WO2018036256A1 - 生成acl表的方法和装置 - Google Patents

生成acl表的方法和装置 Download PDF

Info

Publication number
WO2018036256A1
WO2018036256A1 PCT/CN2017/089498 CN2017089498W WO2018036256A1 WO 2018036256 A1 WO2018036256 A1 WO 2018036256A1 CN 2017089498 W CN2017089498 W CN 2017089498W WO 2018036256 A1 WO2018036256 A1 WO 2018036256A1
Authority
WO
WIPO (PCT)
Prior art keywords
type
port
network device
acl
group
Prior art date
Application number
PCT/CN2017/089498
Other languages
English (en)
French (fr)
Inventor
袁峰
马涛
颜清华
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP17842681.3A priority Critical patent/EP3499810B1/en
Publication of WO2018036256A1 publication Critical patent/WO2018036256A1/zh
Priority to US16/283,363 priority patent/US11032198B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/40—Bus networks
    • H04L12/407—Bus networks with decentralised control
    • H04L12/413—Bus networks with decentralised control with random access, e.g. carrier-sense multiple-access with collision detection [CSMA-CD]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/74—Address processing for routing
    • H04L45/745—Address table lookup; Address filtering
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/54—Store-and-forward switching systems 
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/02—Topology update or discovery
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/02—Topology update or discovery
    • H04L45/04—Interdomain routing, e.g. hierarchical routing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/54—Organization of routing tables
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/56—Routing software
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/101—Access control lists [ACL]

