WO2017186181A1 - 网络访问控制 - Google Patents

网络访问控制 Download PDF

Info

Publication number
WO2017186181A1
WO2017186181A1 PCT/CN2017/082690 CN2017082690W WO2017186181A1 WO 2017186181 A1 WO2017186181 A1 WO 2017186181A1 CN 2017082690 W CN2017082690 W CN 2017082690W WO 2017186181 A1 WO2017186181 A1 WO 2017186181A1
Authority
WO
WIPO (PCT)
Prior art keywords
address
user
network segment
packet
destination
Prior art date
Application number
PCT/CN2017/082690
Other languages
English (en)
French (fr)
Inventor
宋玉兵
杨小朋
Original Assignee
新华三技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 新华三技术有限公司 filed Critical 新华三技术有限公司
Priority to EP17788833.6A priority Critical patent/EP3451612B1/en
Priority to JP2018556323A priority patent/JP6648308B2/ja
Priority to US16/097,154 priority patent/US11025631B2/en
Publication of WO2017186181A1 publication Critical patent/WO2017186181A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/101—Access control lists [ACL]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4633—Interconnection of networks using encapsulation techniques, e.g. tunneling
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4641—Virtual LANs, VLANs, e.g. virtual private networks [VPN]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/66—Arrangements for connecting between networks having differing types of switching systems, e.g. gateways
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/09—Mapping addresses
    • H04L61/10—Mapping addresses of different types
    • H04L61/103—Mapping addresses of different types across network layers, e.g. resolution of network layer into physical layer addresses or address resolution protocol [ARP]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0236—Filtering by address, protocol, port number or service, e.g. IP-address or URL
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0272—Virtual private networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00—Traffic control in data switching networks
    • H04L47/10—Flow control; Congestion control
    • H04L47/24—Traffic characterised by specific attributes, e.g. priority or QoS

