WO2018177409A1 - 一种报文传输方法及装置 - Google Patents

一种报文传输方法及装置 Download PDF

Info

Publication number
WO2018177409A1
WO2018177409A1 PCT/CN2018/081323 CN2018081323W WO2018177409A1 WO 2018177409 A1 WO2018177409 A1 WO 2018177409A1 CN 2018081323 W CN2018081323 W CN 2018081323W WO 2018177409 A1 WO2018177409 A1 WO 2018177409A1
Authority
WO
WIPO (PCT)
Prior art keywords
packet
vtep
port number
nat device
address
Prior art date
Application number
PCT/CN2018/081323
Other languages
English (en)
French (fr)
Inventor
徐卫平
龙华
何宏伟
刘树成
江元龙
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP18777718.0A priority Critical patent/EP3595271B1/en
Publication of WO2018177409A1 publication Critical patent/WO2018177409A1/zh
Priority to US16/581,826 priority patent/US11252129B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/09—Mapping addresses
    • H04L61/25—Mapping addresses of the same type
    • H04L61/2503—Translation of Internet protocol [IP] addresses
    • H04L61/256—NAT traversal
    • H04L61/2575—NAT traversal using address mapping retrieval, e.g. simple traversal of user datagram protocol through session traversal utilities for NAT [STUN]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/09—Mapping addresses
    • H04L61/25—Mapping addresses of the same type
    • H04L61/2503—Translation of Internet protocol [IP] addresses
    • H04L61/256—NAT traversal
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/09—Mapping addresses
    • H04L61/25—Mapping addresses of the same type
    • H04L61/2503—Translation of Internet protocol [IP] addresses
    • H04L61/2592—Translation of Internet protocol [IP] addresses using tunnelling or encapsulation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4633—Interconnection of networks using encapsulation techniques, e.g. tunneling
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4641—Virtual LANs, VLANs, e.g. virtual private networks [VPN]
    • H04L12/4675—Dynamic sharing of VLAN information amongst network nodes
    • H04L12/4679—Arrangements for the registration or de-registration of VLAN attribute values, e.g. VLAN identifiers, port VLAN membership
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/66—Layer 2 routing, e.g. in Ethernet based MAN's
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/09—Mapping addresses
    • H04L61/25—Mapping addresses of the same type
    • H04L61/2503—Translation of Internet protocol [IP] addresses
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4604—LAN interconnection over a backbone network, e.g. Internet, Frame Relay
    • H04L2012/4629—LAN interconnection over a backbone network, e.g. Internet, Frame Relay using multilayer switching, e.g. layer 3 switching
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/50—Routing or path finding of packets in data switching networks using label swapping, e.g. multi-protocol label switch [MPLS]

