WO2021196952A1 - 报文处理方法、设备、系统及存储介质 - Google Patents

报文处理方法、设备、系统及存储介质 Download PDF

Info

Publication number
WO2021196952A1
WO2021196952A1 PCT/CN2021/078660 CN2021078660W WO2021196952A1 WO 2021196952 A1 WO2021196952 A1 WO 2021196952A1 CN 2021078660 W CN2021078660 W CN 2021078660W WO 2021196952 A1 WO2021196952 A1 WO 2021196952A1
Authority
WO
WIPO (PCT)
Prior art keywords
epg information
ipv6
header
network device
destination
Prior art date
Application number
PCT/CN2021/078660
Other languages
English (en)
French (fr)
Inventor
刘冰
彭书萍
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP21780245.3A priority Critical patent/EP4109830A4/en
Publication of WO2021196952A1 publication Critical patent/WO2021196952A1/zh
Priority to US17/936,593 priority patent/US20230043721A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/26—Route discovery packet
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4633—Interconnection of networks using encapsulation techniques, e.g. tunneling
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4641—Virtual LANs, VLANs, e.g. virtual private networks [VPN]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/50—Routing or path finding of packets in data switching networks using label swapping, e.g. multi-protocol label switch [MPLS]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/74—Address processing for routing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00—Traffic control in data switching networks
    • H04L47/10—Flow control; Congestion control
    • H04L47/20—Traffic policing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0272—Virtual private networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/104—Grouping of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/30—Definitions, standards or architectural aspects of layered protocol stacks
    • H04L69/32—Architecture of open systems interconnection [OSI] 7-layer type protocol stacks, e.g. the interfaces between the data link level and the physical level
    • H04L69/322—Intralayer communication protocols among peer entities or protocol data unit [PDU] definitions
    • H04L69/324—Intralayer communication protocols among peer entities or protocol data unit [PDU] definitions in the data link layer [OSI layer 2], e.g. HDLC

Definitions

  • This application relates to the field of communication technology, and in particular to a message processing method, device, system, and storage medium.
  • Micro-segmentation is a network isolation technology based on refined grouping.
  • the micro-segmentation technology can group the devices in the network according to the grouping rules that are more granular than the Virtual Local Area Network (VLAN), define group policies for each group, and implement group policies to achieve traffic isolation, thereby ensuring business security .
  • VLAN Virtual Local Area Network
  • an EPG In the field of micro-segmentation, the group is called an Endpoint Group (EPG).
  • An EPG can include multiple members such as servers and terminals, and the members included in the EPG are called Endpoints.
  • the source VTEP In the process of implementing micro-segmentation, when the original message sent by the source Endpoint device reaches the source Virtual Tunnel Endpoint (VTEP) device, the source VTEP will be in the Virtual Extensible Local Area Network (VXLAN) header. It carries the EPG information of the source Endpoint device, and encapsulates the VXLAN header in the original message to obtain the VXLAN message. The source VTEP will send VXLAN packets to the destination VTEP.
  • VXLAN Virtual Extensible Local Area Network
  • the destination VTEP device After the destination VTEP device receives the VXLAN packet, it will decapsulate the VXLAN header to obtain the EPG information of the source Endpoint device. The destination VTEP will execute the group policy based on the EPG information of the source Endpoint device and the EPG information of the destination end.
  • the embodiments of the present application provide a message processing method, device, system, and storage medium, which can reduce the overhead of transmitting messages.
  • the technical solution is as follows.
  • a message processing method is provided, which is applied to an IPv6 Internet Protocol version 6 network.
  • a first network device in the IPv6 network receives an original message; the first network device is based on The original message and the endpoint group EPG information are generated to generate an IPv6 message, the IPv6 message includes an IPv6 extension header and the original message, and the IPv6 extension header includes the EPG information; sent by the first network device The IPv6 message.
  • the above provides a method for implementing micro-segmentation in an IPv6 network.
  • the EPG information is made visible to the receiving end of the IPv6 packet, so that the receiving end of the IPv6 packet does not need to be resolved.
  • the group policy can be executed according to the EPG information in the IPv6 extension header, thereby realizing the function of micro-segmentation and reducing processing complexity.
  • the IPv6 extension header has stronger scalability, it solves the problem of weak scalability in carrying EPG information through the VXLAN header, which helps to continue to expand new functions.
  • the encapsulation format of the message is more concise and the header occupies fewer bytes, the overhead caused by the transmission of the message is saved.
  • the EPG information includes first EPG information.
  • the first EPG information is used to identify the EPG to which the first computing device belongs, and the source Internet Protocol IP address of the original message includes the IP address of the first computing device.
  • the EPG information of the source Endpoint device is forwarded in the IPv6 network along with the IPv6 packet.
  • the execution node of the group policy can obtain the EPG information of the source Endpoint device from the IPv6 extension header, thus eliminating the need to configure the EPG information of the source Endpoint device on the execution node of the group policy in advance. Therefore, the configuration complexity of the execution node of the group policy is reduced, and it is helpful to improve the efficiency of deploying micro-segmentation in the IPv6 network.
  • the EPG information includes second EPG information.
  • the second EPG information is used to identify the EPG to which the second computing device belongs, and the destination IP address of the original message includes the IP address of the second computing device.
  • the group policy execution node can obtain the EPG information of the destination Endpoint device from the IPv6 extension header during the process of forwarding IPv6 packets, thus eliminating The workload brought by the EPG information of the destination Endpoint device is configured in advance on the execution node of the group policy, thereby reducing the configuration complexity of the execution node of the group policy, and helping to improve the efficiency of deploying micro-segmentation in the IPv6 network.
  • the EPG information includes first EPG information and second EPG information.
  • the group policy enforcement node can obtain the source Endpoint device's information from the IPv6 extension header during the process of forwarding IPv6 packets.
  • EPG information and EPG information of the destination Endpoint device thus eliminating the need to configure the EPG information of the source Endpoint device and the destination Endpoint device on the execution node of the group policy in advance, thereby reducing the complexity of configuring the execution node of the group policy It helps to improve the efficiency of deploying micro-segmentation in IPv6 networks.
  • the IPv6 message includes a hop-by-hop option header, and the hop-by-hop option header includes the EPG information.
  • the hop-by-hop option header includes first EPG information.
  • the hop-by-hop option header includes second EPG information.
  • the hop-by-hop option header includes first EPG information and second EPG information.
  • the intermediate node can obtain the source Endpoint from the hop-by-hop option header when an IPv6 packet passes through the intermediate node during the forwarding process
  • the EPG information of the device and/or the EPG information of the destination Endpoint device in other words, the EPG information of the source Endpoint device and/or the EPG information of the destination Endpoint device are visible to the intermediate node.
  • the intermediate node can use the EPG information of the source Endpoint device and/or the EPG information of the destination Endpoint device to execute the group policy, so that non-VTEP devices such as the intermediate node can also be used as the execution node of the group policy.
  • VTEP equipment can only support micro-segmentation, and expands the function of supporting micro-segmentation for intermediate nodes, so that micro-segmentation is suitable for more application scenarios.
  • group policies by intermediate nodes unnecessary forwarding can be avoided. For example, when the processing action in the group policy is discard, the message will be discarded by the intermediate node, and network resources will no longer be forwarded to the destination VTEP.
  • the encapsulation format of the hop-by-hop option header is more concise, and the hop-by-hop option header occupies fewer bytes, so the transmission overhead of the message can be reduced. and.
  • the hop-by-hop option header is more extensible, and you can continue to support other features by expanding new options in the hop-by-hop option header.
  • this method can be widely applied to network devices that support IPv6 without requiring intermediate nodes to support SRv6-TE. Therefore, this method is more universal.
  • the workload of pre-configuring the EPG information of the source Endpoint device and the destination Endpoint device on the intermediate node is eliminated, the configuration complexity of the intermediate node is reduced.
  • the IPv6 extension header includes a destination option header, and the destination option header includes the EPG information.
  • the destination option header includes first EPG information.
  • the destination option header includes second EPG information.
  • the destination option header includes first EPG information and second EPG information.
  • the destination option header is an IPv6 extension header for the destination node to parse
  • the destination option header by using the destination option header to carry EPG information, it is possible to specify that the destination node executes the group policy.
  • the encapsulation format of the destination option header is more concise, and the destination option header occupies fewer bytes, so the transmission overhead of the message can be reduced. and.
  • the destination option header is more extensible and can continue to support other features by extending new options in the destination option header.
  • this method can be widely applied to network devices that support IPv6 without requiring intermediate nodes to support SRv6-TE. Therefore, this method is universal.
  • the workload of pre-configuring the EPG information of the source Endpoint device on the destination node is eliminated, the configuration complexity of the destination node is reduced.
  • the IPv6 extension header includes a hop-by-hop option header and a destination option header, and the hop-by-hop option header and the destination option header include the EPG information.
  • the intermediate node can obtain the EPG information of the source Endpoint device and the EPG information of the destination Endpoint device through the hop-by-hop option header. Therefore, the intermediate node can obtain the EPG information of the source Endpoint device and The EPG information of the destination Endpoint device executes the group policy.
  • the destination VTEP can obtain the EPG information of the source Endpoint device through the destination option header, so the destination VTEP can also execute group policies based on the EPG information of the source Endpoint device.
  • the same IPv6 packet can be executed by the intermediate node and the destination node in sequence.
  • the group policy executed by the intermediate node and the group policy executed by the destination node are the same or different.
  • the IPv6 extension header includes a type length value TLV, and the EPG information is located in a value field of the TLV.
  • network devices can obtain EPG information from the new TLV, which is helpful because it eliminates the workload of configuring the correspondence between IP addresses and EPG information To reduce the configuration complexity of network equipment.
  • the IPv6 extension header includes one or more options
  • the EPG information includes first EPG information and second EPG information; the first EPG information and the second EPG information are located in the IPv6 extension header Or, the first EPG information and the second EPG information are respectively located in different options of the IPv6 extension header.
  • the network device can obtain the EPG information from the new option, thereby helping to reduce the configuration complexity of the network device.
  • the IPv6 message includes an IPv6 header located in an outer layer of the original message, and the destination IP address of the IPv6 header includes a virtual private network segment identifier VPN SID.
  • the SRv6-BE technology is used to distinguish the traffic of different tenants through different VPN SIDs, thereby realizing tenant isolation.
  • the IPv6 message includes an identification field, and the identification field is used to indicate whether the IPv6 message has been processed according to the group policy corresponding to the EPG information.
  • the upstream node can use the identification field to identify that the group policy has been executed, so that the downstream node does not have to re-execute Group policy, in a scenario where the same group policy only needs to be executed once along the way, it can meet the needs of this scenario and save the processing overhead of nodes after the execution node of the group policy.
  • the EPG information is not in the IPv6 routing header, and the IPv6 routing header includes a segment routing header SRH.
  • the receiving device of the IPv6 packet does not need to support a special routing function (such as SR) to obtain EPG information from the IPv6 packet, thus reducing the functional requirements of the receiving device.
  • SR special routing function
  • a message processing method is provided, which is applied to an IPv6 Internet Protocol version 6 network.
  • a second network device in the IPv6 network receives an IPv6 message, and the IPv6 message includes IPv6 Extension header and original message, the IPv6 extension header includes endpoint group EPG information; the second network device obtains the EPG information from the IPv6 extension header; the second network device corresponds to the EPG information The group policy for processing the IPv6 message.
  • the EPG information includes at least one of the first EPG information and the second EPG information
  • the first EPG information is used to identify the EPG to which the first computing device belongs
  • the source Internet protocol of the original message The IP address includes the IP address of the first computing device
  • the second EPG information is used to identify the EPG to which the second computing device belongs
  • the destination IP address of the original message includes the IP address of the second computing device.
  • the IPv6 extension header includes at least one of a hop-by-hop option header and a destination option header, and at least one of the hop-by-hop option header and the destination option header includes the EPG information.
  • the method further includes: the second network device obtains the group policy according to the EPG information.
  • the IPv6 extension header includes a type length value TLV, and the EPG information is located in a value field of the TLV.
  • the IPv6 extension header includes one or more options
  • the EPG information includes first EPG information and second EPG information; the first EPG information and the second EPG information are located in the IPv6 extension header Or, the first EPG information and the second EPG information are respectively located in different options of the IPv6 extension header.
  • the IPv6 message includes an IPv6 header located in an outer layer of the original message, and the destination IP address of the IPv6 header includes a virtual private network segment identifier VPN SID.
  • the IPv6 message includes an identification field, and the identification field is used to indicate whether the IPv6 message has been processed according to the group policy corresponding to the EPG information, and the second network device according to the EPG information According to the corresponding group policy, before processing the IPv6 message, the method further includes: the second network device determines, according to the value of the identification field, that the IPv6 message has not been processed according to the group policy.
  • the second network device processing the IPv6 packet according to the group policy corresponding to the EPG information includes: the second network device updating the value of the identification field.
  • the EPG information is not in the IPv6 routing header, and the IPv6 routing header includes a segment routing header SRH.
  • a first network device in a third aspect, is provided, and the first network device has a function of realizing packet processing in the first aspect or any one of the optional methods of the first aspect.
  • the first network device includes at least one module, and the at least one module is configured to implement the packet processing method provided in the foregoing first aspect or any one of the optional manners of the first aspect.
  • a second network device in a fourth aspect, has a function of realizing packet processing in the second aspect or any one of the optional manners in the second aspect.
  • the second network device includes at least one module, and the at least one module is configured to implement the packet processing method provided in the foregoing second aspect or any one of the optional manners of the second aspect.
  • a first network device in a fifth aspect, includes a processor and a communication interface.
  • the processor is configured to execute instructions so that the first network device executes the first aspect or any one of the first aspects.
  • the communication interface is used to receive messages and send messages.
  • a second network device in a sixth aspect, includes a processor and a communication interface, and the processor is configured to execute instructions so that the second network device executes the second aspect or any one of the options of the second aspect.
  • the communication interface is used to receive messages.
  • a computer-readable storage medium stores at least one instruction.
  • the instruction is read by a processor to enable a first network device to execute the first aspect or any one of the first aspects. Select the message processing method provided by the method.
  • a computer-readable storage medium stores at least one instruction, and the instruction is read by a processor to enable a second network device to execute the second aspect or any one of the second aspects described above. Select the message processing method provided by the method.
  • a computer program product is provided.
  • the computer program product runs on a first network device
  • the first network device executes the report provided in the first aspect or any one of the optional methods of the first aspect. Text processing method.
  • a computer program product is provided.
  • the second network device executes the report provided in the second aspect or any one of the optional methods of the second aspect. Text processing method.
  • a chip is provided.
  • the first network device executes the packet processing method provided in the first aspect or any one of the optional methods of the first aspect. .
  • a chip is provided, when the chip runs on a second network device, the second network device executes the message processing method provided in the second aspect or any one of the optional methods of the second aspect. .
  • a network system in a thirteenth aspect, includes a first network device and a second network device.
  • the second network device is configured to execute the method described in the second aspect or any one of the optional manners of the second aspect.
  • a first network device in a fourteenth aspect, includes a central processing unit, a network processing unit, and a physical interface.
  • the physical interface is used to receive original messages.
  • the central processor is configured to generate an IPv6 message according to the original message and the endpoint group EPG information; the network processor is configured to trigger a physical interface to send the IPv6 message.
  • the first network device includes a main control board and an interface board
  • the central processing unit is arranged on the main control board
  • the network processor and the physical interface are arranged on the interface board
  • the The main control board is coupled with the interface board.
  • an inter-process communication protocol (IPC) channel is established between the main control board and the interface board, and the main control board and the interface board communicate through the IPC channel.
  • IPC inter-process communication protocol
  • a second network device in a fifteenth aspect, includes a central processing unit, a network processing unit, and a physical interface.
  • the physical interface is used to receive IPv6 packets.
  • the central processing unit is configured to obtain the EPG information from the IPv6 extension header.
  • the IPv6 packet is processed according to the group policy corresponding to the EPG information.
  • the first network device includes a main control board and an interface board
  • the central processing unit is arranged on the main control board
  • the network processor and the physical interface are arranged on the interface board
  • the The main control board is coupled with the interface board.
  • an inter-process communication protocol (IPC) channel is established between the main control board and the interface board, and the main control board and the interface board communicate through the IPC channel.
  • IPC inter-process communication protocol
  • FIG. 1 is a schematic diagram of the format of a VXLAN header provided by an embodiment of the present application
  • FIG. 2 is a schematic diagram of the format of a VXLAN-GPE header provided by an embodiment of the present application
  • FIG. 3 is a schematic diagram of the format of a GENEVE header provided by an embodiment of the present application.
  • FIG. 4 is a schematic diagram of a system architecture 100 provided by an embodiment of the present application.
  • FIG. 5 is a schematic diagram of a system architecture 100 provided by an embodiment of the present application.
  • FIG. 6 is a flowchart of a message processing method 200 provided by an embodiment of the present application.
  • FIG. 7 is a schematic diagram of the format of an IPv6 packet provided by an embodiment of the present application.
  • FIG. 8 is a schematic diagram of the format of an IPv6 header provided by an embodiment of the present application.
  • FIG. 9 is a schematic diagram of the format of a hop-by-hop option header or destination option header provided by an embodiment of the present application.
  • FIG. 10 is a schematic diagram of the format of an SRH provided by an embodiment of the present application.
  • FIG. 11 is a schematic diagram of the format of an IPv6 extension header carrying EPG information provided by an embodiment of the present application.
  • FIG. 12 is a schematic diagram of the format of a hop-by-hop option header carrying EPG information provided by an embodiment of the present application.
  • FIG. 13 is a schematic diagram of the format of a destination option header carrying EPG information provided by an embodiment of the present application.
  • FIG. 14 is a schematic diagram of the format of a group policy TLV provided by an embodiment of the present application.
  • FIG. 15 is a schematic diagram of the format of a group policy TLV provided by an embodiment of the present application.
  • FIG. 16 is a schematic diagram of the format of a group policy option provided by an embodiment of the present application.
  • FIG. 17 is a schematic diagram of the format of an IPv6 message carrying EPG information and VPN SID provided by an embodiment of the present application;
  • FIG. 18 is a schematic diagram of a header overhead for encapsulating EPG information according to an embodiment of the present application.
  • FIG. 19 is a schematic diagram of a header overhead for encapsulating EPG information according to an embodiment of the present application.
  • FIG. 20 is a schematic diagram of a scenario for implementing micro-segmentation provided by an embodiment of the present application.
  • FIG. 21 is a schematic diagram of a scenario for implementing micro-segmentation provided by an embodiment of the present application.
  • FIG. 22 is a flowchart of a message processing method 300 provided by an embodiment of the present application.