Definitions

  • users are usually classified, and all users can be divided into multiple user groups. Users in the same user group can have the same network access rights, and users in different user groups can have different network access rights.
  • a VLAN Virtual Local Area Network
  • An ACL Access Control List
  • Different ACL rules are used to limit the network access rights of different VLANs.
  • FIG. 1 is a schematic diagram of a network architecture of an enterprise network shown by an exemplary example of the present disclosure.
  • FIG. 2 is a flowchart of processing of an ARP request message by an aggregation switch according to an exemplary example of the present disclosure.
  • FIG. 3 is a flowchart of a process in which an aggregation switch performs network access control on a user message according to an exemplary example of the present disclosure.
  • FIG. 4 is a schematic diagram of a hardware architecture of a network access control apparatus according to an exemplary example of the present disclosure.
  • FIG. 5 is a schematic structural diagram of a network access control apparatus according to an exemplary example of the present disclosure.
  • FIG. 6 is another schematic structural diagram of a network access control apparatus according to an exemplary example of the present disclosure.
  • FIG. 7 is still another schematic structural diagram of a network access control apparatus according to an exemplary example of the present disclosure.
  • the following examples of the present disclosure propose a network access control method, and an apparatus to which the method can be applied.
  • an enterprise network can include the following types of devices: an access switch, an aggregation switch, and a core switch.
  • the core switch can be connected to an aggregation switch, an aggregation switch can be connected to an access switch, and an access switch. It can be used for user access access, and overlay (overlap virtualization) technology can be applied on the aggregation switch and core switch.
  • the enterprise network may include a headquarters network and a branch network.
  • the headquarters network includes access switches 101a to 101e, aggregation switches 102a to 102c, and core switches 103a and 103b.
  • the branch network includes access switches 201a to 201e, aggregation switches 202a to 202c, and core switches 203a to 203b.
  • the overlay technology may be applied to the aggregation switch and the core switch.
  • the aggregation switch and the core switch may belong to the same subnet or belong to different subnetworks.
  • an access switch refers only to a network device having an information exchange function, and may be an Ethernet switch, a radio access controller (AC), or the like.
  • the corporate network provides access to the data center.
  • the data center can include data center servers 104a through 104c and data center switch 105a.
  • the overlay technology refers to superimposing a virtual network on an existing physical network.
  • the virtual network is generally a virtual Layer 2 network, which can bring about many advantages such as configuration simplification and user migration.
  • Typical overlay technologies include VXLAN (Virtual eXtensible LAN), NVGRE (Network Virtual Generic Routing Encapsulation), and STT (Stateless Transfer Tunnel).
  • the entire network can be constructed into a virtual Layer 2 network.
  • the virtual Layer 2 network can cover not only the enterprise network including the headquarters network and the branch network, but also the WAN (Wide Area).
  • Network wide area network, can interconnect the headquarters network and branch network across the WAN to form an end-to-end large Layer 2 network.
  • VXLAN technology Take VXLAN technology as an example.
  • the enterprise network shown in Figure 1 between aggregation switches in the same subnet, between aggregation switches in different subnetworks, between aggregation switches and core switches in the same subnet.
  • a VXLAN tunnel can be established between the aggregation switch and the core switch in different subnetworks.
  • the EVPN Ethernet VPN, Ethernet Virtual Private Network
  • MAC Media Access Control
  • the network access control method of the example of the present disclosure may include the following:
  • the software defined network (SDN) controller can receive and save configuration information, where the configuration information includes: user group information, resource group information, and various access control policies.
  • the above configuration information can be configured on the SDN controller through static configuration.
  • the user group information can be as shown in Table 1, and the resource group information can be as shown in Table 2:
  • the user group information may include: a user group identifier and its corresponding VLAN (virtual local area network) identifier, a VXLAN identifier, and a network segment. It can be seen that one user group can correspond to one VLAN, one VXLAN, and one network. segment.
  • VLAN virtual local area network
  • all users can be grouped according to the user identity. Obviously, the grouping may be performed according to the age of the user, the area to which the user belongs, and the like, which is not limited by the examples in the disclosure. Users in the same user group can have the same network access rights, and users in different user groups can have different network access rights.
  • the resource group information may include: a resource group identifier and an IP (Internet Protocol) address of the data center server included in the resource group.
  • the resource group identifier may correspond to an IP address of at least one data center server.
  • the IP addresses may be all IP addresses in one network segment. For example, suppose there are three servers a, b, and c in the data center, resource group 1 may include server a, and resource group 2 may include servers b and c, wherein the IP addresses of servers b and c belong to the same network segment.
  • various access control policies may include: access control policies within the same user group, and/or access control policies between different user groups, and/or user group access control policies for resource groups.
  • the deny if in the corresponding If the deny is marked in the position of the nth column of the m row, it means that the user group corresponding to the mth row is prohibited from accessing each other with the users in the user group corresponding to the nth column, or is used to indicate that the user corresponding to the mth row is prohibited.
  • the group accesses the data center server in the resource group corresponding to the nth column.
  • deny is marked in the position corresponding to the fourth row and the second column, and is used to indicate that the users in the user group 1 and the user group 3 are prohibited from accessing each other; corresponding to the position in the third row and the third column.
  • the deny is marked to indicate that the users in the user group 2 are prohibited from accessing each other; the deny is marked in the position corresponding to the second row and the sixth column, and is used to prohibit the user in the user group 1 from accessing the data in the resource group 2.
  • the central server as shown in Table 2, prohibits access to the data center server whose IP address belongs to the network segment 10.200.0.0/24.
  • the SDN controller can send user group information, resource group information, and corresponding content in various access control policies to various devices in the network, such as an access switch, an aggregation switch, a core switch, and a DHCP (Dynamic Host Configuration Protocol, Dynamic Host Configuration Protocol) servers, etc., so that these devices can be configured accordingly.
  • the configuration process can be as follows:
  • the SDN controller can send the identifiers of the VLANs corresponding to all user groups to all access switches. After the access switch receives the ID of the VLAN, you can configure the VLAN on the local device to configure the uplink port connected to the aggregation switch on the device to allow packets from the VLAN to be sent. The port sends a packet encapsulated with the identifier of the VLAN.
  • the SDN controller can send the identifier of the VLAN corresponding to the user group to all the aggregation switches.
  • each aggregation switch configures the VLAN on the local device, and configures the downlink port connected to the access switch on the device to allow receiving packets from the VLAN. Therefore, the aggregation switch can receive the downlink port.
  • the packet with the identifier of the VLAN is received.
  • the VXLAN corresponding to all user groups can be configured on the aggregation switch to establish the mapping between the VLAN, the VXLAN, and the network segment.
  • the IP address of the Vxlan gateway can be configured on the aggregation switch. And MAC address.
  • the VXLAN virtual interface corresponding to the VXLAN can be configured as the gateway of the corresponding network segment. Therefore, each network segment has a gateway configured for all network segments. In this way, no matter where the user moves, the access switch is connected to the aggregation switch, and the aggregation switch is configured with the gateway of the network segment to which the user corresponding IP address belongs.
  • the SDN controller can send the identity of the VXLAN corresponding to all user groups to all core switches. After each core switch receives the VXLAN identity, the VXLAN and its Layer 3 gateway address can be configured on the device. In addition, the core switch can also be configured with a routing protocol to connect to external devices such as data center switches.
  • the SDN controller can also send various access control policies as shown in Table 3 to all aggregation switches. Every sink After the switch receives the content, you can configure the corresponding ACL rule on the device.
  • the ACL rule includes: a first network segment and a second network segment, where the first network segment and the second network segment correspond to the same user group, or correspond to different user groups, or the first network segment corresponds to The user group and the second network segment correspond to resource groups.
  • the ACL rule can be used to prevent users in the same user group from accessing each other.
  • the ACL rule can be used to prevent users in different user groups from accessing each other.
  • the ACL rule can be used to prohibit user access in the user group.
  • the data center server in the resource group is not limited to the resource group.
  • the ACL rules configured according to the access control policy shown in Table 3 are as follows:
  • ACL1 deny source 10.10.1.1/24 destination 10.200.0.0/24
  • ACL2 deny source 10.20.1.1/24 destination 10.20.1.1/24
  • ACL3 deny source 10.20.1.1/24 destination 10.30.1.1/24
  • ACL4 deny source 10.30.1.1/24 destination 10.20.1.1/24
  • ACL5 deny source 10.30.1.1/24 destination 10.10.1.1/24
  • ACL6 deny source 10.10.1.1/24 destination 10.30.1.1/24
  • ACL7 deny source 10.30.1.1/24 destination 10.100.0.0/24
  • ACL1 can be used to prohibit users in user group 1 from accessing data center servers in resource group 2;
  • ACL2 can be used to prevent users in user group 2 from accessing each other;
  • ACL3 and ACL4 can be used to prohibit user group 2 and user group 3 Users in the user group can access each other;
  • ACL5 and ACL6 can be used to prevent users in user group 1 and user group 3 from accessing each other;
  • ACL7 can be used to prohibit users in user group 3 from accessing data center servers in resource group 1.
  • the SDN controller can configure the correspondence between the user group and the VLAN.
  • the authentication server may also be configured with a correspondence between the user and the user group, so that the correspondence between the user, the user group, and the VLAN may be stored on the authentication server.
  • the SDN controller can send all the network segments to the DHCP server and configure the mapping between the vlan and the address pool. You can save the IP address of each network segment to an address pool to establish the mapping between VLANs and address pools.
  • the user can perform access authentication and access the network after the authentication is passed.
  • the authentication server may determine the user group to which the user belongs, and further determine the VLAN corresponding to the user group, and send the identifier of the VLAN to the access switch; the access switch receives the access authentication.
  • the ID of the VLAN is specified, the user port for accessing the user on the device can be added to the VLAN. Subsequently, the user will apply for an IP address.
  • the aggregation switch can determine the VLAN to which the user port that receives the application for the address belongs. Then, the aggregation switch can encapsulate the identifier of the VLAN in the address request packet, and then send the address request packet to the DHCP server.
  • the DHCP server can find the network segment corresponding to the identifier of the VLAN encapsulated in the application packet, and select an unoccupied IP address from the network segment and carry it in the response packet.
  • the response packet is sent to the aggregation switch, and the response packet is forwarded to the user by the aggregation switch, so that the user can obtain the IP address in the network segment corresponding to the user group.
