document: EP

Kind code of ref document: A1