WO2018188569A1 - 一种转发数据报文的方法、设备和系统 - Google Patents

一种转发数据报文的方法、设备和系统 Download PDF

Info

Publication number
WO2018188569A1
WO2018188569A1 PCT/CN2018/082435 CN2018082435W WO2018188569A1 WO 2018188569 A1 WO2018188569 A1 WO 2018188569A1 CN 2018082435 W CN2018082435 W CN 2018082435W WO 2018188569 A1 WO2018188569 A1 WO 2018188569A1
Authority
WO
WIPO (PCT)
Prior art keywords
virtual network
flow entry
forwarding device
controller
data packet
Prior art date
Application number
PCT/CN2018/082435
Other languages
English (en)
French (fr)
Inventor
郝卫国
徐新军
吴昊
张飞
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP18784557.3A priority Critical patent/EP3588876B1/en
Publication of WO2018188569A1 publication Critical patent/WO2018188569A1/zh
Priority to US16/598,506 priority patent/US11146488B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/06—Management of faults, events, alarms or notifications
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/64—Routing or path finding of packets in data switching networks using an overlay routing layer
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/74—Address processing for routing
    • H04L45/745—Address table lookup; Address filtering
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4633—Interconnection of networks using encapsulation techniques, e.g. tunneling
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4641—Virtual LANs, VLANs, e.g. virtual private networks [VPN]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/06—Management of faults, events, alarms or notifications
    • H04L41/0654—Management of faults, events, alarms or notifications using network fault recovery
    • H04L41/0668—Management of faults, events, alarms or notifications using network fault recovery by dynamic selection of recovery network elements, e.g. replacement by the most appropriate element after failure
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/06—Management of faults, events, alarms or notifications
    • H04L41/0695—Management of faults, events, alarms or notifications the faulty arrangement being the maintenance, administration or management system
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/14—Network analysis or design
    • H04L41/145—Network analysis or design involving simulating, designing, planning or modelling of a network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/28—Routing or path finding of packets in data switching networks using route fault recovery
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/38—Flow based routing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/54—Organization of routing tables
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/74—Address processing for routing
    • H04L45/745—Address table lookup; Address filtering
    • H04L45/7452—Multiple parallel or consecutive lookup operations
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L49/00—Packet switching elements
    • H04L49/25—Routing or path finding in a switch fabric
    • H04L49/252—Store and forward routing