Definitions

  • the present invention relates to the field of data centers, and in particular, to a method and apparatus for generating an access control list (English: access control list, ACL) table.
  • an access control list English: access control list, ACL
  • the two-level mesh architecture refers to dividing the switches that make up the DC network into groups, each of which is connected to all other switches in the same group, and each switch is connected to a group other than the group in which the switch is located, corresponding to the switch. switch.
  • the two-level mesh architecture in FIG. 1 includes three switch groups, each switch group includes three switches, for example, the first group includes switches S11, S12, and S13, and the second group includes switches S21, S22, and S23,
  • the three groups include switches S31, S32 and S33.
  • Each switch is connected to another switch in the switch group to which the switch belongs, and each switch is connected to a corresponding switch in another switch group.
  • S11 is connected to S12 and S13 which belong to the first group, and is also connected to S21 of the second group and S31 of the third group.
  • each switch includes multiple ports, and the ports are divided into a user-side port and a network-side port, wherein the user-side port is used to connect to a server (not shown), and the network-side port is used to connect to other ports. switch.
  • the two servers connected to different switches can access the ACL table.
  • the switch forwards the packet according to the ACL table, so that the packet finally reaches the destination server.
  • An ACL table is stored on each switch, and the ACL table includes an ACL table for each port.
  • An ACL table includes a matching field and an action.
  • the matching field may be one or more. For example, the port number of the port that receives the packet and the destination Internet Protocol (English: Internet Protocol, IP address) of the packet. At least one of them.
  • the ACL table needs to be implemented by a ternary content addressable memory (TCAM) device of a dedicated chip on the switch, the above method needs to be used on the switch for each port through the switch.
  • the flow class configures the corresponding ACL table, and the ACL table is stored in the TCAM of the dedicated chip on the switch. Therefore, when the data center network is large, the TCAM of the oversized specification is required. However, the current technology of the ACL table cannot produce the oversized specification. TCAM, which makes data center network expansion difficult.
  • the present invention provides a method and apparatus for generating an ACL table. To reduce the size of the ACL table and reduce the need for TACM specifications.
  • an embodiment of the present invention provides a method for generating an ACL table, where the method includes:
  • a first type of ACL entry is generated for the target port of the preset port type of the first network device, and a second type of ACL entry corresponding to the routing table of the first network device is generated.
  • the second type of ACL entry and each type of ACL entry are added to the ACL table of the first network device.
  • the ACL entry includes only the first type of ACL entries corresponding to the destination port and the second type of ACL entries corresponding to the routing table, thereby reducing the number of ACL entries included in the ACL table and reducing the number of ACL entries.
  • Demand is convenient for data center network expansion.
  • the obtaining a port type of each port of the first network device includes:
  • the port type of the port included in the notification message received within the preset duration is determined as the interconnection type
  • the port type of the port that is not included in the notification message received within the preset duration is determined to be the default type.
  • the port type of each port of the first network device is obtained by detecting the packet, and the operation is simple, thereby shortening the time for acquiring the port type and improving the efficiency of acquiring the port type.
  • the interconnection type includes an intra-group interconnection type and an inter-group interconnection type
  • the port type of the port included in the notification message received within the preset duration is determined as an interconnection type, including:
  • the peer network device and the first network device belong to the same device group, determine that the port type of the port is an intra-group interconnection type
  • the peer network device and the first network device do not belong to the same device group, determine that the port type of the port is an inter-group interconnection type.
  • the interconnection type includes the intra-group interconnection type and the inter-group interconnection type, and the port type is further refined, thereby improving the accuracy of generating the ACL table.
  • the preset type includes the default type and the intra-group interconnection type.
  • only the first type of ACL entries are generated for the target port of the default type and the intra-group interconnection type, and the number of ACL entries included in the ACL table is reduced.
  • the first type of ACL entry is an ACL entry that includes the target port.
  • each entry of the routing table includes a next hop of the first network device to a second network device
  • each target port For each target port, determining, according to the routing table, an action of the target port corresponding to each second network device, and for each second network device, generating, including the target port, the second network device, and the The ACL entry corresponding to the action of the second network device by the target port.
  • the priority of the second type of ACL entry is lower than the priority of each of the first type of ACL entries.
  • the priority of the second type of ACL entries in the ACL table is lower than the priority of the first type of ACL entries. Therefore, when the first network device receives the traffic, the traffic may be preferentially configured according to the first type of ACL entries. Access improves access efficiency.
  • an embodiment of the present invention provides an apparatus for generating an ACL table, where the apparatus includes:
  • An obtaining module configured to acquire a port type of each port of the first network device
  • a selection module configured to select, according to the port type of each port, a target port whose port type is a preset type from all ports of the first network device;
  • a first generation module configured to generate a corresponding first type of access control list ACL entry for each target port
  • a second generation module configured to generate a second type of ACL entry corresponding to the routing table of the first network device, where the action of the second type of ACL entry is to jump to the routing table;
  • the adding module is configured to add the second type of ACL entry and each of the first type of ACL entries to an ACL table of the first network device.
  • the apparatus for generating an ACL table according to the second aspect described above can implement the methods of the first aspect and the respective embodiments of the first aspect, and achieve corresponding effects.
  • an embodiment of the present invention provides an apparatus for generating an ACL table, where the apparatus includes: a processor, a memory, and a communication interface;
  • the memory and the communication interface are respectively coupled to the processor, the memory is for storing program code, the program code includes computer operation instructions, and the processor executes program code stored in the memory to implement The first aspect and the method of each of the first aspects are described.
  • the port type of the port included in the notification packet received within the preset duration is determined as the type of the port.
  • the port type of the port that is not included in the notification packet received within the preset duration is determined to be the default type. Determining, by the port in each notification packet, the peer network device and the identifier according to the identifier of the device group to which the peer network device to which the notification packet is sent in the notification packet Whether a network device belongs to the same device group
  • an embodiment of the present invention provides a computer storage medium for storing computer program code developed to implement the first aspect and the method in each embodiment of the first aspect.
  • a first type of ACL entry is generated for the target port of the preset port type of the first network device, and a second type of ACL entry corresponding to the routing table of the first network device is generated.
  • the second type of ACL entry and each type of ACL entry are added to the ACL table of the first network device;
  • the first type of ACL entries and the second type of ACL entries corresponding to the routing table are included, which reduces the number of ACL entries included in the ACL, and reduces the demand for TCAM resources.
  • Data center network expansion is included.
  • 1 is a schematic structural diagram of a two-stage mesh architecture
  • FIG. 2 is a schematic structural diagram of a primary mesh architecture according to an embodiment of the present invention.
  • FIG. 3 is a schematic structural diagram of a two-level mesh architecture according to an embodiment of the present invention.
  • FIG. 4 is a flowchart of a method for generating an ACL table according to an embodiment of the present invention.
  • FIG. 5 is a flowchart of a method for a controller to acquire a port type of each port included in a first network device according to an embodiment of the present disclosure
  • FIG. 6 is a flowchart of a method for determining, by the controller, a port type of a port included in a notification message received within a preset duration according to an embodiment of the present invention
  • FIG. 7 is a flowchart of a method for a controller to generate a corresponding first type ACL entry for each target port according to an embodiment of the present disclosure
  • FIG. 8 is a flowchart of a method for generating, by a controller, a second type of ACL entry corresponding to a routing table of a first network device according to an embodiment of the present disclosure
  • FIG. 9 is a schematic structural diagram of an apparatus for generating an ACL table according to an embodiment of the present disclosure.
  • FIG. 10 is a schematic structural diagram of another apparatus for generating an ACL table according to an embodiment of the present invention.
  • FIG. 2 is a schematic structural diagram of a primary mesh architecture according to an embodiment of the present invention.
  • the first-level mesh architecture includes four network devices, namely, S1, S2, S3, and S4; wherein each network device is connected to any other network device in the mesh architecture.
  • Each network device includes a plurality of ports including a user side port and a network side port.
  • the user-side port is a port connected to the host, and the network-side port is a port connected to another network device.
  • S2-A is a user side port
  • S2-B, S2-C, and S2-D are network side interfaces.
  • FIG. 3 is a schematic structural diagram of a two-level mesh architecture according to an embodiment of the present invention.
  • the network architecture includes multiple sets of network devices, and three groups are shown in FIG. 3, which are a first group of network devices, a second group of network devices, and a third group of network devices, and the first group of network devices includes S11, S12, and S13.
  • the second set of network devices includes S21, S22, and S23; and the third set of network devices includes S31, S32, and S33.
  • the connection relationship between each network device and other network devices can be referred to the description in FIG. Different from FIG. 1, in FIG. 3, different types of connections are indicated by different line types. This will be described in detail later.
  • the two-level mesh architecture in Figure 3 can be derived from the first-level mesh architecture in Figure 2.
  • the embodiment of the present invention provides a method for generating an ACL table, and the execution body of the method is a network device such as a controller or a router or a switch.
  • the execution subject is used as a controller as an example for description; referring to FIG. 4, the method includes:
  • Step 101 The controller acquires a port type of each port included in the first network device.
  • the first network device is any network device in the network architecture, and the first network device may be a router or a switch.
  • this step can be implemented through steps 1011-1013, including:
  • the first network device and the controller After the first network device is online, the first network device and the controller establish a connection, and the controller knows that the first network device enters the network architecture, and the controller sends an indication packet to the first network device, where the indication message is used to enable the A network device sends a probe packet to the peer device directly connected to the first network device.
  • the first network device receives the indication packet sent by the controller, and sends a probe packet to the peer device directly connected to the first network device, where the probe packet is used to enable the peer device to receive the probe reported by the first network device. After the text, a notification message is sent to the controller.
  • the probe packet may be a Link Layer Discovery Protocol (LLDP) packet or an Internet Packet Probe (English: Packet Internet Groper, ping for short) packet.
  • LLDP Link Layer Discovery Protocol
  • Internet Packet Probe English: Packet Internet Groper, ping for short
  • the peer device sends a notification packet to the controller, where the notification packet carries at least the identifier of the port connected to the peer device by the first network device, where the port is located on the first network device; If the network architecture is a two-level or two-level mesh architecture, the notification packet may also carry the identifier of the device group to which the peer device belongs.
  • the ID of the port can be the number of the port, and the ID of the device group can be the number of the device group.
  • the peer device If the peer device is a host, for example, a server, the peer device does not send a probe packet to the controller.
  • the step of the controller monitoring the port may be:
  • the controller monitors whether a notification message sent by the peer device connected to the port is received within a preset duration.