  • the user can obtain the IP address in the network segment corresponding to the user group regardless of where the user accesses, that is, the user's
  • the IP address is always the IP address in the same network segment. Therefore, the packet sent by the user can always hit the ACL rule that contains the network segment.
  • the user can obtain the MAC address corresponding to IP1 before sending the user packet to the data center server or another user whose IP address is IP1 (IP1 is the target IP address).
  • IP1 is the target IP address
  • it can be determined whether IP1 and the IP address of the user belong to the same network segment. If yes, the device can send an ARP request packet with the source IP address being the IP address of the user and the destination IP address being IP1. If it is not on the same network segment, the source IP address can be sent as the IP address and destination IP address of the user.
  • the access switch After receiving the ARP request packet, the access switch can determine the VLAN to which the user port that receives the ARP request packet belongs, and encapsulate the identifier of the VLAN in the ARP request packet. The access switch can send the ARP request packet to the aggregation switch because the port isolation function is enabled.
  • Step S101 After receiving the ARP request packet sent by the access switch, the gateway of the network segment corresponding to the VLAN may be found according to the identifier of the VLAN encapsulated in the ARP request packet.
  • step S102 it is determined whether the destination IP address of the ARP request packet is the IP address of the gateway determined in step S101. If yes, step S103 is performed; otherwise, step S104 is performed.
  • Step S103 The MAC address of the gateway is carried in the ARP reply packet and sent to the access switch, and is forwarded to the user through the access switch.
  • Step S104 When the ARP proxy function is configured on the gateway, the MAC address of the gateway may be carried in the ARP reply packet and sent to the access switch, and then forwarded to the user through the access switch. Obviously, no response will be made when the gateway is not configured with the ARP proxy function.
  • the user After receiving the ARP response packet, the user can establish a correspondence between the IP1 and the MAC address of the gateway. Subsequently, the user can send a user message whose destination IP address is IP1 and the destination MAC address is the MAC address of the gateway.
  • the access switch can determine the VLAN to which the user port that receives the user packet belongs, encapsulate the identifier of the VLAN in the user packet, and then forward the packet to the aggregation switch.
  • the aggregation switch After receiving the user packet, the aggregation switch performs the following steps:
  • Step S201 After receiving the user packet, compare the source IP address of the user packet with the first network segment in the ACL rule, and obtain the destination IP address of the user packet and the ACL rule. The second network segment is compared.
  • step S201 if the matching is performed, the user packet hits the ACL rule. Otherwise, if the source IP address of the user packet does not match the first network segment, and/or the destination IP address of the user packet is The packet does not match the second network segment, indicating that the user packet does not hit the ACL rule.
  • step S202 it can be determined whether the user packet hits the ACL rule. If yes, step S203 is performed; otherwise, step S204 is performed.
  • step S203 the user message can be discarded.
  • step S204 the user message can be forwarded.
  • the corresponding outbound interface may be searched in the routing table according to the destination IP address of the user packet. If the outbound interface is the downlink port of the device, the user can forward the user packet through the discovered downlink port. If the outbound interface is a VXLAN tunnel interface, the VXLAN identifier corresponding to the VLAN ID encapsulated in the user packet can be searched, and the user packet is VXLAN encapsulated and then forwarded.
  • VLANs in the above examples of the present disclosure refer to VLANs corresponding to user groups.
  • the overlay technology is applied to the aggregation switch and the core switch, thereby constructing an overlay network architecture, that is, a virtual large Layer 2 network with user-migtable benefits.
  • An ACL rule is configured on the aggregation switch.
  • the ACL rule includes: a first network segment and a second network segment, where the first network segment and the second network segment may be the network segment corresponding to the same user group or different user groups. Or, the first network segment is a network segment corresponding to the user group, and the second network segment is a network segment corresponding to the resource group.
  • the user can be assigned a VLAN corresponding to the user group to which the user belongs, and the user can be assigned an IP address in the network segment corresponding to the VLAN.
  • the aggregation switch matches the user packet with the ACL rule. If the ACL rule is hit, the user packet is discarded, so that the data in the resource group can be implemented.
  • Network access control of the central server and network access control within the same user group and network access control between different user groups.
  • the number of aggregation switches is clear because the ACL rules are configured on the aggregation switch instead of being configured on the access switch.
  • the number of ACL rules to be configured is reduced, which reduces the configuration workload.
  • the VLAN assigned to the user does not change, and the network segment to which the IP address assigned to the user belongs does not change. Therefore, no matter where the user moves, the user message sent by the user can always hit the ACL rule containing the network segment.
  • the ACL rule is not affected by the change of the user access location, and the user access location is avoided.
  • only one ACL rule can be implemented. In this case, the first network segment and the second network segment in the ACL rule are the network segments corresponding to the user group. Therefore, the number of ACL rules to be configured is greatly reduced, and ACL resources are saved.
  • the overlay Due to the network architecture in which the overlay is built, it can be applied to very large-scale networks and networks across WANs.
  • the present disclosure also provides an example of a network access control device.
  • An example of the disclosed network access control device can be applied to an aggregation switch.
  • the device example can be implemented by software, or can be implemented by hardware or a combination of hardware and software.
  • a hardware configuration diagram of the disclosed network access control apparatus includes a processor 10 and a machine readable storage medium 20.
  • the machine readable storage medium 20 stores machine readable instructions corresponding to network access control logic.
  • the processor 10 is in communication with a machine readable storage medium 20, reads and executes machine readable instructions stored in the machine readable storage medium 20, and implements the network access control method as described above with reference to FIG.
  • a machine-readable storage medium may be any electronic, magnetic, optical, or other physical storage device that can contain or store information such as executable instructions, data, and so forth.
  • the machine-readable storage medium may be: RAM (Radom Access Memory), volatile memory, non-volatile memory, flash memory, storage drive (such as a hard disk drive), solid state drive, any type of storage disk. (such as a disc, dvd, etc.), or a similar storage medium, or a combination thereof.
  • the network access control device 50 includes the following modules.
  • the configuration module 501 is configured to configure an ACL rule on the aggregation switch, where the ACL rule includes: a first network segment and a second network segment, where the first network segment and the second network segment correspond to the same user group, or correspond to different users.
  • the group, or the first network segment corresponds to the user group and the second network segment corresponding resource group.
  • the receiving module 502 is configured to receive a user message from the user terminal sent by the access switch.
  • the matching module 503 is configured to compare the source IP address of the user packet with the first network segment in the ACL rule after the receiving module 502 receives the user packet sent by the access switch, and compare the user packet.
  • the destination IP address of the packet is compared with the second network segment in the ACL rule.
  • the source IP address of the user packet is the IP address of the network segment corresponding to the virtual local area network (VLAN) bound to the user group to which the user belongs. address.
  • VLAN virtual local area network
  • the processing module 504 is configured to: if the matching module 503 determines that the source IP address of the user packet matches the first network segment, and the destination IP address of the user packet matches the second network segment, The user message.
  • the receiving module 502 is further configured to receive an identifier of a VLAN corresponding to the user group sent by the SDN controller.
  • the configuration module 501 is further configured to: after the receiving module 502 receives the identifier of the VLAN, configure the VLAN corresponding to the user group, the VXLAN on the aggregation switch; and configure the gateway IP address and the MAC address of the VXLAN.
  • the network access control device 50 further includes a relationship establishing module 505, configured to establish a correspondence between a VLAN, a VXLAN, and a network segment.
  • the processing module 504 is further configured to: if the matching module 503 determines that the source IP address of the user packet does not match the first network segment, and/or the destination IP address of the user packet does not match the second network segment. Then, the corresponding outbound interface is searched in the routing table according to the destination IP address. If the outbound interface is the downlink port of the device, the user interface is forwarded through the discovered downlink port.
  • the VXLAN tunnel interface searches for the VXLAN identifier corresponding to the identifier of the VLAN encapsulated in the user packet, and performs VXLAN encapsulation on the user packet.
  • the network access control device 50 further includes a gateway determining module 506 and a sending module 507.
  • the receiving module 502 is further configured to receive an ARP request packet sent by the access switch for the target IP address.
  • the gateway determining module 506 is configured to determine, according to the identifier of the VLAN encapsulated in the ARP request packet, the gateway of the network segment corresponding to the VLAN, after the receiving module 502 receives the ARP request packet.
  • the sending module 507 is configured to: if the destination IP address of the ARP request packet is the determined IP address of the gateway, send the determined MAC address of the gateway in the ARP response packet to the access switch, if If the destination IP address of the ARP request packet is not the determined IP address of the gateway, the MAC address of the determined gateway is carried in the ARP response packet when the determined gateway is configured with the ARP proxy function.
  • the access switch is configured to enable the user terminal to receive the ARP response packet forwarded by the access switch, establish a correspondence between the target IP address and the MAC address of the gateway, and send a destination IP address to the access switch. The user packet whose destination IP address and destination MAC address are the determined MAC address of the gateway.
  • the gateway determining module 506 determines that the destination IP address of the ARP request packet is the target IP address, when the destination IP address belongs to the same network segment as the source IP address of the ARP request packet. When the destination IP address and the source IP address of the ARP request packet belong to different network segments, the gateway determining module 606 determines that the destination IP address of the ARP request packet is the determined IP address of the gateway.
  • the device example since it basically corresponds to the method example, see the section on the method example for the relevant points. Can be.
  • the device examples described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, ie may be located in one Places, or they can be distributed to multiple network elements. Some or all of the modules may be selected according to actual needs to achieve the objectives of the present disclosure. Those of ordinary skill in the art can understand and implement without any creative effort.
  • first, second, third, etc. may be used in the present disclosure to describe various information, such information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other.
  • first information may also be referred to as second information without departing from the scope of the present disclosure.
  • second information may also be referred to as first information.
  • word "if” as used herein may be interpreted as "when” or “when” or “in response to a determination.”