Definitions

  • the present application relates to the field of communications technologies, and in particular, to a message transmission method and apparatus.
  • NAT Network Address Translation
  • VXLAN Virtual Extensible LAN
  • the source port number of the encapsulated packet is the port number obtained by the HASH algorithm or the port number obtained by the HASH algorithm.
  • the destination port number is the default port number 4789. If the VXLAN is used to send packets, the two VTEPs are located on the private network and the public network. If the NAT device is deployed on the carrier network, the two VTEPs send packets through the NAT device. The problem of being blocked or discarded.
  • FIG. 1 a schematic diagram of the VTEP B located on the private network side and the VTEPA located on the public network side communicating with the NAT device is shown.
  • the source IP address (Internet Protocol) of packet A is ip1
  • the destination IP address is ip2
  • the source port number is port1
  • the destination port number is 4789.
  • the NAT device converts the source IP address of the packet A from ip1 to ip11, converts the source port number of the packet A from port1 to port11, and then sends the packet A to VTEP A. with The conversion relationship is recorded in the NAT entry.
  • VTEP B When VTEP B sends encapsulated packet B to VTEP A, the source port number of packet B is port3 and the destination port number is 4789. After the packet B is sent to the NAT device, the destination port number 4789 is not recorded in the NAT entry, and the source port number port3 does not match the destination port number 4789 in the packet A sent by VTEP B to VTEP A. As a result, packet B is blocked or discarded in the NAT device, that is, packets cannot pass through the NAT device.
  • the present invention provides a message transmission method and device, which are used to solve the problem that packets existing in a VTEP cannot communicate with a NAT device when communicating through a NAT device.
  • the present application provides a message transmission method, which is applied to a VXLAN, where the VXLAN includes a first VTEP, a second VTEP, and a NAT device, where the first VTEP communicates with the second VTEP through the NAT device, first The VTEP is on the public network and the second VTEP is on the private network.
  • the method includes the following steps: the first VTEP performs VXLAN encapsulation on the first packet to obtain a second packet, and then the first VTEP sends the second packet to the second VTEP through the NAT device.
  • the first packet is a packet to be sent, and the destination port number of the second packet is obtained according to the destination IP address of the second packet, and the source port number of the second packet is a preset port number.
  • the second packet sent by the first VTEP of the public network to the second VTEP of the private network is obtained by the destination port number according to the destination IP address of the second packet.
  • the port number is the default port number.
  • the message transmission method when the first VTEP and the second VTEP communicate through the NAT device, the problem that the packets existing in the prior art cannot traverse the NAT device does not occur.
  • the provided message transmission method can realize the transmission of the message between the first VTEP in the public network and the second VTEP in the private network.
  • the destination port number of the second packet is determined according to the destination IP address of the second packet and the first mapping relationship, where the first mapping relationship is used to indicate that the first VTEP passes through the NAT.
  • the mapping between the source IP address and the source port number of the packet received by the device from the second VTEP.
  • the specific manner of obtaining the first mapping relationship may be: before the first VTEP performs VXLAN encapsulation on the first packet, the first VTEP receives the third packet sent by the second VTEP through the NAT device; The mapping relationship between the source IP address and the source port number of the three packets generates or updates the first mapping relationship.
  • the type of the third packet is not limited, as long as the second VTEP sends a packet to the first VTEP through the NAT device, and the source port number and the destination port number of the packet are By default, the packet can be regarded as the third packet.
  • the third VTEP sends a third packet to the first VTEP, where the first VTEP can generate or update the first mapping relationship according to the mapping relationship between the source IP address and the source port number of the third packet, thereby providing a generation or update.
  • the first VTEP may obtain the second report according to the destination MAC address of the first packet and the second mapping relationship.
  • the destination IP address of the text, the second mapping relationship is used to indicate the mapping relationship between the source IP address of the packet received by the first VTEP and the source MAC address of the VXLAN encapsulation received by the NAT device.
  • the first VTEP may also generate or update the second mapping relationship according to the mapping relationship between the source IP address of the third packet and the source MAC address of the VXLAN encapsulation after receiving the third packet.
  • the first VTEP may receive the detection packet sent by the second VTEP, and the detection packet carries the detection information.
  • the detection information is used to detect whether the first VTEP and the second VTEP communicate with each other through the NAT device.
  • the first VTEP determines, according to the detection information, that the first VTEP and the second VTEP communicate with each other through the NAT device.
  • the detection information includes one or more of the following information: a private network source IP address of the detected packet; a private network source port number of the detected packet; and a calculation according to the private network source IP address and the private network source port number. A calculation result.
  • the detection packet may carry a second identifier, where the second identifier may be used to indicate that the detection packet is a packet used by the NAT device when the first VTEP detects that the first VTEP and the second VTEP communicate.
  • the first VTEP determines, according to the second identifier, whether the detection packet is used by the first VTEP to detect whether the first VTEP and the second VTEP communicate with each other through the NAT device.
  • a VTEP does not process the payload in the detection packet, and only needs to determine whether the first VTEP and the second VTEP communicate with each other through the NAT device.
  • the second identifier is carried in the detection packet to prevent the second VTEP from performing useless processing on the payload in the detection packet, thereby occupying system resources.
  • the first VTEP determines that the first VTEP and the second VTEP communicate with each other through the NAT device according to the detection information included in the detection message.
  • the first VTEP determines, according to the detection information, that the manner in which the first VTEP and the second VTEP communicate with each other through the NAT device includes but is not limited to the following three types:
  • the first VTEP compares the private network source IP address of the detection packet with the source IP address of the detection packet, it is determined that the first VTEP and the second VTEP communicate with each other through the NAT device.
  • the first VTEP compares the private network source port number of the detection packet with the source port number of the detection packet, it determines that the first VTEP and the second VTEP communicate with each other through the NAT device.
  • the first VTEP calculates the source IP address of the detection packet and the source port number of the detection packet to obtain a second calculation result.
  • the second calculation result is different from the first calculation result, the first VTEP and the second VTEP are determined to be performed.
  • the communication passes through the NAT device.
  • the detection information includes the private network source IP address of the detection packet
  • the first VTEP and the second VTEP are determined to communicate.
  • the NAT device translates the private network source IP address of the detected packet into a public network IP address.
  • the first VTEP compares the private network source IP address of the detection packet with the source IP address of the detection packet.
  • the source IP address of the detection packet is the public IP address translated by the NAT device.
  • the first VTEP communicates with the second VTEP through the NAT device.
  • the manner in which the first VTEP and the second VTEP communicate with each other through the NAT device according to the private network source port number of the detection packet carried in the detection information or the first calculation result is similar to the principle in the foregoing example. Let me repeat.
  • the first VTEP may receive a control message sent by an SDN (Software Defined Networking) controller.
  • the control message is used to indicate that the first VTEP and the second VTEP are communicating through the NAT device.
  • the SDN controller determines that the first VTEP and the second VTEP communicate with each other through the NAT device, and passes the information.
  • the control message notifies the first VTEP.
  • the first VTEP can receive the fourth packet sent by the second VTEP through the NAT device, and the fourth packet is used by the NAT device to generate or update its own NAT entry.
  • the NAT entry has an aging period. That is, the NAT device does not receive any packet matching the NAT entry within a certain period of time. The NAT entry is invalid. Therefore, in the foregoing solution, the second VTEP sends the fourth packet to the first VTEP through the NAT device, and the NAT device can update the NAT entry according to the fourth packet, so as to prevent the NAT device from receiving the matching NAT within a certain period of time. The problem that the NAT entry fails due to the packet of the entry.
  • the fourth packet may carry a first identifier indicating a packet type of the fourth packet.
  • the first VTEP may determine, according to the first identifier, that the fourth packet is a packet for generating or updating a NAT entry, so that the payload in the fourth packet is not processed, thereby avoiding Occupy system resources.
  • the present application provides a packet transmission method, which is applied to a VXLAN, where the VXLAN includes a first VTEP, a second VTEP, and a NAT device, where the first VTEP communicates with the second VTEP through the NAT device, first The VTEP is on the public network and the second VTEP is on the private network.
  • the method includes the following steps: the second VTEP receives the second packet sent by the first VTEP through the NAT device, and the second VTEP performs the VXLAN encapsulation on the second packet to obtain the first packet.
  • the source port number and the destination port number of the second packet are preset port numbers, and the destination port number of the second packet is before the NAT device converts the destination port and the destination IP address of the second packet. Obtained by the first VTEP according to the destination IP address of the second packet.
  • the destination port number of the second packet received by the second VTEP is converted by the NAT device, so the destination port of the second packet received by the second VTEP
  • the destination port number of the second packet sent by the first VTEP is different.
  • the destination port number of the second packet (the default port number) is the port obtained after the NAT device matches the NAT entry. number.
  • the destination port number of the second packet sent by the first VTEP to the second VTEP can match the NAT entry because the mapping between the preset port number and the public network port number exists in the NAT device.
  • the message transmission method provided by the second aspect when the first VTEP and the second VTEP communicate through the NAT device, the problem that the packet existing in the prior art cannot traverse the NAT device does not occur, and the second aspect is adopted.
  • the provided message transmission method can realize the transmission of the message between the first VTEP in the public network and the second VTEP in the private network.
  • the second VTEP when the second VTEP receives the second packet whose destination port number is the preset port number, the second VTEP can learn that the second packet is a VXLAN type packet, thereby performing the VXLAN encapsulation on the second packet. , get the first message.
  • the second VTEP may send the third packet to the first VTEP through the NAT device.
  • the source port number and the destination port number of the third packet are preset port numbers, and the third packet is used to generate or update the first mapping relationship, and the first mapping relationship is used to indicate that the first VTEP passes through the NAT device.
  • the third VTEP sends a third packet to the first VTEP, where the first VTEP can generate or update the first mapping relationship according to the mapping relationship between the source IP address and the source port number of the third packet, thereby providing a generation or update.
  • the first mapping relationship may be used by the first VTEP to determine a destination port number (public network port number) of the second packet to be sent by itself.
  • the second VETP may send a detection packet to the first VTEP, and the detection packet is sent.
  • the detection information is used by the first VTEP to detect whether the first VTEP and the second VTEP communicate with each other, and the source port number and the destination port number of the detection packet are preset port numbers.
  • the detection information includes one or more of the following information: a private network source IP address of the detected packet; a private network source port number of the detected packet; and a calculation according to the private network source IP address and the private network source port number. A calculation result.
  • the first VTEP determines that the first VTEP and the second VTEP communicate with each other through the NAT device according to the detection information included in the detection message.
  • the second VTEP may send a registration request message to the SDN controller, where the registration request message is sent.
  • the detection information is carried in, and the detection information is used by the SDN controller to detect whether the first VTEP and the second VTEP communicate with each other when passing through the NAT device.
  • the detection information includes one or more of the following information: a private network source IP address of the detected packet; a private network source port number of the detected packet; and a calculation according to the private network source IP address and the private network source port number. A calculation result.
  • the SDN controller determines the first VTEP and the detection information carried in the registration request message sent by the second VTEP.
  • the second VTEP communicates through the NAT device.
  • the second VTEP may send the fourth packet to the first VTEP through the NAT device, where the fourth packet is used by the NAT device to generate or update its own NAT entry.
  • the source port number and destination port number of the fourth packet are preset port numbers.
  • the NAT entry has an aging period. That is, the NAT device does not receive any packet matching the NAT entry within a certain period of time. The NAT entry is invalid. Therefore, in the foregoing solution, the second VTEP sends the fourth packet to the first VTEP through the NAT device, and the NAT device can update the NAT entry according to the fourth packet, so as to prevent the NAT device from receiving the matching NAT within a certain period of time. The problem that the NAT entry fails due to the packet of the entry.
  • the fourth packet may carry a first identifier indicating a packet type of the fourth packet.
  • the first VTEP may determine, according to the first identifier, that the fourth packet is a packet for generating or updating a NAT entry, so that the payload in the fourth packet is not processed, thereby avoiding Occupy system resources.
  • the present application provides a packet transmission method, which is applied to a VXLAN, where the VXLAN includes a first VTEP, a second VTEP, and a NAT device, where the first VTEP communicates with the second VTEP through the NAT device, first The VTEP is on the public network and the second VTEP is on the private network.
  • the method includes the following steps: the second VTEP performs VXLAN encapsulation on the fifth packet to obtain a fourth packet, where the fifth packet is the original packet to be sent by the second VTEP, and the source port number and destination port of the fourth packet.
  • the number is a preset port number.
  • the fourth packet is used by the NAT device to generate or update its own NAT entry, and is used for the first VTEP to generate or update the mapping relationship.
  • the mapping relationship is used by the first VTEP through the NAT device.
  • the VTEP determines the destination port number and/or the destination IP address of the packet when the VXLAN encapsulation packet is sent.
  • the second VTEP sends the fourth packet to the first VTEP through the NAT device.
  • the VXLAN encapsulated packet is a packet encapsulated by VXLAN.
  • the second packet, the third packet, the fourth packet, and the detection packet in the present application are all VXLAN encapsulated packets; and the first packet and the fifth packet in the present application are not VXLAN encapsulated packets.
  • the second packet obtained by VXLAN encapsulation of the first packet is a VXLAN encapsulated packet; the fourth packet obtained by VXLAN encapsulation of the fifth packet is also a VXLAN encapsulated packet.
  • the NAT entry has an aging period. That is, the NAT device does not receive any packet matching the NAT entry within a certain period of time.
  • the NAT entry is invalid. Therefore, in the method provided by the third aspect, the second VTEP sends the fourth packet to the first VTEP through the NAT device, and the NAT device can update the NAT entry according to the fourth packet, so as to prevent the NAT device from being unavailable for a certain period of time. The problem that the NAT entry is invalid because the packet matching the NAT entry is received.
  • the fourth packet may be used to generate or update a mapping relationship between the first VTEP, and the first VTEP may determine, according to the mapping relationship, a destination port number and/or a destination IP address of the packet sent by the NAT device to the second VTEP.
  • the mapping relationship may be the first mapping relationship or the second mapping relationship in the method provided by the foregoing first aspect or the method provided in the second aspect.
  • the second VTEP sends the fourth packet to the first VTEP by using the NAT device, where the second VTEP periodically sends the fourth packet to the NAT device to the NAT device.
  • First VTEP first VTEP.
  • the present application provides a packet transmission method, where the method is applied to a VXLAN, where the VXLAN includes a first VTEP, a second VTEP, and a NAT device, where the first VTEP communicates with the second VTEP through the NAT device, first The VTEP is on the public network and the second VTEP is on the private network.
  • the method includes the following steps: the first VTEP receives a fourth packet sent by the second VTEP through the NAT device.
  • the fourth packet is used by the NAT device to generate or update its own NAT entry, and is used for the first VTEP to generate or update a mapping relationship, where the mapping relationship is used by the first VTEP to send a VXLAN encapsulation report to the second VTEP through the NAT device.
  • the first VTEP generates or updates the mapping according to the fourth packet.
  • the mapping relationship may be the first mapping relationship or the second mapping relationship in the method provided by the foregoing first aspect or the method provided in the second aspect.
  • the VXLAN encapsulated packet is a packet encapsulated by VXLAN.
  • the second packet, the third packet, the fourth packet, and the detection packet in the present application are all VXLAN encapsulated packets; and the first packet and the fifth packet in the present application are not VXLAN encapsulated packets.
  • the second packet obtained by VXLAN encapsulation of the first packet is a VXLAN encapsulated packet; the fourth packet obtained by VXLAN encapsulation of the fifth packet is also a VXLAN encapsulated packet.
  • the NAT entry has an aging period. That is, the NAT device does not receive any packet matching the NAT entry within a certain period of time.
  • the NAT entry is invalid. Therefore, in the method provided by the fourth aspect, the second VTEP sends the fourth packet to the first VTEP through the NAT device, and the NAT device can update the NAT entry according to the fourth packet, so as to prevent the NAT device from being unavailable for a certain period of time. The problem that the NAT entry is invalid because the packet matching the NAT entry is received.
  • the first VTEP receives the fourth packet sent by the second VTEP through the NAT device, and specifically includes: the first VTEP periodically receives the second VTEP sent by the NAT device. Four messages.
  • the first VTEP may send the second packet to the second VTEP through the NAT device, and second The destination port number of the packet is obtained according to the mapping relationship.
  • the source port number of the second packet is the default port number.
  • the present application provides a message transmission device, which is applied to a VXLAN
  • the VXLAN includes the device, a second VTEP, and a device, wherein the device communicates with a second VTEP through a NAT device, and the device is in a public network.
  • the second VTEP is on a private network.
  • the device includes: a processing module, configured to perform VXLAN encapsulation on the first packet to obtain a second packet, and a transceiver module, configured to send the second packet to the second VTEP through the NAT device.
  • the first packet is a packet to be sent, and the destination port number of the second packet is obtained according to the destination IP address of the second packet, and the source port number of the second packet is a preset port number.
  • the destination port number of the second packet is obtained according to the destination IP address of the second packet and the first mapping relationship, where the first mapping relationship is used to indicate that the transceiver module passes the NAT device.
  • the transceiver module is further configured to: before the processing module performs VXLAN encapsulation on the first packet, receive the third packet sent by the second VTEP through the NAT device; And generating or updating the first mapping relationship according to the mapping relationship between the source IP address and the source port number of the third packet.
  • the processing module is further configured to: before the VXLAN encapsulation of the first packet, obtain the second packet according to the destination MAC address of the first packet and the second mapping relationship.
  • the destination IP address, the second mapping relationship is used to indicate the mapping relationship between the source IP address of the packet received by the transceiver module and the source MAC address of the VXLAN encapsulation received by the NAT device.
  • the transceiver module is further configured to: before the processing module performs VXLAN encapsulation on the first packet, receive the detection packet sent by the second VTEP, and detect that the packet carries the detection information.
  • the detection information is used to detect whether the device passes through the NAT device when communicating with the second VTEP; the processing module is further configured to: according to the detection information, determine that the device and the second VTEP communicate with each other through the NAT device.
  • the detection information includes one or more of the following information: a private network source IP address of the detected packet; a private network source port number of the detected packet; and a calculation according to the private network source IP address and the private network source port number. A calculation result.
  • the determining manner when the processing module passes through the NAT device according to the detection information determining device and the second VTEP, the determining manner includes, but is not limited to, the following three types:
  • the processing module compares the private network source IP address of the detection packet with the source IP address of the detection packet, the determining device passes through the NAT device when communicating with the second VTEP.
  • the processing module compares the private network source port number of the detection packet with the source port number of the detection packet, the determining device passes through the NAT device when communicating with the second VTEP.
  • the processing module calculates the source IP address of the detection packet and the source port number of the detection packet to obtain a second calculation result.
  • the determining device and the second VTEP perform communication.
  • NAT device When the second calculation result is different from the first calculation result, the determining device and the second VTEP perform communication.
  • the transceiver module is further configured to: before the processing module performs VXLAN encapsulation on the first packet, receive a control message sent by the SDN controller, where the control message is used to indicate the device and the second The VTEP communicates through the NAT device.
  • the transceiver module is further configured to receive a fourth packet sent by the second VTEP through the NAT device, where the fourth packet is used by the NAT device to generate or update its own NAT entry. .
  • the fourth packet carries a first identifier, where the first identifier is used to indicate a packet type of the fourth packet.
  • the message transmission apparatus provided by the fifth aspect may be used to perform the message transmission method according to the foregoing first aspect, and the implementation manner and technical effects not described in detail in the message transmission apparatus provided by the fifth aspect may be referred to. A related description in the message transmission method described in the first aspect.
  • the application provides a message transmission device, which is applied to a VXLAN, the VXLAN includes a first VTEP, the device, and a NAT device, wherein the first VTEP communicates with the device through a NAT device, and the first VTEP is in the Public network, the device is on a private network.
  • the device includes: a transceiver module, configured to receive a second packet sent by the first VTEP through the NAT device, where the source port number and the destination port number of the second packet are preset port numbers, and the second packet is before the NAT device
  • the destination port number of the packet is obtained by the first VTEP according to the destination IP address of the second packet
  • the processing module is configured to perform the VXLAN encapsulation on the second packet to obtain the first packet.
  • the transceiver module is further configured to send the third packet to the first VTEP through the NAT device before receiving the second packet sent by the first VTEP through the NAT device.
  • the source port number and the destination port number of the third packet are preset port numbers, and the third packet is used by the first VTEP to generate or update the first mapping relationship, where the first mapping relationship is used to indicate the first VTEP.
  • the transceiver module is further configured to send the detection packet to the first VTEP before receiving the second packet sent by the first VTEP through the NAT device.
  • the detection packet carries the detection information, and the detection information is used by the first VTEP to detect whether the first VTEP and the device pass through the NAT device, and the source port number and the destination port number of the detection packet are preset port numbers.
  • the detection information includes one or more of the following information: a private network source IP address of the detected packet; a private network source port number of the detected packet; and a calculation according to the private network source IP address and the private network source port number. A calculation result.
  • the transceiver module is further configured to send a registration request message to the SDN controller, where the registration request message is carried, before receiving the second packet sent by the first VTEP through the NAT device.
  • the detection information is used by the SDN controller to detect whether the first VTEP and the device pass through the NAT device when communicating.
  • the detection information includes one or more of the following information: a private network source IP address of the detected packet; a private network source port number of the detected packet; and a calculation based on the private network source IP address and the private network source port number. The first calculation result.
  • the transceiver module is further configured to send the fourth packet to the first VTEP through the NAT device.
  • the fourth packet is used by the NAT device to generate or update its own NAT entry.
  • the source port number and the destination port number of the fourth packet are preset port numbers.
  • the fourth packet carries a first identifier, where the first identifier is used to indicate a packet type of the fourth packet.
  • the message transmission apparatus provided by the sixth aspect may be used to perform the message transmission method according to the second aspect, and the implementation manner and technical effects not described in detail in the message transmission apparatus provided by the sixth aspect may be referred to. A related description in the message transmission method described in the second aspect.
  • the present application provides a message transmission apparatus, which is applied to a VXLAN, the VXLAN includes a first VTEP, the apparatus, and a NAT device, wherein the first VTEP communicates with the apparatus through a NAT device, and the first VTEP is in the Public network, the device is on a private network.
  • the device includes: a processing module, configured to perform VXLAN encapsulation on the fifth packet, to obtain a fourth packet, where the fifth packet is the original packet to be sent, and the source port number and the destination port number of the fourth packet are all The fourth port is used by the NAT device to generate or update its own NAT entry, and is used for the first VTEP to generate or update the mapping relationship.
  • the mapping relationship is used by the first VTEP to send the VXLAN encapsulation to the device through the NAT device.
  • the packet is determined by the destination port number and/or the destination IP address of the packet, and the transceiver module is configured to send the fourth packet to the first VTEP through the NAT device.
  • the transceiver module sends the fourth packet to the first VTEP through the NAT device, where the transceiver module periodically sends the fourth packet to the NAT device. To the first VTEP.
  • the message transmission apparatus provided by the seventh aspect may be used to perform the message transmission method according to the foregoing third aspect, and the implementation manner and technical effects not described in detail in the message transmission apparatus provided by the seventh aspect may be referred to. A related description in the message transmission method described in the third aspect.
  • the present application provides a message transmission apparatus, the apparatus being applied to a VXLAN, the VXLAN comprising the apparatus, a second VTEP, and a NAT device, wherein the apparatus communicates with the second VTEP through a NAT device, the apparatus is public Network, the second VTEP is on a private network.
  • the device includes: a transceiver module, configured to receive a fourth packet sent by the second VTEP through the NAT device, where the second VTEP is in a private network, and the fourth packet is used by the NAT device to generate or update its own NAT entry, and The device is configured to generate or update a mapping relationship, where the mapping device is configured to determine a destination port number and/or a destination IP address of the packet when the device sends a VXLAN encapsulation message to the second VTEP by using the NAT device, where the processing module is configured to: Generate or update a mapping relationship according to the fourth message.
  • the transceiver module is configured to receive, by the transceiver module, the second VTEP periodically sent by the NAT device when receiving the fourth packet sent by the second VTEP through the NAT device. Fourth message.
  • the transceiver module sends the second packet to the second VTEP through the NAT device, where the second packet is sent.
  • the destination port number is obtained according to the mapping relationship.
  • the source port number of the second packet is a preset port number.
  • the message transmission apparatus provided in the eighth aspect may be used to perform the message transmission method according to the foregoing fourth aspect, and the implementation manner and technical effects not described in detail in the message transmission apparatus provided by the eighth aspect may be referred to. A related description in the message transmission method described in the fourth aspect.
