WO2017219272A1

WO2017219272A1 - Packet forwarding method and device

Info

Publication number: WO2017219272A1
Application number: PCT/CN2016/086696
Authority: WO
Inventors: 邹成钢; 余劲锋; 练海春; 郭成绪
Original assignee: 华为技术有限公司
Priority date: 2016-06-22
Filing date: 2016-06-22
Publication date: 2017-12-28

Abstract

Disclosed are a packet forwarding method and device. The method comprises: receiving a first packet of a virtual network, the first packet carrying an external virtual local area network identifier (VLANID); determining an internal VLANID corresponding to the first packet, the internal VLANID indicating an identifier of the first packet in an internal virtual network, and the internal VLANID corresponding to the external VLANID; incorporating the internal VLANID into a second packet to generate the second packet; and sending the second packet to a general processing unit (GPU). The packet forwarding method and device of the embodiments of the present invention can improve network security and reduce the complexity of network operation and maintenance, thereby ensuring isolation within the network.

Description

Method and device for forwarding messages

Technical field

The present invention relates to the field of information communication technology ICT, and more particularly to a method and apparatus for forwarding messages.

Background technique

The virtualization of telecommunications functions is a strong demand of current operators and represents the evolution of business networks. Even if the telecommunication function is virtualized, the communication function between the internal device of the telecommunication device (network element) and the telecommunication device is indispensable, for example, within the virtualized network function (VNF). Between the VNFs and the physical or physical network function modules (PNFs), communication functions are still required to implement different network functions (Network Function, referred to as "NF") or physical functions. (Physical Function, referred to as "PF"). In a virtualized scenario, when communicating between NEs, you need to network the user's virtual local area network identifier (VLANID) and the system's virtual local area network identifier (VLANID) to implement users (external virtual networks) and systems (internal virtual networks). ) Communication between.

However, in the prior art, the VLAN ID of the virtual network inside the virtual network is uniformly planned with the VLAN ID of the external virtual network, that is, the system uses the same VLAN ID as the user, which not only affects the security of the network, but also increases The complexity of network maintenance.

Summary of the invention

The embodiment of the invention provides a method and a device for forwarding a packet, which can improve network security and reduce network operation and maintenance complexity.

The first aspect provides a method for forwarding a message, including:

Receiving a first packet of the virtual network, where the first packet carries an external virtual local area network identifier VLANID;

Determining an internal VLAN ID corresponding to the first packet, where the internal VLAN ID indicates an identifier corresponding to the first packet in the internal virtual network, where the internal VLAN ID corresponds to the external VLAN ID;

The internal VLAN ID is included in the second packet to generate the second packet.

The second message is sent to the general purpose processing board GPU.

In the method for forwarding a packet, the universal interface board GIU receives the first packet, and the first packet carries the external virtual local area network identifier VLAN ID, and then determines the internal VLAN ID corresponding to the first packet. The VLAN ID indicates the corresponding identifier of the first packet in the internal virtual network, and the internal VLAN ID is included in the second packet, and the second packet is generated, and the second packet is sent to the GPU of the general processing device, and the internal VLAN ID is used. The external network ID isolates the internal network and the external network of the virtual network to improve the security of the network. This prevents users from planning the external network VLAN ID without being restricted by the internal VLAN ID specification, thus reducing the complexity of network maintenance.

In the embodiment of the present invention, the network type of the virtual network may be a VLAN virtual network or a trunk Trunk virtual network.

In the embodiment of the present invention, the first packet may be a packet carrying a VLAN ID. Optionally, if the packet received by the port does not carry a VLANID packet (when the virtual network is a Flat virtual network), the packet may be first The VLAN ID packet is carried as a VLAN ID packet, and then the subsequent action is performed.

The method for forwarding a packet in the embodiment of the present invention can improve the security of the network by determining the internal VLAN ID corresponding to the first packet and isolating the internal network and the external network of the virtual network according to the internal VLAN ID.

In some possible implementations, optionally, the method further includes:

Receiving a third packet sent by the GPU, where the third packet is a packet obtained by the GPU after processing the fourth packet, where the fourth packet is used by the GPU to strip the second packet from the internal VLAN ID and a packet sent to the VM VM, where the third packet carries the internal VLAN ID;

Converting the third packet into a fifth packet, where the fifth packet carries the external VLAN ID;

Send the fifth message to the external port.

Here, the GPU strips the internal VLAN ID of the second packet to obtain the fourth packet, and then sends the fourth packet to the virtual machine VM in the GPU to obtain the data frame of the virtual machine, and the GPU uses the data. The frame or untag packet (corresponding to the fourth packet) is tagged with the internal VLAN ID to obtain a third packet and sent to the GIU. After receiving the third packet, the GIU converts the third packet into the fifth packet, so that the fifth packet carries the external VLAN ID, and finally sends the fifth packet to the external port. In this case, the packet is forwarded from the external network to the internal network, and then forwarded from the internal network to the external network. The correspondence between the internal VLAN ID and the external VLAN ID can always be followed to complete the forwarding. Thereby, the isolation of the internal virtual network and the external virtual network is completed, and the security of the network is ensured. Moreover, the planning of the external VLAN ID is not limited by the internal VLAN ID, as long as there is a correspondence, the complexity of network maintenance is reduced.

In some possible implementations, after receiving the first packet of the virtual network, the method further includes:

Determining an isolation rule according to the network type of the virtual network, where the isolation rule includes an identifier corresponding to the identifier of the internal VLAN ID and the external VLAN ID;

The internal VLAN ID is included in the second packet, including:

The internal VLAN ID is included in the second packet according to the isolation rule, and the second packet is generated.

The GIU can determine the isolation rule according to different network types of the virtual network. For example, a VLAN virtual network and a trunk virtual network, the isolation rule includes the correspondence between the internal VLAN ID of the packet and the identifier of the external VLAN ID, and then includes the internal to the second according to the isolation rule. In the message, the second message is generated.

Optionally, in some possible implementations, the internal VLAN ID is included in the second packet according to the isolation rule, and the second packet is generated, including:

And replacing the external VLAN ID of the first packet with the internal VLAN ID according to the WLAN mapping rule, and generating the second packet, where the virtual local area network mapping rule is the isolation rule.

Here, when the virtual network is a VLAN network type, the GIU can directly replace the external VLAN ID of the first packet with the first internal VLAN ID by using a virtual local area network mapping rule (VLAN mapping rule) to generate the second packet.

Adding the internal VLAN ID to the first packet according to the stacking virtual local area network rule, generating the second packet, where the stacking virtual local area network rule is the isolation rule.

Here, when the virtual network is a trunk network type, the GIU can add a first internal VLAN ID to obtain a second packet by adding a virtual local area network rule (QinQ rule).

The second aspect provides a method for forwarding a message, including:

Receiving, by the GIU of the universal interface board, the internal VLAN ID corresponding to the first packet, the second packet generated by the second packet, where the internal VLAN ID indicates the corresponding identifier of the first packet in the internal virtual network, where The internal VLAN ID corresponds to the external VLAN ID of the first packet. of;

Processing the second packet to obtain a third packet, where the third packet carries the internal VLAN ID;

Sending the third message to the GIU.

In the method for forwarding a packet, the GPU of the general-purpose processing board receives the second packet sent by the GIU, and the second packet is generated by the GIU after the internal VLAN ID corresponding to the first packet is included in the second packet. Then, the GPU processes the second packet to obtain a third packet, and sends the third packet to the GIU.

In some possible implementations, the second packet is processed to obtain a third packet, including:

After the second packet is stripped of the internal VLAN ID, the fourth packet is obtained, and the fourth packet is sent to the virtual machine VM.

Obtaining a data frame of the VM, where the data frame of the VM corresponds to the fourth message;

The internal VLAN ID is added to the fourth packet to obtain the third packet.

After receiving the second packet, the GPU strips the internal VLAN ID of the second packet to the virtual machine, obtains the data frame of the VM, and adds the internal VLAN ID to the data frame of the VM. The third message is configured to send the third message to the GIU.

The third aspect provides a method for forwarding a message, including:

Receiving a packet of the flat virtual network that does not carry the VLAN ID of the virtual local area network;

Transmitting the packet carrying the VLAN ID into the packet carrying the VLAN ID, where the packet carrying the VLAN ID includes the first packet or the second packet, where the virtual local area network identifier of the first packet is the first VLAN ID. The virtual local area network identifier of the second packet is a second VLAN ID, and the first VLAN ID and the second VLAN ID correspond to different virtual machine VMs;

Sending the first packet and the second packet to a general-purpose processing board GPU.

In the embodiment of the present invention, the virtual network is a Flat network. When there is an isolation requirement between different VMs in the Flat network, the GIU converts the received packet that does not carry the VLAN ID of the virtual local area network into a packet carrying the VLAN ID. The packet carrying the VLAN ID includes the first packet or the second packet, where the virtual local area network identifier corresponding to the first packet is the first VLAN ID, and the virtual local area network identifier corresponding to the second packet is the second VLAN ID. The first VLAN ID is different from the second VLAN ID, and finally the first packet and the second packet are sent to the GPU. The first VLAN ID and the second VLAN ID are VLAN IDs corresponding to different VMs. Therefore, different VMs in the Flat network are network-isolated by introducing the first VLAN ID and the second VLAN ID to satisfy Network isolation requirements between different VMs.

