WO2021147358A1 - 一种网络接口的建立方法、装置及系统 - Google Patents

一种网络接口的建立方法、装置及系统 Download PDF

Info

Publication number
WO2021147358A1
WO2021147358A1 PCT/CN2020/116855 CN2020116855W WO2021147358A1 WO 2021147358 A1 WO2021147358 A1 WO 2021147358A1 CN 2020116855 W CN2020116855 W CN 2020116855W WO 2021147358 A1 WO2021147358 A1 WO 2021147358A1
Authority
WO
WIPO (PCT)
Prior art keywords
network
vnf
network interface
agent
interface
Prior art date
Application number
PCT/CN2020/116855
Other languages
English (en)
French (fr)
Inventor
翟满召
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2021147358A1 publication Critical patent/WO2021147358A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/54—Organization of routing tables
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/74—Address processing for routing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0894—Policy-based network configuration management
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0895—Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/34—Signalling channels for network management communication
    • H04L41/342—Signalling channels for network management communication between virtual entities, e.g. orchestrators, SDN or NFV entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/40—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks using virtualisation of network functions or resources, e.g. SDN or NFV entities

Definitions

  • the embodiments of the present application relate to the field of communication technologies, and in particular, to a method, device, and system for establishing a network interface.
  • Network function virtualization provides a new way to design, deploy, and manage network services (network service, NS). It implements some telecom network functions in common servers, switches, and storage. The decoupling of software and hardware enables fast and efficient deployment of NS. Because NFV requires a lot of virtualized resources, it requires a high degree of software management, which the industry calls orchestration.
  • Network function virtualization management and orchestration (network function virtualization management and orchestrator, NFV MANO) is an architectural framework for managing and coordinating virtual network functions (VNF) and other software components.
  • the NFV MANO system adopts a centralized orchestration method. Users can orchestrate the network services (network services) they need according to their own needs.
  • a series of VNF templates, virtual links (VL) and The virtual network function forwarding graph (VNF Forwarding Graph, VNFFG) forms a standard-defined template. Analyze the generated template during deployment, map and associate network service data and service resources, and deploy the involved network function software to the network function virtualization infrastructure (NFVI) through standard interfaces. ) Resource layer.
  • NFVI network function virtualization infrastructure
  • NFVI network function virtualization infrastructure
  • NFVI network function virtualization infrastructure
  • NFVI network function virtualization infrastructure
  • an executable central process is used to coordinate internal and external service interactions, and the central process is used to control the overall goals, operations, and service invocation sequence. Therefore, the NFV MANO orchestration system requires a large number of components, complex deployment, high resource consumption, and high coupling between components, which cannot be upgraded independently.
  • the embodiments of the present application provide a method, device, and system for establishing a network interface to solve the problem of complicated component deployment, high coupling between components, and inability to independently upgrade.
  • an embodiment of the present application provides a method for establishing a network interface, including: a first network agent receives a first connection request from a first virtualized network function VNF network element, and the first network agent is used to manage the first VNF Network element, the first VNF network element is the requester of the network service, the first connection request is used to request the establishment of the network interface, the network interface is the network interface required to realize the network service, and the first connection request carries the demand information of the network interface.
  • the demand information of the interface is used to describe the network interface required by the network service; the first network agent sends a second connection request to the second network agent.
  • the second connection request carries the demand information of the network interface; the second network agent is used to manage the second VNF network element, and the second VNF network element is the network service provider; after receiving the second connection request, the second network agent
  • the second connection request carries the demand information of the network interface to determine the attribute value of the first network interface.
  • the first network interface is the network interface of the first VNF network element for network communication; then the second network agent sends the attribute value of the first network interface to the first network agent, and the first network agent receives the data sent by the second network agent.
  • the attribute value of the first network interface then, the first network agent establishes the first network interface according to the attribute value of the first network interface, so that the first VNF network element communicates through the first network interface.
  • VNF network elements in the embodiments of the present application only need to perform service-related functions, so that service-related functions and network connection-related functions can be independently upgraded and developed. This further reduces the coupling between components and reduces deployment complexity.
  • the network agent (first network agent, second network agent) and VNF network elements (first VNF network element, second VNF network element) adopt the form of container service.
  • a service grid can be used to deploy network agents and VNF network elements.
  • the requirement information of the network interface includes one or more of the following: the type of the network interface, and the name of the network interface.
  • the VNF network element can request the network agent to establish which type of network interface according to the demand, instead of a static configuration method, so that it can be adapted to different business service scenarios.
  • the first connection request also carries a network service definition identifier; before the first network agent sends the second connection request to the second network agent, it further includes: the first network According to the identifier defined by the network service, the agent queries the configuration rule controller for the next-hop VNF network element of the first VNF network element in the network service to be the second VNF network element; wherein, the network service definition
  • the network service definition corresponding to the identifier includes forwarding relationship information corresponding to the network service.
  • the configuration rule controller is used to provide the network service forwarding relationship for the network agent, which can realize on-demand configuration.
  • the first network agent adapts at least one forwarding plane
  • the establishment of the first network agent to establish the first network interface according to the attribute value of the first network interface includes:
  • the first network agent calls the first forwarding plane of the at least one forwarding plane to establish the first network interface according to the attribute value of the first network interface.
  • the network agent can establish different types of network interfaces and provide different network services by adapting to multiple forwarding planes, and then adapt to different business service scenarios.
  • the at least one forwarding plane may include a forwarding plane based on flow table forwarding, a forwarding plane based on a forwarding model of a traditional physical device, and a forwarding plane based on a physical network port.
  • flow table forwarding can be implemented by using a virtual switch based on openflow.
  • the forwarding of the forwarding model of traditional physical equipment can be implemented based on DVR.
  • it may also include a forwarding plane implemented based on other technologies, which is not limited in the embodiment of the present application.
  • the first VNF network element is deployed on a first node
  • the second VNF network element is deployed on a second node
  • the method further includes: the first network agent invoking the forwarding The plane establishes a first tunnel interface on the first node, and the first tunnel interface is used to connect to the second node.
  • the attribute value of the first network interface includes one or more of the following: the name of the first network interface, the type of the first network interface, and the first network The IP address of the interface.
  • the first connection request also carries the network namespace identifier of the first VNF network element; the method further includes: the first network agent transfers the established first The network interface injects the network namespace corresponding to the network namespace identifier.
  • the method further includes: the first network agent receives a network service policy sent from the configuration rule controller, the network service policy includes a condition for triggering network operation; the first network agent receives a network service policy according to the network service The strategy counts telemetry data, and when it is determined based on the telemetry data that the conditions for triggering network operations are met, a first instruction is sent to the telemetry strategy controller, where the first instruction is used to indicate that the conditions for triggering network operations are met; the first network The agent executes the network operation when receiving the notification sent by the telemetry policy controller for executing the network operation.
  • an embodiment of the present application provides a method for establishing a network interface, including: a second network agent receives a second connection request from a first network agent, the second connection request carries demand information of the network interface, and the second network agent
  • the agent is used to manage the second VNF network element, the second VNF network element is the provider of network services; the first network agent is used to manage the first VNF network element, the first VNF network element is the requester of the network service, and the network interface
  • the demand information is used to describe the network interface required to realize the network service; the second network agent determines the attribute value of the second network interface according to the demand information of the network interface; the second network agent establishes the second network interface according to the attribute value of the second network interface , So that the second VNF network element communicates through the second network interface.
  • VNF network elements in the embodiments of the present application only need to perform service-related functions, so that service-related functions and network connection-related functions can be independently upgraded and developed. This further reduces the coupling between components and reduces deployment complexity.
  • the second network agent determines the attribute value of the first network interface according to the demand information of the network interface, the first network interface is the network interface of the first VNF network element for network communication; the second network The agent sends the attribute value of the first network interface to the first network agent.
  • the second network agent adapts to the forwarding plane, the network interface supported by the forwarding plane meets the network interface required by the network service, and the second network agent establishes the second network interface according to the attribute value of the second network interface , Including: the second network agent calls the forwarding plane according to the attribute value of the second network interface to establish the second network interface.
  • the at least one forwarding plane may include a forwarding plane based on flow table forwarding, a forwarding plane based on a forwarding model of a traditional physical device, and a forwarding plane based on a physical network port.
  • flow table forwarding can be implemented by using a virtual switch based on openflow.
  • the forwarding of the forwarding model of traditional physical equipment can be implemented based on DVR.
  • it may also include a forwarding plane implemented based on other technologies, which is not limited in the embodiment of the present application.
  • the first VNF network element is deployed on the first node, and the second VNF network element is deployed on the second node.
  • the second connection request also carries the demand information of the tunnel.
  • the demand information of the tunnel is used to describe in the first node.
  • a tunnel needs to be established between a node and a second node; the method further includes: the second network agent calls the forwarding plane according to the demand information of the tunnel to establish a second tunnel interface for the second node, and the second tunnel interface is used to connect to the first node.
  • the second network agent receives service registration information sent by the second VNF network element, the service registration information is used to describe the network interface capabilities that the second VNF network element can provide; the second network agent Send the service registration information to the configuration rule controller.
  • the VNF network element as the network service provider reports the network interface capabilities it supports through the network agent, thereby configuring the rule controller, which can be selected according to the request of the network service initiator and the capabilities of the network service provider.
  • the rule controller can be selected according to the request of the network service initiator and the capabilities of the network service provider.
  • the service registration information includes one or more of the following: network protocol IP address allocation strategy, IP address segment, and supported network interface type.
  • the attribute value of the first network interface includes one or more of the following: the name of the first network interface, the type of the first network interface, and the IP address of the first network interface.
  • the attribute value of the first network interface includes the IP address of the first network interface
  • the second network agent determines the attribute value of the first network interface according to the demand information of the network interface, including: The second VNF network element sends the demand information of the network interface; the second network agent receives the IP address of the first network interface sent by the second VNF network element.
  • the attribute value of the second network interface includes one or more of the following: the name of the second network interface, the type of the second network interface, and the IP address of the second network interface.
  • the attribute value of the second network interface includes the IP address of the second network interface
  • the second network agent determines the attribute value of the second network interface according to the demand information of the network interface, including: The second VNF network element sends the demand information of the network interface; the second network agent receives the IP address of the second network interface sent by the second VNF network element.
  • the above method may further include: the second network agent configures the IP address of the second network interface for the second network interface.
  • the above method may further include: the second network agent receives a network service policy sent from the configuration rule controller, the network service policy includes conditions for triggering network operations; the second network agent counts telemetry according to the network service policy Data, and according to the telemetry data, when it is determined that the conditions for triggering network operations are met, a second instruction is sent to the telemetry strategy controller. The second instruction is used to indicate that the conditions for triggering network operations are met; the second network agent receives the telemetry strategy controller sent When used to perform network operation notifications, perform network operations.
  • an embodiment of the present application provides a method for establishing a network interface, including: a network agent receives a connection request sent by a VNF network element, the network agent is used to manage the VNF network element, and the connection request is used to request the establishment of N network planes.
  • Network interface the connection request carries the identification of each of the N network planes, and N is an integer greater than 1.
  • the network agent queries the configuration rule controller for each of the N network planes according to the identification of the N network planes
  • the demand information of the corresponding network interface the demand information of the network interface corresponding to each network plane is used to describe the network interface that needs to be established by each network plane for network connection; the network agent is based on the network interface of each of the N network planes.
  • the demand information of the network interface establishes N network interfaces for the first VNF, and the N network interfaces correspond to the N network planes in a one-to-one correspondence.
  • the network agent can establish network interfaces that adapt to different network planes for VNF network elements according to requirements, adapt to multiple business scenarios, and improve flexibility.
  • an embodiment of the present application provides a method for establishing a network service connection, including: a network agent receives network service definitions of N network planes from a configuration rule controller, where N is an integer greater than 1, where N networks In the network service definition of the plane, the network service definition of each network plane includes the demand information of the network interface of the first VNF network element on each network plane; the network agent calls the forwarding plane as the first according to the network service definitions of N network planes.
  • the VNF establishes N network interfaces, and the N network interfaces correspond to N network planes one-to-one.
  • the network agent can establish network interfaces that adapt to different network planes for VNF network elements, adapt to multiple business scenarios, and improve flexibility.
  • the network service definition of each network plane in the network service definitions of the N network planes includes the demand information of the network interface of the second VNF network element on each network plane, and the first VNF is deployed in the first VNF.
  • the second VNF is deployed on the second node, and the network service definition of the N network planes also includes the demand information of the tunnel between the first node and the second node; the method further includes: the network agent according to the N network planes
  • the network service definition calls the forwarding plane to establish N network interfaces for the second VNF; the network agent calls the forwarding plane according to the demand information of the tunnel to establish tunnel interfaces for the first node and the second node respectively.
  • an embodiment of the present application provides a device that is used to execute the method described in the first aspect or any design of the first aspect, or used to perform the second aspect or any design of the second aspect.
  • the method is used to perform the method described in the third aspect or any design of the third aspect, or is used to perform the method described in the fourth aspect.
  • an embodiment of the present application provides a device, including a processor, the processor is coupled to a memory, and the memory is used to store a program or instruction, and when the program or instruction is executed by the processor, Make the device execute the method described in the first aspect or any design of the first aspect, or execute the method described in the second aspect or any design of the second aspect, or execute the third aspect or any design of the third aspect Or implement the method described in the fourth aspect.
  • an embodiment of the present application provides a chip including a memory and a processor, the memory is used to store a computer program, and the processor is used to call and run the computer program from the memory to execute the first aspect or any of the first aspects.
  • an embodiment of the present application provides a system including a first VNF network element, a first network agent for managing the first VNF network element, a second VNF network element, and a second VNF network element for managing the second VNF network element.
  • the first network agent is configured to execute the method described in the first aspect or any design of the first aspect to establish a first network interface for the first VNF network element;
  • the first VNF network element is configured to perform network communication with the second VNF network element through the first network interface
  • the second network agent is configured to implement the second aspect or any design of the second aspect to establish a second network interface for the second VNF network element;
  • the second VNF network element is configured to perform network communication with the first VNF network element through the second network interface.
  • the system also includes a configuration rule controller.
  • the configuration rule controller receives the configuration of the network administrator, such as configuring the network service definition, for the network agent to query. It is also possible to configure network service policies for network agents (such as the first network agent and the second network agent).
  • the first network agent receives the network service policy sent from the configuration rule controller, and the network service policy includes conditions for triggering network operations; the first network agent counts telemetry data according to the network service policy, and determines that it meets the requirements based on the telemetry data When the condition for triggering the network operation is sent, a first instruction is sent to the telemetry strategy controller, and the first instruction is used to indicate that the condition for triggering the network operation is met; When the notification is made, the execution of the network operation is triggered.
  • the present application provides a computer-readable storage medium having computer instructions stored in the computer-readable storage medium, and when the computer instructions are executed on a computer, the computer executes the first aspect or any of the first aspects.
  • this application provides a computer program product, which includes computer program code, which when the computer program code runs on a computer, causes the computer to execute the method described in the first aspect or any design of the first aspect. , Or execute the method of the second aspect or any design of the second aspect, or execute the method of the third aspect or any design of the third aspect, or execute the method of the fourth aspect.
  • Figure 1 is the architecture diagram of the NFV MANO system
  • FIG. 2 is an architecture diagram of an orchestration system in an embodiment of the application
  • FIG. 3 is a schematic diagram of VNF function split in an embodiment of the application.
  • FIG. 4 is a schematic flowchart of a method for establishing a network interface in an embodiment of the application
  • FIG. 5 is a schematic diagram of the structure of a network agent in an embodiment of the application.
  • FIG. 6 is a schematic diagram of the implementation of the control plane in an embodiment of the application.
  • FIG. 7 is a schematic diagram of a service chain scenario in an embodiment of the application.
  • FIG. 8 is a schematic diagram of system deployment in a service chain scenario in an embodiment of the application.
  • FIG. 9 is a schematic diagram of the establishment process of a network interface in an embodiment of the application.
  • FIG. 10 is a schematic diagram of a forwarding plane deployment implemented by an openflow vSwitch in an embodiment of the application
  • FIG. 11 is a schematic diagram of a forwarding plane deployment of a pure layer 3 network connection implemented by a DVR in an embodiment of the application;
  • FIG. 12 is a schematic diagram of multi-network plane deployment in an embodiment of this application.
  • FIG. 13 is a schematic diagram of a forwarding plane deployment implemented by another openflow vSwitch in an embodiment of the application;
  • FIG. 14 is a schematic diagram of a forwarding plane deployment of a pure layer 3 network connection implemented by another DVR in an embodiment of the application;
  • FIG. 15 is a schematic diagram of the structure of a network agent in an embodiment of this application.
  • FIG. 1 is the architecture diagram of the NFV MANO system.
  • NFV MANO has three main functional blocks, namely NFV orchestrator, VNF manager, and virtualized infrastructure manager (VIM).
  • the NFV orchestrator can orchestrate services and resources, control new network services and integrate VNFs into the virtual architecture.
  • the NFV orchestrator can also verify and authorize resource requests from the NFV infrastructure.
  • the VNF manager can manage the life cycle of the VNF.
  • VIM can control and manage NFV infrastructure, including computing resources, storage resources, and network resources.
  • API application interface
  • the operator s operation support system
  • the operation support system (OSS) and the business support system (BSS) also need to interoperate with the NFV MANO system.
  • API application interface
  • BSS business support system
  • Network function virtualization orchestrator is used to realize the management and processing of network service descriptor (NSD) and virtual network function forwarding graph (VNFFG), The management of the life cycle of network services, and the coordination of virtual network function manager (VNFM) to realize the management of the life cycle of virtual network function (VNF) and the global view function of virtual resources .
  • VNFM used to manage the life cycle of VNF, including VNF descriptor (VNF descriptor, VNFD) management, VNF instantiation, and VNF instance elastic scaling (for example, scaling out/up, and/or scaling Scalingin/down), healing of VNF instances, and termination of VNF instances.
  • VNFM also supports receiving elastic scaling (scaling) policies issued by NFVO to realize automated VNF elastic scaling.
  • Virtualized infrastructure manager Mainly responsible for the management of hardware resources at the infrastructure layer, virtualized resources (including reservation and allocation), as well as the monitoring and fault reporting of virtual resource status, and is provided for upper-layer applications Virtualized resource pool.
  • Operation and business support systems Refers to the existing operation and maintenance systems of operators.
  • Element manager Perform traditional fault, configuration, user, performance, and security management (fault management, configuration management, account management, performance management, security management, FCAPS) functions for VNFs.
  • VNF virtualized network function
  • PNF physical network function
  • EPC virtualized evolved packet core
  • MME mobility management entity
  • SGW service gateway
  • PGW packet data gateway
  • VNF packet data network gateway
  • the VNF may be composed of one or more VNF components (virtual network function component, VNFC) of a lower functional level. Therefore, one VNF can be deployed on multiple virtual machines (VMs), and each VM carries the function of one VNFC. A VNF can also be deployed on a VM.
  • VNF virtual network function component
  • NFV infrastructure consists of hardware resources, virtual resources, and virtualization layers. From the perspective of VNF, the virtualization layer and hardware resources appear to be a complete entity that can provide the required virtual resources.
  • the orchestration method adopted by the NFV MANO system requires a large number of components, complex deployment, high resource consumption, and high coupling between components, which cannot be upgraded independently. Furthermore, the NFV MANO system is not suitable for edge computing scenarios.
  • Service Mesh is a dedicated infrastructure layer, a lightweight and high-performance network agent. Provide secure, fast, and reliable inter-service communication, together with actual application deployment, but transparent to applications.
  • Service Mesh can be considered as the TCP protocol in the microservice era, so service mesh is widely used in information technology (IT) systems.
  • IT information technology
  • VNF has many service management-related content that are different from IT applications. For example, in edge computing scenarios, VNF requires multiple network interfaces and supports multiple interface implementation types, and each interface has different quality attributes.
  • an embodiment of the present application proposes a VNF orchestration system and method, combined with Service Mesh, to establish a lightweight VNF orchestration solution.
  • the VNF orchestration system proposed in this application includes a data plane and a control plane.
  • the data plane includes various VNF network elements, which are deployed in a distributed manner.