  • FIG. 23 is a schematic diagram of a scenario for implementing micro-segmentation provided by an embodiment of the present application.
  • FIG. 24 is a flowchart of a message processing method 400 provided by an embodiment of the present application.
  • FIG. 25 is a schematic structural diagram of a network device 500 provided by an embodiment of the present application.
  • FIG. 26 is a schematic structural diagram of a network device 600 provided by an embodiment of the present application.
  • FIG. 27 is a schematic structural diagram of a network device 700 provided by an embodiment of the present application.
  • FIG. 28 is a schematic structural diagram of a network device 800 provided by an embodiment of the present application.
  • FIG. 29 is a schematic structural diagram of a network system 900 provided by an embodiment of the present application.
  • first, second and other words are used to distinguish the same or similar items that have basically the same function and function. It should be understood that between “first”, “second” and “nth” There are no logic or timing dependencies, and no restrictions on the number and execution order. It should also be understood that although the following description uses the terms first, second, etc. to describe various elements, these elements should not be limited by the terms. These terms are only used to distinguish one element from another.
  • the first EPG information may be referred to as second EPG information
  • the second EPG information may be referred to as first EPG information. Both the first EPG information and the second EPG information may be EPG information, and in some cases, may be separate and different EPG information.
  • the message processing method provided in the embodiments of the present application can be applied to data center networks, campus networks, and various other networks where micro-segmentation technology is required to ensure network boundary security, which is helpful for achieving security management and control and simplifying operation and maintenance.
  • micro-segmentation technology is required to ensure network boundary security, which is helpful for achieving security management and control and simplifying operation and maintenance.
  • the following is a brief introduction to the micro-segmentation technology.
  • the traditional network security model is the border security model.
  • the main threat of the network comes from the outside, and only a firewall is deployed at the border of the network.
  • the security monitoring of internal network traffic needs to divert the traffic to the border firewall.
  • Both north-south traffic and east-west traffic need to undergo security analysis, and firewalls or isolation strategies need to be deployed in a distributed manner.
  • This security model is a zero-trust security model. Among them, the north-south traffic refers to the traffic flowing into the data center or the traffic flowing out of the data center. East-west traffic refers to the traffic inside the data center.
  • micro-segmentation technology can now be used to analyze east-west traffic to achieve the purpose of safety isolation and protection.
  • Micro-segmentation can be literally divided into two parts: “Micro” and “segmentation”.
  • Segmentation refers to grouping devices in the network such as servers and terminals, and then defining group policies based on the group, and implementing group policies for packets transmitted between different groups or packets transmitted between different members of the same group.
  • micro means that the granularity of the packet is finer than the granularity of the subnet. Specifically, when dividing subnets, it is usually only based on virtual local area network (Virtual Local Area Network, VLAN) or VXLAN identification (Virtual Network ID, VNI) to achieve subnet division, and devices belonging to different VLANs/VNIs are isolated from each other.
  • VLAN Virtual Local Area Network
  • VNI Virtual Network ID
  • Micro-segmentation can be grouped based on Internet Protocol (IP) addresses, IP network segments, Media Access Control (MAC) addresses, virtual machine (VM) names, containers, operating systems, etc. Obviously The granularity of grouping is much finer than that of subnets. Different devices belonging to the same VLAN can also be isolated from each other through micro-segmentation, thus achieving finer-grained and more flexible traffic isolation, achieving security management and control, and simplifying operation and maintenance. Ensure business security. Of course, the granularity of micro-segmentation may not be finer than the granularity of VLAN. The description here is only an example.
  • micro-segmentation technology has been introduced above, and the terminology concepts in the micro-segmentation technology involved in the embodiments of the present application will be introduced below.
  • Endpoint Group is also called micro-segmentation.
  • EPG is based on (Internet Protocol, IP) address, IP network segment, Media Access Control (MAC) address, virtual machine (VM) name Grouping methods such as, container, operating system, etc., to group Endpoint devices.
  • An EPG includes multiple Endpoint devices. Different Endpoint devices in the same EPG have the same characteristics (such as IP network segment, VM name prefix, container name prefix, etc.).
  • the Endpoint device can be implemented by any computer, such as a device with computing processing capabilities. Different Endpoint devices in the same EPG can be referred to as members of the EPG group. Endpoint devices belonging to different EPGs can be referred to as inter-group members of the EPG.
  • the EPG information is used to identify the EPG to which the Endpoint device belongs.
  • the EPG information can include multiple data forms, which are illustrated below through Case 1 to Case 3.
  • Case 1 The EPG ID is used to identify the EPG to which the Endpoint device belongs.
  • the EPG information includes the ID of the EPG, and the EPG information is also called Group ID or group ID.
  • Endpoint devices are VM1 and VM2.
  • the EPG to which VM1 belongs is EPG1
  • the EPG to which VM2 belongs is EPG2.
  • the EPG information of VM1 includes "1”
  • the EPG information of VM2 both includes "2".
  • Case 2 Use the IP address prefix to identify the EPG to which the Endpoint device belongs.
  • the IP address prefix of each Endpoint device in the same EPG is the same, and the EPG information includes the IP address prefix of the Endpoint device.
  • Endpoint devices are grouped based on IP network segments, and VM5 and VM6 whose IP address prefixes are both A1::3:1/80 are divided into the same EPG, and the EPG information of VM5 and VM6 includes A1::3: 1/80.
  • Case 3 Use the interface name to identify the EPG to which the Endpoint device belongs.
  • the EPG information includes the interface name of the interface connecting the VTEP device and the Endpoint device, and the interface includes but is not limited to a virtual interface or a physical interface.
  • the name of the virtual interface is vInf103-1
  • the EPG information of both VM7 and VM8 includes vInf103-1.
  • Group Based Policy is an EPG-based flow control policy.
  • Group policy is used to instruct the processing actions performed on packets transmitted between members of the EPG group or between group members. By executing the group policy, it can The group members of the EPG and the group members of the EPG perform access control.
  • group policies include allow (also known as permit or allow), deny (also known as Deny), marking, redirection, and mirroring.
  • allow also known as permit or allow
  • deny also known as Deny
  • marking redirection
  • mirroring When the group policy is allowed, the processing action performed by the network device on the packet is forwarding, thereby allowing the intercommunication between the members of the EPG group or between the group members.
  • group policy When the group policy is deny, the processing action performed by the network device on the packet is deny, thereby prohibiting the intercommunication between the members of the EPG group or between the group members.
  • redirection the processing action performed by the network device on the packet is to redirect the packet to the firewall. Marking is a special type of forwarding.
  • the processing action performed by the network device on the message is to first mark the message, and then forward the marked message.
  • the marking includes, but is not limited to, remarking the differentiated services code point (DSCP) of the message or modifying the priority of the message.
  • DSCP differentiated services code point
  • Group policies are usually associated with matching conditions, and the correspondence between group policies and matching conditions is usually saved through a policy matrix.
  • Table 1 The strategy matrix shown in Table 1 includes four group strategies. Among them, * means wildcard.
  • Matching conditions are also called matching rules or rules.
  • the network device will execute the group policy corresponding to the EPG information.
  • the EPG information in the matching condition is the EPG information of the source Endpoint device or the EPG information of the destination Endpoint device includes a variety of situations. Case 1 to Case 3 are used as examples below.
  • the matching condition includes the EPG information of the source Endpoint device and the EPG information of the destination Endpoint device.
  • the first matching condition includes EPG1 and EPG2.
  • EPG1 is an example of the EPG information of the source Endpoint device
  • EPG2 is an example of the EPG information of the destination Endpoint device. illustrate.
  • EPG information of the source Endpoint device in the packet is EPG1 and the EPG information of the destination Endpoint device is EPG2
  • the packet matches the first matching condition, and the network device discards the packet according to the Deny group policy.
  • the matching condition includes the EPG information of the source Endpoint device and does not include the EPG information of the destination Endpoint device.
  • the third matching condition includes EPG3 and *.
  • EPG3 is an example of the EPG information of the source Endpoint device.
  • This matching condition represents the report sent from EPG3 to all other EPGs. All texts should be allowed.
  • the network device will forward the message according to the Allow group policy. In this way, it is not limited which EPG the destination Endpoint of the message belongs to, nor is it limited whether the message carries the EPG information of the destination Endpoint.
  • the matching condition includes the EPG information of the destination Endpoint device and does not include the EPG information of the source Endpoint device.
  • the fifth matching condition includes * and EPG6.
  • EPG6 is an example of the EPG information of the destination Endpoint device. This matching condition indicates that all packets sent to EPG6 should be allowed.
  • the network device will forward the message according to the Allow group policy. In this way, it is not limited to which EPG the source Endpoint of the message belongs to, nor is it limited whether the message carries the EPG information of the source Endpoint.
  • the group policy may include multiple data forms.
  • the allow, Deny, etc. shown in Table 1 are only examples of the data form of the group policy.
  • the group policy may also be expressed in other data forms.
  • group policies are represented by the number of processing actions. For example, the number 1 is assigned to the processing action of forwarding and the number 2 is assigned to the processing action of discarding.
  • the group policy can be in the form of data 1 and 2.
  • the group policy is 1, the packet is forwarded when the group policy is executed.
  • the group policy is 2
  • the packet is discarded when the group policy is executed.
  • the group policy is represented by instructions corresponding to the processing action, for example, the group policy is represented by pseudo code.
  • the group policy is remark dscp 40
  • remark dscp 40 is the instruction corresponding to the mark. This instruction instructs to modify the DSCP of the message to 40, and the network device executes the group policy to mark the message.
  • the matching condition does not limit the matching condition to only include EPG information.
  • the matching condition includes information other than the EPG information.
  • the network device not only determines which group policy to execute based on the EPG information of the message, but also other information related to the message.
  • the matching condition also includes the transmission direction of the message, and the transmission direction of the message includes inflow (in) and outflow (out).
  • the matching condition includes in, the network device will execute the group policy on the received packet.
  • the matching condition includes out, the network device will execute the group policy for the message to be sent.
  • micro-segmentation technology and some terminology concepts in the micro-segmentation technology are introduced above, and the forwarding scenario of the micro-segmentation is introduced below.
  • Endpoint devices are connected to VTEP devices (such as access switches).
  • VTEP devices such as access switches
  • the group policy and matching conditions are configured on the VTEP device, and the EPG information of the Endpoint device is also configured on the VTEP device.
  • the EPG information of all Endpoint devices in the network is usually not configured on each VTEP device, but the EPG information of the Endpoint device is configured on the VTEP device that the Endpoint device accesses. superior.
  • the EPG information of the Endpoint device is configured on which VTEP device, so that the VTEP device pre-stores the EPG information of each Endpoint device connected to it.
  • Scenario 1 Different Endpoint devices under the same VTEP device can access each other.
  • Scenario One is also called the local forwarding scenario.
  • the source Endpoint device and the destination Endpoint device of the original message are connected to the same VTEP device, and the VTEP device serves as the execution node of the group policy.
  • the forwarding path of the original message includes the source Endpoint device ⁇ VTEP device ⁇ destination Endpoint device. Since the VTEP device is connected to both the source Endpoint device and the destination Endpoint device, the EPG information of the source Endpoint device and the EPG information of the destination Endpoint device are both stored on the VTEP device. The VTEP device can use the EPG of the source Endpoint device. The information and EPG information of the destination Endpoint device executes the group policy.
  • Scenario 2 Endpoint devices under different VTEP devices access each other.
  • Scenario 2 is also called a cross-EPG forwarding scenario.
  • the source Endpoint device and the destination Endpoint device of the original message are respectively connected to different VTEP devices, and the VTEP device accessed by the destination Endpoint device is usually used as the execution node of the group policy.
  • the forwarding path of the original packet includes the source Endpoint device ⁇ source VTEP device ⁇ One or more intermediate nodes ⁇ destination VTEP device ⁇ destination Endpoint device. Since the EPG information of the source Endpoint device is stored on the source VTEP device, but not on the destination VTEP device, the source VTEP device needs to transmit the EPG information of the source Endpoint device to the destination VTEP device in some way so that the destination VTEP device can use it The EPG information of the source Endpoint device executes the group policy.
  • micro-segmentation The two forwarding scenarios of micro-segmentation are introduced above. Since some embodiments of the present application focus on describing how to implement micro-segmentation in scenario 2, in order to facilitate understanding, the specific application of micro-segmentation in scenario 2 is introduced below.
  • the EPG information is carried by the VXLAN header in the Virtual Extensible Local Area Network (VXLAN) message.
  • VXLAN Virtual Extensible Local Area Network
  • FIG. 1 shows a VXLAN header carrying a group policy ID (group policy ID, corresponding to EPG information).
  • group policy ID group policy ID
  • the third and fourth bytes in the VXLAN message are used to carry the group policy ID, and the first bit is set as the flag G (G flag), when G flag is set to 1, it indicates that there is a group policy ID.
  • the source VTEP device When the traffic from the source Endpoint device reaches the source VTEP device, if the source VTEP device judges that the destination Endpoint device is not directly connected to the source VTEP device according to the routing table, the source VTEP device VXLAN encapsulates the packet and sends the VXLAN packet to The destination VTEP device where the destination Endpoint device is located.
  • the source VTEP device performs overlay (overlay) encapsulation, it needs to encapsulate the EPG information of the source Endpoint device in a group policy ID according to local configuration, and set G flag to 1.
  • the destination VTEP device decapsulates the VXLAN and caches the EPG information of the source Endpoint device in the group policy ID.
  • the EPG to which the destination Endpoint device belongs is determined according to the destination address of the inner layer packet.
  • the destination VTEP device determines the group policy to be executed according to the EPG to which the source Endpoint device belongs and the EPG to which the destination Endpoint device belongs.
  • the two roles of the policy execution node and the VTEP device are coupled. Specifically, the EPG information of the source Endpoint device is carried in an overlay header and is passed to the destination VTEP device. Because the intermediate node does not decapsulate the Overlay header, the EPG information of the source Endpoint device is not visible to the intermediate node, so the intermediate node It is difficult for the node to execute the group policy based on the EPG information of the source Endpoint device.
  • the scalability is weak. Because the length of the VXLAN header is fixed and the number of reserved fields is limited, after the EPG information is carried through the VXLAN header, other features cannot be extended based on the Overlay header.
  • an extension header based on an Overlay header such as VXLAN Generic Protocol Encapsulation (VXLAN-GPE) and Generic Network Virtualization Encapsulation (GENEVE) carries EPG information.
  • VXLAN-GPE VXLAN Generic Protocol Encapsulation
  • GENEVE Generic Network Virtualization Encapsulation
  • Figure 2 shows a VXLAN-GPE header and an extension header carrying EPG information
  • Figure 3 shows a GENEVE header and an extension header carrying EPG information.
  • the length field in Figure 3 is the length field.
  • the version number field is the version field.
  • the option length field is the Opt Len field.
  • extension headers are defined in VXLAN-GPE and GENEVE, which can be used to carry EPG information.
  • the next protocol Next protocol, corresponding to VXLAN-GPE
  • protocol type Protocol
  • GENEVE basic header Type corresponding to GENEVE
  • the source VTEP device When the traffic from the source Endpoint device reaches the source VTEP device, if the source VTEP device judges that the destination Endpoint device is not directly connected to the source VTEP device according to the routing table, the source VTEP device does not have the EPG information of the destination Endpoint device locally, and the source VTEP device needs to Overlay encapsulation (VXLAN-GPE or GENEVE encapsulation) is performed on the message and sent to the destination VTEP device where the destination Endpoint device is located.
  • VXLAN-GPE or GENEVE encapsulation VXLAN-GPE or GENEVE encapsulation
  • the source VTEP device performs Overlay encapsulation, it needs to encapsulate the EPG information of the source Endpoint device in the group policy ID of the extension header according to the local configuration, and set the Next Protocol/Protocol Type field in the basic header.
  • the destination VTEP device When the VXLAN packet reaches the destination VTEP device, the destination VTEP device decapsulates the Overlay, and caches the EPG information of the source Endpoint device in the Group Policy ID in the extended header, and at the same time determines the EPG to which the destination Endpoint device belongs based on the destination address of the inner layer packet .
  • the destination VTEP device determines the group policy to be executed according to the EPG to which the source Endpoint device belongs and the EPG to which the destination Endpoint device belongs.
  • the EPG information of the source Endpoint device and the EPG information of the destination Endpoint device can be carried in the header at the same time.
  • Two group policy extension headers are used in VXLAN-GPE, and 1 bit is used to distinguish the EPG information of the source Endpoint device and the EPG information of the destination Endpoint device.
  • GENEVE two type length values (type length values, TLV) are used, and different types (Type) are used to distinguish the EPG information of the source Endpoint device and the EPG information of the destination Endpoint device.
  • the group policy can be performed at a centralized gateway/firewall.
  • the Overlay tunnel needs to be divided into two sections.
  • the first section is from the source VTEP device to the centralized gateway/firewall, and the second section is from the centralized gateway/firewall.
  • the gateway also assumes the role of VTEP equipment.
  • the source VTEP device is responsible for finding and encapsulating the EPG information of the source Endpoint device and the EPG information of the destination Endpoint device of the inner packet
  • the centralized gateway/firewall is responsible for executing group policies based on the EPG information.
  • the two roles of the policy execution node and the VTEP device are coupled.
  • the EPG information of the source Endpoint device and the EPG information of the destination Endpoint device are both carried in the Overlay header and then transferred to the destination VTEP.
  • the intermediate node must decapsulate to see the EPG information of the source Endpoint device. Due to the extra action of decapsulating the VXLAN header , Resulting in complex processing of intermediate nodes.
  • the encapsulation is not concise enough: after adding the extended header, the header overhead is greater.
  • a method of using IPv6 to carry EPG information is provided.
  • no more Use Overlay headers such as VXLAN, VXLAN-GPE, or GENEVE to make packet encapsulation more concise.
  • the EPG information of the source Endpoint device and the EPG information of the destination Endpoint device are visible to the intermediate node, so that the group policy can be executed at the intermediate node. Therefore, the role of the policy execution node is decoupled from the role of the destination VTEP device, so the group policy The deployment is more flexible.
  • an embodiment of the present application provides a system architecture 100.
  • the system architecture 100 is an example of a networking topology that implements micro-segmentation based on IPv6.
  • the system architecture 100 includes multiple network devices and multiple computing devices.
  • the network device corresponds to a VTEP device or an intermediate node between different VTEP devices.
  • the network device is, for example, the network device 101, the network device 102, the network device 103, or the network device 104.
  • the network device 101 and the network device 103 are configured as VTEP devices.
  • the network device 102 and the network device 103 are configured as intermediate nodes on the forwarding path of the message.
  • the computing device corresponds to the Endpoint device in the micro-segmentation technology.