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本公开提供一种网络访问控制方法及装置。根据该网络访问控制方法，汇聚交换机可在本设备上配置ACL规则，该ACL规则中包括第一网段和第二网段，所述第一网段和所述第二网段对应同一用户组，或者对应不同用户组，或者所述第一网段对应用户组、所述第二网段对应资源组。汇聚交换机接收到接入交换机发来的来自于用户终端的用户报文之后，将该用户报文的源IP地址与该ACL规则中的第一网段进行匹配，并将该用户报文的目的IP地址与该ACL规则中的第二网段进行匹配。若所述用户报文的源IP地址与所述第一网段匹配并且所述用户报文的目的IP地址与所述第二网段匹配，则丢弃该用户报文。

Description

网络访问控制
相关申请的交叉引用
本公开要求2016年4月29日提交的中国专利申请201610288688.7的优先权，其全部内容通过引用并入本文。
背景技术
在企业网络中，出于信息安全的考虑，通常会对用户进行分类，可将所有用户划分成多个用户组。同一用户组内的用户可拥有相同的网络访问权限，不同用户组内的用户可拥有不同的网络访问权限。
可预先在接入交换机上配置VLAN(Virtual Local Area Network，虚拟局域网)和ACL(Access Control List，访问控制列表)规则，不同的ACL规则用于限定不同VLAN对应的网络访问权限。
附图说明
图1是本公开一示例性示例示出的企业网络的一种网络架构示意图。
图2是本公开一示例性示例示出的汇聚交换机对ARP请求报文的处理流程图。
图3是本公开一示例性示例示出的汇聚交换机对用户报文进行网络访问控制的处理流程图。
图4是本公开一示例性示例示出的网络访问控制装置的硬件架构示意图。
图5是本公开一示例性示例示出的网络访问控制装置的一种结构示意图。
图6是本公开一示例性示例示出的网络访问控制装置的另一种结构示意图。
图7是本公开一示例性示例示出的网络访问控制装置的又一种结构示意图。
具体实施方式
这里将结合附图详细地对示例性示例进行说明。下面的描述涉及附图时，除非另有表示，不同附图中的相同数字表示相同或相似的要素。以下示例性示例中所描述的示例并不代表与本公开相一致的所有示例。相反，它们仅是与如所附权利要求书中所详述的、本公开的一些方面相一致的装置和方法的例子。
本公开以下示例提出了一种网络访问控制方法，以及一种可以应用该方法的装置。
本公开示例可以应用于企业网络中，通常，企业网络中可包括以下几类设备：接入交换机、汇聚交换机和核心交换机，核心交换机可连接汇聚交换机、汇聚交换机可连接接入交换机、接入交换机可用于用户接入访问，在汇聚交换机和核心交换机上可应用overlay(交叠虚拟化)技术。
另外，一个企业网络中可包括多个子网络，例如，如图1所示，该企业网络可包括总部网络和分支网络。该总部网络包括：接入交换机101a至101e、汇聚交换机102a至102c、核心交换机103a和103b。该分支网络中包括：接入交换机201a至201e、汇聚交换机202a至202c和核心交换机203a至203b。其中，在汇聚交换机和核心交换机上可应用overlay技术，其中，上述汇聚交换机和核心交换机可以属于同一子网络，也可以属于不同的子网络。在本公开示例中，接入交换机仅泛指具有信息交换功能的网络设备，可以是以太网交换机、无线接入控制器(AC)等。该企业网络可对数据中心进行访问。如图1所示，数据中心可以包括数据中心服务器104a至104c以及数据中心交换机105a。
overlay技术是指在现有物理网络上再叠加一个虚拟网络，该虚拟网络一般是虚拟二层网络，这样可以带来配置简化，用户迁移等诸多好处。典型的overlay技术主要有VXLAN(Virtual eXtensible LAN，可扩展虚拟局域网络)、NVGRE(Network Virtual Generic Routing Encapsulation，使用通用路由封装的网络虚拟化)和STT(Stateless Transfer Tunnel，无状态传输隧道)等。
通过应用overlay技术，可将整个网络构建成一个虚拟的二层网络，如图1所示，该虚拟的二层网络不仅可以覆盖包括总部网络和分支网络的企业网络，还可以覆盖WAN(Wide Area Network，广域网)，可跨越WAN将总部网络和分支网络互联，形成了一个端到端的大二层网络。
以VXLAN技术为例，在如图1所示的企业网络中，在同一子网络中的汇聚交换机之间、不同子网络中的汇聚交换机之间、同一子网络中的汇聚交换机与核心交换机之间、不同子网络中的汇聚交换机与核心交换机之间可建立VXLAN隧道。
在控制平面上，可通过EVPN(Ethernet VPN，以太网虚拟专用网)机制来同步路由和MAC(Media Access Control，媒体访问控制)地址信息，抑制广播报文。
本公开示例的网络访问控制方法可包括以下内容：
软件定义网络(SDN)控制器可接收并保存配置信息，其中，该配置信息中包括：用户组信息，资源组信息，以及各种访问控制策略。可以通过静态配置的方式在SDN控制器上配置上述配置信息。
其中，用户组信息可以如表1所示，资源组信息可以如表2所示：
表1
用户组标识 VLAN标识 VXLAN标识 网段
用户组1 10 10 10.10.1.1/24
用户组2 20 20 10.20.1.1/24
用户组3 30 30 10.30.1.1/24
由表1可以看出，用户组信息可包括：用户组标识及其对应的VLAN(虚拟局域网络)标识、VXLAN标识和网段，可见，一个用户组可对应一个VLAN，一个VXLAN，以及一个网段。
在实际实施过程中，可以按照用户身份对所有用户进行分组。显然，还可以按照用户年龄、用户所属区域等其它方式进行分组，本公开示例对此不做限定。同一用户组内的用户可拥有相同的网络访问权限，不同用户组内的用户可拥有不同的网络访问权限。
表2
资源组标识 数据中心服务器的IP地址
资源组1 10.100.0.0/24
资源组2 10.200.0.0/24
由表2可以看出，资源组信息可包括：资源组标识以及该资源组中包括的数据中心服务器的IP(Internet Protocol，因特网协议)地址。其中，一个资源组标识可以对应至少一个数据中心服务器的IP地址，当对应多个IP地址时，这些IP地址可以是一个网段中的所有IP地址。例如，假设数据中心中有3台服务器a、b、c，资源组1可包括服务器a，资源组2可包括服务器b和c，其中，服务器b和c的IP地址属于同一网段。
各种访问控制策略可以按照表3直观的表示：
表3
  用户组1 用户组2 用户组3 资源组1 资源组2
用户组1         deny
用户组2   deny deny    
用户组3 deny     deny  
由表3可以看出，各种访问控制策略可包括：同一用户组内的访问控制策略，和/或不同用户组之间的访问控制策略，和/或用户组对资源组的访问控制策略。表3中，如果在对应第 m行第n列的位置中标记了deny，则表示禁止第m行对应的用户组与第n列对应的用户组内的用户之间互相访问，或者，用于表示禁止第m行对应的用户组访问第n列对应的资源组内的数据中心服务器。其中，当第m行对应的用户组与第n列对应的用户组是同一用户组时，实现了同一用户组内的访问控制。当第m行对应的用户组与第n列对应的用户组不是同一用户组时，实现了不同用户组之间的访问控制。
显然，如果在对应第m行、第n列的位置中没有标记deny，则表示允许访问。
例如，在表3中，对应第4行第2列的位置中标记了deny，用于表示禁止用户组1与用户组3内的用户之间互相访问；对应第3行第3列的位置中标记了deny，用于表示禁止用户组2内的用户之间互相访问；对应第2行第6列的位置中标记了deny，用于表示禁止用户组1内的用户访问资源组2内的数据中心服务器，结合表2可知，即禁止访问IP地址属于网段10.200.0.0/24的数据中心服务器。
SDN控制器可将用户组信息、资源组信息和各种访问控制策略中的相应内容，发送给网络中的各个设备，例如接入交换机、汇聚交换机、核心交换机、和DHCP(Dynamic Host Configuration Protocol，动态主机配置协议)服务器等，以便这些设备可以进行相应配置。配置过程可如下：
SDN控制器可将所有用户组对应的VLAN的标识发送给所有接入交换机。每一个接入交换机接收到VLAN的标识之后，可在本设备上配置该VLAN，将本设备上连接汇聚交换机的上行端口配置为允许发送属于该VLAN的报文，从而，接入交换机可以通过上行端口发送封装有VLAN的标识的报文。
SDN控制器可将用户组对应的VLAN的标识发送给所有汇聚交换机。每一个汇聚交换机在接收到VLAN的标识之后，在本设备上配置该VLAN，将本设备上连接接入交换机的下行端口配置为允许接收属于该VLAN的报文，从而，汇聚交换机可以从下行端口上接收封装有该VLAN的标识的报文；可在汇聚交换机上配置所有用户组对应的VXLAN，建立VLAN、VXLAN以及网段之间的对应关系；可在汇聚交换机上配置Vxlan的网关的IP地址和MAC地址。其中，可以将VXLAN对应的VXLAN虚接口配置为对应网段的网关。从而，每一个汇聚交换机上都配置有所有网段的网关。这样，无论用户移动到何处，通过接入交换机接入到哪一个汇聚交换机上，该汇聚交换机上都配置有该用户对应的IP地址所属网段的网关。
SDN控制器可将所有用户组对应的VXLAN的标识发送给所有核心交换机。每一个核心交换机接收到VXLAN的标识之后，可在本设备上配置该VXLAN及其三层网关地址。另外，核心交换机还可通过路由协议，配置与数据中心交换机等外部设备的路由连接。
SDN控制器还可将如表3所示的各种访问控制策略，发送给所有汇聚交换机。每一个汇 聚交换机接收到这些内容之后，可在本设备上配置对应的ACL规则。该ACL规则中包括：第一网段和第二网段，其中，所述第一网段和所述第二网段对应同一用户组，或者对应不同用户组，或者所述第一网段对应用户组、所述第二网段对应资源组。
可见，当第一网段和第二网段对应同一用户组时，该ACL规则可用于禁止同一用户组内的用户之间互相访问，当第一网段和第二网段对应的不同用户组时，该ACL规则可用于禁止不同用户组内的用户之间互相访问，当第一网段对应用户组、第二网段对应资源组时，该ACL规则可用于禁止该用户组内的用户访问该资源组中的数据中心服务器。
例如，按照如表3所示的访问控制策略配置的ACL规则如下：
ACL1 deny source 10.10.1.1/24 destination 10.200.0.0/24
ACL2 deny source 10.20.1.1/24 destination 10.20.1.1/24
ACL3 deny source 10.20.1.1/24 destination 10.30.1.1/24
ACL4 deny source 10.30.1.1/24 destination 10.20.1.1/24
ACL5 deny source 10.30.1.1/24 destination 10.10.1.1/24
ACL6 deny source 10.10.1.1/24 destination 10.30.1.1/24
ACL7 deny source 10.30.1.1/24 destination 10.100.0.0/24
其中，ACL1可用于禁止用户组1内的用户访问资源组2内的数据中心服务器；ACL2可用于禁止用户组2内的用户之间互相访问；ACL3和ACL4可用于禁止用户组2与用户组3内的用户之间互相访问；ACL5和ACL6可用于禁止用户组1与用户组3内的用户之间互相访问；ACL7可用于禁止用户组3内的用户访问资源组1内的数据中心服务器。
SDN控制器可配置用户组与VLAN之间的对应关系。另外，认证服务器上还可配置有用户与用户组之间的对应关系，从而，在认证服务器上，可保存有用户、用户组、与VLAN之间的对应关系。
SDN控制器可将所有网段发送给DHCP服务器，同时配置vlan与地址池对应关系。可以将每一个网段的IP地址分别保存到一个地址池中，建立VLAN与地址池之间的对应关系。
