WO2017181637A1

WO2017181637A1 - Openflow protocol-based sdn l2vpn implementation method and system

Info

Publication number: WO2017181637A1
Application number: PCT/CN2016/102798
Authority: WO
Inventors: 杜伟涛
Original assignee: 烽火通信科技股份有限公司
Priority date: 2016-04-19
Filing date: 2016-10-21
Publication date: 2017-10-26
Also published as: MY198118A; SG11201804250YA; CN105915428A; CN105915428B

Abstract

Disclosed in the present invention are an OpenFlow protocol-based SDN L2VPN implementation method and system, related to the SDN field. The method comprises the following steps: an SDN L2VPN UNI-->NNI service model implemented with one flow table level and three levels of nested group tables: a first level flow table identifying a user data message; when a user data stream match field matches a corresponding flow entry, executing the corresponding apply action of the first level flow table; if there is no pseudowire protection in a first level group table, executing pseudowire tag encapsulation according to a bucket action in the group table; if there is no pseudowire protection in a second group table, executing LSP tag encapsulation and LSP 1:1 processing according to a bucket action in the group table; a third level group table executing egress port lookup. The present invention helps operators in an SDN network architecture to rapidly activate group customer dedicated line service, making network activation no longer dependent on a network administrator.

Description

Method and system for implementing SDN network L2VPN based on OPEN_FLOW protocol

Technical field

The present invention relates to the field of SDN networks, and in particular, to a method and system for implementing an SDN network L2VPN based on the OPEN_FLOW protocol.

Background technique

With the rapid development of mobile devices, virtual servers, cloud services, etc., the drawbacks of traditional network architectures become more and more prominent, and traditional networks are increasingly unable to adapt to today's network needs. For example, most traditional networks are hierarchical and based on the static architecture of the client server model. This static architecture is not well adapted to the current state of dynamic computing and storage of enterprise data. With the rapid growth of cloud services, enterprises are increasingly hoping to quickly access public networks and share other IT (Information Technology/Internet Technology) resources on demand. Traditional networks are difficult to deploy due to complex protocols. Engineers often take days to months to complete a network setup and commissioning, which is used by users. This greatly limits the development of the enterprise.

In addition, the extension of the traditional network is also a very complicated task. When a device needs to join an existing network, the network engineer may need to configure the entire network device, SDN (Software Defined Network) network. The emergence of these will fundamentally solve some network problems such as the above.

With the rapid development of SDN network technology, it is foreseeable that more and more SDN networks will be deployed in the future. Under the SDN network architecture, the specific implementation of the VPWS (Virtual Pseudo Wire Service) in the forwarding layer becomes Technical problems to be solved in the field.

Summary of the invention

The purpose of the present invention is to overcome the deficiencies of the above background art, and to provide an implementation method and system for an SDN network L2VPN based on the OPEN_FLOW protocol, which provides great help for an operator to quickly open a customer dedicated line service under the SDN network architecture, and the network is no longer dependent. In the network management, the service provider can quickly open the collection service through the android-based APP software provided by the equipment manufacturer.

The invention provides an implementation method of an SDN network L2VPN based on the OPEN_FLOW protocol, comprising the following steps:

A. Software-defined network SDN Layer 2 Virtual Private Network VPN User Network Interface UNI---> Network-Network Interface The NNI service model is implemented by a primary flow table and a three-level nested group table:

The first level flow table is used to identify the user data packet; when the matching field of the user data stream has a corresponding flow entry matching, the corresponding application action of the first level flow table is executed; Level nested group table for processing;

In the first-level group table, whether there is pseudo-line protection according to the group table type, if there is no pseudo-line protection, the pseudo-line label is encapsulated according to the bucket action in the group table, and the data stream enters after processing. The second level group table is processed;

In the second-level group table, whether there is a pseudo-line pseudo-line protection according to the group table type, if there is no pseudo-line protection, the label switching path LSP label is encapsulated according to the bucket action in the group table. After processing LSP1:1, the data stream enters the third-level group table for processing after processing;

In the third level group table, perform an export lookup;

B. The NNI---> UNI service model of the SDN Layer 2 VPN is implemented by a three-level flow table and a first-level group table:

The first level flow table is used to identify the packets on the network side, and the data flow on the network side has corresponding The flow entry is matched, and the corresponding application action of the first-level flow table is executed, and the data flow is transferred to the second-level flow table;

The second-level flow table is used to match the LSP label on the network side, and the egress action in the action action pops up the LSP label on the network side, and then the data flow is switched to the third-level flow table.