  • Computing devices include, but are not limited to, mainframes, servers, or personal computers.
  • the computing device can be a physical device, or a virtualized device such as a VM and a container.
  • the computing device is VM1, VM2, VM3, VM4, VM5, VM6, VM7, or VM8.
  • the network equipment of the system architecture 100 supports IPv6.
  • the computing device of the system architecture 100 may or may not support IPv6.
  • the network device 101, the network device 102, the network device 103, or the network device 104 belong to the same IPv6 network, and the network device 101, the network device 102, the network device 103, or the network device 104 supports the IPv6 routing and forwarding function.
  • VM1, VM2, VM3, VM4, VM5, VM6, VM7, or VM8 may support IPv6, or may not support IPv6 but support IPv4.
  • the network device 101 is connected to VM1, VM2, VM3, and VM4, and the EPG information of the four VMs VM1, VM2, VM3, and VM4 is stored on the network device 101.
  • VM1 and VM2 belong to the same EPG: EPG1.
  • the EPG information of VM1 is used to identify EPG1
  • the EPG information of VM2 is used to identify EPG1.
  • VM3 and VM4 belong to the same EPG: EPG2.
  • the EPG information of VM3 is used to identify EPG2, and the EPG information of VM4 is used to identify EPG2.
  • network device 101 is also connected to network device 102 and network device 104;
  • network device 102 is connected to network device 101 and network device 103;
  • network device 104 is connected to network device 101 and network device 103;
  • network device 103 is connected to VM5, VM6, VM7 and VM8 are connected, and the EPG information of the four VMs VM5, VM6, VM7, and VM8 are stored on the network device 103.
  • VM5 and VM6 belong to the same EPG: EPG3.
  • the EPG information of VM1 is used to identify EPG3, and the EPG information of VM2 is used to identify EPG3.
  • VM7 and VM8 belong to the same EPG: EPG4.
  • the EPG information of VM3 is used to identify EPG4, and the EPG information of VM4 is used to identify EPG4.
  • the network device 101 is also connected to the network device 102 and the network device 104; at the same time, the network device 103 is also connected to the network device 102 and the network device 104.
  • the system architecture 100 does not limit the specific connection mode of the network device 101 and the network device 103 with their corresponding VMs. They may be directly connected, or may be connected to the corresponding VM through other network devices, such as switches, firewalls and other devices.
  • the network device 101 is connected to VM1 and VM3 through the network device 201, and the network device 101 is connected to VM2 and VM4 through the network device 202.
  • the network device 103 is connected to VM5 and VM6 through the network device 203, and the network device 103 is connected to VM7 and VM8 through the network device 204.
  • the way it divides the corresponding micro-segmentation for the endpoint group is not limited to the specific connection mode, that is, not only can the micro-segmentation be divided according to their own physical or virtual interfaces, but also Based on the characteristics of the final endpoint group, such as IP address, or DSCP, or a combination of the two or more characteristics, the micro-segmentation is divided.
  • the number of network devices in the system architecture 100 may be more or less.
  • the number of the above-mentioned network devices may be dozens or hundreds, or more.
  • the embodiments of this application do not limit the number and device types of network devices.
  • the system architecture 100 has been introduced above, and the method 200, the method 300, and the method 400 are used to exemplarily introduce the process of the method for implementing micro-segmentation based on the system architecture provided above.
  • FIG. 6 is a flowchart of a message processing method 200 provided by an embodiment of the present application.
  • the method 200 uses a scenario in which a first computing device accesses a second computing device as an example to describe how inter-EPG members across VTEP devices implement micro-segmentation based on IPv6.
  • the forwarding path of the original message includes the first computing device ⁇ the first network device ⁇ the second network device ⁇ the second computing device.
  • the first computing device and the second computing device correspond to Endpoint devices in the micro-segmentation technology.
  • the first computing device corresponds to the source Endpoint device.
  • the second computing device corresponds to the destination Endpoint device.
  • the first computing device and the second computing device are not under the same VTEP device.
  • the VTEP device connected to the first computing device and the VTEP device connected to the second computing device are different.
  • the first computing device and the second computing device belong to different EPGs, and the first computing device and the second computing device correspond to inter-group members of the EPG in the micro-segmentation technology.
  • the first network device is a VTEP device connected to the first computing device, and the first network device corresponds to the source VTEP device.
  • the source VTEP device is also called the ingress VTEP device or Ingress VTEP, and the source VTEP device refers to the VTEP device connected to the source Endpoint device.
  • the second network device is a downstream node of the first network device in the forwarding path of the original message.
  • the second network device is a VTEP device connected to the second computing device, and the second network device may correspond to the destination VTEP device.
  • the second network device is an intermediate node.
  • the destination VTEP equipment is also called export VTEP equipment or Egress VTEP.
  • the destination VTEP device refers to the VTEP device connected to the destination Endpoint device.
  • the intermediate node is the forwarding node between the source VTEP device and the destination VTEP device in the forwarding path of the original message. Intermediate nodes are also called non-VTEP devices.
  • the target VTEP device is the network device 103
  • the intermediate node is the network device 102 or the network device 104.
  • the method 200 is executed by a network device and a computing device in the system architecture 100.
  • the first computing device in method 200 is VM1, VM2, VM3, or VM4.
  • the first network device in the method 200 is the network device 101.
  • the second network device in the method 200 is the network device 102, the network device 103, or the network device 104.
  • the second computing device in method 200 is VM5, VM6, VM7, or VM8.
  • method 200 is processed by a general-purpose central processing unit (central processing unit, CPU), or may be processed by a CPU and a network processor (NP) together, or it may not be used for CPU or NP, and other suitable applications may be used instead.
  • CPU central processing unit
  • NP network processor
  • the processor for message forwarding is not limited in this application.
  • the CPU is used to undertake the processing work corresponding to S203, S206 and S207
  • the NP is used to undertake the processing work corresponding to S201, S202, S204, S205 and S208.
  • the method 200 includes S201 to S208.
  • the first computing device sends an original message.
  • the original message includes, but is not limited to, an IPv4 message, an IPv6 message, or an Ethernet (English: Ethernet) frame.
  • the original message is a data message.
  • the source IP address of the original message includes the IP address of the first computing device.
  • the destination IP address of the original message includes the IP address of the second computing device.
  • the first computing device is VM1
  • the second computing device is VM5.
  • the source IP address of the original message includes the IP address of VM1.
  • the destination IP address of the original message includes the IP address of VM5.
  • S202 The first network device receives the original message.
  • the first network device and the first computing device are located in the same physical device, and the first network device and the first computing device communicate through the internal communication method of the device, thereby receiving the data sent by the first computing device.
  • Original message For example, the first network device and the first computing device are located in the same server, the first computing device is a VM running in the server, and the first network device is a network card or a virtual machine monitor (hypervisor, also called virtual machine monitor) in the server. , VMM).
  • the network card or hypervisor will receive the original message sent by the VM.
  • the first network device and the first computing device are located in different physical devices, and the first network device and the first computing device communicate through the network, thereby receiving the original message sent by the first computing device.
  • the first computing device is a VM running in a server
  • the first network device is a data center switch connected to the server network. After the VM sends the original message, the data center switch will receive the original message sent by the VM.
  • the first network device generates an IPv6 packet according to the original packet and the EPG information.
  • the first network device obtains EPG information according to the original message.
  • the first network device carries the original message and the EPG information together in the IPv6 message, and obtains the IPv6 message including the original message and the EPG information.
  • the EPG information carried in the IPv6 packet by the first network device includes a variety of situations, which will be illustrated below by using Case 1 to Case 3.
  • Case 1 The first network device carries the EPG information of the source Endpoint device in the IPv6 packet.
  • the EPG information includes at least one of EPG information of the first computing device or EPG information of the second computing device.
  • the EPG information of the first computing device is referred to as the first EPG information
  • the EPG information of the second computing device is referred to as the second EPG information.
  • the first EPG information is an example of the EPG information of the source Endpoint device
  • the second EPG information is an example of the EPG information of the destination Endpoint device.
  • the first EPG information is used to identify the EPG to which the first computing device belongs. For example, referring to FIG. 4, VM1 sends an original message to VM5, and the original message is transmitted from VM1 to network device 101 (the first network device).
  • the first computing device source Endpoint device
  • the EPG to which VM1 belongs is EPG1
  • the first EPG information is used to identify EPG1.
  • the first EPG information is the ID of EPG1, the IP address prefix of VM1, The IP address of VM1 or the name of the interface connecting VM1 to the network device 101.
  • Case 2 The first network device carries the EPG information of the destination Endpoint device in the IPv6 packet.
  • the second EPG information is used to identify the EPG to which the second computing device belongs.
  • VM1 sends an original message to VM5, and the original message is transmitted from VM1 to network device 101 (the first network device).
  • the second computing device destination Endpoint device
  • the EPG to which VM5 belongs is EPG3
  • the second EPG information (the EPG information of the destination Endpoint device) is used to identify EPG3.
  • the second EPG information is EPG3. ID, the IP address prefix of VM5, the IP address of VM5, or the name of the interface connecting VM5 to the network device 103.
  • the first network device carries the EPG information of the source Endpoint device and the EPG information of the destination Endpoint device in the IPv6 packet.
  • the EPG information carried in the IPv6 packet by the first network device includes the first EPG information and the second EPG information, so that the EPG information of the first computing device and the second computing device are both carried in the IPv6 packet.
  • How the first network device obtains the EPG information according to the original message includes multiple implementation methods.
  • the following uses method A and method B to illustrate.
  • Manner A The first network device determines the EPG information according to the IP address included in the original message.
  • the first network device locally pre-stores the correspondence between the IP address and the EPG information, and the first network device queries the correspondence between the IP address and the EPG information according to the IP address included in the original message to obtain the IP address Corresponding EPG information. For example, the first network device queries the correspondence between the IP address and the EPG information according to the source IP address of the original message, and obtains the first EPG information corresponding to the source IP address. For another example, the first network device queries the correspondence between the IP address and the EPG information according to the destination IP address included in the original message, and obtains the second EPG information corresponding to the destination IP address.
  • the correspondence between the IP address and the EPG information can be referred to as a local matching strategy.
  • the correspondence between IP addresses and EPG information is shown in Table 2 below.
  • the first network device receives the original message, the source IP address of the original message is 192.168.10.1/32, and the destination IP address of the original message is 192.168.20.2/32, the first network device queries Table 2 below , Determine that the first EPG information is EPG1, and determine that the second EPG information is EPG2.
  • IP address EPG information 192.168.10.1/32 EPG1 192.168.20.2/32 EPG2
  • Manner B The first network device determines the EPG information according to the interface through which the original message is received. For example, the first network device saves the correspondence between the interface name and the EPG information. After receiving the original message from the interface, the first network device queries the correspondence between the interface name and the EPG information according to the interface name of the interface. Get EPG information.
  • the first network device identifies the IP network segment, MAC address, VM name, container, or operating system to which the first computing device belongs based on the original message, and determines the EPG information based on the identification result.
  • the IPv6 message generated by the first network device includes an IPv6 header (IPv6 Header), an IPv6 extension header (IPv6 extension header), and an original message.
  • IPv6 header and IPv6 extension header are two types of headers in IPv6.
  • Figure 7 shows two types of IPv6 packets.
  • One type of IPv6 packet includes an IPv6 header but not an IPv6 extension header.
  • An IPv6 message includes an IPv6 header and an IPv6 extension header. The following is an introduction to the IPv6 header and the IPv6 extension header.
  • the IPv6 header is also called the IPv6 basic header or the IPv6 standard header.
  • the IPv6 header is usually the first header of an IPv6 message, that is, the outermost header. Refer to Figure 8 for the structure of the IPv6 header.
  • the IPv6 header includes the version number (Version) field, the flow type (Traffic Class) field, the flow label (flow label) field, the payload length (payload length) field, the next header index (Next Header) field, the source address field, and the destination. Address field.
  • the source address field is used to carry a 128-bit source IPv6 address.
  • the destination address field is used to carry a 128-bit destination IPv6 address.
  • the IPv6 extension header includes many types.
  • the IPv6 extension header includes a hop-by-hop option header, a destination option header, and SRH.
  • IPv6 extension headers are introduced separately as follows.
  • Hop by hop options header is an IPv6 extension header.
  • the hop-by-hop option header can be processed by each intermediate node in the route during the forwarding process.
  • the value of the next header field of the previous header of the hop-by-hop option header is 0.
  • the hop-by-hop option header is the first IPv6 extension header after the IPv6 header.
  • the previous header of the hop-by-hop option header is the IPv6 header, and the value of the next header field of the IPv6 header is 0.
  • FIG. 9 shows a schematic diagram of the structure of the hop-by-hop option header.
  • the hop-by-hop option header includes an index field of the next header, an extended header length (header Extended Length, referred to as Hdr Ext Len) field, and at least one option.
  • the value of the next header field in the hop-by-hop option header is used to indicate the type of the first header after the hop-by-hop option header.
  • the value of the HdrExtLen field in the hop-by-hop option header is used to indicate the length of the hop-by-hop option header.
  • the options in the hop-by-hop option header are also called hop-by-hop options.
  • the hop-by-hop option is usually encoded in the form of TLV, and the hop-by-hop option includes an option type field, an option data length field, and a value field.
  • the destination option header (Destination option Header, DOH) is an IPv6 extension header.
  • the destination option header is processed by a destination node in the forwarding path of the IPv6 packet, and the destination node is, for example, a device corresponding to the destination IPv6 address of the IPv6 header.
  • the value of the next header field of the previous header of the destination option header is 60.
  • the format of the destination option header is similar to that of the hop-by-hop option header.
  • the destination option header includes the next header field, the Hdr Ext Len field, and at least one option. Among them, the value of the next header field is used to indicate the type of the first header after the destination option header.
  • the value of the Hdr Ext Len field is used to indicate the length of the destination option header.
  • the options in the destination option header are also called destination options.
  • the destination option is usually encoded in the form of TLV, and the destination option includes an option type field, an option data length field, and a value field.
  • SRH is an IPv6 extension header. Specifically, SRH is an IPv6 routing header (IPv6 Routing Header). The value of the Routing Type field of the SRH is 4. Refer to FIG. 10, which is a schematic diagram of a format of an SRH provided by an embodiment of the present application. SRH includes a list of segments, the number of remaining segments (Segments Left, SL), one or more TLVs, next header field, Hdr Ext Len field, Routing Type field, last element index (Last Entry) field, flags (Flags) field, Tag field used to identify the same group of data packets, etc.
  • the first network device uses an IPv6 extension header to carry EPG information. Specifically, the first network device generates an IPv6 extension header including EPG information, and adds the IPv6 extension header on the basis of the original message to obtain the IPv6 message.
  • the EPG information carried by the IPv6 extension header includes a variety of situations, and the following examples are used to illustrate cases a to c.
  • the IPv6 extension header includes the first EPG information.
  • the effect of case a includes: the EPG information of the source Endpoint device is carried in the IPv6 extension header of the IPv6 packet, so that the EPG information of the source Endpoint device is forwarded in the IPv6 network along with the IPv6 packet.
  • the execution node of the group policy can obtain the EPG information of the source Endpoint device from the IPv6 extension header, thus eliminating the need to configure the EPG information of the source Endpoint device on the execution node of the group policy in advance. Therefore, the configuration complexity of the execution node of the group policy is reduced, and it is helpful to improve the efficiency of deploying micro-segmentation in the IPv6 network.
  • the IPv6 extension header includes the second EPG information.
  • the effects of case b include: the EPG information of the destination Endpoint device is transmitted by using the IPv6 extension header in the IPv6 network, so that the group policy enforcement node can obtain the EPG of the destination Endpoint device from the IPv6 extension header during the process of forwarding IPv6 packets Therefore, it eliminates the workload of configuring the EPG information of the destination Endpoint device on the execution node of the group policy in advance, thereby reducing the configuration complexity of the execution node of the group policy, and helping to improve the deployment of micro-segmentation in the IPv6 network s efficiency.
  • the IPv6 extension header includes first EPG information and second EPG information.
  • the effect of case c includes: the EPG information of the source Endpoint device and the EPG information of the destination Endpoint device are transmitted by using the IPv6 extension header in the IPv6 network, so that the group policy execution node can extend from IPv6 in the process of forwarding IPv6 packets
  • the header obtains the EPG information of the source Endpoint device and the EPG information of the destination Endpoint device, thus eliminating the need to configure the EPG information of the source Endpoint device and the destination Endpoint device on the execution node of the group policy in advance, thereby reducing the group policy
  • the complexity of the configuration of the execution node helps to improve the efficiency of deploying micro-segmentation in the IPv6 network.
  • FIG. 11 is a schematic diagram of the format of an IPv6 extension header carrying EPG information provided by an embodiment of this application. How to use the IPv6 extension header to carry EPG The information includes a variety of implementation methods, which are illustrated below through implementation method one to implementation method three.
  • Implementation method 1 Use the hop-by-hop option header to carry EPG information.
  • the IPv6 message generated by the first network device includes a hop-by-hop option header, and the hop-by-hop option header includes EPG information.
  • the hop-by-hop option header includes EPG information.
  • the IPv6 message has an 8-byte hop-by-hop option header after the 40-byte IPv6 header, and the EPG information is located in the hop-by-hop option header.
  • the EPG information carried by the hop-by-hop option header includes but is not limited to at least one of the EPG information of the source Endpoint device or the EPG information of the destination Endpoint device.
  • Method 1A use the hop-by-hop option header to carry the EPG information of the source Endpoint device and the destination Endpoint device.
  • the hop-by-hop option header includes the first EPG information and the second EPG information.
  • FIG. 12 shows a hop-by-hop option header including the first EPG information and the second EPG information.
  • the hop-by-hop option header includes A source EPG (Source EPG) field and a destination EPG (Destination EPG) field.
  • the source EPG field includes first EPG information
  • the destination EPG field includes second EPG information.
  • Method 1B Use the hop-by-hop option header to carry the EPG information of the source Endpoint device.
  • the hop-by-hop option header includes the first EPG information.
  • the hop-by-hop option header includes the source EPG field, and the source EPG field includes the first EPG information.
  • Method 1C Use the hop-by-hop option header to carry the EPG information of the destination Endpoint device.
  • the hop-by-hop option header includes the second EPG information.
  • the hop-by-hop option header includes a destination EPG field, and the destination EPG field includes second EPG information.
  • the effects achieved by the first implementation method include: since the hop-by-hop option header is an IPv6 extension header that can be parsed by the intermediate node, the hop-by-hop option header carries EPG information, so that when the IPv6 packet passes through the intermediate node during the forwarding process, the intermediate node can Obtain the EPG information of the source Endpoint device and/or the EPG information of the destination Endpoint device from the hop-by-hop option header. In other words, the EPG information of the source Endpoint device and/or the EPG information of the destination Endpoint device is visible to the intermediate node.