  • the control plane can exist in a centralized manner to implement service governance, such as service discovery, telemetry monitoring collection, network element health check, routing and load balancing policy issuance, etc.
  • the control plane may include a configuration rule controller, a telemetry strategy controller, and a security controller.
  • the configuration rule controller is the configuration center of the VNF network element, and is used to deliver configuration data to the VNF network element.
  • the telemetry policy controller is used to collect the telemetry data sent by the VNF network element, and to perform policy control on the VNF network element.
  • the security controller is used for communication security control, including communication connection security, key management, file security, user authentication and authorization, etc.
  • the functions performed by the VNF network element can be divided into business logic, network protocol encoding and decoding, service registration and discovery, L2/L3 layer network connection, and load balancing.
  • the business-related functions and network connection-related functions in each VNF network element in the data plane are split, and different service containers are used. to realise.
  • each VNF network element in the data plane includes VNF business services and network agents.
  • VNF business services are used to implement business-related functions, including business logic and network protocol encoding and decoding.
  • the network proxy is used to implement network connection related functions, including service registration and discovery, L2/L3 layer network connection and load balancing.
  • VNF business services focus on business and have no perception of network agents.
  • the network agent focuses on the basic network functions of the L2/L3 layer and guarantees the quality of service (QoS) of the business service.
  • Network agents can run in a variety of environments, such as kubernetes. Since different VNF network elements have different requirements for service forwarding, different services have different requirements. For example, some VNF network elements have low performance requirements for network interfaces, and ordinary kernel-mode interfaces are sufficient. For another example, some VNF network elements have high requirements on the performance of network interfaces and require physical network cards to pass through the user mode protocol stack. Therefore, the network proxy provided in the embodiments of the present application can adapt (or support) different network forwarding planes.
  • the forwarding plane may include one or more of a forwarding plane based on flow table forwarding, a forwarding plane based on a forwarding model of a traditional physical device, or a forwarding plane based on a physical network port.
  • flow table forwarding can be implemented by using a virtual switch (vSwitch) based on open flow (openflow).
  • vSwitch virtual switch
  • open flow openflow
  • the forwarding of the forwarding model of the traditional physical device can be implemented based on distributed virtual router (DVR).
  • DVR distributed virtual router
  • the forwarding plane based on the physical network port can be implemented based on the physical network card allocation of single root I/O virtualization (Single Root I/O Virtualization, SR-IOV).
  • SR-IOV single root I/O Virtualization
  • it may also include a forwarding plane implemented based on other technologies, which is not limited in the embodiment of the present application.
  • the network proxy may support L2 layer network connection and/or L3 layer network connection.
  • L2 layer network connection it is possible to adapt (or support) a virtual switch based on openflow and/or a software switch based on a traditional physical device forwarding model.
  • the network agent supports the distributed virtual router (DVR) of the pure L3 layer network and/or the single root I/O virtualization (Single Root I/O Virtualization, SR-IOV) Physical network card allocation.
  • DVR distributed virtual router
  • SR-IOV Single Root I/O Virtualization
  • the network agent may also be referred to as a network manager, or other terms may be used, which is not limited in this application.
  • the following takes two VNF network elements as an example to describe the process of establishing a network interface in a network service.
  • the two VNF network elements can be divided into network service requesters and network service providers according to their roles.
  • the requestor of the network service is denoted as NSC
  • the provider of the network service is denoted as NSE.
  • the VNF network element acts as both a requester of network services and a provider of network services.
  • Figure 4 is a schematic diagram of the flow of network service connection.
  • the network administrator configures the network service definition and saves the network service definition in the configuration rule controller.
  • the network service definition may include one or more of the following: the forwarding relationship information corresponding to the network service (such as the original selector and the destination selector of the network connection route), the type of the forwarding plane, and the network required for the network connection Interface type, payload type.
  • Network service definitions can also include network service policies.
  • the network service strategy may include one or more of an elastic scaling strategy, a circuit breaker rule, a traffic rule, and the like.
  • the elastic scaling strategy is used to describe the rules for expanding or shrinking the VNF network element.
  • the elastic scaling strategy includes elastic expansion rules and/or elastic shrinking rules.
  • the fusing rule is a rule used to describe the stop of neighbor establishment.
  • the traffic rule is a rule used to count the traffic generated by the communication between the VNF network element and other VNF network elements.
  • the network service definition may include the definition of the multi-network plane network service and/or the network service strategy.
  • the definition of multi-network plane network service includes network plane implementation type, payload type, and network definition.
  • the network definition may include one or more of network name, subnet, IP address, gateway, and virtual network identifier (vni).
  • the NSE When the NSE starts, it will register with the configuration rule controller for network services.
  • the NSE initiates service registration information to the network agent 2 (NSMgr2), and the service registration information is used to describe the network interface capabilities (NetworkServiceEndpoints) that the NSE can provide.
  • the service registration information may include one or more of IP address allocation strategy, IP address segment, supported network interface type, and so on.
  • the network agent 2 sends the service registration information to the configuration rule controller.
  • the configuration rule controller saves the relevant information of the NSE according to the received service registration information.
  • NSE related information can be saved in the form of a service list, or in other forms, such as an array.
  • the service list may include relevant information of the NSE.
  • the related information of the NSE may include the service registration information of the NSE, and may also include one or more of the NSMgr information to which the NSE belongs, the information of the node where the NSE is located, and the network element information of the NSE.
  • the information of the node where the NSE is located may include one or more of the identity of the node where the NSE is located, and the network interface of the node where the NSE is located.
  • the network element information of the NSE may include the network element identification of the NSE and the like.
  • the NSMgr information to which the NSE belongs, the information of the node where the NSE is located, and the network element information of the NSE can be carried in the service registration information and sent by the network agent 2 to the configuration rule controller.
  • the NSMgr information to which the NSE belongs and the information of the node where the NSE is located can be determined by the configuration rule controller according to the source of the service registration information.
  • the network element information of the NSE can be carried in the service registration information and sent to the configuration rule controller.
  • connection request 1 can carry NSC network service requirement information.
  • the demand information of the NSC network service may include demand information of a network interface.
  • the requirement information of the network interface may include the network interface type required by the NSC network service, and may also include the network interface name of the NSC.
  • the network agent may specify the NSC for the NSC.
  • the requirement information of the NSC network service may also include one or more of the identifier defined by the network service, the network namespace identifier corresponding to the NSC, the domain socket file identifier, and the labels. The identity defined by the network service can be dynamically injected into the NSC when the NSC is deployed.
  • the domain socket file corresponding to the domain socket file identifier is used to establish a call channel with NSMgr (NSMgr1 in the embodiment corresponding to FIG. 4).
  • the labels label is used to locate and identify VNF network elements.
  • the NSC network service requirement information may not include the network interface type required by the NSC network service.
  • the NSC network service requirement information includes the network interface type required by the NSC network service.
  • the NSC When the NSC is started, it can initiate a connection request 1 to NSMgr1 on demand through the init-container. Initialize the container, which can be automatically deleted by the container management platform after the network connection is established.
  • the network agent 1 After receiving the connection request 1, the network agent 1 queries the configuration rule controller for the VNF network elements through which the network service passes according to the demand information of the NSC network service. Such as firewall VNF and gateway VNF.
  • the network agent 1 sends a query request to the configuration rule controller, and the query request may carry demand information of the NSC network service.
  • the configuration rule controller queries the service list according to the demand information of the NSC network service and determines that the next-hop VNF network element is the NSE, and the NSE is located on node2. Specifically, query the network service definition, analyze the default destination selector corresponding to the network connection route, determine the first VNF network element (such as Firewall) that needs to be connected, and then query the firewall VNF from the service list in the above configuration rule controller. On the remote node2 node.
  • VNF network element such as Firewall
  • S405 The network agent 1 on node1 sends a connection request 2 to the network agent 2 of node2.
  • connection request 2 may include the demand information of the network interface.
  • connection request 2 may also carry the demand information of the tunnel.
  • the required information of the tunnel includes one or more of tunnel type information, tunnel establishment strategy, and tunnel interface information.
  • the demand information of the tunnel may be included in the network service definition, and the configuration rule controller is issued to each network agent.
  • the network agent 1 can report the tunnel establishment capability supported by itself to the configuration rule controller, so that the configuration rule controller determines the tunnel establishment capability according to the tunnel establishment capability supported by the network agent 1. demand information.
  • the network agent 1 may determine the tunnel requirement information by the ability to establish a tunnel supported by itself.
  • the tunnel type is virtual extended local area network (VXLAN).
  • the tunnel type can also be other types such as generic routing encapsulation (GRE).
  • GRE generic routing encapsulation
  • the tunnel type information includes identification information used to identify the virtual network to which the tunnel belongs.
  • the identification information used to identify the virtual network to which the tunnel belongs may be a virtual network identifier (VNID).
  • VNID virtual network identifier
  • the tunnel establishment strategy can be configured as a forwarding strategy based on flow table forwarding, a forwarding strategy based on the forwarding model of traditional physical devices, or a forwarding strategy based on physical network ports.
  • the tunnel interface information may include the tunnel interface type, the name of the tunnel interface, the source IP address and the destination IP address of the tunnel interface (for example, the IP address of the node), etc.
  • connection request 2 may no longer carry the demand information of the tunnel. If the NSC and the NSE are located on different nodes, the data transmission tunnels between the different nodes need to be opened, and the connection request 2 carries the demand information of the tunnel.
  • the network agent 2 determines the attribute value of the network interface according to the demand information of the network interface.
  • the network interface may include the network interface of the NSE and the network interface of the NSC.
  • the attribute value of the network interface can include one or more of the following:
  • the name of the NSC network interface may be determined by the network agent 2 according to the name of the NSC network interface carried in the connection request 2, or may be configured by the NSE and sent to the network agent 2.
  • the name of the NSE network interface may be sent by the NSE to the network agent 2, or may be designated by the network agent 2 for the NSE.
  • the IP address of the network interface can be issued by the configuration rule controller, or can be determined through negotiation between the network agent 2 and the NSE.
  • the NSE has the ability to assign the IP address of the network interface, which can be assigned by the NSE.
  • the NSE does not have the ability to assign the IP address of the network interface, and can be assigned by the network agent 2.
  • it is designated by the NSE to be distributed by the network agent 2 and so on.
  • the network agent 2 can also determine who will assign the IP address of the network interface according to the payload type, that is, the network interface IP address allocation strategy, and the network agent 2 can determine the IP address of the network interface assigned by the NSE according to the payload type.
  • the network agent 2 assigns the IP address of the network interface.
  • the network interface IP address allocation strategy can also be used by the network agent to allocate IP addresses according to a centralized IP address pool.
  • the centralized IP address pool can be issued to the network agent by the configuration rule controller.
  • the interface type can include kernel mode interface, user mode interface, and physical interface.
  • the kernel mode interface or the user mode interface can be implemented through different interfaces, such as tap, KNI, dpdkvirtiouser, vhost-user, vhost-user-client, etc.
  • the type of the NSE network interface is consistent with the type of the network interface required in the requirement information of the NSC network interface. If the network interface type supported by NSE, the service quality required by this type of network interface is higher than the type of network interface required by NSC, and the type of network interface established is the type of network interface supported by NSE.
  • IP is used to indicate that a Layer 3 network connection needs to be established.
  • Ethernet is used to indicate that a Layer 2 network connection needs to be established.
  • the IP address of the network interface can be allocated by the NSE. If the payload type is IP, indicating the establishment of an L3 network connection, the network agent 2 can allocate the NSE according to the centralized IP address pool.
  • the network agent 2 calls the forwarding plane to establish an NSE network interface and establish a node 2 (node2) tunnel interface. Configure the corresponding IP address for the established NSE network interface, and configure the IP address for the node 2 tunnel interface. Exemplarily, the IP address of the node2 tunnel interface may be the IP address of node2.
  • the network agent 2 injects the established NSE network interface into the NSE network namespace.
  • connection response 2 The network agent 2 sends a connection response 2 to the network agent 1, where the connection response 2 carries the attribute value of the NSC network interface. For example, it includes one or more of IP address, NSC network interface name, and interface type.
  • the network agent 1 After receiving the connection response 2, the network agent 1 calls the forwarding plane, establishes the NSC network interface and the NSC tunnel interface, configures the IP address for the NSC network interface, and configures the IP address of the tunnel interface for the NSC tunnel interface. The network agent 1 injects the established NSC network interface into the NSC network namespace.
  • Connection response 1 is used to notify the completion of the network interface establishment.
  • the network agent can have multiple components. Exemplarily, referring to FIG. 5, the network agent may include a first communication module, a second communication module, a forwarding plane adaptation module, and a rule module. It should be noted that the functions of several components are briefly described as follows, and the description will be carried out in combination with specific scenarios later.
  • the first communication module is the core component of the network connection, responsible for initiating and receiving network service requests. Taking network agent 1 as an example, nsmd in network agent 1 is used to receive connection request 1 from NSC and send connection request 2 to network agent 2.
  • the second communication module (nsmd-k8s): is responsible for communicating with the control plane, such as network service registration and discovery. Taking network agent 2 as an example, nsmd-k8s in network agent 2 is used to send service registration information to the configuration rule controller.
  • Rule-agent receives configuration rules and configuration policies issued by the configuration rule controller, and notifies the VNF network elements.
  • Forwarding plane adaptation module responsible for adapting to different forwarding planes.
  • the forwarding plane may include one or more of a forwarding plane based on flow table forwarding, a forwarding plane based on a forwarding model of a traditional physical device, or a forwarding plane based on a physical network port.
  • the network agent may also include:
  • Interface monitoring module responsible for monitoring the status of the NSC network interface. If an abnormality is found in the NSC interface, it will clean up all the network interfaces corresponding to the network service and re-initiate the connection request.
  • Telemetry module responsible for VNF network element telemetry data collection.
  • Nsmdp responsible for establishing a remote procedure call (RPC) channel between the VNF network element and the network agent. Specifically, it can be used to start the gRPC server deployed in the VNF network element.
  • RPC remote procedure call
  • SR-IOV control module responsible for the distribution of SR-IOV physical network cards.
  • the division of modules in the embodiments of the present application is illustrative, and is only a logical function division, and there may be other division methods in actual implementation.
  • the functional modules in the various embodiments of the present application may be integrated in one processor, or may exist alone physically, or two or more modules may be integrated in one module.
  • the above-mentioned integrated modules can be implemented in the form of hardware or software functional modules.
  • the configuration rule controller, telemetry strategy controller, and security controller included in the control plane can be implemented through the logic architecture shown in FIG. 6.
  • the network element configuration, rule information, security information, policy information, network service definition and network registration information sent by the VNF network element through the network agent generated by the network administrator are all sent to the logical storage layer.
  • the logical storage layer may include multiple storage plane monitoring processes. Different storage plane monitoring processes are used to monitor different storage information received by the logical storage layer, and store the information separately for filtering and encapsulation, and then send to the controller engine.
  • the controller engine reserves different processing pipelines in different processing stages. Unused processing pipelines can implement control plane behavior through different plug-ins. The controller engine function is simple to implement, and the specific business logic is implemented in different plug-ins, so the control plane consumes very little resources.
  • the controller engine sends the configuration information to the network agent through the network interface (dispatch component).
  • a virtual private network (VPN) client in the edge cloud needs to connect to the company's corporate intranet, which will pass through multiple VNF network elements, for example, see Figure 7.
  • the passing VNF network elements include VNF network elements (referred to as firewall VNF, firewall VNF) used to implement the firewall function, and VNF network elements (VPN Gateway VNF) used to implement the VPN gateway (Gateway) function.
  • the L2 layer/L3 layer network connection and data transmission tunnel are established between the VPN client, the firewall VNF, and the VPN gateway.
  • the control plane can define network services according to customer needs and associate them with designated VNF network elements, so that a business chain can be established between VNF network elements.
  • a network administrator can configure an API document or description file used to describe the definition of a network service to the control plane, and the API document or description file indicates the VNF network elements that the network service needs to be established must pass.
  • the firewall VNF and the VPN gateway VNF are passed.
  • FIG. 8 takes the VPN client and firewall VNF deployed on node 1 and the VPN gateway deployed on node 2 as an example for illustration.
  • Different VNF network elements deployed on the same node can proxy VNF network elements through the same network agent to achieve basic network functions and QoS.
  • the network proxy 1 (NSMgr1) is used to proxy the VPN client and firewall VNF
  • the network proxy 2 (NSMgr2) is used to proxy the VPN gateway as an example.
  • connection request 1 The VPN client sends a connection request 1 to NSMgr1, and the connection request 1 carries demand information of the VPN client network service.
  • the demand information of the VPN client network service includes demand information of the network interface.
  • the demand information of the network service may also include the identifier of the network service definition, the network namespace identifier of the VPN client, and so on.
  • the requirement information of the network interface includes the interface type required for the network service connection and the network interface name of the VPN client.
  • the network agent 1 After receiving the connection request 1, the network agent 1 queries the configuration rule controller for the VNF network elements that the network service needs to pass through according to the demand information of the VPN client network service.
  • the next-hop VNF network element of the network service connection is the firewall VNF
  • the next hop of the firewall VNF is the VPN gateway VNF.
  • the network agent 1 sends a first query request to the configuration rule controller, and the first query request may carry demand information of the VPN client network service.
  • the configuration rule controller queries the service list according to the demand information of the VPN client network service and determines that the next hop VNF network element is the firewall VNF, and according to the service list, determines that the firewall VNF is located on node1.
  • the network agent 1 on node1 sends a connection request 2 to the firewall VNF.
  • connection response 2 may carry the name of the network interface and the type of the network interface that the firwall VNF needs to establish.
  • connection response 2 may carry the type of the network interface supported by the firewall VNF and the naming rule of the supported network interface.
  • the network agent 1 generates a network interface name for the firewall, and the network agent 2 determines the type of the network interface that needs to be established for the firewall VNF according to the interface type required for network service connection and the type of network interface supported by the firewall VNF.
  • the firewall VNF and the VPN client belong to the same network agent, and the network agent 1 can determine the VNF network element through which the network service connection passes from the configuration rule controller at one time. Of course, you can also query the configuration rule controller for the next hop VNF network element.
  • the network agent belonging to the firewall VNF receives the firewall VNF service response message, it can query the configuration rule controller for the next hop VNF network element. It is also possible that only the network agent of the NSC queries the VNF network element through which the network service connection passes, and then the identification information of the VNF network element through which the network service connection passes is carried in the connection request and sent to the network agent of the next hop VNF network element.
  • the network agent 1 sends a connection request 3 to the network agent 2 of node2, and the connection request 3 carries demand information of the network interface.
  • connection request 2 may also carry the demand information of the tunnel.
  • the required information of the tunnel includes tunnel type information, tunnel establishment strategy and tunnel interface information.
  • the tunnel type is VXLAN.
  • the tunnel type information may include VNID.
  • the tunnel establishment strategy can be configured with a forwarding strategy based on flow table forwarding, a forwarding strategy based on the forwarding model of traditional physical devices, or a forwarding strategy based on physical network ports.
  • the tunnel interface information may include the tunnel interface type, tunnel interface name, source IP address and destination IP address of the tunnel interface.
  • the network agent 2 sends a connection request 4 to the VPN gateway VNF, and the connection request 4 carries demand information of the network interface.
  • the VPN gateway VNF sends a connection response 4 to the network proxy 2.
  • the connection response 4 carries attribute information for the network interface.
  • the attribute information of the network interface includes the IP address, name, and interface type of the VPN gateway VNF network interface, as well as the IP address of the network interface assigned to the VPN client.
  • the VPN gateway VNF may determine the attribute information of the network interface used for the network service connection according to the demand information of the VPN client network service.
  • the network agent 2 calls the forwarding plane to establish a VPN gateway VNF network interface, and configures an IP address for the established VPN gateway VNF network interface.
  • the network agent 2 injects the established VPN gateway VNF network interface into the VPN gateway VNF network namespace.
  • the determination of the VPN gateway VNF network namespace one way is to send it to the network proxy 2 when the VPN gateway VNF reports its own capability information to the configuration rule controller through the network proxy 2.
  • Another way is that the connection response 4 can carry the identifier of the VPN gateway VNF network namespace.
  • the network agent 2 invokes the forwarding plane to establish a second tunnel interface on node 2 and configures an IP address for the second tunnel interface on node 2.
  • the IP address of the tunnel interface on node 2 may be the IP address of node 2.
  • the network agent 2 sends a connection response 3 to the network agent 1, where the connection response 3 carries the IP address of the VPN client network interface, the name of the VPN client network interface, and the interface type.
  • the network proxy 1 After receiving the connection response 3, the network proxy 1 invokes the forwarding plane to establish a network interface on the firewall VNF for connecting with the VPN gateway VNF.
  • the network agent 1 injects the network interface used to connect to the VPN gateway VNF on the established firewall VNF into the firewall VNF network namespace.
  • the network agent 1 establishes the first tunnel interface on the node 1 according to the demand information of the tunnel, and configures an IP address for the first tunnel interface on the node 1.
  • the IP address of the tunnel interface on node 1 may be the IP address of node 1.
  • the network agent 1 calls the forwarding plane to establish a network interface on the firewall VNF for connecting with the VPN client.
  • the network agent 1 injects the established firewall VNF network interface used to communicate with the VPN client into the firewall VNF network namespace.
  • the network proxy 1 calls the forwarding plane to establish a VPN client network interface for the VPN client.
  • the network proxy 1 injects the established VPN client network interface into the VPN client network namespace.