The third-level flow table is used to process the inner layer pseudo-line label. When there is a corresponding flow item matching the inner layer pseudo-line label, the application action of the third-level flow table is executed, when all the third-level flow tables are After the application action is executed, the data flow will be transferred to the group table, and the group table determines the export of the data packet.

Based on the above technical solution, the first level flow table is a three-state content address memory table.

On the basis of the foregoing technical solution, the matching domain of the first-level flow table is a receiving port + Vlan + Ethernet type, and is used for performing shunt processing on different user data.

On the basis of the foregoing technical solution, in step A, after the egress lookup is performed in the third-level group table, if there is a link aggregation protection related configuration, the process proceeds to the link aggregation process.

On the basis of the foregoing technical solution, in the step B, the group table has a related process of the user label. If the user label does not need to be processed, the user message is directly sent from a specified physical port.

The invention also provides an SDN network L2VPN implementation system based on the OPEN_FLOW protocol, which comprises a software defined network SDN layer 2 virtual private network VPN user network interface UNI---> network-network interface NNI service model and SDN Layer 2 VPN NNI--->UNI business model,

The UNI--->NNI service model of the SDN Layer 2 VPN is implemented by a primary flow table and a three-level nested group table:

The first level flow table is used to identify user data packets; when the user data stream matches If the corresponding flow entry is matched, the corresponding application action of the first-level flow table is executed; the subsequent service is transferred to the three-level nested group table for processing;

In the third level group table, perform an export lookup;

The NNI---> UNI service model of the SDN Layer 2 VPN is implemented by a three-level flow table and a first-level group table:

The first-level flow table is used to identify the packet on the network side. When the data flow on the network side has a corresponding flow entry, the corresponding application action of the first-level flow table is executed, and the data flow is switched to the second-level flow table. ;

On the basis of the foregoing technical solutions, in the implementation process of the UNI->-NNI service model of the SDN Layer 2 VPN, after the egress lookup in the third-level group table, if there is link aggregation protection related If it is configured, it will go to the process of link aggregation processing.

On the basis of the foregoing technical solution, in the implementation process of the NNI->-UNI service model of the SDN Layer 2 VPN, the group table has related processing of user tags, and if the user tags do not need to be processed, the user reports The text is sent directly from a specified physical port.

The advantages of the present invention over the prior art are as follows:

(1) The present invention greatly assists the operator to quickly open the customer dedicated line service under the SDN network architecture. The network opening is no longer dependent on the network management, and the service provider can quickly open the customer service through the android system-based APP software provided by the equipment manufacturer.

(2) Based on the standard open flow protocol, the service provider can completely ignore the difference between the underlying devices and configure the service in the cloud.

(3) Dynamic adjustment of hardware resources according to network conditions.

DRAWINGS

1 is a flow chart of data processing of an L2VPN UNI--->NNI in an embodiment of the present invention.

2 is a flow chart of data processing of an L2VPN NNI---> UNI in the embodiment of the present invention.

detailed description

The present invention will be further described in detail below with reference to the drawings and specific embodiments.

The invention is based on Marvell's programmable NP (Network Processor) chip to realize virtual private line service, and the forwarding flow table design fully complies with the relevant provisions in the ONF OPEN FLOW protocol 1.4.0.

A brief description of the flow table of the Layer 2 VPN (Virtual Private Network) service implementation is as follows:

Ing_Port_Tbl: Inbound port table, this entry is based on Np (Network Processor, Network processor) physical port, each Np physical port has an inbound port table;

My_Mac_Tbl: port Mac table, this table is used to check the packet Mac address;

Table0_Tbl: The first-level flow table, which is used to distinguish data packets of different users. The match_field (matching field) of the flow table is the receiving port + Vlan + Ethernet type.

Table1_Tbl: a second-level flow table, which is used to match a label of a network-side LSP (Label Switched Path), and a match_field is an LSP label.

Table 2_Tbl: a third-level flow table, which is used to match PW (Pseudo Wire) tags, and match_field is a PW tag;

Group0_Bucket1_Tbl: The Bucket1 table of the first-level group is used to encapsulate the PW label for PW1:1 protection.

Group0_Bucket2_Tbl: The Bucket2 table of the first-level group is mainly used to encapsulate the standby PW label when PW1:1 protection is applied.

Group1_Bucket1_Tbl: The Bucket1 table of the second-level group is mainly used to encapsulate the primary LSP label and the Ethernet VLAN (Virtual Local Area Network, DMAC (Destination media access control)).