  • the intermediate node can use the EPG information of the source Endpoint device and/or the EPG information of the destination Endpoint device to execute the group policy, so that non-VTEP devices such as the intermediate node can also be used as the execution node of the group policy.
  • VTEP equipment can only support micro-segmentation, and expands the function of supporting micro-segmentation for intermediate nodes, so that micro-segmentation is suitable for more application scenarios.
  • group policies by intermediate nodes unnecessary forwarding can be avoided. For example, when the processing action in the group policy is discard, the message will be discarded by the intermediate node, and network resources will no longer be forwarded to the destination VTEP.
  • the encapsulation format of the hop-by-hop option header is more concise, and the hop-by-hop option header occupies fewer bytes, so the transmission overhead of the message can be reduced. and.
  • the hop-by-hop option header is more extensible, and you can continue to support other features by expanding new options in the hop-by-hop option header.
  • this method can be widely applied to network devices that support IPv6 without requiring intermediate nodes to support SRv6-TE. Therefore, this method is more universal.
  • the workload of pre-configuring the EPG information of the source Endpoint device and the destination Endpoint device on the intermediate node is eliminated, the configuration complexity of the intermediate node is reduced.
  • Implementation method 2 Use destination option header to carry EPG information.
  • the IPv6 message generated by the first network device includes a destination option header, and the destination option header includes EPG information.
  • the destination option header includes EPG information.
  • the IPv6 packet has an 8-byte destination option header after the 40-byte IPv6 header, and the EPG information is located in the destination option header.
  • the EPG information carried in the destination option header includes, but is not limited to, at least one of the EPG information of the source Endpoint device and the EPG information of the destination Endpoint device, as described below by way of example 2A to 2C.
  • Method 2A Use the destination option header to carry the EPG information of the source Endpoint device.
  • the destination option header includes the first EPG information.
  • FIG. 13 shows the destination option header including the first EPG information
  • the destination option header includes the source EPG field
  • the source EPG field includes the first EPG information.
  • Method 2B Use the destination option header to carry the EPG information of the destination Endpoint device.
  • the destination option header includes the second EPG information.
  • the destination option header includes a destination EPG field, and the destination EPG field includes second EPG information.
  • Method 2C use the destination option header to carry the EPG information of the source Endpoint device and the destination Endpoint device.
  • the destination option header includes first EPG information and second EPG information.
  • the destination option header includes a source EPG field and a destination EPG field, the source EPG field includes first EPG information, and the destination EPG field includes second EPG information.
  • the effects achieved by the second implementation method include: since the destination option header is an IPv6 extension header for the destination node to parse, by using the destination option header to carry EPG information, it is possible to specify that the destination node executes the group policy.
  • the encapsulation format of the destination option header is more concise, and the destination option header occupies fewer bytes, so the transmission overhead of the message can be reduced. and.
  • the destination option header is more extensible and can continue to support other features by extending new options in the destination option header.
  • this method can be widely applied to network devices that support IPv6 without requiring intermediate nodes to support SRv6-TE. Therefore, this method is universal.
  • the workload of pre-configuring the EPG information of the source Endpoint device on the destination node is eliminated, the configuration complexity of the destination node is reduced.
  • Implementation mode 3 Use the hop-by-hop option header and the destination option header to carry EPG information.
  • the IPv6 message generated by the first network device includes a hop-by-hop option header and a destination option header, and both the hop-by-hop option header and the destination option header include EPG information.
  • EPG information is located in the hop-by-hop option header and destination option header.
  • the hop-by-hop option header is located before the destination option header, the hop-by-hop option header is parsed by the receiving end first, and the destination option header is parsed by the receiving end afterwards.
  • How to use the EPG information carried by the two IPv6 extension headers of the hop-by-hop option header and the destination option header includes multiple implementation methods. The following examples illustrate methods 3A to 3F.
  • Method 3A Use the hop-by-hop option header to carry the EPG information of the source Endpoint device and the EPG information of the destination Endpoint device, and use the destination option header to carry the EPG information of the source Endpoint device.
  • the IPv6 packet generated by the first network device includes a hop-by-hop option header and a destination option header
  • the hop-by-hop option header includes first EPG information and second EPG information
  • the destination option header includes the first EPG information.
  • the destination VTEP can obtain the EPG information of the source Endpoint device through the destination option header, so the destination VTEP can also execute group policies based on the EPG information of the source Endpoint device.
  • group policies based on the EPG information of the source Endpoint device.
  • the same IPv6 packet can be executed by the intermediate node and the destination node in sequence.
  • the group policy executed by the intermediate node and the group policy executed by the destination node are the same or different.
  • Method 3B use the hop-by-hop option header to carry the EPG information of the source Endpoint device, and use the destination option header to carry the EPG information of the source Endpoint device.
  • the IPv6 message includes a hop-by-hop option header and a destination option header
  • the hop-by-hop option header includes the first EPG information
  • the destination option header includes the first EPG information
  • Method 3C use the hop-by-hop option header to carry the EPG information of the destination Endpoint device, and use the destination option header to carry the EPG information of the source Endpoint device.
  • the IPv6 message includes a hop-by-hop option header and a destination option header
  • the hop-by-hop option header includes the second EPG information
  • the destination option header includes the first EPG information
  • Mode 3D use the hop-by-hop option header to carry the EPG information of the source Endpoint device and the EPG information of the destination Endpoint device, and use the destination option header to carry the EPG information of the source Endpoint device and the EPG information of the destination Endpoint device.
  • an IPv6 message includes a hop-by-hop option header and a destination option header.
  • the hop-by-hop option header includes first EPG information and second EPG information
  • the destination option header includes first EPG information and second EPG information.
  • the IPv6 message includes a hop-by-hop option header and a destination option header.
  • the hop-by-hop option header includes the first EPG information
  • the destination option header includes the first EPG information and the second EPG information.
  • the IPv6 message includes a hop-by-hop option header and a destination option header
  • the hop-by-hop option header includes second EPG information
  • the destination option header includes first EPG information and second EPG information.
  • the IPv6 extension header also includes the IPv6 routing header.
  • the EPG information is not carried through the IPv6 routing header (for example, SRH), in other words, the EPG information is not in the IPv6 routing header (for example, SRH).
  • the EPG information is not included in the IPv6 routing header, including the case where the IPv6 message does not carry the IPv6 routing header, and the case where the IPv6 message carries the IPv6 routing header but the EPG information is not in the IPv6 routing header.
  • the IPv6 message includes the hop-by-hop option header and does not include the IPv6 routing header (such as SRH), and the EPG information is located in the hop-by-hop option header.
  • an IPv6 message includes a hop-by-hop option header and an IPv6 routing header (for example, SRH), and the EPG information is located in the hop-by-hop option header and not in the IPv6 routing header.
  • the IPv6 message includes the destination option header and does not include the IPv6 routing header (such as SRH), and the EPG information is located in the destination option header.
  • an IPv6 message includes a destination option header and an IPv6 routing header (for example, SRH), and the EPG information is located in the destination option header and not in the IPv6 routing header.
  • an identification field is carried in the IPv6 message to indicate whether the group policy has been executed.
  • the IPv6 message includes an identification field, and the identification field is used to indicate whether the IPv6 message has been processed according to the group policy corresponding to the EPG information.
  • the identification field occupies a bit in an IPv6 message. If this bit is set, it means that the IPv6 message has been processed according to the group policy; if the bit is not set, it means that the IPv6 message has not been processed according to the group policy.
  • the identification field is called "A" bit.
  • the identification field is carried through the IPv6 extension header.
  • the identification field is carried through the hop-by-hop option header, or the identification field is carried through the destination option header.
  • the positional relationship between the identification field and the EPG information includes many situations.
  • the identification field and the EPG information are in the same IPv6 extension header.
  • the identification field and the EPG information are in the same hop-by-hop option header.
  • the identification field and the EPG information are in the same destination option header.
  • the identification field and the EPG information are in the same option.
  • the identification field and the EPG information are in the same TLV.
  • the identification field and the EPG information are in the same field.
  • there is a flag field in an IPv6 packet the high-order bits of the flag field are identification fields, and the low-order bits of the flag field carry EPG information.
  • the upstream node can use the identification field to identify that the group policy has been executed, so that the downstream node does not have to re-execute Group policy, in a scenario where the same group policy only needs to be executed once along the way, it can meet the needs of this scenario and save the processing overhead of nodes after the execution node of the group policy.
  • TLV is an encoding format.
  • a TLV includes a type field, a length field, and a value field.
  • the IPv6 extension header in an IPv6 packet includes the TLV, and the EPG information is located in the value field of the TLV.
  • the group policy TLV refers to the TLV carrying the EPG information.
  • the value field of the group policy TLV includes EPG information.
  • the types of Group Policy TLVs include many situations.
  • the group policy TLV is a new top TLV, and the value of the type field of the group policy TLV indicates the type of the unused top TLV.
  • the group policy TLV is a new sub-TLV of the top TLV, and the value of the type field of the group policy TLV indicates the type of the unused sub-TLV.
  • the group policy TLV is a new sub-sub-TLV (sub-sub-TLV) of the top TLV, and the type of the group policy TLV is an unused sub-sub-TLV type.
  • This embodiment does not limit whether the group policy TLV is a top TLV, a sub-TLV, or a sub-sub-TLV.
  • the length field of the group policy TLV is used to indicate the length of the group policy TLV.
  • TLV to carry EPG information includes multiple implementation methods. The following is an example of implementation I and II.
  • Implementation I Use one TLV to carry at least one of the EPG information of the source Endpoint device or the EPG information of the destination Endpoint device.
  • the EPG information of the source Endpoint device is carried through a group policy TLV
  • the value field of the group policy TLV includes the source EPG field
  • the source EPG field includes the first EPG information.
  • the EPG information of the destination Endpoint device is carried through a group policy TLV
  • the value field of the group policy TLV includes the destination EPG field
  • the destination EPG field includes the second EPG information.
  • the EPG information of the source Endpoint device and the EPG information of the destination Endpoint device are carried through a group policy TLV.
  • the value field of the group policy TLV includes the EPG information of the source Endpoint device and the destination EPG field
  • the source EPG field includes the first EPG information.
  • the destination EPG field includes the second EPG information.
  • the EPG information of the source Endpoint device and the EPG information of the destination Endpoint device are carried through a group policy TLV, optionally, the EPG information of the source Endpoint device and the EPG information of the destination Endpoint device occupy different bits, depending on where the EPG information is located. The bits distinguish whether the EPG information is the EPG information of the source Endpoint device or the EPG information of the destination Endpoint device.
  • Implementation method II Use multiple TLVs to respectively carry the EPG information of the source Endpoint device and the EPG information of the destination Endpoint device.
  • the group policy TLV includes a source group policy TLV and a destination group policy TLV
  • the value field of the source group policy TLV includes the source EPG field
  • the source EPG field includes the first EPG information
  • the value field of the destination group policy TLV includes the destination EPG field
  • the destination EPG field includes the second EPG information.
  • the value of the type field of the source group policy TLV is different from the value of the type field of the destination group policy TLV, in other words, the source group policy TLV and the destination group policy TLV are distinguished by different Types.
  • both the source group policy TLV and the destination group policy TLV include the flag field, and the value of the flag field of the source group policy TLV is different from the value of the flag field of the destination group policy TLV.
  • the source group policy TLV is distinguished by different flags.
  • the destination group policy TLV is examples of group policy TLVs.
  • the EPG field in the group policy TLV shown in FIG. 14 is used to carry the EPG information of one Endpoint device, for example, it carries the EPG information of the source Endpoint device and the EPG information of the destination Endpoint device.
  • the EPG field in the group policy TLV shown in FIG. 14 occupies, for example, 2 bytes, and the length field of the group policy TLV has a value of 2, for example.
  • the group policy TLV shown in FIG. 15 is used to carry the EPG information of the source Endpoint device, the EPG information of the destination Endpoint device, and the identification field. Among them, the source EPG field occupies 2 bytes, the destination EPG field occupies 2 bytes, and the identification field occupies 1 bit.
  • the value of the length field of the group policy TLV is, for example, greater than 4, such as 5.
  • the group policy TLV in the group policy TLV shown in FIG. 15 includes an option type (OptionType) field, an option data length (Opt Data Len) field, an identification field, a reserved field, a source EPG field, and a destination EPG field.
  • the value of the OptType field is 5, which is used to indicate that the length from the first byte after OptLen to the last byte of the option is 5 bytes.
  • the source EPG field includes first EPG information.
  • the destination EPG field includes second EPG information. Among them, the source EPG (Source EPG) and the source EPG continuous (Source EPG con) shown in Figure 15 are the same field.
  • the meaning of the drawing expression is that one row in Figure 15 represents 32 bits, and the source EPG field includes the first row The last 1 byte of and the 1st byte of the second row, the source EPG field has not yet ended when the last byte of the first row is reached, and the first byte of the second row needs to be read continuously.
  • network devices can obtain EPG information from the new TLV, which is helpful because it eliminates the workload of configuring the correspondence between IP addresses and EPG information To reduce the configuration complexity of network equipment.
  • IPv6 extension headers carrying the above-mentioned Group Policy TLV through the IPv6 extension header includes many cases, which are illustrated below through case (1) and case (2).
  • the IPv6 message generated by the first network device includes a hop-by-hop option header, and the hop-by-hop option header includes one or more group policy TLVs.
  • the hop-by-hop option header includes EPG information (first EPG information) of the source Endpoint device, EPG information (second EPG information) of the destination Endpoint device, and an identification field.
  • the hop-by-hop option header further includes a padding (Padding) field, and the Padding field is used for alignment.
  • the IPv6 message generated by the first network device includes a destination option header, and the destination option header includes one or more group policy TLVs.
  • Figure 13 is an example of the destination option header carrying the Group Policy TLV.
  • the group policy TLV shown in FIG. 13 includes EPG information (first EPG information) of the source Endpoint device.
  • the destination option header also includes a two-byte Padding field, and the Padding field is used for alignment.
  • the group policy TLV is carried through the hop-by-hop option header and the destination option header.
  • the IPv6 message includes a hop-by-hop option header and a destination option header, and both the hop-by-hop option header and the destination option header include the group policy TLV.
  • both the hop-by-hop option header and the destination option header include the group policy TLV, please refer to the above method 3A to method 3F.
  • the group policy TLV in the hop-by-hop option header includes the first EPG information and the second EPG information
  • the group policy TLV in the destination option header includes the first EPG information.
  • Carrying EPG information by extending the new TLV is only an optional way.
  • the new TLV is not extended, but the EPG information is carried in the IPv6 extension header in other ways.
  • the flag field in the IPv6 extension header carries EPG information, thereby saving the overhead caused by the type field and the length field of the policy TLV.
  • the flag field carrying EPG information is located in a certain reserved field, or the flag field carrying EPG information is located in the V field of a certain TLV, or the flag field carrying EPG information occupies the original flag field One or more bits of.
  • the EPG information is carried by extending a new option (Option) in the IPv6 extension header.
  • the IPv6 extension header in the IPv6 message includes one or more options, and the EPG information is located in the one or more options.
  • the option that carries EPG information is called a group policy option (group policy option) as an example
  • the hop-by-hop option header is used to carry the group policy option, so that the hop-by-hop option header includes one or more group policy options.
  • the destination option header is used to carry group policy options, so that the destination option header includes one or more group policy options.
  • the group policy option may be encoded in the form of TLV.
  • FIG. 14 or FIG. 15 is replaced with the option type (OptionType), and the group policy shown in FIG. 14 or FIG. Replace the length (Length) field of the policy TLV with the option data length (Opt Data Len) field to obtain the form of the group policy option.
  • the value of the OptLen field in FIG. 16 is 2, which is used to indicate that the length from the first bit after OptLen to the last bit of the option is 2 bytes.
  • the EPG field occupies 2 bytes.
  • Method 1 Use a group policy option to carry EPG information.
  • the IPv6 extension header includes a group policy option
  • the group policy option includes the first EPG information.
  • a group policy option to carry the EPG information of the destination Endpoint device.
  • the IPv6 extension header includes a group policy option
  • the group policy option includes the second EPG information.
  • a group policy option is used to carry the EPG information of the source Endpoint device and the destination Endpoint device, so that the EPG information of the source Endpoint device and the EPG information of the destination Endpoint device are in the same option.
  • the IPv6 extension header includes a group policy option
  • the group policy option includes first EPG information and second EPG information.
  • Method 2 Use multiple group policy options to carry EPG information.
  • use different group policy options to carry the EPG information of different Endpoint devices For example, use the source group policy option to carry the EPG information of the source Endpoint device, and use the destination group policy option to carry the EPG information of the destination Endpoint device.
  • the source group policy option includes the first EPG information
  • the destination group policy option includes the second EPG information.
  • the first EPG information and the second EPG information are in different options.
  • the source group policy option and the destination group policy option are located in the same or different IPv6 extension headers.
  • the source group policy option and the destination group policy option have different Option types, or the source group policy option and the destination group policy option have the same Option type, and they are distinguished by a flag field or other fields.
  • the network device can obtain the EPG information from the new option, thereby helping to reduce the configuration complexity of the network device.
  • IPv6 is used to transmit EPG information
  • segment routing Segment Routing-Best Effort, SR-BE
  • the IPv6 message generated by the first network device is an SRv6-BE message
  • the IPv6 message does not include SRH
  • the IPv6 message includes an IPv6 header located in the outer layer of the original message
  • the destination IP address of the IPv6 header includes a virtual private network Segment identifier (Virtual Private Network Segment ID, VPN SID), which distinguishes the traffic of different tenants through different VPN SIDs, thereby realizing tenant isolation.
  • VPN SID Virtual Private Network Segment ID
  • VPN SID is a type of Internet Protocol version 6 routing (English: internet protocol version 6 for Segment Routing, referred to as SRv6) segment identification (Segment ID, SID).
  • the VPN SID can serve as a Virtual Private Network ID (Virtual Private Network ID, VPN ID), and the VPN SID can identify the corresponding VPN.
  • the VPN SID is the SID pre-published by the destination VTEP device, the location information (Locator) of the VPN SID is used to locate the destination VTEP device, and the function information (Function) of the VPN SID is used to indicate the destination VTEP device Send packets to the VPN instance.
  • the destination VTEP By using the VPN SID as the destination IP address of the IPv6 header, when the destination VTEP receives an IPv6 message and uses the destination IP address to query the local SID table (local SID table), the destination IP address will hit the VPN SID in the local SID table. Then the destination VTEP will perform the operation corresponding to the VPN SID, and forward the IPv6 packet to the corresponding VPN instance, so that the IPv6 packet will enter the corresponding VPN from the destination VTEP, thereby achieving tenant isolation.