Definitions

  • the embodiments of the present invention relate to the field of communications, and in particular, to a method, device, and system for forwarding data packets.
  • a Software Defined Networking (SDN) architecture based on the idea of controlling forwarding separation is a new type of network switching model. Its key components include controllers and forwarding devices (for example, OpenFlow switches). The controller and the forwarding device communicate with each other through the control channel protocol to complete the message interaction and the information transmission.
  • the commonly used control channel protocols may include: OpenFlow protocol, Path Computation Element (Path Computation Element) Communication Protocol (PCEP), Border Gateway Protocol (BGP), and Interface to the Routing System (I2RS).
  • the controller implements the management and control function through the entire network view, generates a forwarding flow table for the forwarding device, and the forwarding device forwards the data packet according to the flow table.
  • a flow table consists of several flow entries.
  • a flow entry consists of matching fields (English: match fields) and operation instructions (English: action instructions).
  • the controller usually uses the pull (English: PULL) mode and sends the flow entry to the corresponding forwarding device as needed. Specifically, after receiving the data packet from the other forwarding device, the forwarding device acquires a matching item of the data packet (the matching item indicates the target network device to which the data packet is sent), and searches for the stream by using the matching item. table. If no matching flow entry is found in the flow table, the data message is redirected to the controller.
  • the controller receives and parses the data packet, and obtains a matching entry of the data packet, and generates a corresponding flow entry for the matching item according to the network topology map of the entire network; and then sends the flow entry to the Forwarding the device and resending the data message to the forwarding device.
  • the forwarding device forwards the data packet to the target network device according to the flow entry.
  • the controller fails, after the forwarding device receives the data packet from the other forwarding device, if the matching flow entry cannot be found in the flow table, the data packet cannot be redirected. The controller that reached the fault. The faulty controller cannot generate a flow entry for the matching of the data packet. Therefore, the forwarding device cannot obtain the flow entry, and the data packet cannot be forwarded to the target network device, thereby causing the data flow. The interruption, the communication cannot be performed normally, and the reliability of the system is reduced.
  • the method, device, and system for forwarding a data packet provided by the embodiment of the present invention solve the problem that the forwarding device cannot forward the data packet normally after the controller fails in the virtual network under the control forwarding and separation architecture working in the Pull mode.
  • the problem of interrupting the data stream helps to improve the reliability of the system.
  • a first aspect of the embodiments of the present invention provides a method for forwarding a data packet, where the method is applied to a virtual network that controls forwarding and separation, and the virtual network includes a controller and a forwarding device.
  • the forwarding device receives a first default flow entry of the virtual network from the controller, and a first default flow entry of the virtual network indicates that the forwarding device is configured according to the If the matching item of the data packet in the virtual network searches for the first flow table and does not hit the flow entry, the data packet in the virtual network is sent to the designated forwarding device; the forwarding device receives the ES from the end system.
  • the first data packet in the virtual network is faulty, and the forwarding device searches the first flow table according to the matching item of the first data packet and does not hit the flow entry In the case, the forwarding device sends the first data packet to the specified forwarding device by using the first default flow entry of the virtual network.
  • the forwarding device may be caused by the forwarding device after the controller fails, and if the matching in the flow table matches the received packet, The default flow entry sends the data packet in the virtual network to the specified forwarding device, so that the forwarding device can forward the data packet normally in the above situation, which avoids the interruption of the data flow and improves the reliability of the system.
  • the forwarding device receives a second default flow entry of the virtual network from the controller, and the second default flow entry of the virtual network indicates that the forwarding device is configured according to If the matching item of the data packet in the virtual network searches for the first flow table and does not hit the flow entry, the data packet in the virtual network is sent to the controller; the virtual network The second default flow entry has a higher priority than the first default flow entry of the virtual network; the controller works normally, and the forwarding device is configured according to the first data packet. If the matching item searches for the first flow table and does not hit the flow entry, the forwarding device sends the first data to the controller by using a second default flow entry of the virtual network with a higher priority. Message.
  • the forwarding device can send the data packet to the controller, and the flow entry is sent in the pull mode to save the storage space of the forwarding device.
  • different matching policies may be adopted according to different states of the controller, such as normal operation, failure, and fault recovery, thereby improving system flexibility.
  • the forwarding device determines that the controller is faulty, setting a first default flow entry of the virtual network has a higher priority than a second default flow of the virtual network.
  • the priority of the entry so that the first data packet is preferentially sent to the designated forwarding device by using the first default flow entry of the virtual network without hitting the flow entry.
  • the second default flow entry of the virtual network is set to have a higher priority than the first default of the virtual network. The priority of the flow entry, so that the first data packet is sent to the controller by using the second default flow entry of the virtual network preferentially without hitting the flow entry.
  • the priority of the first default flow entry of the virtual network is adjusted to be higher than the second default flow entry of the virtual network, for example, the priority of the default flow entry is flexibly adjusted after the controller is pre-confirmed.
  • the first default flow entry with a higher priority is directly matched, and after receiving the packet, the state of the controller is confirmed, and then the default flow table used is determined. Item, which can improve the forwarding efficiency of the message.
  • the controller status is updated, for example, after the fault is rectified, the priority of the second default flow entry is adjusted to be higher than the priority of the first default flow entry, and the priority is directly matched.
  • the second default flow entry is used to improve the forwarding efficiency of the packet and further ensure the reliability and stability of the system.
  • the forwarding device determines that the controller is working normally, setting a first default flow entry of the virtual network has a higher priority than a second default of the virtual network.
  • the priority of the flow entry so that the first data packet is preferentially sent to the designated forwarding device by using the first default flow entry of the virtual network without hitting the flow entry.
  • the priority of the first default flow entry is higher than the priority of the second default flow entry, so that the priority of the first default flow entry is flexibly adjusted according to a design requirement or an application scenario.
  • the message can also be flexibly sent to the designated forwarding device without hit matching, which enhances the flexibility of the system's on-demand setting.
  • the setting the priority of the first default flow entry of the virtual network to be higher than the priority of the second default flow entry of the virtual network includes: the forwarding device modification
  • the priority of the first default flow entry of the virtual network is such that the priority of the first default flow entry of the virtual network is higher than the priority of the second default flow entry of the virtual network;
  • the forwarding device modifies the priority of the second default flow entry of the virtual network, so that the priority of the second default flow entry is lower than the first default flow entry of the virtual network. priority.
  • the first default flow entry By setting the priority of the first default flow entry of the virtual network or lowering the priority of the second default flow entry of the virtual network, a flexible and simple means for setting priorities is provided, which is convenient for After the controller is faulty, the first default flow entry can be selected to forward the data packet.
  • the forwarding device receives a second default flow entry of the virtual network from the controller, and the second default flow entry of the virtual network indicates that the forwarding device is configured according to
  • the matching item of the data packet in the virtual network searches for the second flow table and does not hit the flow entry
  • the data packet in the virtual network is sent to the controller; when the controller works normally,
  • the forwarding device searches for the second flow table according to the matching item of the first data packet and does not hit the flow entry, the forwarding device uses the second default flow entry of the virtual network. Sending the first data message to the controller.
  • the forwarding device can send the data packet to the controller, and the flow entry is sent in the pull mode to save the storage space of the forwarding device.
  • the forwarding device receives a third default flow entry of the virtual network from the controller, and a third default flow entry of the virtual network indicates that the forwarding device is configured according to If the matching item of the data packet in the virtual network searches for the third flow table and does not hit the flow entry, the data packet in the virtual network is sent according to the first flow table; If the fault occurs, and the forwarding device searches for the third flow table according to the matching item of the first data packet and does not hit the flow entry, the forwarding device is configured according to the third default of the virtual network.
  • the indication of the flow entry sends the first data packet according to the first flow table.
  • the third default flow entry may be used to jump to the first default flow entry of the virtual network to perform normal data packet. Forward to avoid interruption of data flow.
  • the forwarding device receives a fourth default flow entry of the virtual network from the controller, and a fourth default flow entry of the virtual network indicates that the forwarding device is configured according to If the matching item of the data packet in the virtual network searches for the third flow table and does not hit the flow entry, the data packet in the virtual network is sent according to the second flow table; The priority of the fourth default flow entry of the virtual network is greater than the priority of the third default flow entry of the virtual network; the controller works normally, and the forwarding device is configured according to the first datagram. If the matching entry of the text finds the third flow table and does not hit the flow entry, the forwarding device is configured according to the second flow according to the indication of the fourth default flow entry of the virtual network with a higher priority. The table sends the first data packet.
  • the entry provides an easy way to extend the flow table and improve the maintainability of the system.
  • the priority of the fourth default flow entry is higher than the priority of the third default flow entry, so that the forwarding device works normally in the controller but matches the received packet in the flow table. If there is no hit in the match, the packet may be further sent to the controller according to the priority of the corresponding flow entry to further send the packet to the controller. Save storage space for forwarding devices.
  • different matching strategies may be adopted according to different states of the controller, such as normal operation, failure, and fault recovery, thereby improving system flexibility.
  • the forwarding device determines that the controller is faulty, setting a third default flow entry of the virtual network has a higher priority than a fourth default flow of the virtual network.
  • the priority of the entry so that the first data packet is sent according to the first flow table according to the indication of the third default flow entry of the virtual network, if the flow entry is not hit.
  • a fourth default flow entry of the virtual network has a higher priority than a third default of the virtual network. The priority of the flow entry, so that the first data packet is sent according to the second flow table according to the indication of the fourth default flow entry of the virtual network, if the flow entry is not hit.
  • Presetting the third default flow entry of the virtual network with a higher priority than the fourth default flow entry of the virtual network for example, flexibly adjusting the default flow table after confirming the controller failure in advance Priority of the item, so that after receiving the message, the third default flow entry with a higher priority can be directly matched, instead of waiting for the message to be received, confirming the state of the controller, and then determining the used
  • the default flow entry can improve the forwarding efficiency of packets.
  • the priority of the fourth default flow entry is adjusted to be higher than the priority of the third default flow entry, so that packet forwarding can be improved. Efficiency and further guarantee the reliability and stability of the system.
  • a third default flow entry of the virtual network has a higher priority than a fourth default of the virtual network.
  • the priority of the flow entry so that the first data packet is sent according to the first flow table according to the indication of the third default flow entry of the virtual network, if the flow entry is not hit.
  • the priority of the third default flow entry is higher than the priority of the fourth default flow entry, so that the packet is adjusted according to the design requirement or the application scenario.
  • the packet In the case that there is no hit match, it can also be flexibly sent to the designated forwarding device according to the first default flow entry, which enhances the flexibility of the system's on-demand setting.
  • the setting the priority of the third default flow entry of the virtual network to be higher than the priority of the fourth default flow entry of the virtual network includes: the forwarding device modification
  • the priority of the third default flow entry of the virtual network is such that the priority of the third default flow entry of the virtual network is higher than the priority of the fourth default flow entry of the virtual network;
  • the forwarding device modifies the priority of the fourth default flow entry of the virtual network, so that the priority of the fourth default flow entry is lower than the third default flow entry of the virtual network. priority.
  • the third default flow entry can be selected, so that the first default flow entry of the virtual network can be forwarded to forward the data packet, so as to ensure that the data flow is not interrupted.
  • the first default flow entry of the virtual network is a flow entry that directs Layer 3 forwarding in a Layer 3 virtual network; and the data packet in the virtual network is specified to be specified.
  • the forwarding device sends the data packet in the Layer 3 virtual network to the forwarding device that stores all or part of the routing information in the Layer 3 virtual network.
  • the action of setting the first default flow entry of the three-layer virtual network is sent to a forwarding device that stores all or part of the routing information in the three-layer virtual network, and provides a three-layer virtual network. After the controller fails, the data packet forwarding is not interrupted, which improves the reliability of the three-layer virtual network forwarding.
  • the first default flow entry of the virtual network is a flow entry that directs Layer 2 forwarding in the Layer 2 virtual network; and the data packet in the virtual network is specified.
  • the forwarding device sends the data packet in the Layer 2 virtual network to the forwarding device in the Layer 2 virtual network.
  • the action of setting the first default flow entry of the Layer 2 virtual network is to broadcast to the forwarding device in the Layer 2 virtual network, and providing a fault in the controller in the Layer 2 virtual network, so that The method of forwarding data packets without interruption improves the reliability of Layer 2 virtual network forwarding.
  • a second aspect of the embodiments of the present invention provides a method for sending a flow entry, which is applied to a virtual network that controls forwarding and separation.
  • the virtual network includes a controller and a forwarding device.
  • the controller generates a first default flow entry of the virtual network, where a first default flow entry of the virtual network indicates that the forwarding device fails in the controller and If the forwarding device searches for the flow table according to the matching item of the data packet in the virtual network and does not hit the flow entry, the data packet in the virtual network is sent to the designated forwarding device, or the And the forwarding device, when the controller works normally, and the forwarding device searches the flow table according to the matching item of the data packet in the virtual network, and does not hit the flow entry, the data packet in the virtual network is used.
  • the controller sends to the designated forwarding device; the controller generates a second default flow entry of the virtual network, where the second default flow entry of the virtual network indicates that the forwarding device works normally in the controller and If the forwarding device searches for the flow table according to the matching item of the data packet in the virtual network and does not hit the flow entry, the data packet in the virtual network is sent to the control ; Said second default forwarding controller apparatus transmits stream entry of the virtual network and the first entry the default flow to the virtual network.
  • the device can forward the data packet normally, and the data stream is interrupted and improved. The reliability of the system.
  • the first default flow entry of the virtual network is an entry in the first flow table, where the indication that the forwarding device fails in the controller and the forwarding device is in the virtual network according to the The matching of the data packet searches for the flow table and does not hit the flow entry, specifically searching for the first flow table and not hitting the flow entry;
  • the second default flow entry of the virtual network is the first flow An entry in the table, the indication that the forwarding device works normally in the controller, and the forwarding device searches the flow table according to a match of the data packet in the virtual network, and does not hit the flow entry, specifically searching for the The first flow table does not hit the flow entry.
  • the first default flow entry of the virtual network is an entry in the first flow table, where the indication that the forwarding device fails in the controller and the forwarding device is in the virtual network according to the The matching of the data packet searches for the flow table and does not hit the flow entry, specifically searching for the first flow table and not hitting the flow entry;
  • the second default flow entry of the virtual network is the second flow table In the entry, the indicating that the forwarding device works normally in the controller, and the forwarding device searches the flow table according to the matching item of the data packet in the virtual network, and does not hit the flow entry, specifically searching for the first The flow table does not hit the flow table entry.
  • the forwarding device can forward data packets normally, which avoids interruption of data flow and improves system reliability.
  • the controller generates a third default flow entry of the virtual network, where a third default flow entry of the virtual network indicates that the forwarding device fails in the controller and If the forwarding device searches for the third flow table according to the matching item of the data packet in the virtual network and does not hit the flow entry, the data packet in the virtual network is sent according to the first flow table; The controller sends a third default flow entry of the virtual network to the forwarding device.
  • the forwarding device may forward the data to the first default flow entry of the virtual network according to the third default flow entry. Forward to avoid interruption of data flow.
  • the controller generates a fourth default flow entry of the virtual network, where a fourth default flow entry of the virtual network indicates that the forwarding device works normally in the controller and If the forwarding device searches for the third flow table according to the matching item of the data packet in the virtual network and does not hit the flow entry, the data packet in the virtual network is used according to the second flow table. Sending; the controller sends a fourth default flow entry of the virtual network to the forwarding device.
  • a fourth default flow table of the virtual network in the same flow table as the third default flow entry of the virtual network in the same flow table as the first and second default flow entries Item provides an easy way to extend the flow table and improve the maintainability of the system.
  • different matching strategies can be adopted according to different states of the controller, such as normal operation, failure, and fault recovery, thereby improving system flexibility.
  • the first default flow entry of the virtual network is a flow entry that directs Layer 3 forwarding in a Layer 3 virtual network; and the data packet in the virtual network is specified to be specified.
  • the forwarding device sends the data packet in the Layer 3 virtual network to the forwarding device that stores all or part of the routing information in the Layer 3 virtual network.
  • the action of setting the first default flow entry of the three-layer virtual network is sent to a forwarding device that stores all or part of the routing information in the three-layer virtual network, and provides a three-layer virtual network. After the controller fails, the data packet forwarding is not interrupted, which improves the reliability of the three-layer virtual network forwarding.
  • the first default flow entry of the virtual network is an entry that directs Layer 2 forwarding in the Layer 2 virtual network; and the data packet in the virtual network is specified to The forwarding device sends the data packet in the Layer 2 virtual network to the forwarding device in the Layer 2 virtual network.
  • the action of setting the first default flow entry of the Layer 2 virtual network is to broadcast to the forwarding device in the Layer 2 virtual network, and providing a fault in the controller in the Layer 2 virtual network, so that The method of forwarding data packets without interruption improves the reliability of Layer 2 virtual network forwarding.
  • the present invention provides a forwarding device for performing the method of the first aspect or any possible implementation of the first aspect.
  • the forwarding device comprises means for performing the method of the first aspect or any possible implementation of the first aspect.
  • the present invention provides a forwarding device including: a processor, a transceiver, a random access memory, a read only memory, and a bus.
  • the processor is respectively coupled to the transmitter, the random access memory, and the read only memory through a bus.
  • the booting device is booted by the basic input/output system or the bootloader booting system in the embedded system, and the booting device is put into a normal running state.
  • the application and operating system are run in a random access memory such that the processor performs the method of the first aspect or any possible implementation of the first aspect.
  • a fifth aspect provides a forwarding device, where the forwarding device includes: a main control board and an interface board, and further includes a switching network board.
  • the forwarding device is operative to perform the method of any of the possible implementations of the second aspect or the second aspect.
  • the forwarding device comprises means for performing the method of the first aspect or any possible implementation of the first aspect.
  • the invention provides a computer readable medium for storing a computer program comprising instructions for performing the method of the first aspect or any of the possible implementations of the first aspect.
  • the present invention provides a controller for performing the method of any of the possible implementations of the second aspect or the second aspect.
  • the controller comprises means for performing the method of any of the second aspect or any of the possible implementations of the second aspect.
  • the present invention provides a controller including: a processor, a transceiver, a random access memory, a read only memory, and a bus.
  • the processor is respectively coupled to the transmitter, the random access memory, and the read only memory through a bus.
  • the controller needs to be run, the booting is started by the booting system in the basic input/output system or the embedded system in the read-only memory, and the controller is put into a normal running state. After the controller enters a normal operating state, the application and operating system are run in a random access memory such that the processor performs the method of any of the second aspect or any of the possible implementations of the second aspect.
  • the invention provides a computer readable medium for storing a computer program comprising instructions for performing the method of any of the second aspect or any of the possible implementations of the second aspect.
  • a system comprising the forwarding device of any of the third to sixth aspects, and the controller of any of the seventh to ninth aspects.
  • FIG. 1 is a schematic diagram of a network according to an embodiment of the present invention.
  • FIG. 2 is a schematic diagram of a process flow of a method for forwarding a data packet according to an embodiment of the present invention
  • FIG. 3 is a schematic diagram of another process flow of a method for forwarding a data packet according to an embodiment of the present invention
  • FIG. 3b is a schematic diagram showing a flow of a method for forwarding a data packet according to another embodiment of the present invention.
  • FIG. 4 is a schematic diagram of a flow table jump relationship in an embodiment of the present invention.
  • FIG. 5 is a schematic structural diagram of a forwarding device according to an embodiment of the present invention.
  • FIG. 5b is a schematic structural diagram of another forwarding device according to an embodiment of the present invention.
  • FIG. 5c is a schematic structural diagram of still another forwarding device according to an embodiment of the present invention.
  • 6a is a schematic structural diagram of a controller in an embodiment of the present invention.
  • 6b is a schematic structural diagram of another controller in the embodiment of the present invention.
  • FIG. 7 is a schematic diagram of a network system in an embodiment of the present invention.
  • the network architecture and the service scenario described in the embodiments of the present invention are used to more clearly illustrate the technical solutions of the embodiments of the present invention, and do not constitute a limitation of the technical solutions provided by the embodiments of the present invention.
  • the technical solutions provided by the embodiments of the present invention are equally applicable to similar technical problems.
  • the data center (English: Data Center, DC) network in the era of cloud computing evolves toward the software-defined network (English: Software Defined Network, SDN) architecture and network virtualization.
  • SDN Software Defined Network
  • the controller centrally controls the forwarding devices in the DC network, and usually uses overlay (English: Overlay) network technology to implement DC network virtualization.
  • An Overlay network is a virtual network above a physical network.
  • the DC network based on the SDN architecture uses a centralized controller to control the forwarding device.
  • the types of terminals accessing the data center network include but are not limited to virtual machines (virtual machines, VMs), physical hosts, and physics. Servers, etc. These terminals are collectively referred to as end systems (English: end system, ES).
  • the forwarding device can be a physical switch, a physical router, or a virtual switch (virtual switch, vSwitch) or virtual router (vRouter) embedded in a physical server and based on software virtualization technology.
  • a virtual switch virtual switch
  • vRouter virtual router
  • ES1 and ES2 are connected to the DC network through the forwarding device 1
  • ES3 and ES4 are connected to the DC network through the forwarding device 2
  • the ES5 and the ES6 access the DC network through the forwarding device 3.
  • ES1 to ES6 access the wide area network (WAN) through a centralized forwarding device.
  • the WAN is also called the external network or the public network.
  • the centralized forwarding device is a border forwarding device (or gateway device) that connects the DC network to the WAN. Capacity and forwarding performance are higher than access forwarding devices (such as forwarding devices 1, 2, and 3).
  • NVo3 is an Overlay network technology on a Layer 3 network. It is based on Internet Protocol (IP)/Multi-Protocol Label Switching (MPLS) as a transport network. The way to build a large-scale, two-tier tenant network.
  • IP Internet Protocol
  • MPLS Multi-Protocol Label Switching
  • the NVO3 includes a variety of tunnel encapsulation implementation technologies. For example, a virtual eXtensible Local Area Network (VXLAN) and a Network Virtualization over Generic Routing Encapsulation (NVGRE) are commonly used.
  • NVo3 technology can virtualize multiple Overlay virtual networks on the physical network of the data center.
  • Each virtual network is a virtual network instance (English: Virtual Network Instance, VNI).
  • the edge nodes of the virtual network are Network Virtualization Edge (NVE) nodes, such as the forwarding devices 1, 2, 3, and the centralized forwarding device shown in FIG.
  • NVE Network Virtualization Edge
  • An NGW node creates an Overlay tunnel (such as a VxLAN tunnel or an NVGRE tunnel) connection for the corresponding Overlay virtual network.
  • the original data packet accessing the virtual network is tunnel encapsulated on the NVE node.
  • the encapsulation identifier is configured to learn the encapsulated forwarding device (NVE). After the encapsulated data packet is sent to the destination ES, the decapsulated forwarding device decapsulates the encapsulated data packet to obtain the original datagram. Text.
  • the forwarding device in the middle of the tunnel forwards the encapsulated data packet based on the encapsulated outer packet header, and does not care about the original data frame carried internally.
  • the virtual network identifier VNID
  • VNID virtual network identifier
  • the original data packet in the overlay header can be an Ethernet frame with a Media Access Control (MAC) address (that is, data forwarded in the Layer 2 virtual network).
  • MAC Media Access Control
  • Packet or just an IP packet (that is, a data packet forwarded within a Layer 3 virtual network).
  • Layer 2 Ethernet frames and Layer 3 IP packets are collectively referred to as data packets in this application.
  • the virtual network includes a Layer 3 virtual network and a Layer 2 virtual network.
  • Each Layer 3 virtual network may include one or more Layer 2 virtual networks.
  • the ESs in each Layer 2 virtual network pass the Layer 2 flow table (for example, the flow).
  • the matching of the table includes the MAC address to communicate with each other (for example, searching and forwarding according to the Layer 2 VNID and the destination MAC address), and each Layer 2 virtual network generally corresponds to one subnet (English: subnet), and each Layer 3 virtual network
  • the intra-span sub-networks perform Layer 3 communication through a Layer 3 flow table (for example, the matching of the flow table includes an IP address) (for example, searching and forwarding according to the Layer 3 VNID and the destination IP address).
  • the ES MAC addresses in different Layer 2 virtual networks can overlap, and the ES IP addresses in different Layer 3 virtual networks can overlap.
  • the Layer 2 or Layer 3 flow table is located on the edge forwarding device of the network.
  • the forwarding device in the middle of the network is forwarded only based on the destination IP address of the outer tunnel after encapsulation. There is no corresponding forwarding flow table.
  • ES1, ES2, ES3, ES4, ES5, and ES6 belong to the same Layer 3 virtual network.
  • ES1, ES3, and ES5 belong to Layer 2 virtual network A
  • ES2, ES4, and ES6 belong to Layer 2 virtual network B.
  • the controller has a topology diagram of the entire network (including a physical network, a Layer 2 virtual network, a Layer 3 virtual network, and the like), and the Layer 2 or Layer 3 forwarding flow table on the forwarding device is calculated and generated by the controller according to the topology map. And unified delivery through the control channel protocol.
  • the controller may send the second or third layer flow table to the forwarding device in the Push and Pull modes.
  • the controller sends all flow tables to all forwarding devices regardless of whether the forwarding device requires the flow table.
  • the controller sends a Layer 2 or Layer 3 flow entry in each virtual network to all forwarding devices associated with the virtual network.
  • forwarding devices 1, 2, and 3 are connected to Layer 3 virtual networks A and II respectively.
  • the controller will send all the Layer 3 flow entries of the Layer 3 virtual network A, the Layer 2 virtual network B, and all the Layer 2 flow entries in the C to the forwarding devices 1, 2 and 3.
  • the push mode a large number of Layer 2 or Layer 3 flow entries are required on the forwarding device.
  • the flow table space requirements of the forwarding device are very high, and the load on the control channel is also increased. Therefore, many controllers use the Pull mode to deliver the flow entry. .
  • the controller sends the flow entry to the corresponding forwarding device as needed. If the ingress forwarding device (such as the forwarding device 1 in Figure 1) receives the data packet from the access side (see Figure 1, ES1), if it does not reach the flow entry of the destination ES (such as ES3 or ES4), The packet will hit the default flow entry and redirect the packet to the controller through the default flow entry.
  • the controller parses the data packet, and obtains the associated egress forwarding device according to the destination MAC address of the data packet (such as the MAC address of the ES3) or the IP address (as shown in Figure 1, the IP address of the ES4).
  • the device forwards the information, sending the corresponding second or third layer flow entry to the ingress forwarding device, and then resending the data packet to the ingress forwarding device, the ingress forwarding device according to the new flow table
  • the item forwards the message to the egress forwarding device, and the egress forwarding device sends the data packet to the destination ES.
  • the second or third-layer flow entry on the ingress forwarding device is periodically aged out. After the aging, the ingress forwarding device deletes the flow entry, so that the subsequent received message repeats the above process, that is, the uplink control.
  • the device sends a flow entry and forwards the packet to the forwarding device.
  • the ingress forwarding device does not receive the flow entry corresponding to the destination ES after receiving the data packet.
  • the data packet cannot be redirected to the faulty controller.
  • the faulty controller cannot generate a flow entry for the data packet. Therefore, the ingress forwarding device cannot obtain the flow entry, and the data packet cannot be forwarded to the destination ES.
  • the forwarding process is interrupted. There is no normal two or three layer communication between them.
  • FIG. 2 is a schematic flowchart of a method for forwarding a data packet according to an embodiment of the present invention. The method may be applied to the application scenario shown in FIG. 1 .
  • the solution provided by the embodiment of the present invention includes a 22-01 part, a 22-02 part, a 21-01 part, a 21-02 part, and a 21-03 part, wherein the 22-01 part and the 22-02 part are executed on the controller, 21 Parts -01, 21-02, and 21-03 are executed on the forwarding device, as explained below.
  • the controller In the section 22-01, the controller generates a first default flow entry of the virtual network, where the first default flow entry of the virtual network indicates that the forwarding device is configured according to data packets in the virtual network. If the matching item searches for the first flow table and does not hit the flow entry, the data packet in the virtual network is sent to the designated forwarding device. When the controller fails, the first default flow entry of the virtual network is used by the forwarding device to forward data packets in the virtual network.
  • the first default flow entry of the virtual network may also be used by the forwarding device to forward data packets in the virtual network.
  • the controller sends a first default flow entry of the virtual network to the forwarding device.
  • the controller generates and delivers the first default flow entry of the virtual network, so that after the controller is faulty, the forwarding device can forward the data packet normally, thereby avoiding interruption of the data flow and improving system reliability.
  • the controller further generates and sends a second default flow entry of the virtual network to the forwarding device, where a second default flow entry of the virtual network indicates that the forwarding device is configured according to the If the matching of the data packet in the virtual network finds the flow table and does not hit the flow entry, the data packet in the virtual network is sent to the controller.
  • the second default flow entry of the virtual network is used by the forwarding device if the controller works normally (including normal operation after the controller is started for the first time and the controller fails to recover) Forwarding data packets in the virtual network.
  • the second default flow entry of the virtual network may be an entry in the first flow table (that is, the forwarding device searches the flow table according to the matching of the data packet in the virtual network and does not hit the flow.
  • the entry is specifically for searching the first flow table, and may also be an entry in the second flow table (that is, the forwarding device searches the flow table according to the matching of the data packet in the virtual network and does not hit the flow.
  • the entry is specifically for finding the second flow table).
  • the first default flow entry of the virtual network is an entry in the first flow table
  • the first default flow entry of the virtual network and the second default flow table of the virtual network An item is two different flow entries in the same flow table. According to the normal or faulty state of the controller, the two default flow entries are selected to forward data packets. In this case, the specific method of using the default entry can be found in the section of Figure 3a below.
  • the priority of the first default flow entry is set to be greater than the priority of the second default flow entry, and the entry is not hit in the lookup table.
  • the first default flow entry of the virtual network may be preferentially selected, and the data packet is sent to the designated forwarding device.
  • the priority of the first default flow entry may be set and adjusted according to the specific needs of the user, and the priority of the second default flow entry is greater than the priority of the second default flow entry. If there is no hit entry, the first default flow entry of the virtual network may be preferentially selected, and the data packet is sent to the designated forwarding device.
  • the priority of the second default flow entry is greater than the priority of the first default flow entry when the controller is started for the first time or after the fault is restored for a period of time.
  • the second default flow entry of the virtual network may be preferentially selected, and the data packet is sent to the controller.
  • the forwarding device can send the data packet to the controller, and the flow entry is sent in the pull mode to save the storage space of the forwarding device.