Here, the first VLAN ID and the second VLAN ID may be determined by using VLAN Mapping.

Here, considering the isolation request between different VMs inside Flat, internal isolation is performed by VLANID. For example, the first VM and the second VM are isolated by the first internal VLAN ID and the second internal VLAN ID.

In some possible implementations, optionally, the method further includes:

And receiving, by the GPU, a fourth packet processed by the third packet, where the third packet is sent by the GPU to the first VLAN ID and sent to the first virtual machine VM. The fourth packet carries the first VLANID;

And receiving the sixth packet processed by the GPU, where the fifth packet is sent by the GPU to the second VLAN ID and sent to the second virtual machine VM. The sixth packet carries the second VLAN ID, where the second VM is different from the first VM;

Sending the fourth packet and the sixth packet to an external port.

The GIU receives the fourth packet processed by the GPU and processes the third packet, and the third packet is sent by the GPU to the first VLAN ID and sent to the first virtual machine VM. The packet carries the first VLAN ID. That is, the GPU obtains the third packet after the first packet is removed from the first packet, and sends the third packet to the internal VM, and then receives the corresponding data frame from the first VM (corresponding to the third packet). The fourth packet obtained by marking the third packet with the first VLANID is forwarded to the GIU. The GIU sends the fourth message to the external port. Similarly, the packet forwarding of the second VM is also processed correspondingly, except that the second VM corresponds to the second VLAN ID. Therefore, in the process of packet forwarding from the GPU to the GIU, network isolation between different VMs is also implemented.

The fourth aspect provides a method for forwarding a message, including:

Receiving, by the GIU, the packet sent by the GIU that does not carry the VLAN ID of the virtual local area network is converted into the packet carrying the VLAN ID, where the packet carrying the VLAN ID includes the first packet or the second packet, where the first packet is received. The virtual local area network identifier is a first VLAN ID, and the virtual local area network identifier of the second packet is a second VLAN ID, and the first VLAN ID and the second VLAN ID correspond to different virtual machine VMs;

After the third packet is processed, the fourth packet is obtained, and the third packet is a packet that is stripped of the first VLAN ID, and the fourth packet carries the first VLAN ID.

After processing the fifth packet, the sixth packet is obtained, and the fifth packet is stripped of the second packet. The second VLANID packet, where the sixth packet carries the second VLAN ID;

Sending the fourth packet and the sixth packet to the GIU.

In the embodiment of the present invention, for the virtual network is a Flat network, the GPU receives the packet carrying the VLAN ID, and the packet carrying the VLAN ID includes the first packet or the second packet, where the first packet is received by the GIU. Corresponding to the first VLAN ID, the second packet corresponds to the second VLAN ID, and the first VLAN ID is different from the second VLAN ID. After the GPU strips the first packet, the GPU obtains the third packet, and then processes the third packet to obtain the fourth packet. The fourth packet carries the first VLAN ID, and the fourth packet carries the fourth packet. Send to GIU. Similarly, the sixth packet is obtained in the same manner as the fourth packet, except that the sixth packet carries the second VLAN ID.

The method for forwarding a packet in the embodiment of the present invention isolates different VMs in the Flat network by introducing a first VLAN ID and a second VLAN ID to meet network isolation requirements between different VMs.

The fifth aspect provides an apparatus for forwarding a message, which is used to perform the method in any of the foregoing first aspect or any possible implementation manner of the first aspect, or to perform any of the foregoing third or third aspect The method in the implementation. In particular, the apparatus comprises means for performing the method of any of the first aspect or the first aspect of the first aspect described above, or the apparatus comprises any possible implementation for performing the third or third aspect described above The unit of the method.

The sixth aspect provides an apparatus for forwarding a message, which is used to perform the method in any of the foregoing possible aspects of the second aspect or the second aspect, or to perform any of the foregoing fourth or fourth aspects The method in the implementation. In particular, the apparatus comprises means for performing the method of any of the above-described second or second aspects of the second aspect, or the apparatus comprises any possible implementation for performing the fourth or fourth aspect described above The unit of the method in the way.

In a seventh aspect, an apparatus for forwarding a message is provided. The device includes a processor, a memory, and a communication interface. The processor is coupled to the memory and communication interface. The memory is for storing instructions for the processor to execute, and the communication interface is for communicating with other network elements under the control of the processor. When the processor executes the instructions stored by the memory, the execution causes the processor to perform the method of the first aspect or any of the possible implementations of the first aspect.

In an eighth aspect, a computer readable medium is provided for storing a computer program, the computer program comprising instructions for performing the method of the first aspect or any of the possible implementations of the first aspect.

DRAWINGS

In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings to be used in the embodiments of the present invention will be briefly described below. It is obvious that the drawings described below are only some embodiments of the present invention, Those skilled in the art can also obtain other drawings based on these drawings without paying any creative work.

FIG. 1 is a schematic structural diagram of a specific networking scenario according to an embodiment of the present invention.

2 is a schematic diagram of an example of a conventional process of forwarding a message in a virtualization scenario.

FIG. 3 is a schematic flowchart of a method for forwarding a message according to an embodiment of the present invention.

4 is a schematic diagram of a specific example in accordance with an embodiment of the present invention.

FIG. 5A is a schematic diagram of an example of forwarding messages by different mapping rules.

Figure 5B is a schematic illustration of another specific example in accordance with an embodiment of the present invention.

FIG. 6 is a schematic flowchart of a method for forwarding a message according to an embodiment of the present invention.

Figure 7 is a schematic illustration of another specific example in accordance with an embodiment of the present invention.

FIG. 8 is a schematic block diagram of an apparatus for forwarding a message according to an embodiment of the present invention.

FIG. 9 is a schematic block diagram of an apparatus for forwarding a message according to an embodiment of the present invention.

FIG. 10 is a structural diagram of an apparatus for forwarding a message according to an embodiment of the present invention.

FIG. 11 is a structural diagram of an apparatus for forwarding a message according to still another embodiment of the present invention.

detailed description

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is obvious that the described embodiments are a part of the embodiments of the present invention, but not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

The technical solution of the present invention can be applied to a scenario of a virtualization technology. Specifically, it includes network function virtualization ("NFV") technology in the virtualization of telecommunications functions. NFV borrows IT virtualization technology, and many types of network devices can be incorporated into industry standards such as servers, switches, and storage, which can be deployed in data centers, network nodes, or users' homes. This requires network functions to be implemented in software and run on a range of industry-standard server hardware that can be migrated, instantiated, and deployed in different locations on the network as needed without the need to install new devices. The ultimate goal of NFV is to replace those privately-owned network element devices of the communication network with industry-standard x86 servers, storage and switching equipment. The advantage of this is that on the one hand, the IT equipment based on the x86 standard is low in cost, which can save the operator a huge investment cost, and on the other hand, an open application programming interface (Application Programming Interface (API) interface). It can also help operators gain more and more flexible network capabilities. Through software and hardware decoupling and functional abstraction, network device functions are no longer dependent on dedicated hardware. Resources can be fully and flexibly shared, enabling rapid development and deployment of new services, and automatic deployment, elastic scaling, and fault isolation based on actual business requirements. And self-healing.

For example, FIG. 1 shows a schematic structural diagram of a specific networking scenario according to an embodiment of the present invention. It should be understood that only FIG. 1 is taken as an example here, but does not constitute a limitation of the present invention. The data center (Data Center, referred to as "DC") includes DC1 and DC2. DC1 and DC2 are different virtual centers or data centers. DC1 includes two physical devices Host (that is, physically existing computers): Host1 and Host2, DC2 includes The three physical devices: Host1, Host2, and Host3; the virtualized network function (VNF) includes VNF1 (corresponding to a virtual network) and VNF2. The virtual network function VNF1 includes three virtual machines ( Virtual Machine (VM): VM1, VM2, and VM3. VNF2 includes three virtual machines: VM4, VM5, and VM6. VM1 is connected to VNF1-NET1, and VNF1-NET1 is connected to the external network through the GPU panel port. For example, External Network-DC1) is connected separately; VM1, VM2, VXLAN Gateway1 is connected to VNF1-NET2, VXLAN Gateway1 is connected to VXLAN-NET1-DC1, VM3, VXLAN Gateway2 is connected to VXLAN-NET1-DC2, VXLAN-NET1-DC1 and VXLAN-NET1-DC2 is connected to external network 2 (for example, External Network-DC12); VM3 and VM4 are connected to Shared-Net1, which is connected to external network 3 (for example, External Network2-DC2); VM4, VM5, VM6 are connected. to VNF2-Net3; VM6 is connected to VNF2-NET2, and VNF2-NET2 is connected to an external network 4 (for example, External Network3-DC2) through a general processing unit ("GPU") panel port. In Figure 1, when the external network is connected to the corresponding virtual network through the interface of the General Interface Unit (GIU), you need to use the same VLAN ID as the corresponding virtual network. VNF1-NET1 is in physical network 1, VNF1-NET2, VNF1-NET3, VNF2-NET2, VNF2-NET3, etc. in physical network 2. In other words, in Figure 1, the virtual network where VNF1-NET1 is located is not in the same physical network as the other virtual networks. The virtual network where VNF1-NET1 is located may be a VLAN type or a Flat network type. In addition, the lower end of each external network can continue to connect different network functions ("Network" (referred to as "NF") (not shown), which is not limited.