  • the positional relationship between VPN SID and EPG information in IPv6 packets includes many situations. For example, the VPN SID is located in the outer layer of the EPG information.
  • the IPv6 message includes the IPv6 header of the VPN SID, the IPv6 extension header carrying EPG information, and the original message in sequence.
  • the types of VPN SID include but are not limited to End.DX and End.DT.
  • the operations corresponding to End.DX SID include decapsulating the outer IPv6 packet header, and forwarding the remaining packets from the outbound interface bound to End.DX SID.
  • End.DX includes but is not limited to End.DX6, End.DX4, End.DX2 or End.DX2V.
  • the operations corresponding to End.DT SID include decapsulating the outer IPv6 packet header, and searching the VPN instance routing table for forwarding according to the destination address included in the remaining packets.
  • End.DT includes but is not limited to End.DT4 or End.DT6.
  • the EPG information For various encapsulation forms that carry one EPG information, take the EPG information (first EPG information) of the source Endpoint device as an example.
  • first EPG information the EPG information of the source Endpoint device
  • the outer layer The IPv6 header occupies 40 bytes
  • the UDP header occupies 8 bytes
  • the VXLAN header carrying the first EPG information occupies 8 bytes.
  • the outer IPv6 header occupies 40 bytes
  • the UDP header occupies 8 bytes
  • the VXLAN-GPE header occupies 8 bytes.
  • the first EPG information occupies 4 bytes.
  • the outer IPv6 header occupies 40 bytes
  • the UDP header occupies 8 bytes
  • the GENEVE header occupies 8 bytes.
  • the first EPG information occupies 8 bytes.
  • the outer IPv6 header occupies 40 bytes
  • the destination option header carrying the first EPG information occupies 8 bytes.
  • IPv6 (SRv6-BE) and a hop-by-hop option header to encapsulate the first EPG information
  • the outer IPv6 header occupies 40 bytes
  • the hop-by-hop option header that carries the first EPG information occupies 8 bytes.
  • EPG information can also save 8 bytes than VXLAN, 12 bytes than VXLAN-GPE, and 16 bytes than GENEVE while realizing the same function.
  • the encapsulation method using SRv6-BE and the IPv6 extension header is more concise, which significantly saves the overhead of the header.
  • the first EPG information is carried by using SRv6-BE and the hop-by-hop option header
  • the second EPG information in the case of realizing the same function, saves 8 bytes than VXLAN-GPE, and saves 12 bytes than GENEVE.
  • the encapsulation method using SRv6-BE and the hop-by-hop option header is more concise, which significantly saves the overhead of the header.
  • How to add an IPv6 extension header includes a variety of specific methods, and the following uses method a and method b to illustrate.
  • the first network device generates an IPv6 header and an IPv6 extension header, uses the original message as a payload, and adds the IPv6 header and the IPv6 extension header to the outer layer of the original message to obtain the IPv6 message, thereby realizing the generation of the IPv6 message .
  • the IPv6 message generated by way a is in the form of mobile IP data encapsulation and tunnel (IP in IP) messages.
  • IP in IP IP in IP
  • the generated IPv6 message includes multiple IP headers, and the outer layer
  • the IP header includes the added IPv6 extension header
  • the inner IP header includes the IP header of the original message.
  • the IPv6 message generated by way a includes two IPv6 headers, the outer IPv6 header is added by the first network device, and the inner IPv6 header is the IPv6 of the original message itself. head.
  • the IPv6 message generated by way a includes an IPv6 header and an IPv4 header, the outer IPv6 header is added by the first network device, and the inner IPv4 header is the original message The IPv4 header of the text itself.
  • Method b Use the insert mode to add the IPv6 extension header.
  • the first network device generates an IPv6 extension header, and inserts the IPv6 extension header between the IPv6 header of the original message and the load of the original message, so as to realize the generation of the IPv6 message.
  • the first network device does not need to generate and add an outer IPv6 header, but instead uses the original IPv6 header of the original message to generate the IPv6 message.
  • the first network device sends an IPv6 packet.
  • the first network device After the first network device sends the IPv6 message to the second network device, since the IPv6 message includes the original message and the EPG information, the original message and the EPG information are transferred to the second network device together.
  • the second network device in the IPv6 network receives the IPv6 packet.
  • the second network device after receiving the IPv6 message, the second network device first identifies the identification field in the IPv6 message, and the second network device determines whether the IPv6 message has been processed according to the group policy according to the value of the identification field. If the second network device determines, according to the identification field, that the IPv6 message has not been processed according to the group policy, that is, the group policy has not been executed by the upstream node, the second network device executes the following S206.
  • the actions performed by the second network device include multiple situations.
  • the second network device does not execute the group policy, that is, the second network device does not execute the following S206 and S207, but skips S206 and S207 to execute S208.
  • the second network device determines whether the identification field is set, and if the identification field is not set.
  • the second network device determines that the IPv6 packet has not been processed according to the group policy, and executes the following S206. If the identification field has been set, the second network device determines that the IPv6 message has been processed in accordance with the group policy, does not perform the following S206, and forwards the IPv6 message.
  • this technical means is applied in scenarios where the intermediate node supports the micro-segmentation function. For example, if both the intermediate node and the destination VTEP device of the IPv6 message path support the micro-segmentation function, when the IPv6 packet is processed by the intermediate node according to the group policy, the destination VTEP device (the second network device) does not follow the indication of the identification field. Then the IPv6 packets are processed according to the group policy.
  • the multi-hop intermediate nodes of the IPv6 message path all support the micro-segmentation function
  • the downstream intermediate node of the intermediate node that executes the group policy according to the identification field Instruct that IPv6 packets will no longer be processed according to the group policy. In this way, it is possible to specify that IPv6 packets are only processed by one-hop intermediate nodes, avoiding the forwarding delay and processing overhead caused by multiple executions of the same group policy by different nodes.
  • the second network device obtains EPG information from the IPv6 extension header.
  • the process of obtaining EPG information also includes multiple situations, which will be illustrated in the following through situations one to three.
  • Case 1 The second network device obtains EPG information from the hop-by-hop option header.
  • the second network device obtains the first EPG information from the hop-by-hop option header.
  • the second network device obtains the first EPG information and the second EPG information from the hop-by-hop option header.
  • the second network device obtains the second EPG information from the hop-by-hop option header.
  • Case 2 The second network device obtains the EPG information from the destination option header.
  • the second network device obtains the first EPG information from the destination option header.
  • the second network device obtains the first EPG information and the second EPG information from the destination option header.
  • the second network device obtains the second EPG information from the destination option header.
  • Case 3 The second network device obtains different EPG information from the hop-by-hop option header and the destination option header.
  • the second network device obtains the first EPG information from the hop-by-hop option header, and obtains the second EPG information from the destination option header.
  • the second network device obtains the second EPG information from the hop-by-hop option header, and obtains the first EPG information from the destination option header.
  • the second network device processes the IPv6 packet according to the group policy corresponding to the EPG information.
  • the second network device obtains the group policy according to the EPG information in the IPv6 packet. Specifically, the second network device obtains and saves the group policy in advance. After receiving the IPv6 packet, the second network device obtains EPG information from the IPv6 packet, and finds the pre-saved group policy according to the EPG information. Among them, the location to save the group policy includes a variety of implementation methods. Optionally, the second network device saves the group policy in the GBP entry.
  • How to obtain the group policy includes multiple implementation methods, and the following uses method 1 to method 2 as examples.
  • Method one static configuration method.
  • the second network device receives the configuration instruction, and the second network device obtains the group policy according to the configuration instruction.
  • the configuration instruction is triggered by a configuration operation of the operation and maintenance personnel.
  • the configuration instruction is issued by the network management system or the network application to the second network device.
  • the second method is the preset method at the time of production.
  • the second network device saves the group policy at the factory by burning in the processor or other hard-coding methods.
  • How to process packets in accordance with Group Policy includes multiple implementation methods.
  • the second network device will query the policy matrix according to the EPG information carried in the IPv6 message, and use the EPG information carried in the IPv6 message to match the matching condition.
  • the second network device will execute the group policy corresponding to the matching condition.
  • the process of executing the group policy is the process of processing IPv6 packets according to the group policy.
  • the matching method includes the strict matching method and the longest matching method.
  • the strict matching method means that when the EPG information in the IPv6 packet completely meets the matching condition, it is determined that the EPG information meets the matching condition.
  • the processing actions corresponding to the completely satisfied matching conditions will be executed.
  • the longest matching method is to determine the matching length between the EPG information in the IPv6 packet and each matching condition, find the matching condition with the longest matching length, and use the matching condition with the longest matching length as the matched matching condition .
  • the longest matching method is adopted, the processing action corresponding to the matching condition with the longest matching length will be executed.
  • the first hit group policy is executed, or the last hit group policy is executed, or the highest priority hit group policy is executed.
  • how to calculate the matching length includes multiple implementation methods. For example, the first EPG information is matched with the EPG information of the source Endpoint device in the matching condition, and if the two EPG information match, the matching length is increased by one.
  • the second EPG information is matched with the EPG information of the destination Endpoint device in the matching condition. If the two EPG information match, the matching length is increased by one.
  • the IPv6 packet carries the EPG information of the source Endpoint device and does not carry the EPG information of the destination Endpoint device
  • the IPv6 packet carries the EPG information of the destination Endpoint device and does not carry the EPG information of the source Endpoint device
  • the IPv6 packet carries the source Endpoint.
  • the second network device can perform S207 to realize the function of micro-segmentation.
  • the following uses implementation A to implementation C to carry the EPG of the source Endpoint device to the IPv6 packet
  • one of the information and the EPG information of the destination Endpoint device how to implement micro-segmentation is described as an example.
  • Implementation mode A the correspondence between the IP address and the EPG information is stored in advance.
  • the second network device pre-stores the correspondence between the IP address of the Endpoint device and the EPG information.
  • the IPv6 packet carries the EPG information of the source Endpoint device and does not carry the EPG information of the destination Endpoint device, when the first 2.
  • the network device not only obtains the first EPG information from the IPv6 extension header of the IPv6 packet, but also queries the correspondence between the IP address and the EPG information according to the destination IP address included in the IPv6 packet, and obtains the first EPG information.
  • the second EPG information is to process the IPv6 message according to the group policy corresponding to the first EPG information and the second EPG information.
  • the second network device When the IPv6 packet carries the EPG information of the destination Endpoint device and does not carry the EPG information of the source Endpoint device, when the second network device receives the IPv6 packet, it not only obtains the second EPG information from the IPv6 extension header of the IPv6 packet , According to the source IP address included in the IPv6 message, query the correspondence between the IP address and the EPG information to obtain the first EPG information, and perform the IPv6 message according to the group policy corresponding to the first EPG information and the second EPG information deal with.
  • the matching condition of the group policy includes one of the EPG information of the source Endpoint device or the EPG information of the destination Endpoint device.
  • the matching condition of the group policy includes the EPG information of the source Endpoint device and does not include the EPG information of the destination Endpoint device.
  • the IPv6 extension header of the message obtains the first EPG information, and the first EPG information is used to match EPG1. In this way, the IPv6 message can only carry the EPG information of the source Endpoint device but not the EPG information of the destination Endpoint device.
  • the second network device is a firewall type device, and the matching condition corresponding to the group policy includes the EPG information of the destination Endpoint device and does not include the EPG information of the source Endpoint device.
  • the matching condition of the group policy is *to EPG1.
  • the second network device receives the IPv6 packet, it obtains the second EPG information from the IPv6 extension header of the IPv6 packet, and uses the second EPG information to match EPG1. In this way, the IPv6 message can only carry the EPG information of the destination Endpoint device but not the EPG information of the source Endpoint device.
  • the EPG information in the IPv6 packet matches the EPG information of the matching condition of the group policy, it is not required that the EPG information of the source Endpoint device and the EPG information of the destination Endpoint device in the group policy are matched.
  • the matching length between the group policy and the IPv6 packet will be increased by one.
  • the group policy that matches one of the EPG information of the source Endpoint device and the EPG information of the destination Endpoint device has Probability of being executed.
  • the second network device mirrors the IPv6 packet to the specified address, and the process ends.
  • the second network device changes the destination address of the IPv6 packet, and ends the process.
  • the second network device forwards the IPv6 packet according to the destination IP address of the outer IPv6 header in the IPv6 packet.
  • the second network device will send at least the original message in the IPv6 message, and whether to send the outer IPv6 header and the IPv6 extension header includes various situations, which are illustrated below by using Case A to Case C as examples.
  • Case A The second network device strips the outer IPv6 header and the IPv6 extension header, and sends the original message of the inner layer. Case A is suitable for the scenario where the second network device is the target VTEP device.
  • Case B The second network device strips off the IPv6 extension header, and sends the outer IPv6 header and the original message of the inner layer.
  • case B the second network device does not strip the outer IPv6 header.
  • the following uses case B1 and case B2 to illustrate.
  • Case B1 The outer IPv6 header is used for routing and forwarding by downstream intermediate nodes.
  • Case B1 is suitable for a scenario where the second network device is an intermediate node.
  • the intermediate node executes the group policy according to the EPG information in the IPv6 extension header (such as the hop-by-hop option header), it removes the IPv6 extension header, and forwards the remaining IPv6 packets to the next-hop intermediate node.
  • the remaining IPv6 packets Including the outer IPv6 header and the original message of the inner layer, so that the next hop intermediate node can route and forward according to the outer IPv6 header.
  • Case B2 The outer IPv6 header is the header carried by the original message.
  • the outer IPv6 header in the IPv6 message received by the second network device may not be added by the first network device, but carried by the original message itself.
  • the second network device does not strip the IPv6 header, so as to pass the IPv6 header carried by the original message to the next hop node.
  • case B2 is applied to the case where the second network device is a tail node.
  • the tail node does not strip the IPv6 header, but strips the IPv6 extension header, and sends the stripped packet to the Customer Edge (CE) node to
  • CE Customer Edge
  • the case B2 can also be applied to the case where the second network device is an intermediate node.
  • Case C The second network device does not strip the IPv6 extension header, and sends the outer layer IPv6 header, the IPv6 extension header, and the inner layer original message.
  • Case C is suitable for a scenario where the second network device is an intermediate node.
  • the IPv6 extension header (such as the hop-by-hop option header) not only carries the EPG information required to execute the group policy, but also carries some other information needed by the forwarding plane, such as the segment identifier of the network segment, the required delay, The required bandwidth, etc., after the intermediate node executes the group policy according to the EPG information in the IPv6 extension header, it forwards the IPv6 packet including the IPv6 header, the IPv6 extension header and the original packet to the next-hop intermediate node for the next-hop intermediate node Use the information in the IPv6 extension header.
  • the IPv6 packet is an SRv6-BE packet
  • the destination IP address in the IPv6 header of the outer layer of the IPv6 packet is the VPN SID.
  • the following methods 1, 2, and 3 are used for the second in the SRv6-BE scenario. An example will be given to illustrate how network equipment forwards packets. Among them, Method 1 is about how the destination VTEP device forwards packets when using SRv6-BE, Method 2 is about how to forward packets when the intermediate nodes that do not support SRv6 when using SRv6-BE, and Method 3 is about intermediate nodes that support SRv6 when using SRv6-BE How to forward messages.
  • the second network device queries the Local SID table according to the destination IP address in the outer IPv6 header, determines that the destination address matches the VPN SID in the local SID table, then strips off the IPv6 header and IPv6 extension header and sends it to the VPN instance (For example, the second computing device or the CE device connected to the second computing device) sends the original message, so that the original message is finally forwarded to the second computing device.
  • the second network device determines that the type of the destination IP address is End.DX according to the Local SID table, and the second network device sends the original message from the outbound interface bound to End.DX SID.
  • the second network device determines that the type of the destination IP address is End.DT according to the Local SID table, and then queries the VPN instance routing table for forwarding according to the destination address in the original message.
  • the second network device queries the IPv6 routing and forwarding table according to the destination IP address in the outer IPv6 header, and according to the IPv6 routing and forwarding table, the IPv6 packet is forwarded with the longest match, so that the IPv6 packet is forwarded to The destination VTEP device.
  • the second network device first queries the Local SID table according to the destination IP address in the outer IPv6 header, and determines that the destination address does not match each SID in the local SID table, and then queries the IPv6 routing and forwarding table. According to the IPv6 routing and forwarding table, the IPv6 message is forwarded with the longest match, so that the IPv6 message is forwarded to the destination VTEP device.
  • the second network device first updates the value of the identification field, and then forwards the IPv6 message with the updated identification field.
  • the second network device not only executes the group policy, but also sets the identification field, and sends the IPv6 with the identification field set and processed according to the group policy to the downstream intermediate node Message.
  • the policy execution node since the policy execution node updates the identification field after executing the group policy, it can indicate that the group policy has been executed, so that the group policy does not need to be repeatedly executed during the subsequent forwarding of IPv6 packets, thus reducing The processing overhead of the downstream node of the policy execution node.
  • This embodiment provides a method for implementing micro-segmentation in an IPv6 network.
  • the IPv6 extension header of the IPv6 packet is used to carry EPG information, so that the EPG information is visible to the receiving end of the IPv6 packet, so that the receiving end of the IPv6 packet does not need it.
  • the group policy can be executed according to the EPG information in the IPv6 extension header, thereby realizing the function of micro-segmentation and reducing processing complexity.
  • the IPv6 extension header has stronger scalability, it solves the problem of weak scalability in carrying EPG information through the VXLAN header, which helps to continue to expand new functions.
  • the encapsulation format of the message is more concise and the header occupies fewer bytes, the overhead caused by the transmission of the message is saved.
  • the above method 200 introduces a method for implementing micro-segmentation based on IPv6.
  • the method 300 and the method 400 are used to illustrate the method 200 respectively.
  • the first computing device is VM1
  • the first network device is the source VTEP device
  • the second network device is the destination VTEP device
  • the second computing device is VM4.
  • the method flow described in the method 300 relates to how the target VTEP device executes the group policy based on IPv6 when the VM1 accesses the VM4.
  • the steps of the method 300 and the method F00 are the same, please refer to the method F00, and will not be described in detail in the method S00.
  • FIG 20 shows a scenario where a VTEP device is implemented through a server.
  • the VTEP device is a virtual switch in the server, and the virtual switch can be implemented through a hypervisor or a network card.
  • the source VTEP device is virtual switch 1 in the server where VM1 is located.
  • the destination VTEP device is virtual switch 2 in the server where VM4 is located.
  • FIG 21 shows a scenario in which a VTEP device is implemented through a network device.
  • the VTEP device is a network device (such as a data center TOR switch).
  • the source VTEP device is Leaf1.