  • the preset duration can be set and changed as needed.
  • the preset duration is not specifically limited; for example, the preset duration may be 1 minute or the like.
  • the controller determines the port type of the port included in the notification message received within the preset duration as the interconnection type.
  • the controller For each port of the first network device, if the controller receives the notification message carrying the identifier of the port within the preset duration, the controller determines that the port type of the port is an interconnection type.
  • the interconnection type includes the intra-group interconnection type and the inter-group interconnection type.
  • the following steps can be performed through the following steps 1012-1. 1012-3 implementation, including:
  • the controller determines, according to the identifier of the device group to which the peer network device that sends the notification packet belongs in the notification packet, for the port in each notification packet received in the preset duration Whether the peer network device and the first network device belong to the same device group.
  • the notification packet carries the identifier of the device group to which the peer device belongs, and the controller obtains the identifier of the device group to which the peer device belongs from the notification packet, and obtains the information from the information stored by the controller.
  • the identifier of the device group to which the network device belongs if the identifier of the device group to which the peer device belongs is the same as the identifier of the device group to which the first network device belongs, it is determined that the peer device and the first network device belong to the same device group; If the identifier of the device group to which the peer device belongs is different from the identifier of the device group to which the first network device belongs, it is determined that the peer device and the first network device do not belong to the same device group.
  • the controller determines that the port type of the port is an intra-group interconnection type.
  • the controller determines that the port type of the port is an inter-group interconnection type.
  • the controller determines the port type of the port not included in the notification message received within the preset duration as the default type.
  • the controller determines that the port type of the port is the default type.
  • the controller obtains the port type of each port included in S2 as shown in Table 1 below:
  • S12-S11 refers to the port that switch S12 uses to connect to switch S11, and so on.
  • Step 102 The controller selects a target port whose port type is a preset type from all ports of the first network device according to the port type of each port.
  • the preset type includes the default type and the intra-group interconnection type; correspondingly, this step can be:
  • each port select the port whose port type is the default type and the intra-group interconnection type from all the ports of the first network, and determine the selected port as the target port.
  • the controller selects the target port from all ports of S2 as S2-A.
  • the controller selects the target ports from all the ports of S12 as S12-server, S12-S13, and S12-S21.
  • Step 103 The controller generates a corresponding first type of ACL entry for each target port.
  • the first type of ACL entry is an ACL entry that includes the destination port.
  • this step can be implemented by the following steps 1031-1033, including:
  • the controller determines a second network device in the network architecture where the first network device is located, and the second network device is any one of the network devices except the first network device.
  • the second network device can be a router or a switch.
  • the controller determines that the second network devices in the primary mesh architecture where S2 is located are S1, S3, and S4, respectively.
  • the controller determines that the second network devices in the two-level mesh architecture where S12 is located are S11, S13, S21, S22, S23, S31, S32, and S33, respectively.
  • the controller generates a routing table, where each entry of the routing table includes a next hop of the first network device to a second network device.
  • the controller generates a routing table of the first network device according to the preset routing algorithm; each entry of the routing table includes at least a next hop of the first network device to a second network device (the destination network device), and a next hop Including the IP address and the outgoing port, the outgoing port can be one or more ports.
  • Each entry of the routing table may further include an identifier of the second network device, and a hop count of the first network device to the second network device.
  • the preset routing algorithm is any existing routing algorithm. In the embodiment of the present invention, the preset routing algorithm is not specifically limited.
  • the routing table may be a forwarding information base (English: Forward Information Base, FIB for short), a routing information database (English: Forward Information Base, RIB) or a multi-path table.
  • routing table of S2 in the primary mesh architecture generated by the controller is as shown in Table 3 below:
  • routing table of S12 in the two-level mesh architecture generated by the controller is as shown in Table 4 below:
  • the controller determines, according to the routing table, an action of the target port corresponding to each second network device, and for each second network device, generates the target port, the second network device, and the target.
  • the port corresponds to an ACL entry of the action of the second network device.
  • the determining, by the controller, the action of the target port corresponding to each second network device according to the routing table may be:
  • the controller obtains the next hop-out port of the second network device corresponding to the target port from the routing table, and determines the next hop-out port as the target port corresponding to The action of the second network device.
  • the first type of ACL entries generated by the controller for the target port are as shown in Table 5 below:
  • the action of the target port corresponding to the second network device is to forward the packet to the next hop-out interface.
  • the destination network device of the target port S2-A is S1
  • the corresponding actions S2-B, S2-C, and S2-D are The packet can be forwarded through any of the next outgoing interfaces S2-B, S2-C, and S2-D.
  • the target port of the default port type is selected from all the ports of the S12, and the target port S12-server on the S12 is used as an example.
  • the first type of ACL entries generated by the controller for the target port are as follows: 6 shows:
  • Step 104 The controller generates a second type of ACL entry corresponding to the routing table of the first network device, and the action of the second type of ACL entry is to jump to the routing table.
  • the second type of ACL entry is an ACL entry that includes a routing table. Referring to FIG. 8, this step can be implemented by the following steps 1041-1043, including:
  • the controller determines a non-target port on the first network device, where the non-target port is any one of the ports of the first network device except the target port.
  • the controller generates a corresponding first type of ACL entry for each non-target port.
  • the controller determines, according to the routing table, the action of the non-target port corresponding to each second network device, and for each second network device, generates the non-target port, the second network device, and the The non-target port corresponds to the first type of ACL entry of the second network device, and the first type of ACL entry corresponding to the non-target port is compressed.
  • the step of compressing the first type of ACL entries corresponding to each non-target port by the controller may be:
  • the controller extracts, from the ACL entries corresponding to the non-target ports, the actions of the second network device and the non-target port corresponding to the second network device.
  • the step of determining, by the controller, the action of the non-target port corresponding to each second network device according to the routing table may be:
  • the controller obtains, from the routing table, the next hop port with the smallest hop count of the second network device corresponding to the non-non-target port, and the hop count is the smallest.
  • the next hop port is determined to be the action of the non-target port corresponding to the second network device.
  • the controller compresses the first type of ACL entries corresponding to each non-target port into a second type of ACL entry.
  • the controller is the first type of ACL entries generated on the S2 for the non-target ports S2-B, S2-C, and S2-D, as shown in Table 7 below:
  • the controller compresses the first type of ACL entries corresponding to each non-target port, that is, compresses the table 7, and the compression result is as shown in Table 8 below:
  • the controller compresses the table 8 into a second type of ACL entry, and the action of the second type of ACL entry is to jump to the routing table.
  • the action of the second type of ACL entry is to jump to the routing table, and only the outbound port with the smallest hop count is found from the routing table.
  • the controller is the first type of ACL entries generated by the non-target ports S12-S11 and S12-S13 on S12, as shown in Table 9 below:
  • the controller compresses the first type of ACL entries corresponding to each non-target port, that is, compresses the table 9.
  • the compression result is as shown in Table 10 below:
  • Step 105 The controller adds the second type of ACL entry and each first type of ACL entry to the ACL table of the first network device.
  • the priority of the second type of ACL entries is lower than the priority of each type of ACL entry.
  • the controller may also add the first type of ACL entry corresponding to each target port and the compressed first type of ACL entry corresponding to each non-target port to the ACL table of the first network device.
  • the controller adds Table 5 and Table 8 to the ACL table of the first network device, and obtains the following Table 11:
  • the controller adds Table 9 and Table 10 to the ACL table of the first network device, and obtains the following Table 12:
  • the requirement of the ACL table for the TCAM resource is reduced, and the traditional network device is used to construct the ultra-large-scale two-level mesh architecture, and the method is applicable to any level of mesh architecture, for example, a primary mesh architecture, Two-level mesh architecture, even higher-order mesh architecture.
  • Step 106 The ACL table and the routing table are delivered to the first network device.
  • step 106 is not a step that must be performed; if the execution subject is a controller, step 106 needs to be performed; if the execution subject is the first network device, step 106 does not need to be performed.
  • a first type of ACL entry is generated for the target port of the preset port type of the first network device, and a second type of ACL entry corresponding to the routing table of the first network device is generated.
  • the second type of ACL entry and each type of ACL entry are added to the ACL table of the first network device.
  • the ACL entry includes only the first type of ACL entries corresponding to the destination port and the second type of ACL entries corresponding to the routing table, thereby reducing the number of ACL entries included in the ACL table and reducing the number of ACL entries.
  • Demand is convenient for data center network expansion.
  • FIG. 9 is a schematic diagram of an apparatus for generating an ACL, which may be a network device such as a controller, a router, or a switch, and may be applied to a network architecture such as a primary mesh or a multi-level mesh, and the device includes:
  • the memory 201 and the communication interface 203 are respectively connected to the processor 201.
  • the memory 202 is configured to store program code, the program code includes computer operation instructions, and the processor 201 executes the memory 202.
  • the stored program code is used to implement related processing of the controller in the above embodiment, and can communicate with the network device through the communication interface 203.
  • Processor 201 includes one or more processing cores.
  • the processor 201 implements the steps and the alternatives in the embodiments of the present invention by running software programs and modules.
  • FIG. 10 is a device for generating an ACL table according to an embodiment of the present invention.
  • the device may be implemented as part or all of the controller by software, hardware, or a combination of the two.
  • the device includes an obtaining module 301, a selecting module 302, a first generating module 303, a second generating module 304, and an adding module 305.
  • step 101 in the above embodiment and its alternatives are executed.
  • step 102 and its alternatives in the above embodiment are performed.
  • step 103 in the above embodiment and its alternatives are executed.
  • step 104 When the second generation module 304 is in operation, step 104 and its alternatives in the above embodiment are performed.
  • step 105 When the adding module 305 is in operation, step 105 and its alternatives in the above embodiment are performed.
  • the device for generating the ACL table is only illustrated by the division of the foregoing functional modules. In actual applications, the functions may be allocated by different functional modules according to requirements. Completed, dividing the internal structure of the device into different functional modules to complete all of the above descriptions Or some features.
  • the device for generating an ACL table provided by the foregoing embodiment is the same as the method for generating an ACL table. For details of the implementation process, refer to the method embodiment, and details are not described herein again.
  • the storage medium may be a read only memory, a magnetic disk or an optical disk or the like.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本发明公开了一种生成ACL表的方法和装置，属于数据中心领域。该方法的执行主体为控制器，方法包括：获取第一网络设备的每个端口的端口类型；根据所述每个端口的端口类型，从所述第一网络设备的所有端口中选择端口类型为预设类型的目标端口；为每个目标端口生成对应的第一类访问控制列表ACL表项；生成所述第一网络设备的路由表对应的一个第二类ACL表项，所述第二类ACL表项的动作为跳转到所述路由表；将所述第二类ACL表项和每个所述第一类ACL表项添加到所述第一网络设备的ACL表中。由于ACL表项中仅包括目标端口对应的第一类ACL表项和路由表对应的一个第二类ACL表项，从而减少了ACL表中包括的ACL表项的数目，降低了对TCAM资源的需求量，方便了数据中心网络扩容。