为了实现同一用户组内的访问控制，可在接入交换机上开启端口隔离功能并在汇聚交换机上开启不同虚拟通道(接入交换机的物理port所属的vlan在汇聚交换机上转换成虚拟通道)之间的隔离。这样，接入交换机从用户端口接收到的报文，只能通过连接汇聚交换机的上行端口转发给汇聚交换机进行网络访问控制。另外，由于在接入交换机上开启了端口隔离功能，用户发出的ARP(Address Resolution Protocol，地址解析协议)请求报文，只能转发给汇聚交换机，因此，可为汇聚交换机上的每一个网关配置ARP代理(proxy)功能。这样，汇聚交换机接收到该ARP请求报文之后，可针对该ARP请求报文做出应答。
在完成上述配置过程之后，用户即可进行接入认证，并在认证通过后访问网络。
在任一用户进行接入认证的过程中，认证服务器可确定该用户所属的用户组，并可进一步确定该用户组对应的VLAN，将该VLAN的标识发送给接入交换机；接入交换机在接收到该VLAN的标识之后，可将本设备上用于该用户接入的用户端口加入到该VLAN中。后续，该用户即会申请IP地址。汇聚交换机接收到该用户发来的地址申请报文之后，可确定接收到该地址申请报文的用户端口所属的VLAN。然后，汇聚交换机可在该地址申请报文中封装该VLAN的标识后，将该地址申请报文发送给DHCP服务器。DHCP服务器接收到该地址申请报文之后，可查找到该地址申请报文中封装的VLAN的标识对应的网段，从该网段中选择一个未被占用的IP地址，携带在应答报文中发送给该汇聚交换机，通过该汇聚交换机将该应答报文转发给该用户，从而，该用户可以获得所属用户组对应的网段中的IP地址。
对于任一用户而言，只要该用户所属的用户组不变，那么，该用户无论从哪里接入，该用户都能获得与该用户组对应的网段中的IP地址，即，该用户的IP地址总是同一网段中的IP地址。因此，该用户发出的报文也总是能够命中包含该网段的ACL规则。
在获得了IP地址之后，该用户向IP地址为IP1(IP1即为目标IP地址)的数据中心服务器或另一用户发送用户报文之前，可先获得IP1对应的MAC地址。此时，可判断IP1与该用户的IP地址是否属于同一网段。若是，则可发送源IP地址为该用户的IP地址、目的IP地址为IP1的ARP请求报文；若不是同一网段，则可发送源IP地址为该用户的IP地址、目的IP地址为该用户的IP地址所属网段的网关IP地址的ARP请求报文。
接入交换机接收到该ARP请求报文之后，可确定接收到该ARP请求报文的用户端口所属的VLAN，并可在该ARP请求报文中封装该VLAN的标识。由于开启了端口隔离功能，因此接入交换机可将该ARP请求报文发送给汇聚交换机。
汇聚交换机接收到该ARP请求报文之后，如图2所示，会执行以下步骤：
步骤S101，在接收到接入交换机发来的ARP请求报文之后，可根据该ARP请求报文中封装的VLAN的标识，查找到该VLAN对应的网段的网关。
步骤S102，可判断该ARP请求报文的目的IP地址是否是步骤S101中确定出的网关的IP地址，若是，则执行步骤S103，否则，执行步骤S104。
步骤S103，可将该网关的MAC地址携带在ARP应答报文中发送给该接入交换机，通过该接入交换机转发给该用户。
步骤S104，在该网关配置了ARP代理功能时，可将该网关的MAC地址携带在ARP应答报文中发送给接入交换机，通过该接入交换机转发给该用户。显然，在该网关没有配置ARP代理功能时，不会做出应答。
该用户接收到该ARP应答报文之后，可建立IP1与该网关的MAC地址之间的对应关系。 后续，该用户可发出目的IP地址是IP1、目的MAC地址是该网关的MAC地址的用户报文。
对该用户报文进行网络访问控制的具体流程如下：
接入交换机接收到该用户报文之后，可确定接收到该用户报文的用户端口所属的VLAN，在该用户报文中封装该VLAN的标识，之后转发给汇聚交换机。
如图3所示，汇聚交换机接收到该用户报文后，会执行以下步骤：
步骤S201，在接收到该用户报文之后，可将该用户报文的源IP地址与ACL规则中的第一网段进行比较，并可将该用户报文的目的IP地址与该ACL规则中的第二网段进行比较。
在步骤S201中，若均匹配，说明该用户报文命中该ACL规则，否则，若该用户报文的源IP地址与第一网段不匹配，和/或，该用户报文的目的IP地址与第二网段不匹配，说明该用户报文没有命中该ACL规则。
步骤S202，可判断该用户报文是否命中该ACL规则，若是，则执行步骤S203，否则，执行步骤S204。
步骤S203，可丢弃该用户报文。
步骤S204，可转发该用户报文。
具体的，步骤S204中，可根据该用户报文的目的IP地址在路由表中查找对应的出接口。若查找到的出接口为本设备的下行端口，则可通过查找到的下行端口转发该用户报文。若查找到的出接口为VXLAN隧道接口，则可查找与该用户报文中封装的VLAN的标识对应的VXLAN的标识，并对该用户报文进行VXLAN封装后进行转发。
在本公开上述示例中的VLAN，均指的是用户组对应的VLAN。
本公开上述示例的方法，实现了以下技术效果：
在汇聚交换机和核心交换机上应用overlay技术，从而，构建了一个overlay网络架构，即，一个虚拟的大二层网络，具有用户可迁移的好处。
汇聚交换机上配置有ACL规则，该ACL规则中包括：第一网段和第二网段，其中，第一网段和第二网段可以是与同一用户组或者与不同用户组对应的网段，或者，第一网段为与用户组对应的网段、第二网段为与资源组对应的网段。用户无论从何处接入，在进行接入认证时，均可为该用户分配该用户所属用户组对应的VLAN，并可为该用户分配该VLAN对应的网段中的IP地址。汇聚交换机在接收到该用户的用户报文之后，会将该用户报文与该ACL规则进行匹配，若命中该ACL规则，则丢弃该用户报文，从而，不仅可以实现对资源组中的数据中心服务器的网络访问控制，而且，可以实现同一用户组内的网络访问控制，以及不同用户组之间的网络访问控制。
由于在汇聚交换机上配置ACL规则，而不是在接入交换机上配置，汇聚交换机的数量明 显小于接入交换机，因而可以减少需要配置的ACL规则总数，减轻配置工作量。
只要该用户所属的用户组不变，分配给该用户的VLAN就不变，分配给该用户的IP地址所属网段也不变。因此，无论该用户移动到何处，该用户发出的用户报文总是能够命中包含该网段的ACL规则，该ACL规则不会受到用户接入位置变化的影响，避免了用户接入位置的变化所导致的ACL规则的更新。而且，当需要实现同一用户组内的网络访问控制时，只需一条ACL规则即可实现，此时，该ACL规则中的第一网段和第二网段均为该用户组对应的网段，从而极大的减少了需要配置的ACL规则数量，节约了ACL资源。
由于构建了overlay的网络架构，因此，可以应用于超大规模网络和跨WAN的网络中。
与前述网络访问控制方法的示例相对应，本公开还提供了网络访问控制装置的示例。
本公开网络访问控制装置的示例可以应用在汇聚交换机上。装置示例可以通过软件实现，也可以通过硬件或者软硬件结合的方式实现。从硬件层面而言，如图4所示，为本公开网络访问控制装置的一种硬件结构图，该网络访问控制装置包括处理器10以及机器可读存储介质20。
机器可读存储介质20存储网络访问控制逻辑对应的机器可读指令。
处理器10与机器可读存储介质20通信，读取和执行机器可读存储介质20中存储的机器可读指令，实现如上参照图3描述的网络访问控制方法。
这里，机器可读存储介质可以是任何电子、磁性、光学或其它物理存储装置，可以包含或存储信息，如可执行指令、数据，等等。例如，机器可读存储介质可以是：RAM(Radom Access Memory，随机存取存储器)、易失存储器、非易失性存储器、闪存、存储驱动器(如硬盘驱动器)、固态硬盘、任何类型的存储盘(如光盘、dvd等)，或者类似的存储介质，或者它们的组合。
本公开示例中还提供一种网络访问控制装置，该网络访问控制装置可以应用在汇聚交换机上。请参考图5，网络访问控制装置50中包括以下模块。
配置模块501，用于在汇聚交换机上配置ACL规则，该ACL规则中包括：第一网段和第二网段，其中，第一网段和第二网段对应同一用户组，或者对应不同用户组，或者，第一网段对应用户组、第二网段对应资源组。
接收模块502，用于接收接入交换机发来的来自于用户终端的用户报文。
匹配模块503，用于在接收模块502接收到接入交换机发来的用户报文之后，将该用户报文的源IP地址与该ACL规则中的第一网段进行比较，并将该用户报文的目的IP地址与该ACL规则中的第二网段进行比较；其中，该用户报文的源IP地址为与用户所属用户组绑定的虚拟局域网(VLAN)所对应的网段中的IP地址。
处理模块504，用于若匹配模块503判断出所述用户报文的源IP地址与所述第一网段匹配、所述用户报文的目的IP地址与所述第二网段匹配，则丢弃该用户报文。
接收模块502，还用于接收SDN控制器发来的用户组对应的VLAN的标识。
配置模块501，还用于在接收模块502接收到VLAN的标识之后，在汇聚交换机上配置用户组对应的VLAN、VXLAN；还用于配置所述VXLAN的网关IP地址和MAC地址。
如图6所示，网络访问控制装置50还包括：关系建立模块505，用于建立VLAN、VXLAN以及网段之间的对应关系。
其中，处理模块504，还用于若匹配模块503判断出该用户报文的源IP地址与第一网段不匹配，和/或，该用户报文的目的IP地址与第二网段不匹配，则根据该目的IP地址在路由表中查找对应的出接口，若查找到的出接口为本设备的下行端口，则通过查找到的下行端口转发该用户报文，若查找到的出接口为VXLAN隧道接口，则查找与该用户报文中封装的VLAN的标识对应的VXLAN的标识，并对该用户报文进行VXLAN封装后进行转发。
另外，如图7所示，上述网络访问控制装置50中还包括：网关确定模块506和发送模块507。
接收模块502，还用于接收接入交换机发来的针对目标IP地址的ARP请求报文。
网关确定模块506，用于在接收模块502接收到该ARP请求报文之后，根据该ARP请求报文中封装的VLAN的标识确定该VLAN对应的网段的网关。
发送模块507，用于若该ARP请求报文的目的IP地址是所确定出的网关的IP地址，则将所确定出的网关的MAC地址携带在ARP应答报文中发送给接入交换机，若该ARP请求报文的目的IP地址不是所确定出的网关的IP地址，则在所确定出的网关配置了ARP代理功能时，将所确定出的网关的MAC地址携带在ARP应答报文中发送给接入交换机，以使该用户终端接收到该接入交换机转发来的该ARP应答报文之后，建立该目标IP地址与该网关的MAC地址的对应关系，向该接入交换机发送目的IP地址为该目标IP地址、目的MAC地址是所确定出的网关的MAC地址的用户报文。
其中，当所述目标IP地址与所述ARP请求报文的源IP地址属于同一网段时，所述网关确定模块506确定所述ARP请求报文的目的IP地址为所述目标IP地址，当所述目标IP地址与所述ARP请求报文的源IP地址属于不同网段时，所述网关确定模块606确定所述ARP请求报文的目的IP地址为所确定出的网关的IP地址。
上述装置中各个单元的功能和作用的实现过程具体详见上述方法中对应步骤的实现过程，在此不再赘述。
对于装置示例而言，由于其基本对应于方法示例，所以相关之处参见方法示例的部分说 明即可。以上所描述的装置示例仅仅是示意性的，其中所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部模块来实现本公开方案的目的。本领域普通技术人员在不付出创造性劳动的情况下，即可以理解并实施。
在本公开使用的术语是仅仅出于描述特定示例的目的，而非旨在限制本公开。在本公开和所附权利要求书中所使用的单数形式的“一种”、“所述”和“该”也旨在包括多数形式，除非上下文清楚地表示其他含义。还应当理解，本文中使用的术语“和/或”是指并包含一个或多个相关联的列出项目的任何或所有可能组合。
应当理解，尽管在本公开可能采用术语第一、第二、第三等来描述各种信息，但这些信息不应限于这些术语。这些术语仅用来将同一类型的信息彼此区分开。例如，在不脱离本公开范围的情况下，第一信息也可以被称为第二信息，类似地，第二信息也可以被称为第一信息。取决于语境，如在此所使用的词语“如果”可以被解释成为“在……时”或“当……时”或“响应于确定”。
以上所述仅为本公开的较佳示例而已，并不用以限制本公开，凡在本公开的精神和原则之内，所做的任何修改、等同替换、改进等，均应包含在本公开保护的范围之内。