  • different matching policies can be adopted according to different states of the controller, such as normal working, fault, and fault recovery, thereby improving system flexibility.
  • the second default flow entry of the virtual network is an entry in the second flow table
  • the first default flow entry of the virtual network and the second default flow of the virtual network The entry is a flow entry in two different flow tables.
  • the forwarding device can send the data packet to the controller, and the flow entry is sent in the pull mode to save the storage space of the forwarding device.
  • the controller further generates and sends a third default flow entry of the virtual network to the forwarding device, where a third default flow entry of the virtual network indicates the forwarding device And if the third flow table is searched according to the matching item of the data packet in the virtual network, and the flow entry is not hit, the data packet in the virtual network is sent according to the first flow table.
  • the controller is faulty, the third default flow entry of the virtual network is used by the forwarding device to forward data packets in the virtual network.
  • the forwarding device may forward the data to the first default flow entry of the virtual network according to the third default flow entry. Forward to avoid interruption of data flow.
  • the controller further generates and sends a fourth default flow entry of the virtual network to the forwarding device, where a fourth default flow entry of the virtual network indicates that the forwarding device is configured according to If the data item in the virtual network searches for the third flow table and does not hit the flow entry, the data packet in the virtual network is sent according to the second flow table.
  • the fourth default flow entry of the virtual network is used by the forwarding device to forward data packets in the virtual network.
  • the four default flow entries are respectively controlled according to the normal or faulty state of the controller and the needs of the user, by setting the priorities of the third and fourth default flow entries flexibly. Selected to forward data packets. For example, when the controller is faulty, the priority of the third default flow entry is set to be greater than the priority of the fourth default flow entry, and the table does not have a hit entry. The third and a default flow entry may be preferentially sent to send the data packet to the designated forwarding device. When the controller is working normally, the priority of the third default flow entry may be set and adjusted according to the specific needs of the user, and the priority of the third default flow entry is greater than the priority of the fourth default flow entry.
  • the third and a default flow entry may be preferentially sent to send the data packet to the designated forwarding device.
  • the priority of the fourth default flow entry is greater than the priority of the third default flow entry when the controller is started for the first time or after the fault is restored for a period of time. If the table entry does not have a hit entry, the fourth and second default flow entries may be preferentially selected, and the data packet is sent to the controller. In this case, the specific method of using the default entry can be found in the section of Figure 3b below.
  • An implementation manner of facilitating maintenance and extending the flow table is provided by setting a fourth default flow entry of the virtual network in the same flow table as the third default flow entry of the virtual network.
  • the first default flow entry of the virtual network is an entry that directs Layer 3 forwarding in the Layer 3 virtual network. Transmitting the data packet in the virtual network to the designated forwarding device, specifically, forwarding the data packet in the Layer 3 virtual network to all or part of the routing information in the Layer 3 virtual network.
  • the forwarding device sends.
  • the second or third and fourth default flow entries of the virtual network are also entries that guide the three-layer forwarding in the three-layer virtual network.
  • the action of setting the first default flow entry of the three-layer virtual network is sent to a forwarding device that stores all or part of the routing information in the three-layer virtual network, and provides a three-layer virtual network. After the controller fails, the data packet forwarding is not interrupted, which improves the reliability of the three-layer virtual network forwarding.
  • the first default flow entry of the virtual network is an entry that directs Layer 2 forwarding in the Layer 2 virtual network.
  • the transmitting the data packet in the virtual network to the designated forwarding device is specifically to broadcast the data packet in the Layer 2 virtual network to the forwarding device in the Layer 2 virtual network.
  • the second or third and fourth default flow entries of the virtual network are also entries that guide Layer 2 forwarding in the Layer 2 virtual network.
  • the action of setting the first default flow entry of the Layer 2 virtual network is to broadcast to the forwarding device in the Layer 2 virtual network, and providing a fault in the controller in the Layer 2 virtual network, so that The method of forwarding data packets without interruption improves the reliability of Layer 2 virtual network forwarding.
  • the forwarding device receives a first default flow entry of the virtual network from the controller, and saves the flow entry to the first flow table.
  • the forwarding device further receives a second default flow entry of the virtual network from the controller, where the second default flow entry of the virtual network may be saved in the first flow table, It is an entry in the first flow table, and may also be saved in the second flow table, which is an entry in the second flow table.
  • the definition and description of the second default flow entry of the virtual network are consistent with the descriptions of the controller side 22-01 and 22-02 described above, and are not described herein again.
  • the second default flow entry of the virtual network and the first default flow entry of the virtual network are all entries in the first flow table
  • the second default flow table of the virtual network The priority of the item is higher than the priority of the first default flow entry of the virtual network.
  • the specific method of using the default entry can be found in the section of Figure 3a below.
  • the forwarding device can send the data packet to the controller, and the flow entry is sent in the pull mode to save the storage space of the forwarding device.
  • different matching strategies may be adopted according to different states of the controller, such as normal operation, failure, and fault recovery, thereby improving system flexibility (details) See paragraph 1 of section 21-03 below).
  • the forwarding device further receives from the controller.
  • the third and fourth default flow entries of the virtual network are saved to the third flow table of the third and fourth default flow entries of the virtual network.
  • the priority of the fourth default flow entry of the virtual network is greater than the priority of the third default flow entry of the virtual network.
  • the definitions and descriptions of the third and fourth default flow entries of the virtual network are consistent with the descriptions of the controller side 22-01 and 22-02 described above, and are not described herein again. In this case, the specific method of using the default entry can be found in the section of Figure 3b below.
  • the entry provides an easy way to extend the flow table and improve the maintainability of the system.
  • the priority of the fourth default flow entry is higher than the priority of the third default flow entry, so that the forwarding device works normally in the controller but matches the received packet in the flow table. If there is no hit in the match, the packet may be further sent to the controller according to the priority of the corresponding flow entry to further send the packet to the controller. Save storage space for forwarding devices.
  • different matching strategies may be adopted according to different states of the controller, such as normal operation, failure, and fault recovery, thereby improving system flexibility ( See section 2 of 21-03 below for details).
  • the forwarding device receives a first data message from the end network ES of the virtual network.
  • the forwarding device in a case where the controller fails, and the forwarding device searches for the first flow table according to a match of the first data packet and does not hit a flow entry, the forwarding device And transmitting, by using the first default flow entry of the virtual network, the first data packet to the designated forwarding device.
  • the forwarding device when the forwarding device detects that the controller is faulty (for example, the protocol is interrupted by a protocol such as OpenFlow) and the protocol connection between the controllers is interrupted, the forwarding device may set the default flow.
  • the priority of the entry is used to preferentially select the first default flow entry to forward data packets. Specifically, it is described in the following two ways.
  • the forwarding device determines the In the case of a controller failure, the priority of the first default flow entry of the virtual network is set to be higher than the priority of the second default flow entry of the virtual network, so that the virtual network is preferentially used.
  • the first default flow entry sends the first data packet to the designated forwarding device.
  • the second default flow entry of the virtual network may be flexibly set to have a higher priority than the first default flow of the virtual network. The priority of the entry, so that the first data packet is sent to the controller by using the second default flow entry of the virtual network preferentially without hitting the flow entry.
  • the specific method of using the default entry can be found in the section of Figure 3a below.
  • the priority of the first default flow entry of the virtual network is adjusted to be higher than the second default flow entry of the virtual network, for example, the priority of the default flow entry is flexibly adjusted after the controller is pre-confirmed.
  • the first default flow entry with a higher priority is directly matched, and after receiving the packet, the state of the controller is confirmed, and then the default flow table used is determined. Item, which can improve the forwarding efficiency of the message.
  • the controller status is updated, for example, after the fault is rectified, the priority of the second default flow entry is adjusted to be higher than the priority of the first default flow entry, and the priority is directly matched.
  • the second default flow entry is used to improve the forwarding efficiency of the packet and further ensure the reliability and stability of the system. It can be understood that, in terms of knowing the real-time status of the controller, the status of the controller can be queried after receiving the packet, and after the controller is confirmed to be faulty, the first default flow entry is used as the packet forwarding. Basis.
  • the first default flow entry of the virtual network may be preferentially set to be higher than the priority according to the design requirement or the application scenario. Determining the priority of the second default flow entry of the virtual network, so that the first default flow entry of the virtual network is preferentially sent to the designated forwarding device without hitting the flow entry A data message that enhances the flexibility of the system's on-demand setup.
  • the forwarding device modifies a priority of the first default flow entry of the virtual network, so that a priority of the first default flow entry of the virtual network is higher than a second of the virtual network The priority of the default flow entry.
  • the forwarding device modifies the priority of the second default flow entry of the virtual network, so that the priority of the second default flow entry is lower than the first default flow entry of the virtual network. priority.
  • the first default flow entry By setting the priority of the first default flow entry of the virtual network or lowering the priority of the second default flow entry of the virtual network, a flexible and simple means for setting priorities is provided, which is convenient for After the controller is faulty, the first default flow entry can be selected to forward the data packet.
  • Manner 2 When the first default flow entry of the virtual network and the second default flow entry of the virtual network are flow entries in two different flow tables, respectively, the forwarding device determines The priority of the third default flow entry of the virtual network is set to be higher than the priority of the fourth default flow entry of the virtual network, so that the priority is used preferentially.
  • the third default flow entry of the virtual network sends the first data packet to the first flow table.
  • the fourth default flow entry of the virtual network may be flexibly set to have a higher priority than the third default flow of the virtual network.
  • Presetting the third default flow entry of the virtual network with a higher priority than the fourth default flow entry of the virtual network for example, flexibly adjusting the default flow table after confirming the controller failure in advance Priority of the item, so that after receiving the message, the third default flow entry with a higher priority can be directly matched, instead of waiting for the message to be received, confirming the state of the controller, and then determining the used
  • the default flow entry can improve the forwarding efficiency of packets.
  • the priority of the fourth default flow entry is adjusted to be higher than the priority of the third default flow entry, so that packet forwarding can be improved. Efficiency and further guarantee the reliability and stability of the system. It can be understood that, in terms of knowing the real-time status of the controller, the status of the controller can be queried after receiving the packet, and after the controller is confirmed to be faulty, the third default flow entry is used as the packet. The basis for forwarding.
  • the third default flow entry of the virtual network may be flexibly set to have a higher priority than the virtual network according to a design requirement or an application scenario. a priority of the fourth default flow entry, so that the first datagram is sent according to the first flow table according to the indication of the third default flow entry of the virtual network, if the flow entry is not hit. This enhances the flexibility of the system's on-demand setup.
  • the forwarding device modifies a priority of the third default flow entry of the virtual network, so that a priority of the third default flow entry of the virtual network is higher than a fourth of the virtual network.
  • the priority of the default flow entry or modifies the priority of the fourth default flow entry of the virtual network, so that the priority of the fourth default flow entry is lower than the third default flow entry of the virtual network. priority.
  • the third default flow entry can be selected, so that the first default flow entry of the virtual network can be forwarded to forward the data packet, so as to ensure that the data flow is not interrupted.
  • the first default flow entry of the virtual network is an entry that directs Layer 3 forwarding in the Layer 3 virtual network or an entry that directs Layer 2 forwarding in the Layer 2 virtual network.
  • the detailed description is consistent with the description of the controller side 22-01 and 22-02 described above, and details are not described herein again.
  • FIG. 3a is a schematic diagram of an interaction flow of a method in which a default flow entry is a method in the same flow table (is an example refinement of a relevant part of the method embodiment of FIG. 2).
  • the method embodiment of the present invention will be described below with reference to the scenario of FIG.
  • the controller creates a second and/or three-layer virtual network for the connected ES on the forwarding devices 1, 2, and 3.
  • the ES1, ES2, ES3, ES4, ES5, and ES6 belong to the same Layer 3 virtual network.
  • the MAC address of ES1 is MAC1, for example, E4:68:a3:fc:18:01, and the IP address of ES1 is IP1, for example, 10.10.10.1/24.
  • the MAC addresses and IP addresses of other ESs are shown in Figure 1, and are not described here.
  • the forwarding device 1 is connected to the ES1 belonging to the Layer 2 virtual network B, and the ES2 belonging to the Layer 2 virtual network C, belonging to the ES 1 and ES 2 of the Layer 3 virtual network A.
  • the interaction process between the controller and the forwarding device 1 is described below by taking the forwarding device 1 as an example in the Layer 2 virtual network B and the Layer 3 virtual network A.
  • the forwarding device 1 generating, by the forwarding device 1, a first default flow entry of the second or third virtual network, where the first default flow entry of the second or third virtual network indicates that the forwarding device 1 is according to the second Or, when the matching of the data packet in the Layer 3 virtual network searches for the first flow table and does not hit the flow entry, the data packet in the second or third virtual network is sent to the designated forwarding device.
  • the first default flow entry of the Layer 2 virtual network B of the device 1 is forwarded (for example, Table 1)
  • the indication device 1 indicates that the forwarding device 1 searches the first flow table according to the matching item of the data packet in the Layer 2 virtual network B, and does not hit the flow entry, and then forwards the data packet in the second layer virtual network B to the second
  • the forwarding device in the layer virtual network B broadcasts, that is, transmits to the forwarding device 2 connected to the ES3 and the forwarding device 3 connected to the ES5.
  • the first default flow of the three-layer virtual network A of the forwarding device 1 The entry (for example, as shown in Table 2) indicates that the forwarding device 1 searches for the first flow table according to the matching item of the data packet in the three-layer virtual network A and does not hit the flow entry, and the three-layer virtual network A is The data packet is sent to a forwarding device that stores all or part of the routing information in the Layer 3 virtual network, that is, to the centralized forwarding device.
  • a centralized forwarding device and other forwarding devices 1, 2, and 3 run an Ethernet virtual private network (EVPN)-based BGP routing protocol, so that the centralized forwarding device can obtain routing and forwarding of the entire Layer 3 network. information.
  • EVPN Ethernet virtual private network
  • the forwarding devices 1, 2, and/or 3 are virtual forwarding devices, only the forwarding function, the function of the control plane, and the function of the control plane are performed by independent controllers, the BGP routing protocol is run between the centralized forwarding device and the controller. To collect routing forwarding information of the forwarding devices 1, 2, and/or 3.
  • the first default flow entry of the virtual network may also be understood as a flow entry whose matching item is a VNID, or a flow entry whose matching is a VNID and a wildcard.
  • VNID and other matching items such as IP address/MAC address
  • the flow entry can be defined as the default flow entry in the virtual network identified by the VNID.
  • the default flow table of the virtual network is selected. Items are forwarded.
  • 3a2-02 Send a first default flow entry of the second or third layer virtual network.
  • the controller sends the first default flow entry of the Layer 2 virtual network B of the forwarding device 1 generated in the above step 3a2-01 to the forwarding device 1.
  • the controller sends the first default flow entry of the Layer 3 virtual network A of the forwarding device 1 generated in the above step 3a2-01 to the forwarding device 1.
  • the controller generates, for the forwarding device 1, a second default flow entry of the second or third virtual network, where the second default flow entry of the second or third virtual network indicates that the forwarding device is configured according to the A data packet in the two or three-layer virtual network is sent to the controller when the matching of the data packet in the two- or three-layer virtual network searches for the first flow table and does not hit the flow entry.
  • the first default flow entry of the second or third virtual network has a lower priority than the second default flow entry of the second or third virtual network.
  • the second default flow entry of the Layer 2 virtual network B of the forwarding device 1 indicates that the forwarding device 1 is based on the Layer 2 virtual network B.
  • the matching of the data packet finds the first flow table and does not hit the flow entry, the data packet in the Layer 2 virtual network is sent to the controller.
  • the second default flow entry (for example, shown in Table 4) of the Layer 3 virtual network A of the forwarding device 1 indicates that the forwarding device 1 is in accordance with the Layer 3 virtual network.
  • the matching of the data packet finds the first flow table and does not hit the flow entry, the data packet in the three-layer virtual network is sent to the controller.
  • 3a2-04 Send a second default flow entry of the second or third layer virtual network.
  • the controller sends the second default flow entry of the Layer 2 virtual network B of the forwarding device 1 generated in the above step 3a2-03 to the forwarding device 1.
  • the controller sends the second default flow entry of the Layer 3 virtual network A of the forwarding device 1 generated in the above step 3a2-03 to the forwarding device 1.
  • sequence of the first default flow entry and the second default flow entry of the second or third virtual network is not limited, and may be the first default flow entry. It can also be made into the second default flow entry.
  • the sequence of the first default flow entry and the second default flow entry to be sent by the controller to the forwarding device 1 is not limited, and the first default flow entry may be delivered first, or may be first The second default flow entry is delivered, and the first default flow entry and the second default flow entry are also sent to the forwarding device 1 at the same time.
  • 3a1-01 Receive a first default flow entry of the second or third layer virtual network.
  • 3a1-02 Receive a second default flow entry of the second or third layer virtual network.
  • the forwarding device 1 receives the first default flow entry and the second default flow entry of the Layer 2 virtual network B, and saves the result to the Layer 2 flow table 1 (as shown in Table 5). Show).
  • ES1 initiates a Layer 2 unicast communication process to ES3.
  • the forwarding device 1 searches for the Layer 2 flow table 1 by using the matching between the virtual network identifier B and the destination MAC address. Table 5), and the traffic table entry is not accurately hit, so that the first default flow entry and the second default flow entry of the Layer 2 virtual network B are hit first because the second default flow table
  • the priority of the item is higher than the first default flow entry, so the second default flow entry is finally hit, and the action of sending the data message destined for ES3 to the controller is performed.
  • the controller After receiving the data packet destined for ES3, the controller generates a Layer 2 flow entry to the MAC3 in the virtual network B for the forwarding device 1 (for example, as shown in Table 6). Then, the Layer 2 flow entry destined for MAC3 is sent to the Layer 2 flow table 1 of the forwarding device 1.
  • the forwarding device 1 receives the data packet destined for the ES3 from the ES1, it directly searches the Layer 2 flow table 1 with the match between the VNID B and the destination MAC address of the MAC3, and accurately hits the Layer 2 flow destined for the MAC3.
  • the entry performs the corresponding action, and encapsulates the packet through an Overlay tunnel (such as a VxLAN tunnel) and sends the packet to the forwarding device 2 connected to the ES3.
  • an Overlay tunnel such as a VxLAN tunnel
  • the forwarding device 1 receives the first default flow entry and the second default flow entry of the Layer 3 virtual network A, and saves the data to the Layer 3 flow table 1 (as shown in Table 7). Show).
  • ES1 initiates a three-layer unicast communication process to ES4.
  • the forwarding device 1 searches for the Layer 3 flow table 1 (see Table 7) by using the matching between the virtual network identifier A and the destination IP address as IP4.
  • the first default flow entry and the second default flow entry of the Layer 3 virtual network A are hit first, because the priority of the second default flow entry is first hit. It is higher than the first default flow entry, so the second default flow entry is finally hit, and the action of sending the data message destined for ES4 to the controller is performed.
  • the controller After receiving the data packet destined for the ES4, the controller generates a Layer 3 flow entry to the IP4 in the virtual network A for the forwarding device 1 (for example, as shown in Table 8).
  • the Layer 3 flow entry destined for IP4 is then sent to the Layer 3 flow table 1 of the forwarding device 1.
  • the forwarding device 1 receives the data packet destined for the ES4 from the ES1, it directly searches the Layer 3 flow table 1 with the match between the VNID A and the destination IP address of IP4, and accurately hits the three-layer flow to the IP4.
  • the entry performs the corresponding action, and encapsulates the packet through an Overlay tunnel (such as a VxLAN tunnel) and sends the packet to the forwarding device 2 connected to the ES4.
  • an Overlay tunnel such as a VxLAN tunnel
  • the forwarding device 1 after receiving the data packet from the ES1, the forwarding device 1 first parses the destination MAC address in the data packet, and then uses the destination. The MAC is compared with the MAC address of the local device. If the MAC address is different, the MAC address is entered into the Layer 2 flow table 1 to perform Layer 2 lookup and forwarding. If the MAC address is the same, the MAC address is parsed. The destination IP address is compared with the IP address of the local device by the destination IP address. If the IP address is the same, the control plane is sent to the protocol for protocol analysis. If the IP address is different, the flow enters the Layer 3 flow table 1 and performs three. Layer lookup forwarding processing.
  • the first default flow entry and the second default flow entry of the Layer 2 virtual network B after the priority are modified, as shown in Table 9. Show.
  • the first default flow entry and the second default flow entry of the Layer 3 virtual network A after the priority are modified, as shown in Table 10. Show.
  • the forwarding device uses the first default flow of the second or third virtual network. The entry sends the first data packet to the designated forwarding device.
  • ES1 initiates a Layer 2 unicast communication process to ES5.
  • the forwarding device 1 uses the virtual network identifier B to match the destination MAC address to the MAC address 5, and searches for the Layer 2 flow table 1 (for example, Table 9), and the first default flow entry and the second default flow entry of the Layer 2 virtual network B are hit because the first default flow entry is hit.
  • the priority is higher than the second default flow entry, so the first default flow entry is finally hit, and the data packet destined for ES5 is broadcast to the forwarding device in the Layer 2 virtual network B.
  • the first default flow entry of the Layer 2 virtual network B is set, so that the first packet of the ES1 to the ES5 cannot be sent to the controller and the second-layer flow entry cannot be accurately matched.
  • the forwarding device 1 After the forwarding device 1 detects that the controller is faulty, the priority of the first default flow entry of the Layer 2 virtual network B is lower than the priority of the second default flow entry. Then, according to the above procedure, the forwarding device 1 receives the data packet sent by the ES1 to the ES5, and if it searches for the Layer 2 flow table 1 and fails to accurately hit the flow entry, the default is obtained from the two defaults. In the flow entry, the second default flow entry with a higher priority is selected, and the data packet is sent to the controller. The controller generates an exact matching Layer 2 flow entry and sends it to the forwarding device 1 to guide the subsequent Layer 2 forwarding. The specific process is as shown in Table 3 above. The flow of the flow entry shown is consistent and will not be described here.
  • the forwarding device 1 Detecting the failure of the controller by the forwarding device 1 and flexibly adjusting the priorities of the first and second default flow entries of the Layer 2 virtual network, so that the data packet can be directly matched after receiving the data packet.
  • the first default flow entry of the high level does not need to wait until the data packet is received, and then confirms the state of the controller, and then determines the default flow entry used, thereby improving the forwarding efficiency of the packet. It can be understood that, from the aspect of knowing the real-time status of the controller, it is also possible to query the status of the controller after receiving the data message, and determine which default to use after confirming the controller failure or failure recovery.
  • the flow entry is forwarded.
  • the priority of the first default flow entry on the forwarding device 1 may be flexibly adjusted according to the design requirement or the application scenario.
  • the priority of the default flow entry is such that the data packet destined for the ES5 can be flexibly broadcasted to the forwarding device in the Layer 2 virtual network B without a hit match, which enhances the system on-demand setting. Flexibility.
  • ES1 initiates a three-layer unicast communication process to ES6.
  • the forwarding device 1 searches for the Layer 3 flow table 1 (see Table 10) by using the matching between the virtual network identifier A and the destination IP address as IP6.
  • the first default flow entry and the second default flow entry of the three-layer virtual network A are hit because the priority ratio of the first default flow entry is hit.
  • the second default flow entry is higher, so the first default flow entry is finally hit, and the data packet destined for ES6 is saved to all or part of the three-layer virtual network A.
  • the forwarding device that routes the forwarding information is sent, that is, sent to the centralized forwarding device.
  • the first packet of the ES1 to the ES6 cannot be sent to the controller and the exact matching Layer 3 flow entry cannot be generated. The problem that caused the communication to be interrupted.
  • the forwarding device 1 After the forwarding device 1 detects that the controller is faulty, the priority of the first default flow entry of the Layer 3 virtual network A is lower than the priority of the second default flow entry. Then, according to the above process, the forwarding device 1 receives the data packet sent by the ES1 to the ES6, and if the traffic table entry is not correctly hit, the default is obtained. In the flow entry, the second default flow entry with a higher priority is selected, and the data packet is sent to the controller. The controller generates an exact matching flow layer 3 entry, and sends the packet to the forwarding device 1 to guide the subsequent forwarding.
  • the specific process is as shown in Table 7 in the above step 3a1-02. The flow of the flow entry is consistent, and is not mentioned here.
  • the forwarding device Detecting the failure of the controller by the forwarding device, and flexibly adjusting the priorities of the first and second default flow entries of the Layer 3 virtual network, so that the data packet can be directly matched with the priority after receiving the data packet.
  • the first default flow entry is high, and the status of the controller is confirmed after receiving the data packet, and then the default flow entry used is determined, so that the forwarding efficiency of the packet can be improved. It can be understood that, from the aspect of knowing the real-time status of the controller, it is also possible to query the status of the controller after receiving the data message, and determine which default to use after confirming the controller failure or failure recovery.
  • the flow entry is forwarded.
  • the priority of the first default flow entry on the forwarding device 1 may be flexibly adjusted according to the design requirement or the application scenario.
  • the priority of the default flow entry allows the data packets destined for the ES6 to be sent to the centralized forwarding device in the Layer 3 virtual network A flexibly without the hit match. This enhances the system's on-demand setting. Flexibility
  • FIG. 3b is a schematic diagram of an interaction flow of a method in which a default flow entry is a different flow table (is an example refinement of a relevant part of the method embodiment of FIG. 2).
  • the method embodiment is similar to the method embodiment described in FIG. 3a, and the first default flow entry of the Layer 2 or Layer 3 virtual network is set to enable the forwarding device to finally succeed when the controller fails. Hit the first default flow entry to guide forwarding.
  • the first default flow entry of the Layer 2 or Layer 3 virtual network and the second default flow entry of the Layer 2 or Layer 3 virtual network are saved in the method embodiment shown in FIG. 3b. In different flow tables.
  • the third embodiment of the invention includes a third or fourth virtual network. Default flow entry.
  • the third and fourth default flow entries are saved in the third flow table. As shown in FIG. 4, if the controller is faulty, the forwarding device forwards the lookup table to hit the third default flow entry, which can be executed. Jumping to the action of the first flow table, thereby hitting the first default flow entry. If the controller is working properly, the forwarding device forwards the lookup table to hit the fourth default flow entry, and may perform an action of jumping to the second flow table, thereby hitting the second default flow entry. .
  • FIG. 3b The following is a schematic diagram of the flowchart shown in FIG. 3b and the scenario of FIG. 1 , similar to the embodiment shown in FIG. 3 a , in which the forwarding device 1 is respectively in the Layer 2 virtual network B and the Layer 3 virtual network A, and FIG. 3b is described.
  • the scenario shown in Figure 1 is consistent with that described in the previous section of Figure 3a. Please refer to the corresponding section, and details are not described here.
  • the steps 3b2-01 to 3b2-08 shown in FIG. 3b are executed on the controller, where 3b2-01 to 3b2-
  • the step 04 is similar to the steps 3a2-01 to 3a2-04 described in FIG. 3a above (for details, please refer to the corresponding part, which is not described here again), except that the second or the embodiment in the embodiment shown in FIG. 3b
  • the second default flow entry of the Layer 3 virtual network is an entry in the second flow table, and is stored in the second flow table of the forwarding device 1.
  • the controller further performs the steps 3b2-05 to 3b2-08, and generates and sends to the forwarding device 1 a third default flow entry and a fourth default flow entry of the second or third virtual network, where the third default The priority of the flow-saving entry is lower than the priority of the fourth default flow entry.
  • the functions of the third and fourth default flow entries of the two or three-layer virtual network are similar to those of the first and second default flow entries. For details, refer to the corresponding parts in Figure 2 and Figure 3a above. The details are as follows: 1) is the entry in the third flow table; 2) the action performed is different, and the third default flow entry indicates that the third flow table has no exact hit flow.
  • the corresponding data packet is sent according to the first flow table (for example, may be sent to the first flow table, and then the first flow table is forwarded for forwarding); the fourth default flow table
  • the corresponding data packet is sent according to the second flow table (for example, the second flow table may be sent to the second flow table, and then the search is performed.
  • the second flow table is forwarded).
  • the controller will use the third and fourth default flow entries of the Layer 2 virtual network B of the forwarding device 1 generated in the above steps 3b2-05 to 3b2-08 (for example, as shown in Table 11). Send to the forwarding device 1.
  • the controller will use the third and fourth default flow entries of the Layer 3 virtual network A of the forwarding device 1 generated in the above steps 3b2-05 to 3b2-08 (for example, as shown in Table 12). Send to the forwarding device 1.
  • sequence of the first, second, third, and fourth default flow entries of the second or third layer virtual network is not limited, and may be generated in combination in any order.
  • the order in which the controller sends the first, second, third, and fourth default flow entries to the forwarding device 1 is not limited, and may be delivered separately or in any number to one or more controls.
  • the channel protocol messages are delivered in any order, which is not limited here.
  • the steps 3b1-01 to 3b1-07 shown in Fig. 3b are performed on the forwarding device 1, wherein the steps 3b1-01 and 3b1-02 are identical to the steps 3a1-01 and 3a1-02 described above in Fig. 3a (details please Reference is made to the corresponding part, which is not described here again.
  • the difference is that the second default flow entry of the two or three-layer virtual network in the embodiment shown in FIG. 3b is an entry in the second flow table, and is It is saved in the second flow table of the forwarding device 1.
  • the forwarding device 1 may further perform the steps 3b1-03 to 3b2-04 shown in FIG. 3b, and receive a third default flow entry and a second default flow entry from the second or third layer virtual network sent by the controller.
  • the default flow entry of the third default flow entry is lower than the priority of the fourth default flow entry.
  • the descriptions of the third and fourth default flow entries of the second or third layer virtual network are the same as those described in the steps 3b2-05 to 3b2-08 of the controller, and are not described again.
  • ES1 in FIG. 1 initiates a Layer 2 unicast communication flow to ES3.
  • the forwarding device 1 uses the virtual network identifier B and the destination MAC address as the matching entries of the MAC3 to search the flow table 3 (Table 11).
  • the third default flow entry and the fourth default flow entry of the Layer 2 virtual network B are hit first. Because the priority of the fourth default flow entry is higher than the third default flow entry, the fourth default flow entry is finally hit, and the data packet to be sent to the ES3 is executed.
  • the Layer 2 flow table 2 sends (for example, it can be sent to the Layer 2 flow table 2, and then the Layer 2 flow table 2 is forwarded). Then, the forwarding device 1 uses the matching between the virtual network identifier B and the destination MAC address as MAC3 to search for the Layer 2 flow table 2, and does not have an exact hit match. Then, the second default flow entry of the Layer 2 virtual network is selected.
  • the Layer 2 flow entry destined for MAC3 is sent to the Layer 2 flow table 3 (that is, the third flow table) of the forwarding device 1.
  • the forwarding device 1 receives the data packet destined for the ES3 from the ES1, it directly searches the Layer 2 flow table 3 with the match between the VNID B and the destination MAC address of the MAC3, and accurately hits the Layer 2 flow destined for the MAC3.
  • the entry performs the corresponding action, and encapsulates the packet through an Overlay tunnel (such as a VxLAN tunnel) and sends the packet to the forwarding device 2 connected to the ES3.
  • an Overlay tunnel such as a VxLAN tunnel
  • ES1 initiates a three-layer unicast communication flow to ES4.
  • the forwarding device 1 searches for the matching entry of the A and the destination IP address as the IP4, and searches for the Layer 3 flow table 3 (Table 12).
  • the third default flow entry and the fourth default flow entry of the three-layer virtual network A are hit first because the priority of the fourth default flow entry is first hit.
  • the third default flow entry is higher than the third default flow entry, so the fourth default flow entry is finally hit, and the data packet destined for ES4 is sent according to the three-layer flow table 2 (for example, it may be three Layer 2 table 2 jumps the transmission, and then looks for the three-layer flow table 2 for forwarding). Then, the forwarding device 1 uses the matching between the virtual network identifier A and the destination IP address as the IP4, and searches for the Layer 3 flow table 2, and does not have an exact hit match. Then, the second default flow entry of the Layer 2 virtual network is selected. Send the data message destined for ES4 to the controller.
  • the three-layer flow table 2 for example, it may be three Layer 2 table 2 jumps the transmission, and then looks for the three-layer flow table 2 for forwarding. Then, the forwarding device 1 uses the matching between the virtual network identifier A and the destination IP address as the IP4, and searches for the Layer 3 flow table 2, and does not have an exact hit match. Then, the second default flow entry of the Layer 2 virtual network
  • the controller After receiving the data packet destined for the ES4, the controller generates a Layer 3 flow entry to the IP4 in the virtual network A for the forwarding device 1 (for example, as shown in Table 8).