Description

生成ACL表的方法和装置
本申请要求于2016年8月25日提交中国专利局、申请号为201610724457.6、发明名称为“生成ACL表的方法和装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明涉及数据中心领域，特别涉及一种生成访问控制列表(英文：access control list，简称：ACL)表的方法和装置。
背景技术
为了满足数据中心(英文：data center，简称：DC)中数据量的飞速增长，出现了基于光交叉技术的两级全连接(英文：mesh)架构的DC网络。
两级mesh架构是指将组成DC网络的交换机分成若干组，每个交换机连接到同组内的所有其他交换机，并且每个交换机连接到除该交换机所在组外的其他组中与该交换机对应的交换机。
例如，图1中的两级mesh架构包括三个交换机组，每个交换机组包括三个交换机，例如，第一组包括交换机S11，S12和S13，第二组包括交换机S21，S22和S23，第三组包括交换机S31，S32和S33。每个交换机分别连接到该交换机所属的交换机组内的其他交换机，每个交换机连接到其他交换机组中的对应交换机。例如，S11连接到同属于第一组的S12和S13，还连接到第二组的S21和第三组的S31。通过上述连接，每个交换机都能与该两级mesh架构中的任意交换机通信。
在两级mesh架构中，每个交换机都包括多个端口，端口分为用户侧端口和网络侧端口，其中用户侧端口用于连接服务器(图中未示出)，网络侧端口用于连接其他交换机。不同交换机连接的两个服务器之间可以互相访问ACL表。交换机收到其所连接的服务器发送的报文时，根据ACL表转发该报文，以使该报文最终到达目的服务器。
每个交换机上存储有ACL表，该ACL表包括每个端口的ACL表。其中，一个ACL表包括匹配字段和动作，匹配字段可以是一个或多个，例如，接收报文的端口的端口号和报文的目的网际协议(英文：Internet Protocol，简称：IP)地址之间的至少一个。
由于ACL表需要交换机上的专用芯片的三态内容寻址存储器(英文：ternary content addressable memory，简称：TCAM)器件来实现，上述方法中需要在该交换机上为通过该交换机的每个端口的每条流配置对应的ACL表，而ACL表存储在交换机上的专用芯片的TCAM中，因此，当数据中心网络规模很大时，需要超大规格的TCAM，然而ACL表当前技术并不能生产超大规格的TCAM，导致数据中心网络扩容困难。
发明内容
为了解决现有技术的问题，本发明提供了一种生成ACL表的方法和装置。以减少ACL表的规模，降低对TACM规格的需求。
第一方面，本发明实施例提供了一种生成ACL表的方法，所述方法包括：
获取第一网络设备的每个端口的端口类型；
根据所述每个端口的端口类型，从所述第一网络设备的所有端口中选择端口类型为预设类型的目标端口；
为每个目标端口生成对应的第一类访问控制列表ACL表项；
生成所述第一网络设备的路由表对应的一个第二类ACL表项，所述第二类ACL表项的动作为跳转到所述路由表；
将所述第二类ACL表项和每个所述第一类ACL表项添加到所述第一网络设备的ACL表中。
在本发明实施例中，为第一网络设备的预设端口类型的目标端口生成对应的第一类ACL表项，生成第一网络设备的路由表对应的一个第二类ACL表项，将第二类ACL表项和每个第一类ACL表项添加到第一网络设备的ACL表中；
由于ACL表项中仅包括目标端口对应的第一类ACL表项和路由表对应的一个第二类ACL表项，从而减少了ACL表中包括的ACL表项的数目，降低了对TCAM资源的需求量，方便了数据中心网络扩容。
在一个可能的设计中，所述获取第一网络设备的每个端口的端口类型，包括：
所述第一网络设备上线后，监控所述第一网络设备的每个端口；
将在预设时长内接收到的通知报文中包括的端口的端口类型确定为互联类型；
将在预设时长内接收到的通知报文中没有包括的端口的端口类型确定为默认类型。
在本发明实施例中，通过探测报文获取第一网络设备的每个端口的端口类型，操作简单，从而缩短了获取端口类型的时间，提高了获取端口类型的效率。
在另一个可能的设计中，所述互联类型包括组内互联类型和组间互联类型；
所述将在预设时长内接收到的通知报文中包括的端口的端口类型确定为互联类型，包括：
对于预设时长内接收到的每个通知报文中的端口，根据所述通知报文中的发送所述通知报文的对端网络设备所属的设备组的标识确定所述对端网络设备和所述第一网络设备是否属于同一个设备组；
当所述对端网络设备和所述第一网络设备属于同一个设备组时，确定所述端口的端口类型为组内互联类型；
当所述对端网络设备和所述第一网络设备不属于同一个设备组时，确定所述端口的端口类型为组间互联类型。
在本发明实施例中，在两级或两级以上的mesh架构中，互联类型包括组内互联类型和组间互联类型，更加细化端口类型，从而提高了生成ACL表的准确性。
在另一个可能的设计中，所述预设类型包括所述默认类型和所述组内互联类型。
在本发明实施例中，仅为默认类型和组内互联类型的目标端口生成对应的第一类ACL表项，减少了ACL表中包括的ACL表项的数目。
在另一个可能的设计中，所述第一类ACL表项是指包括所述目标端口的ACL表项；
所述为每个目标端口生成对应的第一类访问控制列表ACL表项，包括：
确定所述第一网络设备所在网络架构中的第二网络设备，所述第二网络设备为所述网络架构中除所述第一网络设备之外的任意一个网络设备；
生成所述路由表，所述路由表的每个表项包括所述第一网络设备到一个第二网络设备的下一跳；
对于每个目标端口，根据所述路由表确定所述目标端口对应每个第二网络设备的动作，并对于每个第二网络设备，生成包括所述目标端口、所述第二网络设备和所述目标端口对应所述第二网络设备的动作的ACL表项。
在另一个可能的设计中，所述第二类ACL表项的优先级低于每个所述第一类ACL表项的优先级。
在ACL表中第二类ACL表项的优先级低于每个第一类ACL表项的优先级，从而第一网络设备接收到流量时，可以优先根据第一类ACL表项对该流量进行访问，提高了访问效率。
第二方面，本发明实施例提供了一种生成ACL表的装置，所述装置包括：
获取模块，用于获取第一网络设备的每个端口的端口类型；
选择模块，用于根据所述每个端口的端口类型，从所述第一网络设备的所有端口中选择端口类型为预设类型的目标端口；
第一生成模块，用于为每个目标端口生成对应的第一类访问控制列表ACL表项；
第二生成模块，用于生成所述第一网络设备的路由表对应的一个第二类ACL表项，所述第二类ACL表项的动作为跳转到所述路由表；
添加模块，用于将所述第二类ACL表项和每个所述第一类ACL表项添加到所述第一网络设备的ACL表中。
上述第二方面的生成ACL表的装置能够实现所述第一方面以及第一方面的各实施方式中的方法，并取得相应的效果。
第三方面，本发明实施例提供了一种生成ACL表的装置，所述装置包括：处理器、存储器和通信接口；
所述存储器和所述通信接口分别与所述处理器连接，所述存储器用于存储程序代码，所述程序代码包括计算机操作指令，所述处理器执行所述存储器中存储的程序代码以实现所述第一方面以及所述第一方面的各实施方式中的方法。将在预设时长内接收到的通知报文中包括的端口的端口类型确定为互联类型将在预设时长内接收到的通知报文中没有包括的端口的端口类型确定为默认类型对于预设时长内接收到的每个通知报文中的端口，根据所述通知报文中的发送所述通知报文的对端网络设备所属的设备组的标识确定所述对端网络设备和所述第一网络设备是否属于同一个设备组
第四方面，本发明实施例提供了一种计算机存储介质，用于存储为实现上述第一方面以及所述第一方面的各实施方式中的方法所开发的计算机程序代码。
在本发明上述各实施例中，为第一网络设备的预设端口类型的目标端口生成对应的第一类ACL表项，生成第一网络设备的路由表对应的一个第二类ACL表项，将第二类ACL表项和每个第一类ACL表项添加到第一网络设备的ACL表中；由于ACL表项中 仅包括目标端口对应的第一类ACL表项和路由表对应的一个第二类ACL表项，从而减少了ACL表中包括的ACL表项的数目，降低了对TCAM资源的需求量，方便了数据中心网络扩容。
附图说明
图1是一种两级mesh架构的结构示意图；
图2是本发明实施例提供的一种一级mesh架构的结构示意图；
图3是本发明实施例提供的一种两级mesh架构的结构示意图；
图4是本发明实施例提供的一种生成ACL表的方法流程图；