  • the present application provides a message transmission apparatus, which is applied to a VXLAN
  • the VXLAN includes the apparatus, a second VTEP, and a NAT device, wherein the apparatus communicates with the second VTEP through a NAT device, and the apparatus is installed On the public network, the second VTEP is on the private network.
  • the device includes: a processor, configured to perform VXLAN encapsulation on the first packet, to obtain a second packet, where the first packet is a packet to be sent, and the destination port number of the second packet is based on the destination of the second packet.
  • the IP address is obtained.
  • the source port number of the second packet is a preset port number.
  • the transceiver is configured to send the second packet to the second VTEP through the NAT device.
  • the message transmission apparatus provided in the ninth aspect may be used to perform the message transmission method provided in the first aspect and the fourth aspect, and the message transmission apparatus provided in the ninth aspect may be the fifth aspect and the eighth The same device is provided for the message transmission device.
  • the present application provides a message transmission apparatus, which is applied to a VXLAN, where the VXLAN includes a first VTEP, the apparatus, and a NAT device, wherein the first VTEP communicates with the apparatus through a NAT device, and the first VTEP is public Network, the device is on a private network.
  • the device includes:
  • the transceiver is configured to receive the second packet sent by the first VTEP through the NAT device, where the source port number and the destination port number of the second packet are preset port numbers, and the destination port of the second packet before passing through the NAT device The number is obtained by the first VTEP according to the destination IP address of the second packet;
  • the processor is configured to perform a VXLAN encapsulation on the second packet to obtain a first packet.
  • the message transmission apparatus provided by the tenth aspect may be used to perform the message transmission method provided by the second aspect and the third aspect, and the message transmission apparatus provided by the tenth aspect may be the sixth aspect and the seventh The same device is provided for the message transmission device.
  • the application provides a computer readable storage medium, where computer execution instructions are stored, and when at least one processor of a computing node executes the computer to execute an instruction, the computing node performs the first aspect described above.
  • a method provided by various possible implementations of the first aspect or a method provided by performing the second aspect or various possible implementations of the second aspect, or performing various possible implementations of the third or third aspect described above
  • the application provides a computer program product comprising computer executed instructions stored in a computer readable storage medium.
  • At least one processor of the computing node can read the computer-executable instructions from a computer-readable storage medium, the at least one processor executing the computer-executing instructions to cause the computing node to implement the first aspect or the various possible implementations of the first aspect a method, or a method provided by the second aspect or the various possible implementations of the second aspect, or the method provided by performing the third aspect or the various possible implementations of the third aspect, or performing the fourth aspect or the foregoing Four possible approaches to the various possible implementations.
  • FIG. 1 is a schematic diagram of two VTEPs communicated by a NAT device according to the prior art
  • FIG. 2 is a schematic diagram of a classification of a NAT provided by the present application.
  • FIG. 3 is a schematic diagram of a package format of a VXLAN provided by the present application.
  • FIG. 4 is a schematic diagram of two VTEPs communicating through a NAT device according to the present application.
  • FIG. 5 is a schematic flowchart diagram of a first packet transmission method provided by the present application.
  • FIG. 6 is a schematic structural diagram of a detection packet provided by the present application.
  • FIG. 7 is a schematic flowchart of determining a first VTEP and a second VTEP traversing a NAT device according to the present application
  • FIG. 8 is a schematic structural diagram of a fourth packet provided by the present application.
  • FIG. 9 is a schematic flowchart of a second packet transmission method provided by the present application.
  • FIG. 10 is a schematic flowchart diagram of a third packet transmission method provided by the present application.
  • FIG. 11 is a schematic flowchart diagram of a fourth packet transmission method provided by the present application.
  • FIG. 12 is a schematic structural diagram of a first message transmission apparatus provided by the present application.
  • FIG. 13 is a schematic structural diagram of a second packet transmission apparatus provided by the present application.
  • FIG. 14 is a schematic structural diagram of a third message transmission apparatus provided by the present application.
  • FIG. 15 is a schematic structural diagram of a fourth message transmission apparatus provided by the present application.
  • 16 is a schematic structural diagram of a fifth message transmission apparatus provided by the present application.
  • FIG. 17 is a schematic structural diagram of a sixth message transmission apparatus provided by the present application.
  • FIG. 18 is a schematic structural diagram of a seventh message transmission apparatus provided by the present application.
  • FIG. 19 is a schematic structural diagram of an eighth packet transmission apparatus provided by the present application.
  • FIG. 20 is a schematic structural diagram of a first message transmission system provided by the present application.
  • FIG. 21 is a schematic structural diagram of a second packet transmission system provided by the present application.
  • NAT is a conversion technology that converts the IP address of a private network (hereinafter referred to as a private network IP address) into an IP address of a public network (hereinafter referred to as a public network IP address).
  • a private network IP address a private network
  • a public network IP address a public network IP address
  • NAT is mainly used to implement the function of a private network to access a public network.
  • users with multiple private network IP addresses can access the network when a small number of public IP addresses are used.
  • NAT not only solves the problem of insufficient lP address, but also effectively avoids attacks from outside the network, hiding and protecting computers in the private network.
  • the basic working principle of the NAT is that when the device on the private network side (hereinafter referred to as the private network side device) and the device on the public network side (hereinafter referred to as the public network side device) communicate with each other through the NAT device, the NAT device will source the packet.
  • the IP address or destination IP address is translated between the private IP address and the public IP address.
  • the NAT device When the private network side device sends the packet A to the public network side device, the NAT device translates the private network IP address in the packet A into the public network IP address and sends it to the public network.
  • the private network IP address information is no longer included.
  • the destination IP address of the packet B is the public network IP address, and the packet B is sent to the NAT device.
  • the NAT device translates the destination IP address of the packet B. It is the private network IP address, and then sends the packet B to the corresponding private network side device.
  • the classification of NAT can be as shown in Figure 2.
  • the NAT in the present application refers to a NAT of the Network Address and Port Translation (NAPT) type.
  • NAPT Network Address and Port Translation
  • the difference between NAPT and basic NAT is that NAPT not only performs IP address conversion, but also performs port conversion. That is, the NAT device converts the IP address and also converts the port.
  • VXLAN is a technology for encapsulating Layer 2 (data link layer) packets with a Layer 3 (network layer) protocol. It is an extension of Layer 2 networks on Layer 3 networks.
  • VXLAN provides the same Ethernet Layer 2 service as a VLAN (Virtual Local Area Network), but VXLAN has greater scalability and flexibility than VLAN.
  • the VLAN uses a 12-bit tag VLAN ID to support up to 4094 (2 12 ) Layer 2 network segments, while VXLAN uses a 24-bit tag VNI (Virtual Network Interface) or VNID (Virtual Network ID). Support 16777216 (2 24 ) two-layer network segment.
  • the package format of VXLAN can be as shown in Figure 3.
  • the original packet contains the internal Ethernet header, the internal IP header, and the payload.
  • the VXLAN header and the external UDP are added before the original packet.
  • the VXLAN header includes the VXLAN identifier and the VNI;
  • the external UDP header includes the source port number, the destination port number, the UDP length, and the UDP checksum of the encapsulated packet;
  • the external IP header contains the source IP address of the encapsulated packet and Destination IP address.
  • VTEP handles message transmission
  • the VTEP receives the VXLAN packet sent by the peer (Peer) VTEP;
  • the packet is blocked or discarded.
  • the VTEP on the private network communicates with the VTEP on the public network through the NAT device.
  • the scenario can be as shown in Figure 1.
  • VTEP A is on the public network and VTEP B and VTEP C are on the private network.
  • the packet transmission processing mode is adopted, the packet sent by VTEP B to VTEP A can be transmitted to VTEP A, but because VTEP A is to VTEP.
  • B sends a packet the destination port number of the packet is set to 4789. The destination port number of the packet cannot match the NAT entry of the NAT device. Therefore, the packet sent by VTEP A to VTEP B cannot be transmitted to VTEP. B.
  • the source IP address of the packet A is ip1
  • the destination IP address is ip2
  • the source port number is port1 (randomly obtained or obtained through the HASH algorithm).
  • the destination port number is 4789, where ip1 is the private network IP address.
  • the NAT device converts the private network IP address (ip1) to the public network IP address (ip11,), and converts the source port number corresponding to ip1 from port1 to port11.
  • the NAT table of the NAT device Recorded in the item with At the same time, the NAT device sends message A to VTEPA.
  • the source IP address of the packet B is ip2
  • the destination IP address is ip11
  • the source port number is port3 (randomly obtained or obtained by the HASH algorithm)
  • the destination port number is 4789.
  • the NAT device searches for the NAT entry and cannot find the entry matching the destination port number 4789 of the packet B.
  • the source port number port3 and the VTEPB send the packet A to the VTEPA.
  • the destination port number 4789 in the mismatch does not match. Therefore, packet B is blocked or discarded in the NAT device.
  • the present invention provides a packet transmission method and apparatus, in order to solve the problem that a packet that exists when a VTEP communicates with a NAT device cannot traverse a NAT device.
  • the method and the device are based on the same inventive concept. Since the principles of the method and the device for solving the problem are similar, the implementation of the device and the method can be referred to each other, and the repeated description is not repeated.
  • FIG. 5 is a schematic flowchart diagram of a message transmission method provided by the present application.
  • the method is applied to a VXLAN, where the VXLAN includes a first VTEP, a second VTEP, and a NAT device, wherein the first VTEP communicates with the second VTEP through the NAT device, the first VTEP is in the public network, and the second VTEP is in the private network.
  • the method comprises the following steps:
  • S501 The first VTEP performs VXLAN encapsulation on the first packet to obtain a second packet.
  • the first VTEP sends the second packet to the second VTEP through the NAT device.
  • the first VTEP is in the public network
  • the second VTEP is in the private network
  • the first packet is the first VTEP to be sent.
  • the destination port number of the second packet is obtained according to the destination IP address of the second packet
  • the source port number of the second packet is a preset port number, such as port number 4789.
  • preset port number involved in the present application may be 4789, or may be other port numbers set.
  • the specific value of the preset port number is not limited in this application.
  • the first packet can be regarded as the original packet without the VXLAN encapsulation in the VXLAN encapsulation format shown in FIG. 3, and the second packet can be regarded as the packet after the VXLAN encapsulation is added to the VXLAN encapsulation format shown in FIG. .
  • the first message may be a response message sent by the first VTEP to the second VTEP after the second VTEP sends the request message to the first VTEP, or may be a message sent by the first VTEP to the second VTEP, such as a notification message.
  • the first packet includes the source MAC address and the destination MAC address of the first packet.
  • the source MAC address and the destination MAC address of the first packet are recorded in the internal Ethernet header of the first packet.
  • the destination IP address of the second packet can be obtained according to the destination MAC address of the first packet.
  • the destination IP address of the second packet is recorded in the external IP header.
  • the destination port number of the second packet and the source port number of the second packet are recorded in the external UDP header.
  • the first VTEP and the second VTEP communicate through the NAT device, and the NAT device converts the (destination/source) IP address and the (destination/source) port number of the packet. . Therefore, the packet sent by the first VTEP is different from the destination port number of the packet received by the second VTEP; the packet sent by the second VTEP is compared with the packet received by the first VTEP.
  • the source IP address is different from the source port number.
  • the first VTEP sends a message C to the second VTEP.
  • the destination IP address of the packet C sent by the first VTEP is a public network IP address, and the destination port number is a public network port number.
  • the packet C is sent to the NAT device.
  • the NAT device translates the destination IP address of the packet C from the public network IP address to the private network IP address according to the NAT entry, and the destination port number of the packet C is from the public network port.
  • the number is converted to the private network port number, and then the message C is sent to the second VTEP.
  • the destination IP address of the packet C received by the second VTEP is the private network IP address converted by the NAT device, and the destination port number is also the private network port number converted by the NAT device.
  • the second VTEP sends the packet D to the first VTEP
  • the source IP address of the packet D sent by the second VTEP is the private network IP address
  • the source port number is the private network port number
  • the packet D is sent to the NAT.
  • the NAT device converts the source IP address of the packet D from the private network IP address to the public network IP address according to the NAT entry, and converts the source port number of the packet D from the private network port number to the public network port number.
  • the message D is then sent to the first VTEP.
  • the source IP address of the packet D received by the first VTEP is the public network IP address converted by the NAT device, and the source port number is also the public network port number converted by the NAT device.
  • the destination port number of the second packet needs to be obtained according to the destination IP address of the second packet.
  • the destination IP address of the second packet is obtained by: before the first VTEP performs VXLAN encapsulation on the first packet in S501, the first VTEP is based on the first packet.
  • the destination MAC address and the second mapping relationship are used to obtain the destination IP address of the second packet, where the second mapping relationship is used to indicate the source IP address of the packet received by the first VTEP and received by the NAT device from the second VTEP. Mapping relationship between source MAC addresses of VXLAN encapsulation.
  • the first VTEP may also generate or update the second in the embodiment of the present application, after receiving the third packet, according to the mapping between the source IP address of the third packet and the source MAC address of the VXLAN encapsulation. Mapping relations.
  • the encapsulation format of the packet E can be as shown in Figure 3.
  • the source IP address of the packet E is recorded in the external IP header of the packet E, and the packet E is removed from the VXLAN.
  • the encapsulated source MAC address is recorded in the internal Ethernet header of the message E.
  • the destination IP address of the second packet obtained by the destination MAC address and the second mapping relationship of the first packet is the source IP address of the packet E received by the first VTEP, and the source IP address is a public IP address.
  • the address, the public IP address is used as the destination IP address of the second packet, and the second packet is sent to the NAT device, and then the NAT entry is matched and sent to the second VTEP in the private network.
  • the destination port number of the second packet is obtained according to the destination IP address of the second packet
  • the specific manner of obtaining the destination IP address of the second packet may be: the first VTEP may be according to the second packet.
  • the destination IP address of the second packet is obtained by the destination IP address and the first mapping relationship, where the first mapping relationship is used to indicate the source IP address and the source port of the packet from the second VTEP received by the first VTEP through the NAT device.
  • the mapping relationship of the number is used to indicate the source IP address and the source port of the packet from the second VTEP received by the first VTEP through the NAT device.
  • the source IP address of the received packet F is ip11, and the source port number is port11. Since the packet F is the packet received by the first VTEP, the ip11 is the public network IP address converted by the NAT device, and the port 11 is also the public network port number converted by the NAT device. Then, when the first VTEP device receives the packet F, the NAT device has recorded the mapping relationship between the private network IP address ip1 and the public network IP address ip11, and the private network port number 4789 (preset port number) and the public network. Port mapping of port11.
  • the second packet arrives at the NAT device, because the destination port number of the second packet is based on the destination IP address of the second packet (that is, the source IP address ip11 of the packet F).
  • the destination port number of the second packet is port11
  • the destination port number of the second packet is port11 and the NAT entry in the NAT entry when the NAT device matches the second packet according to the NAT entry.
  • the match succeeds.
  • the source IP address of the second packet is in the ip11 and NAT entries. The matching succeeds.
  • the NAT device can convert the destination IP address of the second packet from the public IP address (ip11) to the private network IP address (ip1), and the destination port number of the second packet from the public network port number (port11). ) is converted to the private network port number (4789), thereby sending the second message to the second VTEP.
  • the first mapping relationship in the present application may be generated or updated in the following manner: before the first VTEP performs VXLAN encapsulation on the first packet in S501, the second VTEP may send the third packet to the first VTEP, where After receiving the third packet, the VTEP may generate or update the first mapping relationship according to the mapping relationship between the source IP address and the source port number of the third packet.
  • the type of the third packet is not limited, as long as the second VTEP sends a packet to the first VTEP through the NAT device, and the source port number and the destination port number of the packet are preset port numbers.
  • This message can be regarded as the third message.
  • the first mapping relationship and the second mapping relationship may be generated, updated, and maintained by the first VTEP.
  • the first mapping relationship and the second mapping relationship are generated or updated.
  • the first VTEP may generate or update the first mapping relationship according to the mapping relationship between the source IP address and the source port number of the third packet.
  • the first mapping relationship is generated or updated according to the mapping relationship between the source IP address of the fourth packet and the source port number, or the first mapping relationship may be generated or updated according to the mapping relationship between the source IP address and the source port number of the packet;
  • the first VTEP may generate or update the second mapping relationship according to the third message, the fourth message, or the detection message.
  • the operation of generating or updating the first mapping relationship and the second mapping relationship may also be performed by the SDN controller.
  • the SDN controller receives the packet sent by the second VTEP, and generates or updates the first mapping relationship and the first according to the packet.
  • the second mapping relationship is then sent to the first VTEP by the generated or updated first mapping relationship and the second mapping relationship.
  • the first VTEP After the first VTEP generates or updates the first mapping relationship and the second mapping relationship, or after the first VTEP receives the first mapping relationship and the second mapping relationship sent by the SDN controller, it may be regarded that the first VTEP maintains the first mapping relationship and The second mapping relationship. In order to implement communication between the first VTEP and the second VTEP through the NAT device, the first VTEP needs to maintain the first mapping relationship and the second mapping relationship.
  • S503 The second VTEP performs the VXLAN encapsulation on the received second packet to obtain the first packet.
  • the first VTEP sends the second packet to the second VTEP through the NAT device, and the NAT device converts the destination IP address and the destination port number of the second packet according to the NAT entry, and then sends the packet to the first VTEP.
  • Two VTEP Therefore, the destination port number of the second packet received by the second VTEP is different from the destination port number of the second packet sent by the first VTEP, and the destination IP address of the second packet received by the second VTEP, and the The destination IP address of the second packet sent by a VTEP is different. After the destination port number of the second packet received by the second VTEP is converted by the NAT device, the default port number is changed.
  • the VTEP can determine that the packet is a VXLAN type packet, and thus perform corresponding processing on the packet, such as the VXLAN solution. Processing such as packaging.
  • the destination port number of the second packet sent by the first VTEP to the second VTEP is a port number determined according to the destination IP address of the second packet, but when the second packet is sent to the NAT device, the NAT device The destination port number of the second packet is converted to the second VTEP according to the NAT entry, and the destination port number of the converted second packet is the preset port number.
  • the destination port number of the second packet is a preset port number, and the second VTEP determines that the second packet is a VXLAN type packet, thereby The second packet is encapsulated in the VXLAN to obtain the first packet.
  • the number of NAT devices that pass through when the first VTEP and the second VTEP are communicated in this application is not limited. Since the processing of the first VTEP and the second VTEP is similar to the processing of the first VTEP and the second VTEP when the first VTEP and the second VTEP are communicated, the first VTEP and the second VTEP are used in the present application.
  • a NAT device is used as an example for communication.
  • the second packet sent by the first VTEP in the public network to the second VTEP in the private network is obtained by using the packet transmission method shown in FIG. 5, and the destination port number is obtained according to the destination IP address of the second packet.
  • the port number is the default port number.
  • the source port number (preset port number) of the second packet matches the preset port number in the NAT entry, and the destination port number of the second packet is According to the destination IP address of the second packet, the destination IP address of the second packet can be matched to the NAT entry in the NAT device, and the destination port of the second packet can be matched to the NAT device. NAT entry. Therefore, the message transmission method shown in FIG.
  • the illustrated message transmission method can realize the transmission of the message between the first VTEP in the public network and the second VTEP in the private network.
  • the second VTEP can be determined after receiving the converted second packet.
  • the second packet is a VXLAN-type packet, and the second packet is encapsulated in a VXLAN to obtain a first packet.
  • the transmission method of the message shown in FIG. 5 is based on the premise that the first VTEP and the second VTEP communicate through the NAT device. Then, before executing S501, it may be determined that there are multiple ways of passing through the NAT device when the first VTEP and the second VTEP communicate. Only two of them are listed below.
  • the first VTEP determines that the first VTEP and the second VTEP are communicating through the NAT device.
  • the specific method is as follows:
  • the second VETP sends a detection packet to the first VTEP, where the detection packet carries detection information, where the detection information is used by the first VTEP to detect whether the first VTEP and the second VTEP communicate with each other, and the first VTEP receives the first
  • the first VTEP sends a detection message sent by the VTEP, and the first VTEP determines, according to the detection information, that the first VTEP and the second VTEP communicate with each other through the NAT device.
  • the source port number and the destination port number of the detection packet are preset port numbers.
  • the detection information includes one or more of the following information: the private network source IP address of the packet is detected; and the private network source port number of the packet is detected.
  • the first calculation result calculated according to the private network source IP address and the private network source port number.
  • the detection packet may further carry a second identifier, where the second identifier may be used to indicate that the detection packet is used by the first VTEP to detect whether the first VTEP and the second VTEP communicate with each other through the NAT device.
  • the VTEP determines, according to the second identifier, whether the detection packet is a packet for the first VTEP to detect whether the first VTEP and the second VTEP communicate with the NAT device, so that the first VTEP
  • the payload in the detection packet is not processed, and only the first VTEP and the second VTEP are required to communicate with each other through the NAT device.
  • the second identifier is carried in the detection packet to prevent the second VTEP from performing useless processing on the payload in the detection packet, thereby occupying system resources.
  • a package format of the detection packet can be as shown in FIG. 6.
  • the second identifier is carried in the VXLAN header of the detection message; the detection information can be carried behind the VXLAN header.
  • the detection information is carried in a part of the detection packet.
  • the detection information may be carried in the VXLAN header of the detection packet, or may be carried behind the VXLAN header.
  • the specific manner in which the first VTEP determines that the first VTEP and the second VTEP communicate through the NAT device according to the detection information is also different.
  • the first VTEP and the second VTEP are determined when the first VTEP compares the private network source IP address of the detection packet with the source IP address of the detection packet.
  • the communication passes through the NAT device. This is because if the first VTEP and the second VTEP communicate with each other through the NAT device, the NAT device translates the private network source IP address of the detected packet into a public network IP address.
  • the first VTEP compares the private network source IP address of the detection packet with the source IP address of the detection packet. If the two are different, the source IP address of the detection packet is the public IP address translated by the NAT device.
  • the first VTEP communicates with the second VTEP through the NAT device.
  • the detection information includes the private network source port number of the detection packet
  • the first VTEP and the second VTEP are determined.
  • the communication passes through the NAT device. This is because if the first VTEP and the second VTEP communicate with each other, the NAT device converts the private network source port number of the detected packet to the public network port number.
  • the first VTEP compares the private network source port number of the detection packet with the source port number of the detection packet. If the two are different, the source port number of the detection packet is the public network port number converted by the NAT device.
  • the first VTEP communicates with the second VTEP through the NAT device.
  • the first VTEP calculates the source IP address of the detection packet and the source port number of the detection packet.
  • Obtaining a second calculation result when the second calculation result is different from the first calculation result, determining that the first VTEP and the second VTEP communicate with each other through the NAT device.
  • the NAT device converts the private network source IP address of the detected packet into a public network IP address, and detects the private network source port number of the detected packet. Is the public network port number.
  • the first VTEP calculates the source IP address of the detection packet and the source port number of the detection packet, and obtains a second calculation result. If the second calculation result is different from the first calculation result in the detection information, the detection packet is
  • the source IP address of the private network is the public IP address translated by the NAT device.
  • the source port of the private network is the port number of the public network that is translated by the NAT device. This indicates that the first VTEP and the second VTEP communicate with each other. device.
  • the detection message may be used by the NAT device in addition to being used by the first VTEP to determine that the first VTEP and the second VTEP are in communication, and may also be used by the first VTEP to generate or update the first mapping relationship and the second mapping relationship. That is, if the first mapping relationship is not generated when the first VTEP receives the detection packet, the first VTEP may generate the first mapping relationship according to the correspondence between the source IP address and the source port number of the detection packet; If the first mapping relationship is not generated when the first VTEP receives the detection packet, the first VTEP may generate a second mapping relationship according to the mapping between the source IP address of the detection packet and the source MAC address of the VXLAN encapsulation. If the first mapping relationship and the second mapping relationship are generated, the first VTEP may update the first mapping relationship and the second mapping relationship according to the detection packet.
  • the SDN controller determines that the first VTEP and the second VTEP are communicating with each other through the NAT device.
  • the control protocol between the SDN controller and the first VTEP or the second VTEP includes NETCONF and Openflow. Based on the above control protocol, the SDN controller can communicate with the first VTEP or the second VTEP.
  • the specific manner in which the SDN controller determines that the first VTEP and the second VTEP communicate with each other through the NAT device can be as shown in FIG. 7:
  • the second VTEP sends a registration request message to the SDN controller, where the registration request message carries detection information, and the detection information is used by the SDN controller to detect whether the first VTEP and the second VTEP communicate with each other through the NAT device; the SDN controller After receiving the registration request message, determining, according to the detection information carried in the registration request message, that the first VTEP and the second VTEP communicate with each other through the NAT device, and then the SDN controller sends a control message to the first VTEP, where the control message is used to indicate A VTEP communicates with the second VTEP through the NAT device.
  • the detection information includes one or more of the following information: a private network source IP address of the detected packet; a private network source port number of the detected packet; and a calculation according to the private network source IP address and the private network source port number. A calculation result.
  • the SDN controller determines, according to the detection information, that the specific manner in which the first VTEP and the second VTEP communicate through the NAT device is different.
  • the SDN controller determines, according to the detection information, that the first VTEP and the second VTEP communicate with each other through the NAT device, and is similar to the method of the NAT device when the first VTEP determines that the first VTEP and the second VTEP communicate by the first VTEP. , will not repeat them here.
  • the first VTEP and the second VTEP may use the packet transmission method provided by the prior art; according to the first manner or the foregoing
  • the two modes determine that the working mode of the first VTEP and the second VTEP can be switched after the first VTEP and the second VTEP communicate through the NAT device, which is referred to as “traversing NAT mode” in this application.
  • the first VTEP and the second VTEP After switching to the working mode, the first VTEP and the second VTEP perform the message transmission method shown in FIG. 5, so that the first VTEP and the second VTEP can communicate through the NAT device.
  • the operation of switching the working mode may be performed by the SDN controller indicating the first VTEP and the second VTEP.
  • the NAT entry has an aging period. That is, the NAT device does not receive any packet matching the NAT entry within a certain period of time.
  • the NAT entry is invalid. Therefore, in the present application, the second VTEP may send the fourth packet to the first VTEP through the NAT device, where the fourth packet may be used by the NAT device to generate or update its own NAT entry, and the source port number of the fourth packet. And the destination port number are preset port numbers.
  • the second VTEP may periodically send the fourth packet, and the sending period may be shorter than the aging period of the NAT entry.
  • the NAT device When receiving the fourth packet sent by the second VTEP, the NAT device refreshes the NAT entry: if the source IP address of the fourth packet and the source port number do not exist, the entry is generated, if the fourth If the entry corresponding to the source IP address and source port number of the packet already exists, the aging time of the entry is updated.
  • the fourth packet can be used not only for the NAT device to update its own NAT entry, but also for the first VTEP to generate or update the first mapping relationship and the second mapping relationship. That is, if the first mapping relationship is not generated when the first VTEP receives the fourth packet, the first VTEP may generate the first mapping according to the mapping relationship between the source IP address and the source port number of the fourth packet. Relationship; if the first mapping relationship is not generated when the first VTEP receives the fourth packet, the first VTEP may generate the first mapping relationship according to the source IP address of the fourth packet and the source MAC address of the VXLAN encapsulation. The second mapping relationship. If the first mapping relationship and the second mapping relationship are generated when the first VTEP receives the fourth packet, the first VTEP may update the first mapping relationship and the second mapping relationship according to the fourth packet.
  • the fourth packet may carry a first identifier, where the first identifier may be used to indicate that the fourth packet is a packet for generating or updating a NAT entry, and then the first VTEP receives the fourth packet, that is, after the first VTEP receives the fourth packet,
  • the fourth packet is determined to be a packet for generating or updating a NAT entry according to the first identifier, so that the payload in the fourth packet is not processed, and system resources are not occupied.
  • the message format of a fourth message can be as shown in FIG. 8.
  • the first identifier can be carried in the VXLAN header of the detection message.
  • the timing of sending the fourth packet by the second VTEP is not limited.
  • the second VTEP may send the fourth packet before executing S503, or may send the fourth packet after executing S503.
  • the second VTEP may also send a fourth message or the like before the first VTEP performs S501.
  • the present application further provides a message transmission method, which is applied to a VXLAN, where the VXLAN includes a first VTEP, a second VTEP, and a NAT device, wherein the first VTEP communicates with the second VTEP through the NAT device, and the first VTEP is in the Public network, the second VTEP is on a private network.
  • a message transmission method which is applied to a VXLAN, where the VXLAN includes a first VTEP, a second VTEP, and a NAT device, wherein the first VTEP communicates with the second VTEP through the NAT device, and the first VTEP is in the Public network, the second VTEP is on a private network.
  • S901 The second VTEP performs VXLAN encapsulation on the fifth packet to obtain a fourth packet.
  • the fifth packet is the original packet to be sent by the second VTEP, and the source port number and the destination port number of the fourth packet are preset port numbers, and the fourth packet is used by the NAT device to generate or update its own NAT.
  • the entry is used for the first VTEP to generate or update the mapping relationship, and the mapping relationship is used to determine the destination port number and/or the destination IP address of the packet when the first VTEP sends the VXLAN encapsulation message to the second VTEP through the NAT device. .
  • mapping relationship in the method shown in FIG. 9 may be the first mapping relationship and/or the second mapping relationship in the method shown in FIG. 5.
  • the mapping relationship in the method shown in FIG. 9 may be the first mapping relationship and/or the second mapping relationship in the method shown in FIG. 5.
  • the VXLAN encapsulated packet refers to the packet encapsulated by VXLAN.
  • the second packet, the third packet, the fourth packet, and the detection packet in the present application are all VXLAN encapsulated packets.
  • the encapsulation format of VXLAN encapsulated packets can be as shown in Figure 3.
  • the first packet and the fifth packet in the present application are packets that are not encapsulated by VXLAN, that is, the original packet in FIG.
  • the second packet obtained by the VXLAN encapsulation of the first packet that is, the VXLAN encapsulation described in FIG.
  • VXLAN encapsulation packet 3 is added before the first packet
  • the fifth packet is VXLAN encapsulated (ie, The fourth packet obtained by adding the VXLAN package shown in FIG. 3 to the fifth packet is also a VXLAN encapsulated packet.
  • S902 The second VTEP sends the fourth packet to the first VTEP through the NAT device.
  • the first VTEP receives the fourth packet sent by the second VTEP through the NAT device.
  • S904 The first VTEP generates or updates the foregoing mapping relationship according to the fourth packet.
  • the NAT entry has an aging period. That is, the NAT device does not receive any packet matching the NAT entry within a certain period of time. The NAT entry is invalid. Therefore, in the present application, the second VTEP may send the fourth packet to the first VTEP through the NAT device, where the fourth packet may be used by the NAT device to update its own NAT entry, the source port number and destination of the fourth packet.
  • the port numbers are all preset port numbers.
  • the second VTEP may periodically send the fourth packet, and the sending period may be shorter than the aging period of the NAT entry.
  • the NAT device refreshes the NAT entry when the fourth packet sent by the second VTEP is received. If the source IP address of the fourth packet does not exist, the entry is created. If the entry corresponding to the source IP address and source port number of the packet already exists, the aging time of the entry is updated.
  • the first VTEP may send the second packet to the second VTEP through the NAT device, and the destination port number of the second packet is according to the mapping relationship.
  • the source port number of the second packet is the default port number.
  • the first VTEP After the fourth VTEP receives the fourth packet and generates or updates the mapping according to the fourth packet, the first VTEP sends the second packet to the second VTEP.
  • the NAT entry of the NAT device can be avoided.
  • the present application further provides a message transmission method, which can be regarded as a specific example of the method shown in FIG. 5. As shown in FIG. 10, the method includes the following steps:
  • the second VTEP sends the probe packet to the first VTEP through the NAT device.
  • the detection packet is used by the first VTEP to detect whether the second VTEP traverses the NAT device when sending the probe packet to the first VTEP, and the detection packet carries the detection information. If the probe packet traverses the NAT device, the NAT device is deployed on the public network side, and the first VTEP and the second VTEP communicate with each other through the NAT device.
  • the source port number and destination port number of the probe packet are 4789, the source IP address is ip1, and the destination IP address is ip2.
  • the first VTEP detects whether the probe packet traverses the NAT device.
  • the first VTEP can detect whether the detection packet traverses the NAT device according to the detection information in the detection packet.
  • the specific detection method refer to the related description in FIG.
  • the working mode is set to traverse the NAT mode.
  • the NAT device After the packet is sent to the NAT device, the NAT device translates the source IP address of the packet from ip1 to ip11 and converts the source port number of the packet from 4789 to port11.
  • the first VTEP compares ip11 with ip1 in the detection information, or compares port11 with 4789 in the detection information, or compares the second calculation result and the detection information calculated according to ip11 and port11.
  • a calculation result (calculated according to ip1 and 4789) determines that the probe message traverses the NAT device.
  • the NAT device sends the detection packet to the first VTEP and records the NAT entry of the NAT device. as well as The conversion relationship is the NAT entry.
  • the working mode is set to traverse the NAT mode.
  • the second VTEP sends the third packet to the first VTEP through the NAT device.
  • the source port number and destination port number of the third packet are 4789.
  • the source IP address of the third packet is ip1 and the destination IP address is ip2.
  • the NAT device converts the source IP address ip1 of the third packet to ip11 according to the NAT entry, and converts the source port number 4789 of the third packet to port11 and refreshes its own NAT entry. .
  • the first VTEP generates a first mapping relationship according to the mapping relationship between the source IP address and the source port number of the received third packet.
  • the first mapping relationship is used to indicate a mapping relationship between ip11 and port11.
  • the first VTEP performs VXLAN encapsulation on the first packet to obtain a second packet.
  • the source IP address of the second packet is ip2, the destination IP address is ip11, and the destination port number of the second packet is obtained according to the destination IP address ip11 of the second packet and the first mapping relationship, that is, port11, The source port number of the second packet is 4789.
  • the first VTEP may obtain the destination IP address of the second packet according to the destination MAC address of the first packet and the second mapping relationship, where the second mapping relationship is used to indicate that the first VTEP is received by the NAT device.
  • the first VTEP sends the second packet to the second VTEP through the NAT device.
  • the NAT device When receiving the second packet, the NAT device converts the destination IP address ip11 of the second packet to ip1 and the destination port number port11 of the second packet to 4789 by matching the NAT entry of the second packet.
  • the second message is sent to the second VTEP in the private network.
  • the second VTEP performs the VXLAN encapsulation on the second packet to obtain the first packet.
  • the second VTEP After receiving the second packet, the second VTEP determines that the second packet is a VXLAN type packet by identifying the destination port number of the second packet, and then decapsulating the second packet into a VXLAN encapsulation. First message.
  • the second VTEP periodically sends the fourth message to the first VTEP.
  • the source port number and destination port number of the fourth packet are 4789, the source IP address is ip1, and the destination IP address is ip2.
  • the fourth packet is used by the NAT device to refresh the NAT entry. After receiving the fourth packet, the NAT device refreshes the NAT entry. as well as ), to prevent NAT entries from failing.
  • the first VTEP may update the first mapping relationship and the second mapping relationship according to the fourth packet.
  • the method shown in FIG. 10 can be regarded as a specific example of the method shown in FIG. 5.
  • the implementation not described in detail in FIG. 10 can be referred to the related description in FIG.
  • FIG. 11 is a diagram showing changes in source IP address, destination IP address, source port number, and destination port number of each packet before and after passing through the NAT device when the packet is transmitted by using the method shown in FIG. 11 can more easily understand the operational flow of the method shown in FIG. 11
  • the message transmission method provided by the present application solves the problem that the packet existing in the prior art cannot traverse the NAT device when the first VTEP and the second VTEP communicate through the NAT device, and the packet is implemented. Transmission between the first VTEP of the public network and the second VTEP of the private network.
  • the application provides a message transmission device, which is applied to a VXLAN, the VXLAN includes the device, a second VTEP, and a NAT device, wherein the device communicates with the second VTEP through a NAT device, the device is in a public network, and the second VTEP On a private network.
  • the apparatus can be used to perform the operations performed by the first VTEP in the methods illustrated in Figures 5, 7, 9, and 10, the apparatus being in a public network.
  • the message transmission device 1200 includes a processing module 1201 and a transceiver module 1202.
  • the processing module 1201 is configured to perform VXLAN encapsulation on the first packet to obtain a second packet
  • the transceiver module 1202 is configured to send the second packet to the second VTEP through the NAT device, and the second VTEP On a private network.
  • the first packet is a packet to be sent, and the destination port number of the second packet is obtained according to the destination IP address of the second packet, and the source port number of the second packet is a preset port number.
  • the destination port number of the second packet is obtained according to the destination IP address of the second packet and the first mapping relationship, where the first mapping relationship is used to instruct the transceiver module 1202 to receive the second VTEP from the second VTEP.
  • the transceiver module 1202 is further configured to: before the processing module 1201 performs VXLAN encapsulation on the first packet, receive a third packet sent by the second VTEP through the NAT device; the processing module 1201 is further configured to: according to the third packet The mapping relationship between the source IP address and the source port number generates or updates the first mapping relationship.
  • the processing module 1201 is further configured to: before the VXLAN encapsulation of the first packet, obtain the destination IP address of the second packet according to the destination MAC address of the first packet and the second mapping relationship, where the second mapping relationship is used.
  • the mapping between the source IP address of the packet from the second VTEP and the source MAC address of the VXLAN encapsulation received by the transceiver module 1202 through the NAT device is indicated.
  • the transceiver module 1202 is further configured to: before the processing module 1201 performs VXLAN encapsulation on the first packet, receive the detection packet sent by the second VTEP, where the detection packet carries detection information, where the detection information is used to detect the device. Whether the NAT device is used when communicating with the second VTEP; the processing module 1201 is further configured to: according to the detection information, determine that the device and the second VTEP communicate with each other through the NAT device.
  • the detection information includes one or more of the following information: a private network source IP address of the detected packet; a private network source port number of the detected packet; and a calculation according to the private network source IP address and the private network source port number. A calculation result.
  • the processing module 1201 is configured to: when the determining device and the second VTEP communicate according to the detection information, the processing module 1201 compares the private network source IP address of the detection packet with the detection packet. When the source IP address is different, the determining device and the second VTEP communicate with each other through the NAT device; and/or, when the processing module 1201 compares the private network source port number of the detection packet with the source port number of the detection packet, the determining device and The second VTEP communicates with the NAT device; and/or, the processing module 1201 calculates the source IP address of the detection packet and the source port number of the detection packet, to obtain a second calculation result, and the second calculation result and the first When the calculation result is different, the determining device and the second VTEP communicate with each other through the NAT device.
  • the transceiver module 1202 is further configured to: before the processing module 1201 performs VXLAN encapsulation on the first packet, receive a control message sent by the SDN controller, where the control message is used to indicate that the device and the second VTEP communicate with each other through the NAT device. .
  • the transceiver module 1202 is further configured to: receive a fourth packet sent by the second VTEP through the NAT device, where the fourth packet is used by the NAT device to generate or update its own NAT entry.
  • the fourth packet carries a first identifier, where the first identifier is used to indicate a packet type of the fourth packet.
  • modules in the present application is schematic, and is only a logical function division, and may be further divided in actual implementation.
  • the functional modules in the embodiments of the present application may be integrated into one processing module, or each module may exist physically separately, or two or more modules may be integrated into one module.
  • the above integrated modules can be implemented in the form of hardware or in the form of software functional modules.
  • the message transmission apparatus 1200 can be used to perform the operations performed by the first VTEP in the message transmission methods shown in FIG. 5, FIG. 7, FIG. 9, and FIG.
  • the message transmission apparatus 1200 can be used to perform the operations performed by the first VTEP in the message transmission methods shown in FIG. 5, FIG. 7, FIG. 9, and FIG.
  • FIG. 13 is a schematic diagram showing another possible structure of the message transmission apparatus involved in the above embodiment.
  • the message transmission device 1300 includes a transceiver 1301, a processor 1302, and a memory 1303.
  • the transceiver 1301, the processor 1302, and the memory 1303 are connected by a bus.
  • the transceiver 1301 is configured to support the transmission and reception of information between the message transmission device 1300 and other devices, such as the second VTEP.
  • the processor 1302 executes the message transmission methods illustrated in FIGS. 5, 7, 9, and 10 by calling program codes and data stored in the memory 1303.
  • the message transmission device 1300 can be the same device as the message transmission device 1200, and the message transmission device 1300 can be used to execute the first VTEP performed in the message transmission method shown in FIG. 5, FIG. 7, FIG. 9, and FIG. operating.
  • the application provides a message transmission device, which is applied to a VXLAN, the VXLAN includes a first VTEP, the device, and a NAT device, wherein the first VTEP communicates with the device through a NAT device, and the first VTEP is in a public network, and the device On a private network.
  • the apparatus can be used to perform the operations performed by the second VTEP in the methods illustrated in Figures 5, 7, 9, and 10, which is in a private network.
  • the message transmission device 1400 includes a transceiver module 1401 and a processing module 1402.
  • the transceiver module 1401 is configured to receive the second packet sent by the first VTEP through the NAT device, where the first VTEP is in the public network, and the source port number and the destination port number of the second packet are preset.
  • the port number of the second packet is obtained by the first VTEP according to the destination IP address of the second packet before passing through the NAT device.
  • the processing module 1402 is configured to perform the VXLAN encapsulation on the second packet to obtain the first Message.
  • the transceiver module 1401 is further configured to: before receiving the second packet sent by the first VTEP through the NAT device, send the third packet to the first VTEP through the NAT device, and source port number and destination of the third packet.
  • the port number is a preset port number
  • the third packet is used by the first VTEP to generate or update the first mapping relationship, where the first mapping relationship is used to indicate the source of the packet received by the first VTEP through the NAT device. Mapping between IP address and source port number.
  • the transceiver module 1401 is further configured to send a detection packet to the first VTEP before receiving the second packet sent by the first VTEP, and the detection packet carries the detection information, where the detection information is used for the first VTEP. Detecting whether the first VTEP and the device pass through the NAT device, and the source port number and the destination port number of the detection packet are preset port numbers; wherein the detection information includes one or more of the following information: detecting the private of the packet Network source IP address; the private network source port number of the detected packet; the first calculation result calculated based on the private network source IP address and the private network source port number.
  • the transceiver module 1401 is further configured to: before receiving the second packet sent by the first VTEP through the NAT device, send a registration request message to the SDN controller, where the registration request message carries the detection information, and the detection information is used by the SDN controller. Detecting whether the first VTEP and the device pass through the NAT device when communicating;
  • the detection information includes one or more of the following information: a private network source IP address of the detected packet; a private network source port number of the detected packet; and a calculation according to the private network source IP address and the private network source port number. A calculation result.
  • the transceiver module 1401 is further configured to send the fourth packet to the first VTEP through the NAT device, and the fourth packet is used by the NAT device to generate or update its own NAT entry, and the fourth packet is
  • the source port number and destination port number are preset port numbers.
  • the fourth packet carries a first identifier, where the first identifier is used to indicate a packet type of the fourth packet.
  • the message transmission device 1400 can be used to perform the operations performed by the second VTEP in the message transmission methods shown in FIG. 5, FIG. 7, FIG. 9, and FIG.
  • the message transmission device 1400 can be used to perform the operations performed by the second VTEP in the message transmission methods shown in FIG. 5, FIG. 7, FIG. 9, and FIG.
  • FIG. 15 is a schematic diagram showing another possible structure of the message transmission apparatus involved in the above embodiment.
  • the message transmission device 1500 includes a transceiver 1501, a processor 1502, and a memory 1503.
  • the transceiver 1501, the processor 1502, and the memory 1503 are connected by a bus.
  • the transceiver 1501 is configured to support the transmission and reception of information between the message transmission device 1500 and other devices, such as the first VTEP.
  • the processor 1502 executes the message transmission methods illustrated in FIGS. 5, 7, 9, and 10 by calling program codes and data stored in the memory 1503.
  • the message transmission device 1500 can be the same device as the message transmission device 1400, and the message transmission device 1500 can be used to execute the second VTEP performed in the message transmission method shown in FIG. 5, FIG. 7, FIG. 9, and FIG. operating.
  • the message transmission apparatus 1500 can be the same device as the message transmission device 1400, and the message transmission device 1500 can be used to execute the second VTEP performed in the message transmission method shown in FIG. 5, FIG. 7, FIG. 9, and FIG. operating.
  • the present application provides a message transmission apparatus that can be used to perform the operations performed by the second VTEP in the method illustrated in FIG. 9, the apparatus being in a private network.
  • the message transmission device 1600 includes a processing module 1601 and a transceiver module 1602.
  • the processing module 1601 is configured to perform VXLAN encapsulation on the fifth packet to obtain a fourth packet, where the fifth packet is the original packet to be sent, and the source port number and the destination port number of the fourth packet are pre- The port number is used, and the fourth packet is used by the NAT device to generate or update its own NAT entry, and is used for the first VTEP to generate or update the mapping relationship.
  • the mapping relationship is used by the first VTEP to send the VXLAN encapsulated packet to the device through the NAT device.
  • the destination port number and/or the destination IP address of the packet are determined; the transceiver module 1602 is configured to send the fourth packet to the first VTEP through the NAT device, and the fourth packet is used by the NAT device to generate or update its own NAT table.
  • the source port number and destination port number of the fourth packet are preset port numbers.
  • the transceiver module 1602 is configured to: when the fourth packet is sent to the first VTEP, the transceiver module 1602 periodically sends the fourth packet to the first VTEP through the NAT device.
  • the message transmission device 1600 can be used to perform the operations performed by the second VTEP in the message transmission method shown in FIG. 5, FIG. 7, FIG. 9, and FIG.
  • the message transmission device 1600 can be used to perform the operations performed by the second VTEP in the message transmission method shown in FIG. 5, FIG. 7, FIG. 9, and FIG.
  • FIG. 17 is a schematic diagram showing another possible structure of the message transmission apparatus involved in the above embodiment.
  • the message transmission device 1700 includes a transceiver 1701, a processor 1702, and a memory 1703.
  • the transceiver 1701, the processor 1702, and the memory 1703 are connected by a bus.
  • the transceiver 1701 is configured to support the transmission and reception of information between the message transmission device 1700 and other devices, such as the first VTEP.
  • the processor 1702 executes a message transmission method by calling program codes and data stored in the memory 1703.
  • the message transmission device 1700 can be the same device as the message transmission device 1600, and the message transmission device 1700 can be used to execute the second VTEP performed in the message transmission method shown in FIG. 5, FIG. 7, FIG. 9, and FIG. operating.
  • the message transmission device 1700 can be used to execute the second VTEP performed in the message transmission method shown in FIG. 5, FIG. 7, FIG. 9, and FIG. operating.
  • the present application provides a message transmission apparatus that can be used to perform the operations performed by the first VTEP in the methods illustrated in FIGS. 5, 7, 9, and 10, the apparatus being in a public network.
  • the message transmission device 1800 includes a transceiver module 1801.
  • the transceiver module 1801 is configured to receive a fourth packet sent by the second VTEP through the NAT device, where the second VTEP is in the private network, and the fourth packet is used by the NAT device to generate or update its own NAT entry, and is used by the device to generate The mapping relationship is used to determine the destination port number and/or the destination IP address of the packet when the device sends the VXLAN encapsulation message to the second VTEP through the NAT device.
  • the processing module 1802 is configured to use the fourth report. The text is generated or updated.
  • the transceiver module 1801 is configured to: when the second VTEP receives the fourth packet sent by the NAT device, the transceiver module 1801 periodically receives the fourth packet sent by the second VTEP through the NAT device.
  • the transceiver module 1801 sends the second packet to the second VTEP through the NAT device, and the destination port number of the second packet is according to the mapping relationship.
  • the source port number of the second packet is the default port number.
  • the message transmission device 1800 can be used to perform the operations performed by the first VTEP in the message transmission method shown in FIG. 5, FIG. 7, FIG. 9, and FIG.
  • the message transmission device 1800 can be used to perform the operations performed by the first VTEP in the message transmission method shown in FIG. 5, FIG. 7, FIG. 9, and FIG.
  • FIG. 19 is a schematic diagram showing another possible structure of the message transmission apparatus involved in the above embodiment.
  • the message transmission device 1900 includes a transceiver 1901, a processor 1902, and a memory 1903.
  • the transceiver 1901, the processor 1902, and the memory 1903 are connected by a bus.
  • the transceiver 1901 is configured to support the transmission and reception of information between the message transmission device 1900 and other devices, such as the second VTEP.
  • the processor 1902 executes a message transmission method by calling program codes and data stored in the memory 1903.
  • the message transmission device 1900 can be the same device as the message transmission device 1800, and the message transmission device 1900 can be used to execute the first VTEP performed in the message transmission method shown in FIG. 5, FIG. 7, FIG. 9, and FIG. operating.
  • the message transmission device 1900 can be used to execute the first VTEP performed in the message transmission method shown in FIG. 5, FIG. 7, FIG. 9, and FIG. operating.
  • the present application provides a message transmission system.
  • the message transmission system 2000 includes the message transmission device 1200 or 1300 shown in FIG. 12 and the message transmission device 1400 or 1500 shown in FIG. .
  • the message transmission device 1200 and the message transmission device 1400 constitute the message transmission system 2000 for illustration.
  • the present application further provides a message transmission system.
  • the message transmission system 2100 includes the message transmission device 1600 or 1700 shown in FIG. 16 and the message transmission device 1800 shown in FIG. 1900.
  • the message transmission device 1600 and the message transmission device 1800 constitute the message transmission system 2100 for illustration.
  • embodiments of the present application can be provided as a method, system, or computer program product.
  • the present application can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment in combination of software and hardware.
  • the application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) including computer usable program code.
  • the computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device.
  • the apparatus implements the functions specified in one or more blocks of a flow or a flow and/or block diagram of the flowchart.
  • These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device.
  • the instructions provide steps for implementing the functions specified in one or more of the flow or in a block or blocks of a flow diagram.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Small-Scale Networks (AREA)