In the above networking scenario, the virtual network (L2 network) provides an interworking port of L2. Each virtual network consists of a port (network function VF, port or sub-port corresponding to the physical function PF) connected to the virtual network, and a VLAN accessed by these ports. The internal network of the virtual network can be understood as the internal network of the system, and the external network can be understood as the network planned by the user.

In the networking scenario, the VNF is composed of multiple components deployed on one or more VMs, and the network element functions in the traditional network, such as the Mobility Management Entity (MME) in the 3GPP EPC. The service gateway (Serving GateWay, abbreviated as "S-GW") and the PDN gateway (PDN GateWay, abbreviated as "P-GW") are virtualized. Virtual network functionality is a concept about network architecture. This function utilizes virtualization technology to split the functions of the network node level into several functional blocks, which are implemented in software, and the service deployment is converted into software deployment, which is no longer limited to the hardware architecture. VNF can help organizations dynamically configure the network on demand, regardless of the underlying architecture, and the automation management and agility of the telecommunications network will be greatly enhanced.

It should be understood that the technical solution of the present invention can be applied to a virtual network scenario in which an internal and external network needs to be isolated, which is not limited thereto.

In the embodiment of the present invention, the virtual network may be a different network type. For example, a virtual local area network (Virtual Local Area Network, referred to as "VLAN") virtual network, a Flat virtual network, an extended virtual local area network (VxLAN virtual network), or a trunked trunk virtual network. The VLAN virtual network is a network isolated by using a virtual network identifier VLAN ID in a physical network. That is, one physical network can correspond to multiple VLAN virtual networks. The Flat virtual network corresponds to one physical network and does not use VLAN division. That is to say, one physical network can only correspond to one Flat virtual network. The VxLAN virtual network is a network isolated by VxLAN. This virtual network type is only supported when the host accesses the Open Virtual Switch (Open VSwitch, or "OVS"). VxLAN cannot be used when using Netmap to drive through. Network; VxLAN is introduced to solve the limitation of the number of VLANIDs. The number of VLAN IDs supports up to 4K networks. A trunk virtual network is a network that is isolated by using multiple VLAN IDs in a physical network. That is to say, one physical network may also correspond to multiple trunk virtual networks. Unlike a VLAN virtual network, a trunk virtual network uses multiple VLANID is isolated.

In the embodiment of the present invention, the type of the virtual network may be applied to a Huawei cloud operating system (Fusion Sphere, referred to as "FS") scenario or an embedded universal infrastructure management (Embedded Versatile Infrastructure Management, referred to as "EVM". ") in the scene. The FS scenario is based on the OpenStack cloud operating system. EVM is a software module that provides light-weight system virtualization management in a wireless deployment scenario with less than 5 nodes.

In the embodiment of the present invention, there are many virtualization technologies or concepts that may be involved in different virtual network types, and no limitation is imposed thereon. For example, the embodiment of the present invention can be applied to a hard root virtualization technology (Single root I/O virtualization, abbreviated as "SR-IOV"). Among them, SR-IOV technology is a hardware-based virtualization solution that improves performance and scalability. The SR-IOV standard allows for the efficient sharing of Peripheral Component Interconnect Express ("PCIe") devices between virtual machines, and it is implemented in hardware to achieve performance comparable to native performance. I/O performance. The SR-IOV specification defines a new standard by which new devices are created that allow virtual machines to be directly connected to I/O devices.

For another example, the embodiment of the present invention can be applied to an Elastic Virtual Switch ("EVS"). EVS is a Huawei Virtual Unified Platform (UVP) development. It is an elastic virtual switch based on OVS forwarding technology that improves its IO performance and still conforms to the openflow protocol standard. The IO performance improvement uses the Intel DPDK technology to take over the NIC data transmission and reception through the user state process, adopting the "IO exclusive core" technology, that is, each port is assigned a core dedicated to data forwarding. This polling processing method is better than the middle segment type. The processing is more efficient, and thus the IO performance is significantly improved. Among them, UVP is the key technology platform of Huawei's cloud-based data center solution. It transforms the physical resources of the server, such as CPU, memory, I/O, into a unified management and flexible scheduling by abstracting the physical resources of the server. Dynamically allocated logical resources, and based on these logical resources, build multiple simultaneous, isolated virtual machine execution environments on a single physical server.

The various scenarios or related technologies that may be involved in a virtualization scenario are described earlier. There are some problems in the current virtualization scenario, such as: the user VLAN (such as the external network of the virtual network in Figure 1) is not isolated from the system VLAN (such as the internal network of the virtual network in Figure 1). Generally, in the VLAN ID planning of the virtual local area network, the user VLAN ID and the system VLAN ID are planned in a unified manner, that is, the user VLAN ID and the system VLAN ID share the same VLAN ID. The problem is that when the required isolation of the user VLAN ID and the system VLAN ID are not duplicated (that is, the external virtual network and the internal virtual network are not required to be duplicated), if the unified planning method of the prior art is also adopted, the internal and external network conflicts may be caused. Moreover, this requirement makes the user's external network VLANID planning limited, and the user needs to know and understand the internal network VLANID planning, thereby increasing the complexity of network maintenance. In addition, because the internal network will pre- A part of the VLAN ID is reserved. The reserved part of the VLAN ID does not allow the user to plan the network. Therefore, the user needs to consider the constraints of the internal network, which limits the application planning of the user VLAN ID and affects the user network planning. For example, Figure 2 shows a schematic diagram of an example of a conventional process of forwarding a message in a virtualized scenario. As shown in Figure 2, the Multi-Function Middle-Scale Switch Board (MMX) acts like a switch or route, and forwards the packets received from the GIU to the internal network. The board GPU is processed to complete the packet forwarding process from the external network to the internal network. In Figure 2, the GIU receives the message or data frame through the physical port, and does not perform any processing, and directly transmits it to the MMX. Then the MMX sends the message or data frame sent by the GIU directly to the GPU, and then the GPU will send the message or the data frame. Uploaded to the virtual machine VM. The internal VLAN ID of the packet in Figure 2 shares the same VLAN ID as the user VLAN ID, resulting in no isolation between the internal network and the external network. That is to say, in the prior art, the internal network VLAN ID planning of the virtual network is planned in a unified manner with the external network VLAN ID, which increases the complexity of the network planning, and preserves the existence of the address, thereby increasing the constraint of the networking planning. In addition, for the SR-IOV pass-through scenario, the VLAN ID of the VLAN network type does not support dynamic modification. Once the user network planning changes, it can only go online and offline again, which has a greater impact. Therefore, the present invention proposes a method for forwarding a message for these problems, so that the internal network of the virtual network can be automatically isolated from the external network.

FIG. 3 shows a schematic flowchart of a method 300 for forwarding a message according to an embodiment of the present invention. The method 300 can be performed by a GIU. As shown in FIG. 3, the method 300 includes:

S310, receiving a first packet of the virtual network, where the first packet carries an external virtual local area network identifier VLANID;

The first packet may be a packet of an external network of the virtual network received by the GIU. The packets may be received in different forms for different scenarios of different virtual network types or different virtual network types. For example, for a VLAN virtual network type, the received packets are VLAN packets and no conversion is required. For example, for an EVM scenario in the Flat virtual network type, data frames that do not carry a VLAN ID are received. Therefore, the data frame needs to be converted into a VLAN packet on the GIU port. That is to say, there is no restriction on the form of the first message, as long as it can be reasonably obtained at the end is acceptable.

S320, determining an internal VLAN ID corresponding to the first packet, where the internal VLAN ID indicates a corresponding identifier of the first packet in the internal virtual network, where the internal VLAN ID corresponds to the external VLAN ID;

The GIU determines the internal VLAN ID corresponding to the first packet. The so-called internal VLANID is the first report The internal VLAN ID corresponding to the external VLAN ID of the text. That is, the VLAN ID of the first packet on both the internal network and the external network, and the VLAN ID (first internal VLAN ID) of the internal network exists or satisfies the correspondence (or mapping relationship) with the VLAN ID of the external network. In this way, the VLAN ID of the internal network of the first packet and the VLAN ID of the external network do not have to be exactly the same, as long as there is a correspondence between them.

S330. The first internal VLAN ID is included in the second packet, and the second packet is generated.

The GIU includes the internal VLAN ID in the second packet to generate the second packet, saying that the GIU covers the internal VLAN ID to the second packet by some form (for example, a replacement or a new form), so that the GIU When the message is sent to the internal network (or general purpose processing board GPU), the GPU can know the internal VLAN ID.

S340. Send the second packet to a general-purpose processing board GPU.

In the embodiment of the present invention, the GIU determines the first internal VLAN ID corresponding to the first packet by receiving the first packet, and the first internal VLAN ID is included in the second packet to generate the second packet. The second packet is sent to the GPU of the general-purpose processing board. By isolating the internal network and the external network of the virtual network, the security of the network can be enhanced and the network operation and maintenance complexity can be reduced.