  • the Layer 3 flow entry destined for IP4 is then sent to the Layer 3 flow table 3 of the forwarding device 1.
  • the forwarding device 1 receives the data packet destined for ES4 from the ES1, it directly searches the Layer 3 flow table 3 with the match between the VNID A and the destination IP address of IP4, and accurately hits the three-layer flow to the IP4.
  • the entry performs the corresponding action, and encapsulates the packet through an Overlay tunnel (such as a VxLAN tunnel) and sends the packet to the forwarding device 2 connected to the ES4.
  • an Overlay tunnel such as a VxLAN tunnel
  • the forwarding device 1 can also perform the steps 3b1-05 to 3b1-07. These steps are similar to the steps 3a1-03 to 3a1-05 described in FIG. 3a above (for details, please refer to the corresponding part, which is not described here again), except that the embodiment is provided by the embodiment shown in FIG. 3b.
  • the third default flow entry of the two or three-layer virtual network in the third flow table has a higher priority than the fourth default flow entry of the second or third virtual network in the third flow table. Priority, so that when the controller fails, the forwarding device 1 can hit the third default flow entry, thereby jumping to the first flow table, and further using the second or third layer in the first flow table.
  • the first default flow entry of the virtual network forwards the data packet to the specified forwarding device.
  • ES1 in FIG. 1 initiates a Layer 2 unicast communication process to ES5.
  • the forwarding device 1 searches for the Layer 2 flow table 3 by using the matching between the virtual network identifier B and the destination MAC address as MAC5.
  • the third default flow entry and the fourth default flow entry of the Layer 2 virtual network B are hit first. Because the priority of the third default flow entry is higher than the fourth default flow entry, the third default flow entry is finally hit, and the datagram that will go to the ES5 is executed.
  • the message is sent according to the Layer 2 flow table 2 (for example, it can be sent to the Layer 2 flow table 2, and then the Layer 2 flow table 2 is forwarded). Then, the forwarding device 1 searches for the Layer 2 flow table 1 with the matching of the virtual network identifier B and the destination MAC address as MAC5, and does not have an exact hit match (or the matching device 1 may use the virtual network identifier as the match of B). The Layer 2 flow table 1 is searched for, and the first default flow entry of the Layer 2 virtual network is accurately hit. Then, the first default flow entry of the Layer 2 virtual network is used, and the execution is going to the ES5. The data packet is broadcasted to the forwarding device in the Layer 2 virtual network B, that is, broadcasted to the forwarding devices 2 and 3. After receiving the data packet, the forwarding device 3 connected to the ES5 sends it to the ES5.
  • the first default flow entry of the Layer 2 virtual network B is set, so that the first packet of the ES1 to the ES5 cannot be sent to the controller and the second-layer flow entry cannot be accurately matched.
  • ES1 initiates a three-layer unicast communication process to ES6.
  • the forwarding device 1 searches for the Layer 3 flow table 3 with the matching of the virtual network identifier A and the destination IP address, and fails to accurately hit.
  • the flow table entry so that the third default flow entry and the fourth default flow entry of the three-layer virtual network A are hit first, because the priority of the third default flow entry is higher than the The fourth default flow entry is higher, so the third default flow entry is finally hit, and the data packet destined for ES6 is sent according to the three-layer flow table 1 (for example, it can be a three-layer flow table).
  • the three-layer flow table 1 for example, it can be a three-layer flow table.
  • 1 Jump to send then find the three-tier flow table 1 for forwarding).
  • the forwarding device 1 uses the matching between the virtual network identifier A and the destination IP address as IP6 to search for the Layer 3 flow table 1 and does not have an exact hit match (or the matching device 1 may use the virtual network identifier as the match of A).
  • the Layer 2 flow table 1 is searched for, and the first default flow entry of the Layer 2 virtual network is accurately hit. Then, the first default flow entry of the Layer 3 virtual network is used, and the datagram destined for the ES6 is used.
  • the packet is sent to the forwarding device that stores all or part of the routing information in the Layer 3 virtual network A, that is, sent to the centralized forwarding device. After receiving the data packet, the centralized forwarding device searches for the route forwarding information of the Layer 3 virtual network A and sends it to the ES6 through a tunnel (such as a VxLAN tunnel).
  • the first packet of the ES1 to the ES6 cannot be sent to the controller and the exact matching Layer 3 flow entry cannot be generated. The problem that caused the communication to be interrupted.
  • the priority of the third and fourth default entries is flexibly adjusted.
  • the process of sending the data packet to the controller is similar to the description in the step 3a1-05 of FIG. 3a above, except that the jump between the flow tables is added. For brevity, no further details are provided herein.
  • the priorities of the third and fourth default entries are flexibly adjusted according to the design requirements or application scenarios, so as to achieve the process of sending data packets to the designated forwarding device.
  • the description of the part of step 3a1-05 of FIG. 3a is similar, except that the jump between the flow tables is added, and for brevity, it will not be repeated here.
  • the forwarding device 1 is taken as an example.
  • the same procedure is also applicable to the forwarding devices 2 and 3.
  • the forwarding devices 2 and 3 are not described again.
  • the first, second, third or fourth default flow entry used in the present invention refers to the first, second, third or fourth default flow entry in the Layer 2 virtual network or the Layer 3 virtual network, sometimes for the purpose of description. Concise, in the case of clear context, the limitation of the two or three-layer virtual network is omitted.
  • the Layer 2 flow entry in the present application is a flow entry including a MAC address in the match
  • the Layer 3 flow entry is a flow entry including an IP address in the match.
  • a Layer 2 flow table is a flow table used to store Layer 2 flow entries.
  • a Layer 3 flow table is a flow table used to store Layer 3 flow entries.
  • a Layer 2 flow entry and a Layer 3 flow entry can be placed in two separate flow tables. For example, a Layer 2 flow entry is placed in a Layer 2 flow table, and a Layer 3 flow entry is placed in a Layer 3 flow table. Or in a flow table, the flow table includes a two-layer flow entry and a three-layer flow entry. In this case, the flow table is a flow table in which two or three flow entries are mixed. It can be called a two-layer flow table or a three-layer flow table.
  • the above description is based on the example of a data center network based on control forwarding and separation of SDN and virtualization.
  • the present invention is not limited to the present invention, and can be applied to other networks based on control forwarding and splitting SDN and virtualization.
  • the present invention is in the metropolitan/backbone network.
  • the method implemented in the method is similar to the implementation method of the data center network scenario, except that the ES described in the present invention may also be a two- or three-layer forwarding device, for example, a Customer Edge (CE) device;
  • the tunnel described in the tunnel may also be a Layer 2 Virtual Private Network (L2VPN) tunnel or a Layer 3 Virtual Private Network (L3VPN) tunnel.
  • L2VPN Layer 2 Virtual Private Network
  • L3VPN Layer 3 Virtual Private Network
  • FIG. 5a shows a possible structural diagram of the forwarding device involved in the above embodiment.
  • the forwarding device 500A is applied to the virtual network that controls the forwarding.
  • the virtual network includes a controller and a forwarding device 500A.
  • the forwarding device 500A includes a main control board 510, an interface board 530, a switching network board 520, and an interface board 540.
  • the main control board 510 is used to complete functions such as system management, device maintenance, and protocol processing.
  • the switching network board 520 is used to complete data exchange between each interface board (also referred to as a line card or a service board).
  • Interface boards 530 and 540 are used to provide various service interfaces (eg, Ethernet interfaces, POS interfaces, etc.) and to implement forwarding of data packets.
  • the main control board 510, the interface boards 530 and 540, and the switching network board 520 are connected to each other through the system bus to implement interworking.
  • the central processing unit 531 on the interface board 530 is used to control and manage the interface board and communicate with the central processing unit 511 on the main control board 510.
  • the central processing unit 511 on the main control board 510 is further configured to communicate with the controller, and process a message (for example, flow entry information) sent by the controller to the forwarding device 500A.
  • a physical interface card 533 on the interface board 530 (eg, port 1 on the interface card, through which the port 1 can be connected) is configured to receive a first default flow entry of the virtual network from the controller (For details, refer to the descriptions of related parts in FIG. 2 and FIG. 3a, and details are not described herein again.
  • the first default flow entry is encapsulated in a message of the OpenFlow Control Channel Protocol).
  • the message is sent to the network processor 532 on the interface board 530.
  • the network processor 532 finds the forwarding entry and finds the host route (the destination IP address in the message header is the IP address of the forwarding device 500A), so
  • the central processing unit 531 on the interface board 530 is sent to the central processing unit 511 on the main control board 510.
  • the central processing unit 511 on the main control board 510 passes the first default flow entry of the virtual network from the controller through the central processing unit 541 on the central processing units 531 and 540 on the interface board 530, respectively. It is stored in the forwarding entry storages 534 and 544, respectively.
  • a physical interface card 533 on the interface board 530 e.g., port 2 on the interface card
  • the central processing unit 511 on the main control board 510 is further configured to cause a failure in the controller, and the forwarding device searches for the first flow table stored in the forwarding entry storage 534 according to the matching item of the first data packet.
  • the flow entry is not hit, it is determined that the first data packet is forwarded by using the first default flow entry of the virtual network, and the instruction is sent to the first flow table in the memory 534.
  • the network processor 532 on the interface board 530 receives the first data packet, and searches for the forwarding entry 534 without an exact hit entry according to the matching of the first data packet, so as to hit the virtual network.
  • the first default flow entry The network processor 532 instructs the physical interface card 533 or 543 to send the first data message to the designated forwarding device according to the first default flow entry.
  • the physical interface card 533 is instructed to send the first data packet; if the designated forwarding device is connected to the physical interface card 543, the first data packet is instructed.
  • the switch is sent to the interface board 540 through the switching network board 520, and then the first data packet is sent by the physical interface card 543.
  • the physical interface card 533 on the interface board 530 also receives a second default flow entry from the virtual network of the controller, according to the virtual network. Whether the second default flow entry is saved in the same flow table as the first default flow entry of the virtual network has the following two possible implementation manners.
  • the default flow entry is an implementation of an entry in the same flow table.
  • the central processing unit 511 on the main control board 510 also uses the second virtual network from the controller.
  • the default flow entry (for details, refer to the description of the related parts in Figure 2 and Figure 3a, and the second default flow entry is the entry in the first flow table).
  • the item memories 534 and 544 are published.
  • the second default flow entry of the virtual network has a higher priority than the first default flow entry of the virtual network.
  • the central processing unit 511 on the main control board 510 is further configured to work normally in the controller, and the forwarding device searches the first flow table according to the matching item of the first data packet and does not hit the flow entry. In case, it is determined that the first data packet is forwarded by using a second default flow entry of the virtual network.
  • the central processing unit 511 on the main control board 510 is further configured to set a priority of the first default flow entry of the virtual network after determining the controller failure. The level is higher than the priority of the second default flow entry of the virtual network.
  • the network processor 532 on the interface board 530 is further configured to instruct the physical interface card 533 or 543 to send the first data packet according to the first default flow entry of the virtual network.
  • the default flow entry is an implementation of an entry in a different flow table.
  • the central processing unit 511 on the main control board 510 also uses the second virtual network from the controller.
  • the default flow entry (for details, refer to the description of the related parts in Figure 2 and Figure 3a, and the second default flow entry is the entry in the second flow table). Forward entries in entries 534 and 544.
  • the second default flow entry of the virtual network has a higher priority than the first default flow entry of the virtual network.
  • the physical interface card 533 (for example, port 1 on the interface card) on the interface board 530 is also received, similar to the foregoing process of sending the first default flow entry.
  • the third default flow entry of the virtual network from the controller (refer to the description of related parts in FIG. 2 and FIG. 3b, and details are not described herein again.
  • the third default flow table of the virtual network is The entry in the third flow table).
  • the central processing unit 511 on the main control board 510 also stores the third default flow entry of the virtual network into the forwarding entry storages 534 and 544, respectively.
  • the central processing unit 511 on the main control board 510 is further configured to cause a failure in the controller, and the forwarding device searches the third flow table according to the matching item of the first data packet and does not hit the flow entry. And determining to forward the first data packet by using a third default flow entry of the virtual network.
  • the physical interface card 533 (for example, port 1 on the interface card) on the interface board 530 is also received in the same process as the first default flow entry.
  • the fourth default flow entry of the virtual network from the controller (refer to the description of related parts in FIG. 2 and FIG. 3b, and details are not described herein again.
  • the fourth default flow table of the virtual network is The entry in the third flow table).
  • the central processing unit 511 on the main control board 510 also stores the fourth default flow entry of the virtual network into the forwarding entry storages 534 and 544, respectively.
  • the priority of the fourth default flow entry of the virtual network is greater than the priority of the third default flow entry of the virtual network.
  • the central processing unit 511 on the main control board 510 is further configured to work normally in the controller, and the forwarding device searches for the third flow table according to a match of the first data packet and does not hit the flow. In the case of the entry, it is determined that the first data packet is forwarded by using the fourth default flow entry of the virtual network.
  • the central processing unit 511 on the main control board 510 is further configured to set a third default flow entry of the virtual network after determining the controller failure.
  • the priority of the virtual flow is higher than the priority of the fourth default flow entry of the virtual network.
  • the network processor 532 is further configured to send the first data packet to the first flow table according to the third default flow entry command of the virtual network, and then according to the virtual network in the first flow table.
  • a default flow entry instructs the physical interface card 533 or 543 to send the first data message to the designated forwarding device.
  • the operation on the interface board 540 in the embodiment of the present invention is consistent with the operation of the interface board 530, and is not described again for brevity.
  • the forwarding device 500A of the present embodiment may correspond to the forwarding device (for example, the forwarding device 1, 2 or 3 in FIG. 1) in the embodiment corresponding to the foregoing FIG. 1 to FIG. 3b, in the forwarding device 500A.
  • the main control board 510, the interface board 530, and/or 540 can implement the functions and/or various steps of the forwarding device in the embodiment corresponding to FIG. 1 to FIG. 3b. For brevity, details are not described herein again. .
  • the main control board may have one or more blocks. When there are multiple blocks, the main control board and the standby main control board may be included.
  • the interface board may have one or more blocks. The stronger the data processing capability of the forwarding device, the more interface boards are provided.
  • the physical interface card on the interface board can also have one or more blocks.
  • the switching network board may not exist, and there may be one or more blocks. When there are multiple blocks, the load sharing redundant backup can be implemented together. In the centralized forwarding architecture, the forwarding device does not need to exchange the network board, and the interface board assumes the processing function of the service data of the entire system.
  • the forwarding device may have at least one switching network board, and exchange data between multiple interface boards through the switching network board to provide large-capacity data exchange and processing capabilities. Therefore, the data access and processing capabilities of the forwarding device of the distributed architecture are greater than those of the centralized architecture.
  • the forwarding device 500A may be in the form of only one board, that is, there is no switching network board, and the functions of the interface board and the main control board are integrated on the board, and the central processing unit and the main board on the interface board at this time.
  • the central processing unit on the control board can be combined into a central processing unit on the board to perform the superimposed functions.
  • the data exchange and processing capability of the device is low (for example, low-end switches or routers, etc.) Internet equipment). Which architecture is used depends on the specific network deployment scenario, and is not limited here.
  • FIG. 5b shows still another possible structural diagram of the forwarding device involved in the above embodiment.
  • the forwarding device 500B is applied to a virtual network that controls forwarding separation, the virtual network including a controller and a forwarding device 500B.
  • the forwarding device 500B includes a processing unit 504B, a receiving unit 502B, and a transmitting unit 506B.
  • the receiving unit 502B is configured to receive the first default flow entry of the virtual network from the controller (refer to the description of related parts in FIG. 2 to FIG. 3b, which is not described herein again), where the virtual network
  • the first default flow entry is an entry in the first flow table.
  • the receiving unit 502B is further configured to receive the first data packet in the virtual network from the end system ES.
  • the processing unit 504B is configured to: when the controller fails, and the forwarding device searches for the first flow table according to the matching item of the first data packet and does not hit the flow entry, determining to use the virtual The first default flow entry of the network forwards the first data packet.
  • the sending unit 506B is configured to send the first data packet to the designated forwarding device.
  • the forwarding device 500B further includes a storage unit, where the storage unit is configured to save a first default flow entry of the virtual network.
  • the forwarding device further receives a second default flow entry of the virtual network from the controller, according to whether the second default flow entry of the virtual network is related to the virtual network
  • the first default flow entry is saved in the same flow table.
  • the default flow entry is an implementation of an entry in the same flow table.
  • the receiving unit 502B is further configured to receive a second default flow entry of the virtual network from the controller (refer to the description of related parts in FIG. 2 and FIG. 3a for details).
  • the second default flow entry is an entry in the first flow table.
  • the second default flow entry of the virtual network has a higher priority than the first default flow entry of the virtual network.
  • the processing unit 504B is further configured to: when the controller works normally, and the forwarding device searches for the first flow table according to a match of the first data packet and does not hit a flow entry, determining to use The second default flow entry of the virtual network forwards the first data packet.
  • the sending unit 506B is further configured to send the first data packet to the controller.
  • the processing unit 504B is further configured to: after determining the controller fault, setting a priority of the first default flow entry of the virtual network is higher than the virtual The priority of the second default flow entry of the network.
  • the processing unit 504B is further configured to: when determining the controller failure recovery, setting a priority of the second default flow entry of the virtual network is higher than a priority of the first default flow entry of the virtual network, and in response to the second default flow entry of the virtual network, the sending unit 506B sends the first Data message.
  • the processing unit 504B is further configured to: when determining that the controller works normally, setting a priority of the first default flow entry of the virtual network is higher than The priority of the second default flow entry of the virtual network, and in the case that the flow entry is not hit, the sending unit 506B sends the first according to the first default flow entry of the virtual network.
  • a data message when determining that the controller works normally, setting a priority of the first default flow entry of the virtual network is higher than The priority of the second default flow entry of the virtual network, and in the case that the flow entry is not hit, the sending unit 506B sends the first according to the first default flow entry of the virtual network.
  • a data message is further configured to: when determining that the controller works normally, setting a priority of the first default flow entry of the virtual network is higher than The priority of the second default flow entry of the virtual network, and in the case that the flow entry is not hit, the sending unit 506B sends the first according to the first default flow entry of the virtual network.
  • the storage unit is further configured to save a second default flow entry of the virtual network.
  • the default flow entry is an implementation of an entry in a different flow table.
  • the receiving unit 502B is further configured to receive a second default flow entry of the virtual network from the controller (refer to the relevant parts of FIG. 2 and FIG. 3b for details).
  • the description of the second default flow entry of the virtual network is an entry in the second flow table.
  • the processing unit 504B is further configured to: when the controller works normally, and the forwarding device searches for the second flow table according to the matching item of the first data packet and does not hit the flow entry, determining And forwarding, by using the second default flow entry of the virtual network, the first data packet.
  • the sending unit 506B is further configured to send the first data packet to the controller.
  • the receiving unit 502B is further configured to receive a third default flow entry of the virtual network from the controller (refer to the relevant parts of FIG. 2 and FIG. 3b for details).
  • the description of the third default flow table of the virtual network is an entry in the third flow table.
  • the processing unit 504B is further configured to: when the controller fails, and the forwarding device searches for the third flow table according to the matching item of the first data packet and does not hit the flow entry, determining And using the third default flow entry of the virtual network to forward the first data packet.
  • the sending unit 506B is further configured to send the first data packet to the first flow table.
  • the receiving unit 502B is further configured to receive a fourth default flow entry of the virtual network from the controller (refer to the relevant parts of FIG. 2 and FIG. 3b for details).
  • the description of the third default flow entry of the virtual network is an entry in the third flow table.
  • the priority of the fourth default flow entry of the virtual network is greater than the priority of the third default flow entry of the virtual network.
  • the processing unit 504B is further configured to: when the controller works normally, and the forwarding device searches for the third flow table according to the matching item of the first data packet and does not hit the flow entry, determining And using the fourth default flow entry of the virtual network to forward the first data packet.
  • the sending unit 506B is further configured to send the first data packet to the second flow table.
  • the processing unit 504B is further configured to: after determining the controller fault, setting a third default flow entry of the virtual network with a higher priority than the virtual The priority of the fourth default flow entry of the network.
  • the processing unit 504B is further configured to: when determining the controller failure recovery, setting a fourth default flow entry of the virtual network with a higher priority The priority of the third default flow entry of the virtual network, and in the case that the flow entry is not hit, the sending unit 506B sends the first according to the fourth default flow entry of the virtual network.
  • a data message when determining the controller failure recovery, setting a fourth default flow entry of the virtual network with a higher priority The priority of the third default flow entry of the virtual network, and in the case that the flow entry is not hit, the sending unit 506B sends the first according to the fourth default flow entry of the virtual network.
  • the processing unit 504B is further configured to: when determining that the controller works normally, setting a third default flow entry of the virtual network with a higher priority The priority of the fourth default flow entry of the virtual network, and in the case of not hitting the flow entry, preferentially transmitting, according to the third default flow entry of the virtual network, the sending unit 506B A data message.
  • the storage unit is further configured to save second, third, and fourth default flow entry entries of the virtual network.
  • the forwarding device 500B of the embodiment of the present invention may correspond to the forwarding device in the foregoing method for forwarding a data packet, and each module in the forwarding device 500B and the foregoing other operations and/or functions respectively implement FIG. 1 to FIG.
  • the various steps and methods implemented by the forwarding device in the corresponding embodiment are not described herein for brevity.
  • FIG. 5c shows still another possible structural diagram of the forwarding device involved in the above embodiment.
  • the forwarding device 500C includes a transceiver 510C, a processor 520C, a random access memory 540C, a read only memory 550C, and a bus 560C.
  • the processor 520C is coupled to the transceiver 510C, the random access memory 540C, and the read only memory 550C via the bus 560C.
  • the forwarding device 500C needs to be run, the basic forwarding system in the read-only memory 550C or the bootloader booting system in the embedded system is booted, and the forwarding device 500C is put into a normal running state. After the forwarding device 500C enters the normal operating state, the application and operating system are run in the random access memory 540C such that:
  • the transceiver 510C is configured to receive a first default flow entry of the virtual network from the controller, where a first default flow entry of the virtual network indicates that the forwarding device is configured according to data in the virtual network When the match of the packet finds the first flow table and does not hit the flow entry, the data packet in the virtual network is sent to the designated forwarding device.
  • the transceiver 510C is further configured to receive the first data message in the virtual network from the end system ES.
  • the processor 520C is configured to: when the controller fails, and the forwarding device searches for the first flow table according to the matching item of the first data packet and does not hit the flow entry, determining to use the virtual The first default flow entry of the network forwards the first data packet.
  • the transceiver 510C is further configured to send the first data packet to the designated forwarding device.
  • the random access memory 540C is further configured to save a first default flow entry of the virtual network.
  • the forwarding device 500C of the embodiment of the present invention may correspond to the forwarding device in the embodiment corresponding to the foregoing FIG. 1 to FIG. 4, and the processor 520C, the transceiver 510C, and the like in the forwarding device 500C may implement FIG. 1 to FIG.
  • the processor 520C is configured to perform all operations of the processing unit 504B of the forwarding device of FIG. 5b for performing all operations of the receiving unit 502B and the transmitting unit 506B of the forwarding device of FIG. 5b. For the sake of brevity, it will not be repeated here.
  • the forwarding device can be implemented based on a general physical server and a network function virtualization (NFV) technology, and the forwarding device is a virtual forwarding device (for example, a virtual router or a virtual device). switch).
  • the virtual forwarding device may be a virtual machine (English: Virtual Machine, VM) running a program for forwarding data packets, and the virtual machine is deployed on a hardware device (for example, a physical server).
  • a virtual machine is a complete computer system that runs through a software and has full hardware system functionality running in a fully isolated environment.
  • NFV network function virtualization
  • Fig. 6a shows a possible structural diagram of the controller 600A involved in the above embodiment.
  • the controller 600A is applied to a virtual network that controls forwarding separation, the virtual network includes a controller 600A and a forwarding device, and the controller 600A includes a processing unit 602A and a transmitting unit 604A.
  • the processing unit 602A is configured to generate a first default flow entry of the virtual network, where the first default flow entry of the virtual network indicates that the forwarding device fails in the controller 600A and the forwarding device is configured according to If the matching item of the data packet in the virtual network searches for the flow table and does not hit the flow entry, the data packet in the virtual network is sent to the designated forwarding device, or the forwarding device is instructed to If the controller 600A works normally and the forwarding device searches the flow table according to the matching item of the data packet in the virtual network and does not hit the flow entry, the data packet in the virtual network is sent to the The specified forwarding device sends.
  • the processing unit 602A is further configured to generate a second default flow entry of the virtual network, where the second default flow entry of the virtual network indicates that the forwarding device works normally in the controller 600A and the forwarding device And if the flow table is searched according to the matching item of the data packet in the virtual network and the flow table entry is not hit, the data packet in the virtual network is sent to the controller 600A.
  • the sending unit 604A is configured to send, to the forwarding device, a first default flow entry of the virtual network and a second default flow entry of the virtual network.
  • the default flow entry is an implementation of an entry in the same flow table.
  • the first default flow entry of the virtual network is an entry in the first flow table, where the indication that the forwarding device fails in the controller 600A and the forwarding device is configured according to A match of the data packet in the virtual network searches for the flow table and does not hit the flow entry, specifically searching for the first flow table and not hitting the flow entry.
  • the second default flow entry of the virtual network is an entry in the first flow table, where the indication that the forwarding device works normally in the controller 600A and the forwarding device is based on the data packet in the virtual network The match finds the flow table and does not hit the flow entry specifically to find the first flow table and does not hit the flow entry.
  • the default flow entry is an implementation of an entry in a different flow table.
  • the first default flow entry of the virtual network is an entry in the first flow table, where the indication that the forwarding device fails in the controller 600A and the forwarding device is configured according to A match of the data packet in the virtual network searches for the flow table and does not hit the flow entry, specifically searching for the first flow table and not hitting the flow entry.
  • the second default flow entry of the virtual network is an entry in the second flow table, where the indication indicates that the forwarding device works normally in the controller 600A and the forwarding device matches the data packet according to the virtual network. The item looks up the flow table and does not hit the flow table entry specifically to find the second flow table and does not hit the flow table entry.
  • the processing unit 602A is further configured to generate a third default flow entry of the virtual network (refer to the description of related parts in FIG. 2 and FIG. 3b, where No longer).
  • the sending unit 604A is further configured to send a third default flow entry of the virtual network to the forwarding device.
  • the processing unit 602A is further configured to generate a fourth default flow entry of the virtual network. For details, refer to the descriptions of related parts in FIG. 2 and FIG. 3b. No longer).
  • the sending unit 604A is further configured to send a fourth default flow entry of the virtual network to the forwarding device.
  • the controller 600A of the embodiment of the present invention may implement various implementation functions and steps in the forwarding device in the embodiment corresponding to the foregoing FIG. 1 to FIG. 4 . For brevity, details are not described herein again.
  • Fig. 6b shows still another possible structural diagram of the controller 600B involved in the above embodiment.
  • the controller 600B includes a transceiver 610B, a processor 620B, a random access memory 640B, a read only memory 650B, and a bus 660B.
  • the processor 620B is coupled to the receiver 610B, the random access memory 640B, and the read only memory 650B via the bus 660B.
  • the booting is performed in the basic input/output system in the read-only memory 650B or the bootloader booting system in the embedded system, and the boot controller 600B enters a normal operating state.
  • the application and operating system are run in the random access memory 640B such that:
  • the processor 620B is configured to generate a first default flow entry of the virtual network, where the first default flow entry of the virtual network indicates that the forwarding device fails in the controller 600B and the forwarding device is configured according to If the matching item of the data packet in the virtual network searches for the flow table and does not hit the flow entry, the data packet in the virtual network is sent to the designated forwarding device, or the forwarding device is instructed to If the controller 600B works normally and the forwarding device searches the flow table according to the matching item of the data packet in the virtual network and does not hit the flow entry, the data packet in the virtual network is sent to the The specified forwarding device sends.
  • the processor 620B is further configured to generate a second default flow entry of the virtual network, where the second default flow entry of the virtual network indicates that the forwarding device works normally at the controller 600B and the forwarding device is configured according to the When the matching item of the data packet in the virtual network searches for the flow table and does not hit the flow entry, the data packet in the virtual network is sent to the controller 600B.
  • the transceiver 610B is configured to send, to the forwarding device, a first default flow entry of the virtual network and a second default flow entry of the virtual network.
  • the controller 600B of the embodiment of the present invention may correspond to the controller in the embodiment corresponding to the foregoing FIG. 1 to FIG. 4, and the processor 620B, the transceiver 610B, and the like in the controller 600B may implement FIG. 1 to FIG.
  • the processor 620B is configured to perform all of the operations of the processing unit 602A of the controller of Figure 6a, which is used to perform all of the operations of the transmitting unit 604A of the controller of Figure 6a. For the sake of brevity, it will not be repeated here.
  • the embodiment may also be based on a universal physical server combined with an NFV technology implemented controller, which is a virtual controller.
  • the virtual controller may be a virtual machine (English: Virtual Machine, VM) running a program for sending a flow entry function, and the virtual machine is deployed on a hardware device (for example, a physical server).
  • a virtual machine is a complete computer system that runs through a software and has full hardware system functionality running in a fully isolated environment.
  • Those skilled in the art can use the NFV technology to virtualize a plurality of controllers having the above functions on a general physical server by reading the present application. I will not repeat them here.
  • FIG. 7 is a schematic diagram of a system for forwarding data packets according to an embodiment of the present invention.
  • system 700 includes a forwarding device 710 and a controller 720.
  • the forwarding device 710 is any of the forwarding devices or virtual forwarding devices described above with respect to Figures 5a, 5b, 5c
  • the controller 720 is any of the controllers or virtual controllers described above with respect to Figures 6a, 6b.
  • each device in the system refer to the related sections in Figure 5a-5c and Figure 6a-6b above, and details are not described here.
  • the size of the sequence numbers of the above processes does not mean the order of execution, and the order of execution of each process should be determined by its function and internal logic, and should not be taken to the embodiments of the present invention.
  • the implementation process constitutes any limitation.
  • the disclosed systems, devices, and methods may be implemented in other manners.
  • the device embodiments described above are merely illustrative.
  • the division of the unit is only a logical function division.
  • there may be another division manner for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored or not executed.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be in an electrical, mechanical or other form.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
  • each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the functions may be stored in a computer readable storage medium if implemented in the form of a software functional unit and sold or used as a standalone product.
  • the technical solution of the present invention which is essential or contributes to the prior art, or a part of the technical solution, may be embodied in the form of a software product, which is stored in a storage medium, including
  • the instructions are used to cause a computer device (which may be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention.
  • the foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请提供一种转发数据报文的方法、装置和系统，应用于控制转发分离的虚拟网络中，所述方法包括：转发设备接收来自控制器的所述虚拟网络的第一缺省流表项，所述虚拟网络的第一缺省流表项指示转发设备根据所述虚拟网络内的数据报文的匹配项查找第一流表并且没有命中流表项的情况下，将所述虚拟网络内的数据报文向指定的转发设备发送。转发设备接收来自端系统的所述虚拟网络内的第一数据报文。在控制器发生故障，并且转发设备根据所述第一数据报文的匹配项查找所述第一流表并且没有命中流表项的情况下，转发设备使用所述虚拟网络的第一缺省流表项向所述指定的转发设备发送所述第一数据报文。有助于数据报文转发不中断，提升系统的可靠性。