  • the network agent 1 sends a connection response 1 to the NSC.
  • the connection response 1 is used to notify the NSC network service connection establishment is completed.
  • the forwarding plane is implemented through openflow's vSwitch as an example.
  • the vSwitch can be considered a special kind of VNF network element.
  • Each node will have a vSwitch, which is a data path (or data tunnel) between VNF network elements, which determines the forwarding path of data flows between VNF network elements.
  • vSwitch supports L2 network connection.
  • the VNF network element and the vSwitch exchange data through an interface pair. In the interface pair, one interface is on the VNF network element, and the other interface is on the vSwitch.
  • the vSwitch and the VNF network element share a network interface, or in other words, the vSwitch establishes a network interface for the VNF network element, and injects the established network interface into the VNF network element.
  • Data transmission can be carried out between different nodes through the VXLAN interface, or in other words, the VXLAN packet encapsulation technology is used between different nodes to realize the network connection between different nodes.
  • the vSwitch realizes the interconnection of the network through the network bridge and the kernel mode interface (or user mode interface).
  • the VPN client establishes an L2 network connection with the VPN Gateway through the connection in Figure 10, and only the VPN client and VPN Gateway's eth1 network interface are configured with IP addresses.
  • Each node is composed of 3 vswitch bridges, (ingress bridge) br-int is responsible for the establishment of network interfaces and flow table rules, tunnel bridge (br-tun) is responsible for the establishment of tunnels, egress bridge (br -ex) responsible for getting through with the physical network port.
  • the Firewall VNF uses linux bridge and iptables rules to simulate the firewall function.
  • the network interface used by the VNF network element can be either a kernel-mode interface or a user-mode interface. If it is a user mode interface, the VNF network element will run a user mode protocol stack.
  • a pure Layer 3 network connection based on DVR for the forwarding plane is taken as an example.
  • Pure Layer 3 network connection the connection between VNF network elements needs to be routed (each VNF network element needs to be configured with routing rules), so not only network isolation is required but also different network segments need to be allocated, and each network interface needs to be configured with IP address.
  • two 3-layer VPNs have been established for network isolation, namely vpna and vpnb. Static routing is configured inside vpn.
  • the network IP segment is given as 192.168.1.0/24.
  • the network agent (network agent 1 or network agent 2) allocates n subnets with a 30-bit network mask under the network segment, and every two adjacent network elements are adjacent to each other.
  • the interfaces are in 2 subnets.
  • the network interfaces of VPN Client and Firewall VNF are in the 192.168.1.0/30 subnet and 192.168.1.4.0/30 subnet respectively, and the Firewall VNF and VPN Gateway VNF are in 192.168.1.8/30 respectively. And 192.168.1.12/30 subnet.
  • the VPN Client can communicate with the VPN Gateway VNF on the Layer 3 network.
  • the network interface used by the VNF network element can be either a kernel port or a user mode port.
  • BD represents a broadcast domain or a bridge domain (Bridge Domain, BD), a Layer 2 broadcast domain for forwarding data packets in a VXLAN network.
  • BDIF A three-layer logical interface based on BD. Configuring the IP address through the BDIF interface can realize the communication between VXLANs of different network segments, and between VXLAN and non-VXLAN, and can also realize the Layer 2 network access to the Layer 3 network.
  • the types of network planes can include base plane, fabric plane, external management plane and external data plane. Different types of network planes require different quality attributes. For example, different types of network planes require different network interface types, different load types, and different routing types (such as vSwitch, DVR).
  • XGW GW
  • multiple VNF network elements are deployed in the XGW network element, as shown in FIG. 12.
  • multiple VNF network elements are divided into two categories, namely control services and business services.
  • the control service is called management & control (M&C) in FIG. 12
  • the business service is called the interface process unit (IPU) in FIG. 12.
  • a VNF network element (or VNF service) can be connected to one or more network planes.
  • the quality attributes required by different network planes may be different.
  • six VNF network elements are deployed in XGW network elements as an example, namely M&C1, M&C2, and IPU1-IPU4.
  • two network planes are taken as examples, namely the base plane and the fabric plane.
  • XGW network elements different network planes are required to be isolated from each other.
  • the network administrator configures the multi-plane network service definition and saves the multi-plane network service definition in the configuration rule controller.
  • the multi-plane network service definition includes the network service definition corresponding to each network plane, etc. Among them, the network service definition includes the network plane implementation type, the payload type, and the network definition.
  • the network definition may include one or more of network name, subnet, IP address, gateway, and virtual network identifier (vni).
  • the configuration rule controller after the configuration rule controller receives the multi-plane network service definition, it sends the multi-plane network service definition to the network agent for managing the XGW.
  • the network agent calls the forwarding plane according to the network service definition to establish network interfaces for the network planes corresponding to each VNF network element, and configures an IP address for each network interface.
  • one VNF network element corresponds to two network planes, and the VNF network element needs to establish two network interfaces, and the network interfaces correspond to the network planes one-to-one.
  • the VNF network element requests the establishment of N network plane network interfaces on demand.
  • the network agent receives the connection request sent by the VNF network element.
  • the network agent is used to manage the VNF network element.
  • the connection request is used to request the establishment of network interfaces of N network planes.
  • the connection request carries the identification of each of the N network planes.
  • N is an integer greater than 1; the network agent queries the configuration rule controller for the demand information of the network interface corresponding to each of the N network planes according to the identifiers of the N network planes; each network plane corresponds to the demand information of the network interface Used to describe the network interfaces that need to be established for network connections using each network plane; the network agent establishes N network interfaces and N networks for the first VNF according to the demand information of the network interfaces on each of the N network planes The interface corresponds to the N network planes one-to-one.
  • the network agent When a tunnel needs to be established, one way is that the network agent establishes a tunnel interface for each node in the system. Another way is that when the network agent receives a request for establishing a tunnel interface with node 2 initiated by a certain VNF network element (deployed on node 1), it establishes a tunnel interface for node 1 where the VNF is located, and establishes a tunnel interface for node 2 .
  • the forwarding plane is implemented through the openflow vSwitch as an example, and the IP address segment configured on the base plane is 10.56.217.XX.
  • the IP address segment configured on the fabric plane is 10.56.218.XX.
  • M&C1 and IPU1 are located at node 1 (node1), and M&C2 and IPU2 are located at node 2 (node2) as an example.
  • the IP address of the network interface (eth1) assigned by the network agent to M&C1 is 10.56.217.10
  • the IP address of the network interface (eth1) assigned by the network agent to M&C2 is 10.56.217.11
  • the network interface (eth1) assigned by the network agent to IPU1 ) The IP address is 10.56.217.15
  • the IP address of the network interface (eth1) assigned by the network agent to IPU2 is 10.56.217.12.
  • the IP address of the network interface (eth2) assigned by the network agent to M&C1 is 10.56.218.5
  • the IP address of the network interface (eth2) assigned by the network agent to M&C2 is 10.56.217.7
  • the network interface (eth2) assigned by the network agent to IPU1 ) The IP address is 10.56.217.6
  • the network interface (eth2) IP address assigned by the network agent for IPU2 is 10.56.217.8.
  • An L2 network connection is established between M&C1 and IPU1 in node1 and M&C2 and IPU2 in node2 through VXLAN.
  • Each node is composed of 3 vswitch bridges, br-int is responsible for the establishment of network interfaces and flow table rules, br-tun is responsible for the establishment of tunnels, and br-ex is responsible for opening up with the physical network port.
  • the forwarding plane is implemented by DVR as an example.
  • DVR An example diagram of establishing a pure 3-layer network connection based on DVR between M&C1 and IPU1 in node1 and M&C2 and IPU2 in node2.
  • the network administrator configures the network service policy, and configures the network service policy to the configuration rule controller.
  • the network service policy includes conditions that trigger network operations.
  • the network service strategy includes one or more of an elastic scaling strategy, a circuit breaker rule, a traffic rule, and the like.
  • the elastic scaling strategy is used to describe the rules for expanding or shrinking VNF network elements, including the conditions for expanding or shrinking VNF network elements.
  • the elastic scaling strategy includes elastic scaling rules and/or elastic scaling rules. Fuse rules are used to describe the rules for stopping neighbor establishment, including conditions that trigger VNF network elements to stop neighbor establishment.
  • the configuration rule controller After the configuration rule controller receives the network service policy, it sends the network service policy to each network agent (such as the above-mentioned network agent 1 and network agent 2). After receiving the network service policy, the network agent regularly counts telemetry data according to the network service policy. According to the statistical telemetry data, determine whether the conditions for triggering network operation specified by the network service strategy are met, and when it is determined to be satisfied, send an instruction to the telemetry strategy controller that satisfies the trigger network operation condition, and the telemetry strategy controller receives the instruction to trigger the network operation condition When, perform network operations.
  • each network agent such as the above-mentioned network agent 1 and network agent 2.
  • the network agent After receiving the network service policy, the network agent regularly counts telemetry data according to the network service policy. According to the statistical telemetry data, determine whether the conditions for triggering network operation specified by the network service strategy are met, and when it is determined to be satisfied, send an instruction to the telemetry strategy controller that satisfies the trigger network operation
  • the network administrator configures the configuration rule controller to trigger a circuit breaker rule.
  • Fuse triggering rules include the maximum number of neighbors and the maximum number of virtual routing forwarding (VRF).
  • the configuration rule controller sends the triggering fuse rule to the network agent, and the network agent counts telemetry data, that is, counts the number of neighbors and the number of VRFs of the VNF network element.
  • the network agent determines that the number of neighbors of the VNF network element reaches the maximum number of neighbors and the number of VRFs reaches the maximum number of VNFs, the network agent sends an indication to the telemetry strategy controller that the conditions for triggering the fuse are reached, and the telemetry strategy controller receives the trigger for the fuse.
  • the network agent When the condition is instructed, the network agent issues a neighbor establishment stop instruction to the VNF network element, and then after the VNF network element receives the neighbor establishment stop instruction, the process of establishing a neighbor connection is no longer triggered.
  • the telemetry strategy controller can also send out alarm messages.
  • the network administrator configures elastic expansion rules for the configuration rule controller.
  • the trigger condition included in the elastic expansion rule is the maximum number of neighbors.
  • the configuration rule controller sends the elastic expansion rule to the network agent, and the network agent counts the telemetry data, that is, counts the number of neighbors of the VNF network element.
  • the network agent determines that the number of neighbors of the VNF network element reaches the maximum number of neighbors tolerable, it sends an instruction to the telemetry strategy controller to meet the elastic expansion conditions.
  • the telemetry strategy controller receives the instruction to meet the elastic expansion conditions, it sends the VNF network element through the network agent
  • the expansion strategy is issued, so that the VNF network element executes the expansion operation according to the expansion strategy.
  • the function of the network agent will be described in detail below in conjunction with the schematic diagram of the network agent device provided in FIG. 5.
  • the network proxy shown in FIG. 5 is used to implement the method described in the embodiment shown in FIG. 4 or FIG. 9 above.
  • the device shown in FIG. 5 uses network agent 1.
  • the first communication module is configured to receive a first connection request from a first virtualized network function VNF network element, and the network agent 1 is configured to manage the first VNF network element, and the first VNF network element is a network service
  • the requestor (NSC) of the first connection request is used to request the establishment of a network interface
  • the network interface is a network interface required to realize the network service
  • the first connection request carries demand information of the network interface, so The demand information of the network interface is used to describe the network interface required by the network service.
  • the first communication module is further configured to send a second connection request to the network agent 2, where the second connection request carries demand information of the network interface; the network agent 2 is used to manage the second VNF network element, The second VNF network element is a provider of the network service;
  • the first communication module is further configured to receive the attribute value of the first network interface sent by the network agent 2, where the attribute value of the first network interface is determined by the network agent 2 according to the demand information of the network interface;
  • the forwarding plane adaptation module calls the forwarding plane to establish the first network interface according to the attribute value of the first network interface, so that the first VNF network element communicates through the first network interface.
  • the requirement information of the network interface includes one or more of the following: the type of the network interface, and the name of the network interface.
  • the first connection request also carries an identifier defined by the network service
  • the second communication module is configured to query the configuration rule controller for the download of the first VNF network element in the network service according to the identifier defined by the network service before sending the second connection request to the network agent 2.
  • the one-hop VNF network element is the second VNF network element;
  • the network service definition corresponding to the identifier of the network service definition includes forwarding relationship information corresponding to the network service.
  • the forwarding plane adapting module is used to adapt the forwarding plane, the network interface supported by the forwarding plane meets the network interface required by the network service, and the forwarding plane adapting module according to the first The attribute value of the network interface calls the forwarding plane to establish the first network interface.
  • the first VNF network element is deployed on a first node
  • the second VNF network element is deployed on a second node
  • the forwarding plane adaptation module invokes the forwarding plane to establish the first node
  • the first tunnel interface where the first tunnel interface is used to connect to the second node.
  • the attribute value of the first network interface includes one or more of the following:
  • the name of the first network interface the type of the first network interface, and the IP address of the first network interface.
  • the first connection request also carries the network namespace identifier of the first VNF network element
  • the forwarding plane adaptation module is configured to inject the established first network interface into the network namespace corresponding to the network namespace identifier.
  • the rule module is configured to receive a network service policy sent from a configuration rule controller, and the network service policy includes conditions that trigger network operations;
  • the telemetry module is configured to count telemetry data according to the network service strategy, and when it is determined according to the telemetry data that the conditions for triggering network operations are met, send a first instruction to the telemetry strategy controller, and the first instruction is used to indicate that the trigger is satisfied The condition of the network operation; when a notification for executing the network operation sent by the telemetry strategy controller is received, the execution of the network operation is triggered.
  • the device shown in FIG. 5 is applied to the network agent 2.
  • the first communication module is configured to receive a second connection request from the network agent 1, and the second connection request carries demand information of the network interface.
  • the network agent 2 is used to manage a second VNF network element, and the second connection request.
  • the VNF network element is the provider of network services;
  • the network agent 1 is used to manage the first VNF network element, the first VNF network element is the requester of the network service, and the demand information of the network interface is used to describe the implementation Describe the network interface required by the network service;
  • the first communication module is further configured to determine the attribute value of the second network interface according to the demand information of the network interface;
  • a forwarding plane adaptation module configured to call an adapted forwarding plane according to the attribute value of the second network interface to establish the second network interface, so that the second VNF network element communicates through the second network interface .
  • it also includes:
  • the first communication module is further configured to determine the attribute value of the first network interface according to the demand information of the network interface, where the first network interface is a network interface through which the first VNF network element performs network communication;
  • the first communication module is configured to send the attribute value of the first network interface to the network agent 1.
  • the forwarding plane adaptation module adapts the forwarding plane, the network interface supported by the forwarding plane meets the network interface required by the network service, and the forwarding plane adaptation module adapts the network interface according to the second network interface.
  • the attribute value of calls the forwarding plane to establish the second network interface.
  • the first VNF network element is deployed on a first node
  • the second VNF network element is deployed on a second node
  • the second connection request also carries demand information of the tunnel.
  • the demand information is used to describe the tunnel that needs to be established between the first node and the second node; the forwarding plane adaptation module calls the forwarding plane to establish a second node for the second node according to the demand information of the tunnel.
  • the second communication module receives service registration information sent by the second VNF network element, where the service registration information is used to describe the network interface capabilities that the second VNF network element can provide; Send the service registration information to the configuration rule controller.
  • the service registration information includes one or more of the following: a network protocol IP address allocation strategy, an IP address segment, and a supported network interface type.
  • the attribute value of the first network interface includes one or more of the following:
  • the name of the first network interface the type of the first network interface, and the IP address of the first network interface.
  • the attribute value of the first network interface includes the IP address of the first network interface
  • the network agent 2 determines the attribute value of the first network interface according to the demand information of the network interface, include:
  • the first communication module sends the demand information of the network interface to the second VNF network element; receives the IP address of the first network interface sent by the second VNF network element.
  • the attribute value of the second network interface includes one or more of the following: the name of the second network interface, the type of the second network interface, and the IP address of the second network interface .
  • the attribute value of the second network interface includes the IP address of the second network interface
  • the first communication module sends the demand information of the network interface to the second VNF network element; Receiving the IP address of the second network interface sent by the second VNF network element.
  • the first communication module configures the second network interface with the IP address of the second network interface.
  • the rule module receives the network service policy sent from the configuration rule controller, and the network service policy includes conditions that trigger network operations; the telemetry module collects telemetry data according to the network service policy, and according to the telemetry data When it is determined that the conditions for triggering network operations are met, a second instruction is sent to the telemetry strategy controller, where the second instructions are used to indicate that the conditions for triggering network operations are met; When the network operation is notified, the execution of the network operation is triggered.
  • the first communication module receives a connection request sent by a VNF network element
  • the network agent is used to manage the VNF network element
  • the connection request is used to request the establishment of network interfaces of N network planes
  • the connection request carries all
  • the identifier of each of the N network planes where N is an integer greater than 1.
  • the configuration rule controller is inquired about the corresponding network plane of each of the N network planes. Demand information of the network interface;
  • the requirement information of the network interface corresponding to each network plane is used to describe the network interface that needs to be established for network connection using each network plane;
  • the forwarding plane adaptation module establishes N network interfaces for the first VNF according to the demand information of the network interfaces on each of the N network planes, and the N network interfaces are one-to-one with the N network planes. correspond.
  • Fig. 15 is a schematic structural diagram of a network agent applicable to an embodiment of the present application.
  • the network agent includes: one or more processors 1501, one or more memories 1502, and one or more communication interfaces 1503.
  • the processor 1501 is used to control the communication interface 1503 to send and receive signals
  • the memory 1502 is used to store a computer program
  • the processor 1501 is used to call and run the computer program from the memory 1502, so that the network agent executes the network interface establishment method of the present application.
  • the present application also provides a computer-readable storage medium that stores computer instructions.
  • the computer instructions run on the computer, the computer executes the network interface in the method for establishing a network interface of the present application.
  • the present application also provides a chip, including a memory and a processor, the memory is used to store a computer program, and the processor is used to call and run the computer program from the memory, so that the network device installed with the chip executes the network interface of the present application.
  • a chip including a memory and a processor
  • the memory is used to store a computer program
  • the processor is used to call and run the computer program from the memory, so that the network device installed with the chip executes the network interface of the present application.
  • this application also provides a computer program product.
  • the computer program product includes computer program code.
  • the computer program code runs on a computer, the computer executes the network agent, network agent 1, and network agent in the method for establishing a network interface in this application. Corresponding processes and/or operations performed by the network agent 2.
  • first, second and other words are used to distinguish the same or similar items that have basically the same function and function. It should be understood that between “first”, “second” and “nth” There are no logic or timing dependencies, and no restrictions on the number and execution order. It should also be understood that although the following description uses the terms first, second, etc. to describe various elements, these elements should not be limited by the terms. These terms are only used to distinguish one element from another.
  • the first image may be referred to as the second image
  • the second image may be referred to as the first image.
  • Both the first image and the second image may be images, and in some cases, may be separate and different images.
  • the processor may be a CPU, a microprocessor, an application specific integrated circuit (ASIC), or one or more integrated circuits used to control the execution of the program of the present application, etc.
  • the processor may include a digital signal processor device, a microprocessor device, an analog-to-digital converter, a digital-to-analog converter, and so on.
  • the processor can allocate the control and signal processing functions of the mobile device among these devices according to their respective functions.
  • the processor may include the function of operating one or more software programs, and the software programs may be stored in the memory.
  • the functions of the processor can be implemented by hardware, or can be implemented by hardware executing corresponding software.
  • the hardware or software includes one or more modules corresponding to the above-mentioned functions.
  • the memory can be read-only memory (ROM) or other types of static storage devices that can store static information and instructions, random access memory (RAM), or other types that can store information and instructions Dynamic storage device. It can also be electrically erasable programmable read-only memory (EEPROM), compact disc readonly memory (CD-ROM) or other optical disc storage, optical disc storage (including compact discs, laser discs) , Optical discs, digital universal discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or any other media that can be used to carry or store desired program codes in the form of instructions or data structures and that can be accessed by a computer, etc. . _
  • this application can be provided as methods, systems, or computer program products. Therefore, this application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, this application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.
  • computer-usable storage media including but not limited to disk storage, CD-ROM, optical storage, etc.
  • These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing equipment to work in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including the instruction device.
  • the device implements the functions specified in one process or multiple processes in the flowchart and/or one block or multiple blocks in the block diagram.
  • These computer program instructions can also be loaded on a computer or other programmable data processing equipment, so that a series of operation steps are executed on the computer or other programmable equipment to produce computer-implemented processing, so as to execute on the computer or other programmable equipment.
  • the instructions provide steps for implementing the functions specified in one process or multiple processes in the flowchart and/or one block or multiple blocks in the block diagram.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请公开了一种网络接口的建立方法、装置及系统，用以解决组件部署复杂、组件之间耦合性大，无法独立升级问题。通过在原有VNF网元执行的各个功能进行逻辑划分，原来由VNF执行的网络连接的相关功能部署在网络代理上。本申请中的VNF网元仅需执行业务相关功能，网络连接的相关功能由网络代理执行。从而业务相关功能、网络连接的相关功能可以独立升级和发展。进一步使得组件之间耦合性降低，部署复杂度降低。