It should be understood that, in various embodiments of the present invention, the size of the sequence numbers of the above processes does not mean the order of execution, and the order of execution of each process should be determined by its function and internal logic, and should not be directed to the embodiments of the present invention. The implementation process constitutes any limitation.

It should also be understood that the numbers "first" and "second" in the embodiment of the present invention are only for distinguishing different objects, for example, distinguishing different messages, or virtual machine VMs, or VLAN IDs, and do not limit the present invention. .

Optionally, the method further includes:

Receiving a third packet sent by the GPU, where the third packet is a packet processed by the GPU for the fourth packet, where the fourth packet is used by the GPU to strip the second packet from the internal VLAN ID. a packet sent to the VM VM, where the third packet carries the internal VLAN ID;

Send the fifth message to the external port.

Specifically, the GIU can receive the third packet sent by the GPU, where the third packet is the GPU that processes the fourth packet, and the fourth packet is the GPU strips the second packet. The internal VLAN ID is sent to the VM VM. It should be understood that the GPU does not consider the specific use or processing of the VM after receiving the second packet to remove the untag packet of the internal VLAN ID. The GPU only needs to know that the data frame or the untagged packet obtained from the VM is a packet that strips the internal VLAN ID, that is, the GPU only needs to know that the fourth packet is obtained by stripping the internal VLAN ID. . Here, the processing of the fourth packet by the GPU refers to: marking the fourth packet with the internal VLAN ID to obtain a third packet. The GIU converts the received third packet into a fifth packet, so that the fifth packet carries an external VLAN ID. The GIU can convert the third packet to the external VLAN ID to obtain the fifth packet, or obtain the outer VLAN ID after decapsulating the third packet. Fifth message. Finally, the fifth message is sent to the external port.

Therefore, the method for forwarding a packet in the embodiment of the present invention, by determining the internal VLAN ID corresponding to the first packet, and isolating the internal network and the external network of the virtual network according to the internal VLAN ID, can enhance network security and reduce network operation and maintenance complexity. degree.

Optionally, after receiving the first packet of the virtual network, the method further includes:

The internal VLAN ID is included in the second packet, including:

Specifically, the GIU can automatically allocate the isolation rule according to the network type of the virtual network. The network type of the virtual network can be the VLAN virtual network, the trunk virtual network, and the Flat virtual network described above, and the corresponding isolation is automatically determined according to different network types. rule. For example, for a VLAN virtual network and a flat virtual network, the isolation rule can adopt the VLAN mapping rule. For the trunk virtual network, the isolation rule can use the Qinq rule. Of course, this is only an example, and the isolation rules are not limited to this. Then, the GIU includes the internal VLAN ID in the second packet according to the isolation rule to generate the second packet.

Optionally, as an embodiment, the internal VLAN ID is included in the second packet according to the isolation rule, and the second packet is generated, including:

Specifically, the GIU can use the virtual local area network mapping rule to replace the external VLAN ID of the first packet with the internal VLAN ID to obtain the second packet, thereby realizing the replacement of the user VLAN ID and the internal system VLAN ID. For example, the GIU uses VLAN mapping to send the first packet. The external VLAN ID is replaced with the internal VLAN ID to obtain the second packet, which can solve the isolation problem of the internal and external networks. In addition, by re-mapping the user VLAN ID and the internal system VLAN ID through VLAN Mapping, the VLAN ID of the virtual network can be dynamically modified. In this case, it can also solve the problem that the original OpenStack open source code cannot modify the VLANID. That is to say, the problem that OpenStack's open source code cannot be modified is transferred to the outbound interface through VLAN mapping mapping, thereby realizing dynamic modification in disguise. In the embodiment of the present invention, VLAN mapping can solve the problem of isolation of internal and external networks, and can also dynamically modify the VLAN ID, which can be described as two things.

For example, for a VLAN network type, whether it is an FS scenario or an EVM scenario, the GIU can use VLAN mapping rules to replace the internal VLAN ID and the external VLAN ID.

That is to say, in the specific implementation process, when the virtual network is a VLAN network type, the method of obtaining the second packet can adopt the VLAN mapping rule. VLAN mapping (also known as VLAN translation) is a flexible QinQ. Instead of adding a VLAN, different user VLANs are replaced with different VLANs. That is, when a packet is forwarded, there is only one VLAN. The method for forwarding a packet in the embodiment of the present invention when the virtual network is a VLAN network type is described in the following.

FIG. 4 shows a schematic diagram of a specific example according to an embodiment of the present invention. It should be noted that this is only to assist those skilled in the art to better understand the embodiments of the present invention and not to limit the scope of the embodiments of the present invention. As shown in Figure 4, the small black frame in the figure is the physical port. The virtual network is the VLAN network type. The isolation rule is the VLAN mapping rule. The GIU receives the first one at the physical port (the black circle in the figure). The packet is a VLAN packet. The first packet carries the external VLAN ID. The GIU determines the internal VLAN ID of the first packet. When the first packet meets the VLAN mapping rule, the specific action is based on the VLAN mapping rule. The external VLAN ID of the packet is directly replaced with the internal VLAN ID to obtain the second packet. If the first packet does not meet the VLAN mapping rule, the first packet is directly discarded. Then the second packet is forwarded through the MMX. The GPU in the GPU sends the third packet to the VM, and then the third packet is sent to the VM. When the GPU forwards the packet to the GIU through the MMX, the GPU obtains the untag data frame of the VM (corresponding to the third packet), and then the third packet is tagged with the internal VLAN ID to obtain the fourth packet, which is forwarded to the GIU through the MMX. When the GIU receives the fourth message, such as The fourth packet satisfies the rule Mapping VLAN, the interior of the fourth packets VLANID corresponding external replaced VLANID, the fifth packet is received and sent to the external port. In this way, the system network and the user network are isolated by the internal VLAN ID and the external VLAN ID, which avoids limitation of the user network planning. It should be understood that the number of the message here is very flexible, and is only for convenience of description, and there is no problem such as conflict or limitation with the message number of the context.

The application of VLAN mapping rules in virtual networks is described above. When the virtual network is a trunk network type, stack virtual local area network rules (Qinq rules) can be used to isolate the internal network from the external network. An embodiment in which the virtual network is a trunk network type in the embodiment of the present invention will be specifically described below.

Specifically, the GIU may encapsulate the corresponding internal VLAN ID on the outer VLAN ID of the first packet, thereby obtaining the second packet. Here, the GIU may adopt a stacking virtual local area network rule, such as a QinQ rule, to encapsulate a new VLAN ID (internal VLAN ID) on the external VLAN ID of the first packet to obtain a second packet, which can solve the isolation problem of the internal and external networks.

In the embodiment of the present invention, the essence of the QinQ rule is to extend the VLAN protocol. That is, in a VLAN packet, a layer of VLAN is added to form a packet with 2 layers (or even multiple layers) of VLANs. The purpose of QinQ was originally to solve the problem of insufficient VLAN space. At the same time, QinQ also brings three additional benefits: 1) users plan their own inner VLAN to improve deployment; 2) provide a simple Layer 2 VPN function; 3) inner VLAN is not visible, improve security Sex. The frame format of QinQ adds a layer of VLAN tags based on the VLAN frame. The difference between QinQ and VLAN is mainly the “Type” information of the VLAN tag. According to the description of IEEE802.1ad, the value of the QinQ outer VLAN is 0x88a8. For QinQ ports, the VLANs are encapsulated in different applications based on the QinQ technology. (1) Standard QinQ: Port-based QinQ technology. The device encapsulates all the packets allowed on the port and encapsulates the default VLAN of the port. If the user packet does not carry a VLAN, only one layer of VLANs is encapsulated. (2) VLAN stacking: is a flexible QinQ, which is based on the user VLAN to add different outer VLANs. (3) VLAN Mapping: is a flexible QinQ. Instead of adding a VLAN, different user VLANs are replaced with different VLANs. When a packet is forwarded, there is only one VLAN. In order to understand the difference between QinQ rules and VLAN mapping more intuitively, the following description will be made with reference to the example in FIG. 5A. FIG. 5A is a schematic diagram showing an example of forwarding packets by different mapping rules, such as a schematic diagram of an example of a VLAN mapping rule and a QinQ rule. It should be noted that this is only to assist those skilled in the art to better understand the embodiments of the present invention and not to limit the scope of the embodiments of the present invention. As shown in FIG. 5A, the left part of the figure is an example of a VLAN mapping rule, if a message is used (as shown in FIG. 5).

The packet is an example. The external VLAN ID of the Payload can be understood as the payload or the data is Ctag: 1000, and the corresponding internal VLAN ID is Stag: 100. When the packet is forwarded, the GIU determines the VLAN ID of the packet. Replace the internal VLAN ID with the external VLAN ID, that is, the Ctag: 1000 is directly replaced with the Stag: 100. When the VM is sent to the host, the STP: 100 packet is sent out (the host sends the message to the GIU.) The right part of the figure is an example of QinQ, with Ctag100 and Ctag101 (also as shown in Figure 5).