Description

一种转发数据报文的方法、设备和系统
本申请要求于2017年4月11日提交中国专利局、申请号为201710233682.4、申请名称为“一种转发数据报文的方法、设备和系统”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明实施例涉及通信领域，尤其涉及一种转发数据报文的方法、设备和系统。
背景技术
基于控制转发分离思想的软件定义网络(英文：Software Defined Networking，SDN)架构，是一种新型网络交换模型，其关键组件包括控制器和转发设备(例如，开放流(英文：OpenFlow)交换机)。控制器和转发设备之间通过控制通道协议进行通信，完成消息的交互和信息的传递，目前常用的控制通道协议，例如，可以包括：开放流(OpenFlow)协议、路径计算通信协议(Path Computation Element Communication Protocol,PCEP)、边界网关协议(Border Gateway Protocol，BGP)、路由系统接口(Interface to the Routing System，I2RS)等。控制器通过全网络视图来实现管控功能,为转发设备生成转发流表，转发设备根据流表来转发数据包。流表由若干个流表项构成，一个流表项主要由匹配字段(英文：match fields)和操作指令(英文：action instructions)等部分组成。为了节省转发设备存储流表的空间，通常控制器采用拉(英文：PULL)模式、按需下发流表项到相应的转发设备。具体地，当一个转发设备从其它转发设备收到数据报文之后，获取该数据报文的匹配项(该匹配项指示了该数据报文去往的目标网络设备)，并用该匹配项查找流表。如果在流表中查找不到匹配的流表项，则会将该数据报文重定向发送到控制器。该控制器收到并解析该数据报文，获取该数据报文的匹配项，并根据全网的网络拓扑图为该匹配项生成相应的流表项；然后将该流表项下发到该转发设备，以及将该数据报文重新发送给该转发设备。该转发设备根据该流表项将该数据报文向该目标网络设备转发。
但是，如果该控制器发生了故障，当该转发设备从其它转发设备收到该数据报文之后，在流表中查找不到匹配的流表项时，则无法将该数据报文重定向送达到该故障的控制器。该故障的控制器也无法为该数据报文的匹配项生成流表项，因此，该转发设备无法获得流表项，也就无法将该数据报文向该目标网络设备转发，从而造成数据流的中断、无法正常进行通信、降低了系统的可靠性。
发明内容
本发明实施例提供的转发数据报文的方法、设备和系统，解决了在采用Pull模式 工作的控制转发分离架构下的虚拟网络中，当控制器故障后，转发设备无法正常转发数据报文，造成数据流的中断的问题，有助于提升系统的可靠性。
为了解决上述问题，本发明实施例第一方面提供了一种转发数据报文的方法，该方法应用于控制转发分离的虚拟网络中，所述虚拟网络包括控制器和转发设备。在所述方法中，所述转发设备接收来自所述控制器的所述虚拟网络的第一缺省流表项，所述虚拟网络的第一缺省流表项指示所述转发设备根据所述虚拟网络内的数据报文的匹配项查找第一流表并且没有命中流表项的情况下，将所述虚拟网络内的数据报文向指定的转发设备发送；所述转发设备接收来自端系统ES的所述虚拟网络内的第一数据报文；在所述控制器发生故障，并且所述转发设备根据所述第一数据报文的匹配项查找所述第一流表并且没有命中流表项的情况下，所述转发设备使用所述虚拟网络的第一缺省流表项向所述指定的转发设备发送所述第一数据报文。
通过增加所述虚拟网络的第一缺省流表项，可以使得转发设备，在控制器故障后，并且在流表中匹配接收报文的匹配项时没有命中的情况下，可以根据该第一缺省流表项将所述虚拟网络内的数据报文发送到指定的转发设备，从而使转发设备可以在上述情况下正常转发数据报文，避免了数据流中断，提升了系统的可靠性。
在一种可能的设计中，所述转发设备接收来自所述控制器的所述虚拟网络的第二缺省流表项，所述虚拟网络的第二缺省流表项指示所述转发设备根据所述虚拟网络内的数据报文的匹配项查找所述第一流表并且没有命中流表项的情况下，将所述虚拟网络内的数据报文向所述控制器发送；所述虚拟网络的第二缺省流表项的优先级高于所述虚拟网络的第一缺省流表项的优先级；在所述控制器正常工作，并且所述转发设备根据所述第一数据报文的匹配项查找所述第一流表并且没有命中流表项的情况下，所述转发设备使用优先级高的所述虚拟网络的第二缺省流表项向所述控制器发送所述第一数据报文。
通过设置所述虚拟网络的第一缺省流表项和所述虚拟网络的第二缺省流表项在同一流表中，提供了一种高效的实现方式，提高了流表项的匹配效率。通过所述第二缺省流表项，能使控制器正常工作时，转发设备将数据报文发送到控制器，实现Pull模式下按需下发流表项，从而节省转发设备的存储空间。此外，通过设置调整所述第一和二缺省流表项的优先级，还可以根据控制器正常工作、故障、故障恢复等不同的状态采用不同的匹配策略，从而提高系统的灵活性。
在一种可能的设计中，所述转发设备确定所述控制器故障的情况下，设置所述虚拟网络的第一缺省流表项的优先级高于所述虚拟网络的第二缺省流表项的优先级，以便在没有命中流表项的情况下优先使用所述虚拟网络的第一缺省流表项向所述指定的转发设备发送所述第一数据报文。
在一种可能的设计中，所述转发设备确定所述控制器故障恢复的情况下，设置所述虚拟网络的第二缺省流表项的优先级高于所述虚拟网络的第一缺省流表项的优先级，以便在没有命中流表项的情况下优先使用所述虚拟网络的第二缺省流表项向所述控制器发送所述第一数据报文。
通过预先调整虚拟网络的第一缺省流表项的优先级高于虚拟网络的第二缺省流表项，例如，在预先确认控制器故障后，灵活地调整缺省流表项的优先级，这样可以在收到报文 后，直接匹配优先级高的所述第一缺省流表项，而不用等到接收到报文后，再确认控制器的状态，然后确定使用的缺省流表项，从而可以提高报文的转发效率。并在获知控制器状态更新后，例如故障恢复后，及时调整所述第二缺省流表项的优先级高于所述第一缺省流表项的优先级，直接匹配优先级高的所述第二缺省流表项，从而可以提高报文的转发效率，并且进一步保障系统的可靠性和稳定性。
在一种可能的设计中，所述转发设备确定所述控制器正常工作的情况下，设置所述虚拟网络的第一缺省流表项的优先级高于所述虚拟网络的第二缺省流表项的优先级，以便在没有命中流表项的情况下优先使用所述虚拟网络的第一缺省流表项向所述指定的转发设备发送所述第一数据报文。
在控制器正常工作的情况下，也可以根据设计要求或应用场景，通过灵活地调整所述第一缺省流表项的优先级高于所述第二缺省流表项的优先级，使得报文在没有命中匹配项的情况下，也可以灵活地被向指定的转发设备发送，增强了系统的按需设置的灵活性。
在一种可能的设计中，所述设置所述虚拟网络的第一缺省流表项的优先级高于所述虚拟网络的第二缺省流表项的优先级包括：所述转发设备修改所述虚拟网络的第一缺省流表项的优先级，使所述虚拟网络的第一缺省流表项的优先级高于所述虚拟网络的第二缺省流表项的优先级；或者所述转发设备修改所述虚拟网络的第二缺省流表项的优先级，使所述第二缺省流表项的优先级低于所述虚拟网络的第一缺省流表项的优先级。
通过调高虚拟网络的第一缺省流表项的优先级或者调低虚拟网络的第二缺省流表项的优先级，提供了一种灵活简便的设置优先级的手段，有助于快捷地实现了控制器故障后，保证该第一缺省流表项能够被选用去转发数据报文。
在一种可能的设计中，所述转发设备接收来自所述控制器的所述虚拟网络的第二缺省流表项，所述虚拟网络的第二缺省流表项指示所述转发设备根据所述虚拟网络内的数据报文的匹配项查找第二流表并且没有命中流表项时，将所述虚拟网络内的数据报文向所述控制器发送；在所述控制器正常工作，并且所述转发设备根据所述第一数据报文的匹配项查找所述第二流表并且没有命中流表项的情况下，所述转发设备使用所述虚拟网络的第二缺省流表项向所述控制器发送所述第一数据报文。
通过设置与所述虚拟网络的第一缺省流表项在不同流表中的所述虚拟网络的第二缺省流表项，提供了一种易于扩展流表的实现方式，提高了系统的可维护性。通过所述第二缺省流表项，能使控制器正常工作时，转发设备将数据报文发送到控制器，实现Pull模式下按需下发流表项，从而节省转发设备的存储空间。
在一种可能的设计中，所述转发设备接收来自所述控制器的所述虚拟网络的第三缺省流表项，所述虚拟网络的第三缺省流表项指示所述转发设备根据所述虚拟网络内的数据报文的匹配项查找第三流表并且没有命中流表项的情况下，将所述虚拟网络内的数据报文依据所述第一流表发送；在所述控制器发生故障，并且所述转发设备根据所述第一数据报文的匹配项查找所述第三流表并且没有命中流表项的情况下，所述转发设备根据所述虚拟网络的第三缺省流表项的指示依据所述第一流表发送所述第一数据报文。
通过设置与所述虚拟网络的第一缺省流表项和所述虚拟网络的第二缺省流表项在不同流表中的所述虚拟网络的第三缺省流表项，提供了一种易于扩展流表的实现方式，提高 了系统的可维护性。此外，通过所述第三缺省流表项，使控制器故障时，可以根据该第三缺省流表项跳转到所述虚拟网络的第一缺省流表项进行数据报文的正常转发，避免数据流的中断。
在一种可能的设计中，所述转发设备接收来自所述控制器的所述虚拟网络的第四缺省流表项，所述虚拟网络的第四缺省流表项指示所述转发设备根据所述虚拟网络内的数据报文的匹配项查找所述第三流表并且没有命中流表项的情况下，将所述虚拟网络内的数据报文依据所述第二流表发送；所述虚拟网络的第四缺省流表项的优先级大于所述虚拟网络的第三缺省流表项的优先级；在所述控制器正常工作，并且所述转发设备根据所述第一数据报文的匹配项查找所述第三流表并且没有命中流表项的情况下，所述转发设备根据优先级高的所述虚拟网络的第四缺省流表项的指示依据所述第二流表发送所述第一数据报文。
通过设置与所述虚拟网络的第三缺省流表项在同一流表中、与所述第一和第二缺省流表项不在同一流表中的所述虚拟网络的第四缺省流表项，提供了一种便于扩展流表的实现方式，提高了系统的可维护性。通过灵活的设置所述第四缺省流表项的优先级高于所述第三缺省流表项的优先级，使得转发设备在控制器正常工作，但在流表中匹配接收报文的匹配项时没有命中的情况下，可以根据相应流表项的优先级灵活地跳转到所述第二缺省流表项去进一步向控制器发送报文，从而实现按需下发流表项、节约转发设备的存储空间。此外，通过设置调整所述第三和第四缺省流表项的优先级，还可以根据控制器正常工作、故障、故障恢复等不同的状态采用不同的匹配策略，从而提高系统的灵活性。
在一种可能的设计中，所述转发设备确定所述控制器故障的情况下，设置所述虚拟网络的第三缺省流表项的优先级高于所述虚拟网络的第四缺省流表项的优先级，以便在没有命中流表项的情况下优先根据所述虚拟网络的第三缺省流表项的指示依据所述第一流表发送所述第一数据报文。
在一种可能的设计中，所述转发设备确定所述控制器故障恢复的情况下，设置所述虚拟网络的第四缺省流表项的优先级高于所述虚拟网络的第三缺省流表项的优先级，以便在没有命中流表项的情况下优先根据所述虚拟网络的第四缺省流表项的指示依据所述第二流表发送所述第一数据报文。
通过预先调整所述虚拟网络的第三缺省流表项的优先级高于所述虚拟网络的第四缺省流表项，例如，在预先确认控制器故障后，灵活地调整缺省流表项的优先级，这样可以在收到报文后，直接匹配优先级高的所述第三缺省流表项，而不用等到接收到报文后，再确认控制器的状态，然后确定使用的缺省流表项，从而可以提高报文的转发效率。并在获知控制器状态更新后，例如故障恢复后，及时调整所述第四缺省流表项的优先级高于所述第三缺省流表项的优先级，从而可以提高报文的转发效率，并且进一步保障系统的可靠性和稳定性。
在一种可能的设计中，所述转发设备确定所述控制器正常工作的情况下，设置所述虚拟网络的第三缺省流表项的优先级高于所述虚拟网络的第四缺省流表项的优先级，以便在没有命中流表项的情况下优先根据所述虚拟网络的第三缺省流表项的指示依据所述第一流表发送所述第一数据报文。
在控制器正常工作的情况下，也可以根据设计要求或应用场景，通过调整所述第三缺 省流表项的优先级高于所述第四缺省流表项的优先级，使得报文在没有命中匹配项的情况下，也可以灵活地被依据所述第一缺省流表项向指定的转发设备发送，增强了系统的按需设置的灵活性。
在一种可能的设计中，所述设置所述虚拟网络的第三缺省流表项的优先级高于所述虚拟网络的第四缺省流表项的优先级包括：所述转发设备修改所述虚拟网络的第三缺省流表项的优先级，使所述虚拟网络的第三缺省流表项的优先级高于所述虚拟网络的第四缺省流表项的优先级；或者所述转发设备修改所述虚拟网络的第四缺省流表项的优先级，使所述第四缺省流表项的优先级低于所述虚拟网络的第三缺省流表项的优先级。
通过调高虚拟网络的第三缺省流表项的优先级或者调低虚拟网络的第四缺省流表项的优先级，提供了一种灵活简便的设置优先级的手段，有助于快捷地实现了控制器故障后，保证该第三缺省流表项能够被选用，从而能够跳转到所述虚拟网络的第一缺省流表项去转发数据报文，从而保证数据流不中断。
在一种可能的设计中，所述虚拟网络的第一缺省流表项为在三层虚拟网络内指导三层转发的流表项；所述将所述虚拟网络内的数据报文向指定的转发设备发送具体为将所述三层虚拟网络内的数据报文向保存有所述三层虚拟网络内的全部或部分路由转发信息的转发设备发送。
通过设置所述三层虚拟网络的第一缺省流表项的动作为向保存有所述三层虚拟网络内的全部或部分路由转发信息的转发设备发送，提供了一种在三层虚拟网络中控制器故障后的，使数据报文转发不中断的方法，提升了三层虚拟网络转发的可靠性。
在一种可能的设计中，所述虚拟网络的第一缺省流表项为在二层虚拟网络内指导二层转发的流表项；所述将所述虚拟网络内的数据报文向指定的转发设备发送具体为将所述二层虚拟网络内的数据报文向所述二层虚拟网络内的转发设备广播发送。
通过设置所述二层虚拟网络的第一缺省流表项的动作为向所述二层虚拟网络内的转发设备广播发送，提供了一种在二层虚拟网络中控制器故障后的，使数据报文转发不中断的方法，提升了二层虚拟网络转发的可靠性。
本发明实施例第二方面提供一种发送流表项的方法，应用于控制转发分离的虚拟网络中，所述虚拟网络包括控制器和转发设备。在所述方法中，所述控制器生成所述虚拟网络的第一缺省流表项，所述虚拟网络的第一缺省流表项指示所述转发设备在所述控制器发生故障以及所述转发设备根据所述虚拟网络内的数据报文的匹配项查找流表并且没有命中流表项的情况下，将所述虚拟网络内的数据报文向指定的转发设备发送，或指示所述转发设备在所述控制器正常工作以及所述转发设备根据所述虚拟网络内的数据报文的匹配项查找流表并且没有命中流表项的情况下，将所述虚拟网络内的数据报文向所述指定的转发设备发送；所述控制器生成所述虚拟网络的第二缺省流表项，所述虚拟网络的第二缺省流表项指示所述转发设备在控制器正常工作以及所述转发设备根据所述虚拟网络内的数据报文的匹配项查找所述流表并且没有命中流表项的情况下，将所述虚拟网络内的数据报文向所述控制器；所述控制器向所述转发设备发送所述虚拟网络的第一缺省流表项和所述虚拟网络的第二缺省流表项。
通过控制器生成和下发所述虚拟网络的第一和二缺省流表项，使控制器正常工作和故 障后，都能使转发设备可以正常转发数据报文，避免了数据流中断，提升了系统的可靠性。
在一种可能的设计中，所述虚拟网络的第一缺省流表项为第一流表中的表项，所述指示所述转发设备在控制器发生故障以及转发设备根据所述虚拟网络内的数据报文的匹配项查找所述流表并且没有命中流表项具体为查找所述第一流表并且没有命中流表项；所述虚拟网络的第二缺省流表项为所述第一流表中的表项，所述指示所述转发设备在控制器正常工作以及转发设备根据所述虚拟网络内的数据报文的匹配项查找所述流表并且没有命中流表项具体为查找所述第一流表并且没有命中流表项。
通过设置所述虚拟网络的第一缺省流表项和所述虚拟网络的第二缺省流表项在同一流表中，提供了一种高效的实现方式，提高了流表项的匹配效率。此外，通过设置调整所述第一和二缺省流表项的优先级，可以根据控制器正常工作、故障、故障恢复等不同的状态采用不同的匹配策略，从而提高系统的灵活性。
在一种可能的设计中，所述虚拟网络的第一缺省流表项为第一流表中的表项，所述指示所述转发设备在控制器发生故障以及转发设备根据所述虚拟网络内的数据报文的匹配项查找所述流表并且没有命中流表项具体为查找所述第一流表并且没有命中流表项；所述虚拟网络的第二缺省流表项为第二流表中的表项，所述指示所述转发设备在控制器正常工作以及转发设备根据所述虚拟网络内的数据报文的匹配项查找所述流表并且没有命中流表项具体为查找所述第二流表并且没有命中流表项。
通过设置所述虚拟网络的第一缺省流表项和所述虚拟网络的第二缺省流表项在不同的流表中，提供了一种易于扩展流表的实现方式，提高了系统的可维护性。并且在控制器正常工作和故障后，都能使转发设备可以正常转发数据报文，避免了数据流中断，提升了系统的可靠性。
在一种可能的设计中，所述控制器生成所述虚拟网络的第三缺省流表项，所述虚拟网络的第三缺省流表项指示所述转发设备在控制器发生故障以及所述转发设备根据所述虚拟网络内的数据报文的匹配项查找第三流表并且没有命中流表项的情况下，将所述虚拟网络内的数据报文依据所述第一流表发送；所述控制器向所述转发设备发送所述虚拟网络的第三缺省流表项。
通过设置与所述虚拟网络的第一缺省流表项和所述虚拟网络的第二缺省流表项在不同流表中的所述虚拟网络的第三缺省流表项，提供了一种易于扩展流表的实现方式，提高了系统的可维护性。通过所述第三缺省流表项，使控制器故障时，转发设备可以根据该第三缺省流表项跳转到所述虚拟网络的第一缺省流表项进行数据报文的正常转发，避免数据流的中断。
在一种可能的设计中，所述控制器生成所述虚拟网络的第四缺省流表项，所述虚拟网络的第四缺省流表项指示所述转发设备在控制器正常工作以及所述转发设备根据所述虚拟网络内的数据报文的匹配项查找所述第三流表并且没有命中流表项的情况下，将所述虚拟网络内的数据报文依据所述第二流表发送；所述控制器向所述转发设备发送所述虚拟网络的第四缺省流表项。
通过设置与所述虚拟网络的第三缺省流表项在同一流表、与所述第一和第二缺省流表项不在同一流表中的所述虚拟网络的第四缺省流表项，提供了一种易于扩展流表的实现方式，提高了系统的可维护性。通过设置、调整所述第三和四缺省流表项的优先级，可以根 据控制器正常工作、故障、故障恢复等不同的状态采用不同的匹配策略，从而提高系统的灵活性。
在一种可能的设计中，所述虚拟网络的第一缺省流表项为在三层虚拟网络内指导三层转发的流表项；所述将所述虚拟网络内的数据报文向指定的转发设备发送具体为将所述三层虚拟网络内的数据报文向保存有所述三层虚拟网络内的全部或部分路由转发信息的转发设备发送。
通过设置所述三层虚拟网络的第一缺省流表项的动作为向保存有所述三层虚拟网络内的全部或部分路由转发信息的转发设备发送，提供了一种在三层虚拟网络中控制器故障后的，使数据报文转发不中断的方法，提升了三层虚拟网络转发的可靠性。
在一种可能的设计中，所述虚拟网络的第一缺省流表项为在二层虚拟网络内指导二层转发的表项；所述将所述虚拟网络内的数据报文向指定的转发设备发送具体为将所述二层虚拟网络内的数据报文向所述二层虚拟网络内的转发设备广播发送。
通过设置所述二层虚拟网络的第一缺省流表项的动作为向所述二层虚拟网络内的转发设备广播发送，提供了一种在二层虚拟网络中控制器故障后的，使数据报文转发不中断的方法，提升了二层虚拟网络转发的可靠性。
第三方面，本发明提供一种转发设备，所述转发设备用于执行第一方面或第一方面的任意可能的实现方式中的方法。具体地，所述转发设备包括用于执行第一方面或第一方面的任意可能的实现方式中的方法的模块。
第四方面，本发明提供一种转发设备，所述转发设备包括：处理器、收发器、随机存取存储器、只读存储器以及总线。其中，处理器通过总线分别耦接发送器、随机存取存储器以及只读存储器。其中，当需要运行转发设备时，通过固化在只读存储器中的基本输入输出系统或者嵌入式系统中的bootloader引导系统进行启动，引导转发设备进入正常运行状态。在转发设备进入正常运行状态后，在随机存取存储器中运行应用程序和操作系统，使得该处理器执行第一方面或第一方面的任意可能的实现方式中的方法。
第五方面，提供一种转发设备，所述转发设备包括：主控板和接口板，进一步，还可以包括交换网板。所述转发设备用于执行第二方面或第二方面的任意可能的实现方式中的方法。具体地，所述转发设备包括用于执行第一方面或第一方面的任意可能的实现方式中的方法的模块。
第六方面，本发明提供一种计算机可读介质，用于存储计算机程序，该计算机程序包括用于执行第一方面或第一方面的任意可能的实现方式中的方法的指令。
第七方面，本发明提供一种控制器，所述控制器用于执行第二方面或第二方面的任意可能的实现方式中的方法。具体地，所述控制器包括用于执行第二方面或第二方面的任意可能的实现方式中的方法的模块。
第八方面，本发明提供一种控制器，所述控制器包括：处理器、收发器、随机存取存储器、只读存储器以及总线。其中，处理器通过总线分别耦接发送器、随机存取存储器以及只读存储器。其中，当需要运行控制器时，通过固化在只读存储器中的基本输入输出系统或者嵌入式系统中的bootloader引导系统进行启动，引导控制器进入正常运行状态。在控制器进入正常运行状态后，在随机存取存储器中运行应用程序和操作系统，使得该处理器执行第二方面或第二方面的任意可能的实现方式中的方法。
第九方面，本发明提供一种计算机可读介质，用于存储计算机程序，该计算机程序包括用于执行第二方面或第二方面的任意可能的实现方式中的方法的指令。
第十方面，提供一种系统，所述系统包括第三方面至第六方面任一的转发设备和第七方面至第九方面任一的控制器。
附图说明
为了更清楚地说明本发明实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍。显而易见地，下面附图中反映的仅仅是本发明的一部分实施例，对于本领域普通技术人员来讲，在不付出创造性劳动性的前提下，还可以根据这些附图获得本发明的其他实施方式。而所有这些实施例或实施方式都在本发明的保护范围之内。
图1是本发明实施例的一种网络示意图；
图2是本发明实施例中一种转发数据报文的方法流程交互示意图；
图3a是本发明实施例中另一种转发数据报文的方法流程交互示意图；
图3b是本发明实施例中又一种转发数据报文的方法流程交互示意图；
图4是本发明实施例中流表跳转关系的示意图；
图5a是本发明实施例中的一种转发设备的结构示意图；
图5b是本发明实施例中的另一种转发设备的结构示意图；
图5c是本发明实施例中的又一种转发设备的结构示意图；
图6a是本发明实施例中的一种控制器的结构示意图；
图6b是本发明实施例中的另一种控制器的结构示意图；
图7是本发明实施例中的一种网络系统示意图。
具体实施方式
下面将结合附图，对本发明实施例中的技术方案进行清楚、完整地描述。显然，所描述的实施例仅仅是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有付出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
本发明实施例描述的网络架构以及业务场景是为了更加清楚的说明本发明实施例的技术方案，并不构成对于本发明实施例提供的技术方案的限定，本领域普通技术 人员可知，随着网络架构的演变和新业务场景的出现，本发明实施例提供的技术方案对于类似的技术问题，同样适用。
云计算时代的数据中心(英文：Data Center，DC)网络向着基于控制转发分离思想的软件定义网络(英文:Software Defined Network,SDN)架构和网络虚拟化的方向演进。在基于SDN的DC网络中，控制器对DC网络中的转发设备进行集中管控，并通常采用叠加(英文：Overlay)网络技术来实现DC网络虚拟化。Overlay网络是物理网络之上的虚拟网络。
如图1所示，基于SDN架构的DC网络采用集中控制器对转发设备进行控制，接入该数据中心网络的终端类型包括但不限于虚拟机(英文：virtual machine,VM)、物理主机、物理服务器等，这些终端本文统称为端系统(英文：end system，ES)。转发设备可以为物理交换机、物理路由器，或者为嵌入在物理服务器中、基于软件虚拟化技术的虚拟交换机(英文：virtual Switch，vSwitch)、虚拟路由器(英文：virtual Router，vRouter)。图1中ES1和ES2通过转发设备1接入DC网络，ES3和ES4通过转发设备2接入DC网络，ES5和ES6通过转发设备3接入DC网络。ES1至ES6通过集中转发设备访问广域网(英语：Wide Area Network，WAN)，WAN也叫外网或公网，该集中转发设备是连接DC网络与WAN的边界转发设备(或网关设备)，通常交换容量、转发性能相对比接入转发设备(如转发设备1、2和3)要高。
当前主流的数据中心网络虚拟化的技术框架，例如，为三层网络虚拟化(英文：Network Virtualization over Layer 3，NVo3)。NVo3是一种三层网络之上的Overlay网络技术，它基于互联网协议(英文：Internet Protocol，IP)/多协议标记交换(Multi-Protocol Label Switching，MPLS)作为传输网，在其上通过隧道连接的方式，构建大规模的二层租户网络。NVO3包括多种隧道封装实现技术，例如，常用的是虚拟扩展局域网(Virtual eXtensible Local Area Network，VXLAN)和基于通用路由封装协议的网络虚拟化(Network Virtualization over Generic Routing Encapsulation，NVGRE)。通过NVo3技术可以在数据中心的物理网络上虚拟划分出多个Overlay的虚拟网络，每个虚拟网络就是一个虚拟网络实例(英文：Virtual Network Instance，VNI)。虚拟网络的边缘节点为网络虚拟边缘(Network Virtualization Edge，NVE)节点，例如图1中所示的转发设备1、2、3、集中转发设备。NVE节点之间为相应的Overlay虚拟网络创建Overlay隧道(如VxLAN隧道或者NVGRE隧道)连接。接入虚拟网络的原始数据报文在NVE节点上进行隧道封装。该封装标识了解封装的转发设备(即NVE)，在将封装后的数据报文发送到目的ES之前，该解封装的转发设备将对该封装后的数据报文进行解封装，得到原始数据报文。位于隧道中间的转发设备基于封装的外层报文头来转发该封装后的数据报文，不关心内部携带的原始数据帧。虚拟网络标识符(英文：Virtual Network Identifier，VNID)可以封装到叠加头(即所述封装的外层报文头)中，用来标识数据帧所属的虚拟网络。因为虚拟数据中心既支持路由，也支持桥接，叠加报头内部的原始数据报文可以是带有媒体接入控制(Media Access Control，MAC)地址的以太帧(即在二层虚拟网络内转发的数据报文)，或者仅仅是IP报文(即在三层虚拟网络内转发的数据报文)。值得说明的是，为了描述的简洁，二层以太网帧和三层IP报文在本申请中统称为数据报文。
虚拟网络包括三层虚拟网络和二层虚拟网络，每个三层虚拟网络内可以包括一个或多个二层虚拟网络，每个二层虚拟网络内ES之间通过二层流表(如，流表的匹配项包括MAC地址)进行互相通信(如，根据二层VNID和目的MAC地址进行查找转发)，每个二层虚拟网络一般对应一个子网(英文：subnet)，每个三层虚拟网络内跨子网ES之间通过三层流表(如，流表的匹配项包括IP地址)进行三层通信(如，根据三层VNID和目的IP地址进行查找转发)。不同二层虚拟网络内的ES MAC地址可以重叠，不同三层虚拟网络内的ES IP地址可以重叠。对于采用overlay隧道封装的数据中心，二或三层流表都是位于网络的边缘转发设备,网络中间的转发设备只基于封装之后的外层隧道目的IP进行转发，没有对应的转发流表。如图1所示，ES1、ES2、ES3、ES4、ES5和ES6属于同一个三层虚拟网络，其中ES1、ES3和ES5属于二层虚拟网络A，ES2、ES4和ES6属于二层虚拟网络B。
控制器上拥有整网(包括物理网络、二层虚拟网络、三层虚拟网络等)的拓扑图，转发设备上的二或三层转发流表由所述控制器根据该拓扑图集中计算生成，并通过控制通道协议进行统一下发。所述控制器可以通过Push和Pull两种模式将二或三层流表下发给所述转发设备。对于Push模式，不管所述转发设备是否需要该流表，控制器都将所有流表下发给所有转发设备。例如图1，控制器会将每个虚拟网络内的二或三层流表项下发给该虚拟网络关联的所有转发设备，比如转发设备1、2和3分别连接三层虚拟网络A、二层虚拟网络B和C，则控制器会将三层虚拟网络A的所有三层流表项、二层虚拟网络B和C内的所有二层流表项分别下发给转发设备1、2和3。对于Push模式，转发设备上需要安装大量的二或三层流表项，对转发设备流表空间要求很高，也增加了控制通道的负荷，因此很多控制器采用Pull模式进行流表项下发。
对于Pull模式，控制器是按需下发流表项到对应的转发设备。入口转发设备(如图1，转发设备1)从接入侧(如图1，ES1)收到数据报文之后，如果没有到达目的ES(如图1，ES3或ES4)的流表项，则报文会命中缺省流表项，通过缺省流表项将报文重定向到控制器。控制器解析数据报文，根据该数据报文的目的MAC地址(如图1，ES3的MAC地址)或IP地址(如图1，ES4的IP地址)获取到关联的出口转发设备(如图1，转发设备2)信息，将对应的二或三层流表项下发给该入口转发设备，然后将该数据报文再重新发送给该入口转发设备，该入口转发设备根据该新的流表项将报文转发到该出口转发设备，该出口转发设备再将该数据报文送往该目的ES。该入口转发设备上的该二或三层流表项一般会定期老化，老化之后该入口转发设备会将该流表项删除，这样后续收到的报文又重复上面的流程，即上送控制器、下发流表项、转发设备安装流表项、转发报文。
如果控制器故障，该入口转发设备收到数据报文之后，如果没有目的ES对应的流表项，则无法将该数据报文重定向送达到该故障的控制器。该故障的控制器也无法为该数据报文的匹配项生成流表项，因此，该入口转发设备无法获得流表项，也就无法将该数据报文向目的ES转发，转发流程中断，ES之间无法正常进行二或三层通信。
上面描述了本发明涉及的可能的应用场景，下面将基于此对本发明实施例进一步详细说明。
图2为本发明实施例提供的一种转发数据报文的方法流程示意图，该方法可以应用于图1所示的应用场景中。
本发明实施例提供的方案包括22-01部分、22-02部分、21-01部分、21-02部分和21-03部分，其中22-01部分和22-02部分在控制器上执行，21-01部分、21-02部分和21-03部分在转发设备上执行，下面分别说明。
在22-01部分，所述控制器生成虚拟网络的第一缺省流表项，所述虚拟网络的第一缺省流表项指示所述转发设备根据所述虚拟网络内的数据报文的匹配项查找第一流表并且没有命中流表项的情况下，将所述虚拟网络内的数据报文向指定的转发设备发送。在所述控制器发生故障时，所述虚拟网络的第一缺省流表项被转发设备使用去转发所述虚拟网络内的数据报文。
可选地，在所述控制器正常工作的情况下，所述虚拟网络的第一缺省流表项也可以被转发设备使用去转发所述虚拟网络内的数据报文。
在22-02部分，所述控制器向所述转发设备发送所述虚拟网络的第一缺省流表项。
通过控制器生成和下发所述虚拟网络的第一缺省流表项，使控制器故障后，能使转发设备可以正常转发数据报文，避免了数据流中断，提升了系统的可靠性。
可选地，所述控制器还生成并向所述转发设备发送所述虚拟网络的第二缺省流表项，所述虚拟网络的第二缺省流表项指示所述转发设备根据所述虚拟网络内的数据报文的匹配项查找流表并且没有命中流表项的情况下，将所述虚拟网络内的数据报文向所述控制器发送。在所述控制器正常工作(可以包括所述控制器首次启动后正常工作和所述控制器故障恢复后正常工作)的情况下，所述虚拟网络的第二缺省流表项被转发设备使用去转发所述虚拟网络内的数据报文。所述虚拟网络的第二缺省流表项可以是所述第一流表中的一条表项(即所述转发设备根据所述虚拟网络内的数据报文的匹配项查找流表并且没有命中流表项具体为查找所述第一流表)，也可以是第二流表中的一条表项(即所述转发设备根据所述虚拟网络内的数据报文的匹配项查找流表并且没有命中流表项具体为查找所述第二流表)。
当所述虚拟网络的第二缺省流表项是所述第一流表中的一条表项时，所述虚拟网络的第一缺省流表项和所述虚拟网络的第二缺省流表项是同一流表中的两条不同的流表项。根据控制器正常或故障的状态，这两条缺省流表项分别被选中去转发数据报文。此种情况下，使用缺省表项的具体方法可以参见下文图3a部分所述。