图5是本发明实施例提供的一种控制器获取第一网络设备包括的每个端口的端口类型的方法流程图；
图6是本发明实施例提供的一种控制器将在预设时长内接收到的通知报文中包括的端口的端口类型确定为互联类型的方法流程图；
图7是本发明实施例提供的一种控制器为每个目标端口生成对应的第一类ACL表项的方法流程图；
图8是本发明实施例提供的一种控制器生成第一网络设备的路由表对应的一个第二类ACL表项的方法流程图；
图9是本发明实施例提供的一种生成ACL表的装置结构示意图；
图10是本发明实施例提供的另一种生成ACL表的装置结构示意图。
具体实施方式
为使本发明的目的、技术方案和优点更加清楚，下面将结合附图对本发明实施方式作进一步地详细描述。
如图2所示，为本发明实施例提供的一种一级mesh架构的结构示意图。该一级mesh架构包括四个网络设备，分别为S1、S2、S3和S4；其中，每个网络设备连接到该mesh架构中的任意一个其他网络设备。每个网络设备包括多个端口，该多个端口包括用户侧端口和网络侧端口。其中，用户侧端口为连接主机的端口，网络侧端口为连接其他网络设备的端口。例如图2中，S2-A为用户侧端口，S2-B、S2-C和S2-D为网络侧接口。
如图3所示，为本发明实施例提供的一种两级mesh架构的结构示意图。该网络架构中包括多组网络设备，图3中示出了三组，分别为第一组网络设备，第二组网络设备和第三组网络设备，第一组网络设备包括S11、S12和S13；第二组网络设备包括S21、S22和S23；第三组网络设备包括S31、S32和S33。每个网络设备与其他网络设备的连接关系可以参考图1中的描述。与图1不同的是，在图3中，用不同的线型表示不同类型的连接。关于这点，后续会有详细描述。图3中两级mesh架构可以由图2中的一级mesh架构扩展得到。
基于图2所示的一级mesh架构或图3所示的两级mesh架构，本发明实施例提供一种生成ACL表的方法，该方法的执行主体为控制器或路由器、交换机等网络设备。
在本发明实施例中，以执行主体为控制器为例进行说明；参见图4，该方法包括：
步骤101：控制器获取第一网络设备包括的每个端口的端口类型。
第一网络设备为网络架构中的任一网络设备，且第一网络设备可以为路由器或者交换机等。
参见图5，本步骤可以通过步骤1011-1013实现，包括：
1011：第一网络设备上线后，控制器监控第一网络设备的每个端口。
第一网络设备上线后，第一网络设备和控制器建立连接，此时控制器获知第一网络设备进入网络架构中，控制器向第一网络设备发送指示报文，指示报文用于使第一网络设备向与第一网络设备直接相连的对端设备发送探测报文。
第一网络设备接收控制器发送的指示报文，向与第一网络设备直接相连的对端设备发送探测报文，探测报文用于使对端设备在接收到第一网络设备发送的探测报文后，向控制器发送通知报文。探测报文可以为链路层发现协议(英文：Link Layer Discovery Protocol，简称：LLDP)报文或者因特网包探索器(英文：Packet Internet Groper，简称：ping)报文等。
如果对端设备为网络设备，则对端设备向控制器发送通知报文，该通知报文至少携带第一网络设备与该对端设备连接的端口的标识，该端口位于第一网络设备上；如果该网络架构为两级或两级以上的mesh架构，则该通知报文还可以携带该对端设备所属的设备组的标识。
端口的标识可以为端口的编号等；设备组的标识可以为设备组的编号等。
如果对端设备为主机，例如，服务器，则对端设备不向控制器发送探测报文。
对于第一网络设备的每个端口，控制器监控该端口的步骤可以为：
控制器监控在预设时长内是否接收到与该端口连接的对端设备发送的通知报文。
预设时长可以根据需要进行设置并更改，在本发明实施例中，对预设时长不作具体限定；例如，预设时长可以为1分钟等。
1012：控制器将在预设时长内接收到的通知报文中包括的端口的端口类型确定为互联类型。
对于第一网络设备的每个端口，如果控制器在预设时长内接收到携带该端口的标识的通知报文，控制器确定该端口的端口类型为互联类型。
在两级或两级以上的mesh架构中，存在多组网络设备，因此，互联类型包括组内互联类型和组间互联类型；相应的，参见图6，本步骤可以通过以下步骤1012-1至1012-3实现，包括：
1012-1：对于预设时长内接收到的每个通知报文中的端口，控制器根据所述通知报文中的发送所述通知报文的对端网络设备所属的设备组的标识确定所述对端网络设备和所述第一网络设备是否属于同一个设备组。
该通知报文中携带该对端设备所属的设备组的标识，控制器从该通知报文中获取该对端设备所属的设备组的标识，以及，从所述控制器存储的信息中获取第一网络设备所属的设备组的标识；如果该对端设备所属的设备组的标识和第一网络设备所属的设备组的标识相同，确定该对端设备和第一网络设备属于同一个设备组；如果该对端设备所属的设备组的标识和第一网络设备所属的设备组的标识不相同，确定该对端设备和第一网络设备不属于同一个设备组。
1012-2：当对端网络设备和第一网络设备属于同一个设备组时，控制器确定该端口的端口类型为组内互联类型。
1012-3：当对端网络设备和第一网络设备不属于同一个设备组时，控制器确定该端口的端口类型为组间互联类型。
1013：控制器将在预设时长内接收到的通知报文中没有包括的端口的端口类型确定为默认类型。
对于第一网络设备的每个端口，如果控制器在预设时长内没有接收到携带该端口的标识的通知报文，控制器确定该端口的端口类型为默认类型。
例如，在图2所示的一级mesh架构中，以S2为第一网络设备为例进行说明，则控制器获取S2包括的每个端口的端口类型如下表1所示：
表1
端口 端口类型
S2-A 默认类型
S2-B 互联类型
S2-C 互联类型
S2-D 互联类型
再如，在图3所示的两级mesh架构中，实线表示组内互联，虚线表示组间互联。以S12为第一网络设备为例进行说明，则控制器获取S12包括的每个端口的端口类型如下表2所示：
表2
端口 端口类型
S12-服务器 默认类型
S12-S11 组内互联类型
S12-S13 组内互联类型
S12-S21 组间互联类型
S12-S22 组间互联类型
S12-S23 组间互联类型
S12-S31 组间互联类型
S12-S32 组间互联类型
S12-S33 组间互联类型
其中，S12-S11是指交换机S12用于连接交换机S11的端口，其他端口以此类推。
步骤102：控制器根据每个端口的端口类型，从第一网络设备的所有端口中选择端口类型为预设类型的目标端口。
预设类型包括默认类型和组内互联类型；相应的，本步骤可以为：
根据每个端口的端口类型，从第一网络的所有端口中选择端口类型为默认类型和组内互联类型的端口，将选出的端口确定为目标端口。
例如，控制器根据表1，从S2的所有端口中选出的目标端口为S2-A。
再如，控制器根据表2，从S12的所有端口中选出的目标端口为S12-服务器、S12-S13和S12-S21。
步骤103：控制器为每个目标端口生成对应的第一类ACL表项。
第一类ACL表项是指包括目标端口的ACL表项。相应的，参见图7，本步骤可以通过以下步骤1031-1033实现，包括：
1031：控制器确定第一网络设备所在网络架构中的第二网络设备，第二网络设备为该网络架构中除第一网络设备之外的任意一个网络设备。
第二网络设备可以为路由器或者交换机等。
例如，控制器确定S2所在的一级mesh架构中的第二网络设备分别为S1、S3和S4。
再如，控制器确定S12所在的两级mesh架构中的第二网络设备分别为S11、S13、S21、S22、S23、S31、S32和S33。
1032：控制器生成路由表，该路由表的每个表项包括第一网络设备到一个第二网络设备的下一跳。
控制器根据预设路由算法，生成第一网络设备的路由表；该路由表的每个表项至少包括第一网络设备到一个第二网络设备(目的网络设备)的下一跳，下一跳包括IP地址和出端口，出端口可以为一个或多个端口。
该路由表的每个表项还可以包括一个第二网络设备的标识、第一网络设备到该第二网络设备的跳数。
预设路由算法为现有的任一路由算法，在本发明实施例中，对预设路由算法不作具体限定。路由表可以为转发信息库(英文：Forward Information Base，简称：FIB)表、路由信息库表(英文：Forward Information Base，简称：RIB)或者多路径表等。
例如，控制器生成的一级mesh架构中的S2的路由表如下表3所示：
表3
Figure PCTCN2017089498-appb-000001