The packet is taken as an example. For Ctag100 and Ctag101, the outer Stag:200 is added, that is, the inner Ctag is unchanged, and the outer Stag is added on the basis of the same, and the VM is sent to the Host. At the same time, the message stripping Stag: 200 is sent (the host does not show the process to the GIU transmission process), and the Ctag is reserved and sent to the VM.

For example, in the FS scenario where the virtual network is a trunk network type, the VLAN transparent transmission mode is adopted to implement the trunk network function. The "VLAN transparent transmission" network requires: only receive data frames within the configured VLANID range and transparently forward them. In this way, the external data frame is transparently transmitted to the internal virtual network, and the internal network and the external network cannot be isolated. However, the VLAN ID of the virtual network cannot be dynamically modified. In this scenario, the embodiment of the present invention uses the QinQ rule to isolate the internal and external networks. Here, the virtual network of FIG. 5B is used to describe the packet forwarding process of the trunk network type. FIG. 5B shows a schematic diagram of another example of message forwarding in accordance with an embodiment of the present invention. As shown in FIG. 5B, the first packet received by the GIU at the entrance of the physical port (the black circle in the figure) is a VLAN packet, and the first packet carries an external VLAN ID; the GIU determines the internal VLAN ID of the first packet. When the first packet satisfies the quarantine rule (for example, the quarantine rule used by the VRRP network type is the QinQ rule), the specific action is to encapsulate the outer VLAN ID of the first packet on the outer VLAN ID according to the QinQ rule. In order to obtain the second packet, if the first packet does not satisfy the QinQ rule, the first packet is directly discarded; then the second packet is forwarded to the virtual machine VM in the GPU through the MMX, and sent on the virtual machine VM. When the VM is given to the GPU, the GPU decapsulates the newly encapsulated internal VLAN ID of the second packet (retains the external VLAN ID), obtains the third packet, and then sends the third packet to the VM; similarly, on the GPU When the MMX forwards the packet to the GIU, the GPU obtains the untag data frame of the VM (corresponding to the third packet), and then encapsulates the outer layer of the third packet with the internal VLAN ID to obtain the fourth packet, which is forwarded by the MMX. The GIU, when receiving the fourth packet, if the fourth packet satisfies the QinQ rule, the GIU decapsulates the internal VLAN ID of the fourth packet (retains the external VLAN ID), obtains the fifth packet, and sends the packet. To the external port. In this way, the system network and the user network are isolated by the internal VLAN ID and the external VLAN ID, which avoids limitation of the user network planning.

In addition, for the EVM scenario in which the virtual network is a trunk network type, the QinQ rule can also be used for processing, and details are not described herein.

The difference between a virtual network and a VLAN network type is that the rules adopted by the trunk network type are different. The VLAN network type uses the VLAN mapping rule (that is, direct replacement), and the trunk network type uses the QinQ rule (that is, the outer package encapsulates the new VLANID). Here, different isolation rules can be selected for the network types of different virtual networks. Certainly, the network type of the virtual network and the type of the quarantine rule are not limited, and the reasonable quarantine rule corresponding to the virtual network may be selected according to the actual situation, which is not limited by the present invention.

Therefore, the method for forwarding a packet in the embodiment of the present invention can improve the security of the network by isolating the internal VLAN ID corresponding to the first packet and isolating the internal network and the external network of the virtual network according to the internal VLAN ID.

A method for forwarding a message according to an embodiment of the present invention is described below from the GPU side in conjunction with FIG. FIG. 6 shows a schematic diagram of a method of forwarding a message according to an embodiment of the present invention. The method 600 is performed by a GPU, as shown in FIG. 6, the method 600 includes:

S610, the receiving, by the GIU, the internal VLAN ID corresponding to the first packet, and the second packet generated by the second packet, where the internal VLAN ID indicates the corresponding identifier of the first packet in the internal virtual network. The internal VLAN ID is corresponding to the external VLAN ID of the first packet.

S620, the second packet is processed to obtain a third packet, where the third packet carries the internal VLAN ID;

S630. Send the third packet to the GIU.

In the embodiment of the present invention, the GPU receives the second packet sent by the GIU, and the second packet is generated by the GIU after the internal VLAN ID corresponding to the first packet is included in the second packet. After receiving the second packet, the GPU processes the second packet to obtain a third packet, so that the first packet is obtained. The third packet carries the internal VLAN ID, and finally sends the third packet to the GIU.

The method for forwarding a packet in the embodiment of the present invention, by determining an internal VLAN ID corresponding to the first packet, and isolating the internal network and the external network of the virtual network according to the internal VLAN ID, can enhance network security and reduce network operation and maintenance complexity.

Optionally, the second packet is processed to obtain a third packet, including:

The internal VLAN ID is added to the fourth packet to obtain the third packet.

Specifically, the GPU performs the stripping process on the received second VLAN ID, and then sends the obtained fourth packet to the virtual machine VM to obtain the data frame (untag message) of the VM. Should be the fourth message. The GPU adds the internal VLAN ID to the fourth packet, and obtains the third packet, and sends the third packet to the GIU, so that the GIU processes the third packet and sends the packet to the external port.

Embodiments in which the internal network and the external network in the virtual network are isolated are described above. The specific case when the virtual network is of the Flat network type in the embodiment of the present invention will be described below. When the virtual network is of the Flat network type, there is only one in the same physical network, so the default Flat internal network is interworking, but consider the existence of Flat network isolation between different VMs. Moreover, there is no problem that the internal network conflicts with the external network VLAN ID, and there is no problem of dynamically modifying the VLAN ID. An embodiment of the isolation requirements between different virtual machines of the Flat virtual network will be described below.

Optionally, as an embodiment, the present invention further provides a method for forwarding a message, which may also be performed by a GIU, where the GIU may be a GIU corresponding to multiple VMs, and the number of GIUs is not limited. It is a VM corresponding to one GIU, or multiple VMs corresponding to one GIU. The method can include:

Transmitting the packet carrying the VLAN ID into the packet carrying the VLAN ID, where the packet carrying the VLAN ID includes the first packet or the second packet, where the virtual local area network identifier of the first packet is the first VLAN ID. The virtual local area network identifier of the second packet is a second VLAN ID. The first VLAN ID and the second VLAN ID correspond to different virtual machine VMs;

Specifically, the GIU needs to convert the packet carrying the VLAN ID into a packet carrying the VLAN ID, such as the first packet, or the packet carrying the VLAN ID of the virtual virtual network. a second packet, where the GIU determines that the virtual local area network identifier of the first packet is the first VLAN ID, and the virtual local area network identifier of the second packet is the second VLAN ID, where the first VLAN ID is different from the second VLAN ID. The virtual machine VM then sends the first message and the second message to the GPU to isolate different VMs.

For example, when the virtual network is of the Flat network type, the GIU converts the packet into a packet carrying the VLAN ID in the manner of the port-base VLAN ID (PVID) PVID=1. The first packet carries the first VLAN ID and the second packet carries the second VLAN ID. The first VLAN ID is different from the second VLAN ID. Different from the VLAN network type, the Flat network type considers the isolation request between different VMs, so different VMs need to be isolated by different VLAN IDs.

In the embodiment of the present invention, for the Flat network type, there is only one in the same physical network, so the default Flat internal network is interworking, but considering the existence of the Flat network isolation between different VMs, it is considered that the internal VLAN mapping is unified to solve the problem. . In the EVM scenario, the data frame carrying the VLAN ID is discarded because the data frame without the VLAN ID is allowed to pass through to the VM. Therefore, there is no problem of dynamically modifying the virtual network VLAN ID and internal network conflicts in the EVM scenario. Only VLAN mapping rules need to be adopted internally to satisfy the requirements of Flat network isolation between different VMs. In the FS scenario, there is no problem that the internal network conflicts with the external network VLANID. In the SR-IOV pass-through scenario, VLAN mapping rules can also be used to satisfy the requirements of Flat network isolation between different VMs.

Therefore, the method for forwarding a packet in the embodiment of the present invention isolates the network between different VMs by using the first VLAN ID and the second VLAN ID, thereby enhancing network security and reducing network operation and maintenance complexity.

Optionally, the method may further include:

Receiving, by the GPU, a sixth packet processed by the fifth packet, where the fifth packet is the The GPU strips the second packet and sends the second VLAN ID to the packet of the second virtual machine VM, where the sixth packet carries the second VLAN ID, and the second VM is different from the first VM.

Sending the fourth packet and the sixth packet to an external port.

Specifically, in a process in which the GPU corresponding to the first VM forwards the packet to the GIU, the GIU may further receive the fourth packet processed by the GPU for the third packet, where the third packet is the GPU. The packet is stripped of the first VLAN ID and sent to the first virtual machine VM. Here, the GPU processes the third packet to replace the third packet with the first VLAN ID to obtain the fourth packet. Similarly, the processing manner for the GPU of the second VM to forward the packet to the GIU is similar to that of the first VM. That is, the GIU can also receive the sixth packet processed by the GPU, and the fifth packet is sent by the GPU to the first VLAN ID and sent to the first virtual machine VM. Text. Here, the GPU processes the fifth packet, and then the third packet is tagged with the first VLAN ID to obtain the sixth packet.