可选地，当所述控制器故障时，通过设置、调整所述第一缺省流表项的优先级大于所述第二缺省流表项的优先级，在查表没有命中表项的情况下，可以优先选用所述虚拟网络的第一缺省流表项，向所述指定的转发设备发送数据报文。当所述控制器正常工作时，也可以根据用户的具体需要，通过设置、调整所述第一缺省流表项的优先级大于所述第二缺省流表项的优先级，在查表没有命中表项的情况下，可以优先选用所述虚拟网络的第一缺省流表项，向所述指定的转发设备发送数据报文。当所述控制器首次启动或者工作一段时间故障后、又恢复正常工作时，通过设置、调整所述第二缺省流表项的优先级大于所述第一缺省流表项的优先级，在查表没有命中表项的情况下，可以优先选用所述虚拟网络的第二缺省流表项，向所述控制器发送数据报文。
通过设置所述虚拟网络的第一缺省流表项和所述虚拟网络的第二缺省流表项在同一流表中，提供了一种高效的实现方式，提高了流表项的匹配效率。通过所述第二缺省流表项，能使控制器正常工作时，转发设备将数据报文发送到控制器，实现Pull模式下按需下发流表项，从而节省转发设备的存储空间。通过设置调整所述第一和二缺省流表项的优先级，可以根据控制器正常工作、故障、故障恢复等不同的状态采用不同的匹配策略，从而提高系统的灵活性。
当所述虚拟网络的第二缺省流表项是所述第二流表中的一条表项时，所述虚拟网络的第一缺省流表项和所述虚拟网络的第二缺省流表项分别是两个不同的流表中的流表项。
通过设置所述虚拟网络的第一缺省流表项和所述虚拟网络的第二缺省流表项在不同的流表中，提供了一种易于扩展流表的实现方式，提高了系统的可维护性。通过所述第二缺省流表项，能使控制器正常工作时，转发设备将数据报文发送到控制器，实现Pull模式下按需下发流表项，从而节省转发设备的存储空间。
此时，可选地，所述控制器还生成并向所述转发设备发送所述虚拟网络的第三缺省流表项，所述虚拟网络的第三缺省流表项指示所述转发设备根据所述虚拟网络内的数据报文的匹配项查找第三流表并且没有命中流表项的情况下，将所述虚拟网络内的数据报文依据所述第一流表发送。在控制器发生故障时，所述虚拟网络的第三缺省流表项被转发设备使用去转发所述虚拟网络内的数据报文。
通过设置与所述虚拟网络的第一缺省流表项和所述虚拟网络的第二缺省流表项在不同流表中的所述虚拟网络的第三缺省流表项，提供了一种易于扩展流表的实现方式，提高了系统的可维护性。通过所述第三缺省流表项，使控制器故障时，转发设备可以根据该第三缺省流表项跳转到所述虚拟网络的第一缺省流表项进行数据报文的正常转发，避免数据流的中断。
进一步，可选地，所述控制器还生成并向所述转发设备发送所述虚拟网络的第四缺省流表项，所述虚拟网络的第四缺省流表项指示所述转发设备根据所述虚拟网络内的数据报文的匹配项查找所述第三流表并且没有命中流表项的情况下，将所述虚拟网络内的数据报文依据所述第二流表发送。在控制器正常工作时，所述虚拟网络的第四缺省流表项被转发设备使用去转发所述虚拟网络内的数据报文。
可选地，根据所述控制器正常或故障的状态，以及用户的需要，通过灵活地设置所述第三和第四缺省流表项的优先级，来控制这四条缺省流表项分别被选中去转发数据报文。例如，当所述控制器故障时，通过设置、调整所述第三缺省流表项的优先级大于所述第四缺省流表项的优先级，在查表没有命中表项的情况下，可以优先选用所述第三、一缺省流表项，向所述指定的转发设备发送数据报文。当所述控制器正常工作时，也可以根据用户的具体需要，通过设置、调整所述第三缺省流表项的优先级大于所述第四缺省流表项的优先级，在查表没有命中表项的情况下，可以优先选用所述第三、一缺省流表项，向所述指定的转发设备发送数据报文。当所述控制器首次启动或者工作一段时间故障后、又恢复正常工作时，通过设置、调整所述第四缺省流表项的优先级大于所述第三缺省流表项的优先级，在查表没有命中表项的情况下，可以优先选用所述第四、二缺省流表项，向控制器发送数据报文。此种情况下，使用缺省表 项的具体方法可以参见下文图3b部分所述。
通过设置与所述虚拟网络的第三缺省流表项在同一流表中的所述虚拟网络的第四缺省流表项，提供了一种便于维护、扩展流表的实现方式。通过设置、调整所述第三和四缺省流表项的优先级，可以根据控制器正常工作、故障、故障恢复等不同的状态采用不同的匹配策略，从而提高系统的灵活性。
可选地，所述虚拟网络的第一缺省流表项为在三层虚拟网络内指导三层转发的表项。所述将所述虚拟网络内的数据报文向指定的转发设备发送具体为将所述三层虚拟网络内的数据报文向保存有所述三层虚拟网络内的全部或部分路由转发信息的转发设备发送。相应地，所述虚拟网络的第二或三、四缺省流表项也为在三层虚拟网络内指导三层转发的表项。
通过设置所述三层虚拟网络的第一缺省流表项的动作为向保存有所述三层虚拟网络内的全部或部分路由转发信息的转发设备发送，提供了一种在三层虚拟网络中控制器故障后的，使数据报文转发不中断的方法，提升了三层虚拟网络转发的可靠性。
可选地，所述虚拟网络的第一缺省流表项为在二层虚拟网络内指导二层转发的表项。所述将所述虚拟网络内的数据报文向指定的转发设备发送具体为将所述二层虚拟网络内的数据报文向所述二层虚拟网络内的转发设备广播发送。相应地，所述虚拟网络的第二或三、四缺省流表项也为在二层虚拟网络内指导二层转发的表项。
通过设置所述二层虚拟网络的第一缺省流表项的动作为向所述二层虚拟网络内的转发设备广播发送，提供了一种在二层虚拟网络中控制器故障后的，使数据报文转发不中断的方法，提升了二层虚拟网络转发的可靠性。
在21-01部分，所述转发设备接收来自所述控制器的所述虚拟网络的第一缺省流表项，并将所述流表项保存到所述第一流表中。
可选地，所述转发设备还接收来自控制器的所述虚拟网络的第二缺省流表项，所述虚拟网络的第二缺省流表项可以被保存到所述第一流表中，是所述第一流表中的一条表项；也可以被保存到第二流表中，是所述第二流表中的一条表项。所述虚拟网络的第二缺省流表项的定义和描述与上述控制器侧22-01和22-02部分的描述一致，此处不再赘述。
当所述虚拟网络的第二缺省流表项和所述虚拟网络的第一缺省流表项都是所述第一流表中的表项时，所述虚拟网络的第二缺省流表项的优先级高于所述虚拟网络的第一缺省流表项的优先级。此种情况下，使用缺省表项的具体方法可以参见下文图3a部分所述。
通过设置所述虚拟网络的第一缺省流表项和所述虚拟网络的第二缺省流表项在同一流表中，提供了一种高效的实现方式，提高了流表项的匹配效率。通过所述第二缺省流表项，能使控制器正常工作时，转发设备将数据报文发送到控制器，实现Pull模式下按需下发流表项，从而节省转发设备的存储空间。此外，通过设置调整所述第一和二缺省流表项的优先级，还可以根据控制器正常工作、故障、故障恢复等不同的状态采用不同的匹配策略，从而提高系统的灵活性(详见下文21-03部分方式一所述)。
当所述虚拟网络的第一缺省流表项和所述虚拟网络的第二缺省流表项分别是两 个不同的流表中的流表项时，所述转发设备还接收来自控制器的所述虚拟网络的第三、四缺省流表项，并将所述虚拟网络的第三、四缺省流表项保存到所述第三流表中。其中，所述虚拟网络的第四缺省流表项的优先级大于所述虚拟网络的第三缺省流表项的优先级。所述虚拟网络的第三、四缺省流表项的定义和描述与上述控制器侧22-01和22-02部分的描述一致，此处不再赘述。此种情况下，使用缺省表项的具体方法可以参见下文图3b部分所述。
通过设置与所述虚拟网络的第三缺省流表项在同一流表中、与所述第一和第二缺省流表项不在同一流表中的所述虚拟网络的第四缺省流表项，提供了一种便于扩展流表的实现方式，提高了系统的可维护性。通过灵活的设置所述第四缺省流表项的优先级高于所述第三缺省流表项的优先级，使得转发设备在控制器正常工作，但在流表中匹配接收报文的匹配项时没有命中的情况下，可以根据相应流表项的优先级灵活地跳转到所述第二缺省流表项去进一步向控制器发送报文，从而实现按需下发流表项、节约转发设备的存储空间。此外，通过设置调整所述第三和第四缺省流表项的优先级，还可以根据控制器正常工作、故障、故障恢复等不同的状态采用不同的匹配策略，从而提高系统的灵活性(详见下文21-03部分方式二所述)。
在21-02部分，所述转发设备接收来自端系统ES的所述虚拟网络内的第一数据报文。
在21-03部分，在所述控制器发生故障，并且所述转发设备根据所述第一数据报文的匹配项查找所述第一流表并且没有命中流表项的情况下，所述转发设备使用所述虚拟网络的第一缺省流表项向所述指定的转发设备发送所述第一数据报文。
可选地，当转发设备检测到控制器发生故障(例如，通过开放流(英文：OpenFlow)等协议能够感知和控制器之间的协议连接中断)时，所述转发设备可以通过设置缺省流表项的优先级来优先选择所述第一缺省流表项进行数据报文的转发。具体地，分以下两种方式描述。
方式一、当所述虚拟网络的第二缺省流表项和所述虚拟网络的第一缺省流表项都是所述第一流表中的表项时，在所述转发设备确定所述控制器故障的情况下，灵活地设置所述虚拟网络的第一缺省流表项的优先级高于所述虚拟网络的第二缺省流表项的优先级，以便优先使用所述虚拟网络的第一缺省流表项向所述指定的转发设备发送所述第一数据报文。此外，在所述转发设备确定所述控制器故障恢复的情况下，还可以灵活地设置所述虚拟网络的第二缺省流表项的优先级高于所述虚拟网络的第一缺省流表项的优先级，以便在没有命中流表项的情况下优先使用所述虚拟网络的第二缺省流表项向所述控制器发送所述第一数据报文。此种情况下，使用缺省表项的具体方法可以参见下文图3a部分所述。
通过预先调整虚拟网络的第一缺省流表项的优先级高于虚拟网络的第二缺省流表项，例如，在预先确认控制器故障后，灵活地调整缺省流表项的优先级，这样可以在收到报文后，直接匹配优先级高的所述第一缺省流表项，而不用等到接收到报文后，再确认控制器的状态，然后确定使用的缺省流表项，从而可以提高报文的转发效率。并在获知控制器状 态更新后，例如故障恢复后，及时调整所述第二缺省流表项的优先级高于所述第一缺省流表项的优先级，直接匹配优先级高的所述第二缺省流表项，从而可以提高报文的转发效率，并且进一步保障系统的可靠性和稳定性。可以理解，从获知控制器状态实时性方面而言，也可以在收到报文后，查询控制器的状态，并在确认为控制器故障后，使用第一缺省流表项作为报文转发的依据。
可选地，在所述转发设备确定所述控制器正常工作的情况下，也可以根据设计要求或应用场景，灵活地设置所述虚拟网络的第一缺省流表项的优先级高于所述虚拟网络的第二缺省流表项的优先级，以便在没有命中流表项的情况下优先使用所述虚拟网络的第一缺省流表项向所述指定的转发设备发送所述第一数据报文，从而增强了系统按需设置的灵活性。
可选地，所述转发设备修改所述虚拟网络的第一缺省流表项的优先级，使所述虚拟网络的第一缺省流表项的优先级高于所述虚拟网络的第二缺省流表项的优先级。或者所述转发设备修改所述虚拟网络的第二缺省流表项的优先级，使所述第二缺省流表项的优先级低于所述虚拟网络的第一缺省流表项的优先级。
通过调高虚拟网络的第一缺省流表项的优先级或者调低虚拟网络的第二缺省流表项的优先级，提供了一种灵活简便的设置优先级的手段，有助于快捷地实现了控制器故障后，保证该第一缺省流表项能够被选用去转发数据报文。
方式二、当所述虚拟网络的第一缺省流表项和所述虚拟网络的第二缺省流表项分别是两个不同的流表中的流表项时，在所述转发设备确定所述控制器故障的情况下，灵活地设置所述虚拟网络的第三缺省流表项的优先级高于所述虚拟网络的第四缺省流表项的优先级，以便优先使用所述虚拟网络的第三缺省流表项向所述第一流表发送所述第一数据报文。此外，在所述转发设备确定所述控制器故障恢复的情况下，还可以灵活地设置所述虚拟网络的第四缺省流表项的优先级高于所述虚拟网络的第三缺省流表项的优先级，以便在没有命中流表项的情况下优先根据所述虚拟网络的第四缺省流表项的指示依据所述第二流表发送所述第一数据报文。此种方式下，使用缺省表项的具体方法可以参见下文图3b部分所述。
通过预先调整所述虚拟网络的第三缺省流表项的优先级高于所述虚拟网络的第四缺省流表项，例如，在预先确认控制器故障后，灵活地调整缺省流表项的优先级，这样可以在收到报文后，直接匹配优先级高的所述第三缺省流表项，而不用等到接收到报文后，再确认控制器的状态，然后确定使用的缺省流表项，从而可以提高报文的转发效率。并在获知控制器状态更新后，例如故障恢复后，及时调整所述第四缺省流表项的优先级高于所述第三缺省流表项的优先级，从而可以提高报文的转发效率，并且进一步保障系统的可靠性和稳定性。可以理解，从获知控制器状态实时性方面而言，也可以在收到报文后，查询控制器的状态，并在确认为控制器故障后，使用第三缺省流表项、作为报文转发的依据。
在所述转发设备确定所述控制器正常工作的情况下，也可以根据设计要求或应用场景，灵活地设置所述虚拟网络的第三缺省流表项的优先级高于所述虚拟网络的第四缺省流表项的优先级，以便在没有命中流表项的情况下优先根据所述虚拟网络的第三 缺省流表项的指示依据所述第一流表发送所述第一数据报文，增强了系统的按需设置的灵活性。
可选地，所述转发设备修改所述虚拟网络的第三缺省流表项的优先级，使所述虚拟网络的第三缺省流表项的优先级高于所述虚拟网络的第四缺省流表项的优先级。或者所述转发设备修改所述虚拟网络的第四缺省流表项的优先级，使所述第四缺省流表项的优先级低于所述虚拟网络的第三缺省流表项的优先级。
通过调高虚拟网络的第三缺省流表项的优先级或者调低虚拟网络的第四缺省流表项的优先级，提供了一种灵活简便的设置优先级的手段，有助于快捷地实现了控制器故障后，保证该第三缺省流表项能够被选用，从而能够跳转到所述虚拟网络的第一缺省流表项去转发数据报文，从而保证数据流不中断。
可选地，所述虚拟网络的第一缺省流表项为在三层虚拟网络内指导三层转发的表项或者在二层虚拟网络内指导二层转发的表项。具体描述与上述控制器侧22-01和22-02部分的描述一致，此处不再赘述。
图3a是缺省流表项为同一流表中的方法的交互流程示意图(是对图2方法实施例相关部分的举例细化)。下面结合附图1的场景，对本发明的该方法实施例进行说明。如图1所示，控制器会在转发设备1、2、3上为连接的ES创建二和/或三层虚拟网络，ES1、ES2、ES3、ES4、ES5和ES6属于同一个三层虚拟网络A(其VNID＝A)，其中ES1、ES3和ES5属于二层虚拟网络B(其VNID＝B)，ES2、ES4和ES6属于二层虚拟网络C(其VNID＝C)。ES1的MAC地址为MAC1，例如为E4:68:a3:fc:18:01，ES1的IP地址为IP1，例如为10.10.10.1/24。其它ES的MAC地址和IP地址如图1所示，不再赘述。转发设备1分别连接了属于二层虚拟网络B的ES1，属于二层虚拟网络C的ES2，属于三层虚拟网络A的ES 1和ES2。
下面以转发设备1分别在二层虚拟网络B和三层虚拟网络A中为例，描述所述控制器与转发设备1之间的交互处理过程。
在控制器按照Pull模式工作的情况下，创建二和/或三层虚拟网络成功之后，在控制器上执行以下步骤：
3a2-01、为转发设备1生成二或三层虚拟网络的第一缺省流表项，所述二或三层虚拟网络的第一缺省流表项指示所述转发设备1根据所述二或三层虚拟网络内的数据报文的匹配项查找第一流表并且没有命中流表项时，将所述二或三层虚拟网络内的数据报文向指定的转发设备发送。
在二层虚拟网络的示例中，如果二层虚拟网络为ES1、ES3和ES5构成的二层虚拟网络B，则转发设备1的二层虚拟网络B的第一缺省流表项(例如表1所示)指示转发设备1根据所述二层虚拟网络B内的数据报文的匹配项查找第一流表并且没有命中流表项时，将所述二层虚拟网络B内的数据报文向二层虚拟网络B内的转发设备广播发送，也就是向连接ES3的转发设备2和连接ES5的转发设备3发送。
表1
Figure PCTCN2018082435-appb-000001
Figure PCTCN2018082435-appb-000002
在三层虚拟网络的示例中，如果三层虚拟网络为ES1、ES2、ES3、ES4、ES5和ES6构成的三层虚拟网络A，则转发设备1的三层虚拟网络A的第一缺省流表项(例如表2所示)指示转发设备1根据所述三层虚拟网络A内的数据报文的匹配项查找第一流表并且没有命中流表项时，将所述三层虚拟网络A内的数据报文向保存有所述三层虚拟网络内的全部或部分路由转发信息的转发设备发送，也就是向集中转发设备发送。例如，集中转发设备和其它的转发设备1、2和3之间运行基于以太网虚拟专用网(Ethernet Virtual Private Network，EVPN)的BGP路由协议，从而集中转发设备可以获取整个三层网络的路由转发信息。如果转发设备1、2和/或3为虚拟转发设备，只有转发功能，没有控制面的功能，控制面的功能由独立的控制器完成，则集中转发设备和控制器之间运行该BGP路由协议，来收集该转发设备1、2和/或3的路由转发信息。
表2
Figure PCTCN2018082435-appb-000003
需要说明的是，所述虚拟网络的第一缺省流表项也可以理解为匹配项为VNID的流表项，或者匹配项为VNID和通配符的流表项。当用VNID和其它匹配项(如IP地址/MAC地址)组合查找流表无法精确命中时，则选用或命中该匹配项为VNID的流表项。该流表项可以理解为该VNID标识的虚拟网络中的缺省流表项，当该虚拟网络中的数据报文，查找流表，无法精确命中时，则选用该虚拟网络的缺省流表项进行转发。
3a2-02、发送所述二或三层虚拟网络的第一缺省流表项。
在二层虚拟网络的示例中，控制器将上述3a2-01步骤中生成的转发设备1的二层虚拟网络B的第一缺省流表项向转发设备1发送。
在三层虚拟网络的示例中，控制器将上述3a2-01步骤中生成的转发设备1的三层虚拟网络A的第一缺省流表项向转发设备1发送。
3a2-03、控制器为转发设备1生成二或三层虚拟网络的第二缺省流表项，所述二 或三层虚拟网络的第二缺省流表项指示所述转发设备根据所述二或三层虚拟网络内的数据报文的匹配项查找所述第一流表并且没有命中流表项时，将所述二或三层虚拟网络内的数据报文向所述控制器发送。所述二或三层虚拟网络的第一缺省流表项的优先级低于所述二或三层虚拟网络的第二缺省流表项的优先级。
在二层虚拟网络B的示例中，转发设备1的二层虚拟网络B的第二缺省流表项(例如表3所示)指示所述转发设备1根据所述二层虚拟网络B内的数据报文的匹配项查找所述第一流表并且没有命中流表项时，将所述二层虚拟网络内的数据报文向所述控制器发送。
表3
Figure PCTCN2018082435-appb-000004
同理，在三层虚拟网络的示例中，转发设备1的三层虚拟网络A的第二缺省流表项(例如表4所示)指示所述转发设备1根据所述三层虚拟网络内的数据报文的匹配项查找所述第一流表并且没有命中流表项时，将所述三层虚拟网络内的数据报文向所述控制器发送。
表4
Figure PCTCN2018082435-appb-000005
3a2-04、发送所述二或三层虚拟网络的第二缺省流表项。
在二层虚拟网络的示例中，控制器将上述3a2-03步骤中生成的转发设备1的二层虚拟网络B的第二缺省流表项向转发设备1发送。
在三层虚拟网络的示例中，控制器将上述3a2-03步骤中生成的转发设备1的三层虚拟网络A的第二缺省流表项向转发设备1发送。
需要说明的是，控制器生成所述二或三层虚拟网络的第一缺省流表项和第二缺省流表项的先后顺序没有限定，可以先生成所述第一缺省流表项，也可以先生成所述第二缺省流表项。控制器向转发设备1下发所述第一缺省流表项和所述第二缺省流表项的顺序也没有限定，可以先下发所述第一缺省流表项，也可以先下发所述第二缺省流表项，还可以将所述第一缺省流表项和所述第二缺省流表项放在一个消息里，同时下发到所述转发设备1。
在转发设备1上执行以下步骤：
3a1-01、接收所述二或三层虚拟网络的第一缺省流表项。
3a1-02、接收所述二或三层虚拟网络的第二缺省流表项。
在二层虚拟网络的示例中，转发设备1接收所述二层虚拟网络B的第一缺省流表项和第二缺省流表项，并保存到二层流表1(如表5所示)中。
表5
Figure PCTCN2018082435-appb-000006
此时，控制器正常工作，ES1发起到ES3的二层单播通信流程。ES1发起的去往ES3的首包(即第一个数据报文)到达转发设备1时，转发设备1用虚拟网络标识为B和目的MAC为MAC3的匹配项，查找二层流表1(如表5)，且没能精确命中流表项，于是先命中了所述二层虚拟网络B的第一缺省流表项和第二缺省流表项，因为所述第二缺省流表项的优先级比所述第一缺省流表项更高，所以最终命中所述第二缺省流表项，并执行将去往ES3的数据报文向控制器发送的动作。控制器收到该去往ES3的数据报文后，为转发设备1生成虚拟网络B中的去往MAC3的二层流表项(例如表6所示)。然后将该去往MAC3的二层流表项下发到转发设备1的二层流表1中。转发设备1后续再接收到来自ES1的去往ES3的数据报文时，直接用VNID为B和目的MAC为MAC3的匹配项查找二层流表1，并精确命中该去往MAC3的二层流表项，执行相应的动作，将报文通过Overlay隧道(如VxLAN隧道)封装，向与ES3相连的转发设备2发送。
表6
Figure PCTCN2018082435-appb-000007
在三层虚拟网络的示例中，转发设备1接收所述三层虚拟网络A的第一缺省流表项和第二缺省流表项，并保存到三层流表1(如表7所示)中。
表7
Figure PCTCN2018082435-appb-000008
此时，控制器正常工作，ES1发起到ES4的三层单播通信流程。ES1发起的首包(即第一个数据报文)到达转发设备1时，转发设备1用虚拟网络标识为A和目的IP为IP4的匹配项，查找三层流表1(如表7)，且没能精确命中流表项，于是先命中了所述三层虚拟网络A的第一缺省流表项和第二缺省流表项，因为所述第二缺省流表项的优先级比所述第一缺省流表项更高，所以最终命中所述第二缺省流表项，并执行将去往ES4的数据报文向控制器发送的动作。控制器收到该去往ES4的数据报文后，为转发设备1生成虚拟网络A中的去往IP4的三层流表项(例如表8所示)。然后将该去往IP4的三层流表项下发到转发设备1的三层流表1中。转发设备1后续再接收到来自ES1的去往ES4的数据报文时，直接用VNID为A和目的IP为IP4的匹配项查找三层流表1，并精确命中该去往IP4的三层流表项，执行相应的动作，将报文通过Overlay隧道(如VxLAN隧道)封装，向与ES4相连的转发设备2发送。
表8
Figure PCTCN2018082435-appb-000009
需要说明的是，在上述二层或三层虚拟网络的示例中，例如，转发设备1收到来自ES1的数据报文后，先解析出该数据报文中的目的MAC地址，然后用该目的MAC与自己本机的MAC地址比较，如果比较后，发现MAC地址不同，则进入二层流表1，进行二层查找转发；如果比较后，发现MAC地址相同，则继续解析出该数据报文中的目的IP地址，用该目的IP地址与自己本机的IP地址比较，如果IP地址相同，则上送控制面进行协议解析处理，如果IP地址不同，则进入三层流表1，进行三层查找转发处理。
3a1-03、在获知所述控制器发生故障时，设置所述二或三层虚拟网络的第一缺省流表项的优先级高于所述二或三层虚拟网络的第二缺省流表项的优先级。
在二层虚拟网络的示例中，在二层流表1中，修改优先级后的所述二层虚拟网络B的第一缺省流表项和第二缺省流表项，如表9所示。
表9
Figure PCTCN2018082435-appb-000010
在三层虚拟网络的示例中，在三层流表1中，修改优先级后的所述三层虚拟网络A的第一缺省流表项和第二缺省流表项，如表10所示。
表10
Figure PCTCN2018082435-appb-000011
3a1-04、接收来自ES1的第一数据报文。
3a1-05、根据所述第一数据报文的匹配项查找所述第一流表并且没有命中流表项的情况下，所述转发设备使用所述二或三层虚拟网络的第一缺省流表项向所述指定的转发设备发送所述第一数据报文。
在二层虚拟网络的示例中，所述控制器发生故障时，ES1发起到ES5的二层单播通信流程。ES1发起的去往ES5的首包(即第一个数据报文)到达转发设备1时，转发设备1用虚拟网络标识为B和目的MAC为MAC5的匹配项，查找二层流表1(如表9)，且没能精确命中流表项，于是命中了所述二层虚拟网络B的第一缺省流表项和第二缺省流表项，因为所述第一缺省流表项的优先级比所述第二缺省流表项更高，所以最终命中所述第一缺省流表项，并执行将去往ES5的数据报文向二层虚拟网络B内的转发设备广播发送，即向转发设备2和3广播发送。
通过设置了二层虚拟网络B的第一缺省流表项，从而避免了控制器故障时，ES1到ES5的首包无法上送到达控制器，无法生成精确匹配的二层流表项，从而造成通信中断的问题。
当转发设备1检测到所述控制器故障恢复后，设置所述二层虚拟网络B的第一缺省流表项的优先级低于所述第二缺省流表项的优先级。然后，按照上述流程，转发设备1收到ES1发起的去往ES5的数据报文，在查找二层流表1，且没能精确命中流表项的情况下，则会从这两条缺省流表项中，选择优先级高的所述第二缺省流表项，将数据报文上送所述控制器。所述控制器为其生成一条精确匹配的二层流表项，并下发给转发设备1指导后续的二层转发(具体流程与上文3a1-02步骤中控制器正常情况下生成如表6所示的流表项的流程一致，此处不再赘述)。
通过转发设备1检测到控制器故障与否，并灵活地调整所述二层虚拟网络的第一和第二缺省流表项的优先级，这样可以在收到数据报文后，直接匹配优先级高的所述第一缺省流表项，而不用等到接收到数据报文后，再确认控制器的状态，然后确定使用的缺省流表项，从而可以提高报文的转发效率。可以理解的是，从获知控制器状态实时性方面而言，也可以在收到数据报文后，查询控制器的状态，并在确认控制器故 障或故障恢复后，再确定使用哪条缺省流表项进行转发。
值得说明的是，在控制器正常工作的情况下，也可以根据设计要求或应用场景，通过灵活地调整转发设备1上的所述第一缺省流表项的优先级高于所述第二缺省流表项的优先级，使得去往ES5的数据报文在没有命中匹配项的情况下，也可以灵活地被向二层虚拟网络B内的转发设备广播发送，增强了系统按需设置的灵活性。
在三层虚拟网络的示例中，控制器发生故障时，ES1发起到ES6的三层单播通信流程。ES1发起的首包(即第一个数据报文)到达转发设备1时，转发设备1用虚拟网络标识为A和目的IP为IP6的匹配项，查找三层流表1(如表10)，且没能精确命中流表项，于是命中了所述三层虚拟网络A的第一缺省流表项和第二缺省流表项，因为所述第一缺省流表项的优先级比所述第二缺省流表项更高，所以最终命中所述第一缺省流表项，并执行将去往ES6的数据报文向保存有所述三层虚拟网络A内的全部或部分路由转发信息的转发设备发送，即向集中转发设备发送。
通过设置了三层虚拟网络A的第一缺省流表项，从而避免了控制器故障时，ES1到ES6的首包无法上送到达控制器，无法生成精确匹配的三层流表项，从而造成通信中断的问题。
当转发设备1检测到所述控制器故障恢复后，设置所述三层虚拟网络A的第一缺省流表项的优先级低于所述第二缺省流表项的优先级。然后，按照上述流程，转发设备1收到ES1发起的去往ES6的数据报文，在查找三层流表1，且没能精确命中流表项的情况下，则会从这两条缺省流表项中，选择优先级高的所述第二缺省流表项，将数据报文上送所述控制器。所述控制器为其生成一条精确匹配的流三层表项，并下发给转发设备1指导后续的转发(具体流程与上文3a1-02步骤中控制器正常情况下生成如表7所示的流表项的流程一致，此处不再赘述)。
通过转发设备检测到控制器故障与否，并灵活地调整所述三层虚拟网络的第一和第二缺省流表项的优先级，这样可以在收到数据报文后，直接匹配优先级高的所述第一缺省流表项，而不用等到接收到数据报文后，再确认控制器的状态，然后确定使用的缺省流表项，从而可以提高报文的转发效率。可以理解的是，从获知控制器状态实时性方面而言，也可以在收到数据报文后，查询控制器的状态，并在确认控制器故障或故障恢复后，再确定使用哪条缺省流表项进行转发。
值得说明的是，在控制器正常工作的情况下，也可以根据设计要求或应用场景，通过灵活地调整转发设备1上的所述第一缺省流表项的优先级高于所述第二缺省流表项的优先级，使得去往ES6的数据报文在没有命中匹配项的情况下，也可以灵活地被向三层虚拟网络A内的集中转发设备发送，增强了系统按需设置的灵活性
图3b是缺省流表项为不同流表中的方法的交互流程示意图(是对图2方法实施例相关部分的举例细化)。该方法实施例与图3a所述的方法实施例类似，都是通过设置了所述二层或三层虚拟网络的第一缺省流表项来实现当控制器故障时，让转发设备最终能命中该第一缺省流表项去指导转发。不同之处在于图3b所示的方法实施例中的所述二层或三层虚拟网络的第一缺省流表项与所述二层或三层虚拟网络的第二缺省流表项保存在不同的流表中。为了根据控制器的故障或正常工作状态有选择的命中所述 第一缺省流表项或第二缺省流表项，该发明实施例中还包括二或三层虚拟网络的第三和四缺省流表项。该第三和四缺省流表项保存在第三流表中，如图4所示，如果控制器故障，转发设备转发查表时，使其命中该第三缺省流表项，可以执行跳转到所述第一流表的动作，从而命中所述第一缺省流表项。如果控制器正常工作，转发设备转发查表时，使其命中该第四缺省流表项，可以执行跳转到所述第二流表的动作，从而命中所述第二缺省流表项。
下面结合图3b所示的流程示意图和图1的场景，与图3a所示的实施例中类似，以转发设备1分别在二层虚拟网络B和三层虚拟网络A中为例，描述图3b所示方法的所述控制器与转发设备1之间的交互处理过程。图1所示的场景与上文图3a部分所描述的一致，请参考相应章节，此处不再赘述。
在控制器按照Pull模式工作的情况下，创建二和/或三层虚拟网络成功之后，在控制器上执行如图3b所示的3b2-01至3b2-08步骤，其中3b2-01至3b2-04步骤与上文图3a所描述的3a2-01至3a2-04步骤类似(具体细节请参考相应部分，此处不再赘述)，不同之处在于图3b所示实施例中的所述二或三层虚拟网络的第二缺省流表项是第二流表中的表项，被保存在转发设备1的第二流表中。
此外，控制器还执行3b2-05至3b2-08步骤，生成并向转发设备1发送二或三层虚拟网络的第三缺省流表项和第四缺省流表项，其中该第三缺省流表项的优先级低于该第四缺省流表项的优先级。所示二或三层虚拟网络的第三和四缺省流表项的功能与所述第一和二缺省流表项的功能类似(具体细节请参考上文图2、图3a相应部分，此处不再赘述)，不同之处在于：1)是第三流表中的表项；2)执行的动作不同，该第三缺省流表项指示查找该第三流表没有精确命中流表项时，将相应的数据报文依据所述第一流表发送(例如，可以为向所述第一流表跳转发送，然后查找所述第一流表进行转发)；该第四缺省流表项指示查找该第三流表没有精确命中流表项时，将相应的数据报文依据所述第二流表发送(例如，可以为向所述第二流表跳转发送，然后查找所述第二流表进行转发)。
在二层虚拟网络的示例中，控制器将上述3b2-05至3b2-08步骤中生成的转发设备1的二层虚拟网络B的第三和四缺省流表项(例如表11所示)向转发设备1发送。
表11
Figure PCTCN2018082435-appb-000012
在三层虚拟网络的示例中，控制器将上述3b2-05至3b2-08步骤中生成的转发设备1的三层虚拟网络A的第三和四缺省流表项(例如表12所示)向转发设备1发送。
表12
Figure PCTCN2018082435-appb-000013
Figure PCTCN2018082435-appb-000014
需要说明的是，控制器生成所述二或三层虚拟网络的第一、二、三和第四缺省流表项的先后顺序没有限定，可以以任意顺序组合先后生成。控制器向转发设备1下发所述第一、二、三和第四缺省流表项的顺序也没有限定，可以一条一条分别下发，也可以以任意条数组合到一个或多个控制通道协议消息中，以任意的先后顺序下发，此处不做限定。
在转发设备1上执行图3b所示的3b1-01至3b1-07步骤，其中3b1-01和3b1-02步骤与上文图3a所描述的3a1-01和3a1-02步骤一致(具体细节请参考相应部分，此处不再赘述)，不同之处在于图3b所示实施例中的所述二或三层虚拟网络的第二缺省流表项是第二流表中的表项，被保存在转发设备1的第二流表中。
此外，可选地，转发设备1还可以执行图3b所示的3b1-03至3b2-04步骤，接收来自所述控制器发送的二或三层虚拟网络的第三缺省流表项和第四缺省流表项，其中该第三缺省流表项的优先级低于该第四缺省流表项的优先级。该二或三层虚拟网络的第三和四缺省流表项的描述与上文控制器执行的3b2-05至3b2-08步骤部分的描述一致，不再赘述。