Claims (12)

  1. 一种网络访问控制方法，包括：
    汇聚交换机在本设备上配置访问控制列表(ACL)规则，其中，所述ACL规则中包括第一网段和第二网段，所述第一网段和所述第二网段对应同一用户组，或者对应不同用户组，或者所述第一网段对应用户组、所述第二网段对应资源组；
    所述汇聚交换机接收接入交换机发来的来自于用户终端的用户报文；
    所述汇聚交换机将所述用户报文的源互联网协议(IP)地址与所述ACL规则中的所述第一网段进行比较，并将所述用户报文的目的IP地址与所述ACL规则中的所述第二网段进行比较；其中，所述用户报文的源IP地址为与用户所属用户组绑定的虚拟局域网(VLAN)所对应的网段中的IP地址；
    若所述用户报文的源IP地址与所述第一网段匹配并且所述用户报文的目的IP地址与所述第二网段匹配，则所述汇聚交换机丢弃所述用户报文。
  2. 根据权利要求1所述的方法，还包括：
    所述汇聚交换机接收软件定义网络SDN控制器发来的用户组对应的VLAN的标识；
    所述汇聚交换机在本设备上配置用户组对应的VLAN、VXLAN，建立所述VLAN、VXLAN以及网段之间的对应关系，并配置所述VXLAN的网关IP地址和媒体接入控制(MAC)地址。
  3. 根据权利要求2所述的方法，还包括：
    若所述用户报文的源IP地址与所述第一网段不匹配，和/或，所述用户报文的目的IP地址与所述第二网段不匹配，则所述汇聚交换机根据所述目的IP地址在路由表中查找对应的出接口；
    在查找到的出接口为本设备的下行端口的情况下，所述汇聚交换机通过查找到的下行端口转发所述用户报文；
    在查找到的出接口为VXLAN隧道接口的情况下，所述汇聚交换机查找与所述用户报文中封装的VLAN的标识对应的VXLAN的标识，并对所述用户报文进行VXLAN封装后进行转发。
  4. 根据权利要求2所述的方法，还包括：
    在接收所述接入交换机发来的用户报文之前，所述汇聚交换机接收所述接入交换机发来 的针对目标IP地址的地址解析协议ARP请求报文；
    所述汇聚交换机根据该ARP请求报文中封装的VLAN的标识确定该VLAN对应的网段的网关；
    所述汇聚交换机根据所述目标IP地址和所述ARP请求报文的源IP地址，确定所述ARP请求报文的目的IP地址。
  5. 根据权利要求4所述的方法，还包括：
    若所述ARP请求报文的目的IP地址是所述确定出的网关的IP地址，则所述汇聚交换机将所述确定出的网关的MAC地址携带在ARP应答报文中发送给所述接入交换机；
    若所述ARP请求报文的目的IP地址不是所述确定出的网关的IP地址，则在所述确定出的网关配置了ARP代理功能时，所述汇聚交换机将所述确定出的网关的MAC地址携带在ARP应答报文中发送给所述接入交换机，以使所述用户终端接收到所述接入交换机转发来的所述ARP应答报文之后，建立所述目标IP地址与该网关的MAC地址的对应关系，向所述接入交换机发送目的IP地址为所述目标IP地址、目的MAC地址是所述确定出的网关的MAC地址的所述用户报文。
  6. 根据权利要求4所述的方法，其中，根据所述目标IP地址和所述ARP请求报文的源IP地址，确定所述ARP请求报文的目的IP地址，包括：
    当所述目标IP地址与所述ARP请求报文的源IP地址属于同一网段时，所述汇聚交换机确定所述ARP请求报文的目的IP地址为所述目标IP地址，
    当所述目标IP地址与所述ARP请求报文的源IP地址属于不同网段时，所述汇聚交换机确定所述ARP请求报文的目的IP地址为所述确定出的网关的IP地址。
  7. 一种网络访问控制装置，包括处理器以及机器可读存储介质，所述机器可读存储介质存储有能够被所述处理器执行的机器可读指令，所述处理器被所述机器可读指令促使：
    在汇聚交换机上配置访问控制列表(ACL)规则，其中，所述ACL规则中包括第一网段和第二网段，所述第一网段和所述第二网段对应同一用户组，或者对应不同用户组，或者所述第一网段对应用户组、所述第二网段对应资源组；
    接收接入交换机发来的来自于用户终端的用户报文；
    将所述用户报文的源互联网协议(IP)地址与所述ACL规则中的所述第一网段进行比较，并将所述用户报文的目的IP地址与所述ACL规则中的所述第二网段进行比较；其中，所述 用户报文的源IP地址为与用户所属用户组绑定的虚拟局域网(VLAN)所对应的网段中的IP地址；
    若所述用户报文的源IP地址与所述第一网段匹配并且所述用户报文的目的IP地址与所述第二网段匹配，则丢弃所述用户报文。
  8. 根据权利要求7所述的网络访问控制装置，其中，所述机器可读指令还促使所述处理器：
    接收软件定义网络SDN控制器发来的用户组对应的VLAN的标识；
    在所述汇聚交换机上配置用户组对应的VLAN、VXLAN，建立所述VLAN、VXLAN以及网段之间的对应关系，并配置所述VXLAN的网关IP地址和媒体接入控制(MAC)地址。
  9. 根据权利要求8所述的装置，其中，所述机器可读指令还促使所述处理器：
    若所述用户报文的源IP地址与所述第一网段不匹配，和/或，所述用户报文的目的IP地址与所述第二网段不匹配，则根据所述目的IP地址在路由表中查找对应的出接口；
    在查找到的出接口为所述汇聚交换机的下行端口的情况下，通过查找到的下行端口转发所述用户报文，
    在查找到的出接口为VXLAN隧道接口的情况下，查找与所述用户报文中封装的VLAN的标识对应的VXLAN的标识，并对所述用户报文进行VXLAN封装后进行转发。
  10. 根据权利要求8所述的装置，其中，所述机器可读指令还促使所述处理器：
    在接收所述接入交换机发来的用户报文之前，接收所述接入交换机发来的针对目标IP地址的地址解析协议ARP请求报文；
    根据该ARP请求报文中封装的VLAN的标识确定该VLAN对应的网段的网关；
    根据所述目标IP地址和所述ARP请求报文的源IP地址，确定所述ARP请求报文的目的IP地址。
  11. 根据权利要求10所述的装置，其中，所述机器可读指令还促使所述处理器：
    若所述ARP请求报文的目的IP地址是所确定出的网关的IP地址，则将所确定出的网关的MAC地址携带在ARP应答报文中发送给所述接入交换机；
    若所述ARP请求报文的目的IP地址不是所确定出的网关的IP地址，则在所确定出的网关配置了ARP代理功能时，将所确定出的网关的MAC地址携带在ARP应答报文中发送给 所述接入交换机，以使所述用户终端接收到所述接入交换机转发来的所述ARP应答报文之后，建立所述目标IP地址与该网关的MAC地址的对应关系，向所述接入交换机发送目的IP地址为所述目标IP地址、目的MAC地址是所确定出的网关的MAC地址的所述用户报文。
  12. 根据权利要求10所述的装置，其中，在根据所述目标IP地址和所述ARP请求报文的源IP地址确定所述ARP请求报文的目的IP地址时，所述机器可读指令还促使所述处理器：
    当所述目标IP地址与所述ARP请求报文的源IP地址属于同一网段时，确定所述ARP请求报文的目的IP地址为所述目标IP地址，
    当所述目标IP地址与所述ARP请求报文的源IP地址属于不同网段时，确定所述ARP请求报文的目的IP地址为所确定出的网关的IP地址。
PCT/CN2017/082690 2016-04-29 2017-05-02 网络访问控制 WO2017186181A1 (zh)