Therefore, the method for forwarding a packet in the embodiment of the present invention isolates networks between different VMs by using the first VLAN ID and the second VLAN ID, thereby enhancing network security.

An embodiment of the isolation requirements between different virtual machines of the Flat virtual network will be described below from the GPU side. Optionally, as an embodiment, the method is performed by a GPU, where the number of GPUs is not limited, and may be multiple or one. The method includes:

After the fifth packet is processed, the sixth packet is obtained, and the fifth packet is used to strip the packet of the second VLAN ID, and the sixth packet carries the second VLAN ID;

Sending the fourth packet and the sixth packet to the GIU.

Specifically, the GPU receives the converted VLAN ID-enabled packet sent by the GIU, and the packet carrying the VLAN ID includes the first packet or the second packet, and the virtual local area network identifier of the first packet is the first VLAN ID. The virtual local area network identifier of the second packet is a second VLAN ID, and the first VLAN ID and the second VLAN ID correspond to different virtual machine VMs. Of course After the first VM is used as an example, the GPU sends the third packet obtained by stripping the first VLAN ID to the first VM, and then the data frame of the first VM (ie, the third packet). The fourth VLAN ID is sent to the GIU. The processing of the second VM is similar to that of the first VM, and is not described here. The difference is that the second VM corresponds to the second VLAN ID. In this case, in the Flat virtual network, the isolation requirements of different virtual machines can be isolated by using VLANID, which improves the security of the network.

Optionally, the third packet is processed to obtain a fourth packet, including:

Sending the third message to the first VM;

Obtaining a data frame of the first VM, where the data frame of the first VM corresponds to the third packet;

Adding the first VLAN ID to the third packet, to obtain the fourth packet, where the first VLAN ID corresponds to the first VM;

The fifth packet is processed to obtain a sixth packet, including:

Sending the fifth message to the second VM, where the second VM is different from the first VM;

Obtaining a data frame of the second VM, where the data frame of the second VM corresponds to the fifth message;

The second VLAN ID is added to the fifth packet to obtain the sixth packet, where the second VLAN ID corresponds to the second VM.

Here, before the fourth packet is processed for the third packet, the GPU needs to send the third packet to the VM first, and then obtain the data frame (untag packet) of the VM, that is, the third packet, and then The first VLAN ID is added to the third packet, and the fourth packet is sent to the GIU. Similarly, the fifth packet needs to be processed to obtain the sixth packet. For brevity, details are not described herein.

A specific example in which the virtual network is a Flat network type will be described below with reference to FIG. 7, which shows a schematic diagram of another specific example according to an embodiment of the present invention. It should be noted that this is only to assist those skilled in the art to better understand the embodiments of the present invention and not to limit the scope of the embodiments of the present invention.

As shown in FIG. 7, different from FIG. 4, FIG. 7 adds related components of another virtual machine VM2, that is, the first virtual machine VM1 and the second virtual machine VM2 may have corresponding GIUs and GPUs respectively, but Not limited to this, multiple VMs may also correspond to the same components. Here, VM1 is first described. When the packet enters, the GIU needs to perform the PVID=1 processing on the port to convert the packet that does not carry the VLAN ID to the VLAN ID packet. For example, VM1 corresponds to the first packet, and then According to the VLAN mapping rule, the VLAN ID of VM1 is X, which will carry The first packet of the VLAN ID=X is sent to the GPU. The GPU strips the first packet, strips the first VLAN ID carried by the GPU, and then sends the third packet to the VM1 to forward the packet. . Similarly, when the message is sent, it needs to be processed when it is sent from the GPU to the GIU. After the GPU obtains the data frame from VM1, it puts the first VLANID, and after obtaining the fourth message, it sends it to the GIU through the MMX, and the GIU will The fourth packet is sent to the external port. Similarly, for the VM2, when the packet is sent, the GIU needs to perform the PVID=1 processing on the port to convert the packet that does not carry the VLAN ID to the VLAN ID packet, for example, VM2. The second packet is obtained, and then the VLAN ID of the VM2 is Y, and the second packet carrying the VLAN ID=Y is sent to the GPU according to the VLAN mapping rule, and the GPU strips the second packet and peels off the second packet. The second VLAN ID is carried, and the fourth packet is sent to the VM2 to be forwarded to the VM2. Similarly, when the packet is sent, the GPU needs to process the data from the GPU. After the GPU obtains the data frame from the VM1, After the second VLAN ID is obtained, the sixth packet is sent to the GIU through the MMX, and the GIU sends the sixth packet to the external port.

Unlike VM1, VM2 has a VLAN ID of Y, where X and Y are different values. In this way, the Flat network of VM1 and the Flat network of VM2 are isolated by X and Y, thereby satisfying the isolation request between different VMs in the Flat network. Of course, only two VMs are taken as an example here, and in practice, applications of multiple VMs can be extended, which is not limited.

Therefore, the method for forwarding a message according to the embodiment of the present invention can isolate the internal network between different VMs in the virtual network according to the first VLAN ID and the second VLAN ID, thereby enhancing network security.

It should be understood that, in the embodiment of the present invention, only the first VM and the second VM are taken as an example. The number of VMs is not limited, and more VMs may be separated by more VLAN IDs, which is not limited. .

In the embodiment of the present invention, in the specific implementation process, regarding the allocation of internal network resources, a Cloud EPS Distribute (CED) may be adopted. The CED is used to implement automatic allocation of internal network VLAN IDs to implement automatic isolation of internal network VLAN IDs. The CED can add internal and external network identification parameters to the network template of the VM. For the internal network, the CED does not need to pay attention to the VLAN ID in the template. For the external network, the CED must input the VLAN ID of the external interconnection. For example, since the internal and external networks are isolated, the CED automatically assigns an internal VLAN ID between 2 and 4094 for the internal network. For the VLAN ID of the external network, the VLAN ID is automatically assigned to the internal VLAN ID. Specifically, for example, when the CED is external to the network and the network type is VLAN, the internal automatically is automatically between 2 and 4058 (the remaining bits are reserved or detected). Assign an internal VLANID to it. In addition, Hardware Infrastructure Manager (HIM) can be implemented in conjunction with CED. The HIM is used to generate the QinQ/VLAN mapping rules and the configurations are delivered to the hardware. As a module, HIM can be integrated on the previous GIU or GPU, or other reasonable location. CED can be considered as a data source for HIM. For example, the CED creates a virtual network according to the VNF module, and sends the information or data to the HIM according to the type of the external virtual network and the mapping relationship between the internal and external VLAN IDs. The HIM generates the port based on the configured port VLAN, network type, and internal and external VLAN information. The Qinq/VLAN mapping rule is used to perform the Qinq/VLAN mapping rule on the GIU or GPU port in order to implement the method for forwarding packets according to the embodiment of the present invention. It is to be understood that the description of the present invention is not to be construed as limiting the invention.

The method for forwarding a message according to an embodiment of the present invention is described in detail above, and an apparatus for forwarding a message according to an embodiment of the present invention will be described below.

FIG. 8 shows a schematic block diagram of an apparatus 800 for forwarding a message in accordance with an embodiment of the present invention. As shown in FIG. 8, the apparatus 800 includes:

The receiving module 810 is configured to receive a first packet of the virtual network, where the first packet carries an external virtual local area network identifier (VLANID);

The determining module 820 is configured to determine an internal VLAN ID corresponding to the first packet received by the receiving module 810, where the internal VLAN ID indicates a corresponding identifier of the first packet in the internal virtual network, where the internal VLAN ID corresponds to the external VLAN ID. of;

The processing module 830 is configured to include the internal VLAN ID determined by the determining module 820 into the second packet, to generate the second packet.

The sending module 840 is configured to send the second packet to the universal processing board GPU.

The apparatus for forwarding a packet in the embodiment of the present invention, by determining the internal VLAN ID corresponding to the first packet, and isolating the internal network and the external network of the virtual network according to the first internal VLAN ID, can enhance network security and reduce network operation and maintenance complexity. degree.

Optionally, the receiving module 810 is further configured to receive a third packet sent by the GPU, where the third packet is a packet processed by the GPU for the fourth packet, where the fourth packet is the GPU. The second The packet is stripped of the internal VLAN ID and sent to the virtual machine VM, and the third packet carries the internal VLAN ID.

The processing module 830 is further configured to convert the third packet into a fifth packet, where the fifth packet carries the external VLAN ID;

The sending module 840 is further configured to send the fifth packet to an external port.

Optionally, the determining module 820 is specifically configured to:

The processing module 830 is further configured to:

The internal VLAN ID is included in the second packet according to the isolation rule determined by the determining module, and the second packet is generated.

Optionally, the processing module 830 is specifically configured to:

The apparatus 800 for forwarding a message according to an embodiment of the present invention may perform a method of forwarding a message according to an embodiment of the present invention, and the foregoing and other operations and/or functions of the respective modules in the apparatus 800 are respectively implemented to implement the foregoing methods. The corresponding process, for the sake of brevity, will not be described here.