在二层虚拟网络的示例中，当控制器正常工作时，例如，图1中ES1发起到ES3的二层单播通信流程。ES1发起的去往ES3的首包(即第一个数据报文)到达转发设备1时，转发设备1用虚拟网络标识为B和目的MAC为MAC3的匹配项，查找流表3(如表11)，且没能精确命中流表项，于是先命中了所述二层虚拟网络B的第三缺省流表项和第四缺省流表项。因为所述第四缺省流表项的优先级比所述第三缺省流表项更高，所以最终命中所述第四缺省流表项，并执行将去往ES3的数据报文依据二层流表2发送(例如，可以为向二层流表2跳转发送，然后查找二层流表2进行转发)。然后，转发设备1用虚拟网络标识为B和目的MAC为MAC3的匹配项，查找二层流表2，没有精确命中匹配项，于是选用所述二层虚拟网络的第二缺省流表项，将去往ES3的数据报文向控制器发送。控制器收到该去往ES3的数据报文后，为转发设备1生成虚拟网络B中的去往MAC3的二层流表项(例如表6所示)。然后将该去往MAC3的二层流表项下发到转发设备1的二层流表3(即所述第三流表)中。转发设备1后续再接收到来自ES1的去往ES3的数据报文时，直接用VNID为B和目的MAC为MAC3的匹配项查找二层流表3，并精确命中该去往MAC3的二层流表项，执行相应的动作，将报文通过Overlay隧道(如VxLAN隧道)封装，向与ES3相连的转发设备2发送。
在三层虚拟网络的示例中，当控制器正常工作，ES1发起到ES4的三层单播通信流程。ES1发起的首包(即第一个数据报文)到达转发设备1时，转发设备1用虚拟网络标识为A和目的IP为IP4的匹配项，查找三层流表3(如表12)，且没能精确命中流表项，于是先命中了所述三层虚拟网络A的第三缺省流表项和第四缺省流表项，因为所述第四缺省流表项的优先级比所述第三缺省流表项更高，所以最终命中所述第四缺省流表项，并执行将去往ES4的数据报文依据三层流表2发送(例如，可以为向 三层流表2跳转发送，然后查找三层流表2进行转发)。然后，转发设备1用虚拟网络标识为A和目的IP为IP4的匹配项，查找三层流表2，没有精确命中匹配项，于是选用所述二层虚拟网络的第二缺省流表项，将去往ES4的数据报文向控制器发送。控制器收到该去往ES4的数据报文后，为转发设备1生成虚拟网络A中的去往IP4的三层流表项(例如表8所示)。然后将该去往IP4的三层流表项下发到转发设备1的三层流表3中。转发设备1后续再接收到来自ES1的去往ES4的数据报文时，直接用VNID为A和目的IP为IP4的匹配项查找三层流表3，并精确命中该去往IP4的三层流表项，执行相应的动作，将报文通过Overlay隧道(如VxLAN隧道)封装，向与ES4相连的转发设备2发送。
进一步，转发设备1还可以执行3b1-05至3b1-07步骤。这些步骤与上文图3a所描述的3a1-03至3a1-05步骤类似(具体细节请参考相应部分，此处不再赘述)，不同之处在于图3b所示实施例中通过设置所述第三流表中的所述二或三层虚拟网络的第三缺省流表项的优先级高于所述第三流表中的所述二或三层虚拟网络的第四缺省流表项的优先级，从而在控制器故障时，转发设备1查表能命中该第三缺省流表项，从而跳转到所述第一流表，进一步使用第一流表中的所述二或三层虚拟网络的第一缺省流表项，将数据报文转发到指定的转发设备。
在二层虚拟网络的示例中，控制器发生故障时，例如，图1中ES1发起到ES5的二层单播通信流程。ES1发起的去往ES5的首包(即第一个数据报文)到达转发设备1时，转发设备1用虚拟网络标识为B和目的MAC为MAC5的匹配项，查找二层流表3，且没能精确命中流表项，于是先命中了所述二层虚拟网络B的第三缺省流表项和第四缺省流表项。因为此时所述第三缺省流表项的优先级比所述第四缺省流表项更高，所以最终命中所述第三缺省流表项，并执行将去往ES5的数据报文依据二层流表2发送(例如，可以为向二层流表2跳转发送，然后查找二层流表2进行转发)。然后，转发设备1用虚拟网络标识为B和目的MAC为MAC5的匹配项，查找二层流表1，没有精确命中匹配项(或者，也可以是转发设备1用虚拟网络标识为B的匹配项，查找二层流表1，精确命中所述二层虚拟网络的第一缺省流表项)，于是使用所述二层虚拟网络的第一缺省流表项，并执行将去往ES5的数据报文向二层虚拟网络B内的转发设备广播发送，即向转发设备2和3广播发送。与ES5相连的转发设备3收到该数据报文后，将其发送给ES5。
通过设置了二层虚拟网络B的第一缺省流表项，从而避免了控制器故障时，ES1到ES5的首包无法上送到达控制器，无法生成精确匹配的二层流表项，从而造成通信中断的问题。
在三层虚拟网络的示例中，控制器发生故障时，ES1发起到ES6的三层单播通信流程。ES1发起的首包(即第一个数据报文)到达转发设备1时，转发设备1用虚拟网络标识为A和目的IP为IP6的匹配项，查找三层流表3，且没能精确命中流表项，于是先命中了所述三层虚拟网络A的第三缺省流表项和第四缺省流表项，因为此时所述第三缺省流表项的优先级比所述第四缺省流表项更高，所以最终命中所述第三缺省流表项，并执行将去往ES6的数据报文依据三层流表1发送(例如，可以为向三层流 表1跳转发送，然后查找三层流表1进行转发)。然后，转发设备1用虚拟网络标识为A和目的IP为IP6的匹配项，查找三层流表1，没有精确命中匹配项(或者，也可以是转发设备1用虚拟网络标识为A的匹配项，查找二层流表1，精确命中所述二层虚拟网络的第一缺省流表项)，于是使用所述三层虚拟网络的第一缺省流表项，将去往ES6的数据报文向保存有所述三层虚拟网络A内的全部或部分路由转发信息的转发设备发送，即向集中转发设备发送。集中转发设备收到该数据报文后，查找三层虚拟网络A的路由转发信息，通过隧道(如VxLAN隧道)向ES6发送。
通过设置了三层虚拟网络A的第一缺省流表项，从而避免了控制器故障时，ES1到ES6的首包无法上送到达控制器，无法生成精确匹配的三层流表项，从而造成通信中断的问题。
值得说明的是，在二层或三层虚拟网络中，当转发设备1检测到所述控制器故障恢复后通过灵活地调整所述第三和第四缺省表项的优先级，以便达到将数据报文上送控制器的流程与上文图3a的步骤3a1-05部分的描述类似，不同之处在于增加了流表之间的跳转，为了简洁，此处不再赘述。此外，当控制器正常工作中，根据设计要求或应用场景，灵活地调整所述第三和第四缺省表项的优先级，以便达到将数据报文向指定的转发设备发送的流程与与上文图3a的步骤3a1-05部分的描述也类似，不同之处在于增加了流表之间的跳转，为了简洁，此处不再赘述。
需要说明的是，上述图3a和图3b方法实施例中以转发设备1为例进行了描述，同样的步骤流程也适用于转发设备2和3，为了简洁，不再赘述转发设备2和3。本发明中用到的第一、二、三或四缺省流表项均是指二层虚拟网络或三层虚拟网络中的第一、二、三或四缺省流表项，有时为了描述的简洁，在上下文清晰的情况下，省略了二或三层虚拟网络的限定。
需要说明的是，本申请所说的二层流表项是匹配项里包括MAC地址的流表项，三层流表项是匹配项里包括IP地址的流表项。二层流表是指用于存放二层流表项的流表，三层流表是指用于存放三层流表项的流表。二层流表项和三层流表项可以是分别放在两个独立的流表里，例如，二层流表项放在二层流表里，三层流表项放在三层流表里；也可以是放在一个流表里，这个流表里既包括二层流表项，也包括三层流表项，此时该流表是一个二、三层流表项混合的流表，既可以称为二层流表，也可以称为三层流表。
还需要说明的是，以上是以基于控制转发分离SDN、虚拟化的数据中心网络为例进行的本发明的描述。但是并不限定本发明还可以应用到其它基于控制转发分离SDN、虚拟化的网络中，比如，基于控制转发分离SDN、虚拟化的城域/骨干网络中，本发明在该城域/骨干网络中实现的方法原理与该数据中心网络场景的实施方法类似，不同的是本发明中所述的ES还可以是二或三层转发设备，例如，用户边缘(Customer Edge，CE)设备；本发明中所述的隧道还可以是二层虚拟专用网(Layer 2Virtual Private Network，L2VPN)隧道或者三层虚拟专用网(Layer 3 Virtual Private Network，L3VPN)隧道。
图5a示出了上述实施例中所涉及的转发设备的一种可能的结构示意图。转发设备500A应用于控制转发分离的虚拟网络中，所述虚拟网络包括控制器和转发设备500A，转发设备500A包括：主控板510、接口板530、交换网板520和接口板540。主控板510用于完成系统管理、设备维护、协议处理等功能。交换网板520用于完成各接口板(接口板也称为线卡或业务板)之间的数据交换。接口板530和540用于提供各种业务接口(例如，以太网接口、POS接口等)，并实现数据包的转发。主控板510、接口板530和540，以及交换网板520之间通过系统总线与系统背板相连实现互通。接口板530上的中央处理器531用于对接口板进行控制管理并与主控板510上的中央处理器511进行通信。主控板510上的中央处理器511还用于与所述控制器进行通信，对所述控制器下发给转发设备500A的消息(例如，流表项信息)进行处理。
接口板530上的物理接口卡533(例如该接口卡上的端口1，通过该端口1能够与所述控制器相连)用于接收来自控制器的所述虚拟网络的第一缺省流表项(具体请参考图2和图3a相关部分的描述，此处不再赘述，例如，该第一缺省流表项被封装在OpenFlow控制通道协议的消息中)。该消息被发送到接口板530上的网络处理器532，网络处理器532查找转发表项后发现为主机路由(该消息报文头中的目的IP地址是转发设备500A的IP地址)，于是通过接口板530上的中央处理器531上送到主控板510上的中央处理器511。
主控板510上的中央处理器511将来自所述控制器的所述虚拟网络的第一缺省流表项分别通过接口板530上的中央处理器531和540上的中央处理器541，将其分别存储到转发表项存储器534和544中。接口板530上的物理接口卡533(例如该接口卡上的端口2)用于接收来自ES的第一数据报文。主控板510上的中央处理器511还用于在所述控制器发生故障，并且所述转发设备根据所述第一数据报文的匹配项查找存储在转发表项存储器534中的第一流表并且没有命中流表项的情况下，确定使用所述虚拟网络的第一缺省流表项转发所述第一数据报文，并将指令下发到存储器534中的第一流表。接口板530上的网络处理器532接收到所述第一数据报文，并且根据所述第一数据报文的匹配项查找转发表项存储器534没有精确命中表项，于是命中所述虚拟网络的第一缺省流表项。网络处理器532根据所述第一缺省流表项指令物理接口卡533或543将所述第一数据报文向指定的转发设备发送。例如，如果指定的转发设备与物理接口卡533相连，则指令物理接口卡533发送所述第一数据报文；如果指定的转发设备与物理接口卡543相连，则指令所述第一数据报文通过交换网板520发送到接口板540，然后由物理接口卡543发送所述第一数据报文。
可选地，接口板530上的物理接口卡533(例如该接口卡上的端口1)还会接收来自所述控制器的所述虚拟网络的第二缺省流表项，根据所述虚拟网络的第二缺省流表项是否与所述虚拟网络的第一缺省流表项保存在同一个流表中，有以下两种可能的实现方式。
方式一为缺省流表项为同一流表中的表项的实现方式。
基于方式一，在一种可能的实现中，与上述下发第一缺省流表项类似的流程，主控板510上的中央处理器511还将来自控制器的所述虚拟网络的第二缺省流表项(具 体请参考图2和图3a相关部分的描述，此处不再赘述，该第二缺省流表项为所述第一流表中的表项)分别下发存储到转发表项存储器534和544中。所述虚拟网络的第二缺省流表项的优先级高于所述虚拟网络的第一缺省流表项的优先级。主控板510上的中央处理器511还用于在所述控制器正常工作，并且所述转发设备根据所述第一数据报文的匹配项查找所述第一流表并且没有命中流表项的情况下，确定使用所述虚拟网络的第二缺省流表项转发所述第一数据报文。
基于方式一，在另一种可能的实现中，主控板510上的中央处理器511还用于在确定所述控制器故障后，设置所述虚拟网络的第一缺省流表项的优先级高于所述虚拟网络的第二缺省流表项的优先级。接口板530上的网络处理器532还用于根据所述虚拟网络的第一缺省流表项指令物理接口卡533或543发送所述第一数据报文。
方式二为缺省流表项为不同流表中的表项的实现方式。
基于方式二，在一种可能的实现中，与上述下发第一缺省流表项类似的流程，主控板510上的中央处理器511还将来自控制器的所述虚拟网络的第二缺省流表项(具体请参考图2和图3a相关部分的描述，此处不再赘述，该第二缺省流表项为所述第二流表中的表项)分别下发存储到转发表项存储器534和544中。所述虚拟网络的第二缺省流表项的优先级高于所述虚拟网络的第一缺省流表项的优先级。
基于方式二，在另一种可能的实现中，与上述下发第一缺省流表项类似的流程，接口板530上的物理接口卡533(例如该接口卡上的端口1)还会接收来自所述控制器的所述虚拟网络的第三缺省流表项(具体请参考图2和图3b相关部分的描述，此处不再赘述，所述虚拟网络的第三缺省流表为第三流表中的表项)。主控板510上的中央处理器511还将所述虚拟网络的第三缺省流表项分别下发存储到转发表项存储器534和544中。主控板510上的中央处理器511还用于在所述控制器发生故障，并且所述转发设备根据所述第一数据报文的匹配项查找所述第三流表并且没有命中流表项的情况下，确定使用所述虚拟网络的第三缺省流表项转发所述第一数据报文。
基于方式二，在又一种可能的实现中，与上述下发第一缺省流表项类似的流程，接口板530上的物理接口卡533(例如该接口卡上的端口1)还会接收来自所述控制器的所述虚拟网络的第四缺省流表项(具体请参考图2和图3b相关部分的描述，此处不再赘述，所述虚拟网络的第四缺省流表为第三流表中的表项)。主控板510上的中央处理器511还将所述虚拟网络的第四缺省流表项分别下发存储到转发表项存储器534和544中。所述虚拟网络的第四缺省流表项的优先级大于所述虚拟网络的第三缺省流表项的优先级。所述主控板510上的中央处理器511还用于在所述控制器正常工作，并且所述转发设备根据所述第一数据报文的匹配项查找所述第三流表并且没有命中流表项的情况下，确定使用所述虚拟网络的第四缺省流表项转发所述第一数据报文。
基于方式二，在再一种可能的实现中，所述主控板510上的中央处理器511还用于在确定所述控制器故障后，设置所述虚拟网络的第三缺省流表项的优先级高于所述虚拟网络的第四缺省流表项的优先级。所述网络处理器532还用于根据所述虚拟网络的第三缺省流表项指令将所述第一数据报文发送到第一流表，然后根据第一流表中的所述虚拟网络的第一缺省流表项指令物理接口卡533或543将所述第一数据报文向指定的转发设备发送。
应理解，本发明实施例中接口板540上的操作与所述接口板530的操作一致，为了简洁，不再赘述。应理解，本实施例的转发设备500A可对应于上述图1至图3b所对应的实施例中的转发设备(例如，图1中的转发设备1、2或3)，该转发设备500A中的主控板510、接口板530和/或540可以实现图1至图3b所对应的实施例中的转发设备所具有的功能和/或所实施的各种步骤，为了简洁，在此不再赘述。
值得说明的是，主控板可能有一块或多块，有多块的时候可以包括主用主控板和备用主控板。接口板可能有一块或多块，转发设备的数据处理能力越强，提供的接口板越多。接口板上的物理接口卡也可以有一块或多块。交换网板可能没有，也可能有一块或多块，有多块的时候可以共同实现负荷分担冗余备份。在集中式转发架构下，转发设备可以不需要交换网板，接口板承担整个系统的业务数据的处理功能。在分布式转发架构下，转发设备可以有至少一块交换网板，通过交换网板实现多块接口板之间的数据交换，提供大容量的数据交换和处理能力。所以，分布式架构的转发设备的数据接入和处理能力要大于集中式架构的设备。可选地，转发设备500A的形态也可以是只有一块板卡，即没有交换网板，接口板和主控板的功能集成在该一块板卡上，此时接口板上的中央处理器和主控板上的中央处理器在该一块板卡上可以合并为一个中央处理器，执行两者叠加后的功能，这种形态设备的数据交换和处理能力较低(例如，低端交换机或路由器等网络设备)。具体采用哪种架构，取决于具体的组网部署场景，此处不做任何限定。
图5b示出了上述实施例中所涉及的转发设备的又一种可能的结构示意图。转发设备500B应用于控制转发分离的虚拟网络中，所述虚拟网络包括控制器和转发设备500B。转发设备500B包括：处理单元504B、接收单元502B和发送单元506B。
接收单元502B用于接收来自所述控制器的所述虚拟网络的第一缺省流表项(具体请参考图2至图3b相关部分的描述，此处不再赘述)，所述虚拟网络的第一缺省流表项为第一流表中的表项。接收单元502B还用于接收来自端系统ES的所述虚拟网络内的第一数据报文。处理单元504B用于在所述控制器发生故障，并且所述转发设备根据所述第一数据报文的匹配项查找所述第一流表并且没有命中流表项的情况下，确定使用所述虚拟网络的第一缺省流表项转发所述第一数据报文。发送单元506B用于向所述指定的转发设备发送所述第一数据报文。转发设备500B还包括存储单元，所述存储单元用于保存所述虚拟网络的第一缺省流表项。
可选地，所述转发设备还会接收来自所述控制器的所述虚拟网络的第二缺省流表项，根据所述虚拟网络的第二缺省流表项是否与所述虚拟网络的第一缺省流表项保存在同一个流表中，有以下两种可能的实现方式。
方式一为缺省流表项为同一流表中的表项的实现方式。
基于方式一，在一种可能的实现中，所述接收单元502B还用于接收来自控制器的所述虚拟网络的第二缺省流表项(具体请参考图2和图3a相关部分的描述，此处不再赘述)，该第二缺省流表项为所述第一流表中的表项。所述虚拟网络的第二缺省流表项的优先级高于所述虚拟网络的第一缺省流表项的优先级。所述处理单元504B还用于在所述控制器正常工作，并且所述转发设备根据所述第一数据报文的匹配项查找 所述第一流表并且没有命中流表项的情况下，确定使用所述虚拟网络的第二缺省流表项转发所述第一数据报文。所述发送单元506B还用于向所述控制器发送所述第一数据报文。
基于方式一，在一种可能的实现中，所述处理单元504B还用于在确定所述控制器故障后，设置所述虚拟网络的第一缺省流表项的优先级高于所述虚拟网络的第二缺省流表项的优先级。
基于方式一，在一种可能的实现中，所述处理单元504B还用于在确定所述控制器故障恢复的情况下，设置所述虚拟网络的第二缺省流表项的优先级高于所述虚拟网络的第一缺省流表项的优先级，以及在没有命中流表项的情况下根据所述虚拟网络的第二缺省流表项指令所述发送单元506B发送所述第一数据报文。
基于方式一，在一种可能的实现中，所述处理单元504B还用于在确定所述控制器正常工作的情况下，设置所述虚拟网络的第一缺省流表项的优先级高于所述虚拟网络的第二缺省流表项的优先级，以及在没有命中流表项的情况下优先根据所述虚拟网络的第一缺省流表项指令所述发送单元506B发送所述第一数据报文。
基于方式一，在一种可能的实现中，所述存储单元还用于保存所述虚拟网络的第二缺省流表项。
方式二为缺省流表项为不同流表中的表项的实现方式。
基于方式二，在一种可能的实现中，所述接收单元502B还用于接收来自所述控制器的所述虚拟网络的第二缺省流表项(具体请参考图2和图3b相关部分的描述，此处不再赘述)，所述虚拟网络的第二缺省流表项为第二流表中的表项。所述处理单元504B还用于在所述控制器正常工作，并且所述转发设备根据所述第一数据报文的匹配项查找所述第二流表并且没有命中流表项的情况下，确定使用所述虚拟网络的第二缺省流表项转发所述第一数据报文。所述发送单元506B还用于向所述控制器发送所述第一数据报文。
基于方式二，在一种可能的实现中，所述接收单元502B还用于接收来自所述控制器的所述虚拟网络的第三缺省流表项(具体请参考图2和图3b相关部分的描述，此处不再赘述)，所述虚拟网络的第三缺省流表为第三流表中的表项。所述处理单元504B还用于在所述控制器发生故障，并且所述转发设备根据所述第一数据报文的匹配项查找所述第三流表并且没有命中流表项的情况下，确定使用所述虚拟网络的第三缺省流表项转发所述第一数据报文。所述发送单元506B还用于向所述第一流表发送所述第一数据报文。
基于方式二，在一种可能的实现中，所述接收单元502B还用于接收来自所述控制器的所述虚拟网络的第四缺省流表项(具体请参考图2和图3b相关部分的描述，此处不再赘述)，所述虚拟网络的第四缺省流表项为第三流表中的表项。所述虚拟网络的第四缺省流表项的优先级大于所述虚拟网络的第三缺省流表项的优先级。所述处理单元504B还用于在所述控制器正常工作，并且所述转发设备根据所述第一数据报文的匹配项查找所述第三流表并且没有命中流表项的情况下，确定使用所述虚拟网络的第四缺省流表项转发所述第一数据报文。所述发送单元506B还用于向所述第二流表发送所述第一数据报文。
基于方式二，在一种可能的实现中，所述处理单元504B还用于在确定所述控制器故障后，设置所述虚拟网络的第三缺省流表项的优先级高于所述虚拟网络的第四缺省流表项的优先级。
基于方式二，在一种可能的实现中，所述处理单元504B还用于在确定所述控制器故障恢复的情况下，设置所述虚拟网络的第四缺省流表项的优先级高于所述虚拟网络的第三缺省流表项的优先级，以及在没有命中流表项的情况下优先根据所述虚拟网络的第四缺省流表项指令所述发送单元506B发送所述第一数据报文。
基于方式二，在一种可能的实现中，所述处理单元504B还用于在确定所述控制器正常工作的情况下，设置所述虚拟网络的第三缺省流表项的优先级高于所述虚拟网络的第四缺省流表项的优先级，以及在没有命中流表项的情况下优先根据所述虚拟网络的第三缺省流表项指令所述发送单元506B发送所述第一数据报文。
基于方式二，在一种可能的实现中，所述存储单元还用于保存所述虚拟网络的第二、三和四缺省流表项。
本发明实施例的转发设备500B可对应于上述转发数据报文的方法实施例中的转发设备，并且，该转发设备500B中的各模块和上述其他操作和/或功能分别为了实现图1至图4所对应的实施例中的转发设备所实施的各种步骤和方法，为了简洁，在此不再赘述。
图5c示出了上述实施例中所涉及的转发设备的再一种可能的结构示意图。转发设备500C包括：收发器510C、处理器520C、随机存取存储器540C、只读存储器550C以及总线560C。其中，处理器520C通过总线560C分别耦接收发器510C、随机存取存储器540C以及只读存储器550C。其中，当需要运行转发设备500C时，通过固化在只读存储器550C中的基本输入输出系统或者嵌入式系统中的bootloader引导系统进行启动，引导转发设备500C进入正常运行状态。在转发设备500C进入正常运行状态后，在随机存取存储器540C中运行应用程序和操作系统，使得：
收发器510C用于接收来自所述控制器的所述虚拟网络的第一缺省流表项，所述虚拟网络的第一缺省流表项指示所述转发设备根据所述虚拟网络内的数据报文的匹配项查找第一流表并且没有命中流表项时，将所述虚拟网络内的数据报文向指定的转发设备发送。收发器510C还用于接收来自端系统ES的所述虚拟网络内的第一数据报文。处理器520C用于在所述控制器发生故障，并且所述转发设备根据所述第一数据报文的匹配项查找所述第一流表并且没有命中流表项的情况下，确定使用所述虚拟网络的第一缺省流表项转发所述第一数据报文。收发器510C还用于向所述指定的转发设备发送所述第一数据报文。随机存取存储器540C还用于保存所述虚拟网络的第一缺省流表项。
本发明实施例的转发设备500C可对应于上述图1至图4所对应的实施例中的转发设备，并且，该转发设备500C中的处理器520C、收发器510C等可以实现图1至图4所对应的实施例中的转发设备所具有的功能和/或所实施的各种步骤和方法。所述处理器520C用于执行图5b所述转发设备的处理单元504B的所有操作，所述收发器510C用于执行图5b所述转发设备的接收单元502B和发送单元506B的所有操作。为 了简洁，在此不再赘述。
需要说明的是，本实施例也可以基于通用的物理服务器结合网络功能虚拟化(英文：Network Function Virtualization，NFV)技术实现的转发设备，所述转发设备为虚拟转发设备(如，虚拟路由器或虚拟交换机)。所述虚拟转发设备可以是运行有用于转发数据报文功能的程序的虚拟机(英文：Virtual Machine，VM)，所述虚拟机部署在硬件设备上(例如，物理服务器)。虚拟机指通过软件模拟的具有完整硬件系统功能的、运行在一个完全隔离环境中的完整计算机系统。本领域技术人员通过阅读本申请即可结合NFV技术在通用物理服务器上虚拟出具有上述功能的多个转发设备。此处不再赘述。
图6a示出了上述实施例中所涉及的控制器600A的一种可能的结构示意图。控制器600A应用于控制转发分离的虚拟网络中，所述虚拟网络包括控制器600A和转发设备，控制器600A包括：处理单元602A和发送单元604A。
处理单元602A用于生成所述虚拟网络的第一缺省流表项，所述虚拟网络的第一缺省流表项指示所述转发设备在所述控制器600A发生故障以及所述转发设备根据所述虚拟网络内的数据报文的匹配项查找流表并且没有命中流表项的情况下，将所述虚拟网络内的数据报文向指定的转发设备发送，或指示所述转发设备在所述控制器600A正常工作以及所述转发设备根据所述虚拟网络内的数据报文的匹配项查找流表并且没有命中流表项的情况下，将所述虚拟网络内的数据报文向所述指定的转发设备发送。所述处理单元602A还用于生成所述虚拟网络的第二缺省流表项，所述虚拟网络的第二缺省流表项指示所述转发设备在控制器600A正常工作以及所述转发设备根据所述虚拟网络内的数据报文的匹配项查找所述流表并且没有命中流表项的情况下，将所述虚拟网络内的数据报文向所述控制器600A发送。发送单元604A用于向所述转发设备发送所述虚拟网络的第一缺省流表项和所述虚拟网络的第二缺省流表项。
可选地，根据所述虚拟网络的第二缺省流表项是否与所述虚拟网络的第一缺省流表项保存在同一个流表中，有以下两种可能的实现方式。
方式一为缺省流表项为同一流表中的表项的实现方式。
基于方式一，在一种可能的实现中，所述虚拟网络的第一缺省流表项为第一流表中的表项，所述指示所述转发设备在控制器600A发生故障以及转发设备根据所述虚拟网络内的数据报文的匹配项查找所述流表并且没有命中流表项具体为查找所述第一流表并且没有命中流表项。所述虚拟网络的第二缺省流表项为所述第一流表中的表项，所述指示所述转发设备在控制器600A正常工作以及转发设备根据所述虚拟网络内的数据报文的匹配项查找所述流表并且没有命中流表项具体为查找所述第一流表并且没有命中流表项。
方式二为缺省流表项为不同流表中的表项的实现方式。
基于方式二，在一种可能的实现中，所述虚拟网络的第一缺省流表项为第一流表中的表项，所述指示所述转发设备在控制器600A发生故障以及转发设备根据所述虚拟网络内的数据报文的匹配项查找所述流表并且没有命中流表项具体为查找所述第一流表并且没有命中流表项。所述虚拟网络的第二缺省流表项为第二流表中的表项，所 述指示所述转发设备在控制器600A正常工作以及转发设备根据所述虚拟网络内的数据报文的匹配项查找所述流表并且没有命中流表项具体为查找所述第二流表并且没有命中流表项。
基于方式二，在另一种可能的实现中，所述处理单元602A还用于生成所述虚拟网络的第三缺省流表项(具体请参考图2和图3b相关部分的描述，此处不再赘述)。所述发送单元604A还用于向所述转发设备发送所述虚拟网络的第三缺省流表项。
基于方式二，在又一种可能的实现中，所述处理单元602A还用于生成所述虚拟网络的第四缺省流表项(具体请参考图2和图3b相关部分的描述，此处不再赘述)。所述发送单元604A还用于向所述转发设备发送所述虚拟网络的第四缺省流表项。
本发明实施例的控制器600A可以实施上述图1至图4所对应的实施例中的转发设备中的各种实施功能和的步骤，为了简洁，在此不再赘述。
图6b示出了上述实施例中所涉及的控制器600B的再一种可能的结构示意图。控制器600B包括：收发器610B、处理器620B、随机存取存储器640B、只读存储器650B以及总线660B。其中，处理器620B通过总线660B分别耦接接收器610B、随机存取存储器640B以及只读存储器650B。其中，当需要运行控制器600B时，通过固化在只读存储器650B中的基本输入输出系统或者嵌入式系统中的bootloader引导系统进行启动，引导控制器600B进入正常运行状态。在控制器600B进入正常运行状态后，在随机存取存储器640B中运行应用程序和操作系统，使得：
处理器620B用于生成所述虚拟网络的第一缺省流表项，所述虚拟网络的第一缺省流表项指示所述转发设备在所述控制器600B发生故障以及所述转发设备根据所述虚拟网络内的数据报文的匹配项查找流表并且没有命中流表项的情况下，将所述虚拟网络内的数据报文向指定的转发设备发送，或指示所述转发设备在所述控制器600B正常工作以及所述转发设备根据所述虚拟网络内的数据报文的匹配项查找流表并且没有命中流表项的情况下，将所述虚拟网络内的数据报文向所述指定的转发设备发送。处理器620B还用于生成所述虚拟网络的第二缺省流表项，所述虚拟网络的第二缺省流表项指示所述转发设备在控制器600B正常工作以及所述转发设备根据所述虚拟网络内的数据报文的匹配项查找所述流表并且没有命中流表项的情况下，将所述虚拟网络内的数据报文向所述控制器600B发送。收发器610B用于向所述转发设备发送所述虚拟网络的第一缺省流表项和所述虚拟网络的第二缺省流表项。
本发明实施例的控制器600B可对应于上述图1至图4所对应的实施例中的控制器，并且，该控制器600B中的处理器620B、收发器610B等可以实现图1至图4所对应的实施例中的控制器所具有的功能和/或所实施的各种步骤和方法。所述处理器620B用于执行图6a所述控制器的处理单元602A的所有操作，所述收发器610B用于执行图6a所述控制器的发送单元604A的所有操作。为了简洁，在此不再赘述。
需要说明的是，本实施例也可以基于通用的物理服务器结合NFV技术实现的控制器，所述控制器为虚拟控制器。所述虚拟控制器可以是运行有用于发送流表项功能的程序的虚拟机(英文：Virtual Machine，VM)，所述虚拟机部署在硬件设备上(例如，物理服务器)。虚拟机指通过软件模拟的具有完整硬件系统功能的、运行在一个 完全隔离环境中的完整计算机系统。本领域技术人员通过阅读本申请即可结合NFV技术在通用物理服务器上虚拟出具有上述功能的多个控制器。此处不再赘述。
图7是本发明实施例提供的一种转发数据报文的系统示意图。如图7所示，系统700包括转发设备710和控制器720。转发设备710为上述图5a、5b、5c所述的任一转发设备或虚拟转发设备，控制器720为上述图6a、6b所述的任一控制器或虚拟控制器。有关系统中各设备的详细描述，请参见上述图5a-5c和图6a-6b等相关章节，此处不再赘述。
应理解，本领域技术人员在阅读本申请文件的基础上，可以针对本申请实施例中所描述的可选的特征、步骤或方法进行不需要付出创造性的组合，都属于本申请公开的实施例，只是由于描述或行文的简单没有重复赘述不同组合。
应理解，本文中术语“和/或”，仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。另外，本文中字符“/”，一般表示前后关联对象是一种“或”的关系。
应理解，在本发明的各种实施例中，上述各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本发明实施例的实施过程构成任何限定。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本发明的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本发明各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本发明的技术方案本质上或 者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本发明各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本发明的具体实施方式，但本发明的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本发明揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本发明的保护范围之内。因此，本发明的保护范围应以所述权利要求的保护范围为准。