Description

一种网络接口的建立方法、装置及系统
相关申请的交叉引用
本申请要求在2020年01月23日提交中国专利局、申请号为202010076990.2、申请名称为“一种网络接口的建立方法、装置及系统”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请实施例涉及通信技术领域，尤其涉及一种网络接口的建立方法、装置及系统。
背景技术
网络功能虚拟化(network function virtualization，NFV)提供了一种设计、部署和管理网络服务(network service，NS)的全新方式，它在通用的服务器、交换机和存储器中将部分电信网络功能的实现进行软件和硬件解耦，因而能够实现NS快速、高效的部署。由于NFV需要大量的虚拟化资源，因此需要高度的软件管理，业界称之为编排。网络功能虚拟化管理与编排(network function virtualization management and orchestrator，NFV MANO)是用于管理和协调虚拟化网络功能(virtual network function，VNF)和其它软件组件的架构框架。
目前NFV MANO系统采用集中式的编排方式，用户可以根据自己的需求编排自己所需要的网络服务(network service)，在编排过程中引用一系列的VNF模板、虚拟链路(virtual link，VL)以及虚拟网络功能转发图(VNF Forwarding Graph，VNFFG)，形成标准定义的模板。在部署下发的时候对生成的模板进行解析，将网络服务数据和服务资源进行映射和关联，将涉及到的网络功能软件通过标准接口部署到网络功能虚拟化基础设施(network function virtualization infrastructure，NFVI)资源层。NFV MANO采用的编排方式中，强调的是通过一个可执行的中心流程来协同内部及外部的服务交互，通过中心流程来控制总体的目标、操作以及服务调用顺序。因此，NFV MANO编排系统需要的组件繁多、部署复杂，资源消耗较多，组件之间耦合性大，无法独立升级。
发明内容
本申请实施例提供一种网络接口的建立方法、装置及系统，用以解决组件部署复杂、组件之间耦合性大，无法独立升级问题。
第一方面，本申请实施例提供一种网络接口的建立方法，包括：第一网络代理接收来自第一虚拟化网络功能VNF网元的第一连接请求，第一网络代理用于管理第一VNF网元，第一VNF网元为网络服务的请求方，第一连接请求用于请求建立网络接口，网络接口是实现网络服务所需的网络接口，第一连接请求携带网络接口的需求信息，网络接口的需求信息用于描述网络服务所需的网络接口；第一网络代理向第二网络代理发送第二连接请求。第二连接请求中携带网络接口的需求信息；第二网络代理用于管理第二VNF网元，第二VNF网元为网络服务的提供方；第二网络代理接收到第二连接请求后，根据第二连接请求中携带网络接口的需求信息确定第一网络接口的属性值。第一网络接口为所述第一VNF 网元进行网络通信的网络接口；然后第二网络代理将第一网络接口的属性值发送给第一网络代理，第一网络代理接收第二网络代理发送的第一网络接口的属性值；之后，第一网络代理根据第一网络接口的属性值建立第一网络接口，以使得第一VNF网元通过第一网络接口进行通信。
通过上述方案，根据原有VNF网元执行的各个功能进行逻辑划分，原来由VNF执行的网络连接的相关功能部署在网络代理上。本申请实施例中的VNF网元仅需执行业务相关功能，从而业务相关功能、网络连接的相关功能可以独立升级和发展。进一步使得组件之间耦合性降低，部署复杂度降低。
在一种可能的设计中，网络代理(第一网络代理、第二网络代理)和VNF网元(第一VNF网元、第二VNF网元)采用容器服务的形式。比如，可以采用服务网格的方式部署网络代理和VNF网元。
在一种可能的设计中，所述网络接口的需求信息中包括如下一项或多项：网络接口的类型、网络接口的名称。上述设计，VNF网元可以根据需求向网络代理请求建立哪种类型的网络接口，并非静态配置的方式，从而可以适配到不同的业务服务的场景中。
在一种可能的设计中，所述第一连接请求还携带网络服务定义的标识；所述第一网络代理向所述第二网络代理发送第二连接请求之前，还包括：所述第一网络代理根据所述网络服务定义的标识，向配置规则控制器查询所述网络服务中所述第一VNF网元的下一跳VNF网元为所述第二VNF网元；其中，网络服务定义的标识所对应的网络服务定义中包括所述网络服务对应的转发关系信息。上述设计中，配置规则控制器用于为网络代理提供网络服务的转发关系，可以实现按需配置。
在一种可能的设计中，所述第一网络代理适配至少一种转发平面，建立所述第一网络代理根据所述第一网络接口的属性值建立所述第一网络接口，包括：所述第一网络代理根据所述第一网络接口的属性值调用所述至少一种转发平面中的第一转发平面建立所述第一网络接口。上述设计中，网络代理通过与多种转发平面适配，从而可以建立不同类型的网络接口，提供不同的网络服务，进而适配到不同的业务服务的场景中。
示例性的，至少一种转发平面可以包括基于流表转发的转发平面，基于传统物理设备的转发模型的转发平面，基于物理网口的转发平面。比如，流表转发可以采用基于openflow实现的虚拟交换机来实现。比如，传统物理设备的转发模型的转发可以是基于DVR来实现。当然还可以包括基于其它技术实现的转发平面，本申请实施例对此不作限定。
在一种可能的设计中，所述第一VNF网元部署于第一节点，所述第二VNF网元部署于第二节点，所述方法还包括：所述第一网络代理调用所述转发平面建立所述第一节点上第一隧道接口，所述第一隧道接口用于连通所述第二节点。
在一种可能的设计中，所述第一网络接口的属性值包括如下中的一项或多项：所述第一网络接口的名称、所述第一网络接口的类型、所述第一网络接口的IP地址。
在一种可能的设计中，所述第一连接请求还携带所述第一VNF网元的网络命名空间标识；所述方法还包括：所述第一网络代理将所述建立的所述第一网络接口注入所述网络命名空间标识所对应的网络命名空间。
在一种可能的设计中，还包括：所述第一网络代理接收来自配置规则控制器发送的网络服务策略，网络服务策略包括触发网络操作的条件；所述第一网络代理根据所述网络服务策略统计遥测数据，并根据遥测数据确定满足所述触发网络操作的条件时，向遥测策略 控制器发送第一指示，所述第一指示用于指示满足触发网络操作的条件；所述第一网络代理接收到所述遥测策略控制器发送的用于执行所述网络操作的通知时，执行所述网络操作。
第二方面，本申请实施例提供一种网络接口的建立方法，包括：第二网络代理接收来自第一网络代理的第二连接请求，第二连接请求中携带网络接口的需求信息，第二网络代理用于管理第二VNF网元，第二VNF网元为网络服务的提供方；第一网络代理用于管理第一VNF网元，第一VNF网元为网络服务的请求方，网络接口的需求信息用于描述实现网络服务所需的网络接口；第二网络代理根据网络接口的需求信息确定第二网络接口的属性值；第二网络代理根据第二网络接口的属性值建立第二网络接口，以使得第二VNF网元通过第二网络接口进行通信。
通过上述方案，根据原有VNF网元执行的各个功能进行逻辑划分，原来由VNF执行的网络连接的相关功能部署在网络代理上。本申请实施例中的VNF网元仅需执行业务相关功能，从而业务相关功能、网络连接的相关功能可以独立升级和发展。进一步使得组件之间耦合性降低，部署复杂度降低。
在一种可能的设计中，还包括：第二网络代理根据网络接口的需求信息确定第一网络接口的属性值，第一网络接口为第一VNF网元进行网络通信的网络接口；第二网络代理将第一网络接口的属性值发送给第一网络代理。
在一种可能的设计中，第二网络代理适配转发平面，转发平面支持建立的网络接口满足网络服务所需的网络接口，第二网络代理根据第二网络接口的属性值建立第二网络接口，包括：第二网络代理根据第二网络接口的属性值调用转发平面建立第二网络接口。
示例性的，至少一种转发平面可以包括基于流表转发的转发平面，基于传统物理设备的转发模型的转发平面，基于物理网口的转发平面。比如，流表转发可以采用基于openflow实现的虚拟交换机来实现。比如，传统物理设备的转发模型的转发可以是基于DVR来实现。当然还可以包括基于其它技术实现的转发平面，本申请实施例对此不作限定。
在一种可能的设计中，第一VNF网元部署于第一节点，第二VNF网元部署于第二节点，第二连接请求还携带隧道的需求信息，隧道的需求信息用于描述在第一节点与第二节点所需建立的隧道；方法还包括：第二网络代理根据隧道的需求信息调用转发平面为第二节点建立第二隧道接口，第二隧道接口用于连通第一节点。
在一种可能的设计中，还包括：第二网络代理接收第二VNF网元发送的服务注册信息，服务注册信息用于描述第二VNF网元所能提供的网络接口能力；第二网络代理将服务注册信息发送给配置规则控制器。
上述设计中，作为网络服务提供方的VNF网元通过网络代理上报自己所支持的网络接口能力，从而配置规则控制器，可以根据网络服务发起方的请求，以及网络服务提供方的能力，选择用于提供网络服务的VNF网元，实现了按需求适配不同的场景。
在一种可能的设计中，服务注册信息包括如下一项或多项：网络协议IP地址分配策略、IP地址段、支持的网络接口类型。
在一种可能的设计中，第一网络接口的属性值包括如下一项或多项：第一网络接口的名称、第一网络接口的类型，第一网络接口的IP地址。
在一种可能的设计中，第一网络接口的属性值包括第一网络接口的IP地址，第二网络代理根据网络接口的需求信息确定第一网络接口的属性值，包括：第二网络代理向第二VNF网元发送网络接口的需求信息；第二网络代理接收第二VNF网元发送的第一网络接 口的IP地址。
在一种可能的设计中，第二网络接口的属性值包括如下一项或多项：第二网络接口的名称、第二网络接口的类型，第二网络接口的IP地址。
在一种可能的设计中，第二网络接口的属性值包括第二网络接口的IP地址，第二网络代理根据网络接口的需求信息确定第二网络接口的属性值，包括：第二网络代理向第二VNF网元发送网络接口的需求信息；第二网络代理接收第二VNF网元发送的第二网络接口的IP地址。
在一种可能的设计中，上述方法还可以包括：第二网络代理为第二网络接口配置第二网络接口的IP地址。
在一种可能的设计中，上述方法还可以包括：第二网络代理接收来自配置规则控制器发送的网络服务策略，网络服务策略包括触发网络操作的条件；第二网络代理根据网络服务策略统计遥测数据，并根据遥测数据确定满足触发网络操作的条件时，向遥测策略控制器发送第二指示，第二指示用于指示满足触发网络操作的条件；第二网络代理接收到遥测策略控制器发送的用于执行网络操作的通知时，执行网络操作。
第三方面，本申请实施例提供一种网络接口的建立方法，包括：网络代理接收VNF网元发送的连接请求，网络代理用于管理VNF网元，连接请求用于请求建立N个网络平面的网络接口，连接请求中携带N个网络平面中每个网络平面的标识，N为大于1的整数；网络代理根据N个网络平面的标识向配置规则控制器查询N个网络平面中每个网络平面对应的网络接口的需求信息；每个网络平面对应网络接口的需求信息用于描述采用每个网络平面进行网络连接所需建立的网络接口；网络代理根据N个网络平面中每个网络平面上的网络接口的需求信息为第一VNF建立N个网络接口，N个网络接口与N个网络平面一一对应。
通过上述方案，网络代理可以按照需求为VNF网元建立适配不同网络平面的网络接口，适配多种业务场景，提高灵活性。
第四方面，本申请实施例提供一种网络服务连接的建立方法，包括：网络代理接收来自配置规则控制器的N个网络平面的网络服务定义，N为大于1的整数；其中，N个网络平面的网络服务定义中每个网络平面的网络服务定义包括每个网络平面上的第一VNF网元的网络接口的需求信息；网络代理根据N个网络平面的网络服务定义调用转发平面为第一VNF建立N个网络接口，N个网络接口与N个网络平面一一对应。
通过上述方案，网络代理可以为VNF网元建立适配不同网络平面的网络接口，适配多种业务场景，提高灵活性。
在一种可能的设计中，N个网络平面的网络服务定义中每个网络平面的网络服务定义包括每个网络平面上的第二VNF网元的网络接口的需求信息，第一VNF部署于第一节点上，第二VNF部署于第二节点上，N个网络平面的网络服务定义中还包括第一节点与第二节点之间隧道的需求信息；方法还包括：网络代理根据N个网络平面的网络服务定义调用转发平面为第二VNF建立N个网络接口；网络代理根据隧道的需求信息调用转发平面分别为第一节点和第二节点建立隧道接口。
第五方面，本申请实施例提供一种装置，所述装置用于执行第一方面或者第一方面的任意设计所述的方法，或者用于执行第二方面或者第二方面的任意设计所述的方法，或者用于执行第三方面或者第三方面的任意设计所述的方法，或者用于执行第四方面所述的方 法。
第六方面，本申请实施例提供一种装置，包括：处理器，所述处理器与存储器耦合，所述存储器用于存储程序或指令，当所述程序或指令被所述处理器执行时，使得所述装置执行第一方面或者第一方面的任意设计所述的方法，或者执行第二方面或者第二方面的任意设计所述的方法，或者执行第三方面或者第三方面的任意设计所述的方法，或者执行第四方面所述的方法。
第七方面，本申请实施例提供一种芯片，包括存储器和处理器，存储器用于存储计算机程序，处理器用于从存储器中调用并运行该计算机程序，以执行第一方面或者第一方面的任意设计所述的方法，或者执行第二方面或者第二方面的任意设计所述的方法，或者执行第三方面或者第三方面的任意设计所述的方法，或者执行第四方面所述的方法。
第八方面，本申请实施例提供一种系统，包括第一VNF网元、用于管理第一VNF网元的第一网络代理、第二VNF网元以及用于管理第二VNF网元的第二网络代理；
所述第一网络代理，用于执行第一方面或者第一方面的任意设计所述的方法为第一VNF网元建立第一网络接口；
所述第一VNF网元，用于通过所述第一网络接口与所述第二VNF网元进行网络通信；
所述第二网络代理，用于执行第二方面或者第二方面的任意设计为第二VNF网元建立第二网络接口；
所述第二VNF网元，用于通过所述第二网络接口与所述第一VNF网元进行网络通信。
在一种可能的设计中，系统中还包括配置规则控制器。配置规则控制器接收网络管理员的配置，比如配置网络服务定义，供网络代理查询。还可以为网络代理(比如第一网络代理、第二网络代理)配置网络服务策略。所述第一网络代理接收来自配置规则控制器发送的网络服务策略，网络服务策略包括触发网络操作的条件；所述第一网络代理根据所述网络服务策略统计遥测数据，并根据遥测数据确定满足所述触发网络操作的条件时，向遥测策略控制器发送第一指示，所述第一指示用于指示满足触发网络操作的条件；所述遥测策略控制器在接收到用于执行所述网络操作的通知时，触发执行所述网络操作。
第九方面，本申请提供一种计算机可读存储介质，该计算机可读存储介质中存储有计算机指令，当该计算机指令在计算机上运行时，使得计算机执行上述第一方面或者第一方面的任意设计所述的方法，或者执行第二方面或者第二方面的任意设计所述的方法，或者执行第三方面或者第三方面的任意设计所述的方法，或者执行第四方面所述的方法。
第十方面，本申请提供一种计算机程序产品，该计算机程序产品包括计算机程序代码，当计算机程序代码在计算机上运行时，使得计算机执行上述第一方面或者第一方面的任意设计所述的方法，或者执行第二方面或者第二方面的任意设计所述的方法，或者执行第三方面或者第三方面的任意设计所述的方法，或者执行第四方面所述的方法。
附图说明
图1为NFV MANO系统的架构图；
图2为本申请实施例中编排系统的架构图；
图3为本申请实施例中VNF功能拆分示意图；
图4为本申请实施例中网络接口的建立方法流程示意图；
图5为本申请实施例中网络代理的结构示意图；
图6为本申请实施例中控制平面实现示意图；
图7为本申请实施例中服务链的场景示意图；
图8为本申请实施例中服务链的场景下的系统部署示意图；
图9为本申请实施例中网络接口的建立流程示意图；
图10为本申请实施例中一种openflow的vSwitch实现的转发平面部署示意图；
图11为本申请实施例中一种DVR实现的纯3层网络连接的转发平面部署示意图；
图12为本申请实施例中多网络平面部署示意图；
图13为本申请实施例中另一种openflow的vSwitch实现的转发平面部署示意图；
图14为本申请实施例中另一种DVR实现的纯3层网络连接的转发平面部署示意图；