Abstract

本申请提供一种报文传输方法及装置，用以解决VTEP之间经过NAT设备进行通信时，存在的报文无法穿越NAT设备的问题。该方法应用于VXLAN中，该VXLAN包括第一VTEP、第二VTEP以及NAT设备，其中第一VTEP通过NAT设备与第二VTEP通信，第一VTEP处于公有网络，第二VTEP处于私有网络。该方法包括：第一VTEP对第一报文进行VXLAN封装，得到第二报文；第一VTEP将第二报文经过NAT设备发送至第二VTEP；第二VTEP对接收到的第二报文进行解VXLAN封装，得到第一报文。其中，第一报文为第一VTEP待发送的报文，第二报文的目的端口号是根据第二报文的目的IP地址获取的，第二报文的源端口号为预设端口号。

Description

一种报文传输方法及装置
本申请要求于2017年3月30日提交中国专利局、申请号为201710201924.1、发明名称为“一种报文传输方法和装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域，尤其涉及一种报文传输方法及装置。
背景技术
随着互联网技术的发展，NAT(Network Address Translation，网络地址转换)技术和VXLAN(Virtual Extensible LAN，虚拟扩展局域网)技术均得到了广泛的应用。其中，VTEP(VXLAN Tunnel End Point，VXLAN隧道端点)用于对VXLAN报文进行封装/解封装。
当VTEP对待发送的报文进行封装时，封装后报文的源端口号为随机获得或通过HASH算法获得的端口号，目的端口号为预设的端口号4789。由于采用上述VXLAN发送报文的机制，当两个VTEP分别位于私网侧和公网侧时，若运营商网络中部署了NAT设备，两个VTEP经过NAT设备进行报文发送时，存在报文被阻挡或丢弃的问题。
以图1为例，示出了位于私网侧的VTEP B和位于公网侧的VTEPA经过NAT设备进行通信的示意图。当VTEP B向VTEP A发送封装后的报文A时，报文A的源IP(Internet Protocol，互联网协议)地址为ip1，目的ip地址为ip2，源端口号为port1，目的端口号为4789。报文A经过NAT设备时，NAT设备将报文A的源ip地址由ip1转换为ip11，将报文A的源端口号由port1转换为port11，然后将报文A发送给VTEP A，并将
Figure PCTCN2018081323-appb-000001
和
Figure PCTCN2018081323-appb-000002
的转换关系记录在NAT表项中。当VTEP B向VTEP A发送封装后的报文B时，报文B的源端口号为port3，目的端口号为4789。报文B发送至NAT设备后，NAT表项中并没有记录目的端口号4789对应表项，且源端口号port3也与VTEP B向VTEP A发送的报文A中的目的端口号4789不匹配，因而会导致报文B在NAT设备中被阻断或丢弃，即报文无法穿越NAT设备。
综上，现有技术中，若VTEP之间进行通信时经过NAT设备，存在报文无法穿越NAT设备的问题。
发明内容
本申请提供一种报文传输方法及装置，用以解决VTEP之间经过NAT设备进行通信时，存在的报文无法穿越NAT设备的问题。
第一方面，本申请提供一种报文传输方法，该方法应用于VXLAN中，该VXLAN包括第一VTEP、第二VTEP以及NAT设备，其中第一VTEP通过NAT设备与第二VTEP通信，第一VTEP处于公有网络，第二VTEP处于私有网络。该方法包括如下步骤：第一VTEP对第一报文进行VXLAN封装，得到第二报文，然后第一VTEP将第二报文经过NAT设备发送至第二VTEP。
其中，第一报文为待发送的报文，第二报文的目的端口号根据第二报文的目的IP地址获取，第二报文的源端口号为预设端口号。
采用第一方面提供的报文传输方法，处于公有网络的第一VTEP向处于私有网络的第二VTEP发送的第二报文，其目的端口号根据第二报文的目的IP地址获取的，源端口号为预设端口号。由于NAT设备在接收到该第二报文时，第二报文的源端口号(预设端口号)可与NAT表项中的预设端口号匹配，且由于第二报文的目的端口号是根据第二报文的目的IP地址获取的，第二报文的目的IP地址可匹配到NAT设 备中的NAT表项，那么第二报文的目的端口也就可以相应地匹配到NAT设备中的NAT表项。因此，采用第一方面提供的报文传输方法，在第一VTEP和第二VTEP经过NAT设备进行通信时，不会出现现有技术中存在的报文无法穿越NAT设备的问题，采用第一方面提供的报文传输方法可以实现报文在处于公有网络的第一VTEP和处于私有网络的第二VTEP间的传输。
基于第一方面，在一种可能的实现方式中，第二报文的目的端口号根据第二报文的目的IP地址和第一映射关系确定，第一映射关系用于指示第一VTEP经过NAT设备接收到的、来自第二VTEP的报文的源IP地址和源端口号的映射关系。
具体地，获取第一映射关系的具体方式可以是：在第一VTEP对第一报文进行VXLAN封装之前，第一VTEP接收第二VTEP经过NAT设备发送的第三报文；第一VTEP根据第三报文的源IP地址和源端口号的映射关系生成或更新第一映射关系。
需要说明的是，本申请中对第三报文的类型不做限制，只要第二VTEP经过NAT设备向第一VTEP发送了某个报文，且该报文的源端口号和目的端口号为预设端口号，该报文即可视为第三报文。
通过第二VTEP向第一VTEP发送第三报文，第一VTEP可根据第三报文的源IP地址和源端口号的映射关系生成或更新第一映射关系，因而提供了一种生成或更新第一映射关系的方式。
基于第一方面，在一种可能的实现方式中，在第一VTEP对第一报文进行VXLAN封装之前，第一VTEP可根据第一报文的目的MAC地址和第二映射关系获取第二报文的目的IP地址，第二映射关系用于指示第一VTEP经过NAT设备接收到的、来自第二VTEP的报文的源IP地址和去除VXLAN封装的源MAC地址的映射关系。
其中，第一VTEP也可在接收到上述第三报文后，根据该第三报文的源IP地址和去除VXLAN封装的源MAC地址的映射关系，生成或更新第二映射关系。
采用上述方案，提供了一种获取第二报文的目的IP地址的方式。
基于第一方面，在一种可能的实现方式中，在第一VTEP对第一报文进行VXLAN封装之前，第一VTEP可接收第二VTEP发送的检测报文，检测报文中携带检测信息，检测信息用于检测第一VTEP和第二VTEP进行通信时是否经过NAT设备；第一VTEP根据检测信息，确定第一VTEP和第二VTEP进行通信时经过NAT设备。
其中，检测信息包含以下一种或多种信息：检测报文的私有网络源IP地址；检测报文的私有网络源端口号；根据私有网络源IP地址和私有网络源端口号进行计算得到的第一计算结果。
需要说明的是，检测报文中可携带第二标识，该第二标识可用于指示检测报文为用于第一VTEP检测第一VTEP和第二VTEP进行通信时是否经过NAT设备的报文，那么第一VTEP接收到检测报文后，即可根据该第二标识确定该检测报文为用于第一VTEP检测第一VTEP和第二VTEP进行通信时是否经过NAT设备的报文，从而第一VTEP不对检测报文中的有效载荷做处理，仅需判断第一VTEP和第二VTEP进行通信时是否经过NAT设备即可。检测报文中携带第二标识可避免第二VTEP对检测报文中的有效载荷做无用的处理，导致占用系统资源。
采用上述方案，可以实现第一VTEP根据检测报文中包含的检测信息确定第一VTEP和第二VTEP进行通信时经过NAT设备。
基于第一方面，在一种可能的实现方式中，第一VTEP根据检测信息确定第一VTEP和第二VTEP进行通信时经过NAT设备的方式包括但不限于以下三种：
第一种
第一VTEP比较检测报文的私有网络源IP地址和检测报文的源IP地址不同时，确定第一VTEP和第二VTEP进行通信时经过NAT设备。
第二种
第一VTEP比较检测报文的私有网络源端口号和检测报文的源端口号不同时，确定第一VTEP和第二VTEP进行通信时经过NAT设备。
第三种
第一VTEP对检测报文的源IP地址和检测报文的源端口号进行计算，得到第二计算结果，在第二计算结果与第一计算结果不同时，确定第一VTEP和第二VTEP进行通信时经过NAT设备。
下面以第一种为例，阐述第一VTEP根据检测信息确定第一VTEP和第二VTEP进行通信时经过NAT设备的原理。检测信息中包含检测报文的私有网络源IP地址时，第一VTEP比较检测报文的私有网络源IP地址和检测报文的源IP地址不同时，确定第一VTEP和第二VTEP进行通信时经过NAT设备。这是因为，若第一VTEP和第二VTEP进行通信时经过NAT设备，NAT设备会将检测报文的私网源IP地址转换为公网IP地址。第一VTEP比较检测报文的私有网络源IP地址和检测报文的源IP地址，若二者不同，则说明检测报文的源IP地址为经过NAT设备转换的公网IP地址，也就说明第一VTEP和第二VTEP进行通信时经过NAT设备。第一VTEP根据检测信息中携带的检测报文的私有网络源端口号或第一计算结果确定第一VTEP和第二VTEP进行通信时经过NAT设备的方式与上述举例中的原理类似，此处不再赘述。
基于第一方面，在一种可能的实现方式中，在第一VTEP对第一报文进行VXLAN封装之前，第一VTEP可接收SDN(Software Defined Networking，软件定义网络)控制器发送的控制消息，控制消息用于指示第一VTEP和第二VTEP进行通信时经过NAT设备。
采用上述方案，不必由第一VTEP确定第一VTEP和第二VTEP进行通信时经过NAT设备，而是由SDN控制器确定第一VTEP和第二VTEP进行通信时经过NAT设备，并将该信息通过控制消息通知第一VTEP。
基于第一方面，在一种可能的实现方式中，第一VTEP可接收第二VTEP经过NAT设备发送的第四报文，第四报文用于NAT设备生成或更新自身的NAT表项。
在NAT设备中，NAT表项存在老化周期，即NAT设备在一定时间内没有接收到匹配NAT表项的报文，NAT表项会失效。因此，在上述方案中，第二VTEP将第四报文经过NAT设备发送至第一VTEP，NAT设备可根据第四报文更新NAT表项，避免由于NAT设备在一定时间内没有接收到匹配NAT表项的报文而导致的NAT表项失效的问题。
此外，第四报文中可携带用于指示第四报文的报文类型的第一标识。第一VTEP接收到第四报文后，即可根据该第一标识确定该第四报文为用于生成或更新NAT表项的报文，从而不对第四报文中的有效载荷处理，避免占用系统资源。
第二方面，本申请提供一种报文传输方法，该方法应用于VXLAN中，该VXLAN包括第一VTEP、第二VTEP以及NAT设备，其中第一VTEP通过NAT设备与第二VTEP通信，第一VTEP处于公有网络，第二VTEP处于私有网络。该方法包括如下步骤:第二VTEP接收第一VTEP经过NAT设备发送的第二报文；第二VTEP对第二报文进行解VXLAN封装，得到第一报文。其中，第二报文的源端口号和目的端口号均为预设端口号，在经过NAT设备对第二报文的目的端口和目的IP地址进行转换之前，该第二报文的目的端口号由第一VTEP根据第二报文的目的IP地址获取。
采用第二方面提供的报文传输方法，由于NAT设备会将第一VTEP向第二VTEP发送的第二报文的目的端口号进行转换，因此第二VTEP接收到的第二报文的目的端口号(预设端口号)与第一VTEP发送的第二报文的目的端口号不同，即第二报文的目的端口号(预设端口号)为经过NAT设备匹配NAT表项后得到的端口号。由于NAT设备中存在预设端口号与某个公网端口号的映射关系，因此第一VTEP向第二VTEP发送的第二报文的目的端口号可与NAT表项匹配。因此，采用第二方面提供的报文传输方法，在第一VTEP和第二VTEP经过NAT设备进行通信时，不会出现现有技术中存在的报文无法穿越NAT设备的问题，采用 第二方面提供的报文传输方法可以实现报文在处于公有网络的第一VTEP和处于私有网络的第二VTEP间的传输。
此外，当第二VTEP接收到目的端口号为预设端口号的第二报文时，第二VTEP可获知该第二报文为VXLAN类型的报文，从而对第二报文进行解VXLAN封装，得到第一报文。
基于第二方面，在一种可能的实现方式中，在第二VTEP接收第一VTEP经过NAT设备发送的第二报文之前，第二VTEP可将第三报文经过NAT设备发送至第一VTEP，第三报文的源端口号和目的端口号均为预设端口号，第三报文用于第一VTEP生成或更新第一映射关系，第一映射关系用于指示第一VTEP经过NAT设备接收到的、来自第二VTEP的报文的源IP地址和源端口号的映射关系。
通过第二VTEP向第一VTEP发送第三报文，第一VTEP可根据第三报文的源IP地址和源端口号的映射关系生成或更新第一映射关系，因而提供了一种生成或更新第一映射关系的方式。第一映射关系可用于第一VTEP确定自身要发送的第二报文的目的端口号(公网端口号)。
基于第二方面，在一种可能的实现方式中，在第二VTEP接收第一VTEP经过NAT设备发送的第二报文之前，第二VETP可向第一VTEP发送检测报文，检测报文中携带检测信息，检测信息用于第一VTEP检测第一VTEP和第二VTEP进行通信时是否经过NAT设备，检测报文的源端口号和目的端口号均为预设端口号。
其中，检测信息包含以下一种或多种信息：检测报文的私有网络源IP地址；检测报文的私有网络源端口号；根据私有网络源IP地址和私有网络源端口号进行计算得到的第一计算结果。
采用上述方案，可以实现第一VTEP根据检测报文中包含的检测信息确定第一VTEP和第二VTEP进行通信时经过NAT设备。
基于第二方面，在一种可能的实现方式中，在第二VTEP接收第一VTEP经过NAT设备发送的第二报文之前，第二VTEP可向SDN控制器发送注册请求消息，该注册请求消息中携带检测信息，检测信息用于SDN控制器检测第一VTEP和第二VTEP进行通信时是否经过NAT设备。
其中，检测信息包含以下一种或多种信息：检测报文的私有网络源IP地址；检测报文的私有网络源端口号；根据私有网络源IP地址和私有网络源端口号进行计算得到的第一计算结果。
采用上述方案，不必由第一VTEP确定第一VTEP和第二VTEP进行通信时经过NAT设备，而是由SDN控制器根据第二VTEP发送的注册请求消息中携带的检测信息，确定第一VTEP和第二VTEP进行通信时经过NAT设备。
基于第二方面，在一种可能的实现方式中，第二VTEP可将第四报文经过NAT设备发送至第一VTEP，该第四报文用于NAT设备生成或更新自身的NAT表项，该第四报文的源端口号和目的端口号均为预设端口号。
在NAT设备中，NAT表项存在老化周期，即NAT设备在一定时间内没有接收到匹配NAT表项的报文，NAT表项会失效。因此，在上述方案中，第二VTEP将第四报文经过NAT设备发送至第一VTEP，NAT设备可根据第四报文更新NAT表项，避免由于NAT设备在一定时间内没有接收到匹配NAT表项的报文而导致的NAT表项失效的问题。
此外，第四报文中可携带用于指示第四报文的报文类型的第一标识。第一VTEP接收到第四报文后，即可根据该第一标识确定该第四报文为用于生成或更新NAT表项的报文，从而不对第四报文中的有效载荷处理，避免占用系统资源。
第三方面，本申请提供一种报文传输方法，该方法应用于VXLAN中，该VXLAN包括第一VTEP、第二VTEP以及NAT设备，其中第一VTEP通过NAT设备与第二VTEP通信，第一VTEP处于公有网络，第二VTEP处于私有网络。该方法包括如下步骤：第二VTEP对第五报文进行VXLAN封装，得到第四报文，第五报文 为第二VTEP待发送的原始报文，第四报文的源端口号和目的端口号均为预设端口号，第四报文用于NAT设备生成或更新自身的NAT表项，以及用于第一VTEP生成或更新映射关系，该映射关系用于第一VTEP经过NAT设备向第二VTEP发送VXLAN封装报文时确定该报文的目的端口号和/或目的IP地址；第二VTEP将第四报文经过NAT设备发送至第一VTEP。
其中，VXLAN封装报文是指经过VXLAN封装后的报文。比如，本申请中的第二报文、第三报文、第四报文和检测报文等，均为VXLAN封装报文；而本申请中的第一报文和第五报文为未经VXLAN封装的报文。对第一报文进行VXLAN封装后得到的第二报文即为VXLAN封装报文；对第五报文进行VXLAN封装后得到的第四报文也为VXLAN封装报文。
在NAT设备中，NAT表项存在老化周期，即NAT设备在一定时间内没有接收到匹配NAT表项的报文，NAT表项会失效。因此，在第三方面提供的方法中，第二VTEP将第四报文经过NAT设备发送至第一VTEP，NAT设备可根据第四报文更新NAT表项，避免由于NAT设备在一定时间内没有接收到匹配NAT表项的报文而导致的NAT表项失效的问题。
此外，第四报文还可用于第一VTEP生成或更新映射关系，第一VTEP可根据该映射关系确定经过NAT设备向第二VTEP发送的报文的目的端口号和/或目的IP地址。其中，该映射关系可以是前述第一方面提供的方法或第二方面提供的方法中的第一映射关系或者第二映射关系。
基于第三方面，在一种可能的实现方式中，第二VTEP将第四报文经过NAT设备发送至第一VTEP，具体包括：第二VTEP周期性地将第四报文经过NAT设备发送至第一VTEP。
第四方面，本申请提供一种报文传输方法，该方法应用于VXLAN中，该VXLAN包括第一VTEP、第二VTEP以及NAT设备，其中第一VTEP通过NAT设备与第二VTEP通信，第一VTEP处于公有网络，第二VTEP处于私有网络。该方法包括如下步骤：第一VTEP接收第二VTEP经过NAT设备发送的第四报文。其中，第四报文用于NAT设备生成或更新自身的NAT表项，以及用于第一VTEP生成或更新映射关系，该映射关系用于第一VTEP经过NAT设备向第二VTEP发送VXLAN封装报文时确定该报文的目的端口号和/或目的IP地址。第一VTEP根据第四报文生成或更新该映射关系。
其中，该映射关系可以是前述第一方面提供的方法或第二方面提供的方法中的第一映射关系或者第二映射关系。
其中，VXLAN封装报文是指经过VXLAN封装后的报文。比如，本申请中的第二报文、第三报文、第四报文和检测报文等，均为VXLAN封装报文；而本申请中的第一报文和第五报文为未经VXLAN封装的报文。对第一报文进行VXLAN封装后得到的第二报文即为VXLAN封装报文；对第五报文进行VXLAN封装后得到的第四报文也为VXLAN封装报文。
在NAT设备中，NAT表项存在老化周期，即NAT设备在一定时间内没有接收到匹配NAT表项的报文，NAT表项会失效。因此，在第四方面提供的方法中，第二VTEP将第四报文经过NAT设备发送至第一VTEP，NAT设备可根据第四报文更新NAT表项，避免由于NAT设备在一定时间内没有接收到匹配NAT表项的报文而导致的NAT表项失效的问题。
基于第四方面，在一种可能的实现方式中，第一VTEP接收第二VTEP经过NAT设备发送的第四报文，具体包括：第一VTEP周期性地接收第二VTEP经过NAT设备发送的第四报文。
基于第四方面，在一种可能的实现方式中，在第一VTEP根据第四报文生成或更新映射关系之后，第一VTEP可将第二报文经过NAT设备发送至第二VTEP，第二报文的目的端口号根据映射关系获取，第二报文的源端口号为预设端口号。
第五方面，本申请提供一种报文传输装置，该装置应用于VXLAN中，该VXLAN包括该装置、第二VTEP以及设备，其中该装置通过NAT设备与第二VTEP通信，该装置处于公有网络，第二VTEP处于私有网络。 该装置包括：处理模块，用于对第一报文进行VXLAN封装，得到第二报文；收发模块，用于将第二报文经过NAT设备发送至第二VTEP。其中，第一报文为待发送的报文，第二报文的目的端口号根据第二报文的目的IP地址获取，第二报文的源端口号为预设端口号。
基于第五方面，在一种可能的实现方式中，第二报文的目的端口号根据第二报文的目的IP地址和第一映射关系获取，第一映射关系用于指示收发模块经过NAT设备接收到的、来自第二VTEP的报文的源IP地址和源端口号的映射关系。
基于第五方面，在一种可能的实现方式中，收发模块，还用于在处理模块对第一报文进行VXLAN封装之前，接收第二VTEP经过NAT设备发送的第三报文；处理模块还用于根据第三报文的源IP地址和源端口号的映射关系生成或更新第一映射关系。
基于第五方面，在一种可能的实现方式中，处理模块还用于在对第一报文进行VXLAN封装之前，根据第一报文的目的MAC地址和第二映射关系获取第二报文的目的IP地址，第二映射关系用于指示收发模块经过NAT设备接收到的、来自第二VTEP的报文的源IP地址和去除VXLAN封装的源MAC地址的映射关系。
基于第五方面，在一种可能的实现方式中，收发模块还用于：在处理模块对第一报文进行VXLAN封装之前，接收第二VTEP发送的检测报文，检测报文中携带检测信息，检测信息用于检测装置和第二VTEP进行通信时是否经过NAT设备；处理模块还用于根据检测信息，确定装置和第二VTEP进行通信时经过NAT设备。
其中，检测信息包含以下一种或多种信息：检测报文的私有网络源IP地址；检测报文的私有网络源端口号；根据私有网络源IP地址和私有网络源端口号进行计算得到的第一计算结果。
基于第五方面，在一种可能的实现方式中，处理模块在根据检测信息确定装置和第二VTEP进行通信时经过NAT设备时，确定方式包括但不限于以下三种：
第一种
处理模块比较检测报文的私有网络源IP地址和检测报文的源IP地址不同时，确定装置和第二VTEP进行通信时经过NAT设备。
第二种
处理模块比较检测报文的私有网络源端口号和检测报文的源端口号不同时，确定装置和第二VTEP进行通信时经过NAT设备。
第三种
处理模块对检测报文的源IP地址和检测报文的源端口号进行计算，得到第二计算结果，在第二计算结果与第一计算结果不同时，确定装置和第二VTEP进行通信时经过NAT设备。
基于第五方面，在一种可能的实现方式中，收发模块还用于在处理模块对第一报文进行VXLAN封装之前，接收SDN控制器发送的控制消息，控制消息用于指示装置和第二VTEP进行通信时经过NAT设备。
基于第五方面，在一种可能的实现方式中，收发模块还用于接收第二VTEP经过NAT设备发送的第四报文，该第四报文用于NAT设备生成或更新自身的NAT表项。
基于第五方面，在一种可能的实现方式中，第四报文携带第一标识，该第一标识用于指示第四报文的报文类型。
需要说明的是，第五方面提供的报文传输装置可用于执行上述第一方面所述的报文传输方法，第五方面提供的报文传输装置中未详细描述的实现方式和技术效果可参见第一方面所述的报文传输方法中的相关描述。
第六方面，本申请提供一种报文传输装置，该装置应用于VXLAN中，该VXLAN包括第一VTEP、该装置以及NAT设备，其中第一VTEP通过NAT设备与该装置通信，第一VTEP处于公有网络，该装置处于私有网络。该装置包括：收发模块，用于接收第一VTEP经过NAT设备发送的第二报文，第二报文的源端口号和目的端口号均为预设端口号，在经过NAT设备之前该第二报文的目的端口号由第一VTEP根据第二报文的目的IP地址获取；处理模块，用于对第二报文进行解VXLAN封装，得到第一报文。
基于第六方面，在一种可能的实现方式中，收发模块还用于在接收第一VTEP经过NAT设备发送的第二报文之前，将第三报文经过NAT设备发送至第一VTEP。其中，该第三报文的源端口号和目的端口号均为预设端口号，该第三报文用于第一VTEP生成或更新第一映射关系，第一映射关系用于指示第一VTEP经过NAT设备接收到的、来自装置的报文的源IP地址和源端口号的映射关系。
基于第六方面，在一种可能的实现方式中，收发模块还用于在接收第一VTEP经过NAT设备发送的第二报文之前，向第一VTEP发送检测报文。其中，该检测报文中携带检测信息，检测信息用于第一VTEP检测第一VTEP和装置进行通信时是否经过NAT设备，检测报文的源端口号和目的端口号均为预设端口号。
其中，检测信息包含以下一种或多种信息：检测报文的私有网络源IP地址；检测报文的私有网络源端口号；根据私有网络源IP地址和私有网络源端口号进行计算得到的第一计算结果。
基于第六方面，在一种可能的实现方式中，收发模块还用于在接收第一VTEP经过NAT设备发送的第二报文之前，向SDN控制器发送注册请求消息，该注册请求消息中携带检测信息，该检测信息用于SDN控制器检测第一VTEP和装置进行通信时是否经过NAT设备。
其中，该检测信息包含以下一种或多种信息：检测报文的私有网络源IP地址；检测报文的私有网络源端口号；根据私有网络源IP地址和私有网络源端口号进行计算得到的第一计算结果。
基于第六方面，在一种可能的实现方式中，收发模块还用于将第四报文经过NAT设备发送至第一VTEP。其中，该第四报文用于NAT设备生成或更新自身的NAT表项，该第四报文的源端口号和目的端口号均为预设端口号。
基于第六方面，在一种可能的实现方式中，该第四报文携带第一标识，第一标识用于指示该第四报文的报文类型。
需要说明的是，第六方面提供的报文传输装置可用于执行上述第二方面所述的报文传输方法，第六方面提供的报文传输装置中未详细描述的实现方式和技术效果可参见第二方面所述的报文传输方法中的相关描述。
第七方面，本申请提供一种报文传输装置，该装置应用于VXLAN中，该VXLAN包括第一VTEP、该装置以及NAT设备，其中第一VTEP通过NAT设备与该装置通信，第一VTEP处于公有网络，该装置处于私有网络。该装置包括：处理模块，用于对第五报文进行VXLAN封装，得到第四报文，第五报文为待发送的原始报文，第四报文的源端口号和目的端口号均为预设端口号，第四报文用于NAT设备生成或更新自身的NAT表项，以及用于第一VTEP生成或更新映射关系，映射关系用于第一VTEP经过NAT设备向该装置发送VXLAN封装报文时确定该报文的目的端口号和/或目的IP地址；收发模块，用于将第四报文经过NAT设备发送至第一VTEP。