  • the destination VTEP device is Leaf2.
  • the method 300 includes S301 to S308.
  • the source VTEP device in the IPv6 network receives the original message.
  • the transmission direction of the packet stream is from VM1 to VM4.
  • VM1 sends the original message, and the original message reaches the source VTEP device.
  • the source VTEP device recognizes that the EPG to which VM1 belongs is Group B according to the IP address of the original message, and determines that the destination VM4 of the original message is not under the source VTEP device, and then executes S303.
  • the source VTEP device generates an IPv6 message according to the original message and the EPG information of VM1, and the destination option header of the IPv6 message includes the EPG information of VM1.
  • the EPG information of VM1 is an example of the first EPG information (EPG information of the source Endpoint device) in the method 200.
  • the EPG information of VM1 is used to identify the EPG to which VM1 belongs. For example, if the EPG to which VM1 belongs is EPG B, the EPG information of VM1 is the ID of EPG B.
  • the source VTEP device encapsulates the ID of the EPG B in the destination option header, for example, the TLV in the destination option header.
  • the source VTEP device encapsulates the destination option header in the original message, and then forwards it in the direction of the destination VTEP device after the encapsulation is completed.
  • the source VTEP device sends an IPv6 packet.
  • the destination VTEP device in the IPv6 network receives the IPv6 packet.
  • the destination VTEP device obtains the EPG information of VM1 from the destination option header.
  • the target VTEP device has two roles: the VTEP device and the execution node of the group policy. After the message reaches the destination VTEP, the destination VTEP device reads and caches the EPG information of VM1 from the TLV in the destination option header.
  • the destination VTEP device processes the IPv6 packet according to the group policy corresponding to the EPG information of VM1 and the EPG information of VM4.
  • the EPG information of VM4 is an example of the second EPG information (EPG information of the destination Endpoint device) in the method 200.
  • the EPG information of VM4 is used to identify the EPG to which VM4 belongs.
  • the destination VTEP device decapsulates the outer IPv6 and exposes the original message, and the destination VTEP device matches the EPG information of VM4 according to the destination IP address in the original message.
  • the destination VTEP device searches the strategy matrix to obtain the corresponding group policy according to the EPG information of VM1 and the EPG information of VM4; the destination VTEP device processes the original message according to the group policy.
  • the destination VTEP device sends the original message to VM4.
  • This embodiment provides a method for a destination VTEP device to execute group policies based on an IPv6 network.
  • the destination option header of IPv6 is used to carry the EPG information of the source Endpoint device, so that the EPG information of the source Endpoint device is transferred to the destination VTEP device through the destination option header. Therefore, the destination VTEP device does not need to decapsulate the VXLAN header, and can execute the group policy according to the EPG information of the source Endpoint device, thereby achieving the function of micro-segmentation and reducing processing complexity.
  • the destination option header is more extensible, it solves the problem of weak extensibility in carrying EPG information through the VXLAN header, which helps to continue to expand new functions.
  • the encapsulation format of the destination option header is more concise, and the packet's outer encapsulation Overhead is smaller, the overhead caused by the transmission of the packet is saved.
  • the first computing device is VM1
  • the first network device is the source VTEP device
  • the second network device is an intermediate node
  • the second computing device is VM4.
  • the method flow described in the method 400 relates to how the intermediate node in the process of VM1 accessing VM4 executes the group policy based on IPv6.
  • the steps of the method 400 and the method 200 or the method 300 are the same, please refer to the method 200 or the method 300, and will not be described in detail in the method 400.
  • the method 400 includes S401 to S409.
  • the source VTEP device in the IPv6 network receives the original message.
  • the source VTEP device generates an IPv6 message according to the original message, the EPG information of VM1, and the EPG information of VM4.
  • the IPv6 message includes a hop-by-hop option header and the original message.
  • the hop-by-hop option header includes VM1’s EPG information and VM4’s EPG information. EPG information.
  • the EPG information of VM1 is an example of the first EPG information (EPG information of the source Endpoint device) in the method 200.
  • the EPG information of VM4 is an example of the second EPG information (EPG information of the destination Endpoint device) in the method 200.
  • the vSwitch on the data center server serves as the VTEP device, and the VTEP device searches for the EPG information of VM1 and the EPG of VM4 according to the source IP address, destination IP address and local entry information of the original message in the inner layer.
  • Information, the EPG information of VM1 and the EPG information of VM4 are encapsulated in the hop-by-hop option header of IPv6, and the IPv6 packet encapsulated with the hop-by-hop option header is forwarded.
  • the source VTEP device sends an IPv6 packet.
  • the intermediate node in the IPv6 network receives the IPv6 packet.
  • the intermediate node obtains the EPG information of VM1 and the EPG information of VM4 from the hop-by-hop option header.
  • the intermediate node processes the IPv6 packet according to the group policy corresponding to the EPG information of VM1 and the EPG information of VM4.
  • any intermediate node on the forwarding path can execute the group policy according to the EPG information of the source Endpoint device and the EPG information of the destination Endpoint device.
  • the intermediate node is, for example, a leaf switch or a spine switch in the data center.
  • Figure 23 shows the execution of group policies on the Spine switch. Wherein, when the group policy is forwarding or marking, the intermediate node executes the following S408. When the group policy is discard, the intermediate node ends the process.
  • the intermediate node sends an IPv6 packet.
  • the destination VTEP device receives the IPv6 message, decapsulates the IPv6 message, obtains the original message, and sends the original message to VM4.
  • This embodiment provides a method for an intermediate node to execute a group policy based on an IPv6 network, using the hop-by-hop option header of IPv6 to carry the EPG information of the source Endpoint device and the EPG information of the destination Endpoint device, so that the EPG information of the source Endpoint device and the destination Endpoint are The EPG information of the device is passed to the intermediate node through the hop-by-hop option header. Therefore, the intermediate node does not need to decapsulate the VXLAN header, and can execute the group policy according to the EPG information of the source Endpoint device and the destination Endpoint device, thereby realizing the function of micro-segmentation and reducing processing the complexity.
  • the hop-by-hop option header is more scalable, it solves the problem of weak scalability in carrying EPG information through the VXLAN header, which helps to continue to expand new functions.
  • the encapsulation format of the hop-by-hop option header is more concise, and the packet's outer encapsulation Overhead is smaller, the overhead caused by the transmission of the packet is saved.
  • it breaks the restriction that the group policy can only be executed by the VTEP device, and decouples the role of the policy execution node from the VTEP device, so that the intermediate node can also execute the group policy, thereby supporting the function of micro-segmentation.
  • the intermediate node does not need to unpack the outer encapsulation when executing the group policy, so the processing overhead of understanding the outer encapsulation is eliminated, and the processing flow is simplified.
  • the method 200, method 300, and method 400 of the embodiment of the present application are described above.
  • the network device of the embodiment of the present application is described below.
  • the network device described below has the first network device or the second network device in the method 200, method 300 or method 400. Any function of network equipment.
  • FIG. 25 is a schematic structural diagram of a network device 500 provided by an embodiment of the present application.
  • the network device 500 includes: a receiving module 501, configured to perform S202, S302, or S402; and a generating module 502, configured to perform S203 , S303 or S403; sending module 503, used to execute S204, S304 or S404.
  • the network device 500 corresponds to the first network device in the foregoing method embodiment, and each module in the network device 500 and the foregoing other operations and/or functions are used to implement various steps and functions implemented by the first network device in the method embodiment, respectively.
  • each module in the network device 500 and the foregoing other operations and/or functions are used to implement various steps and functions implemented by the first network device in the method embodiment, respectively.
  • For specific details of the method please refer to the above method 200, method 300 or method 400. For the sake of brevity, it will not be repeated here.
  • the network device 500 processes messages, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned function allocation can be completed by different functional modules according to needs, that is, the internal structure of the network device 500 is divided into different The functional modules to complete all or part of the functions described above.
  • the network device 500 provided in the foregoing embodiment belongs to the same concept as the foregoing method 200, method 300, or method 400. For the specific implementation process, refer to the method 200, method 300, or method 400, which will not be repeated here.
  • FIG. 26 is a schematic structural diagram of a network device 600 provided by an embodiment of the present application.
  • the network device 600 includes: a receiving module 601 for performing S205, S305 or S405; an obtaining module 602 for performing S206 , S306 or S406;
  • the processing module 603 is used to execute S207, S307 or S407.
  • the network device 600 corresponds to the second network device in the foregoing method embodiment, and each module in the network device 600 and the foregoing other operations and/or functions are used to implement various steps and steps implemented by the second network device in the method embodiment, respectively.
  • each module in the network device 600 and the foregoing other operations and/or functions are used to implement various steps and steps implemented by the second network device in the method embodiment, respectively.
  • For specific details of the method please refer to the above method 200, method 300 or method 400. For the sake of brevity, it will not be repeated here.
  • the network device 600 processes messages, only the division of the above-mentioned functional modules is used as an example. In practical applications, the above-mentioned function allocation can be completed by different functional modules according to needs, that is, the internal structure of the network device 600 is divided into different The function module to complete all or part of the functions described above.
  • the network device 600 provided in the foregoing embodiment belongs to the same concept as the foregoing method 200, method 300, or method 400. For the specific implementation process, refer to the method 200, method 300, or method 400, which will not be repeated here.
  • the embodiments of the present application also provide a network device.
  • the hardware structure of the network device is introduced below.
  • the network device 700 or the network device 800 described below corresponds to the first network device or the second network device in the foregoing method embodiment.
  • the hardware, modules, and other operations and/or functions in the network device 700 or the network device 800 are respectively
  • the steps of the above method 200, method 300, or method 400 are completed by the integrated logic circuit of the hardware in the network device 700 or the network device 800 processor or the instructions in the form of software.
  • the steps of the method disclosed in combination with the embodiments of the present application may be directly embodied as being executed and completed by a hardware processor, or executed and completed by a combination of hardware and software modules in the processor.
  • the software module can be located in a mature storage medium in the field, such as random access memory, flash memory, read-only memory, programmable read-only memory, or electrically erasable programmable memory, registers.
  • the storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware. To avoid repetition, it will not be described in detail here.
  • the network device 700 or the network device 800 corresponds to the network device 500 or the network device 600 in the foregoing virtual device embodiment, and each functional module in the network device 500 or the network device 600 is implemented by the software of the network device 700 or the network device 800.
  • the functional modules included in the network device 500 or the network device 600 are generated after the processor of the network device 700 or the network device 800 reads the program code stored in the memory.
  • FIG. 27 shows a schematic structural diagram of a network device 700 provided by an exemplary embodiment of the present application.
  • the network device 700 may be configured as a first network device or a second network device.
  • the network device 700 can be implemented by a general bus architecture.
  • the network device 700 includes at least one processor 701, a communication bus 702, a memory 703, and at least one communication interface 704.
  • the processor 701 may be a general-purpose CPU, NP, or microprocessor, or may be one or more integrated circuits used to implement the solution of the present application, for example, application-specific integrated circuit (ASIC), programmable logic A device (programmable logic device, PLD) or a combination thereof.
  • ASIC application-specific integrated circuit
  • PLD programmable logic A device
  • the above-mentioned PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.
  • the communication bus 702 is used to transfer information between the above-mentioned components.
  • the communication bus 702 can be divided into an address bus, a data bus, a control bus, and so on. For ease of presentation, only one thick line is used to indicate in FIG. 27, but it does not mean that there is only one bus or one type of bus.
  • the memory 703 can be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, or it can be a random access memory (RAM) or can store information and instructions
  • ROM read-only memory
  • RAM random access memory
  • Other types of dynamic storage devices can also be electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disk storage , CD storage (including compressed CDs, laser disks, CDs, digital universal CDs, Blu-ray CDs, etc.), disk storage media or other magnetic storage devices, or can be used to carry or store desired program codes in the form of instructions or data structures And any other media that can be accessed by the computer, but not limited to this.
  • the memory 703 may exist independently and is connected to the processor 701 through the communication bus 702.
  • the memory 703 may also be integrated with the processor 701.
  • the communication interface 704 uses any device such as a transceiver for communicating with other devices or a communication network.
  • the communication interface 704 includes a wired communication interface, and may also include a wireless communication interface.
  • the wired communication interface may be, for example, an Ethernet interface.
  • the Ethernet interface can be an optical interface, an electrical interface, or a combination thereof.
  • the wireless communication interface may be a wireless local area network (WLAN) interface, a cellular network communication interface, or a combination thereof.
  • WLAN wireless local area network
  • the processor 701 may include one or more CPUs, such as CPU0 and CPU1 as shown in FIG. 27.
  • the network device 700 may include multiple processors, such as the processor 701 and the processor 705 as shown in FIG. 27.
  • processors can be a single-core processor (single-CPU) or a multi-core processor (multi-CPU).
  • the processor here may refer to one or more devices, circuits, and/or processing cores for processing data (such as computer program instructions).
  • the network device 700 may further include an output device 706 and an input device 707.
  • the output device 706 communicates with the processor 701 and can display information in a variety of ways.
  • the output device 706 may be a liquid crystal display (LCD), a light emitting diode (LED) display device, a cathode ray tube (CRT) display device, or a projector, etc.
  • the input device 707 communicates with the processor 701, and can receive user input in a variety of ways.
  • the input device 707 may be a mouse, a keyboard, a touch screen device, a sensor device, or the like.
  • the memory 703 is used to store the program code 710 for executing the solution of the present application, and the processor 701 may execute the program code 710 stored in the memory 703. That is, the network device 700 may implement the method 200, the method 300, or the method 400 provided in the method embodiment through the processor 701 and the program code 710 in the memory 703.
  • the network device 700 in the embodiment of the present application may correspond to the first network device or the second network device in the foregoing method embodiments, and the processor 701, the communication interface 704, etc. in the network device 700 may implement the foregoing methods.
  • the receiving module 501 and the sending module 503 in the network device 500 are equivalent to the communication interface 704 in the network device 700; the generating module 502 in the network device 500 may be equivalent to the processor 701 in the network device 700.
  • the receiving module 601 in the network device 600 is equivalent to the communication interface 704 in the network device 700; the obtaining module 602 and the processing module 603 in the network device 600 may be equivalent to the processor 701 in the network device 700.
  • FIG. 28 shows a schematic structural diagram of a network device 800 provided by an exemplary embodiment of the present application.
  • the network device 800 may be configured as a first network device or a second network device.
  • the network device 800 includes: a main control board 810 and an interface board 830.
  • the main control board 810 is also called a main processing unit (MPU) or a route processor card (route processor card).
  • the main control board 810 is used to control and manage various components in the network device 800, including routing calculations and equipment. Management, equipment maintenance, and protocol processing functions.
  • the main control board 810 includes: a central processing unit 811 and a memory 812.
  • the interface board 830 is also called a line processing unit (LPU), a line card (line card), or a service board.
  • the interface board 830 is used to provide various service interfaces and implement data packet forwarding.
  • Service interfaces include, but are not limited to, Ethernet interfaces, POS (Packet over SONET/SDH) interfaces, etc.
  • the Ethernet interfaces are, for example, Flexible Ethernet Clients (Flexible Ethernet Clients, FlexE Clients).
  • the interface board 830 includes a central processor 831, a network processor 832, a forwarding entry memory 834, and a physical interface card (PIC) 833.
  • PIC physical interface card
  • the central processing unit 831 on the interface board 830 is used to control and manage the interface board 830 and to communicate with the central processing unit 811 on the main control board 810.
  • the network processor 832 is used to implement message forwarding processing.
  • the form of the network processor 832 may be a forwarding chip.
  • the network processor 832 is configured to forward the received message based on the forwarding table stored in the forwarding table entry memory 834, and if the destination address of the message is the address of the network device 800, the message is sent to the CPU ( Such as the central processor 811) processing; if the destination address of the message is not the address of the network device 800, the next hop and outbound interface corresponding to the destination address are found in the forwarding table according to the destination address, and the message is forwarded to The outgoing interface corresponding to the destination address.
  • the processing of the upstream message includes: the processing of the incoming interface of the message, the lookup of the forwarding table; the processing of the downstream message: the lookup of the forwarding table, and so on.
  • the physical interface card 833 is used to implement the docking function of the physical layer, the original traffic enters the interface board 830 from this, and the processed packets are sent from the physical interface card 833.
  • the physical interface card 833 is also called a daughter card, which can be installed on the interface board 830, and is responsible for converting the photoelectric signal into a message, checking the validity of the message, and forwarding it to the network processor 832 for processing.
  • the central processing unit can also perform the functions of the network processor 832, such as realizing software forwarding based on a general-purpose CPU, so that the network processor 832 is not required in the physical interface card 833.
  • the network device 800 includes multiple interface boards.
  • the network device 800 further includes an interface board 840.
  • the interface board 840 includes: a central processing unit 841, a network processor 842, a forwarding entry memory 844, and a physical interface card 843.
  • the network device 800 further includes a switching network board 820.
  • the switch fabric unit 820 may also be referred to as a switch fabric unit (SFU).
  • SFU switch fabric unit
  • the switching network board 820 is used to complete data exchange between the interface boards.
  • the interface board 830 and the interface board 840 may communicate with each other through the switching network board 820.
  • the main control board 810 and the interface board 830 are coupled.
  • the main control board 810, the interface board 830, the interface board 840, and the switching network board 820 are connected to the system backplane through the system bus to achieve intercommunication.
  • an inter-process communication protocol (IPC) channel is established between the main control board 810 and the interface board 830, and the main control board 810 and the interface board 830 communicate through the IPC channel.
  • IPC inter-process communication protocol
  • the network device 800 includes a control plane and a forwarding plane.
  • the control plane includes a main control board 810 and a central processing unit 831.
  • the forwarding plane includes various components that perform forwarding, such as a forwarding entry memory 834, a physical interface card 833, and network processing. ⁇ 832.
  • the control plane performs functions such as routers, generation of forwarding tables, processing of signaling and protocol messages, configuration and maintenance of the status of the equipment, etc.
  • the control plane issues the generated forwarding tables to the forwarding plane.
  • the network processor 832 is based on the control plane.
  • the issued forwarding table looks up and forwards the message received by the physical interface card 833.
  • the forwarding table issued by the control plane can be stored in the forwarding entry storage 834. In some embodiments, the control plane and the forwarding plane can be completely separated and not on the same device.
  • the physical interface card 833 receives the original message and sends it to the network processor 832.
  • the network processor 832 generates an IPv6 message based on the original message and EPG information, and based on the outgoing interface and other information After the link layer encapsulation is completed, the IPv6 message is sent out from the physical interface card 833, so that the IPv6 message is transmitted to the second network device.
  • the physical interface card 833 receives the IPv6 message and sends it to the network processor 832.