图15为本申请实施例中网络代理的结构示意图。
具体实施方式
参见图1，图1是NFV MANO系统的架构图。如图1所示，NFV MANO有三个主要功能块，分别是NFV编排器、VNF管理器和虚拟基础设施管理器(virtualised infrastructure maneger，VIM)。简单来说，NFV编排器可以对服务和资源进行编排，可以控制新的网络服务并将VNF集成到虚拟架构中，NFV编排器还能够验证并授权NFV基础设施的资源请求。VNF管理器能够管理VNF的生命周期。VIM能够控制并管理NFV基础设施，包括计算资源、存储资源以及网络资源等。为了使NFV MANO行之有效，它必须与现有系统中的应用程序接口(application interface，API)集成，以便跨多个网络域使用多个厂商的技术，同样地，运营商的运营支撑系统(operation support system，OSS)和商务支撑系统(businesssupport system，BSS)也需要与NFV MANO系统实现互操作。
网络功能虚拟化编排器(network function virtualization orchestrator，NFVO)，用于实现对网络服务描述符(network service descriptor，NSD)、虚拟网络功能转发图(virtual network function forwarding graph，VNFFG)的管理及处理，对网络服务的生命周期的管理，以及和虚拟网络功能管理器(virtual network function manager，VNFM)配合，实现对虚拟网络功能(virtual network function，VNF)的生命周期的管理和虚拟资源的全局视图功能。
VNFM：用于实现对VNF的生命周期的管理，包括VNF描述符(VNF descriptor，VNFD)的管理、VNF的实例化、VNF实例的弹性伸缩(例如，扩容Scaling out/up，和/或缩容Scalingin/down)、VNF实例的治愈(healing)以及VNF实例的终止。VNFM还支持接收NFVO下发的弹性伸缩(scaling)策略，实现自动化的VNF的弹性伸缩。
虚拟基础设施管理器(virtualised infrastructure manager，VIM)：主要负责基础设施层的硬件资源、虚拟化资源的管理(包括，预留和分配)，以及虚拟资源状态的监控和故障上报，面向上层应用提供虚拟化资源池。
运营和商务支撑系统(operations and business support systems，OSS/BSS)：指运营商现有的运行维护系统。
网元管理系统(element manager，EM)：针对VNF执行传统的故障、配置、用户、性能和安全的管理(fault management，configuration management，account management，performance management，security management，FCAPS)的功能。
虚拟化网络功能(virtualized network function，VNF)：对应于传统非虚拟化网络中的物理网络功能(physical network function，PNF)，例如，虚拟化的演进分组核心网(evolved  packet core，EPC)的移动性管理实体(mobility management entity，MME)、服务网关(service gateway，SGW)、分组数据网关(packet data network gateway，PGW)等节点。网络功能的功能性行为和状态与虚拟化与否无关，NFV技术需求希望VNF和PNF拥有相同的功能性行为和外部接口。其中，VNF可以由一个或多个更低功能级别的VNF组件(virtual network function component，VNFC)组成。因此，一个VNF可以部署在多个虚拟机(virtual machine，VM)上，每个VM承载一个VNFC的功能。一个VNF也可以部署在一个VM上。
NFV基础设施(NFV infrastructure，NFVI):由硬件资源、虚拟资源和虚拟化层组成。从VNF的角度来说，虚拟化层和硬件资源看起来是一个能够提供所需的虚拟资源的完整实体。
NFV MANO系统采用的编排方式，需要的组件繁多、部署复杂，资源消耗较多，并且组件之间耦合性大，无法独立升级。进而，NFV MANO系统不太适用于边缘计算场景。
申请人将服务网格(Service Mesh)技术引入VNF的编排系统。服务网格(Service Mesh)是专用的基础设施层，轻量级高性能网络代理。提供安全、快速、可靠地服务间通讯，与实际应用部署一起，但对应用透明。Service Mesh可以认为是微服务时代的TCP协议，因此服务网格在信息技术(information technical，IT)系统中应用广泛。但是VNF有很多不同于IT应用的服务治理相关内容，比如边缘计算场景中，VNF需要多个网络接口且支持多种接口实现类型，每种接口有不同的质量属性。
基于此，本申请实施例提出一种VNF编排系统及方法，结合Service Mesh，建立一种轻量级的VNF编排方案。本申请提出的VNF编排系统中包括数据平面和控制平面。参见图2所示，数据平面上包括各个VNF网元，采用分布式的方式部署。控制平面可以采用集中式的方式存在，用于实现服务治理，比如服务发现、遥测监控收集、网元健康检查、路由和负载均衡策略下发等。
示例性地，参见图2所示，控制平面可以包括配置规则控制器、遥测策略控制器、安全控制器。配置规则控制器为VNF网元的配置中心，用于将配置数据下发到VNF网元。遥测策略控制器，用于收集VNF网元发送的遥测数据，对VNF网元进行策略控制等。安全控制器，用于为通信安全控制，比如包括通信连接安全、密钥管理、文件安全、用户认证授权等。
VNF网元执行的各个功能可以划分为业务逻辑、网络协议编解码，服务注册与发现、L2/L3层的网络连接、负载均衡。为了业务相关功能、网络连接的相关功能可以独立升级和发展，本申请实施例中将数据平面中的各个VNF网元中业务相关功能、网络连接的相关功能进行了拆分，通过不同的服务容器来实现。参见图2和图3所示，数据平面中的各个VNF网元包括VNF业务服务和网络代理。VNF业务服务用于实现业务相关功能，包括业务逻辑、网络协议编解码。网络代理用于实现网络连接的相关功能，包括服务注册与发现、L2/L3层网络连接和负载均衡。VNF业务服务聚焦于业务，对网络代理无感知。网络代理聚焦于L2/L3层基础网络功能以及保证业务服务的服务质量(quality of service，QoS)。网络代理可以在多种环境下运行，比如kubernetes。由于不同的VNF网元对于业务转发来说，不同的业务具有不同需求。比如，一些VNF网元对网络接口的性能要求低，普通内核态接口即可。再比如，一些VNF网元对网络接口的性能要求高，需要物理网卡通过用户态协议栈的方式。因此，本申请实施例中提供的网络代理能够适配(或者支持)不同的网络转发平面。示例性的，转发平面可以包括基于流表转发的转发平面，基于传统物理设备的转发模型的转发平面，或者基于物理网口的转发平面中的一项或多项。比如，流表转 发可以采用基于开放流(openflow)实现的虚拟交换机(virtual switch，vSwitch)来实现。比如，传统物理设备的转发模型的转发可以是基于分布式虚拟路由(distributed virtual router，DVR)来实现。再比如，基于物理网口的转发平面可以基于单根I/O虚拟化(Single Root I/O Virtualization，SR-IOV)的物理网卡分配来实现。当然还可以包括基于其它技术实现的转发平面，本申请实施例对此不作限定。
示例性地，比如网络代理可以支持L2层网络连接和/或L3层网络连接。在L2层网络连接中，可以适配(或者支持)基于openflow的虚拟交换机和/或基于传统物理设备转发模型的软件交换机。在L3层网络连接中，网络代理支持纯L3层网络的分布式虚拟路由(distributed virtual router，DVR)和/或基于单根I/O虚拟化(Single Root I/O Virtualization，SR-IOV)的物理网卡分配。网络代理也可以称为网络管理器(network manager)，或者可以采用其它的称呼，本申请对此不作限定。
下面以两个VNF网元为例，对网络服务中网络接口的建立流程进行说明。两个VNF网元按照角色可以分为网络服务的请求者和网络服务的提供者。本申请实施例中网络服务的请求者表示为NSC、网络服务的提供者表示为NSE。在多个网元串联时，VNF网元既作为网络服务的请求者，也作为网络服务的提供者。参见图4所示，为网络服务连接的流程示意图。
VNF网元建立后，网络管理员配置网络服务定义，将网络服务定义保存在配置规则控制器中。例如，网络服务定义可以包括如下中的一项或多项：所述网络服务对应的转发关系信息(比如网络连接路由的原选择器和目的选择器)、转发面类型、网络连接所需的网络接口类型、载荷(payload)类型。网络服务定义还可以包括网络服务策略。网络服务策略可以包括弹性伸缩策略、熔断规则、流量规则等中的一项或多项。弹性伸缩策略用于描述对VNF网元扩容或缩容的规则，弹性伸缩策略中包括弹性扩容规则和/或弹性缩容规则。熔断规则为用于描述建邻停止的规则。流量规则为用于统计VNF网元与其它VNF网元通信产生的流量的规则。
作为一种示例，在需要部署多网络平面的场景中，网络服务定义中可以包括多网络平面网络服务的定义和/或网络服务策略等。其中，多网络平面网络服务的定义包括网络平面实现类型、playload类型、网络定义。网络定义可以包括网络名称、子网、IP地址、网关、虚拟网络标识(virtual network identifier，vni)中的一项或多项。
NSE启动时，会向配置规则控制器进行网络服务注册。
S401，NSE向网络代理2(NSMgr2)发起服务注册信息，服务注册信息用于描述NSE所能提供的网络接口能力(NetworkServiceEndpoints)。比如服务注册信息可以包括IP地址分配策略、IP地址段、支持的网络接口类型等中的一项或多项。
S402，网络代理2将服务注册信息发送给配置规则控制器。配置规则控制器根据接收到的服务注册信息，保存所述NSE的相关信息。比如，可以以服务列表的形式保存NSE的相关信息，还可以以其它形式保存，比如数组。以服务列表的形式保存为例，服务列表中可以包括NSE的相关信息。NSE的相关信息可以包括NSE的服务注册信息，还可以包括NSE所属的NSMgr信息、NSE所在节点的信息、NSE的网元信息中的一项或多项。NSE所在节点的信息可以包括NSE所在节点的标识，NSE所在节点的网络接口等中的一项或多项。所述NSE的网元信息可以包括所述NSE的网元标识等。
一种示例中，NSE所属的NSMgr信息、NSE所在节点的信息、NSE的网元信息可以 携带在服务注册信息中，由网络代理2发送给配置规则控制器。另一种示例中，NSE所属的NSMgr信息、NSE所在节点的信息可以由配置规则控制器根据服务注册信息的来源来确定。NSE的网元信息可以携带在服务注册信息中发送给配置规则控制器。
S403，NSC向网络代理1(NSMgr1)发送连接请求1。连接请求1中可以携带NSC网络服务的需求信息。
所述NSC网络服务的需求信息可以包括网络接口的需求信息。网络接口的需求信息可以包括NSC网络服务所需的网络接口类型，还可以包括NSC的网络接口名称。网络接口的需求信息不包括NSC的网络接口名称时，可以由网络代理为所述NSC指定。所述NSC网络服务的需求信息还可以包括网络服务定义的标识、NSC对应的网络命名空间标识、域套接字(domain socket)文件标识、labels标签中的一项或多项。网络服务定义的标识可以在NSC部署时，动态注入到NSC中。
其中，domain socket文件标识所对应的domain socket文件用于与NSMgr(图4对应实施例中NSMgr1)建立调用通道。labels标签用于定位和标识VNF网元。
需要说明的是，网络服务定义中包括网络服务所需的网络接口类型时，NSC网络服务的需求信息中可以不包括NSC网络服务所需的网络接口类型。网络服务定义中不包括网络服务所需的网络接口类型时，NSC网络服务的需求信息中包括NSC网络服务所需的网络接口类型。
NSC启动时，可以通过初始化容器(init-container)按需向NSMgr1发起连接请求1。初始化容器，可以在网络连接建立完成后，由容器管理平台将其自动删除。
S404，网络代理1接收连接请求1后，根据NSC网络服务的需求信息向配置规则控制器查询网络服务所经过的VNF网元。比如防火墙VNF和网关VNF。
示例性的，网络代理1向配置规则控制器发送查询请求，查询请求中可以携带NSC网络服务的需求信息。配置规则控制器根据NSC网络服务的需求信息查询服务列表确定下一跳VNF网元为NSE，NSE位于node2上。具体的，查询网络服务定义，并解析网络连接路由对应的默认目的选择器，确定需要连接的第一个VNF网元(例如Firewall)，然后从上述配置规则控制器中的服务列表查询Firewall VNF在远端node2节点上。
S405，node1上网络代理1向node2的网络代理2发送连接请求2。
其中，连接请求2中可以包括网络接口的需求信息。
示例性地，连接请求2中还可以携带隧道的需求信息。隧道的需求信息包括隧道类型信息、隧道建立策略和隧道接口信息等中的一项或多项。
一种可能的方式中，隧道的需求信息可以包含在网络服务定义中，由配置规则控制器下发给各个网络代理。另一种可能的方式中，可以由网络代理1向配置规则控制器上报自身所支持的建立隧道的能力，从而配置规则控制器根据网络代理1自身所支持的建立隧道的能力确定所述隧道的需求信息。又一种可能的方式中，网络代理1可以自身所支持的建立隧道的能力来确定所述隧道需求信息。
示例性地，隧道类型为虚拟扩展局域网(virtual extensible local area network，VXLAN)。隧道类型还可以是通用路由封装(generic routing encapsulation，GRE)等其他类型。
隧道类型信息包括用于标识隧道所属的虚拟网络的标识信息，比如，用于标识隧道所属的虚拟网络的标识信息可以为虚拟网络标识符(virtual network identifier，VNID)。隧道建立策略根据具体转发平面的不同，可以配置为基于流表转发的转发策略，基于传统物理 设备的转发模型的转发策略，或者基于物理网口的转发策略。隧道接口信息中可以包括隧道接口类型、隧道接口名称、隧道接口的源IP地址和目的IP地址(比如是node的IP地址)等。
应理解的是，若NSC和NSE位于同一节点上时，则连接请求2中可以不再携带隧道的需求信息。若NSC和NSE位于不同的节点上，则需要打通不同的节点之间的数据传输隧道，连接请求2中携带隧道的需求信息。
S406，网络代理2根据网络接口的需求信息确定网络接口的属性值。
示例性地，网络接口可以包括NSE的网络接口和NSC的网络接口。
网络接口的属性值可以包括如下中的一项或多项：
1)网络接口名称。NSC网络接口的名称可以由网络代理2根据连接请求2携带的NSC网络接口的名称来确定，或者可以由NSE配置并发送给网络代理2。NSE网络接口的名称可以由NSE发送给网络代理2，或者由网络代理2为所述NSE指定。
2)网络接口的IP地址。网络接口的IP地址分配策略可以由配置规则控制器下发，也可以由网络代理2与NSE协商确定。比如，NSE具有分配网络接口IP地址的能力，可以由NSE来分配。或者NSE不具备由分配网络接口IP地址的能力，可以由网络代理2来分配。或者由NSE指定由网络代理2来分配等。或者还可以由网络代理2来根据payload类型来确定由谁来分配网络接口的IP地址，即，网络接口IP地址分配策略，可以由网络代理2根据payload类型来确定由NSE分配网络接口的IP地址或者由网络代理2分配网络接口的IP地址。
网络接口IP地址分配策略还可以为由网络代理根据集中式的IP地址池分配IP地址。集中式的IP地址池可以由配置规则控制器下发给网络代理。
3)网络接口类型。接口类型可以包括内核态接口、用户态接口、物理接口。