Figure PCTCN2017089498-appb-000002
再如，控制器生成的两级mesh架构中的S12的路由表如下表4所示：
表4
Figure PCTCN2017089498-appb-000003
1033：对于每个目标端口，控制器根据该路由表确定该目标端口对应每个第二网络设备的动作，并对于每个第二网络设备，生成包括该目标端口、第二网络设备和该目标端口对应第二网络设备的动作的ACL表项。
控制器根据该路由表确定该目标端口对应每个第二网络设备的动作的步骤可以为：
对于每个目标端口和每个第二网络设备，控制器从该路由表中获取该目标端口对应的该第二网络设备的下一跳出端口，将该下一跳出端口确定为该目标端口对应该第二网络设备的动作。
例如，对于S2上的目标端口S2-A为例，控制器为该目标端口生成的第一类ACL表项如下表5所示：
表5
Figure PCTCN2017089498-appb-000004
Figure PCTCN2017089498-appb-000005
其中，目标端口对应第二网络设备的动作是指向下一跳出接口转发报文，例如目标端口S2-A的目的网络设备为S1时，对应的动作S2-B，S2-C和S2-D是指可以通过下一跳出接口S2-B，S2-C和S2-D中的任意一个转发报文。
再如，为了便于描述，仅从S12的所有端口中选择默认端口类型的目标端口，以S12上的目标端口S12-服务器为例，控制器为该目标端口生成的第一类ACL表项如下表6所示：
表6
Figure PCTCN2017089498-appb-000006
Figure PCTCN2017089498-appb-000007
步骤104：控制器生成第一网络设备的路由表对应的一个第二类ACL表项，第二类ACL表项的动作为跳转到路由表。
第二类ACL表项是指包括路由表的ACL表项。参见图8，本步骤可以通过以下步骤1041-1043实现，包括：
1041：控制器确定第一网络设备上的非目标端口，非目标端口为第一网络设备的所有端口中除目标端口之外的任意一个端口。
1042：控制器为每个非目标端口生成对应的第一类ACL表项。
对于每个非目标端口，控制器根据该路由表确定该非目标端口对应每个第二网络设备的动作，并对于每个第二网络设备，生成包含该非目标端口、第二网络设备和该非目标端口对应第二网络设备的动作的第一类ACL表项，并对每个非目标端口对应的第一类ACL表项进行压缩。
控制器对每个非目标端口对应的第一类ACL表项进行压缩的步骤可以为：
控制器从每个非目标端口对应的ACL表项中提取第二网络设备和该非目标端口对应第二网络设备的动作。
其中，控制器根据该路由表确定该非目标端口对应每个第二网络设备的动作的步骤可以为：
对于每个非目标端口和每个第二网络设备，控制器从该路由表中获取该非非目标端口对应的该第二网络设备的跳数最小的下一跳出端口，将该跳数最小的下一跳出端口确定为该非目标端口对应该第二网络设备的动作。
1043：控制器将每个非目标端口对应的第一类ACL表项压缩为一个第二类ACL表项。
例如，控制器为S2上为非目标端口S2-B、S2-C和S2-D生成的第一类ACL表项，如下表7所示：
表7
Figure PCTCN2017089498-appb-000008
Figure PCTCN2017089498-appb-000009
控制器对每个非目标端口对应的第一类ACL表项进行压缩，也即对表7进行压缩，压缩结果如下表8所示：
表8
Figure PCTCN2017089498-appb-000010
控制器将表8压缩为一个第二类ACL表项，第二类ACL表项的动作为跳转到路由表。
进一步地，第二类ACL表项的动作为跳转到路由表，且只从路由表中查找跳数最小的出端口。
再如，控制器为S12上的非目标端口S12-S11和S12-S13生成的第一类ACL表项，如下表9所示：
表9
Figure PCTCN2017089498-appb-000011
Figure PCTCN2017089498-appb-000012
控制器对每个非目标端口对应的第一类ACL表项进行压缩，也即对表9进行压缩，压缩结果如下表10所示：
表10
Figure PCTCN2017089498-appb-000013
Figure PCTCN2017089498-appb-000014
步骤105：控制器将第二类ACL表项和每个第一类ACL表项添加到第一网络设备的ACL表中。
在该ACL表中，第二类ACL表项的优先级低于每个第一类ACL表项的优先级。
进一步地，控制器也可以将每个目标端口对应的第一类ACL表项和每个非目标端口对应的压缩后的第一类ACL表项添加到第一网络设备的ACL表中。
例如，控制器将表5和表8添加到第一网络设备的ACL表中，得到如下表11：
表11
Figure PCTCN2017089498-appb-000015
再如，控制器将表9和表10添加到第一网络设备的ACL表中，得到如下表12：
表12
Figure PCTCN2017089498-appb-000016
Figure PCTCN2017089498-appb-000017
本发明实施例中减少了ACL表对TCAM资源的需求，使得采用传统网络设备来搭建超大规模的两级mesh架构成为可能，并且该方法适用于任意层次的mesh架构，例如，一级mesh架构、两级mesh架构，甚至是更高阶的mesh架构。
步骤106：向第一网络设备下发该ACL表和路由表。
需要说明的是，步骤106不是必须执行的步骤；如果执行主体为控制器，则需要执行步骤106；如果执行主体为第一网络设备，则不需要执行步骤106。
在本发明实施例中，为第一网络设备的预设端口类型的目标端口生成对应的第一类ACL表项，生成第一网络设备的路由表对应的一个第二类ACL表项，将第二类ACL表项和每个第一类ACL表项添加到第一网络设备的ACL表中；
由于ACL表项中仅包括目标端口对应的第一类ACL表项和路由表对应的一个第二类ACL表项，从而减少了ACL表中包括的ACL表项的数目，降低了对TCAM资源的需求量，方便了数据中心网络扩容。
下述为本发明装置实施例，可以用于执行本发明方法实施例。对于本发明装置实施例中未披露的细节，请参照本发明方法实施例。
图9是本发明实施例提供了生成ACL表的装置，该装置可以为控制器或路由器、交换机等网络设备，且可以应用在一级mesh或多级mesh等网络架构中，该装置包括：处理器201、存储器202和通信接口203，其中，存储器202和通信接口203分别与处理器201连接，存储器202用于存储程序代码，所述程序代码包括计算机操作指令，处理器201执行所述存储器202中存储的程序代码，用于实现上述实施例中控制器的相关处理，并可以通过通信接口203与网络设备进行通信。
处理器201包括一个或者一个以上处理核心。处理器201通过运行软件程序以及模块，从而实现本发明实施例中的步骤及其可选方案。
图10是本发明实施例提供的一种生成ACL表的装置，该装置可以通过软件、硬件或者两者的结合实现成为控制器中的部分或者全部。该装置包括：获取模块301、选择模块302、第一生成模块303、第二生成模块304和添加模块305。
获取模块301工作时，执行上述实施例中的步骤101及其可选方案。
选择模块302工作时，执行上述实施例中的步骤102及其可选方案。
第一生成模块303工作时，执行上述实施例中的步骤103及其可选方案。
第二生成模块304工作时，执行上述实施例中的步骤104及其可选方案。
添加模块305工作时，执行上述实施例中的步骤105及其可选方案。
需要说明的是：上述实施例提供的生成ACL表的装置在生成ACL表时，仅以上述各功能模块的划分进行举例说明，实际应用中，可以根据需要而将上述功能分配由不同的功能模块完成，即将装置的内部结构划分成不同的功能模块，以完成以上描述的全部 或者部分功能。另外，上述实施例提供的生成ACL表的装置与生成ACL表的方法实施例属于同一构思，其具体实现过程详见方法实施例，这里不再赘述。
本领域普通技术人员可以理解实现上述实施例的全部或部分步骤可以通过硬件来完成，也可以通过程序来指令相关的硬件完成，的程序可以存储于一种计算机可读存储介质中，上述提到的存储介质可以是只读存储器，磁盘或光盘等。
以上仅为本发明的较佳实施例，并不用以限制本发明，凡在本发明的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本发明的保护范围之内。