  • the network processor 832 obtains the EPG information from the IPv6 extension header; according to the group policy corresponding to the EPG information, Process IPv6 packets.
  • the receiving module 501 and the sending module 503 in the network device 500 are equivalent to the physical interface card 833 in the network device 800; the generating module 502 in the network device 500 may be equivalent to the network processor 832 or the central processing unit 811.
  • the receiving module 601 in the network device 600 is equivalent to the physical interface card 833 in the network device 800; the obtaining module 602 and the processing module 603 in the network device 600 may be equivalent to the network processor 832 or the central processing unit 811.
  • the operations on the interface board 840 in the embodiment of the present application are consistent with the operations on the interface board 830, and will not be repeated for the sake of brevity.
  • the network device 800 of this embodiment may correspond to the first network device or the second network device in the foregoing method embodiments.
  • the main control board 810, interface boards 830 and/or 840 in the network device 800 can implement the foregoing methods
  • the functions and/or various steps implemented by the first network device or the second network device in the embodiment will not be repeated here.
  • main control boards there may be one or more main control boards, and when there are more than one, it may include the main main control board and the standby main control board.
  • the switching network board may not exist, or there may be one or more. When there are more than one, the load sharing and redundant backup can be realized together. Under the centralized forwarding architecture, the network equipment may not need to switch the network board, and the interface board undertakes the processing function of the business data of the entire system.
  • the network device can have at least one switching network board, and data exchange between multiple interface boards is realized through the switching network board, providing large-capacity data exchange and processing capabilities. Therefore, the data access and processing capabilities of network equipment with a distributed architecture are greater than those with a centralized architecture.
  • the form of the network device may also have only one board, that is, there is no switching network board, and the functions of the interface board and the main control board are integrated on the one board.
  • the central processing unit and the main control board on the interface board The central processing unit on the board can be combined into a central processing unit on the same board to perform the functions of the two superimposed.
  • This type of equipment has low data exchange and processing capabilities (for example, low-end switches or routers and other networks) equipment).
  • the specific architecture used depends on the specific networking deployment scenario, and there is no restriction here.
  • the foregoing first network device or second network device may be implemented as a virtualized device.
  • the virtualization device may be a virtual machine (English: Virtual Machine, VM) running a program for sending a message function, and the virtual machine is deployed on a hardware device (for example, a physical server).
  • a virtual machine refers to a complete computer system with complete hardware system functions that is simulated by software and runs in a completely isolated environment.
  • the virtual machine can be configured as the first network device or the second network device.
  • the first network device or the second network device can be implemented based on a general physical server combined with network function virtualization (Network Functions Virtualization, NFV) technology.
  • the first network device or the second network device is a virtual host, a virtual router, or a virtual switch.
  • NFV Network Functions Virtualization
  • the virtualization device may be a container, and the container is an entity used to provide an isolated virtualization environment.
  • the container may be a docker container.
  • the container can be configured as the first network device or the second network device.
  • the first network device or the second network device can be created through the corresponding image.
  • two container instances can be created for the proxy-container through the image of proxy-container (a container that provides proxy services), which are container instances.
  • proxy-container1, container instance proxy-container2 the container instance proxy-container1 is provided as the first network device or the first computing device
  • the container instance proxy-container2 is provided as the second network device or the second computing device.
  • the first network device or the second network device can run using the kernel of a physical machine, and multiple first network devices or second network devices can share the operating system of the physical machine.
  • the container technology can isolate different first network devices or second network devices.
  • the containerized first network device or second network device can run in a virtualized environment, for example, can run in a virtual machine, and the containerized first network device or second network device can also run directly in a physical machine .
  • the virtualization device can be a Pod, and the Pod is Kubernetes (Kubernetes is a container orchestration engine open sourced by Google, referred to as K8s in English) as the basic unit for deploying, managing, and orchestrating containerized applications.
  • Pod can include one or more containers. Each container in the same Pod is usually deployed on the same host, so each container in the same Pod can communicate through the host, and can share the storage resources and network resources of the host.
  • Pod can be configured as the first network device or the second network device.
  • a container as a service full English name: container as a service, English abbreviation: CaaS, which is a container-based PaaS service
  • CaaS which is a container-based PaaS service
  • first network device or the second network device may also be other virtualization devices, which are not listed here.
  • the above-mentioned first network device or second network device may also be implemented by a general-purpose processor.
  • the form of the general-purpose processor may be a chip.
  • the general-purpose processor that implements the first network device or the second network device includes a processing circuit, an input interface and an output interface that are internally connected and communicated with the processing circuit, and the processing circuit is used to execute the foregoing various method embodiments through the input interface.
  • the processing circuit is used to execute the receiving steps in the foregoing method embodiments through the input interface, and the processing circuit is used to execute the sending steps in the foregoing method embodiments through the output interface.
  • the general-purpose processor may further include a storage medium, and the processing circuit is configured to execute the storage steps in each of the foregoing method embodiments through the storage medium.
  • the storage medium may store instructions executed by the processing circuit, and the processing circuit is configured to execute the instructions stored in the storage medium to execute the foregoing method embodiments.
  • the system 900 includes a first network device 901 and a second network device 902.
  • the first network device 901 is, for example, the network device 500, the network device 700, or the network device 800
  • the second network device 902 is the network device 600, the network device 700, or the network device 800.
  • the embodiments of the present application provide a computer program product.
  • the computer program product runs on a first network device or a second network device
  • the first network device or the second network device is caused to execute the method 200 in the above method embodiment. , Method 300 or Method 400.
  • the embodiment of the present application provides a chip that, when the chip runs on a first network device or a second network device, enables the first network device or the second network device to execute the method 200, method 300, or method in the foregoing method embodiment.
  • Method 400 The embodiment of the present application provides a chip that, when the chip runs on a first network device or a second network device, enables the first network device or the second network device to execute the method 200, method 300, or method in the foregoing method embodiment.
  • the above-mentioned network devices of various product forms respectively have any function of the first network device or the second network device in the above method embodiment, and will not be repeated here.
  • the disclosed system, device, and method may be implemented in other ways.
  • the device embodiments described above are only illustrative.
  • the division of the unit is only a logical function division, and there may be other divisions in actual implementation, for example, multiple units or components may be combined or may be Integrate into another system, or some features can be ignored or not implemented.
  • the displayed or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or units, and may also be electrical, mechanical or other forms of connection.
  • the unit described as a separate component may or may not be physically separated, and the component displayed as a unit may or may not be a physical unit, that is, it may be located in one place, or may also be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the objectives of the solutions of the embodiments of the present application.
  • the functional units in the various embodiments of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit.
  • the above-mentioned integrated unit can be implemented in the form of hardware or software functional unit.
  • the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium.
  • the technical solution of this application is essentially or the part that contributes to the existing technology, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium. It includes several instructions to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods in the various embodiments of the present application.
  • the aforementioned storage media include: U disk, mobile hard disk, read-only memory (read-only memory, ROM), random access memory (random access memory, RAM), magnetic disks or optical disks and other media that can store program codes. .
  • the above embodiments it may be implemented in whole or in part by software, hardware, firmware, or any combination thereof.
  • software it can be implemented in the form of a computer program product in whole or in part.
  • the computer program product includes one or more computer program instructions.
  • the computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices.
  • the computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium.
  • the computer program instructions can be passed from a website, computer, server, or data center.
  • the computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server or data center integrated with one or more available media.
  • the usable medium may be a magnetic medium (for example, a floppy disk, a hard disk, and a magnetic tape), an optical medium (for example, a digital video disc (DVD), or a semiconductor medium (for example, a solid state hard disk).

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请提供了一种报文处理方法、设备、系统及存储介质，属于通信技术领域。本申请提供了一种在IPv6网络中实现微分段的方法，通过使用IPv6报文的IPv6扩展头携带EPG信息，使得EPG信息对IPv6报文的接收端可见，以便IPv6报文的接收端根据IPv6扩展头中的EPG信息执行组策略，从而实现微分段的功能。由于IPv6扩展头的扩展性更强，因此解决了通过VXLAN头携带EPG信息存在的扩展性弱的问题，有助于继续扩展新的功能。并且，由于报文的封装格式更加简洁，报头占用的字节更少，因此节省了传输报文带来的开销。

Description

报文处理方法、设备、系统及存储介质
本申请要求于2020年03月31日提交的申请号为202010245961.4、发明名称为“报文处理方法、设备、系统及存储介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域，特别涉及一种报文处理方法、设备、系统及存储介质。