Group1_Bucket2_Tbl: The bucket1 table of the second-level group is mainly used to encapsulate the LSP label, Ethernet VLan, and Dmac when LSP1:1 protection is applied.

Group2_Bucket1_Tbl: The third-level Group table is mainly used to encapsulate the data packet Smac (Source media access control).

The SDN Layer 2 VPN service is composed of the UNI (User Network Interface)--->NNI (Network Network Interface) direction and the NNI--->UNI direction. The following two directions are used. The processing is explained separately.

The embodiment of the invention provides an SDN network L2VPN implementation system based on the OPEN_FLOW protocol, which includes an SDN Layer 2 VPN UNI--->NNI service model and an SDN Layer 2 VPN NNI---> UNI service model.

The embodiment of the invention further provides an implementation method of an SDN network L2VPN based on the OPEN_FLOW protocol, comprising the following steps:

A. Referring to Figure 1, the SDN Layer 2 VPN UNI--->NNI service model is implemented by a primary flow table and a three-level nested Group table:

The first level flow table table0 is a TCAM (Ternary Content Addressable Memory) table, which is used to identify user data packets. Since the TCAM table is tri-state, the match_field can be a port. Any combination with the user Vlan, this matching method greatly facilitates the shunting of different user data. When the match field of the user data stream has a corresponding flow entry matching, the corresponding Apply action of table0 will be executed. According to our flow table design, the subsequent business will be transferred to the three-level nested Group table for processing.

In the first-level group table, the PW label is encapsulated according to the group type (group type). If there is no PW protection, the PW label is encapsulated according to the bucket action in the group table. After processing, the data stream will enter the second level group for processing.

In the second-level group table, whether there is a pseudo-line pseudo-line protection according to the group table type, if there is no pseudo-line protection, the label switching path LSP label is encapsulated according to the bucket action in the group table. After the LSP1:1 is processed, the data stream enters the third-level group table for processing. The processing of the second-level group table is similar to that of the first-level group table. The only difference is that the LSP label is encapsulated, and the processing of LSP 1:1 is also performed in the second-level flow table.

The third-level group is used for the egress lookup. In the third-level group table, the egress lookup is performed. If there is a configuration related to the link aggregation protection (Lag), the process of the Lag process is transferred to the L2VPN. Layer 2 Virtual Private Network, the second layer of virtual private network) UNI to NNI basic processing flow is over.

B. As shown in Figure 2, the SDN Layer 2 VPN NNI---> UNI service model is implemented by a three-level flow table and a first-level group table:

The first level flow table table0 is a TCAM table, which is used to identify the packets on the network side. When the data flow on the network side has a corresponding flow entry, the corresponding Apply action of the table0 is executed, and the data flow is performed. Turn to the second stage flow table table1;

The second-level flow table table1 is used to match the network-side LSP label. Because it is a Layer 2 VPN service, the pop-up action in the application action (Ipop, Ipop: Internal popup of the Apply Action) pops up the LSP label on the network side. Then the data stream is transferred to the third-level flow table table2;

The third-level flow table table2 is used to process the inner PW tag. When there is a corresponding flow entry matching the tag, the Apply action of the third-level flow table table2 is executed, when all the third-level flow tables are applied. After the Action is executed, the data flow will be transferred to the Group table. The group table determines the export of the data packet. In the group table, there is a related processing of the Ctag (Customer Tag). If the user tag (tag) does not need to be processed, the user packet is directly sent from a specified physical port.

A person skilled in the art can make various modifications and variations to the embodiments of the present invention, and such modifications and variations are within the scope of the present invention. .

The contents not described in detail in the specification are prior art known to those skilled in the art.

Claims

An implementation method of SDN network L2VPN based on OPEN_FLOW protocol, characterized in that it comprises the following steps:

A. Software-defined network SDN Layer 2 Virtual Private Network VPN User Network Interface UNI---> Network-Network Interface The NNI service model is implemented by a primary flow table and a three-level nested group table:

The first level flow table is used to identify the user data packet; when the matching field of the user data stream has a corresponding flow entry matching, the corresponding application action of the first level flow table is executed; Level nested group table for processing;

In the first-level group table, whether there is pseudo-line protection according to the group table type, if there is no pseudo-line protection, the pseudo-line label is encapsulated according to the bucket action in the group table, and the data stream enters after processing. The second level group table is processed;

In the second-level group table, whether there is a pseudo-line pseudo-line protection according to the group table type, if there is no pseudo-line protection, the label switching path LSP label is encapsulated according to the bucket action in the group table. After processing LSP1:1, the data stream enters the third-level group table for processing after processing;

In the third level group table, perform an export lookup;

B. The NNI---> UNI service model of the SDN Layer 2 VPN is implemented by a three-level flow table and a first-level group table:

The first-level flow table is used to identify the packet on the network side. When the data flow on the network side has a corresponding flow entry, the corresponding application action of the first-level flow table is executed, and the data flow is switched to the second-level flow table. ;

The second-level flow table is used to match the LSP label on the network side, and the egress action in the action action pops up the LSP label on the network side, and then the data flow is switched to the third-level flow table.