FIG. 9 shows a schematic block diagram of an apparatus 900 for forwarding a message in accordance with an embodiment of the present invention. As shown in FIG. 9, the apparatus 900 includes:

The receiving module 910 is configured to receive, by the universal interface board GIU, the second VLAN ID that is generated after the internal VLAN ID corresponding to the first packet is sent to the second packet, where the internal VLAN ID indicates that the first packet is in the internal virtual network. Corresponding identifier, the internal VLAN ID is corresponding to the external VLAN ID of the first packet;

The processing module 920 is configured to process the second packet to obtain a third packet, where the third packet carries the internal VLAN ID;

The sending module 930 is configured to send the third packet obtained by the processing module 920 to the GIU.

Optionally, the processing module 920 is specifically configured to:

Obtaining a data frame of the VM, where the data frame corresponds to the fourth message;

The internal VLAN ID is added to the fourth packet to obtain the third packet.

The apparatus 900 for forwarding a message according to an embodiment of the present invention may perform a method of forwarding a message according to an embodiment of the present invention, and the foregoing and other operations and/or functions of the respective modules in the apparatus 900 are respectively implemented to implement the foregoing methods. The corresponding process, for the sake of brevity, will not be described here.

Optionally, when the virtual network is a Flat network, the embodiment of the present invention further provides a device for forwarding a message, where the device may be a GIU side, and the device includes:

a receiving module, configured to receive a packet of a flat virtual network that does not carry a VLAN ID of the virtual local area network;

The processing module is configured to convert the packet that does not carry the VLAN ID into the packet that carries the VLAN ID, where the packet carrying the VLAN ID includes the first packet or the second packet, where the virtual local area network identifier of the first packet The first VLAN ID, the virtual local area network identifier of the second packet is a second VLAN ID, and the first VLAN ID and the second VLAN ID correspond to different virtual machine VMs;

And a sending module, configured to send the first packet and the second packet to a GPU of the general-purpose processing board.

The device for forwarding a packet in the embodiment of the present invention can satisfy the isolation request between different VMs by using the first VLAN ID and the second VLAN ID, and can enhance the security of the network.

Optionally, the receiving module is further configured to:

The receiving module is further configured to: receive the sixth packet processed by the GPU, and the fifth packet is sent by the GPU to the second VLAN ID and sent to the second VLAN ID. a packet of the second virtual machine VM, where the sixth packet carries the second VLAN ID, where the second VM is different from the first VM;

The processing module is further configured to: convert the fourth packet into a seventh packet, where the seventh packet carries the first VLANID;

The processing module is further configured to: convert the sixth packet into an eighth packet, where the eighth packet carries the second VLAN ID;

The sending module is also used to:

The seventh message and the eighth message are sent to an external port.

Optionally, when the virtual network is a Flat network, the embodiment of the present invention further provides a device for forwarding a message, where the device may be a GPU side, and the device includes:

The receiving module is configured to receive, by the GIU, the packet that carries the VLAN ID of the virtual local area network (VLAN ID) and the packet that carries the VLAN ID, where the packet carrying the VLAN ID includes the first packet or the second packet, where The virtual local area network identifier of the first packet is a first VLAN ID, and the virtual local area network identifier of the second packet is a second VLAN ID, and the first VLAN ID and the second VLAN ID correspond to different virtual machine VMs;

The first processing module is configured to process the third packet to obtain a fourth packet, where the third packet is a packet that is stripped of the first VLAN ID, where the fourth packet carries the first packet a VLANID;

a second processing module, configured to process the fifth packet to obtain a sixth packet, where the fifth packet is used to strip the packet of the second VLAN ID, where the sixth packet carries the packet Two VLANID;

And a sending module, configured to send the fourth packet and the sixth packet to the GIU.

The device for forwarding packets in the embodiment of the present invention satisfies the isolation request between different VMs by using the first VLAN ID and the second VLAN ID, which can enhance network security and reduce network operation and maintenance complexity.

Optionally, the first processing module is specifically configured to:

Sending the third message to the first VM;

Adding the second VLAN ID to the data frame of the second VM to obtain the fourth packet;

The second processing module is specifically configured to:

FIG. 10 shows a structure of an apparatus for forwarding a message according to still another embodiment of the present invention, comprising at least one processor 1002 (for example, a CPU), at least one network interface 1005 or other communication interface, a memory 1006, and at least one communication. A bus 1003 is used to implement connection communication between these devices. The processor 1002 is configured to execute executable modules, such as computer programs, stored in the memory 1006. The memory 1006 may include a high speed random access memory (RAM), and may also include a non-volatile memory such as at least one disk memory. A communication connection with at least one other network element is achieved by at least one network interface 1005, which may be wired or wireless.

In some embodiments, the memory 1006 stores a program 10061, and the processor 1002 executes the program 10061 for performing the method of forwarding a message on the GIU side of the foregoing embodiment of the present invention.

FIG. 11 shows a structure of an apparatus for forwarding a message according to still another embodiment of the present invention, comprising at least one processor 1102 (for example, a CPU), at least one network interface 1105 or other communication interface, a memory 1106, and at least one communication. A bus 1103 is used to implement connection communication between these devices. The processor 1102 is configured to execute executable modules, such as computer programs, stored in the memory 1106. The memory 1106 may include a high speed random access memory (RAM), and may also include a non-volatile memory such as at least one disk memory. A communication connection with at least one other network element is achieved by at least one network interface 1105 (which may be wired or wireless).

In some embodiments, the memory 1106 stores a program 11061, and the processor 1102 executes a program 11061 for performing the method of forwarding a message on the GPU side of the foregoing embodiment of the present invention.

It should be understood that the term "and/or" herein is merely an association relationship describing an associated object, indicating that there may be three relationships, for example, A and/or B, which may indicate that A exists separately, and A and B exist simultaneously. There are three cases of B alone. In addition, the character "/" in this article generally indicates that the contextual object is an "or" relationship.

Those of ordinary skill in the art will appreciate that the elements and algorithm steps of the various examples described in connection with the embodiments disclosed herein can be implemented in electronic hardware or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the solution. A person skilled in the art can use different methods for implementing the described functions for each particular application, but such implementation should not be considered to be beyond the scope of the present invention.

A person skilled in the art can clearly understand that for the convenience and brevity of the description, the specific working process of the system, the device and the unit described above can refer to the corresponding process in the foregoing method embodiment, and details are not described herein again.

In the several embodiments provided by the present application, it should be understood that the disclosed systems, devices, and methods may be implemented in other manners. For example, the device embodiments described above are merely illustrative. For example, the division of the unit is only a logical function division. In actual implementation, there may be another division manner, for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be in an electrical, mechanical or other form.

The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.

In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

The functions may be stored in a computer readable storage medium if implemented in the form of a software functional unit and sold or used as a standalone product. Based on such understanding, the technical solution of the present invention, which is essential or contributes to the prior art, or a part of the technical solution, may be embodied in the form of a software product, which is stored in a storage medium, including The instructions are used to cause a computer device (which may be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention. And before The storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like, which can store program codes.

The above is only a specific embodiment of the present invention, but the scope of the present invention is not limited thereto, and any person skilled in the art can easily think of changes or substitutions within the technical scope of the present invention. It should be covered by the scope of the present invention. Therefore, the scope of the invention should be determined by the scope of the appended claims.

Claims

A method for forwarding a message, comprising:

Receiving a first packet of the virtual network, where the first packet carries an external virtual local area network identifier VLANID;

Determining an internal VLAN ID corresponding to the first packet, where the internal VLAN ID indicates an identifier corresponding to the first packet in the internal virtual network, where the internal VLAN ID is corresponding to the external VLAN ID;

And the internal VLAN ID is included in the second packet to generate the second packet.

Sending the second message to a general purpose processing board GPU.
The method of claim 1 further comprising:

Receiving a third packet sent by the GPU, where the third packet is a packet processed by the GPU for the fourth packet, and the fourth packet is the GPU stripping the second packet And deleting the internal VLAN ID and sending the packet to the virtual machine VM, where the third packet carries the internal VLAN ID;

Converting the third packet into a fifth packet, where the fifth packet carries the external VLAN ID;

Sending the fifth message to an external port.
The method according to claim 1 or 2, wherein after receiving the first packet of the virtual network, the method further comprises:

Determining an isolation rule according to the network type of the virtual network, where the isolation rule includes an identifier corresponding to the identifier of the internal VLAN ID and the external VLAN ID;

The including the internal VLAN ID in the second packet includes:

And the internal VLAN ID is included in the second packet according to the isolation rule, and the second packet is generated.
The method according to claim 3, wherein the initiating the internal VLAN ID according to the isolation rule into the second packet, and generating the second packet, includes:

The second packet is generated by replacing the external VLAN ID of the first packet with the internal VLAN ID according to a virtual local area network mapping rule, where the virtual local area network mapping rule is the isolation rule.
The method according to claim 3, wherein the initiating the internal VLAN ID according to the isolation rule into the second packet, and generating the second packet, includes:

Adding the internal VLAN ID to the first report according to a stacked virtual local area network rule The second packet is generated, and the stacked virtual local area network rule is the isolation rule.
A method for forwarding a message, comprising:

Receiving, by the GIU, the internal VLAN ID corresponding to the first packet, the second packet generated by the second packet, where the internal VLAN ID indicates that the first packet corresponds to the internal virtual network. Identifying that the internal VLAN ID is corresponding to an external VLAN ID of the first packet;

Processing the second packet to obtain a third packet, where the third packet carries the internal VLAN ID;

Sending the third message to the GIU.
The method according to claim 6, wherein the processing the second packet to obtain a third packet comprises:

After the second packet is stripped of the internal VLAN ID, the fourth packet is obtained, and the fourth packet is sent to the virtual machine VM.