Priority Applications (3)

Application Number Priority Date Filing Date Title
EP17788833.6A EP3451612B1 (en) 2016-04-29 2017-05-02 Network access control
JP2018556323A JP6648308B2 (ja) 2016-04-29 2017-05-02 パケット伝送
US16/097,154 US11025631B2 (en) 2016-04-29 2017-05-02 Network access control

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610288688.7A CN107332812B (zh) 2016-04-29 2016-04-29 网络访问控制的实现方法及装置
CN201610288688.7 2016-04-29

Publications (1)

Publication Number Publication Date
WO2017186181A1 true WO2017186181A1 (zh) 2017-11-02

Family

ID=60161827

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/082690 WO2017186181A1 (zh) 2016-04-29 2017-05-02 网络访问控制

Country Status (5)

Country Link
US (1) US11025631B2 (zh)
EP (1) EP3451612B1 (zh)
JP (1) JP6648308B2 (zh)
CN (1) CN107332812B (zh)
WO (1) WO2017186181A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2020005256A (ja) * 2018-06-26 2020-01-09 華為技術有限公司Ｈｕａｗｅｉ Ｔｅｃｈｎｏｌｏｇｉｅｓ Ｃｏ．，Ｌｔｄ． Ｖｘｌａｎ実装方法、ネットワークデバイス、および通信システム

Families Citing this family (40)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10454714B2 (en) 2013-07-10 2019-10-22 Nicira, Inc. Method and system of overlay flow control
US10523636B2 (en) * 2016-02-04 2019-12-31 Airwatch Llc Enterprise mobility management and network micro-segmentation
US10999100B2 (en) 2017-10-02 2021-05-04 Vmware, Inc. Identifying multiple nodes in a virtual network defined over a set of public clouds to connect to an external SAAS provider
US10686625B2 (en) 2017-10-02 2020-06-16 Vmware, Inc. Defining and distributing routes for a virtual network
US11115480B2 (en) 2017-10-02 2021-09-07 Vmware, Inc. Layer four optimization for a virtual network defined over public cloud
FR3072529B1 (fr) * 2017-10-17 2019-10-18 Sagemcom Broadband Sas Routage de donnees dans une passerelle residentielle mettant en œuvre l'agregation de liens
US11223514B2 (en) 2017-11-09 2022-01-11 Nicira, Inc. Method and system of a dynamic high-availability mode based on current wide area network connectivity
CN108600170A (zh) * 2018-03-20 2018-09-28 大势至(北京)软件工程有限公司 一种控制多网段环境下网络设备上网行为的方法及系统
CN110401726B (zh) * 2018-04-24 2022-04-15 中兴通讯股份有限公司 地址解析协议报文的处理方法、装置及设备、存储介质
CN108616463B (zh) * 2018-04-25 2021-04-30 新华三技术有限公司 一种报文处理方法及交换机
CN110446214A (zh) * 2018-05-03 2019-11-12 中兴通讯股份有限公司 管理网络访问进程的方法、装置及设备、存储介质
CN110650075B (zh) * 2018-06-26 2022-02-18 华为技术有限公司 基于vxlan的组策略实现方法、网络设备和组策略实现系统
CN109525601B (zh) * 2018-12-28 2021-04-27 杭州迪普科技股份有限公司 内网中终端间的横向流量隔离方法和装置
CN111030970B (zh) * 2019-03-21 2023-04-18 安天科技集团股份有限公司 一种分布式访问控制方法、装置及存储设备
CN111865876B (zh) * 2019-04-29 2021-10-15 华为技术有限公司 网络的访问控制方法和设备
US10999137B2 (en) 2019-08-27 2021-05-04 Vmware, Inc. Providing recommendations for implementing virtual networks
CN110535744B (zh) * 2019-08-29 2021-12-24 新华三信息安全技术有限公司 报文处理方法、装置及Leaf设备
CN116208658A (zh) 2019-09-06 2023-06-02 华为云计算技术有限公司 混合云环境中的通信方法及网关、管理方法及装置
CN112565158B (zh) * 2019-09-25 2022-10-04 阿里巴巴集团控股有限公司 数据访问方法、装置、系统、电子设备及计算机可读介质
CN110691101A (zh) * 2019-10-28 2020-01-14 锐捷网络股份有限公司 哑终端免认证名单的配置方法及装置
CN111130976B (zh) * 2019-11-15 2022-04-22 苏州浪潮智能科技有限公司 一种配置白盒交换机虚拟局域网的方法、设备及介质
CN110838966B (zh) * 2019-11-20 2022-03-01 紫光华山科技有限公司 一种设备连接控制方法及装置
CN112838983B (zh) * 2019-11-22 2023-09-12 斑马智行网络(香港)有限公司 数据传输方法、系统、设备、代理服务器及存储介质
CN110958334B (zh) * 2019-11-25 2022-08-09 新华三半导体技术有限公司 报文处理方法及装置
CN111107142B (zh) * 2019-12-16 2022-07-01 新华三大数据技术有限公司 业务访问方法和装置
CN113132326B (zh) * 2019-12-31 2022-08-09 华为技术有限公司 一种访问控制方法、装置及系统
CN111695149B (zh) * 2020-05-15 2023-07-28 浙江信网真科技股份有限公司 一种基于云协同的安全过滤方法
US11522754B2 (en) * 2020-09-15 2022-12-06 Arista Networks, Inc. Systems and methods for Zero-Touch Provisioning of a switch in intermediate distribution frames and main distribution frames
US11929903B2 (en) 2020-12-29 2024-03-12 VMware LLC Emulating packet flows to assess network links for SD-WAN
US11792127B2 (en) 2021-01-18 2023-10-17 Vmware, Inc. Network-aware load balancing
US11979325B2 (en) 2021-01-28 2024-05-07 VMware LLC Dynamic SD-WAN hub cluster scaling with machine learning
CN112511569B (zh) * 2021-02-07 2021-05-11 杭州筋斗腾云科技有限公司 网络资源访问请求的处理方法、系统及计算机设备
US20220353190A1 (en) * 2021-04-29 2022-11-03 Vmware, Inc. Methods for micro-segmentation in sd-wan for virtual networks
US11595232B1 (en) * 2021-07-13 2023-02-28 Paul Chang Switch fabric for a data center network having virtual machines
US11943146B2 (en) 2021-10-01 2024-03-26 VMware LLC Traffic prioritization in SD-WAN
CN114124896B (zh) * 2021-11-03 2023-08-08 中盈优创资讯科技有限公司 一种解决客户与服务系统间广播域被隔离方法及装置
CN114051246B (zh) * 2021-11-16 2024-02-20 酒泉钢铁(集团)有限责任公司 基于sdn+vxlan网络与企业5g网络融合的方法
CN114520737B (zh) * 2022-01-26 2024-04-02 北京华信傲天网络技术有限公司 一种无线用户的二层数据访问控制方法及系统
US11909815B2 (en) 2022-06-06 2024-02-20 VMware LLC Routing based on geolocation costs
CN115412319B (zh) * 2022-08-19 2024-03-26 浪潮思科网络科技有限公司 一种基于策略随行的网络权限控制方法、设备及介质

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1878112A (zh) * 2006-07-20 2006-12-13 杭州华为三康技术有限公司 实现虚拟局域网聚合的方法和汇聚交换机
CN101022394A (zh) * 2007-04-06 2007-08-22 杭州华为三康技术有限公司 一种实现虚拟局域网聚合的方法及汇聚交换机
US8675664B1 (en) * 2011-08-03 2014-03-18 Juniper Networks, Inc. Performing scalable L2 wholesale services in computer networks using customer VLAN-based forwarding and filtering