Claims (12)

  1. 一种生成访问控制列表ACL表的方法，其特征在于，所述方法包括：
    获取第一网络设备的每个端口的端口类型；
    根据所述每个端口的端口类型，从所述第一网络设备的所有端口中选择端口类型为预设类型的目标端口；
    为每个目标端口生成对应的第一类ACL表项；
    生成所述第一网络设备的路由表对应的一个第二类ACL表项，所述第二类ACL表项的动作为跳转到所述路由表；
    将所述第二类ACL表项和每个所述第一类ACL表项添加到所述第一网络设备的ACL表中。
  2. 根据权利要求1所述的方法，其特征在于，所述获取第一网络设备的每个端口的端口类型，包括：
    所述第一网络设备上线后，监控所述第一网络设备的每个端口；
    将在预设时长内接收到的通知报文中包括的端口的端口类型确定为互联类型；
    将在预设时长内接收到的通知报文中没有包括的端口的端口类型确定为默认类型。
  3. 根据权利要求2所述的方法，其特征在于，所述互联类型包括组内互联类型和组间互联类型；
    所述将在预设时长内接收到的通知报文中包括的端口的端口类型确定为互联类型，包括：
    对于预设时长内接收到的每个通知报文中的端口，根据所述通知报文中的发送所述通知报文的对端网络设备所属的设备组的标识确定所述对端网络设备和所述第一网络设备是否属于同一个设备组；
    当所述对端网络设备和所述第一网络设备属于同一个设备组时，确定所述端口的端口类型为组内互联类型；
    当所述对端网络设备和所述第一网络设备不属于同一个设备组时，确定所述端口的端口类型为组间互联类型。
  4. 根据权利要求3所述的方法，其特征在于，所述预设类型包括所述默认类型和所述组内互联类型。
  5. 根据权利要求1-4中任意一项所述的方法，其特征在于，所述第一类ACL表项是指包括所述目标端口的ACL表项；
    所述为每个目标端口生成对应的第一类访问控制列表ACL表项，包括：
    确定所述第一网络设备所在网络架构中的第二网络设备，所述第二网络设备为所述网络架构中除所述第一网络设备之外的任意一个网络设备；
    生成所述路由表，所述路由表的每个表项包括所述第一网络设备到一个第二网络设 备的下一跳；
    对于每个目标端口，根据所述路由表确定所述目标端口对应每个第二网络设备的动作，并对于每个第二网络设备，生成包括所述目标端口、所述第二网络设备和所述目标端口对应所述第二网络设备的动作的ACL表项。
  6. 根据权利要求5所述的方法，其特征在于，所述第二类ACL表项的优先级低于每个所述第一类ACL表项的优先级。
  7. 一种生成访问控制列表ACL表的装置，其特征在于，所述装置包括：
    获取模块，用于获取第一网络设备的每个端口的端口类型；
    选择模块，用于根据所述每个端口的端口类型，从所述第一网络设备的所有端口中选择端口类型为预设类型的目标端口；
    第一生成模块，用于为每个目标端口生成对应的第一类ACL表项；
    第二生成模块，用于生成所述第一网络设备的路由表对应的一个第二类ACL表项，所述第二类ACL表项的动作为跳转到所述路由表；
    添加模块，用于将所述第二类ACL表项和每个所述第一类ACL表项添加到所述第一网络设备的ACL表中。
  8. 根据权利要求7所述的装置，其特征在于，所述获取模块，还用于所述第一网络设备上线后，监控所述第一网络设备的每个端口；将在预设时长内接收到的通知报文中包括的端口的端口类型确定为互联类型；将在预设时长内接收到的通知报文中没有包括的端口的端口类型确定为默认类型。
  9. 根据权利要求8所述的装置，其特征在于，所述互联类型包括组内互联类型和组间互联类型；
    所述获取模块，还用于对于预设时长内接收到的每个通知报文中的端口，根据所述通知报文中的发送所述通知报文的对端网络设备所属的设备组的标识确定所述对端网络设备和所述第一网络设备是否属于同一个设备组；当所述对端网络设备和所述第一网络设备属于同一个设备组时，确定所述端口的端口类型为组内互联类型；当所述对端网络设备和所述第一网络设备不属于同一个设备组时，确定所述端口的端口类型为组间互联类型。
  10. 根据权利要求9所述的装置，其特征在于，所述预设类型包括所述默认类型和所述组内互联类型。
  11. 根据权利要求7-10中任意一项所述的装置，其特征在于，所述第一类ACL表项是指包括所述目标端口的ACL表项；
    所述第一生成模块，还用于确定所述第一网络设备所在网络架构中的第二网络设备，所述第二网络设备为所述网络架构中除所述第一网络设备之外的任意一个网络设备；生成所述路由表，所述路由表的每个表项包括所述第一网络设备到一个第二网络设备的下一跳；对于每个目标端口，根据所述路由表确定所述目标端口对应每个第二网络设备的动作，并对于每个第二网络设备，生成包括所述目标端口、所述第二网络设备和所述目标端口对应所述第二网络设备的动作的ACL表项。
  12. 根据权利要求11所述的装置，其特征在于，所述第二类ACL表项的优先级低于每个所述第一类ACL表项的优先级。
PCT/CN2017/089498 2016-08-25 2017-06-22 生成acl表的方法和装置 WO2018036256A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP17842681.3A EP3499810B1 (en) 2016-08-25 2017-06-22 Method and apparatus for generating acl
US16/283,363 US11032198B2 (en) 2016-08-25 2019-02-22 Method and apparatus for generating ACL table

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610724457.6A CN107786497B (zh) 2016-08-25 2016-08-25 生成acl表的方法和装置
CN201610724457.6 2016-08-25