其中内核态接口或者用户态接口又可以通过不同的接口实现，比如tap、KNI、dpdkvirtiouser、vhost-user、vhost-user-client等。
一种情况下，NSE网络接口的类型与NSC的网络接口的需求信息中所需的网络接口的类型保持一致。若NSE所支持的网络接口类型，这类型的网络接口所要求的服务质量高于NSC所需的网络接口的类型，建立的网络接口的类型为NSE所支持的网络接口类型。
4)payload类型。一般选择IP或者以太网(Ethernet)。IP用于指示需要建立三层网络连接。Ethernet用于指示需要建立二层网络连接。
示例性地，如果payload类型为Ethernet，指示建立L2层网络连接，网络接口的IP地址可以由NSE分配。如果payload类型为IP，指示建立L3层网络连接，可以由网络代理2根据集中式的IP地址池为NSE分配。
S407，网络代理2调用转发平面建立NSE网络接口以及建立节点2(node2)隧道接口。为建立的NSE网络接口配置相应的IP地址，为节点2隧道接口配置IP地址。示例性的，node2隧道接口的IP地址可以为node2的IP地址。网络代理2将建立的NSE网络接口注入到NSE网络命名空间中。
S408，网络代理2向网络代理1发送连接响应2，所述连接响应2携带NSC网络接口的属性值。比如，包括IP地址、NSC网络接口名称以及接口类型中的一项或多项。
S409，网络代理1接收到连接响应2后，调用转发平面，建立NSC网络接口以及NSC隧道接口，为NSC网络接口配置IP地址，以及为NSC隧道接口配置隧道接口的IP地址。 网络代理1将建立的NSC网络接口注入到NSC网络命名空间中。
S410，网络代理2向NSC发送连接响应1。连接响应1用于通知网络接口建立完成。
网络代理可以多个组件。示例性地，参见图5所示，网络代理可以包括第一通信模块、第二通信模块、转发平面适配模块以及规则模块。需要说明的是，如下针对几个组件的功能进行简要描述，后续结合具体场景再展开描述。
第一通信模块(Nsmd)，为网络连接的核心组件，负责发起和接收网络服务请求。以网络代理1为例，网络代理1中的nsmd用于接收来自NSC的连接请求1，并向网络代理2发送连接请求2。
第二通信模块(nsmd-k8s)：负责与控制平面进行通信，比如进行网络服务注册和发现。以网络代理2为例，网络代理2中的nsmd-k8s用于将服务注册信息发送给配置规则控制器。
规则模块(rule-agent)：接收来自配置规则控制器下发的配置规则和配置策略，并通知给VNF网元。
转发平面适配模块(dataplane-agent)：负责适配不同的转发平面。例如，转发平面可以包括基于流表转发的转发平面，基于传统物理设备的转发模型的转发平面，或者基于物理网口的转发平面中的一项或多项。
示例性地，网络代理还可以包括：
接口监控模块(crossconnect-monitor)：负责监控NSC的网络接口状态，如果发现NSC接口出现异常，清理掉对应网络服务的所有网络接口，重新发起连接请求。
遥测模块(telemetry-agent)：负责VNF网元遥测数据收集。
通信插件(Nsmdp)：负责VNF网元与网络代理之间建立远程过程调用(remote procedure call，RPC)通道。具体可以用于启动部署于VNF网元中的gRPC服务器(server)。
SR-IOV控制模块(sriov-controller)：负责SR-IOV物理网卡的分配。
本申请实施例中对模块的划分是示意性的，仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。另外，在本申请各个实施例中的各功能模块可以集成在一个处理器中，也可以是单独物理存在，也可以两个或两个以上模块集成在一个模块中。上述集成的模块既可以采用硬件的形式实现，也可以采用软件功能模块的形式实现。
作为一种示例，控制平面中包括的配置规则控制器、遥测策略控制器、安全控制器可以通过图6所示的逻辑架构来实现。
网络管理员产生的网元配置、规则信息、安全信息、策略信息、网络服务定义和VNF网元通过网络代理发送的网络注册信息均发送给逻辑存储层。逻辑存储层可以包括多个存储平面监控进程。不同的存储平面监控进程用于监控逻辑存储层接收到的不同的存储信息，并分别存储信息进行过滤和封装，然后发送给控制器引擎。控制器引擎在不同的处理阶段预留不同的处理流水线。不用的处理流水线可以通过不同的插件来实现控制平面的行为。控制器引擎功能实现简单，具体的业务逻辑都在不同插件中实现，所以控制面的资源占用很少。控制器引擎通过网络接口(dispatch组件)将配置信息下发给网络代理。
下面结合具体应用场景对本申请提供的具体方案进行详细说明。
一种可能的场景中，在边缘云中一个虚拟专用网(virtual private network，VPN)客户端(client)需要连接公司企业内网，其中会经过多个VNF网元，比如，参见图7所示，经过的VNF网元包括用于实现防火墙功能的VNF网元(称为防火墙VNF，firewall VNF)， 以及用于实现VPN网关(Gateway)功能的VNF网元(VPN Gateway VNF)。VPN客户端、防火墙VNF以及VPN网关之间建立L2层/L3层的网络连接和数据传输隧道。
控制平面可以根据客户需求来定义网络服务，并关联到指定的VNF网元中，从而VNF网元之间来建立业务链。比如，网络管理员可以将用于描述网络服务定义的API文档或描述文件配置给控制平面，API文档或描述文件指示所需建立的网络服务所需经过的VNF网元。图7所示的场景中，经过防火墙VNF和VPN网关VNF。
应理解的是，VPN客户端、防火墙VNF以及VPN网关也可以部署在同一节点，也可以部署在不同的节点，或者可以两个VNF网元部署在其中一个节点，另一个VNF网元部署在另外一个节点，本申请实施例对此不作具体限定。其中，图8中以VPN客户端、防火墙VNF部署于节点1，VPN网关部署在节点2为例进行说明。部署于同一节点的不同的VNF网元可以通过同一网络代理来进行代理VNF网元，来实现基础网络功能与QoS。图8中以网络代理1(NSMgr1)用来代理VPN客户端、防火墙VNF，网络代理2(NSMgr2)用来代理VPN网关为例。
下面结合图8和图9对网络服务的网络接口的建立流程进行说明。
S901，VPN客户端向NSMgr1发送连接请求1，连接请求1中携带VPN客户端网络服务的需求信息。
VPN客户端网络服务的需求信息包括网络接口的需求信息。网络服务的需求信息还可以包括网络服务定义的标识、VPN客户端的网络命名空间标识等。
网络接口的需求信息中包括网络服务连接所需的接口类型、VPN客户端的网络接口名称。
S902，网络代理1接收连接请求1后，根据VPN客户端网络服务的需求信息向配置规则控制器查询网络服务所需经过的VNF网元。图8对应的场景中，网络服务连接的下一跳VNF网元为firewall VNF，firewall VNF的下一跳为VPN网关VNF。
示例性的，网络代理1向配置规则控制器发送第一查询请求，第一查询请求中可以携带VPN客户端网络服务的需求信息。配置规则控制器根据VPN客户端网络服务的需求信息查询服务列表确定下一跳VNF网元为firewall VNF，根据服务列表确定firewall VNF位于node1上。
S903，node1上网络代理1向firewall VNF发送连接请求2。
S904，firewall VNF向网络代理1发送连接响应2。
一种示例中，连接响应2中可以携带firwall VNF所需建立的网络接口的名称和网络接口的类型。
另一种示例中，连接响应2中可以携带firewall VNF所支持的网络接口的类型以及所支持的网络接口的命名规则。由网络代理1为firewall生成一个网络接口名称，网络代理2根据网络服务连接所需的接口类型以及firewall VNF所支持的网络接口的类型确定需为所述firewall VNF建立的网络接口的类型。
图9对应的实施例中，firewall VNF与VPN客户端归属于同一网络代理，网络代理1可以一次向配置规则控制器确定网络服务连接所经过的VNF网元。当然，也可以向配置规则控制器查询下一跳VNF网元。
在firewall VNF与VPN客户端归属于不同的网络代理时，归属于firewall VNF的网络代理接收到firewall VNF的服务响应消息时，可以向配置规则控制器查询下一跳VNF网元。 还可以仅NSC的网络代理查询网络服务连接所经过的VNF网元，然后将网络服务连接所经过的VNF网元的标识信息携带在连接请求中发送给下一跳VNF网元的网络代理。
S905，网络代理1向node2的网络代理2发送连接请求3，连接请求3中携带网络接口的需求信息。
示例性地，连接请求2中还可以携带隧道的需求信息。隧道的需求信息包括隧道类型信息、隧道建立策略和隧道接口信息。例如，隧道类型为VXLAN。隧道类型信息可以包括VNID。隧道建立策略根据具体转发平面的不同，可以配置基于流表转发的转发策略，基于传统物理设备的转发模型的转发策略，或者基于物理网口的转发策略。隧道接口信息中可以包括隧道接口类型、隧道接口名称、隧道接口的源IP地址和目的IP地址。
S906，网络代理2向VPN gateway VNF发送连接请求4，连接请求4中携带网络接口的需求信息。
S907，VPN gateway VNF向网络代理2发送连接响应4。连接响应4中携带用于网络接口的属性信息。
其中，网络接口的属性信息中包括VPN gateway VNF网络接口的IP地址、名称以及接口类型，还包括为VPN客户端分配的网络接口的IP地址。具体的，VPN gateway VNF可以根据VPN客户端网络服务的需求信息确定用于网络服务连接的网络接口的属性信息。
S908，网络代理2调用转发平面建立VPN gateway VNF的网络接口，为建立的VPN gateway VNF网络接口配置IP地址。网络代理2将建立的VPN gateway VNF网络接口注入到VPN gateway VNF网络命名空间中。针对VPN gateway VNF网络命名空间的确定，一种方式是，在VPN gateway VNF通过网络代理2向配置规则控制器上报自身的能力信息时，一块发送给网络代理2。另一种方式是，连接响应4可以携带VPN gateway VNF网络命名空间的标识。
S909，网络代理2调用转发平面建立节点2上第二隧道接口，为节点2上第二隧道接口配置IP地址。节点2上隧道接口的IP地址可以为节点2的IP地址。
S910，网络代理2向网络代理1发送连接响应3，所述连接响应3携带VPN客户端网络接口的IP地址、VPN客户端网络接口的名称以及接口类型。
S911，网络代理1接收到连接响应3后，调用转发平面，建立firewall VNF上用于与VPN gateway VNF连通的网络接口。网络代理1将建立的firewall VNF上用于与VPN gateway VNF连通的网络接口注入到firewall VNF网络命名空间中。
S912，网络代理1根据隧道的需求信息建立节点1上第一隧道接口，为节点1上第一隧道接口配置IP地址。例如，节点1上隧道接口的IP地址可以为节点1的IP地址。
S913，网络代理1调用转发平面，建立firewall VNF上用于与VPN客户端连通的网络接口。网络代理1将建立的firewall VNF上用于与VPN客户端连通的网络接口注入到firewall VNF网络命名空间中。
S914，网络代理1调用转发平面，为VPN客户端建立VPN客户端网络接口。网络代理1将建立的VPN客户端网络接口注入到VPN客户端网络命名空间中。
S915，网络代理1向NSC发送连接响应1。连接响应1用于通知NSC网络服务连接建立完成。
一种示例中，以转发平面通过openflow的vSwitch实现为例。vSwitch可以认为是一种特殊的VNF网元。每个节点都会有一个vSwitch，是VNF网元之间的数据通路(或者 数据隧道)，决定VNF网元之间数据流的转发路径。vSwitch支持L2层网络连接。一种方式中，VNF网元与vSwitch之间通过接口对来进行数据交互，接口对中一个接口在VNF网元，另一个接口在vSwitch上。另一种方式中，在vSwitch与VNF网元共用一个网络接口，或者说在vSwitch为VNF网元建立网络接口，并将建立的网络接口注入到VNF网元中。不同的节点之间可以通过VXLAN接口来进行数据传输，或者说，不同的节点之间通过VXLAN报文封装技术来实现不同的节点之间的网络连接。vSwitch通过网桥和内核态接口(或者用户态接口)来实现网络的互联。
参见图10所示，VPN客户端通过图10中的连线和VPN Gateway建立了L2层网络连接，其中只有VPN client和VPN Gateway的eth1网络接口配置了IP地址。每个node上有3个vswitch网桥组成，(入口网桥)br-int负责实现网络接口和流表规则的建立、隧道网桥(br-tun)负责实现隧道的建立、出口网桥(br-ex)负责与物理网口打通。Firewall VNF内部使用linux网桥和iptables规则来模拟防火墙功能。另外VNF网元(VPN客户端、VPN GatewayVNF或Firewall VNF)使用的网络接口既可以是内核态接口也可以是用户态接口。如果是用户态接口，VNF网元内部会运行用户态协议栈。
参见图11所示，以转发平面基于DVR实现的纯3层网络连接为例。纯3层网络连接，VNF网元之间的连接需要通过路由(每个VNF网元都需要配置路由规则)，因此不仅需要网络隔离而且需要分配不同的网段,每个网络接口都需要配置IP地址。如图11所示，为了进行网络隔离共建立了2个3层VPN，分别为vpna和vpnb。vpn内部配置静态路由。业务链的网络服务定义中给定了网络IP段为192.168.1.0/24。当有VPN client请求该网络服务时，网络代理(网络代理1或网络代理2)在该网段下分配了n个网络掩码为30位的子网，每相邻两个网元的相邻接口在2个子网中，例如VPN Client和Firewall VNF的网络接口分别在192.168.1.0/30子网和192.168.1.4.0/30子网中，Firewall VNF和VPN Gateway VNF分别在192.168.1.8/30和192.168.1.12/30子网中。这样VPN Client就可以和VPN Gateway VNF进行3层网络通信了。另外VNF网元使用的网络接口既可以是内核口也可以是用户态口，如果是用户态口，网元内部会运行用户态协议栈。图11中，BD表示广播域或桥域(Bridge Domain，BD)，VXLAN网络中转发数据报文的二层广播域。BDIF：基于BD建立的三层逻辑接口。通过BDIF接口配置IP地址可实现不同网段的VXLAN间，及VXLAN和非VXLAN的通信，也可实现二层网络接入三层网络。
另一种可能的场景中，针对VNF多网络平面场景。网络平面的类型可以包括base面、fabric面、外联管理面和外联数据面等。不同类型的网络平面所要求的质量属性不同，比如不同类型的网络平面所要求的网络接口类型不同、载荷类型不同、路由类型不同(比如vSwitch、DVR)。以任意GW(XGW)网元为例，XGW网元中部署多个VNF网元，参见图12所示。比如多个VNF网元分为两类，分别为控制类服务和业务类服务。控制类服务在图12中称为管理&控制(mangerment&control，M&C)，业务类服务在图12中称为接口处理单元(interface process unit，IPU)。一个VNF网元(或者称为VNF服务)可以连接一个或者多个网络平面。不同的网络平面所要求的质量属性可能不同。图12中，以XGW网元部署6个VNF网元为例，分别为M&C1、M&C2以及IPU1-IPU4。图12中以两个网络平面为例，分别为base面和fabric面。XGW网元中要求不同的网络平面之间相互隔离。
网络管理员配置多平面的网络服务定义，将多平面的网络服务定义保存在配置规则控 制器中。多平面的网络服务定义中包括每个网络平面对应的网络服务定义等。其中，网络服务定义包括网络平面实现类型、playload类型、网络定义。网络定义可以包括网络名称、子网、IP地址、网关、虚拟网络标识(virtual network identifier，vni)中的一项或多项。