基于第七方面，在一种可能的实现方式中，收发模块在将第四报文经过NAT设备发送至第一VTEP时，具体用于：收发模块周期性地将第四报文经过NAT设备发送至第一VTEP。
需要说明的是，第七方面提供的报文传输装置可用于执行上述第三方面所述的报文传输方法，第七方面提供的报文传输装置中未详细描述的实现方式和技术效果可参见第三方面所述的报文传输方法中的相关描述。
第八方面，本申请提供一种报文传输装置，该装置应用于VXLAN中，该VXLAN包括该装置、第二VTEP以及NAT设备，其中该装置通过NAT设备与第二VTEP通信，该装置处于公有网络，第二VTEP处于私有网络。该装置包括：收发模块，用于接收第二VTEP经过NAT设备发送的第四报文，该第二VTEP处于私有网络，该第四报文用于NAT设备生成或更新自身的NAT表项，以及用于该装置生成或更新映射关系，该映射关系用于该装置经过NAT设备向第二VTEP发送VXLAN封装报文时确定该报文的目的端口号和/或目的IP地址；处理模块，用于根据第四报文生成或更新映射关系。
基于第八方面，在一种可能的实现方式中，收发模块在接收第二VTEP经过NAT设备发送的第四报文时，具体用于：收发模块周期性地接收第二VTEP经过NAT设备发送的第四报文。
基于第八方面，在一种可能的实现方式中，在处理模块根据第四报文生成或更新映射关系后，收发模块将第二报文经过NAT设备发送至第二VTEP，该第二报文的目的端口号根据该映射关系获取，该第二报文的源端口号为预设端口号。
需要说明的是，第八方面提供的报文传输装置可用于执行上述第四方面所述的报文传输方法，第八方面提供的报文传输装置中未详细描述的实现方式和技术效果可参见第四方面所述的报文传输方法中的相关描述。
第九方面，本申请提供一种报文传输装置，该装置应用于VXLAN中，所述VXLAN包括该装置、第二VTEP以及NAT设备，其中该装置通过NAT设备与第二VTEP通信，装该装置处于公有网络，第二VTEP处于私有网络。该装置包括：处理器，用于对第一报文进行VXLAN封装，得到第二报文，第一报文为待发送的报文，第二报文的目的端口号根据第二报文的目的IP地址获取，第二报文的源端口号为预设端口号；收发器，用于将第二报文经过NAT设备发送至第二VTEP。
需要说明的是，第九方面提供的报文传输装置可用于执行第一方面和第四方面所提供的报文传输方法，第九方面提供的报文传输装置可以是与第五方面和第八方面提供的报文传输装置相同的装置。
第十方面，本申请提供一种报文传输装置，该装置应用于VXLAN中，VXLAN包括第一VTEP、该装置以及NAT设备，其中第一VTEP通过NAT设备与该装置通信，第一VTEP处于公有网络，该装置处于私有网络。该装置包括:
收发器，用于接收第一VTEP经过NAT设备发送的第二报文，第二报文的源端口号和目的端口号均为预设端口号，在经过NAT设备之前第二报文的目的端口号由第一VTEP根据第二报文的目的IP地址获取；
处理器，用于对第二报文进行解VXLAN封装，得到第一报文。
需要说明的是，第十方面提供的报文传输装置可用于执行第二方面和第三方面所提供的报文传输方法，第十方面提供的报文传输装置可以是与第六方面和第七方面提供的报文传输装置相同的装置。
第十一方面，本申请提供一种计算机可读存储介质，计算机可读存储介质中存储有计算机执行指令，当计算节点的至少一个处理器执行该计算机执行指令时，计算节点执行上述第一方面或者第一方面的各种可能实现方式提供的方法、或者执行上述第二方面或者第二方面的各种可能实现方式提供的方法、或者执行上述第三方面或者第三方面的各种可能实现方式提供的方法、或者执行上述第四方面或者第四方面的各种可能实现方式提供的方法。
第十二方面，本申请提供一种计算机程序产品，该计算机程序产品包括计算机执行指令，该计算机执行指令存储在计算机可读存储介质中。计算节点的至少一个处理器可以从计算机可读存储介质读取该计算机执行指令，至少一个处理器执行该计算机执行指令使得计算节点实施上述第一方面或者第一方面的各种可能实现方式提供的方法、或者执行上述第二方面或者第二方面的各种可能实现方式提供的方法、或者执行上述第三方面或者第三方面的各种可能实现方式提供的方法、或者执行上述第四方面或者第四方面的各种可能实现方式提供的方法。
附图说明
图1为现有技术提供的一种两个VTEP经过NAT设备进行通信的示意图；
图2为本申请提供的一种NAT的分类的示意图；
图3为本申请提供的一种VXLAN的封装格式的示意图；
图4为本申请提供的一种两个VTEP经过NAT设备进行通信的示意图；
图5为本申请提供的第一种报文传输方法的流程示意图；
图6为本申请提供的一种检测报文的结构示意图；
图7为本申请提供的一种确定第一VTEP和第二VTEP穿越NAT设备的流程示意图；
图8为本申请提供的一种第四报文的结构示意图；
图9为本申请提供的第二种报文传输方法的流程示意图；
图10为本申请提供的第三种报文传输方法的流程示意图；
图11为本申请提供的第四种报文传输方法的流程示意图；
图12为本申请提供的第一种报文传输装置的结构示意图；
图13为本申请提供的第二种报文传输装置的结构示意图；
图14为本申请提供的第三种报文传输装置的结构示意图；
图15为本申请提供的第四种报文传输装置的结构示意图；
图16为本申请提供的第五种报文传输装置的结构示意图；
图17为本申请提供的第六种报文传输装置的结构示意图；
图18为本申请提供的第七种报文传输装置的结构示意图；
图19为本申请提供的第八种报文传输装置的结构示意图；
图20为本申请提供的第一种报文传输系统的结构示意图；
图21为本申请提供的第二种报文传输系统的结构示意图。
具体实施方式
NAT是一种将私有网络的IP地址(以下简称私网IP地址)转化为公有网络的IP地址(以下简称公网IP地址)的转换技术。在实际应用中，NAT主要用于实现私有网络访问公有网络的功能。通过NAT，可以在使用少量公网IP地址的情况下，实现较多私网IP地址对应的用户访问网络。NAT不仅完美地解决了lP地址不足的问题，而且还能够有效地避免来自网络外部的攻击，隐藏并保护私有网络内的计算机。
NAT的基本工作原理是：当私有网络侧的设备(以下简称私网侧设备)和公有网络侧的设备(以下简称公网侧设备)进行通信经过NAT设备时，NAT设备将报文中的源IP地址或目的IP地址在私网IP地址和公网IP地址之间进行转换。当私网侧设备向公网侧设备发送报文A时，报文A经过NAT设备时，NAT设备将报文A中的私网IP地址转换为公网IP地址并发送至公有网络，该报文A到达公网侧设备时，已不再包含私网IP地址信息。当公网侧设备向私网侧设备发送报文B时，报文B的目的IP地址为公网IP地址，报文B将被发送至NAT设备，NAT设备将报文B的目的IP地址转换为私网IP地址，然后将报文B发送至相应私网侧设备。
NAT的分类可如图2所示。本申请中的NAT是指NAPT(Network Address and Port Translation，网络地址端口转换)类型的NAT。NAPT相较于基本NAT的区别是：NAPT不仅进行IP地址的转换，同时还进行端口的转换。即NAT设备对IP地址进行转换的同时，还对端口进行转换。
VXLAN是一种将二层(数据链路层)报文用三层(网络层)协议进行封装的技术，是二层网络在三层网络上的拓展。VXLAN提供与VLAN(Virtual Local Area Network，虚拟局域网)相同的以太网二层服务，但是VXLAN相比于VLAN拥有更强的扩展性和灵活性。VLAN使用12比特标记VLAN ID，最多支持4094(2 12)个二层网段，而VXLAN则使用24比特标记VNI(Virtual Network Interface，虚拟网络接口)或者VNID(Virtual Network ID，虚拟网络ID)，支持16777216(2 24)个二层网段。
VXLAN的封装格式可如图3所示。在未对原始报文进行VXLAN封装时，原始报文中包含内部以太头、内部IP头以及有效载荷；在对原始报文进行VXLAN封装时，在原始报文前添加VXLAN头、外部UDP(User Datagram Protocol，用户数据报协议)头，外部IP头和外部以太头。其中，VXLAN头中包含VXLAN标识以及VNI；外部UDP头中包含封装后报文的源端口号、目的端口号、UDP长度以及UDP校验和；外部IP头包含封装后报文的源IP地址和目的IP地址。
如前所述，VTEP在进行报文传输时的处理方式是：
1)报文接收：VTEP接收对端(Peer)VTEP发送的VXLAN报文；
2)报文发送：VTEP发送VXLAN报文时，源端口号随机获得或通过HASH算法获得，目的端口号为知名端口号4789。
基于以上报文接收和报文发送的处理方式，若处于私有网络的VTEP和处于公有网络的VTEP进行通信时经过NAT设备，会存在报文被阻挡或丢弃的问题。
处于私有网络的VTEP和处于公有网络的VTEP进行通信时经过NAT设备，其场景可如图1所示。图1中，VTEP A处于公有网络，VTEP B和VTEP C处于私有网络。以处于私有网络的VTEP B和处于公有网络的VTEP A进行通信为例，若采用上述报文传输的处理方式，VTEP B向VTEP A发送的报文可传输至VTEP A，但是由于VTEP A向VTEP B发送报文时，将该报文的目的端口号设置为4789，导致该报文的目的端口号无法与NAT设备的NAT表项匹配，因而VTEP A向VTEP B发送的报文无法传输至VTEP B。
如图4所示，当VTEPB向VTEPA发送封装后的报文A时，报文A的源IP地址为ip1、目的IP地址为ip2、源端口号为port1(随机获得或通过HASH算法获得)、目的端口号为4789，其中ip1为私网IP地址。报文A经过NAT设备时，NAT设备将私网IP地址(ip1)转换为公网IP地址(ip11,)，同时将ip1对应的源端口号由port1转换为port11，此时NAT设备的NAT表项中记录下
Figure PCTCN2018081323-appb-000003
和
Figure PCTCN2018081323-appb-000004
的转换关系，同时，NAT设备将报文A发送至VTEPA。当VTEPA向VTEPB发送封装后的报文B时，报文B的源IP地址为ip2、目的IP地址为ip11、源端口号为port3(随机获得或通过HASH算法获得)、目的端口号为4789。当报文B发送至NAT设备时，NAT设备查找NAT表项，无法查找到与报文B的目的端口号4789相匹配的表项，且源端口号port3也与VTEPB向VTEPA发送的报文A中的目的端口号4789不匹配。因此，报文B在NAT设备中会被阻断或丢弃。
为了解决VTEP之间经过NAT设备进行通信时存在的报文无法穿越NAT设备的问题，本申请提供一种报文传输方法及装置。其中，方法和装置是基于同一发明构思的，由于方法及装置解决问题的原理相似，因此装置与方法的实施可以相互参见，重复之处不再赘述。
另外，需要理解的是，在本申请的描述中，“第一”、“第二”等词汇，仅用于区分描述的目的，而不能理解为指示或暗示相对重要性，也不能理解为指示或暗示顺序。
下面结合附图对本申请提供的报文传输方案进行具体说明。
参见图5，为本申请提供的一种报文传输方法的流程示意图。该方法应用于VXLAN中，VXLAN包括第一VTEP、第二VTEP以及NAT设备，其中第一VTEP通过NAT设备与第二VTEP通信，第一VTEP处于公有网络，第二VTEP处于私有网络。该方法包括如下步骤：
S501：第一VTEP对第一报文进行VXLAN封装，得到第二报文。
S502：第一VTEP将第二报文经过NAT设备发送至第二VTEP。
本申请实施例中，第一VTEP处于公有网络，第二VTEP处于私有网络，第一报文为第一VTEP待发送的报文。第二报文的目的端口号是根据第二报文的目的IP地址获取的，第二报文的源端口号为预设端口号，比如端口号4789。
需要说明的是，本申请中所涉及的预设端口号可以是4789，也可以是设定的其它端口号。本申请中对预设端口号的具体值不做限制。
其中，第一报文可视为图3所示的VXLAN封装格式中未添加VXLAN封装的原始报文，第二报文可视为图3所示的VXLAN封装格式中添加VXLAN封装以后的报文。
第一报文可以是在第二VTEP向第一VTEP发送请求消息后，第一VTEP向第二VTEP发送的响应消息，也可以是第一VTEP主动向第二VTEP发送的消息，比如通知消息等。第一报文中包含第一报文的源MAC地址和目的MAC地址信息，第一报文的源MAC地址和目的MAC地址记录在该第一报文的内部以太头中。第二报文的目的IP地址可根据第一报文的目的MAC地址获取。
第二报文的目的IP地址记录在外部IP头中，第二报文的目的端口号和第二报文的源端口号记录在外部UDP头中。
需要说明的是，本申请实施例中，第一VTEP和第二VTEP进行通信时经过NAT设备，而NAT设备会对报文的(目的/源)IP地址和(目的/源)端口号进行转换。因此，第一VTEP发送的报文与第二VTEP接收到的该报文相比，目的IP地址和目的端口号不同；第二VTEP发送的报文与第一VTEP接收到的该报文相比，源IP地址和源端口号不同。
比如，第一VTEP向第二VTEP发送报文C，第一VTEP发送的报文C的目的IP地址是公网IP地址，目的端口号是公网端口号，那么报文C被发送至NAT设备。该报文C被发送至NAT设备后，NAT设备根据NAT表项将报文C的目的IP地址由公网IP地址转换为私网IP地址，同时将报文C的目的端口号由公网端口号转换为私网端口号，然后将报文C发送至第二VTEP。那么，第二VTEP接收到的报文C的目的IP地址为经过NAT设备转换后的私网IP地址，目的端口号也为经过NAT设备转换后的私网端口号。
再比如，第二VTEP向第一VTEP发送报文D，第二VTEP发送的报文D的源IP地址是私网IP地址，源端口号是私网端口号，该报文D被发送至NAT设备后，NAT设备根据NAT表项将报文D的源IP地址由私网IP地址转换为公网IP地址，同时将报文D的源端口号由私网端口号转换为公网端口号，然后将报文D发送至第一VTEP。那么，第一VTEP接收到的报文D的源IP地址为经过NAT设备转换后的公网IP地址，源端口号也为经过NAT设备转换后的公网端口号。
本申请实施例中，需要根据第二报文的目的IP地址获取第二报文的目的端口号。在获取第二报文的目的端口号之前，第二报文的目的IP地址可通过如下方式获取：在S501中第一VTEP对第一报文进行VXLAN封装之前，第一VTEP根据第一报文的目的MAC地址和第二映射关系获取第二报文的目的IP地址，该第二映射关系用于指示第一VTEP经过NAT设备接收到的、来自第二VTEP的报文的源IP地址和去除VXLAN封装的源MAC地址的映射关系。
其中，第一VTEP也可在接收到上述第三报文后，根据该第三报文的源IP地址和去除VXLAN封装的源MAC地址的映射关系，生成或更新本申请实施例中的第二映射关系。
假设第一VTEP接收到来自私有网络的报文E，报文E的封装格式可如图3所示，报文E的源IP地址记录在报文E的外部IP头，报文E的去除VXLAN封装的源MAC地址记录在报文E的内部以太头中。根据第一报文的目的MAC地址和第二映射关系获取的第二报文的目的IP地址，即为第一VTEP接收到的报文E的源IP地址，该源IP地址是一个公网IP地址，将该公网IP地址作为第二报文的目的IP地址，可以实现将第二报文发送至NAT设备，然后再通过匹配NAT表项后发送至私有网络中的第二VTEP。
本申请中，第二报文的目的端口号是根据第二报文的目的IP地址获取的，获取第二报文的目的IP地址的具体方式可以是：第一VTEP可根据第二报文的目的IP地址和第一映射关系获取第二报文的目的端口号，该第一映射关系用于指示第一VTEP经过NAT设备接收到的、来自第二VTEP的报文的源IP地址和源端口号的映射关系。
假设第一VTEP接收到来自私有网络的报文F，接收到的报文F的源IP地址是ip11，源端口号是port11。由于报文F是第一VTEP接收到的报文，因此ip11是经NAT设备转换后的公网IP地址，port11也是经NAT设备转换后的公网端口号。那么，在第一VTEP设备接收到报文F时，NAT设备中已经记录有私网IP地址ip1和公网IP地址ip11的映射关系，以及私网端口号4789(预设端口号)和公网端口号port11的映射关系。当第一VTEP发送第二报文时，第二报文到达NAT设备后，由于第二报文的目的端口号是根据第二报文的目的IP地址(即报文F的源IP地址ip11)确定的，即第二报文的目的端口号是port11，那么NAT设备在根据NAT表项对第二报文进行匹配时，第二报文的目的端口号port11与NAT表项中的
Figure PCTCN2018081323-appb-000005
匹配成功，第二报文的源IP地址ip11与NAT表项中的
Figure PCTCN2018081323-appb-000006
匹配成功，因此NAT设备可将第二报文的目的IP地址由公网IP地址(ip11)转换为私网IP地址(ip1)，将第二报文的目的端口号由公网端口号(port11)转换为私网端口号(4789)，从而将第二报文发送至第二VTEP。
具体地，本申请中的第一映射关系可通过如下方式生成或更新：在S501中第一VTEP对第一报文进行VXLAN封装之前，第二VTEP可向第一VTEP发送第三报文，第一VTEP在接收到第三报文后，可根据第三报文的源IP地址和源端口号的映射关系生成或更新上述第一映射关系。
本申请中对第三报文的类型不做限制，只要第二VTEP经过NAT设备向第一VTEP发送了某个报文，且该报文的源端口号和目的端口号为预设端口号，该报文即可视为第三报文。
需要说明的是，本申请实施例中，第一映射关系和第二映射关系可由第一VTEP生成、更新及维护。生成或更新第一映射关系和第二映射关系的方式有多种，比如第一VTEP可根据第三报文的源IP地址和源端口号的映射关系生成或更新上述第一映射关系，也可根据第四报文源IP地址和源端口号的映射关系生成或更新上述第一映射关系，或者可根据检测报文的源IP地址和源端口号的映射关系生成或更新上述第一映射关系；同样地，第一VTEP可根据第三报文、第四报文或者检测报文等报文生成或更新第二映射关系。此外，生成或更新第一映射关系和第二映射关系的操作也可由SDN控制器执行，比如，SDN控制器接收第二VTEP发送的报文，根据该报文生成或更新第一映射关系和第二映射关系，然后将生成或更新后的第一映射关系和第二映射关系发送给第一VTEP。
第一VTEP生成或更新第一映射关系和第二映射关系后或者第一VTEP接收SDN控制器发送的第一映射关系和第二映射关系后，可视为第一VTEP维护有第一映射关系和第二映射关系。为了实现第一VTEP和第二VTEP间经过NAT设备进行通信，第一VTEP需维护该第一映射关系和第二映射关系。
S503：第二VTEP对接收到的第二报文进行解VXLAN封装，得到第一报文。
其中，由于第一VTEP将第二报文经过NAT设备发送至第二VTEP，而NAT设备会根据自身的NAT表项对第二报文的目的IP地址和目的端口号进行转换后再发送给第二VTEP。因此，第二VTEP接收到的第二报文的目的端口号，与第一VTEP发送的第二报文的目的端口号不同，第二VTEP接收到的第二报文的目的IP地址，与第一VTEP发送的第二报文的目的IP地址不同。第二VTEP接收到的第二报文的目的端口号经NAT设备转换后会变成上述预设端口号。
在VXLAN技术中，VTEP在接收到目的端口号为预设端口号的报文后，可确定该报文为VXLAN类型的报文，从而对该报文做VXLAN报文的相应处理，比如解VXLAN封装等处理。本申请中，第一VTEP向第二VTEP发送的第二报文的目的端口号为根据第二报文的目的IP地址确定的端口号，但是，第二报文发送至NAT设备时，NAT设备会根据NAT表项对该第二报文的目的端口号进行转换后再发送给第二VTEP，转换后 的第二报文的目的端口号即为预设端口号。因此，第二VTEP在接收到第二报文后，第二报文的目的端口号为预设端口号，此时，第二VTEP确定第二报文为VXLAN类型的报文，从而对该第二报文进行解VXLAN封装，得到第一报文。
需要说明的是，本申请中对第一VTEP和第二VTEP进行通信时经过的NAT设备的数量不做限制。由于第一VTEP和第二VTEP进行通信时经过多个NAT设备与经过一个NAT设备相比，第一VTEP和第二VTEP的处理过程类似，因此本申请中仅以第一VTEP和第二VTEP进行通信时经过一个NAT设备为例进行说明。
采用图5所示的报文传输方法，处于公有网络的第一VTEP向处于私有网络的第二VTEP发送的第二报文，其目的端口号根据第二报文的目的IP地址获取的，源端口号为预设端口号。由于NAT设备在接收到该第二报文时，第二报文的源端口号(预设端口号)可与NAT表项中的预设端口号匹配，且由于第二报文的目的端口号是根据第二报文的目的IP地址获取的，第二报文的目的IP地址可匹配到NAT设备中的NAT表项，那么第二报文的目的端口也就可以相应地匹配到NAT设备中的NAT表项。因此，采用图5所示的报文传输方法，在第一VTEP和第二VTEP经过NAT设备进行通信时，不会出现现有技术中存在的报文无法穿越NAT设备的问题，采用图5所示的报文传输方法可以实现报文在处于公有网络的第一VTEP和处于私有网络的第二VTEP间的传输。
此外，由于第一VTEP发送的第二报文在经过NAT设备的转换后，其目的端口号转换为预设端口号，那么第二VTEP在接收到转换后的第二报文后，即可确定该第二报文为VXLAN类型的报文，从而对该第二报文进行解VXLAN封装，得到第一报文。
图5所示的报文的传输方法是基于第一VTEP和第二VTEP进行通信时经过NAT设备的前提。那么，在执行S501之前，确定第一VTEP和第二VTEP进行通信时经过NAT设备的方式可以有多种。下面仅列举其中两种。
第一种方式
在第一种方式中，由第一VTEP确定第一VTEP和第二VTEP进行通信时经过NAT设备。具体方式如下：
第二VETP向第一VTEP发送检测报文，该检测报文中携带检测信息，该检测信息用于第一VTEP检测第一VTEP和第二VTEP进行通信时是否经过NAT设备，第一VTEP接收第二VTEP发送的检测报文，第一VTEP根据检测信息，确定第一VTEP和第二VTEP进行通信时经过NAT设备。
其中，检测报文的源端口号和目的端口号均为预设端口号；检测信息包含以下一种或多种信息：检测报文的私有网络源IP地址；检测报文的私有网络源端口号；根据私有网络源IP地址和私有网络源端口号进行计算得到的第一计算结果。
此外，检测报文中还可携带第二标识，该第二标识可用于指示检测报文为用于第一VTEP检测第一VTEP和第二VTEP进行通信时是否经过NAT设备的报文，那么第一VTEP接收到检测报文后，即可根据该第二标识确定该检测报文为用于第一VTEP检测第一VTEP和第二VTEP进行通信时是否经过NAT设备的报文，从而第一VTEP不对检测报文中的有效载荷做处理，仅需判断第一VTEP和第二VTEP进行通信时是否经过NAT设备即可。检测报文中携带第二标识可避免第二VTEP对检测报文中的有效载荷做无用的处理，导致占用系统资源。
检测报文的一种封装格式可如图6所示。图6中，第二标识携带在检测报文的VXLAN头中；检测信息可携带在VXLAN头后面。需要说明的是，本申请中对检测信息携带在检测报文的哪个部分不做限制，比如，检测信息可携带在检测报文的VXLAN头中，也可携带在VXLAN头后面。
具体地，根据检测信息包含的不同信息，第一VTEP根据检测信息确定第一VTEP和第二VTEP进行通信时经过NAT设备的具体方式也不同。
比如，检测信息中包含检测报文的私有网络源IP地址时，第一VTEP比较检测报文的私有网络源IP地址和检测报文的源IP地址不同时，确定第一VTEP和第二VTEP进行通信时经过NAT设备。这是因为，若第一VTEP和第二VTEP进行通信时经过NAT设备，NAT设备会将检测报文的私网源IP地址转换为公网IP地址。第一VTEP比较检测报文的私有网络源IP地址和检测报文的源IP地址，若二者不同，则说明检测报文的源IP地址为经过NAT设备转换的公网IP地址，也就说明第一VTEP和第二VTEP进行通信时经过NAT设备。
比如，检测信息中包含检测报文的私有网络源端口号时，第一VTEP比较检测报文的私有网络源端口号和检测报文的源端口号不同时，确定第一VTEP和第二VTEP进行通信时经过NAT设备。这是因为，若第一VTEP和第二VTEP进行通信时经过NAT设备，NAT设备会将检测报文的私网源端口号转换为公网端口号。第一VTEP比较检测报文的私有网络源端口号和检测报文的源端口号，若二者不同，则说明检测报文的源端口号为经过NAT设备转换的公网端口号，也就说明第一VTEP和第二VTEP进行通信时经过NAT设备。
比如，检测信息中包含根据私有网络源IP地址和私有网络源端口号进行计算得到的第一计算结果时，第一VTEP对检测报文的源IP地址和检测报文的源端口号进行计算，得到第二计算结果，在第二计算结果与第一计算结果不同时，确定第一VTEP和第二VTEP进行通信时经过NAT设备。这是因为，若第一VTEP和第二VTEP进行通信时经过NAT设备，NAT设备会将检测报文的私网源IP地址转换为公网IP地址，将检测报文的私网源端口号转换为公网端口号。第一VTEP对检测报文的源IP地址和检测报文的源端口号进行计算，得到第二计算结果，若第二计算结果和检测信息中的第一计算结果不同，则说明检测报文的私网源IP地址为经过NAT设备转换的公网IP地址，检测报文的私网源端口为经过NAT设备转换的公网端口号，也就说明第一VTEP和第二VTEP进行通信时经过NAT设备。
需要说明的是，上面列举的三种情形可以单独实施，也可以组合实施。