Obtaining a data frame of the VM, where the data frame of the VM corresponds to the fourth packet;

And adding the internal VLAN ID to the fourth packet to obtain the third packet.
A method for forwarding a message, comprising:

Receiving a packet of the flat virtual network that does not carry the VLAN ID of the virtual local area network;

Transmitting the packet carrying the VLAN ID into the packet carrying the VLAN ID, where the packet carrying the VLAN ID includes the first packet or the second packet, where the virtual local area network identifier of the first packet is a VLAN ID, the virtual local area network identifier of the second packet is a second VLAN ID, and the first VLAN ID and the second VLAN ID correspond to different virtual machine VMs;

Sending the first packet and the second packet to a general-purpose processing board GPU.
The method of claim 8 further comprising:

Receiving, by the GPU, the fourth packet processed by the third packet, where the third packet is sent by the GPU to the first VLAN ID and sent to the first packet a packet of the virtual machine VM, where the fourth packet carries the first VLANID;

And receiving, by the GPU, a sixth packet processed by the fifth packet, where the fifth packet is sent by the GPU to the second VLAN ID by the GPU and sent to the second packet a packet of the virtual machine VM, where the sixth packet carries the second VLAN ID, and the second VM is different from the first VM;

Sending the fourth packet and the sixth packet to an external port.
A method for forwarding a message, comprising:

And receiving, by the GIU, the packet that does not carry the virtual local area network identifier VLAN ID, and the packet that carries the VLAN ID, where the packet carrying the VLAN ID includes the first packet or the second packet, where the first The virtual local area network identifier of the packet is a first VLAN ID, and the virtual local area network identifier of the second packet is a second VLAN ID, and the first VLAN ID and the second VLAN ID correspond to different virtual machine VMs;

The third packet is processed to obtain a fourth packet, where the third packet is a packet that is stripped of the first VLAN ID, and the fourth packet carries the first packet. VLANID;

After the fifth packet is processed, the sixth packet is obtained, where the fifth packet is used to strip the packet of the second VLANID, and the sixth packet carries the second packet. VLANID;

Sending the fourth packet and the sixth packet to the GIU.
The method according to claim 10, wherein the processing the third packet to obtain the fourth packet comprises:

Sending the third packet to the first VM;

Obtaining a data frame of the first VM, where the data frame of the first VM corresponds to the third packet;

Adding the first VLAN ID to the third packet, to obtain the fourth packet, where the first VLAN ID corresponds to the first VM;

The processing the fifth packet to obtain the sixth packet includes:

And sending the fifth packet to the second VM, where the second VM is different from the first VM;

Obtaining a data frame of the second VM, where the data frame of the second VM corresponds to the fifth packet;

Adding the second VLAN ID to the fifth packet to obtain the sixth packet, where the second VLAN ID corresponds to the second VM.
An apparatus for forwarding a message, comprising:

a receiving module, configured to receive a first packet of the virtual network, where the first packet carries an external virtual local area network identifier VLANID;

a determining module, configured to determine an internal VLAN ID corresponding to the first packet received by the receiving module, where the internal VLAN ID indicates a corresponding identifier of the first packet in an internal virtual network, the internal VLAN ID and the The external VLAN ID is corresponding;

a processing module, configured to include the internal VLAN ID determined by the determining module into a second packet, to generate the second packet;

And a sending module, configured to send the second packet to a general-purpose processing board GPU.
The apparatus according to claim 12, wherein the receiving module is further configured to receive a third packet sent by the GPU, where the third packet is a packet processed by the GPU for the fourth packet, where The fourth packet is a message that the GPU strips the second packet from the internal VLAN ID and sends the packet to the virtual machine VM, where the third packet carries the internal VLAN ID.

The processing module is further configured to: convert the third packet into a fifth packet, where the fifth packet carries the external VLAN ID;

The sending module is further configured to send the fifth packet to an external port.
The device according to claim 12 or 13, wherein the determining module is specifically configured to:

Determining an isolation rule according to the network type of the virtual network, where the isolation rule includes an identifier corresponding to the identifier of the internal VLAN ID and the external VLAN ID;

The processing module is further configured to:

The second VLAN is generated according to the isolation rule determined by the determining module, and the second VLAN is generated in the second packet.
The device according to claim 14, wherein the processing module is specifically configured to:

The second packet is generated by replacing the external VLAN ID of the first packet with the internal VLAN ID according to a virtual local area network mapping rule, where the virtual local area network mapping rule is the isolation rule.
The device according to claim 14, wherein the processing module is specifically configured to:

And adding the internal VLAN ID to the first packet according to the stacking virtual local area network rule to generate the second packet, where the stacked virtual local area network rule is the isolation rule.
An apparatus for forwarding a message, comprising:

The receiving module is configured to receive, by the GIU, the second VLAN that is generated by the common interface board GIU, and the internal VLAN ID corresponding to the first packet is sent to the second packet, where the internal VLAN ID indicates that the first packet is internally Corresponding identifier in the virtual network, where the internal VLAN ID is corresponding to the external VLAN ID of the first packet;

a processing module, configured to process the second packet to obtain a third packet, where the third packet carries the internal VLAN ID;

And a sending module, configured to send, to the GIU, the third packet obtained by the processing module.
The device according to claim 17, wherein the processing module is specifically configured to:

After the second packet is stripped of the internal VLAN ID, the fourth packet is obtained, and the fourth packet is sent to the virtual machine VM.

Obtaining a data frame of the VM, where the data frame corresponds to the fourth packet;

And adding the internal VLAN ID to the fourth packet to obtain the third packet.
An apparatus for forwarding a message, comprising:

a receiving module, configured to receive a packet of a flat virtual network that does not carry a VLAN ID of the virtual local area network;

a processing module, configured to convert the packet that does not carry a VLAN ID into a packet that carries a VLAN ID, where the packet carrying the VLAN ID includes a first packet or a second packet, where the first packet is virtualized The local area network identifier is a first VLAN ID, and the virtual local area network identifier of the second packet is a second VLAN ID, and the first VLAN ID and the second VLAN ID correspond to different virtual machine VMs;

And a sending module, configured to send the first packet and the second packet to a GPU of a general-purpose processing board.
The device according to claim 19, wherein the receiving module is further configured to:

Receiving, by the GPU, the fourth packet processed by the third packet, where the third packet is sent by the GPU to the first VLAN ID and sent to the first packet a packet of the virtual machine VM, where the fourth packet carries the first VLANID;

The receiving module is further configured to: receive a sixth packet that is processed by the GPU and that is processed by the GPU, where the fifth packet is used by the GPU to strip the second packet And sending, by the second VLAN ID, the packet sent to the second virtual machine VM, where the sixth packet carries the second VLAN ID, where the second VM is different from the first VM;

The processing module is further configured to: convert the fourth packet into a seventh packet, where the seventh packet carries the first VLAN ID;

The processing module is further configured to: convert the sixth packet into an eighth packet, where the eighth packet carries the second VLAN ID;

The sending module is further configured to:

Sending the seventh message and the eighth message to an external port.
An apparatus for forwarding a message, comprising:

The receiving module is configured to receive, by the GIU, the packet that carries the VLAN ID of the virtual local area network (VLAN ID) and the packet that carries the VLAN ID, where the packet carrying the VLAN ID includes the first packet or the second packet, where The virtual local area network identifier of the first packet is first. a VLAN ID, the virtual local area network identifier of the second packet is a second VLAN ID, and the first VLAN ID and the second VLAN ID correspond to different virtual machine VMs;

The first processing module is configured to process the third packet to obtain a fourth packet, where the third packet is a packet that is stripped of the first VLAN ID, and the fourth packet is Carrying the first VLANID;

a second processing module, configured to process the fifth packet to obtain a sixth packet, where the fifth packet is used to strip the packet of the second VLANID, the sixth packet Carrying the second VLANID;

And a sending module, configured to send the fourth packet and the sixth packet to the GIU.
The device according to claim 21, wherein the first processing module is specifically configured to:

Sending the third packet to the first VM;

Obtaining a data frame of the first VM, where the data frame of the first VM corresponds to the third packet;

Adding the first VLAN ID to the third packet, to obtain the fourth packet, where the first VLAN ID corresponds to the first VM;

Adding the second VLANID to the data frame of the second VM to obtain the fourth packet;

The second processing module is specifically configured to:

And sending the fifth packet to the second VM, where the second VM is different from the first VM;

Obtaining a data frame of the second VM, where the data frame of the second VM corresponds to the fifth packet;

Adding the second VLAN ID to the fifth packet to obtain the sixth packet, where the second VLAN ID corresponds to the second VM.