一种可能的方式中，配置规则控制器接收到多平面的网络服务定义后，将多平面的网络服务定义发送给用于管理XGW的网络代理。网络代理根据网络服务定义调用转发平面为各个VNF网元分别对应的网络平面建立网络接口，并为各个网络接口配置IP地址。比如一个VNF网元对应两个网络平面，则该VNF网元需要建立两个网络接口，网络接口与网络平面一一对应。
另一种可能的方式中，VNF网元按需请求建立N个网络平面的网络接口。网络代理接收该VNF网元发送的连接请求，网络代理用于管理VNF网元，连接请求用于请求建立N个网络平面的网络接口，连接请求中携带N个网络平面中每个网络平面的标识，N为大于1的整数；网络代理根据N个网络平面的标识向配置规则控制器查询N个网络平面中每个网络平面对应的网络接口的需求信息；每个网络平面对应网络接口的需求信息用于描述采用每个网络平面进行网络连接所需建立的网络接口；网络代理根据N个网络平面中每个网络平面上的网络接口的需求信息为第一VNF建立N个网络接口，N个网络接口与N个网络平面一一对应。
在需要建立隧道时，一种方式是，网络代理为系统中的每一个节点建立隧道接口。另一种方式是，网络代理接收某个VNF网元(部署于节点1)发起的与节点2的隧道接口建立请求时，为该VNF所在的节点1建立隧道接口，以及为节点2建立隧道接口。
一种示例中，如图13所示，以转发平面通过openflow的vSwitch实现为例，base面配置的IP地址段为10.56.217.XX。fabric面配置的IP地址段为10.56.218.XX。图13中以M&C1、IPU1位于节点1(node1)，M&C2、IPU2位于节点2(node2)为例。针对base面，网络代理为M&C1分配的网络接口(eth1)IP地址为10.56.217.10，网络代理为M&C2分配的网络接口(eth1)IP地址为10.56.217.11，网络代理为IPU1分配的网络接口(eth1)IP地址为10.56.217.15，网络代理为IPU2分配的网络接口(eth1)IP地址为10.56.217.12。针对fabric面，网络代理为M&C1分配的网络接口(eth2)IP地址为10.56.218.5，网络代理为M&C2分配的网络接口(eth2)IP地址为10.56.217.7，网络代理为IPU1分配的网络接口(eth2)IP地址为10.56.217.6，网络代理为IPU2分配的网络接口(eth2)IP地址为10.56.217.8。node1中的M&C1、IPU1与node2中的M&C2、IPU2之间通过VXLAN建立L2层网络连接。每个node上有3个vswitch网桥组成，br-int负责实现网络接口和流表规则的建立、br-tun负责实现隧道的建立、br-ex负责与物理网口打通。
另一种示例中，如图14所示，以转发平面通过DVR实现为例。node1中的M&C1、IPU1与node2中的M&C2、IPU2之间建立基于DVR实现的纯3层网络连接的示例图。
又一种可能的场景中，网络管理员配置网络服务策略，将网络服务策略配置给配置规则控制器。网络服务策略中包括触发网络操作的条件。例如，网络服务策略中包括弹性伸缩策略、熔断规则、流量规则等中的一项或多项。弹性伸缩策略用于描述对VNF网元扩容或缩容的规则，包括对VNF网元扩容或缩容的条件。弹性伸缩策略中包括弹性扩容规则和/或弹性缩容规则。熔断规则用于描述建邻停止的规则，包括触发VNF网元停止建邻的条件。
配置规则控制器接收到网络服务策略后，将网络服务策略发送给各个网络代理(比如上述网络代理1、网络代理2)，网络代理接收到网络服务策略后，根据网络服务策略定时统计遥测数据，根据统计的遥测数据确定是否满足网络服务策略所规定的触发网络操作的条件，确定满足时，向遥测策略控制器发送满足触发网络操作条件的指示，遥测策略控制器接收到触发网络操作条件的指示时，执行网络操作。
一种示例中，网络管理员给配置规则控制器配置触发熔断规则。触发熔断规则包括最大承受邻居数和最大虚拟路由转发(virtual routing forwarding，VRF)数。配置规则控制器将触发熔断规则发送给网络代理，网络代理统计遥测数据，即统计VNF网元的邻居数和VRF数。网络代理在确定VNF网元的邻居数达到最大承受邻居数且VRF数达到最大VNF数时，网络代理向遥测策略控制器发送达到触发熔断的条件的指示，遥测策略控制器接收到达到触发熔断的条件的指示时，通过网络代理向VNF网元下发停止建邻指示，进而VNF网元接收到停止建邻指示后，不再触发建立邻居的连接的流程。遥测策略控制器还可以发出告警消息。
另一种示例中，网络管理员给配置规则控制器配置弹性扩容规则。弹性扩容规则包括的触发条件为最大承受邻居数。配置规则控制器将弹性扩容规则发送给网络代理，网络代理统计遥测数据，即统计VNF网元的邻居数。网络代理确定VNF网元的邻居数达到最大承受邻居数时，向遥测策略控制器发送达到弹性扩容条件的指示，遥测策略控制器接收到达到弹性扩容条件的指示时，通过网络代理给VNF网元下发扩容策略，从而VNF网元根据扩容策略执行扩容操作。
下面结合图5提供的网络代理的装置示意图，对网络代理的功能进行详细说明。图5所示的网络代理用于实现上述图4或图9所示的实施例所述的方法。
一种可能的场景中，图5所示的装置应用网络代理1。
第一通信模块，用于接收来自第一虚拟化网络功能VNF网元的第一连接请求，所述网络代理1用于管理所述第一VNF网元，所述第一VNF网元为网络服务的请求方(NSC)，所述第一连接请求用于请求建立网络接口，所述网络接口是实现所述网络服务所需的网络接口，所述第一连接请求携带网络接口的需求信息，所述网络接口的需求信息用于描述所述网络服务所需的网络接口。
第一通信模块，还用于向所述网络代理2发送第二连接请求，所述第二连接请求中携带所述网络接口的需求信息；所述网络代理2用于管理第二VNF网元，所述第二VNF网元为所述网络服务的提供方；
第一通信模块，还用于接收所述网络代理2发送的第一网络接口的属性值，所述第一网络接口的属性值是所述网络代理2根据所述网络接口的需求信息确定的；
转发平面适配模块，根据所述第一网络接口的属性值调用转发平面建立所述第一网络接口，以使得所述第一VNF网元通过所述第一网络接口进行通信。
在一种可能的示例中，所述网络接口的需求信息中包括如下一项或多项：网络接口的类型、网络接口的名称。
在一种可能的示例中，所述第一连接请求还携带网络服务定义的标识；
第二通信模块，用于在向所述网络代理2发送第二连接请求之前，根据所述网络服务定义的标识，向配置规则控制器查询所述网络服务中所述第一VNF网元的下一跳VNF网元为所述第二VNF网元；
其中，网络服务定义的标识所对应的网络服务定义中包括所述网络服务对应的转发关系信息。
在一种可能的示例中，转发平面适配模块用于适配转发平面，所述转发平面支持建立的网络接口满足所述网络服务所需的网络接口，转发平面适配模块根据所述第一网络接口的属性值调用所述转发平面建立所述第一网络接口。
在一种可能的示例中，所述第一VNF网元部署于第一节点，所述第二VNF网元部署于第二节点，转发平面适配模块调用所述转发平面建立所述第一节点上第一隧道接口，所述第一隧道接口用于连通所述第二节点。
在一种可能的示例中，所述第一网络接口的属性值包括如下中的一项或多项：
所述第一网络接口的名称、所述第一网络接口的类型、所述第一网络接口的IP地址。
在一种可能的示例中，所述第一连接请求还携带所述第一VNF网元的网络命名空间标识；
转发平面适配模块，用于将所述建立的所述第一网络接口注入所述网络命名空间标识所对应的网络命名空间。
在一种可能的示例中，规则模块，用于接收来自配置规则控制器发送的网络服务策略，网络服务策略包括触发网络操作的条件；
遥测模块，用于根据所述网络服务策略统计遥测数据，并根据遥测数据确定满足所述触发网络操作的条件时，向遥测策略控制器发送第一指示，所述第一指示用于指示满足触发网络操作的条件；接收到所述遥测策略控制器发送的用于执行所述网络操作的通知时，触发执行所述网络操作。
另一种可能的场景中，图5所示的装置应用于网络代理2。
第一通信模块，用于接收来自网络代理1的第二连接请求，所述第二连接请求中携带网络接口的需求信息，所述网络代理2用于管理第二VNF网元，所述第二VNF网元为网络服务的提供方；网络代理1用于管理第一VNF网元，所述第一VNF网元为所述网络服务的请求方，所述网络接口的需求信息用于描述实现所述网络服务所需的网络接口；
第一通信模块，还用于根据所述网络接口的需求信息确定第二网络接口的属性值；
转发平面适配模块，用于根据所述第二网络接口的属性值调用适配的转发平面建立所述第二网络接口，以使得所述第二VNF网元通过所述第二网络接口进行通信。
在一种可能的示例中，还包括：
第一通信模块，还用于根据所述网络接口的需求信息确定第一网络接口的属性值，所述第一网络接口为所述第一VNF网元进行网络通信的网络接口；
第一通信模块，用于将所述第一网络接口的属性值发送给所述网络代理1。
在一种可能的示例中，转发平面适配模块适配转发平面，所述转发平面支持建立的网络接口满足所述网络服务所需的网络接口，转发平面适配模块根据所述第二网络接口的属性值调用所述转发平面建立所述第二网络接口。
在一种可能的示例中，所述第一VNF网元部署于第一节点，所述第二VNF网元部署于第二节点，所述第二连接请求还携带隧道的需求信息，所述隧道的需求信息用于描述在所述第一节点与所述第二节点所需建立的隧道；转发平面适配模块根据所述隧道的需求信息调用所述转发平面为所述第二节点建立第二隧道接口，所述第二隧道接口用于连通所述第一节点。
在一种可能的示例中，第二通信模块，接收所述第二VNF网元发送的服务注册信息，所述服务注册信息用于描述所述第二VNF网元所能提供的网络接口能力；将所述服务注册信息发送给配置规则控制器。
在一种可能的示例中，所述服务注册信息包括如下一项或多项：网络协议IP地址分配策略、IP地址段、支持的网络接口类型。
在一种可能的示例中，第一网络接口的属性值包括如下一项或多项：
所述第一网络接口的名称、所述第一网络接口的类型，所述第一网络接口的IP地址。
在一种可能的示例中，所述第一网络接口的属性值包括所述第一网络接口的IP地址，所述网络代理2根据所述网络接口的需求信息确定第一网络接口的属性值，包括：
第一通信模块，向所述第二VNF网元发送所述网络接口的需求信息；接收所述第二VNF网元发送的所述第一网络接口的IP地址。
在一种可能的示例中，第二网络接口的属性值包括如下一项或多项：所述第二网络接口的名称、所述第二网络接口的类型，所述第二网络接口的IP地址。
在一种可能的示例中，所述第二网络接口的属性值包括所述第二网络接口的IP地址，第一通信模块，向所述第二VNF网元发送所述网络接口的需求信息；接收所述第二VNF网元发送的所述第二网络接口的IP地址。
在一种可能的示例中，第一通信模块为所述第二网络接口配置所述第二网络接口的IP地址。
在一种可能的示例中，规则模块，接收来自配置规则控制器发送的网络服务策略，网络服务策略包括触发网络操作的条件；遥测模块，根据所述网络服务策略统计遥测数据，并根据遥测数据确定满足所述触发网络操作的条件时，向遥测策略控制器发送第二指示，所述第二指示用于指示满足触发网络操作的条件；接收到所述遥测策略控制器发送的用于执行所述网络操作的通知时，触发执行所述网络操作。
在又一种可能的场景中，针对多平面场景中的网络代理。
第一通信模块，接收VNF网元发送的连接请求，所述网络代理用于管理所述VNF网元，所述连接请求用于请求建立N个网络平面的网络接口，所述连接请求中携带所述N个网络平面中每个网络平面的标识，N为大于1的整数；根据所述N个网络平面的标识向所述配置规则控制器查询所述N个网络平面中每个网络平面对应的网络接口的需求信息；
所述每个网络平面对应网络接口的需求信息用于描述采用所述每个网络平面进行网络连接所需建立的网络接口；
通过转发平面适配模块根据N个网络平面中每个网络平面上的网络接口的需求信息为所述第一VNF建立N个网络接口，所述N个网络接口与所述N个网络平面一一对应。
图15是适用于本申请实施例的网络代理的示意性结构图。如图15所示，网络代理包括：一个或多个处理器1501，一个或多个存储器1502，一个或多个通信接口1503。处理器1501用于控制通信接口1503收发信号，存储器1502用于存储计算机程序，处理器1501用于从存储器1502中调用并运行该计算机程序，使得网络代理执行本申请的网络接口的建立方法中网络代理、网络代理1、网络代理2执行的相应流程和/或操作。
此外，本申请还提供一种计算机可读存储介质，该计算机可读存储介质中存储有计算机指令，当该计算机指令在计算机上运行时，使得计算机执行上述本申请的网络接口的建立方法中网络代理、网络代理1、网络代理2执行的相应流程和/或操作。
此外，本申请还提供一种芯片，包括存储器和处理器，存储器用于存储计算机程序，处理器用于从存储器中调用并运行该计算机程序，使得安装有该芯片的网络设备执行本申请的网络接口的建立方法中网络代理、网络代理1、网络代理2执行的相应流程和/或操作。
此外，本申请还提供一种计算机程序产品，该计算机程序产品包括计算机程序代码，当计算机程序代码在计算机上运行时，使得计算机执行本申请的网络接口的建立方法中网络代理、网络代理1、网络代理2执行的相应流程和/或操作。
上述实施例中，“和/或”描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B的情况。其中A，B可以是单数或者复数。
本申请中术语“第一”“第二”等字样用于对作用和功能基本相同的相同项或相似项进行区分，应理解，“第一”、“第二”、“第n”之间不具有逻辑或时序上的依赖关系，也不对数量和执行顺序进行限定。还应理解，尽管以下描述使用术语第一、第二等来描述各种元素，但这些元素不应受术语的限制。这些术语只是用于将一元素与另一元素区别分开。例如，在不脱离各种所述示例的范围的情况下，第一图像可以被称为第二图像，并且类似地，第二图像可以被称为第一图像。第一图像和第二图像都可以是图像，并且在某些情况下，可以是单独且不同的图像。
以上实施例中，处理器可以为CPU、微处理器、特定应用集成电路(applicationspecificintegrated circuit，ASIC)，或一个或多个用于控制本申请方案程序执行的集成电路等。例如，处理器可以包括数字信号处理器设备、微处理器设备、模数转换器、数模转换器等。处理器可以根据这些设备各自的功能而在这些设备之间分配移动设备的控制和信号处理的功能。此外，处理器可以包括操作一个或多个软件程序的功能，软件程序可以存储在存储器中。
处理器的所述功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。所述硬件或软件包括一个或多个与上述功能相对应的模块。
存储器可以是只读存储器(read-only memory，ROM)或可存储静态信息和指令的其他类型的静态存储设备，随机存取存储器(random access memory，RAM)或者可存储信息和指令的其他类型的动态存储设备。也可以是电可擦可编程只读存储器(electrically erasable programmable read-only memory，EEPROM)、只读光盘(compact disc readonly memory，CD-ROM)或其他光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘存储介质或者其他磁存储设备、或者能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质等。_
本领域内的技术人员应明白，本申请的实施例可提供为方法、系统、或计算机程序产品。因此，本申请可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本申请可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本申请是参照根据本申请实施例的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器 以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
显然，本领域的技术人员可以对本申请实施例进行各种改动和变型而不脱离本申请实施例的范围。这样，倘若本申请实施例的这些修改和变型属于本申请权利要求及其等同技术的范围之内，则本申请也意图包含这些改动和变型在内。