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/283,363 Continuation US11032198B2 (en) 2016-08-25 2019-02-22 Method and apparatus for generating ACL table

Publications (1)

Publication Number Publication Date
WO2018036256A1 true WO2018036256A1 (zh) 2018-03-01

Family

ID=61245396

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/089498 WO2018036256A1 (zh) 2016-08-25 2017-06-22 生成acl表的方法和装置

Country Status (4)

Country Link
US (1) US11032198B2 (zh)
EP (1) EP3499810B1 (zh)
CN (1) CN107786497B (zh)
WO (1) WO2018036256A1 (zh)

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113992561A (zh) * 2020-07-10 2022-01-28 华为技术有限公司 一种报文处理方法及装置
CN112866208B (zh) * 2020-12-31 2022-11-08 迈普通信技术股份有限公司 表项配置方法、报文处理方法、装置、设备及存储介质
US11658976B2 (en) * 2021-01-27 2023-05-23 Arista Networks, Inc. Captive portal redirection and network access restriction of device using a single access control list
CN113438245B (zh) * 2021-06-29 2023-04-07 新华三信息安全技术有限公司 一种信息更新、报文安全性检测方法及装置
CN117319343A (zh) * 2022-06-22 2023-12-29 中兴通讯股份有限公司 策略路由实现方法、设备及存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101035060A (zh) * 2006-03-08 2007-09-12 中兴通讯股份有限公司 一种三重内容可寻址存储器报文分类的统一处理方法
CN101411136A (zh) * 2006-04-03 2009-04-15 极进网络股份有限公司 利用超过cam关键字长度的表索引执行查表操作的方法
CN101651623A (zh) * 2009-09-07 2010-02-17 中兴通讯股份有限公司 访问控制列表应用的生成方法及装置
JP2010057034A (ja) * 2008-08-29 2010-03-11 Nec Infrontia Corp ルータにおけるアクセス制御方法、ルータ、およびアクセス制御プログラム
US20140082122A1 (en) * 2012-09-14 2014-03-20 International Business Machines Corporation Using special-case hardware units for facilitating access control lists on a networking element

Family Cites Families (16)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6377577B1 (en) * 1998-06-30 2002-04-23 Cisco Technology, Inc. Access control list processing in hardware
US7133914B1 (en) * 2001-10-31 2006-11-07 Cisco Technology, Inc. Statistics-preserving ACL flattening system and method
US7313667B1 (en) * 2002-08-05 2007-12-25 Cisco Technology, Inc. Methods and apparatus for mapping fields of entries into new values and combining these mapped values into mapped entries for use in lookup operations such as for packet processing
US7792113B1 (en) * 2002-10-21 2010-09-07 Cisco Technology, Inc. Method and system for policy-based forwarding
US7536476B1 (en) * 2002-12-20 2009-05-19 Cisco Technology, Inc. Method for performing tree based ACL lookups
US8295198B2 (en) * 2007-12-18 2012-10-23 Solarwinds Worldwide Llc Method for configuring ACLs on network device based on flow information
US8719917B1 (en) * 2009-02-17 2014-05-06 Juniper Networks, Inc. Merging firewall filters using merge graphs
US9525647B2 (en) * 2010-07-06 2016-12-20 Nicira, Inc. Network control apparatus and method for creating and modifying logical switching elements
US9571502B2 (en) * 2012-09-14 2017-02-14 International Business Machines Corporation Priority resolution for access control list policies in a networking device
US20140114995A1 (en) * 2012-10-24 2014-04-24 James Madison Kelley Scalable high speed relational processor for databases and networks
US9282056B2 (en) * 2013-03-13 2016-03-08 International Business Machines Corporation Metrics and forwarding actions on logical switch partitions in a distributed network switch
US9594612B2 (en) * 2013-06-28 2017-03-14 Arista Networks, Inc. System and method of a hardware shadow for a network element
CN105791109B (zh) * 2014-12-25 2020-03-10 中兴通讯股份有限公司 多协议标签交换中间节点组播转发的方法、装置和节点
CN104821913B (zh) * 2015-05-05 2019-01-29 新华三技术有限公司 一种数据报文转发方法和装置
CN106302252B (zh) * 2015-05-15 2019-11-26 华为技术有限公司 数据交换系统架构、发送数据流量的方法以及交换装置
US10050804B2 (en) * 2016-06-01 2018-08-14 Pluribus Networks, Inc. Loop-free fabric utilizing distributed address and port tables

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101035060A (zh) * 2006-03-08 2007-09-12 中兴通讯股份有限公司 一种三重内容可寻址存储器报文分类的统一处理方法
CN101411136A (zh) * 2006-04-03 2009-04-15 极进网络股份有限公司 利用超过cam关键字长度的表索引执行查表操作的方法
JP2010057034A (ja) * 2008-08-29 2010-03-11 Nec Infrontia Corp ルータにおけるアクセス制御方法、ルータ、およびアクセス制御プログラム
CN101651623A (zh) * 2009-09-07 2010-02-17 中兴通讯股份有限公司 访问控制列表应用的生成方法及装置
US20140082122A1 (en) * 2012-09-14 2014-03-20 International Business Machines Corporation Using special-case hardware units for facilitating access control lists on a networking element

Also Published As

Publication number Publication date
US11032198B2 (en) 2021-06-08
EP3499810B1 (en) 2020-10-21
EP3499810A4 (en) 2019-08-21
US20190190828A1 (en) 2019-06-20
CN107786497B (zh) 2020-04-14
EP3499810A1 (en) 2019-06-19
CN107786497A (zh) 2018-03-09

Similar Documents

Publication Publication Date Title
WO2018036256A1 (zh) 生成acl表的方法和装置
US10623308B2 (en) Flow routing system
US9813323B2 (en) Systems and methods for controlling switches to capture and monitor network traffic
US10491519B2 (en) Routing method, device, and system
US10142160B1 (en) System and methods for managing network hardware address requests with a controller
US9130870B1 (en) Methods for determining network topologies
AU2011300438B2 (en) Automated traffic engineering for multi-protocol label switching (MPLS) with link utilization as feedback into the tie-breaking mechanism
US8553584B2 (en) Automated traffic engineering for 802.1AQ based upon the use of link utilization as feedback into the tie breaking mechanism
US10469277B2 (en) Multicast group establishment method in fat-tree network, apparatus, and fat-tree network
US10742545B2 (en) Multicasting system
US9331930B1 (en) Systems and methods for forwarding network packets in a network using network domain topology information
JP2017147733A (ja) ＤｉａｍｅｔｅｒシグナリングルータにおいてＤｉａｍｅｔｅｒメッセージをルーティングするための方法、システムおよびコンピュータ読取可能媒体
CN108092896B (zh) 堆叠系统和聚合组建立装置
US9356838B1 (en) Systems and methods for determining network forwarding paths with a controller
US11394635B2 (en) Aggregated bit index explicit replication networking system
CN112087382B (zh) 一种服务路由方法及装置
US9667540B2 (en) Fiber channel over ethernet (FCoE) frame forwarding system
US10491511B1 (en) Feedback-based packet routing system
US8948171B1 (en) System and method for IP multicast
US11356368B2 (en) Pinning bi-directional network traffic to a service device
US11876680B2 (en) Method and apparatus for determining link for forwarding service flow
US10148555B2 (en) Multi-chassis LAG access node determination system
Alqahtani et al. Bert: Scalable source routed multicast for cloud data centers
Kumar et al. Increase in TCP Throughput using Shortest Path Routing Algorithm in Mininet
Raluca et al. Energy-Efficient Virtual Machine Replication for Data Centers

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17842681

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2017842681

Country of ref document: EP

Effective date: 20190313