检测报文除了可用于第一VTEP确定第一VTEP和第二VTEP进行通信时经过NAT设备，还可用于第一VTEP生成或更新第一映射关系和第二映射关系。也就是说，若第一VTEP在接收到检测报文时，第一映射关系还没有生成，那么第一VTEP可根据检测报文的源IP地址和源端口号的对应关系生成第一映射关系；若第一VTEP在接收到检测报文时，第二映射关系还没有生成，那么第一VTEP可根据检测报文的源IP地址和去除VXLAN封装的源MAC地址的映射关系生成第二映射关系。若第一VTEP在接收到检测报文时，第一映射关系和第二映射关系已生成，第一VTEP可根据检测报文更新第一映射关系和第二映射关系。
第二种方式
在第二种方式中，由SDN控制器确定第一VTEP和第二VTEP进行通信时经过NAT设备。其中，SDN控制器与第一VTEP或第二VTEP间的控制协议包括NETCONF和Openflow等。基于上述控制协议，SDN控制器可以和第一VTEP或第二VTEP进行通信。SDN控制器确定第一VTEP和第二VTEP进行通信时经过NAT设备的具体方式可如图7所示：
图7中，第二VTEP向SDN控制器发送注册请求消息，注册请求消息中携带检测信息，检测信息用于SDN控制器检测第一VTEP和第二VTEP进行通信时是否经过NAT设备；SDN控制器在接收到注册请求消息后，根据注册请求消息中携带的检测信息确定第一VTEP和第二VTEP进行通信时经过NAT设备，然后SDN控制器向第一VTEP发送控制消息，控制消息用于指示第一VTEP和第二VTEP进行通信时经过NAT设备。
其中，检测信息包含以下一种或多种信息：检测报文的私有网络源IP地址；检测报文的私有网络源端口号；根据私有网络源IP地址和私有网络源端口号进行计算得到的第一计算结果。
具体地，根据检测信息包含的不同信息，SDN控制器根据检测信息确定第一VTEP和第二VTEP进行通信时经过NAT设备的具体方式也不同。由SDN控制器根据检测信息确定第一VTEP和第二VTEP进行通信 时经过NAT设备，与上述第一种方式中由第一VTEP确定第一VTEP和第二VTEP进行通信时经过NAT设备的方式类似，此处不再赘述。
本申请中，若第一VTEP和第二VTEP进行通信时没有经过NAT设备，第一VTEP和第二VTEP进行通信时可采用现有技术提供的报文传输方法；根据上述第一种方式或第二种方式确定第一VTEP和第二VTEP进行通信时经过NAT设备后，可切换第一VTEP和第二VTEP的工作模式，本申请中将之称为“穿越NAT模式”。切换到该工作模式后，第一VTEP和第二VTEP执行图5所示的报文传输方法，从而实现第一VTEP和第二VTEP可经过NAT设备进行通信。若采用上述第二种方式确定第一VTEP和第二VTEP进行通信时经过NAT设备，则切换工作模式的操作可由SDN控制器指示第一VTEP和第二VTEP执行。
在NAT设备中，NAT表项存在老化周期，即NAT设备在一定时间内没有接收到匹配NAT表项的报文，NAT表项会失效。因此，本申请中，第二VTEP可将第四报文经过NAT设备发送至第一VTEP，该第四报文可用于NAT设备生成或更新自身的NAT表项，第四报文的源端口号和目的端口号均为预设端口号。特别地，为了避免NAT表项失效，第二VTEP可周期性地发送上述第四报文，发送周期可小于NAT表项的老化周期。
NAT设备在接收到第二VTEP发送的第四报文时，刷新NAT表项：若第四报文的源IP地址和源端口号对应的表项不存在，则生成该表项，若第四报文的源IP地址和源端口号对应的表项已存在，则更新该表项的老化时间。
此外，第四报文不仅可用于NAT设备更新自身的NAT表项，第四报文还可用于第一VTEP生成或更新第一映射关系和第二映射关系。也就是说，若第一VTEP在接收到第四报文时，第一映射关系还没有生成，那么第一VTEP可根据第四报文的源IP地址和源端口号的映射关系生成第一映射关系；若第一VTEP在接收到第四报文时，第二映射关系还没有生成，那么第一VTEP可根据第四报文的源IP地址和去除VXLAN封装的源MAC地址的映射关系生成第二映射关系。若第一VTEP在接收到第四报文时，第一映射关系和第二映射关系已生成，第一VTEP可根据第四报文更新第一映射关系和第二映射关系。
此外，第四报文中可携带第一标识，该第一标识可用于指示第四报文为用于生成或更新NAT表项的报文，那么第一VTEP接收到第四报文后，即可根据该第一标识确定该第四报文为用于生成或更新NAT表项的报文，从而不对第四报文中的有效载荷处理，避免占用系统资源。
基于以上描述，一种第四报文的报文格式可如图8所示。图8中，第一标识可携带在检测报文的VXLAN头中。
需要说明的是，本申请中对第二VTEP发送第四报文的时机不做限制，比如，第二VTEP可在执行S503之前发送第四报文，也可在执行S503之后发送第四报文，或者第二VTEP也可在第一VTEP执行S501之前发送第四报文等等。
此外，本申请还提供一种报文传输方法，该方法应用于VXLAN中，VXLAN包括第一VTEP、第二VTEP以及NAT设备，其中第一VTEP通过NAT设备与第二VTEP通信，第一VTEP处于公有网络，第二VTEP处于私有网络。该方法如图9所示。
S901：第二VTEP对第五报文进行VXLAN封装，得到第四报文。
其中，第五报文为第二VTEP待发送的原始报文，第四报文的源端口号和目的端口号均为预设端口号，第四报文用于NAT设备生成或更新自身的NAT表项，以及用于第一VTEP生成或更新映射关系，该映射关系用于第一VTEP经过NAT设备向第二VTEP发送VXLAN封装报文时确定该报文的目的端口号和/或目的IP地址。
需要说明的是，图9所示方法中的映射关系可以是图5所示方法中的第一映射关系和/或第二映射关系。第一VTEP经过NAT设备向第二VTEP发送报文时，可根据该报文的目的MAC地址和第二映射关系确定该报文的目的IP地址，并可根据该报文的目的IP地址和第一映射关系确定该报文的目的端口号。
同样需要说明的是，VXLAN封装报文是指经过VXLAN封装后的报文。比如，本申请中的第二报文、第三报文、第四报文和检测报文等，均为VXLAN封装报文。VXLAN封装报文的封装格式可如图3所示。而本申请中的第一报文和第五报文为未经VXLAN封装的报文，即图3中的原始报文。对第一报文进行VXLAN封装(即在第一报文前添加图3所述的VXLAN封装)后得到的第二报文即为VXLAN封装报文；对第五报文进行VXLAN封装(即在第五报文前添加图3所示的VXLAN封装)后得到的第四报文也为VXLAN封装报文。
S902：第二VTEP将第四报文经过NAT设备发送至第一VTEP。
S903：第一VTEP接收第二VTEP经过NAT设备发送的第四报文。
S904：第一VTEP根据第四报文生成或更新上述映射关系。
在NAT设备中，NAT表项存在老化周期，即NAT设备在一定时间内没有接收到匹配NAT表项的报文，NAT表项会失效。因此，本申请中，第二VTEP可将第四报文经过NAT设备发送至第一VTEP，该第四报文可用于NAT设备更新自身的NAT表项，第四报文的源端口号和目的端口号均为预设端口号。特别地，为了避免NAT表项失效，第二VTEP可周期性地发送上述第四报文，发送周期可小于NAT表项的老化周期。
NAT设备在接收到第二VTEP发送的第四报文时，刷新NAT表项：若第四报文的源IP地址和源端口号对应的表项不存在，则创建该表项，若第四报文的源IP地址和源端口号对应的表项已存在，则更新该表项的老化时间。
可选地，在第一VTEP根据第四报文生成或更新映射关系之后，第一VTEP可将第二报文经过NAT设备发送至第二VTEP，第二报文的目的端口号根据上述映射关系获取，第二报文的源端口号为预设端口号。
通过上述方式，可在第一VTEP接收到第四报文，并根据第四报文生成或更新映射关系后，实现第一VTEP向第二VTEP发送第二报文。
通过执行图9所示的方法，可避免NAT设备的NAT表项失效。
基于以上实施例，本申请还提供一种报文传输方法，该报文传输方法可视为图5所示方法的一个具体示例。如图10所示，该方法包含如下步骤：
1、第二VTEP将探测报文经过NAT设备发送至第一VTEP。
探测报文用于第一VTEP检测第二VTEP向第一VTEP发送探测报文时是否穿越NAT设备，检测报文携带检测信息。其中，若该探测报文穿越NAT设备则表示公有网络侧部署有NAT设备，第一VTEP和第二VTEP进行通信时经过NAT设备。
其中，探测报文的源端口号和目的端口号均为4789，源IP地址为ip1，目的IP地址为ip2。
2、第一VTEP检测该探测报文是否穿越NAT设备。
第一VTEP可根据检测报文中的检测信息来检测该检测报文是否穿越NAT设备。具体检测方法可参见图5中的相关描述。
3、第一VTEP确定该检测报文穿越NAT设备后，将工作模式设置为穿越NAT模式。
检测报文经过NAT设备后，NAT设备将检测报文的源IP地址由ip1转换为ip11，将检测报文的源端口号由4789转换为port11。第一VTEP接收到检测报文后，比较ip11和检测信息中的ip1不同，或者比较port11和检测信息中的4789不同，或者比较根据ip11和port11计算得到的第二计算结果与检测信息中的第一计算结果(根据ip1和4789计算得到)不同，确定该探测报文穿越NAT设备。
NAT设备将检测报文发送至第一VTEP的同时，NAT设备的NAT表项中记录下
Figure PCTCN2018081323-appb-000007
以及
Figure PCTCN2018081323-appb-000008
的转换关系，该转换关系即为NAT表项。
第一VTEP确定该探测报文穿越NAT设备后，将工作模式设置为穿越NAT模式。
4、第二VTEP将第三报文经过NAT设备发送至第一VTEP。
第三报文的源端口号与目的端口号均为4789，第三报文的源IP地址为ip1，目的IP地址为ip2。
第三报文经过NAT设备时，NAT设备根据NAT表项将第三报文的源IP地址ip1转换为ip11，将第三报文的源端口号4789转换为port11，同时刷新自身的NAT表项。
5、第一VTEP根据接收到的第三报文的源IP地址和源端口号的映射关系生成第一映射关系。
其中，第一映射关系用于指示ip11和port11的映射关系。
6、第一VTEP对第一报文进行VXLAN封装，得到第二报文。
其中，第二报文的源IP地址为ip2，目的IP地址为ip11，第二报文的目的端口号是根据第二报文的目的IP地址ip11和第一映射关系获取的，即port11，第二报文的源端口号为4789。
可选地，第一VTEP可根据第一报文的目的MAC地址和第二映射关系获取第二报文的目的IP地址，该第二映射关系用于指示第一VTEP经过NAT设备接收到的、来自第二VTEP的报文的源IP地址和去除VXLAN封装的源MAC地址的映射关系。
7、第一VTEP将第二报文经过NAT设备发送至第二VTEP。
NAT设备在接收到第二报文时，通过匹配自身的NAT表项，将第二报文的目的IP地址ip11转换为ip1，将第二报文的目的端口号port11转换为4789，从而将转换后的第二报文发送至私有网络中的第二VTEP。
8、第二VTEP对第二报文进行解VXLAN封装，得到第一报文。
第二VTEP在接收到第二报文后，通过识别第二报文的目的端口号为4789，确定该第二报文为VXLAN类型的报文，从而对第二报文进行解VXLAN封装，得到第一报文。
9、第二VTEP周期性地将第四报文发送至第一VTEP。
第四报文的源端口号与目的端口号均为4789，源IP地址为ip1，目的IP地址为ip2。第四报文用于NAT设备刷新NAT表项，NAT设备在接收到第四报文后，刷新NAT表项(
Figure PCTCN2018081323-appb-000009
以及
Figure PCTCN2018081323-appb-000010
)，防止NAT表项失效。
此外，第一VTEP在接收到第四报文后，可根据第四报文更新第一映射关系和第二映射关系。
图10所示方法可视为图5所示方法的一个具体示例，图10中未详尽描述的实现方式可参见图5中的相关描述。
图11示出了采用图10所示方法进行报文传输时，各报文的源IP地址、目的IP地址、源端口号、目的端口号经过NAT设备前以及经过NAT设备后的变化，参考图11可更易理解图10所示方法的操作流程。
综上，采用本申请提供的报文传输方法，在第一VTEP和第二VTEP经过NAT设备进行通信时，解决了现有技术中存在的报文无法穿越NAT设备的问题，实现了报文在公有网络的第一VTEP和私有网络的第二VTEP间的传输。
本申请提供一种报文传输装置，该装置应用于VXLAN中，VXLAN包括该装置、第二VTEP以及NAT设备，其中该装置通过NAT设备与第二VTEP通信，该装置处于公有网络，第二VTEP处于私有网络。该装置可用于执行图5、图7、图9和图10所示方法中第一VTEP所执行的操作，该装置处于公有网络。参见图12，该报文传输装置1200包括处理模块1201和收发模块1202。
报文传输装置1200中，处理模块1201用于对第一报文进行VXLAN封装，得到第二报文；收发模块1202，用于将第二报文经过NAT设备发送至第二VTEP，第二VTEP处于私有网络。其中，第一报文为待发送的报文，第二报文的目的端口号根据第二报文的目的IP地址获取，第二报文的源端口号为预设端口号。
可选地，第二报文的目的端口号根据第二报文的目的IP地址和第一映射关系获取，第一映射关系用于指示收发模块1202经过NAT设备接收到的、来自第二VTEP的报文的源IP地址和源端口号的映射关系。
可选地，收发模块1202还用于在处理模块1201对第一报文进行VXLAN封装之前，接收第二VTEP经过NAT设备发送的第三报文；处理模块1201还用于根据第三报文的源IP地址和源端口号的映射关系生成或更新第一映射关系。
可选地，处理模块1201还用于在对第一报文进行VXLAN封装之前，根据第一报文的目的MAC地址和第二映射关系获取第二报文的目的IP地址，第二映射关系用于指示收发模块1202经过NAT设备接收到的、来自第二VTEP的报文的源IP地址和去除VXLAN封装的源MAC地址的映射关系。
可选地，收发模块1202还用于在处理模块1201对第一报文进行VXLAN封装之前，接收第二VTEP发送的检测报文，该检测报文中携带检测信息，该检测信息用于检测装置和第二VTEP进行通信时是否经过NAT设备；处理模块1201还用于根据检测信息，确定装置和第二VTEP进行通信时经过NAT设备。
其中，检测信息包含以下一种或多种信息：检测报文的私有网络源IP地址；检测报文的私有网络源端口号；根据私有网络源IP地址和私有网络源端口号进行计算得到的第一计算结果。
可选地，处理模块1201在根据检测信息，确定装置和第二VTEP进行通信时经过NAT设备的情况下，具体用于：处理模块1201比较检测报文的私有网络源IP地址和检测报文的源IP地址不同时，确定装置和第二VTEP进行通信时经过NAT设备；和/或，处理模块1201比较检测报文的私有网络源端口号和检测报文的源端口号不同时，确定装置和第二VTEP进行通信时经过NAT设备；和/或，处理模块1201对检测报文的源IP地址和检测报文的源端口号进行计算，得到第二计算结果，在第二计算结果与第一计算结果不同时，确定装置和第二VTEP进行通信时经过NAT设备。
可选地，收发模块1202还用于在处理模块1201对第一报文进行VXLAN封装之前，接收SDN控制器发送的控制消息，该控制消息用于指示装置和第二VTEP进行通信时经过NAT设备。
可选地，收发模块1202还用于：接收第二VTEP经过NAT设备发送的第四报文，该第四报文用于NAT设备生成或更新自身的NAT表项。
可选地，第四报文携带第一标识，该第一标识用于指示第四报文的报文类型。
需要说明的是，本申请中对模块的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。本申请实施例中的各功能模块可以集成在一个处理模块中，也可以是各个模块单独物理存在，也可以两个或两个以上模块集成在一个模块中。上述集成的模块既可以采用硬件的形式实现，也可以采用软件功能模块的形式实现。
需要说明的是，报文传输装置1200可用于执行图5、图7、图9和图10所示的报文传输方法中第一VTEP所执行的操作。报文传输装置1200中未详尽描述的实现方式可参见图5、图7、图9和图10所示的报文传输方法中的相关描述。
图13示出了上述实施例中所涉及的报文传输装置的另一种可能的结构示意图。
报文传输装置1300包括收发器1301、处理器1302和存储器1303。收发器1301、处理器1302和存储器1303通过总线连接。该收发器1301用于支持报文传输装置1300与其他装置(比如第二VTEP)之间收发信息。处理器1302通过调用存储器1303中存储的程序代码和数据来执行图5、图7、图9和图10所示的报文传输方法。
报文传输装置1300可以是与报文传输装置1200相同的装置，报文传输装置1300可用于执行图5、图7、图9和图10所示的报文传输方法中第一VTEP所执行的操作。报文传输装置1300中未详尽描述的实现方式可参见图5、图7、图9和图10所示的报文传输方法和报文传输装置1200中的相关描述。
本申请提供一种报文传输装置，该装置应用于VXLAN中，VXLAN包括第一VTEP、该装置以及NAT设备，其中第一VTEP通过NAT设备与该装置通信，第一VTEP处于公有网络，该装置处于私有网络。该装置可用于执行图5、图7、图9和图10所示方法中第二VTEP所执行的操作，该装置处于私有网络。参见图14，该报文传输装置1400包括收发模块1401和处理模块1402。
报文传输装置1400中，收发模块1401，用于接收第一VTEP经过NAT设备发送的第二报文，第一VTEP处于公有网络，第二报文的源端口号和目的端口号均为预设端口号，在经过NAT设备之前第二报文的目的端口号由第一VTEP根据第二报文的目的IP地址获取；处理模块1402，用于对第二报文进行解VXLAN封装，得到第一报文。
可选地，收发模块1401还用于在接收第一VTEP经过NAT设备发送的第二报文之前，将第三报文经过NAT设备发送至第一VTEP，第三报文的源端口号和目的端口号均为预设端口号，第三报文用于第一VTEP生成或更新第一映射关系，第一映射关系用于指示第一VTEP经过NAT设备接收到的、来自装置的报文的源IP地址和源端口号的映射关系。
可选地，收发模块1401还用于在接收第一VTEP经过NAT设备发送的第二报文之前，向第一VTEP发送检测报文，检测报文中携带检测信息，检测信息用于第一VTEP检测第一VTEP和装置进行通信时是否经过NAT设备，检测报文的源端口号和目的端口号均为预设端口号；其中，检测信息包含以下一种或多种信息：检测报文的私有网络源IP地址；检测报文的私有网络源端口号；根据私有网络源IP地址和私有网络源端口号进行计算得到的第一计算结果。
可选地，收发模块1401还用于在接收第一VTEP经过NAT设备发送的第二报文之前，向SDN控制器发送注册请求消息，注册请求消息中携带检测信息，检测信息用于SDN控制器检测第一VTEP和装置进行通信时是否经过NAT设备；
其中，检测信息包含以下一种或多种信息：检测报文的私有网络源IP地址；检测报文的私有网络源端口号；根据私有网络源IP地址和私有网络源端口号进行计算得到的第一计算结果。
可选地，收发模块1401还用于将第四报文经过NAT设备发送至第一VTEP，且该第四报文用于NAT设备生成或更新自身的NAT表项，且该第四报文的源端口号和目的端口号均为预设端口号。
可选地，第四报文携带第一标识，该第一标识用于指示第四报文的报文类型。
需要说明的是，报文传输装置1400可用于执行图5、图7、图9和图10所示的报文传输方法中第二VTEP所执行的操作。报文传输装置1400中未详尽描述的实现方式可参见图5、图7、图9和图10所示的报文传输方法中的相关描述。
图15示出了上述实施例中所涉及的报文传输装置的另一种可能的结构示意图。
报文传输装置1500包括收发器1501、处理器1502和存储器1503。收发器1501、处理器1502和存储器1503通过总线连接。该收发器1501用于支持报文传输装置1500与其他装置(比如第一VTEP)之间收发信息。处理器1502通过调用存储器1503中存储的程序代码和数据来执行图5、图7、图9和图10所示的报文传输方法。
报文传输装置1500可以是与报文传输装置1400相同的装置，报文传输装置1500可用于执行图5、图7、图9和图10所示的报文传输方法中第二VTEP所执行的操作。报文传输装置1500中未详尽描述的实现方式可参见图5、图7、图9和图10所示的报文传输方法和报文传输装置1400中的相关描述。
本申请提供一种报文传输装置，该装置可用于执行图9所示方法中第二VTEP所执行的操作，该装置处于私有网络。参见图16，该报文传输装置1600，包括处理模块1601和收发模块1602。
其中，处理模块1601，用于对第五报文进行VXLAN封装，得到第四报文，第五报文为待发送的原始报文，第四报文的源端口号和目的端口号均为预设端口号，第四报文用于NAT设备生成或更新自身的NAT表项，以及用于第一VTEP生成或更新映射关系，映射关系用于第一VTEP经过NAT设备向装置发送VXLAN封装报文时确定该报文的目的端口号和/或目的IP地址；收发模块1602用于将第四报文经过NAT设备发送至第一VTEP，第四报文用于NAT设备生成或更新自身的NAT表项，第四报文的源端口号和目的端口号均为预设端口号。
可选地，收发模块1602在将第四报文经过NAT设备发送至第一VTEP时，具体用于：收发模块1602周期性地将第四报文经过NAT设备发送至第一VTEP。
需要说明的是，报文传输装置1600可用于执行图5、图7、图9和图10所示的报文传输方法中第二VTEP所执行的操作。报文传输装置1600中未详尽描述的实现方式可参见图5、图7、图9和图10所示的报文传输方法中的相关描述。
图17示出了上述实施例中所涉及的报文传输装置的另一种可能的结构示意图。
报文传输装置1700包括收发器1701、处理器1702和存储器1703。收发器1701、处理器1702和存储器1703通过总线连接。该收发器1701用于支持报文传输装置1700与其他装置(比如第一VTEP)之间收发信息。处理器1702通过调用存储器1703中存储的程序代码和数据来执行报文传输方法。
报文传输装置1700可以是与报文传输装置1600相同的装置，报文传输装置1700可用于执行图5、图7、图9和图10所示的报文传输方法中第二VTEP所执行的操作。报文传输装置1700中未详尽描述的实现方式可参见图5、图7、图9和图10所示的报文传输方法和报文传输装置1600中的相关描述。
本申请提供一种报文传输装置，该装置可用于执行图5、图7、图9和图10所示方法中第一VTEP所执行的操作，该装置处于公有网络。参见图18，该报文传输装置1800包括收发模块1801。
收发模块1801，用于接收第二VTEP经过NAT设备发送的第四报文，第二VTEP处于私有网络，第四报文用于NAT设备生成或更新自身的NAT表项，以及用于该装置生成或更新映射关系，该映射关系用于该装置经过NAT设备向第二VTEP发送VXLAN封装报文时确定该报文的目的端口号和/或目的IP地址；处理模块1802，用于根据第四报文生成或更新该映射关系。
可选地，收发模块1801在接收第二VTEP经过NAT设备发送的第四报文时，具体用于：收发模块1801周期性地接收第二VTEP经过NAT设备发送的第四报文。
可选地，在处理模块1802根据第四报文生成或更新映射关系后，收发模块1801将第二报文经过NAT设备发送至第二VTEP，该第二报文的目的端口号根据该映射关系获取，该第二报文的源端口号为预设端口号。
需要说明的是，报文传输装置1800可用于执行图5、图7、图9和图10所示的报文传输方法中第一VTEP所执行的操作。报文传输装置1800中未详尽描述的实现方式可参见图5、图7、图9和图10所示的报文传输方法中的相关描述。
图19示出了上述实施例中所涉及的报文传输装置的另一种可能的结构示意图。
报文传输装置1900包括收发器1901、处理器1902和存储器1903。收发器1901、处理器1902和存储器1903通过总线连接。该收发器1901用于支持报文传输装置1900与其他装置(比如第二VTEP)之间收发信息。处理器1902通过调用存储器1903中存储的程序代码和数据来执行报文传输方法。
报文传输装置1900可以是与报文传输装置1800相同的装置，报文传输装置1900可用于执行图5、图7、图9和图10所示的报文传输方法中第一VTEP所执行的操作。报文传输装置1900中未详尽描述的实现方式可参见图5、图7、图9和图10所示的报文传输方法和报文传输装置1800中的相关描述。
此外，本申请提供一种报文传输系统，如图20所示，该报文传输系统2000包含图12所示的报文传输装置1200或1300和图14所示的报文传输装置1400或1500。图20中仅以报文传输装置1200和报文传输装置1400构成该报文传输系统2000进行示意。
此外，本申请还提供一种报文传输系统，如图21所示，该报文传输系统2100包含图16所示的报文传输装置1600或1700和图18所示的报文传输装置1800或1900。图21中仅以报文传输装置1600和报文传输装置1800构成该报文传输系统2100进行示意。
本领域内的技术人员应明白，本申请的实施例可提供为方法、系统、或计算机程序产品。因此，本申请可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本申请可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本申请是参照根据本申请的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
显然，本领域的技术人员可以对本申请进行各种改动和变型而不脱离本申请的精神和范围。这样，倘若本申请的这些修改和变型属于本申请权利要求及其等同技术的范围之内，则本申请也意图包含这些改动和变型在内。