Claims (24)

  1. 一种网络接口的建立方法，其特征在于，包括：
    第一网络代理接收来自第一虚拟化网络功能VNF网元的第一连接请求，所述第一网络代理用于管理所述第一VNF网元，所述第一VNF网元为网络服务的请求方，所述第一连接请求用于请求建立实现所述网络服务所需的网络接口，所述第一连接请求携带网络接口的需求信息，所述网络接口的需求信息用于描述实现所述网络服务所需的网络接口；
    所述第一网络代理向所述第二网络代理发送第二连接请求，所述第二连接请求中携带所述网络接口的需求信息；所述第二网络代理用于管理第二VNF网元，所述第二VNF网元为所述网络服务的提供方；
    所述第一网络代理接收所述第二网络代理发送的第一网络接口的属性值，所述第一网络接口的属性值是所述第二网络代理根据所述网络接口的需求信息确定的；
    所述第一网络代理根据所述第一网络接口的属性值建立所述第一网络接口，以使得所述第一VNF网元通过所述第一网络接口进行通信。
  2. 如权利要求1所述的方法，其特征在于，所述网络接口的需求信息中包括如下一项或多项：
    网络接口的类型、网络接口的名称。
  3. 如权利要求1或2所述的方法，其特征在于，所述第一连接请求还携带网络服务定义的标识；
    所述第一网络代理向所述第二网络代理发送第二连接请求之前，还包括：
    所述第一网络代理根据所述网络服务定义的标识，向配置规则控制器查询所述网络服务中所述第一VNF网元的下一跳VNF网元为所述第二VNF网元；
    其中，所述网络服务定义的标识所对应的网络服务定义中包括所述网络服务对应的转发关系信息。
  4. 如权利要求1-3任一项所述的方法，其特征在于，所述第一网络代理适配至少一种转发平面，所述第一网络代理根据所述第一网络接口的属性值建立所述第一网络接口，包括：
    所述第一网络代理根据所述第一网络接口的属性值调用所述至少一种转发平面中的第一转发平面建立所述第一网络接口。
  5. 如权利要求4所述的方法，其特征在于，所述第一VNF网元部署于第一节点，所述第二VNF网元部署于第二节点，所述方法还包括：
    所述第一网络代理调用所述转发平面建立所述第一节点上第一隧道接口，所述第一隧道接口用于连通所述第二节点。
  6. 如权利要求1-5任一项所述的方法，其特征在于，所述第一网络接口的属性值包括如下中的一项或多项：
    所述第一网络接口的名称、所述第一网络接口的类型、所述第一网络接口的IP地址。
  7. 如权利要求1-6任一项所述的方法，其特征在于，所述第一连接请求还携带所述第一VNF网元的网络命名空间标识；
    所述方法还包括：
    所述第一网络代理将所述建立的所述第一网络接口添加至所述网络命名空间标识所 对应的网络命名空间。
  8. 如权利要求1-7任一项所述的方法，其特征在于，还包括：
    所述第一网络代理接收来自配置规则控制器发送的网络服务策略，网络服务策略包括触发网络操作的条件；
    所述第一网络代理根据所述网络服务策略统计遥测数据，并根据遥测数据确定满足所述触发网络操作的条件时，向遥测策略控制器发送第一指示，所述第一指示用于指示满足触发网络操作的条件；
    所述第一网络代理接收到所述遥测策略控制器发送的用于执行所述网络操作的通知时，执行所述网络操作。
  9. 一种网络接口的建立方法，其特征在于，包括：
    第二网络代理接收来自第一网络代理的第二连接请求，所述第二连接请求用于请求建立实现所述网络服务所需的网络接口，所述第二连接请求中携带网络接口的需求信息，所述第二网络代理用于管理第二VNF网元，所述第二VNF网元为网络服务的提供方；第一网络代理用于管理第一VNF网元，所述第一VNF网元为所述网络服务的请求方，所述网络接口的需求信息用于描述实现所述网络服务所需的网络接口；
    所述第二网络代理根据所述网络接口的需求信息确定第二网络接口的属性值；
    所述第二网络代理根据所述第二网络接口的属性值建立所述第二网络接口，以使得所述第二VNF网元通过所述第二网络接口进行通信。
  10. 如权利要求9所述的方法，其特征在于，还包括：
    所述第二网络代理根据所述网络接口的需求信息确定第一网络接口的属性值，所述第一网络接口为所述第一VNF网元进行网络通信的网络接口；
    所述第二网络代理将所述第一网络接口的属性值发送给所述第一网络代理。
  11. 如权利要求9或10所述的方法，其特征在于，所述第二网络代理适配至少一种转发平面，所述第二网络代理根据所述第二网络接口的属性值建立所述第二网络接口，包括：
    所述第二网络代理根据所述第二网络接口的属性值调用所述至少一种转发平面中的第一转发平面建立所述第二网络接口。
  12. 如权利要求11所述的方法，其特征在于，所述第一VNF网元部署于第一节点，所述第二VNF网元部署于第二节点，所述第二连接请求还携带隧道的需求信息，所述隧道的需求信息用于描述在所述第一节点与所述第二节点所需建立的隧道；
    所述方法还包括：
    所述第二网络代理根据所述隧道的需求信息调用所述转发平面为所述第二节点建立第二隧道接口，所述第二隧道接口用于连通所述第一节点。
  13. 如权利要求9-12任一项所述的方法，其特征在于，还包括：
    所述第二网络代理接收所述第二VNF网元发送的服务注册信息，所述服务注册信息用于描述所述第二VNF网元提供的网络接口能力；
    所述第二网络代理将所述服务注册信息发送给配置规则控制器。
  14. 如权利要求13所述的方法，其特征在于，所述服务注册信息包括如下一项或多项：
    网络协议IP地址分配策略、IP地址段、支持的网络接口类型。
  15. 如权利要求10-14任一项所述的方法，其特征在于，第一网络接口的属性值包括 如下一项或多项：
    所述第一网络接口的名称、所述第一网络接口的类型，所述第一网络接口的IP地址。
  16. 如权利要求15所述的方法，其特征在于，所述第一网络接口的属性值包括所述第一网络接口的IP地址，所述第二网络代理根据所述网络接口的需求信息确定第一网络接口的属性值，包括：
    所述第二网络代理向所述第二VNF网元发送所述网络接口的需求信息；
    所述第二网络代理接收所述第二VNF网元发送的所述第一网络接口的IP地址。
  17. 如权利要求9-16任一项所述的方法，其特征在于，第二网络接口的属性值包括如下一项或多项：
    所述第二网络接口的名称、所述第二网络接口的类型，所述第二网络接口的IP地址。
  18. 如权利要求17所述的方法，其特征在于，所述第二网络接口的属性值包括所述第二网络接口的IP地址，所述第二网络代理根据所述网络接口的需求信息确定第二网络接口的属性值，包括：
    所述第二网络代理向所述第二VNF网元发送所述网络接口的需求信息；
    所述第二网络代理接收所述第二VNF网元发送的所述第二网络接口的IP地址。
  19. 如权利要求17或18所述的方法，其特征在于，还包括：
    所述第二网络代理为所述第二网络接口配置所述第二网络接口的IP地址。
  20. 如权利要求9-19任一项所述的方法，其特征在于，还包括：
    所述第二网络代理接收来自配置规则控制器发送的网络服务策略，网络服务策略包括触发网络操作的条件；
    所述第二网络代理根据所述网络服务策略统计遥测数据，并根据遥测数据确定满足所述触发网络操作的条件时，向遥测策略控制器发送第二指示，所述第二指示用于指示满足触发网络操作的条件；
    所述第二网络代理接收到所述遥测策略控制器发送的用于执行所述网络操作的通知时，执行所述网络操作。
  21. 一种网络接口的建立方法，其特征在于，包括：
    网络代理接收VNF网元发送的连接请求，所述网络代理用于管理所述VNF网元，所述连接请求用于请求建立N个网络平面的网络接口，所述连接请求中携带所述N个网络平面中每个网络平面的标识，N为大于1的整数；
    所述网络代理根据所述N个网络平面的标识向配置规则控制器查询所述N个网络平面中每个网络平面对应的网络接口的需求信息，所述每个网络平面对应的网络接口的需求信息用于描述采用所述每个网络平面进行网络连接所需建立的网络接口；
    所述网络代理根据N个网络平面中每个网络平面对应的网络接口的需求信息为所述第一VNF建立N个网络接口，所述N个网络接口与所述N个网络平面一一对应。
  22. 一种装置，其特征在于，包括：处理器，所述处理器与存储器耦合，所述存储器用于存储程序或指令，当所述程序或指令被所述处理器执行时，使得所述装置执行如权利要求1至21中任一项所述的方法。
  23. 一种系统，其特征在于，包括第一VNF网元、用于管理所述第一VNF网元的第一网络代理、第二VNF网元以及用于管理所述第二VNF网元的第二网络代理；
    所述第一网络代理，用于执行如权利要求1-8任一项所述的方法为所述第一VNF网元 建立第一网络接口；
    所述第一VNF网元，用于通过所述第一网络接口与所述第二VNF网元进行网络通信；
    所述第二网络代理，用于执行如权利要求9-20任一项所述的方法为所述第二VNF网元建立第二网络接口；
    所述第二VNF网元，用于通过所述第二网络接口与所述第一VNF网元进行网络通信。
  24. 一种计算机可读介质，其上存储有计算机程序或指令，其特征在于，所述计算机程序或指令被执行时使得计算机执行如权利要求1至21中任一项所述的方法。
PCT/CN2020/116855 2020-01-23 2020-09-22 一种网络接口的建立方法、装置及系统 WO2021147358A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010076990.2A CN113162785A (zh) 2020-01-23 2020-01-23 一种网络接口的建立方法、装置及系统
CN202010076990.2 2020-01-23

Publications (1)

Publication Number Publication Date
WO2021147358A1 true WO2021147358A1 (zh) 2021-07-29

Family

ID=76882118

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/116855 WO2021147358A1 (zh) 2020-01-23 2020-09-22 一种网络接口的建立方法、装置及系统

Country Status (2)

Country Link
CN (1) CN113162785A (zh)
WO (1) WO2021147358A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115379010A (zh) * 2022-08-15 2022-11-22 杭州安恒信息技术股份有限公司 一种容器网络构建方法、装置、设备及存储介质
CN116610530A (zh) * 2023-07-12 2023-08-18 北京亿赛通科技发展有限责任公司 网络数据的处理方法、装置、计算机设备及存储介质

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115883047B (zh) * 2022-12-23 2024-04-16 深圳市瑞科慧联科技有限公司 信令数据传输方法、装置、设备及介质

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104518935A (zh) * 2013-09-27 2015-04-15 华为技术有限公司 实现虚拟网络通信的方法、装置和系统
CN104601592A (zh) * 2015-01-31 2015-05-06 华为技术有限公司 一种接入云服务的方法及接入设备
US10284434B1 (en) * 2016-06-29 2019-05-07 Sprint Communications Company L.P. Virtual network function (VNF) relocation in a software defined network (SDN)

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104518935A (zh) * 2013-09-27 2015-04-15 华为技术有限公司 实现虚拟网络通信的方法、装置和系统
CN104601592A (zh) * 2015-01-31 2015-05-06 华为技术有限公司 一种接入云服务的方法及接入设备
US10284434B1 (en) * 2016-06-29 2019-05-07 Sprint Communications Company L.P. Virtual network function (VNF) relocation in a software defined network (SDN)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115379010A (zh) * 2022-08-15 2022-11-22 杭州安恒信息技术股份有限公司 一种容器网络构建方法、装置、设备及存储介质
CN115379010B (zh) * 2022-08-15 2024-04-26 杭州安恒信息技术股份有限公司 一种容器网络构建方法、装置、设备及存储介质
CN116610530A (zh) * 2023-07-12 2023-08-18 北京亿赛通科技发展有限责任公司 网络数据的处理方法、装置、计算机设备及存储介质

Also Published As

Publication number Publication date
CN113162785A (zh) 2021-07-23

Similar Documents

Publication Publication Date Title
US11689497B2 (en) Auto deploying network for virtual private cloud with heterogenous workloads
CN111066301B (zh) 用于强制执行统一全局策略的方法、系统及存储介质
US10129108B2 (en) System and methods for network management and orchestration for network slicing
US10033595B2 (en) System and method for mobile network function virtualization
WO2021147358A1 (zh) 一种网络接口的建立方法、装置及系统
KR101714279B1 (ko) 폴리시 기반 데이터센터 네트워크 자동화를 제공하는 시스템 및 방법
US9584369B2 (en) Methods of representing software defined networking-based multiple layer network topology views
US9344360B2 (en) Technique for managing an allocation of a VLAN
KR20150105421A (ko) 네트워크 장치에 대한 네트워크 기능 가상화
CN105530259A (zh) 报文过滤方法及设备
US11799972B2 (en) Session management in a forwarding plane
US20130297752A1 (en) Provisioning network segments based on tenant identity
US20230156828A1 (en) Session establishment method and apparatus, system, and computer storage medium
CN115843429A (zh) 用于网络切片中隔离支持的方法与装置
US20220350637A1 (en) Virtual machine deployment method and related apparatus
WO2017133020A1 (zh) 一种nfv系统中的策略传输方法和装置
Mazumdar et al. Towards A Data Privacy-Aware Execution Zone Creation on Cloud/Fog Platform
US11968269B1 (en) Hybrid tag based virtual private network with scalable next hop convergence
US11916775B1 (en) Multi-tenant cloud native control plane system
EP4274197A1 (en) Data communication managing component and method for performing guaranteed performance data communication
CN117425891A (zh) 用于支持基于网络的计算服务的系统和方法
CN114428620A (zh) 一种数据流镜像方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20914799

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20914799

Country of ref document: EP

Kind code of ref document: A1