Claims (37)

  1. 一种转发数据报文的方法，其特征在于，应用于控制转发分离的虚拟网络中，所述虚拟网络包括控制器和转发设备，所述方法包括：
    所述转发设备接收来自所述控制器的所述虚拟网络的第一缺省流表项，所述虚拟网络的第一缺省流表项指示所述转发设备根据所述虚拟网络内的数据报文的匹配项查找第一流表并且没有命中流表项的情况下，将所述虚拟网络内的数据报文向指定的转发设备发送；
    所述转发设备接收来自端系统ES的所述虚拟网络内的第一数据报文；
    在所述控制器发生故障，并且所述转发设备根据所述第一数据报文的匹配项查找所述第一流表并且没有命中流表项的情况下，所述转发设备使用所述虚拟网络的第一缺省流表项向所述指定的转发设备发送所述第一数据报文。
  2. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    所述转发设备接收来自所述控制器的所述虚拟网络的第二缺省流表项，所述虚拟网络的第二缺省流表项指示所述转发设备根据所述虚拟网络内的数据报文的匹配项查找所述第一流表并且没有命中流表项的情况下，将所述虚拟网络内的数据报文向所述控制器发送；所述虚拟网络的第二缺省流表项的优先级高于所述虚拟网络的第一缺省流表项的优先级；
    在所述控制器正常工作，并且所述转发设备根据所述第一数据报文的匹配项查找所述第一流表并且没有命中流表项的情况下，所述转发设备使用优先级高的所述虚拟网络的第二缺省流表项向所述控制器发送所述第一数据报文。
  3. 根据权利要求2所述的方法，其特征在于，所述方法还包括：
    所述转发设备确定所述控制器故障的情况下，设置所述虚拟网络的第一缺省流表项的优先级高于所述虚拟网络的第二缺省流表项的优先级，以便在没有命中流表项的情况下优先使用所述虚拟网络的第一缺省流表项向所述指定的转发设备发送所述第一数据报文。
  4. 根据权利要求2所述的方法，其特征在于，所述方法还包括：
    所述转发设备确定所述控制器正常工作的情况下，设置所述虚拟网络的第一缺省流表项的优先级高于所述虚拟网络的第二缺省流表项的优先级，以便在没有命中流表项的情况下优先使用所述虚拟网络的第一缺省流表项向所述指定的转发设备发送所述第一数据报文。
  5. 根据权利要求2所述的方法，其特征在于，所述方法还包括：
    所述转发设备确定所述控制器故障恢复的情况下，设置所述虚拟网络的第二缺省流表项的优先级高于所述虚拟网络的第一缺省流表项的优先级，以便在没有命中流表项的情况下优先使用所述虚拟网络的第二缺省流表项向所述控制器发送所述第一数据报文。
  6. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    所述转发设备接收来自所述控制器的所述虚拟网络的第二缺省流表项，所述虚拟网络的第二缺省流表项指示所述转发设备根据所述虚拟网络内的数据报文的匹配项查找第二流表并且没有命中流表项时，将所述虚拟网络内的数据报文向所述控制器发送；
    在所述控制器正常工作，并且所述转发设备根据所述第一数据报文的匹配项查找所述第二流表并且没有命中流表项的情况下，所述转发设备使用所述虚拟网络的第二缺省流表项向所述控制器发送所述第一数据报文。
  7. 根据权利要求6所述的方法，其特征在于，所述方法还包括：
    所述转发设备接收来自所述控制器的所述虚拟网络的第三缺省流表项，所述虚拟网络的第三缺省流表项指示所述转发设备根据所述虚拟网络内的数据报文的匹配项查找第三流表并且没有命中流表项的情况下，将所述虚拟网络内的数据报文依据所述第一流表发送；
    在所述控制器发生故障，并且所述转发设备根据所述第一数据报文的匹配项查找所述第三流表并且没有命中流表项的情况下，所述转发设备根据所述虚拟网络的第三缺省流表项的指示依据所述第一流表发送所述第一数据报文。
  8. 根据权利要求7所述的方法，其特征在于，所述方法还包括：
    所述转发设备接收来自所述控制器的所述虚拟网络的第四缺省流表项，所述虚拟网络的第四缺省流表项指示所述转发设备根据所述虚拟网络内的数据报文的匹配项查找所述第三流表并且没有命中流表项的情况下，将所述虚拟网络内的数据报文依据所述第二流表发送；所述虚拟网络的第四缺省流表项的优先级大于所述虚拟网络的第三缺省流表项的优先级；
    在所述控制器正常工作，并且所述转发设备根据所述第一数据报文的匹配项查找所述第三流表并且没有命中流表项的情况下，所述转发设备根据优先级高的所述虚拟网络的第四缺省流表项的指示依据所述第二流表发送所述第一数据报文。
  9. 根据权利要求8所述的方法，其特征在于，所述方法还包括：
    所述转发设备确定所述控制器故障的情况下，设置所述虚拟网络的第三缺省流表项的优先级高于所述虚拟网络的第四缺省流表项的优先级，以便在没有命中流表项的情况下优先根据所述虚拟网络的第三缺省流表项的指示依据所述第一流表发送所述第一数据报文。
  10. 根据权利要求8所述的方法，其特征在于，所述方法还包括：
    所述转发设备确定所述控制器正常工作的情况下，设置所述虚拟网络的第三缺省流表项的优先级高于所述虚拟网络的第四缺省流表项的优先级，以便在没有命中流表项的情况下优先根据所述虚拟网络的第三缺省流表项的指示依据所述第一流表发送所述第一数据报文。
  11. 根据权利要求8所述的方法，其特征在于，所述方法还包括：
    所述转发设备确定所述控制器故障恢复的情况下，设置所述虚拟网络的第四缺省流表项的优先级高于所述虚拟网络的第三缺省流表项的优先级，以便在没有命中流表项的情况下优先根据所述虚拟网络的第四缺省流表项的指示依据所述第二流表发送所述第一数据报文。
  12. 根据权利要求1至11任一所述的方法，其特征在于，所述虚拟网络的第一缺省流表项为在三层虚拟网络内指导三层转发的流表项；
    所述将所述虚拟网络内的数据报文向指定的转发设备发送具体为将所述三层虚拟网络内的数据报文向保存有所述三层虚拟网络内的全部或部分路由转发信息的转发 设备发送。
  13. 根据权利要求1至11任一所述的方法，其特征在于，所述虚拟网络的第一缺省流表项为在二层虚拟网络内指导二层转发的流表项；
    所述将所述虚拟网络内的数据报文向指定的转发设备发送具体为将所述二层虚拟网络内的数据报文向所述二层虚拟网络内的转发设备广播发送。
  14. 一种发送流表项的方法，其特征在于，应用于控制转发分离的虚拟网络中，所述虚拟网络包括控制器和转发设备，所述方法包括：
    所述控制器生成所述虚拟网络的第一缺省流表项，所述虚拟网络的第一缺省流表项指示所述转发设备在所述控制器发生故障以及所述转发设备根据所述虚拟网络内的数据报文的匹配项查找流表并且没有命中流表项的情况下，将所述虚拟网络内的数据报文向指定的转发设备发送，或指示所述转发设备在所述控制器正常工作以及所述转发设备根据所述虚拟网络内的数据报文的匹配项查找流表并且没有命中流表项的情况下，将所述虚拟网络内的数据报文向所述指定的转发设备发送；
    所述控制器生成所述虚拟网络的第二缺省流表项，所述虚拟网络的第二缺省流表项指示所述转发设备在控制器正常工作以及所述转发设备根据所述虚拟网络内的数据报文的匹配项查找所述流表并且没有命中流表项的情况下，将所述虚拟网络内的数据报文向所述控制器发送；
    所述控制器向所述转发设备发送所述虚拟网络的第一缺省流表项和所述虚拟网络的第二缺省流表项。
  15. 根据权利要求14所述的方法，其特征在于，
    所述虚拟网络的第一缺省流表项为第一流表中的表项，所述指示所述转发设备在控制器发生故障以及转发设备根据所述虚拟网络内的数据报文的匹配项查找所述流表并且没有命中流表项具体为查找所述第一流表并且没有命中流表项；
    所述虚拟网络的第二缺省流表项为所述第一流表中的表项，所述指示所述转发设备在控制器正常工作以及转发设备根据所述虚拟网络内的数据报文的匹配项查找所述流表并且没有命中流表项具体为查找所述第一流表并且没有命中流表项。
  16. 根据权利要求14所述的方法，其特征在于，
    所述虚拟网络的第一缺省流表项为第一流表中的表项，所述指示所述转发设备在控制器发生故障以及转发设备根据所述虚拟网络内的数据报文的匹配项查找所述流表并且没有命中流表项具体为查找所述第一流表并且没有命中流表项；
    所述虚拟网络的第二缺省流表项为第二流表中的表项，所述指示所述转发设备在控制器正常工作以及转发设备根据所述虚拟网络内的数据报文的匹配项查找所述流表并且没有命中流表项具体为查找所述第二流表并且没有命中流表项。
  17. 根据权利要求16所述的方法，其特征在于，所述方法还包括：
    所述控制器生成所述虚拟网络的第三缺省流表项，所述虚拟网络的第三缺省流表项指示所述转发设备在控制器发生故障以及所述转发设备根据所述虚拟网络内的数据报文的匹配项查找第三流表并且没有命中流表项的情况下，将所述虚拟网络内的数据报文依据所述第一流表发送；
    所述控制器向所述转发设备发送所述虚拟网络的第三缺省流表项。
  18. 根据权利要求17所述的方法，其特征在于，所述方法还包括：
    所述控制器生成所述虚拟网络的第四缺省流表项，所述虚拟网络的第四缺省流表项指示所述转发设备在控制器正常工作以及所述转发设备根据所述虚拟网络内的数据报文的匹配项查找所述第三流表并且没有命中流表项的情况下，将所述虚拟网络内的数据报文依据所述第二流表发送；
    所述控制器向所述转发设备发送所述虚拟网络的第四缺省流表项。
  19. 一种转发设备，其特征在于，应用于控制转发分离的虚拟网络中，所述虚拟网络包括控制器和所述转发设备，所述转发设备包括：
    接收单元，用于接收来自所述控制器的所述虚拟网络的第一缺省流表项，所述虚拟网络的第一缺省流表项指示所述转发设备根据所述虚拟网络内的数据报文的匹配项查找第一流表并且没有命中流表项的情况下，将所述虚拟网络内的数据报文向指定的转发设备发送；
    所述接收单元，还用于接收来自端系统ES的所述虚拟网络内的第一数据报文；
    处理单元，用于在所述控制器发生故障，并且所述转发设备根据所述第一数据报文的匹配项查找所述第一流表并且没有命中流表项的情况下，确定使用所述虚拟网络的第一缺省流表项转发所述第一数据报文；
    发送单元，用于向所述指定的转发设备发送所述第一数据报文。
  20. 根据权利要求19所述的转发设备，其特征在于，所述转发设备还包括：
    所述接收单元，还用于接收来自控制器的所述虚拟网络的第二缺省流表项，所述虚拟网络的第二缺省流表项指示所述转发设备根据所述虚拟网络内的数据报文的匹配项查找所述第一流表并且没有命中流表项的情况下，将所述虚拟网络内的数据报文向所述控制器发送；所述虚拟网络的第二缺省流表项的优先级高于所述虚拟网络的第一缺省流表项的优先级；
    所述处理单元，还用于在所述控制器正常工作，并且所述转发设备根据所述第一数据报文的匹配项查找所述第一流表并且没有命中流表项的情况下，确定使用优先级高的所述虚拟网络的第二缺省流表项转发所述第一数据报文；
    所述发送单元，还用于向所述控制器发送所述第一数据报文。
  21. 根据权利要求20所述的转发设备，其特征在于，
    所述处理单元，还用于在确定所述控制器故障的情况下，设置所述虚拟网络的第一缺省流表项的优先级高于所述虚拟网络的第二缺省流表项的优先级。
  22. 根据权利要求20所述的转发设备，其特征在于，
    所述处理单元，还用于在确定所述控制器正常工作的情况下，设置所述虚拟网络的第一缺省流表项的优先级高于所述虚拟网络的第二缺省流表项的优先级，以及在没有命中流表项的情况下优先根据所述虚拟网络的第一缺省流表项指令所述发送单元发送所述第一数据报文。
  23. 根据权利要求20所述的转发设备，其特征在于，
    所述处理单元，还用于在确定所述控制器故障恢复的情况下，设置所述虚拟网络的第二缺省流表项的优先级高于所述虚拟网络的第一缺省流表项的优先级，以及在没有命中流表项的情况下根据所述虚拟网络的第二缺省流表项指令所述发送单元发送所 述第一数据报文。
  24. 根据权利要求19所述的转发设备，其特征在于，
    所述接收单元，还用于接收来自所述控制器的所述虚拟网络的第二缺省流表项，所述虚拟网络的第二缺省流表项指示所述转发设备根据所述虚拟网络内的数据报文的匹配项查找第二流表并且没有命中流表项的情况下，将所述虚拟网络内的数据报文向所述控制器发送；
    所述处理单元，还用于在所述控制器正常工作，并且所述转发设备根据所述第一数据报文的匹配项查找所述第二流表并且没有命中流表项的情况下，确定使用所述虚拟网络的第二缺省流表项转发所述第一数据报文；
    所述发送单元，还用于向所述控制器发送所述第一数据报文。
  25. 根据权利要求24所述的转发设备，其特征在于，
    所述接收单元，还用于接收来自所述控制器的所述虚拟网络的第三缺省流表项，所述虚拟网络的第三缺省流表项指示所述转发设备根据所述虚拟网络内的数据报文的匹配项查找第三流表并且没有命中流表项的情况下，将所述虚拟网络内的数据报文依据所述第一流表发送；
    所述处理单元，还用于在所述控制器发生故障，并且所述转发设备根据所述第一数据报文的匹配项查找所述第三流表并且没有命中流表项的情况下，根据所述虚拟网络的第三缺省流表项的指示确定将所述第一流表作为转发所述第一数据报文的依据；
    所述发送单元，还用于依据所述处理单元的确定结果发送所述第一数据报文。
  26. 根据权利要求25所述的转发设备，其特征在于，
    所述接收单元，还用于接收来自所述控制器的所述虚拟网络的第四缺省流表项，所述虚拟网络的第四缺省流表项指示所述转发设备根据所述虚拟网络内的数据报文的匹配项查找所述第三流表并且没有命中流表项的情况下，将所述虚拟网络内的数据报文向所述第二流表发送；所述虚拟网络的第四缺省流表项的优先级大于所述虚拟网络的第三缺省流表项的优先级；
    所述处理单元，还用于在所述控制器正常工作，并且所述转发设备根据所述第一数据报文的匹配项查找所述第三流表并且没有命中流表项的情况下，根据所述虚拟网络的第四缺省流表项的指示确定将所述第二流表作为转发所述第一数据报文的依据；
    所述发送单元，还用于依据所述处理单元的确定结果发送所述第一数据报文。
  27. 根据权利要求26所述的转发设备，其特征在于，
    所述处理单元，还用于在确定所述控制器故障的情况下，设置所述虚拟网络的第三缺省流表项的优先级高于所述虚拟网络的第四缺省流表项的优先级。
  28. 根据权利要求26所述的转发设备，其特征在于，
    所述处理单元，还用于在确定所述控制器正常工作的情况下，设置所述虚拟网络的第三缺省流表项的优先级高于所述虚拟网络的第四缺省流表项的优先级，以及在没有命中流表项的情况下优先根据所述虚拟网络的第三缺省流表项指令所述发送单元发送所述第一数据报文。
  29. 根据权利要求26所述的转发设备，其特征在于，
    所述处理单元，还用于在确定所述控制器故障恢复的情况下，设置所述虚拟网络 的第四缺省流表项的优先级高于所述虚拟网络的第三缺省流表项的优先级，以及在没有命中流表项的情况下优先根据所述虚拟网络的第四缺省流表项指令所述发送单元发送所述第一数据报文。
  30. 一种控制器，其特征在于，应用于控制转发分离的虚拟网络中，所述虚拟网络包括控制器和转发设备，所述控制器包括：
    处理单元，用于生成所述虚拟网络的第一缺省流表项，所述虚拟网络的第一缺省流表项指示所述转发设备在所述控制器发生故障以及所述转发设备根据所述虚拟网络内的数据报文的匹配项查找流表并且没有命中流表项的情况下，将所述虚拟网络内的数据报文向指定的转发设备发送，或指示所述转发设备在所述控制器正常工作以及所述转发设备根据所述虚拟网络内的数据报文的匹配项查找流表并且没有命中流表项的情况下，将所述虚拟网络内的数据报文向所述指定的转发设备发送；
    所述处理单元，还用于生成所述虚拟网络的第二缺省流表项，所述虚拟网络的第二缺省流表项指示所述转发设备在控制器正常工作以及所述转发设备根据所述虚拟网络内的数据报文的匹配项查找所述流表并且没有命中流表项的情况下，将所述虚拟网络内的数据报文向所述控制器发送；
    发送单元，用于向所述转发设备发送所述虚拟网络的第一缺省流表项和所述虚拟网络的第二缺省流表项。
  31. 根据权利要求30所述的控制器，其特征在于，
    所述虚拟网络的第一缺省流表项为第一流表中的表项，所述指示所述转发设备在控制器发生故障以及转发设备根据所述虚拟网络内的数据报文的匹配项查找所述流表并且没有命中流表项具体为查找所述第一流表并且没有命中流表项；
    所述虚拟网络的第二缺省流表项为所述第一流表中的表项，所述指示所述转发设备在控制器正常工作以及转发设备根据所述虚拟网络内的数据报文的匹配项查找所述流表并且没有命中流表项具体为查找所述第一流表并且没有命中流表项。
  32. 根据权利要求30所述的控制器，其特征在于，
    所述虚拟网络的第一缺省流表项为第一流表中的表项，所述指示所述转发设备在控制器发生故障以及转发设备根据所述虚拟网络内的数据报文的匹配项查找所述流表并且没有命中流表项具体为查找所述第一流表并且没有命中流表项；
    所述虚拟网络的第二缺省流表项为第二流表中的表项，所述指示所述转发设备在控制器正常工作以及转发设备根据所述虚拟网络内的数据报文的匹配项查找所述流表并且没有命中流表项具体为查找所述第二流表并且没有命中流表项。
  33. 根据权利要求32所述的控制器，其特征在于，
    所述处理单元，还用于生成所述虚拟网络的第三缺省流表项，所述虚拟网络的第三缺省流表项指示所述转发设备在控制器发生故障以及所述转发设备根据所述虚拟网络内的数据报文的匹配项查找第三流表并且没有命中流表项的情况下，将所述虚拟网络内的数据报文依据所述第一流表发送；
    所述发送单元，还用于向所述转发设备发送所述虚拟网络的第三缺省流表项。
  34. 根据权利要求33所述的控制器，其特征在于，
    所述处理单元，还用于生成所述虚拟网络的第四缺省流表项，所述虚拟网络的第 四缺省流表项指示所述转发设备在控制器正常工作以及所述转发设备根据所述虚拟网络内的数据报文的匹配项查找所述第三流表并且没有命中流表项的情况下，将所述虚拟网络内的数据报文依据所述第二流表发送；
    所述发送单元，还用于向所述转发设备发送所述虚拟网络的第四缺省流表项。
  35. 一种转发设备，其特征在于，应用于控制转发分离的虚拟网络中，所述虚拟网络包括控制器和所述转发设备，所述转发设备包括：
    收发器，用于接收来自所述控制器的所述虚拟网络的第一缺省流表项，所述虚拟网络的第一缺省流表项指示所述转发设备根据所述虚拟网络内的数据报文的匹配项查找第一流表并且没有命中流表项的情况下，将所述虚拟网络内的数据报文向指定的转发设备发送；
    所述收发器，还用于接收来自端系统ES的所述虚拟网络内的第一数据报文；
    处理器，用于在所述控制器发生故障，并且所述转发设备根据所述第一数据报文的匹配项查找所述第一流表并且没有命中流表项的情况下，确定使用所述虚拟网络的第一缺省流表项转发所述第一数据报文；
    所述收发器，还用于向所述指定的转发设备发送所述第一数据报文。
  36. 一种控制器，其特征在于，应用于控制转发分离的虚拟网络中，所述虚拟网络包括控制器和转发设备，所述控制器包括：
    处理器，用于生成所述虚拟网络的第一缺省流表项，所述虚拟网络的第一缺省流表项指示所述转发设备在所述控制器发生故障以及所述转发设备根据所述虚拟网络内的数据报文的匹配项查找流表并且没有命中流表项的情况下，将所述虚拟网络内的数据报文向指定的转发设备发送，或指示所述转发设备在所述控制器正常工作以及所述转发设备根据所述虚拟网络内的数据报文的匹配项查找流表并且没有命中流表项的情况下，将所述虚拟网络内的数据报文向所述指定的转发设备发送；
    所述处理器，还用于生成所述虚拟网络的第二缺省流表项，所述虚拟网络的第二缺省流表项指示所述转发设备在控制器正常工作以及所述转发设备根据所述虚拟网络内的数据报文的匹配项查找所述流表并且没有命中流表项的情况下，将所述虚拟网络内的数据报文向所述控制器发送；
    收发器，用于向所述转发设备发送所述虚拟网络的第一缺省流表项和所述虚拟网络的第二缺省流表项。
  37. 一种转发数据报文的系统，其特征在于，所述系统包括如权利要求19至29任一所述的转发设备和如权利要求30至34任一所述的控制器；或者所述系统包括如权利要求35所述的转发设备和如权利要求36所述的控制器。
PCT/CN2018/082435 2017-04-11 2018-04-10 一种转发数据报文的方法、设备和系统 WO2018188569A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP18784557.3A EP3588876B1 (en) 2017-04-11 2018-04-10 Method, device and system for forwarding data messages
US16/598,506 US11146488B2 (en) 2017-04-11 2019-10-10 Data packet forwarding method, device, and system

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710233682.4 2017-04-11
CN201710233682.4A CN108696434B (zh) 2017-04-11 2017-04-11 一种转发数据报文的方法、设备和系统

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/598,506 Continuation US11146488B2 (en) 2017-04-11 2019-10-10 Data packet forwarding method, device, and system

Publications (1)

Publication Number Publication Date
WO2018188569A1 true WO2018188569A1 (zh) 2018-10-18

Family

ID=63793115

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/082435 WO2018188569A1 (zh) 2017-04-11 2018-04-10 一种转发数据报文的方法、设备和系统

Country Status (4)

Country Link
US (1) US11146488B2 (zh)
EP (1) EP3588876B1 (zh)
CN (1) CN108696434B (zh)
WO (1) WO2018188569A1 (zh)

Families Citing this family (36)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10454714B2 (en) 2013-07-10 2019-10-22 Nicira, Inc. Method and system of overlay flow control
US10135789B2 (en) 2015-04-13 2018-11-20 Nicira, Inc. Method and system of establishing a virtual private network in a cloud service for branch networking
US11706127B2 (en) 2017-01-31 2023-07-18 Vmware, Inc. High performance software-defined core network
US20180219765A1 (en) 2017-01-31 2018-08-02 Waltz Networks Method and Apparatus for Network Traffic Control Optimization
US10992568B2 (en) 2017-01-31 2021-04-27 Vmware, Inc. High performance software-defined core network
US20200036624A1 (en) 2017-01-31 2020-01-30 The Mode Group High performance software-defined core network
US10523539B2 (en) 2017-06-22 2019-12-31 Nicira, Inc. Method and system of resiliency in cloud-delivered SD-WAN
US11115480B2 (en) 2017-10-02 2021-09-07 Vmware, Inc. Layer four optimization for a virtual network defined over public cloud
US10778466B2 (en) 2017-10-02 2020-09-15 Vmware, Inc. Processing data messages of a virtual network that are sent to and received from external service machines
US10999100B2 (en) 2017-10-02 2021-05-04 Vmware, Inc. Identifying multiple nodes in a virtual network defined over a set of public clouds to connect to an external SAAS provider
US11223514B2 (en) 2017-11-09 2022-01-11 Nicira, Inc. Method and system of a dynamic high-availability mode based on current wide area network connectivity
US11252105B2 (en) * 2019-08-27 2022-02-15 Vmware, Inc. Identifying different SaaS optimal egress nodes for virtual networks of different entities
US11044190B2 (en) 2019-10-28 2021-06-22 Vmware, Inc. Managing forwarding elements at edge nodes connected to a virtual network
US11489783B2 (en) 2019-12-12 2022-11-01 Vmware, Inc. Performing deep packet inspection in a software defined wide area network
CN113037599A (zh) * 2019-12-24 2021-06-25 中兴通讯股份有限公司 一种报文处理的方法、设备及存储介质
US11606712B2 (en) 2020-01-24 2023-03-14 Vmware, Inc. Dynamically assigning service classes for a QOS aware network link
US11689455B2 (en) 2020-05-28 2023-06-27 Oracle International Corporation Loop prevention in virtual layer 2 networks
CN113079030B (zh) * 2020-05-29 2022-05-24 新华三信息安全技术有限公司 配置信息下发方法和接入设备
US11463355B2 (en) * 2020-07-14 2022-10-04 Oracle International Corporation Systems and methods for a VLAN switching and routing service
US11709710B2 (en) 2020-07-30 2023-07-25 Vmware, Inc. Memory allocator for I/O operations
US11575600B2 (en) 2020-11-24 2023-02-07 Vmware, Inc. Tunnel-less SD-WAN
CN112615914B (zh) * 2020-12-10 2022-07-05 中国电信股份有限公司江苏分公司 一种利用边界网关协议传递组播热备表项的方法
US11929903B2 (en) 2020-12-29 2024-03-12 VMware LLC Emulating packet flows to assess network links for SD-WAN
US11652743B2 (en) 2020-12-30 2023-05-16 Oracle International Corporation Internet group management protocol (IGMP) of a layer-2 network in a virtualized cloud environment
US11792127B2 (en) 2021-01-18 2023-10-17 Vmware, Inc. Network-aware load balancing
US11979325B2 (en) 2021-01-28 2024-05-07 VMware LLC Dynamic SD-WAN hub cluster scaling with machine learning
US11671355B2 (en) 2021-02-05 2023-06-06 Oracle International Corporation Packet flow control in a header of a packet
US11777897B2 (en) 2021-02-13 2023-10-03 Oracle International Corporation Cloud infrastructure resources for connecting a service provider private network to a customer private network
US11616849B2 (en) * 2021-02-15 2023-03-28 Lilac Cloud, Inc. Distributed split edge application architecture
US11582144B2 (en) 2021-05-03 2023-02-14 Vmware, Inc. Routing mesh to provide alternate routes through SD-WAN edge forwarding nodes based on degraded operational states of SD-WAN hubs
US11729065B2 (en) 2021-05-06 2023-08-15 Vmware, Inc. Methods for application defined virtual network service among multiple transport in SD-WAN
CN113347100B (zh) * 2021-05-31 2022-06-17 平安科技（深圳）有限公司 数据流传输方法、装置、计算机设备及存储介质
US11943146B2 (en) 2021-10-01 2024-03-26 VMware LLC Traffic prioritization in SD-WAN
US11909815B2 (en) 2022-06-06 2024-02-20 VMware LLC Routing based on geolocation costs
CN115225708B (zh) * 2022-07-28 2023-08-08 天翼云科技有限公司 一种报文转发方法计算机设备及存储介质
CN115134315B (zh) * 2022-09-01 2022-12-02 珠海星云智联科技有限公司 报文转发方法及相关装置

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20140098669A1 (en) * 2012-10-08 2014-04-10 Vipin Garg Method and apparatus for accelerating forwarding in software-defined networks
CN104320340A (zh) * 2014-10-21 2015-01-28 杭州华三通信技术有限公司 软件定义网络中学习源mac地址的方法和装置
CN105959217A (zh) * 2016-06-06 2016-09-21 北京邮电大学 一种sdn移动自组网的数据处理方法及装置

Family Cites Families (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6862622B2 (en) * 1998-07-10 2005-03-01 Van Drebbel Mariner Llc Transmission control protocol/internet protocol (TCP/IP) packet-centric wireless point to multi-point (PTMP) transmission system architecture
US8416796B2 (en) * 2011-05-06 2013-04-09 Big Switch Networks, Inc. Systems and methods for managing virtual switches
CN103259725B (zh) * 2012-02-21 2017-04-12 华为技术有限公司 报文发送方法和网络设备
CN102685006A (zh) * 2012-05-03 2012-09-19 中兴通讯股份有限公司 一种转发数据报文的方法及装置
US9548920B2 (en) * 2012-10-15 2017-01-17 Cisco Technology, Inc. System and method for efficient use of flow table space in a network environment
US9197569B2 (en) * 2013-12-06 2015-11-24 Algoblu Holdings Limited Hierarchical control in software-defined network (SDN)
CN103916314A (zh) * 2013-12-26 2014-07-09 杭州华为数字技术有限公司 报文转发控制方法和相关装置及物理主机
CN105099920A (zh) * 2014-04-30 2015-11-25 杭州华三通信技术有限公司 一种设置sdn流表项的方法和装置
CN106101297B (zh) * 2016-06-02 2019-07-05 新华三技术有限公司 一种报文应答方法及装置
CN106302265B (zh) * 2016-07-21 2019-08-06 新华三技术有限公司 报文转发方法及装置
CN106231003B (zh) * 2016-07-28 2019-09-17 新华三技术有限公司 一种地址分配方法及装置
US10623308B2 (en) * 2017-02-17 2020-04-14 Dell Products L.P. Flow routing system

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20140098669A1 (en) * 2012-10-08 2014-04-10 Vipin Garg Method and apparatus for accelerating forwarding in software-defined networks
CN104320340A (zh) * 2014-10-21 2015-01-28 杭州华三通信技术有限公司 软件定义网络中学习源mac地址的方法和装置
CN105959217A (zh) * 2016-06-06 2016-09-21 北京邮电大学 一种sdn移动自组网的数据处理方法及装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3588876A4

Also Published As

Publication number Publication date
EP3588876A4 (en) 2020-02-19
US11146488B2 (en) 2021-10-12
CN108696434A (zh) 2018-10-23
EP3588876B1 (en) 2023-04-05
CN108696434B (zh) 2022-01-14
EP3588876A1 (en) 2020-01-01
US20200044969A1 (en) 2020-02-06

Similar Documents

Publication Publication Date Title
WO2018188569A1 (zh) 一种转发数据报文的方法、设备和系统
US10116559B2 (en) Operations, administration and management (OAM) in overlay data center environments
US10333836B2 (en) Convergence for EVPN multi-homed networks
US10397049B2 (en) Auto-provisioning edge devices in a communication network using control plane communications
US9864619B2 (en) Systems and methods for a data center architecture facilitating layer 2 over layer 3 communication
EP3041179B1 (en) A method and apparatus for use in network management
EP2874359B1 (en) Extended ethernet fabric switches
US10237377B2 (en) Packet rewriting apparatus, control apparatus, communication system, packet transmission method and program
US10237179B2 (en) Systems and methods of inter data center out-bound traffic management
US10462038B2 (en) Control apparatus, communication system, tunnel endpoint control method, and program
EP3197107B1 (en) Message transmission method and apparatus
US11108683B2 (en) Techniques for preferred path local switching in EVPN-VPWS
CN114342342A (zh) 跨多个云的分布式服务链
US20170118066A1 (en) Data plane to forward traffic based on communications from a software defined (sdn) controller during a control plane failure
WO2016082739A1 (en) Layer-3 forwarding in vxlan
WO2013185715A1 (zh) 一种实现虚拟网络的方法和虚拟网络
EP4325777A1 (en) Method and device for electing designated forwarder (df)
EP4175208A1 (en) Message sending method, device and system
WO2015137977A1 (en) A switching fabric including a virtual switch
CN115988074A (zh) 分布式隧道结构的虚拟网关的动态流量重定向

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18784557

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2018784557

Country of ref document: EP

Effective date: 20190926

NENP Non-entry into the national phase

Ref country code: DE