The third-level flow table is used to process the inner layer pseudo-line label when there is a corresponding stream entry and inner layer. When the pseudo-line labels match, the application action of the third-level flow table is executed. When all the application actions of the third-level flow table are performed, the data flow turns to the group table, and the group table determines the export of the data packet. .
The SDN network L2VPN implementation method based on the OPEN_FLOW protocol according to claim 1, wherein the first level flow table is a three-state content address memory table.
The method for implementing an SDN network L2VPN based on the OPEN_FLOW protocol according to claim 1, wherein the matching domain of the first-level flow table is a receiving port + Vlan + Ethernet type, and is used for performing shunt processing on different user data.
The method for implementing an SDN network L2VPN based on the OPEN_FLOW protocol according to claim 1, wherein in step A, after the egress lookup in the third-level group table, if there is a link aggregation protection related configuration, Transfer to the process of link aggregation processing.
The method for implementing an SDN network L2VPN based on the OPEN_FLOW protocol according to claim 1, wherein in the step B, the group table has a related process of user tags, and if the user tag does not need to be processed, the user message directly A specified physical port is sent.
An SDN network L2VPN implementation system based on OPEN_FLOW protocol, characterized in that: the system comprises a software defined network SDN layer 2 virtual private network VPN user network interface UNI---> network-network interface NNI service model and SDN Layer 2 VPN NNI--->UNI business model,

The UNI--->NNI service model of the SDN Layer 2 VPN is implemented by a primary flow table and a three-level nested group table:

The first level flow table is used to identify the user data packet; when the matching field of the user data stream has a corresponding flow entry matching, the corresponding application action of the first level flow table is executed; The subsequent business turns to the three-level nested group table for processing;

In the first-level group table, whether there is pseudo-line protection according to the group table type, if there is no pseudo-line protection, the pseudo-line label is encapsulated according to the bucket action in the group table, and the data stream enters after processing. The second level group table is processed;

In the second-level group table, whether there is a pseudo-line pseudo-line protection according to the group table type, if there is no pseudo-line protection, the label switching path LSP label is encapsulated according to the bucket action in the group table. After processing LSP1:1, the data stream enters the third-level group table for processing after processing;

In the third level group table, perform an export lookup;

The NNI---> UNI service model of the SDN Layer 2 VPN is implemented by a three-level flow table and a first-level group table:

The first-level flow table is used to identify the packet on the network side. When the data flow on the network side has a corresponding flow entry, the corresponding application action of the first-level flow table is executed, and the data flow is switched to the second-level flow table. ;

The second-level flow table is used to match the LSP label on the network side, and the egress action in the action action pops up the LSP label on the network side, and then the data flow is switched to the third-level flow table.

The third-level flow table is used to process the inner layer pseudo-line label. When there is a corresponding flow item matching the inner layer pseudo-line label, the application action of the third-level flow table is executed, when all the third-level flow tables are After the application action is executed, the data flow will be transferred to the group table, and the group table determines the export of the data packet.
The SDN network L2VPN implementation system based on the OPEN_FLOW protocol according to claim 6, wherein the first level flow table is a three-state content address memory table.
The SDN network L2VPN implementation system based on the OPEN_FLOW protocol according to claim 6, wherein the matching domain of the first-level flow table is a receiving end Port + Vlan + Ethernet type, used to offload different user data.
The SDN network L2VPN implementation system based on the OPEN_FLOW protocol according to claim 6, wherein: in the implementation process of the UNI->-NNI service model of the SDN Layer 2 VPN, in the third-level group table, After the egress lookup, if there is a link aggregation protection related configuration, the process proceeds to the link aggregation process.
The SDN network L2VPN implementation system based on the OPEN_FLOW protocol according to claim 6, wherein in the implementation of the NNI---> UNI service model of the SDN Layer 2 VPN, the group table has a user label. Related processing, if the user tag does not need to be processed, the user message is sent directly from a specified physical port.