Family Cites Families (36)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7009933B2 (en) * 2001-01-30 2006-03-07 Broadcom Corporation Traffic policing of packet transfer in a dual speed hub
CN100433750C (zh) * 2003-03-06 2008-11-12 华为技术有限公司 一种基于用户帐号的网络访问控制方法
US8045566B2 (en) * 2003-08-01 2011-10-25 Hewlett-Packard Development Company, L.P. Automated router load balancing
CN101827008A (zh) * 2009-03-04 2010-09-08 中兴通讯股份有限公司 一种控制以太网地址表刷新次数的方法
BR112012018762B1 (pt) * 2010-05-28 2022-06-21 Huawei Technologies Co., Ltd Sistema, componente de rede e método para promover uma comunicação entre uma pluralidade de domínios de acesso
CN103262485A (zh) * 2010-12-16 2013-08-21 日本电气株式会社 交换设备、交换设备的上层设备、网络和分组转发方法
US9379975B2 (en) * 2011-01-05 2016-06-28 Nec Corporation Communication control system, control server, forwarding node, communication control method, and communication control program
US8763075B2 (en) * 2011-03-07 2014-06-24 Adtran, Inc. Method and apparatus for network access control
JP5395833B2 (ja) 2011-03-14 2014-01-22 株式会社東芝 仮想ネットワークシステム及び仮想通信制御方法
WO2012133290A1 (ja) * 2011-03-31 2012-10-04 日本電気株式会社 コンピュータシステム、及び通信方法
CN102255918A (zh) * 2011-08-22 2011-11-23 神州数码网络(北京)有限公司 一种基于DHCP Option 82的用户接入权限控制方法
JP5484427B2 (ja) 2011-10-27 2014-05-07 株式会社日立製作所 ネットワークシステムの管理方法、ネットワークシステム及び管理サーバ
CN102404346A (zh) * 2011-12-27 2012-04-04 神州数码网络(北京)有限公司 一种互联网用户访问权限的控制方法及系统
CA2775804C (en) * 2012-05-08 2013-01-29 Guest Tek Interactive Entertainment Ltd. Automatically configuring computer network at hospitality establishment with reservation-specific settings
US8751650B2 (en) 2012-05-10 2014-06-10 Cisco Technology, Inc. Method and apparatus for supporting access control lists in a multi-tenant environment
US9210079B2 (en) * 2012-08-14 2015-12-08 Vmware, Inc. Method and system for virtual and physical network integration
JP6060688B2 (ja) * 2013-01-10 2017-01-18 富士通株式会社 転送装置、通信システム、および迂遠経路検知方法
US20140233569A1 (en) * 2013-02-15 2014-08-21 Futurewei Technologies, Inc. Distributed Gateway in Virtual Overlay Networks
US9325610B2 (en) * 2013-03-15 2016-04-26 Cisco Technology, Inc. Extended tag networking
US9203738B2 (en) * 2013-05-21 2015-12-01 Cisco Technology, Inc. Optimal forwarding for trill fine-grained labeling and VXLAN interworking
CN104380667B (zh) * 2013-06-14 2017-09-12 华为技术有限公司 一种数据报文的路由方法和设备
US9374323B2 (en) * 2013-07-08 2016-06-21 Futurewei Technologies, Inc. Communication between endpoints in different VXLAN networks
CN104869065B (zh) * 2014-02-26 2020-04-21 中兴通讯股份有限公司 数据报文处理方法及装置
CN105471740B (zh) * 2014-07-09 2018-10-12 新华三技术有限公司 基于软件定义网络的网关迁徙处理方法及装置
US9825878B2 (en) * 2014-09-26 2017-11-21 Cisco Technology, Inc. Distributed application framework for prioritizing network traffic using application priority awareness
CN105450532B (zh) * 2014-09-28 2018-10-09 新华三技术有限公司 软件定义网络中的三层转发方法及装置
CN105577548B (zh) * 2014-10-10 2018-10-09 新华三技术有限公司 一种软件定义网络中报文处理方法和装置
US9781004B2 (en) * 2014-10-16 2017-10-03 Cisco Technology, Inc. Discovering and grouping application endpoints in a network environment
CN105656796B (zh) * 2014-11-25 2019-01-22 新华三技术有限公司 实现虚拟扩展局域网三层转发的方法和装置
US9621577B2 (en) * 2015-05-28 2017-04-11 Microsoft Technology Licensing, Llc Mitigation of computer network attacks
WO2017069736A1 (en) * 2015-10-20 2017-04-27 Hewlett Packard Enterprise Development Lp Sdn controller assisted intrusion prevention systems
US10298490B2 (en) * 2015-12-09 2019-05-21 Cisco Technology, Inc. Coexistence and migration of legacy ethernet and overlay networks
US10432628B2 (en) * 2016-02-23 2019-10-01 Cisco Technology, Inc. Method for improving access control for TCP connections while optimizing hardware resources
US10200278B2 (en) * 2016-03-02 2019-02-05 Arista Networks, Inc. Network management system control service for VXLAN on an MLAG domain
US10142163B2 (en) * 2016-03-07 2018-11-27 Cisco Technology, Inc BFD over VxLAN on vPC uplinks
US10270778B2 (en) * 2016-03-21 2019-04-23 Google Llc Methods and systems for dynamic creation of access control lists

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1878112A (zh) * 2006-07-20 2006-12-13 杭州华为三康技术有限公司 实现虚拟局域网聚合的方法和汇聚交换机
CN101022394A (zh) * 2007-04-06 2007-08-22 杭州华为三康技术有限公司 一种实现虚拟局域网聚合的方法及汇聚交换机
US8675664B1 (en) * 2011-08-03 2014-03-18 Juniper Networks, Inc. Performing scalable L2 wholesale services in computer networks using customer VLAN-based forwarding and filtering

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3451612A4 *

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2020005256A (ja) * 2018-06-26 2020-01-09 華為技術有限公司Ｈｕａｗｅｉ Ｔｅｃｈｎｏｌｏｇｉｅｓ Ｃｏ．，Ｌｔｄ． Ｖｘｌａｎ実装方法、ネットワークデバイス、および通信システム
JP2021145345A (ja) * 2018-06-26 2021-09-24 華為技術有限公司Huawei Technologies Co., Ltd. Ｖｘｌａｎ実装方法、ネットワークデバイス、および通信システム
US11271779B2 (en) 2018-06-26 2022-03-08 Huawei Technologies Co., Ltd. VXLAN implementation method, network device, and communications system
US11563603B2 (en) 2018-06-26 2023-01-24 Huawei Technologies Co., Ltd. VXLAN implementation method, network device, and communications system
US11888652B2 (en) 2018-06-26 2024-01-30 Huawei Technologies Co., Ltd. VXLAN implementation method, network device, and communications system

Also Published As

Publication number Publication date
JP6648308B2 (ja) 2020-02-14
EP3451612B1 (en) 2021-03-03
CN107332812B (zh) 2020-07-07
JP2019516320A (ja) 2019-06-13
US11025631B2 (en) 2021-06-01
EP3451612A1 (en) 2019-03-06
CN107332812A (zh) 2017-11-07
US20190132322A1 (en) 2019-05-02
EP3451612A4 (en) 2019-03-20

Similar Documents

Publication Publication Date Title
WO2017186181A1 (zh) 网络访问控制
EP3499799B1 (en) Forwarding policy configuration
US10320838B2 (en) Technologies for preventing man-in-the-middle attacks in software defined networks
US9900263B2 (en) Non-overlay resource access in datacenters using overlay networks
US9374323B2 (en) Communication between endpoints in different VXLAN networks
US9730269B2 (en) Method and system for partitioning wireless local area network
KR102054338B1 (ko) 개별 관리들을 이용하는 vlan 태깅된 패킷들의 가상 포워딩 인스턴스들의 원단 주소들로의 라우팅
US8718071B2 (en) Method to pass virtual local area network information in virtual station interface discovery and configuration protocol
EP2905930B1 (en) Processing method, apparatus and system for multicast
US20190238508A1 (en) Unified security policies across virtual private clouds with overlapping ip address blocks
US20150124823A1 (en) Tenant dhcp in an overlay network
US11228558B2 (en) Method and apparatus for isolating transverse communication between terminal devices in intranet
EP3282667B1 (en) Generating a vnf for authorizing service
CN106559292A (zh) 一种宽带接入方法和装置
US9641417B2 (en) Proactive detection of host status in a communications network
EP2584742B1 (en) Method and switch for sending packet
US20160080318A1 (en) Dynamic host configuration protocol release on behalf of a user
US11438268B2 (en) Server-based local address assignment protocol
CN115442184B (zh) 一种接入系统及方法、接入服务器、系统及存储介质
US20230283589A1 (en) Synchronizing dynamic host configuration protocol snoop information
JP6865266B2 (ja) 機器検知方法、ｓｄｎコントローラ及び記憶媒体
US9438475B1 (en) Supporting relay functionality with a distributed layer 3 gateway
WO2021037358A1 (en) Virtual local presence based on l3 virtual mapping of remote network nodes
US20230006998A1 (en) Management of private networks over multiple local networks
US20220103424A1 (en) Dynamic User Private Networks of a Shared Virtual Network

Legal Events

Date Code Title Description
ENP Entry into the national phase

Ref document number: 2018556323

Country of ref document: JP

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE

WWE Wipo information: entry into national phase

Ref document number: 2017788833

Country of ref document: EP

ENP Entry into the national phase

Ref document number: 2017788833

Country of ref document: EP

Effective date: 20181129

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17788833

Country of ref document: EP

Kind code of ref document: A1