Claims (37)

  1. 一种报文传输方法，应用于虚拟扩展局域网VXLAN中，所述VXLAN包括第一虚拟扩展局域网隧道端点VTEP、第二VTEP以及网络地址转换NAT设备，其中所述第一VTEP通过所述NAT设备与所述第二VTEP通信，所述第一VTEP处于公有网络，所述第二VTEP处于私有网络，其特征在于，所述方法包括:
    所述第一VTEP对第一报文进行VXLAN封装，得到第二报文，所述第一报文为待发送的报文，所述第二报文的目的端口号根据所述第二报文的目的互联网协议IP地址获取，所述第二报文的源端口号为预设端口号；
    所述第一VTEP将所述第二报文经过所述NAT设备发送至所述第二VTEP。
  2. 如权利要求1所述的方法，其特征在于，所述第二报文的目的端口号根据所述第二报文的目的IP地址和第一映射关系获取，所述第一映射关系用于指示所述第一VTEP经过所述NAT设备接收到的、来自所述第二VTEP的报文的源IP地址和源端口号的映射关系。
  3. 如权利要求2所述的方法，其特征在于，在所述第一VTEP对所述第一报文进行VXLAN封装之前，还包括：
    所述第一VTEP接收所述第二VTEP经过所述NAT设备发送的第三报文；
    所述第一VTEP根据所述第三报文的源IP地址和源端口号的映射关系生成或更新所述第一映射关系。
  4. 如权利要求1～3任一项所述的方法，其特征在于，在所述第一VTEP对所述第一报文进行VXLAN封装之前，还包括：
    所述第一VTEP根据所述第一报文的目的MAC地址和第二映射关系获取所述第二报文的目的IP地址，所述第二映射关系用于指示所述第一VTEP经过所述NAT设备接收到的、来自所述第二VTEP的报文的源IP地址和去除VXLAN封装的源MAC地址的映射关系。
  5. 如权利要求1～4任一项所述的方法，其特征在于，在所述第一VTEP对所述第一报文进行VXLAN封装之前，还包括：
    所述第一VTEP接收所述第二VTEP发送的检测报文，所述检测报文中携带检测信息，所述检测信息用于检测所述第一VTEP和所述第二VTEP进行通信时是否经过所述NAT设备；其中，所述检测信息包含以下一种或多种信息：所述检测报文的私有网络源IP地址；所述检测报文的私有网络源端口号；根据所述私有网络源IP地址和所述私有网络源端口号进行计算得到的第一计算结果；
    所述第一VTEP采用以下方式中的一种或多种，根据所述检测信息确定所述第一VTEP和所述第二VTEP进行通信时经过所述NAT设备：
    所述第一VTEP比较所述检测报文的私有网络源IP地址和所述检测报文的源IP地址不同时，确定所述第一VTEP和所述第二VTEP进行通信时经过所述NAT设备；
    所述第一VTEP比较所述检测报文的私有网络源端口号和所述检测报文的源端口号不同时，确定所述第一VTEP和所述第二VTEP进行通信时经过所述NAT设备；
    所述第一VTEP对所述检测报文的源IP地址和所述检测报文的源端口号进行计算，得到第二计算结果，在所述第二计算结果与所述第一计算结果不同时，确定所述第一VTEP和所述第二VTEP进行通信时经过所述NAT设备。
  6. 如权利要求1～4任一项所述的方法，其特征在于，在所述第一VTEP对所述第一报文进行VXLAN封装之前，还包括：
    所述第一VTEP接收软件定义网络SDN控制器发送的控制消息，所述控制消息用于指示所述第一VTEP和所述第二VTEP进行通信时经过所述NAT设备。
  7. 如权利要求1～6任一项所述的方法，其特征在于，还包括：
    所述第一VTEP接收所述第二VTEP经过所述NAT设备发送的第四报文，所述第四报文用于所述NAT设备生成或更新自身的NAT表项。
  8. 如权利要求7所述的方法，其特征在于，所述第四报文携带第一标识，所述第一标识用于指示所述第四报文的报文类型。
  9. 一种报文传输方法，应用于虚拟扩展局域网VXLAN中，所述VXLAN包括第一虚拟扩展局域网隧道端点VTEP、第二VTEP以及网络地址转换NAT设备，其中所述第一VTEP通过所述NAT设备与所述第二VTEP通信，所述第一VTEP处于公有网络，所述第二VTEP处于私有网络，其特征在于，所述方法包括:
    所述第二VTEP接收所述第一VTEP经过所述NAT设备发送的第二报文，所述第二报文的源端口号和目的端口号均为预设端口号，在经过所述NAT设备之前所述第二报文的目的端口号由所述第一VTEP根据所述第二报文的目的互联网协议IP地址获取；
    所述第二VTEP对所述第二报文进行解VXLAN封装，得到第一报文。
  10. 如权利要求9所述的方法，其特征在于，在所述第二VTEP接收所述第一VTEP经过所述NAT设备发送的第二报文之前，还包括：
    所述第二VTEP将第三报文经过所述NAT设备发送至所述第一VTEP，所述第三报文的源端口号和目的端口号均为所述预设端口号，所述第三报文用于所述第一VTEP生成或更新第一映射关系，所述第一映射关系用于指示所述第一VTEP经过所述NAT设备接收到的、来自所述第二VTEP的报文的源IP地址和源端口号的映射关系。
  11. 如权利要求9或10所述的方法，其特征在于，在所述第二VTEP接收所述第一VTEP经过所述NAT设备发送的第二报文之前，还包括：
    所述第二VETP向所述第一VTEP发送检测报文，所述检测报文中携带检测信息，所述检测信息用于所述第一VTEP检测所述第一VTEP和所述第二VTEP进行通信时是否经过所述NAT设备，所述检测报文的源端口号和目的端口号均为所述预设端口号；
    其中，所述检测信息包含以下一种或多种信息：
    所述检测报文的私有网络源IP地址；
    所述检测报文的私有网络源端口号；
    根据所述私有网络源IP地址和所述私有网络源端口号进行计算得到的第一计算结果。
  12. 如权利要求9或10所述的方法，其特征在于，在所述第二VTEP接收所述第一VTEP经过所述NAT设备发送的第二报文之前，还包括：
    所述第二VTEP向软件定义网络SDN控制器发送注册请求消息，所述注册请求消息中携带检测信息，所述检测信息用于所述SDN控制器检测所述第一VTEP和所述第二VTEP进行通信时是否经过所述NAT设备；
    其中，所述检测信息包含以下一种或多种信息：
    所述检测报文的私有网络源IP地址；
    所述检测报文的私有网络源端口号；
    根据所述私有网络源IP地址和所述私有网络源端口号进行计算得到的第一计算结果。
  13. 如权利要求9～12任一项所述的方法，其特征在于，还包括：
    所述第二VTEP将第四报文经过所述NAT设备发送至所述第一VTEP，所述第四报文用于所述NAT设备生成或更新自身的NAT表项，所述第四报文的源端口号和目的端口号均为所述预设端口号。
  14. 如权利要求13所述的方法，其特征在于，所述第四报文携带第一标识，所述第一标识用于指示 所述第四报文的报文类型。
  15. 一种报文传输方法，应用于虚拟扩展局域网VXLAN中，所述VXLAN包括第一虚拟扩展局域网隧道端点VTEP、第二VTEP以及网络地址转换NAT设备，其中所述第一VTEP通过所述NAT设备与所述第二VTEP通信，所述第一VTEP处于公有网络，所述第二VTEP处于私有网络，其特征在于，所述方法包括：
    所述第二VTEP对第五报文进行VXLAN封装，得到第四报文，所述第五报文为所述第二VTEP待发送的原始报文，所述第四报文的源端口号和目的端口号均为预设端口号，所述第四报文用于所述NAT设备生成或更新自身的NAT表项，以及用于所述第一VTEP生成或更新映射关系，所述映射关系用于所述第一VTEP经过所述NAT设备向所述第二VTEP发送VXLAN封装报文时确定该报文的目的端口号和/或目的互联网协议IP地址；
    所述第二VTEP将所述第四报文经过所述NAT设备发送至所述第一VTEP。
  16. 如权利要求15所述的方法，其特征在于，所述第二VTEP将所述第四报文经过所述NAT设备发送至所述第一VTEP，具体包括：
    所述第二VTEP周期性地将所述第四报文经过所述NAT设备发送至所述第一VTEP。
  17. 一种报文传输方法，应用于虚拟扩展局域网VXLAN中，所述VXLAN包括第一虚拟扩展局域网隧道端点VTEP、第二VTEP以及网络地址转换NAT设备，其中所述第一VTEP通过所述NAT设备与所述第二VTEP通信，所述第一VTEP处于公有网络，所述第二VTEP处于私有网络，其特征在于，所述方法包括：
    所述第一VTEP接收所述第二VTEP经过所述NAT设备发送的第四报文，所述第四报文用于所述NAT设备生成或更新自身的NAT表项，以及用于所述第一VTEP生成或更新映射关系，所述映射关系用于所述第一VTEP经过所述NAT设备向所述第二VTEP发送VXLAN封装报文时确定该报文的目的端口号和/或目的互联网协议IP地址；
    所述第一VTEP根据所述第四报文生成或更新所述映射关系。
  18. 如权利要求17所述的方法，其特征在于，所述第一VTEP接收所述第二VTEP经过所述NAT设备发送的所述第四报文，具体包括：
    所述第一VTEP周期性地接收所述第二VTEP经过所述NAT设备发送的所述第四报文。
  19. 如权利要求17或18所述的方法，其特征在于，在所述第一VTEP根据所述第四报文生成或更新所述映射关系之后，还包括：
    所述第一VTEP将第二报文经过所述NAT设备发送至所述第二VTEP，所述第二报文的目的端口号根据所述映射关系获取，所述第二报文的源端口号为预设端口号。
  20. 一种报文传输装置，应用于虚拟扩展局域网VXLAN中，所述VXLAN包括所述装置、第二虚拟扩展局域网隧道端点VTEP以及网络地址转换NAT设备，其中所述装置通过所述NAT设备与所述第二VTEP通信，所述装置处于公有网络，所述第二VTEP处于私有网络，其特征在于，所述装置包括:
    处理模块，用于对第一报文进行VXLAN封装，得到第二报文，所述第一报文为待发送的报文，所述第二报文的目的端口号根据所述第二报文的目的互联网协议IP地址获取，所述第二报文的源端口号为预设端口号；
    收发模块，用于将所述第二报文经过所述NAT设备发送至所述第二VTEP。
  21. 如权利要求20所述的装置，其特征在于，所述第二报文的目的端口号根据所述第二报文的目的IP地址和第一映射关系获取，所述第一映射关系用于指示所述收发模块经过所述NAT设备接收到的、来自所述第二VTEP的报文的源IP地址和源端口号的映射关系。
  22. 如权利要求21所述的装置，其特征在于，所述收发模块，还用于：
    在所述处理模块对所述第一报文进行VXLAN封装之前，接收所述第二VTEP经过所述NAT设备发送的 第三报文；
    所述处理模块，还用于根据所述第三报文的源IP地址和源端口号的映射关系生成或更新所述第一映射关系。
  23. 如权利要求20～22任一项所述的装置，其特征在于，所述处理模块，还用于：
    在对所述第一报文进行VXLAN封装之前，根据所述第一报文的目的MAC地址和所述第二映射关系获取所述第二报文的目的IP地址，所述第二映射关系用于指示所述收发模块经过所述NAT设备接收到的、来自所述第二VTEP的报文的源IP地址和去除VXLAN封装的源MAC地址的映射关系。
  24. 如权利要求20～23任一项所述的装置，其特征在于，所述收发模块，还用于：
    在所述处理模块对所述第一报文进行VXLAN封装之前，接收所述第二VTEP发送的检测报文，所述检测报文中携带检测信息，所述检测信息用于检测所述装置和所述第二VTEP进行通信时是否经过所述NAT设备；其中，所述检测信息包含以下一种或多种信息：所述检测报文的私有网络源IP地址；所述检测报文的私有网络源端口号；根据所述私有网络源IP地址和所述私有网络源端口号进行计算得到的第一计算结果；
    所述处理模块，还用于采用以下方式中的一种或多种，根据所述检测信息确定所述装置和所述第二VTEP进行通信时经过所述NAT设备：
    所述处理模块比较所述检测报文的私有网络源IP地址和所述检测报文的源IP地址不同时，确定所述装置和所述第二VTEP进行通信时经过所述NAT设备；
    所述处理模块比较所述检测报文的私有网络源端口号和所述检测报文的源端口号不同时，确定所述装置和所述第二VTEP进行通信时经过所述NAT设备；
    所述处理模块对所述检测报文的源IP地址和所述检测报文的源端口号进行计算，得到第二计算结果，在所述第二计算结果与所述第一计算结果不同时，确定所述装置和所述第二VTEP进行通信时经过所述NAT设备。
  25. 如权利要求20～23任一项所述的装置，其特征在于，所述收发模块，还用于：
    在所述处理模块对所述第一报文进行VXLAN封装之前，接收软件定义网络SDN控制器发送的控制消息，所述控制消息用于指示所述装置和所述第二VTEP进行通信时经过所述NAT设备。
  26. 如权利要求20～25任一项所述的装置，其特征在于，所述收发模块，还用于：
    接收所述第二VTEP经过所述NAT设备发送的第四报文，所述第四报文用于所述NAT设备生成或更新自身的NAT表项。
  27. 如权利要求26所述的装置，其特征在于，所述第四报文携带第一标识，所述第一标识用于指示所述第四报文的报文类型。
  28. 一种报文传输装置，应用于虚拟扩展局域网VXLAN中，所述VXLAN包括第一虚拟扩展局域网隧道端点VTEP、所述装置以及网络地址转换NAT设备，其中所述第一VTEP通过所述NAT设备与所述装置通信，所述第一VTEP处于公有网络，所述装置处于私有网络，其特征在于，所述装置包括:
    收发模块，用于接收所述第一VTEP经过所述NAT设备发送的第二报文，所述第二报文的源端口号和目的端口号均为预设端口号，在经过所述NAT设备之前所述第二报文的目的端口号由所述第一VTEP根据所述第二报文的目的互联网协议IP地址获取；
    处理模块，用于对所述第二报文进行解VXLAN封装，得到第一报文。
  29. 如权利要求28所述的装置，其特征在于，所述收发模块，还用于：
    在接收所述第一VTEP经过所述NAT设备发送的第二报文之前，将第三报文经过所述NAT设备发送至所述第一VTEP，所述第三报文的源端口号和目的端口号均为所述预设端口号，所述第三报文用于所述第 一VTEP生成或更新第一映射关系，所述第一映射关系用于指示所述第一VTEP经过所述NAT设备接收到的、来自所述装置的报文的源IP地址和源端口号的映射关系。
  30. 如权利要求28或29所述的装置，其特征在于，所述收发模块，还用于：
    在接收所述第一VTEP经过所述NAT设备发送的第二报文之前，向所述第一VTEP发送检测报文，所述检测报文中携带检测信息，所述检测信息用于所述第一VTEP检测所述第一VTEP和所述装置进行通信时是否经过所述NAT设备，所述检测报文的源端口号和目的端口号均为所述预设端口号；
    其中，所述检测信息包含以下一种或多种信息：
    所述检测报文的私有网络源IP地址；
    所述检测报文的私有网络源端口号；
    根据所述私有网络源IP地址和所述私有网络源端口号进行计算得到的第一计算结果。
  31. 如权利要求28或29所述的装置，其特征在于，所述收发模块，还用于：
    在接收所述第一VTEP经过所述NAT设备发送的第二报文之前，向软件定义网络SDN控制器发送注册请求消息，所述注册请求消息中携带检测信息，所述检测信息用于所述SDN控制器检测所述第一VTEP和所述装置进行通信时是否经过所述NAT设备；
    其中，所述检测信息包含以下一种或多种信息：
    所述检测报文的私有网络源IP地址；
    所述检测报文的私有网络源端口号；
    根据所述私有网络源IP地址和所述私有网络源端口号进行计算得到的第一计算结果。
  32. 如权利要求28～31任一项所述的装置，其特征在于，所述收发模块，还用于：
    将第四报文经过所述NAT设备发送至所述第一VTEP，所述第四报文用于所述NAT设备生成或更新自身的NAT表项，所述第四报文的源端口号和目的端口号均为所述预设端口号。
  33. 如权利要求32所述的装置，其特征在于，所述第四报文携带第一标识，所述第一标识用于指示所述第四报文的报文类型。
  34. 一种报文传输装置，应用于虚拟扩展局域网VXLAN中，所述VXLAN包括第一虚拟扩展局域网隧道端点VTEP、所述装置以及网络地址转换NAT设备，其中所述第一VTEP通过所述NAT设备与所述装置通信，所述第一VTEP处于公有网络，所述装置处于私有网络，其特征在于，所述装置包括：
    处理模块，用于对第五报文进行VXLAN封装，得到第四报文，所述第五报文为待发送的原始报文，所述第四报文的源端口号和目的端口号均为预设端口号，所述第四报文用于所述NAT设备生成或更新自身的NAT表项，以及用于所述第一VTEP生成或更新映射关系，所述映射关系用于所述第一VTEP经过所述NAT设备向所述装置发送VXLAN封装报文时确定该报文的目的端口号和/或目的互联网协议IP地址；
    收发模块，用于将所述第四报文经过所述NAT设备发送至所述第一VTEP。
  35. 一种报文传输装置，应用于虚拟扩展局域网VXLAN中，所述VXLAN包括所述装置、第二虚拟扩展局域网隧道端点VTEP以及网络地址转换NAT设备，其中所述装置通过所述NAT设备与所述第二VTEP通信，所述装置处于公有网络，所述第二VTEP处于私有网络，其特征在于，所述装置包括：
    收发模块，用于接收所述第二VTEP经过所述NAT设备发送的第四报文，所述第四报文用于所述NAT设备生成或更新自身的NAT表项，以及用于所述装置生成或更新映射关系，所述映射关系用于所述装置经过所述NAT设备向所述第二VTEP发送VXLAN封装报文时确定该报文的目的端口号和/或目的互联网协议IP地址；
    处理模块，用于根据所述第四报文生成或更新所述映射关系。
  36. 一种报文传输装置，应用于虚拟扩展局域网VXLAN中，所述VXLAN包括所述装置、第二虚拟扩 展局域网隧道端点VTEP以及网络地址转换NAT设备，其中所述装置通过所述NAT设备与所述第二VTEP通信，所述装置处于公有网络，所述第二VTEP处于私有网络，其特征在于，所述装置包括:
    处理器，用于对第一报文进行VXLAN封装，得到第二报文，所述第一报文为待发送的报文，所述第二报文的目的端口号根据所述第二报文的目的互联网协议IP地址获取，所述第二报文的源端口号为预设端口号；
    收发器，用于将所述第二报文经过所述NAT设备发送至所述第二VTEP。
  37. 一种报文传输装置，应用于虚拟扩展局域网VXLAN中，所述VXLAN包括第一虚拟扩展局域网隧道端点VTEP、所述装置以及网络地址转换NAT设备，其中所述第一VTEP通过所述NAT设备与所述装置通信，所述第一VTEP处于公有网络，所述装置处于私有网络，其特征在于，所述装置包括:
    收发器，用于接收所述第一VTEP经过所述NAT设备发送的第二报文，所述第二报文的源端口号和目的端口号均为预设端口号，在经过所述NAT设备之前所述第二报文的目的端口号由所述第一VTEP根据所述第二报文的目的互联网协议IP地址获取；
    处理器，用于对所述第二报文进行解VXLAN封装，得到第一报文。
PCT/CN2018/081323 2017-03-30 2018-03-30 一种报文传输方法及装置 WO2018177409A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP18777718.0A EP3595271B1 (en) 2017-03-30 2018-03-30 Packet transmission method, apparatus and network
US16/581,826 US11252129B2 (en) 2017-03-30 2019-09-25 Packet transmission method and apparatus

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710201924.1 2017-03-30
CN201710201924.1A CN108667945B (zh) 2017-03-30 2017-03-30 一种报文传输方法及装置

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/581,826 Continuation US11252129B2 (en) 2017-03-30 2019-09-25 Packet transmission method and apparatus

Publications (1)

Publication Number Publication Date
WO2018177409A1 true WO2018177409A1 (zh) 2018-10-04

Family

ID=63675248

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/081323 WO2018177409A1 (zh) 2017-03-30 2018-03-30 一种报文传输方法及装置

Country Status (4)

Country Link
US (1) US11252129B2 (zh)
EP (1) EP3595271B1 (zh)
CN (1) CN108667945B (zh)
WO (1) WO2018177409A1 (zh)

Families Citing this family (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111371666B (zh) * 2018-12-26 2021-12-31 华为技术有限公司 一种处理报文的方法、设备及系统
CN109547316A (zh) * 2018-12-29 2019-03-29 瑞斯康达科技发展股份有限公司 Vxlan报文穿越nat设备的方法、系统、存储介质
CN109819067A (zh) * 2019-03-12 2019-05-28 赛特斯信息科技股份有限公司 利用stun协议实现基于vxlan隧道技术的nat穿越处理的方法
CN109743244A (zh) * 2019-03-21 2019-05-10 山东华辰泰尔信息科技股份有限公司 一种基于sdn与nfv技术实现高速互联互通的系统和方法
CN113067911B (zh) * 2020-01-02 2023-06-30 中国移动通信有限公司研究院 一种nat穿越方法、装置、电子设备和存储介质
US11876790B2 (en) * 2020-01-21 2024-01-16 The Boeing Company Authenticating computing devices based on a dynamic port punching sequence
US11245629B2 (en) * 2020-07-09 2022-02-08 Vmware, Inc. Adaptive source port generation in overlay networks
CN114006788B (zh) * 2020-11-30 2023-03-21 易识科技(广东)有限责任公司 一种建立双向隧道的控制方法及系统
CN114567616B (zh) * 2022-02-28 2023-10-31 天翼安全科技有限公司 一种VxLAN NAT穿越的方法、系统和设备
CN116760795B (zh) * 2023-08-15 2023-12-08 中移(苏州)软件技术有限公司 网络地址转换nat网关设备、报文处理方法和装置

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103688516A (zh) * 2011-05-05 2014-03-26 瑞典爱立信有限公司 提供公共可达性的方法和有关系统与装置
US20140112137A1 (en) * 2012-10-18 2014-04-24 Hewlett-Packard Development Company, L.P. Routing encapsulated data packets onto selected vlans
CN106330649A (zh) * 2015-06-18 2017-01-11 杭州华三通信技术有限公司 一种跨软件定义网络的数据报文转发方法和装置

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2004063843A2 (en) * 2003-01-15 2004-07-29 Matsushita Electric Industrial Co., Ltd. PEER-TO-PEER (P2P) CONNECTION DESPITE NETWORK ADDRESS TRANSLATOR (NATs) AT BOTH ENDS
US9560016B2 (en) * 2013-04-30 2017-01-31 Futurewei Technologies, Inc. Supporting IP address overlapping among different virtual networks
US10511458B2 (en) * 2014-09-30 2019-12-17 Nicira, Inc. Virtual distributed bridging
CN105721359B (zh) * 2014-12-04 2019-11-15 中兴通讯股份有限公司 Vxlan报文传输方法及装置
CN104601432B (zh) * 2014-12-31 2018-03-13 新华三技术有限公司 一种报文传输方法和设备
CN106341333B (zh) * 2015-07-10 2019-07-19 新华三技术有限公司 应用于vxlan中的丢包定位方法和装置

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103688516A (zh) * 2011-05-05 2014-03-26 瑞典爱立信有限公司 提供公共可达性的方法和有关系统与装置
US20140112137A1 (en) * 2012-10-18 2014-04-24 Hewlett-Packard Development Company, L.P. Routing encapsulated data packets onto selected vlans
CN106330649A (zh) * 2015-06-18 2017-01-11 杭州华三通信技术有限公司 一种跨软件定义网络的数据报文转发方法和装置

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
ROSENBERG, J. ET AL.: "FC 3489 STUN SIMPLE TRAVERSAL OF USER DATAGRAM PROTOCOL UDP THROUGH NETWORK ADDRESS TRANSLATORS NATS", STUN - SIMPLE TRAVERSAL OF USER DATAGRAM PROTOCOL (UDP) THROUGH NETWORK ADDRESS TRANSLATORS (NATS); RFC3489.TXT, 31 March 2003 (2003-03-31), XP015009272 *
See also references of EP3595271A4

Also Published As

Publication number Publication date
US20200021558A1 (en) 2020-01-16
EP3595271A1 (en) 2020-01-15
EP3595271B1 (en) 2024-01-10
EP3595271A4 (en) 2020-01-15
CN108667945A (zh) 2018-10-16
US11252129B2 (en) 2022-02-15
CN108667945B (zh) 2020-10-23

Similar Documents

Publication Publication Date Title
WO2018177409A1 (zh) 一种报文传输方法及装置
US12101296B2 (en) Intelligent service layer for separating application from physical networks and extending service layer intelligence over IP across the internet, cloud, and edge networks
US8982707B2 (en) Interoperability of data plane based overlays and control plane based overlays in a network environment
CN104601432B (zh) 一种报文传输方法和设备
TWI538461B (zh) 用於在虛擬區域網路中管理雲端裝置之管理伺服器及其管理方法
CN101227407B (zh) 基于二层隧道协议的报文发送方法及装置
WO2018040529A1 (zh) 一种报文处理方法、设备及系统
WO2016192686A1 (zh) 数据报文转发
CN110121864B (zh) 不同网络通信协议之间的网络桥接的方法和设备
WO2017071547A1 (zh) 应用于vxlan的报文转发
US10831920B2 (en) Filter-based control information query in software-defined networking (SDN) environments
JP2018139448A5 (zh)
CN107094110B (zh) 一种dhcp报文转发方法及装置
US20210273915A1 (en) Multi-access interface for internet protocol security
ES2826388T3 (es) Procedimiento y puerta de enlace para adquirir una ruta según se requiera
CN106130819B (zh) Vtep异常的检测方法及装置
US20170332439A1 (en) Extending the range of mesh networks
CN104579954A (zh) 报文跨域转发方法、装置及通信设备
WO2021082803A1 (zh) 路由信息传输方法及装置、数据中心互联网络
WO2022042503A1 (zh) 一种报文传输方法、装置及系统
US8804737B2 (en) Encoding watermarks in a sequence of sent packets, the encoding useful for uniquely identifying an entity in encrypted networks
US20240039846A1 (en) Asymmetric Addressing For Limited Domains and Internet
CN107733930B (zh) 用于在多个wan网络网关处转发互联网协议(ip)数据包的方法和系统
KR20230026424A (ko) IPv6 네트워크 통신 방법, 장치 및 시스템
WO2014156143A1 (ja) ホームゲートウェイ装置およびパケット転送方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18777718

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2018777718

Country of ref document: EP

Effective date: 20191010