背景技术
微分段(Micro-segmentation)是一种基于精细化分组的网络隔离技术。微分段技术可以通过将网络中的设备按照比虚拟局域网(Virtual Local Area Network，VLAN)粒度更细的分组规则进行分组，为各个分组定义组策略，执行组策略来实现流量隔离，从而保证业务安全。
在微分段领域中，分组被称为端点组(Endpoint Group，EPG)。一个EPG可以包括服务器、终端等多个成员，EPG包括的成员称为端点(Endpoint)。在实现微分段的过程中，当源Endpoint设备发来的原始报文到达源虚拟隧道端点(Virtual Tunnel Endpoint，VTEP)设备时，源VTEP会在虚拟扩展局域网(Virtual Extensible Local Area Network，VXLAN)头中携带源Endpoint设备的EPG信息，向原始报文封装VXLAN头，得到VXLAN报文。源VTEP会向目的VTEP发送VXLAN报文。目的VTEP设备接收到VXLAN报文后，会解封装VXLAN头，得到源Endpoint设备的EPG信息。目的VTEP会根据源Endpoint设备的EPG信息与目的端的EPG信息执行组策略。
采用上述方法实现微分段技术时，需要依赖VXLAN头承载EPG信息，而VXLAN头是一种覆盖网络头(Overlay header)，报头的封装不够简洁，导致网络中传输报文的开销过大。
发明内容
本申请实施例提供了一种报文处理方法、设备、系统及存储介质，能够减少传输报文的开销。所述技术方案如下。
第一方面，提供了一种报文处理方法，应用于互联网协议第6版IPv6网络，在该方法中，所述IPv6网络中的第一网络设备接收原始报文；所述第一网络设备根据所述原始报文和端点组EPG信息，生成IPv6报文，所述IPv6报文包括IPv6扩展头和所述原始报文，所述IPv6扩展头包括所述EPG信息；所述第一网络设备发送所述IPv6报文。
以上提供了一种在IPv6网络中实现微分段的方法，通过使用IPv6报文的IPv6扩展头携带EPG信息，使得EPG信息对IPv6报文的接收端可见，以便IPv6报文的接收端不需要解封装VXLAN头，即可根据IPv6扩展头中的EPG信息执行组策略，从而实现微分段的功能，降低处理复杂度。且由于IPv6扩展头的扩展性更强，因此解决了通过VXLAN头携带EPG信息存在的扩展性弱的问题，有助于继续扩展新的功能。并且，由于报文的封装格式更加简洁，报头占用的字节更少，因此节省了传输报文带来的开销。
可选地，所述EPG信息包括第一EPG信息。所述第一EPG信息用于标识第一计算设备所属的EPG，所述原始报文的源互联网协议IP地址包括所述第一计算设备的IP地址。
通过在IPv6报文的IPv6扩展头携带源Endpoint设备的EPG信息，使得源Endpoint设备的EPG信息随着IPv6报文在IPv6网络中转发。组策略的执行节点在转发IPv6报文的过程中，能从IPv6扩展头获得源Endpoint设备的EPG信息，因此免去了预先在组策略的执行节点上配置源Endpoint设备的EPG信息带来的工作量，从而降低了组策略的执行节点的配置复杂度，有助于提高IPv6网络中部署微分段的效率。
可选地，所述EPG信息包括第二EPG信息。所述第二EPG信息用于标识第二计算设备所属的EPG，所述原始报文的目的IP地址包括所述第二计算设备的IP地址。
通过在IPv6网络中使用IPv6扩展头来传递目的Endpoint设备的EPG信息，使得组策略的执行节点在转发IPv6报文的过程中，能从IPv6扩展头获得目的Endpoint设备的EPG信息，因此免去了预先在组策略的执行节点上配置目的Endpoint设备的EPG信息带来的工作量，从而降低了组策略的执行节点的配置复杂度，有助于提高IPv6网络中部署微分段的效率。
可选地，所述EPG信息包括第一EPG信息和第二EPG信息。
通过在IPv6网络中使用IPv6扩展头来传递源Endpoint设备的EPG信息和目的Endpoint设备的EPG信息，使得组策略的执行节点在转发IPv6报文的过程中，能从IPv6扩展头获得源Endpoint设备的EPG信息和目的Endpoint设备的EPG信息，因此免去了预先在组策略的执行节点上配置源Endpoint设备和目的Endpoint设备的EPG信息带来的工作量，从而降低了组策略的执行节点的配置复杂度，有助于提高IPv6网络中部署微分段的效率。
可选地，所述IPv6报文包括逐跳选项头，所述逐跳选项头包括所述EPG信息。
可选地，所述逐跳选项头包括第一EPG信息。
可选地，所述逐跳选项头包括第二EPG信息。
可选地，所述逐跳选项头包括第一EPG信息和第二EPG信息。
由于逐跳选项头是可供中间节点解析的IPv6扩展头，通过使用逐跳选项头携带EPG信息，使得IPv6报文在转发过程中途径中间节点时，中间节点能从逐跳选项头得到源Endpoint设备的EPG信息和/或目的Endpoint设备的EPG信息，换句话说，源Endpoint设备的EPG信息和/或目的Endpoint设备的EPG信息是对中间节点可见的。因此，中间节点能够利用源Endpoint设备的EPG信息和/或目的Endpoint设备的EPG信息执行组策略，从而让中间节点这样的非VTEP设备也能作为组策略的执行节点。一方面，解决了VTEP设备才能支持微分段的局限性问题，为中间节点扩展了支持微分段的功能，从而让微分段适于的应用场景更多。另一方面，通过由中间节点执行组策略，能避免不必要的转发。比如，当组策略中的处理动作为丢弃时，报文会被中间节点丢弃，而不会再占用网络资源向目的VTEP转发。再一方面，相对于VXLAN等overlay报头的封装格式而言，逐跳选项头的封装格式更简洁，逐跳选项头占用的字节更少，因此能够降低报文的传输开销。并且。逐跳选项头的扩展性更强，可通过在逐跳选项头中扩展新的选项来继续支持其他特性。再一方面，这种方式能广泛地应用在支持IPv6的网络设备上，而不必要求中间节点支持SRv6-TE，因此这种方式的普适性更强。再一方面，由于免去在中间节点上预先配置源Endpoint设备和目的Endpoint设备的EPG信息的工作量，因此降低了中间节点的配置复杂度。
可选地，所述IPv6扩展头包括目的选项头，所述目的选项头包括所述EPG信息。
可选地，所述目的选项头包括第一EPG信息。
可选地，所述目的选项头包括第二EPG信息。
可选地，所述目的选项头包括第一EPG信息和第二EPG信息。
由于目的选项头是供目的节点解析的IPv6扩展头，通过使用目的选项头携带EPG信息，能够指定由目的节点执行组策略。一方面，相对于VXLAN等overlay报头的封装格式而言，目的选项头的封装格式更简洁，目的选项头占用的字节更少，因此能够降低报文的传输开销。并且。目的选项头的扩展性更强，可通过在目的选项头中扩展新的选项来继续支持其他特性。再一方面，这种方式能广泛地应用在支持IPv6的网络设备上，而不必要求中间节点支持SRv6-TE，因此这种方式的普适性。再一方面，由于免去在目的节点上预先配置源Endpoint设备的EPG信息的工作量，因此降低了目的节点的配置复杂度。
可选地，所述IPv6扩展头包括逐跳选项头和目的选项头，所述逐跳选项头和所述目的选项头包括所述EPG信息。
通过这种方式，在IPv6报文沿途转发的过程中，中间节点能通过逐跳选项头得到源Endpoint设备的EPG信息和目的Endpoint设备的EPG信息，因此中间节点能根据源Endpoint设备的EPG信息和目的Endpoint设备的EPG信息执行组策略。并且，目的VTEP能通过目的选项头得到源Endpoint设备的EPG信息，因此目的VTEP也能根据源Endpoint设备的EPG信息执行组策略。如此，同一个IPv6报文能够被中间节点和目的节点依次执行组策略。其中，中间节点执行的组策略和目的节点执行的组策略相同或不同。
可选地，所述IPv6扩展头包括类型长度值TLV，所述EPG信息位于所述TLV的值字段中。
通过在IPv6扩展头中扩展一个新的TLV携带EPG信息，使得网络设备从新的TLV中即可得到EPG信息，由于免去了配置IP地址与EPG信息之间的对应关系的工作量，因此有助于减少网络设备的配置复杂度。
可选地，所述IPv6扩展头包括一个或多个选项，所述EPG信息包括第一EPG信息和第二EPG信息；所述第一EPG信息和所述第二EPG信息位于所述IPv6扩展头的同一个选项中；或，所述第一EPG信息和所述第二EPG信息分别位于所述IPv6扩展头的不同选项中。
通过在IPv6扩展头中扩展新的选项携带EPG信息，使得网络设备从新的选项中即可得到EPG信息，因此有助于减少网络设备的配置复杂度。
可选地，所述IPv6报文包括位于所述原始报文外层的IPv6头，所述IPv6头的目的IP地址包括虚拟专用网络段标识VPN SID。
通过这种可选方式，利用SRv6-BE技术，通过不同VPN SID区分不同租户的流量，从而实现租户隔离。
可选地，所述IPv6报文包括标识字段，所述标识字段用于指示所述IPv6报文是否已被按照所述EPG信息对应的组策略处理。
通过在IPv6报文中携带标识字段，在IPv6报文途径各个节点的过程中，如果上游节点已经执行了组策略，上游节点可通过标识字段来标识组策略已经被执行，使得下游节点不必重新执行组策略，在同一个组策略沿途只需执行一次的场景下，能够满足这种场景的需求，节省组策略的执行节点之后的节点的处理开销。
可选地，所述EPG信息不在IPv6路由头中，所述IPv6路由头包括段路由头SRH。
通过这种方式，IPv6报文的接收设备无需支持特殊的路由功能(如SR)，即可从IPv6报文中得到EPG信息，因此降低了对接收设备的功能要求。
第二方面，提供了一种报文处理方法，应用于互联网协议第6版IPv6网络，在该方法中，所述IPv6网络中的第二网络设备接收IPv6报文，所述IPv6报文包括IPv6扩展头和原始报文，所述IPv6扩展头包括端点组EPG信息；所述第二网络设备从所述IPv6扩展头中，获得所述EPG信息；所述第二网络设备按照所述EPG信息对应的组策略，对所述IPv6报文进行处理。
可选地，所述EPG信息包括第一EPG信息和第二EPG信息中的至少一项，所述第一EPG信息用于标识第一计算设备所属的EPG，所述原始报文的源互联网协议IP地址包括所述第一计算设备的IP地址，所述第二EPG信息用于标识第二计算设备所属的EPG，所述原始报文的目的IP地址包括所述第二计算设备的IP地址。
可选地，所述IPv6扩展头包括逐跳选项头和目的选项头中的至少一项，所述逐跳选项头和所述目的选项头中的至少一项包括所述EPG信息。
可选地，所述第二网络设备从所述IPv6扩展头中，获得所述EPG信息之后，所述方法还包括：所述第二网络设备根据所述EPG信息，获得所述组策略。
可选地，所述IPv6扩展头包括类型长度值TLV，所述EPG信息位于所述TLV的值字段中。
可选地，所述IPv6扩展头包括一个或多个选项，所述EPG信息包括第一EPG信息和第二EPG信息；所述第一EPG信息和所述第二EPG信息位于所述IPv6扩展头的同一个选项中；或，所述第一EPG信息和所述第二EPG信息分别位于所述IPv6扩展头的不同选项中。
可选地，所述IPv6报文包括位于所述原始报文外层的IPv6头，所述IPv6头的目的IP地址包括虚拟专用网络段标识VPN SID。
可选地，所述IPv6报文包括标识字段，所述标识字段用于指示所述IPv6报文是否已被按照所述EPG信息对应的组策略处理，所述第二网络设备按照所述EPG信息对应的组策略，对所述IPv6报文进行处理之前，所述方法还包括：所述第二网络设备根据所述标识字段的值，确定所述IPv6报文尚未被按照所述组策略处理。
可选地，所述第二网络设备按照所述EPG信息对应的组策略，对所述IPv6报文进行处理，包括：所述第二网络设备更新所述标识字段的值。
可选地，所述EPG信息不在IPv6路由头中，所述IPv6路由头包括段路由头SRH。
第三方面，提供了一种第一网络设备，该第一网络设备具有实现上述第一方面或第一方面任一种可选方式中报文处理的功能。该第一网络设备包括至少一个模块，至少一个模块用于实现上述第一方面或第一方面任一种可选方式所提供的报文处理方法。第三方面提供的第一网络设备的具体细节可参见上述第一方面或第一方面任一种可选方式，此处不再赘述。
第四方面，提供了一种第二网络设备，该第二网络设备具有实现上述第二方面或第二方面任一种可选方式中报文处理的功能。该第二网络设备包括至少一个模块，至少一个模块用于实现上述第二方面或第二方面任一种可选方式所提供的报文处理方法。第四方面提供的第二网络设备的具体细节可参见上述第二方面或第二方面任一种可选方式，此处不再赘述。
第五方面，提供了一种第一网络设备，该第一网络设备包括处理器和通信接口，该处理器用于执行指令，使得该第一网络设备执行上述第一方面或第一方面任一种可选方式所提供的报文处理方法，所述通信接口用于接收报文和发送报文。第五方面提供的第一网络设备的具体细节可参见上述第一方面或第一方面任一种可选方式，此处不再赘述。
第六方面，提供了第二网络设备，该第二网络设备包括处理器和通信接口，该处理器用于执行指令，使得该第二网络设备执行上述第二方面或第二方面任一种可选方式所提供的报文处理方，所述通信接口用于接收报文。第六方面提供的第二网络设备的具体细节可参见上述第二方面或第二方面任一种可选方式，此处不再赘述。
第七方面，提供了一种计算机可读存储介质，该存储介质中存储有至少一条指令，该指令由处理器读取以使第一网络设备执行上述第一方面或第一方面任一种可选方式所提供的报文处理方法。
第八方面，提供了一种计算机可读存储介质，该存储介质中存储有至少一条指令，该指令由处理器读取以使第二网络设备执行上述第二方面或第二方面任一种可选方式所提供的报文处理方法。
第九方面，提供了一种计算机程序产品，当该计算机程序产品在第一网络设备上运行时，使得第一网络设备执行上述第一方面或第一方面任一种可选方式所提供的报文处理方法。
第十方面，提供了一种计算机程序产品，当该计算机程序产品在第二网络设备上运行时，使得第二网络设备执行上述第二方面或第二方面任一种可选方式所提供的报文处理方法。
第十一方面，提供了一种芯片，当该芯片在第一网络设备上运行时，使得第一网络设备执行上述第一方面或第一方面任一种可选方式所提供的报文处理方法。
第十二方面，提供了一种芯片，当该芯片在第二网络设备上运行时，使得第二网络设备执行上述第二方面或第二方面任一种可选方式所提供的报文处理方法。
第十三方面，提供了一种网络系统，该网络系统包括第一网络设备以及第二网络设备，该第一网络设备用于执行上述第一方面或第一方面任一种可选方式所述的方法，该第二网络设备用于执行上述第二方面或第二方面任一种可选方式所述的方法。
第十四方面，提供了一种第一网络设备，该第一网络设备包括：中央处理器、网络处理器和物理接口。所述物理接口用于接收原始报文。所述中央处理器用于根据所述原始报文和端点组EPG信息，生成IPv6报文；所述网络处理器用于触发物理接口发送所述IPv6报文。
可选地，所述第一网络设备包括主控板和接口板，所述中央处理器设置在所述主控板上， 所述网络处理器和所述物理接口设置在接口板上，所述主控板和所述接口板耦合。
在一种可能的实现方式中，主控板和接口板之间建立进程间通信协议(inter-process communication，IPC)通道，主控板和接口板之间通过IPC通道进行通信。
第十五方面，提供了一种第二网络设备，该第二网络设备包括：中央处理器、网络处理器和物理接口。所述物理接口用于接收IPv6报文。所述中央处理器用于从所述IPv6扩展头中，获得所述EPG信息。按照所述EPG信息对应的组策略，对所述IPv6报文进行处理。
可选地，所述第一网络设备包括主控板和接口板，所述中央处理器设置在所述主控板上，所述网络处理器和所述物理接口设置在接口板上，所述主控板和所述接口板耦合。
在一种可能的实现方式中，主控板和接口板之间建立进程间通信协议(inter-process communication，IPC)通道，主控板和接口板之间通过IPC通道进行通信。
附图说明
图1是本申请实施例提供的一种VXLAN头的格式示意图；
图2是本申请实施例提供的一种VXLAN-GPE头的格式示意图；
图3是本申请实施例提供的一种GENEVE头的格式示意图；
图4是本申请实施例提供的一种系统架构100的示意图；
图5是本申请实施例提供的一种系统架构100的示意图；
图6是本申请实施例提供的一种报文处理方法200的流程图；
图7是本申请实施例提供的一种IPv6报文的格式示意图；
图8是本申请实施例提供的一种IPv6头的格式示意图；
图9是本申请实施例提供的一种逐跳选项头或目的选项头的格式示意图；
图10是本申请实施例提供的一种SRH的格式示意图；
图11是本申请实施例提供的一种携带EPG信息的IPv6扩展头的格式示意图；
图12是本申请实施例提供的一种携带EPG信息的逐跳选项头的格式示意图；
图13是本申请实施例提供的一种携带EPG信息的目的选项头的格式示意图；
图14是本申请实施例提供的一种组策略TLV的格式示意图；
图15是本申请实施例提供的一种组策略TLV的格式示意图；
图16是本申请实施例提供的一种组策略选项的格式示意图；
图17是本申请实施例提供的一种携带EPG信息和VPN SID的IPv6报文的格式示意图；
图18是本申请实施例提供的一种封装EPG信息的报头开销的示意图；
图19是本申请实施例提供的一种封装EPG信息的报头开销的示意图；
图20是本申请实施例提供的一种实现微分段的场景示意图；
图21是本申请实施例提供的一种实现微分段的场景示意图；
图22是本申请实施例提供的一种报文处理方法300的流程图；
图23是本申请实施例提供的一种实现微分段的场景示意图；
图24是本申请实施例提供的一种报文处理方法400的流程图；
图25是本申请实施例提供的一种网络设备500的结构示意图；
图26是本申请实施例提供的一种网络设备600的结构示意图；
图27是本申请实施例提供的一种网络设备700的结构示意图；
图28是本申请实施例提供的一种网络设备800的结构示意图；
图29是本申请实施例提供的一种网络系统900的结构示意图。
具体实施方式
为使本申请的目的、技术方案和优点更加清楚，下面将结合附图对本申请实施方式作进一步地详细描述。
本申请中术语“第一”“第二”等字样用于对作用和功能基本相同的相同项或相似项进行区分，应理解，“第一”、“第二”、“第n”之间不具有逻辑或时序上的依赖关系，也不对数量和执行顺序进行限定。还应理解，尽管以下描述使用术语第一、第二等来描述各种元素，但这些元素不应受术语的限制。这些术语只是用于将一元素与另一元素区别分开。例如，在不脱离各种所述示例的范围的情况下，第一EPG信息可以被称为第二EPG信息，并且类似地，第二EPG信息可以被称为第一EPG信息。第一EPG信息和第二EPG信息都可以是EPG信息，并且在某些情况下，可以是单独且不同的EPG信息。
还应理解，术语“如果”可被解释为意指“当...时”(“when”或“upon”)或“响应于确定”或“响应于检测到”。类似地，根据上下文，短语“如果确定...”或“如果检测到[所陈述的条件或事件]”可被解释为意指“在确定...时”或“响应于确定...”或“在检测到[所陈述的条件或事件]时”或“响应于检测到[所陈述的条件或事件]”。
本申请实施例提供的报文处理方法能够应用在数据中心网络、园区网络以及其他各种网络中需要通过微分段技术保障网络边界安全的场景，有助于实现安全管控、简化运维的目的。下面对微分段技术进行简单的介绍。
传统的网络安全模型是边界安全模型，网络的主要威胁来自于外部，只在网络的边界部署防火墙即可。网络内部流量的安全监测需要将流量引流到边界防火墙上进行。随着数据中心、园区等场景下网络的规模增大，网络内租户增多，威胁可能来自于网络内部的用户，使得边界安全模型不再适用。无论南北向流量还是东西向流量都需要经过安全分析，防火墙或者隔离策略需要被分布式部署，此种安全模型为零信任安全模型。其中，南北向流量是指流入数据中心内部的流量或从数据中心流出的流量。东西向流量是指数据中心内部的流量。
有鉴于此，时下能通过微分段(Micro-segmentation)技术实现对东西向流量进行分析，达到安全隔离保护的目的。
微分段，从字面上可以拆分为“微”(Micro)和“分段”(segmentation)两部分。“分段”是指对服务器、终端等网络中的设备进行分组，然后基于组定义组策略，对不同组之间传输的报文或同一组的不同成员之间传输的报文执行组策略。可选地，“微”是指分组的粒度比子网的粒度更细。具体地，在划分子网时，通常仅能基于虚拟局域网(Virtual Local Area Network，VLAN)或VXLAN标识(Virtual Network ID，VNI)实现子网划分，属于不同VLAN/VNI的设备之间相互隔离，属于同一VLAN/VNI的设备之间互通。但是基于子网的粒度太粗，不能实现同一子网内不同服务器之间的隔离，并且当业务变化时，需要重新划分子网。而微分段能够基于互联网协议(Internet Protocol，IP)地址、IP网段、媒体访问控制(Media Access Control，MAC)地址、虚拟机(virtual machine，VM)名、容器、操作系统等进行分组，显然分组的粒度比子网的粒度精细很多，属于相同VLAN的不同设备之间也能通过微分段实现相互隔离，因此实现更细粒度、更加灵活的流量隔离，达到安全管控、简化运维的目 的，保证业务安全。当然，微分段的粒度也可以不比VLAN的粒度更细，此处的描述仅是举例说明。
以上介绍了微分段技术，以下对本申请实施例涉及的微分段技术中的术语概念进行介绍。
(1)EPG
端点组(Endpoint Group，EPG)也称微分段，EPG是指基于(Internet Protocol，IP)地址、IP网段、媒体访问控制(Media Access Control，MAC)地址、虚拟机(virtual machine，VM)名称、容器、操作系统等分组方式，对端点(Endpoint)设备进行的分组。一个EPG包括多个Endpoint设备。同一EPG中的不同Endpoint设备具有相同的特征(如IP网段、VM名称前缀、容器名称前缀等)。
(2)Endpoint设备
Endpoint设备可通过任意计算机一类的具有计算处理能力的设备实现。同一EPG内的不同Endpoint设备可称为EPG的组内成员。属于不同EPG的Endpoint设备可称为EPG的组间成员。
(3)EPG信息
EPG信息用于标识Endpoint设备所属的EPG。EPG信息可以包括多种数据形式，以下通过情况一至情况三举例说明。
情况一、使用EPG的ID标识Endpoint设备所属的EPG。
在情况一下，EPG信息包括EPG的ID，EPG信息也称Group ID、组ID。例如，Endpoint设备为VM1和VM2。VM1所属的EPG为EPG1，VM2所属的EPG为EPG2。在这个例子中，VM1的EPG信息包括“1”，VM2的EPG信息均包括“2”。
情况二、使用IP地址前缀标识Endpoint设备所属的EPG。
在情况二下，同一EPG中的每个Endpoint设备的IP地址前缀相同，EPG信息包括Endpoint设备的IP地址前缀。例如，基于IP网段对Endpoint设备进行了分组，将IP地址前缀均为A1::3:1/80的VM5和VM6划分至同一个EPG，VM5和VM6的EPG信息均包括A1::3:1/80。
情况三、使用接口名来标识Endpoint设备所属的EPG。
在情况三下，EPG信息包括VTEP设备与Endpoint设备相连的接口的接口名，该接口包括而不限于虚拟接口或物理接口。例如，将同一个虚接口连接的VM7和VM8划分至同一EPG，该虚接口的名称为vInf103-1，VM7和VM8的EPG信息均包括vInf103-1。
(4)组策略
组策略(Group Based Policy，GBP)是基于EPG的流量控制策略，组策略用于指示对EPG的组内成员或组间成员之间传输的报文执行的处理动作，通过执行组策略，能够对EPG的组内成员和EPG的组间成员进行访问控制。
组策略对应的处理动作包括多种类型。例如，组策略包括允许(也称permit或allow)、拒绝(也称Deny)、标记、重定向(redirect)和镜像等。当组策略为允许时，网络设备对报文执行的处理动作为转发，从而允许对EPG的组内成员或组间成员之间的互通。当组策略为拒绝时，网络设备对报文执行的处理动作为拒绝，从而禁止对EPG的组内成员或组间成员之间的互通。当组策略为重定向时，网络设备对报文执行的处理动作为将报文重定向至防火墙。标记为一种特殊的转发，当组策略为标记时，网络设备对报文执行的处理动作为先标记报文， 再转发已标记的报文。标记包括而不限于重新标记该报文的区分服务编码点(differentiated services code point，DSCP)或修改报文的优先级等。通过对多种组策略的支持，能够匹配多种网络业务的需求，满足更多的应用场景。
组策略通常会与匹配条件关联起来，组策略与匹配条件之间的对应关系通常通过策略矩阵保存。例如，请参考下表1，表1所示的策略矩阵包括四条组策略。其中，*表示通配符。
表1
Figure PCTCN2021078660-appb-000001
匹配条件也称匹配规则或rule。当报文携带的EPG信息与匹配条件匹配时，网络设备会执行EPG信息对应的组策略。匹配条件中的EPG信息是源Endpoint设备的EPG信息还是目的Endpoint设备的EPG信息包括多种情况，以下通过情况1至情况3举例说明。
情况1、匹配条件包括源Endpoint设备的EPG信息和目的Endpoint设备的EPG信息。
例如，请参考上表1所示的第一条匹配条件，第一条匹配条件包括EPG1和EPG2，EPG1是对源Endpoint设备的EPG信息的举例说明，EPG2是对目的Endpoint设备的EPG信息的举例说明。当报文中携带的源Endpoint设备的EPG信息为EPG1且目的Endpoint设备的EPG信息为EPG2时，报文与第一条匹配条件匹配，网络设备会按照Deny这条组策略，丢弃报文。
情况2、匹配条件包括源Endpoint设备的EPG信息且不包括目的Endpoint设备的EPG信息。
请参考上表1所示的第三条匹配条件，第三条匹配条件包括EPG3和*，EPG3是对源Endpoint设备的EPG信息的举例说明，该匹配条件表示从EPG3向其他所有EPG发送的报文都应该被允许。当报文中携带的源Endpoint设备的EPG信息为EPG3时，报文与第三条匹配条件匹配，网络设备会按照Allow这条组策略，转发报文。在这种方式下，不限定报文的目的Endpoint属于是哪一个EPG，也不限定报文是否携带目的Endpoint的EPG信息。
情况3、匹配条件包括目的Endpoint设备的EPG信息且不包括源Endpoint设备的EPG信息。
请参考上表1所示的第五条匹配条件，第五条匹配条件包括*和EPG6，EPG6是对目的Endpoint设备的EPG信息的举例说明，该匹配条件表示凡是发往EPG6的报文都应该被允许。当报文中携带的目的Endpoint设备的EPG信息为EPG6时，报文与第五条匹配条件匹配，网络设备会按照Allow这条组策略，转发报文。在这种方式下，不限定报文的源Endpoint属于是哪一个EPG，也不限定报文是否携带源Endpoint的EPG信息。
组策略可以包括多种数据形式，表1所示的allow、Deny等仅是对组策略的数据形式的示例，在一些实施例中，组策略也可以通过其他数据形式表示。例如，组策略通过处理动作的编号表示。比如说，为转发这种处理动作分配编号1，为丢弃这种处理动作分配编号2，组 策略可以是1、2这样的数据形式，当组策略为1时，执行组策略即转发报文，当组策略为2时，执行组策略即丢弃报文。又如，组策略通过处理动作对应的指令表示，比如组策略通过伪代码表示。例如，组策略为remark dscp 40，remark dscp 40是标记对应的指令，这条指令指示将报文的DSCP修改为40，网络设备执行组策略即为标记报文。
本实施例并不限定匹配条件仅包括EPG信息。可选地，匹配条件包括EPG信息之外的其他信息，换句话说，网络设备不仅依据报文的EPG信息，还根据报文相关的其他信息判定要执行哪个组策略。例如，匹配条件还包括报文的传输方向，报文的传输方向包括流入(in)和流出(out)。当匹配条件包括in时，网络设备会对接收到的报文执行组策略。当匹配条件包括out时，网络设备会对待发送的报文执行组策略。
以上介绍了微分段技术以及微分段技术中的一些术语概念，以下对微分段的转发场景进行介绍。
在数据中心和园区场景中，会将Endpoint设备接入至VTEP设备(如接入交换机)上，换句话说，每个VTEP设备下挂至少一个Endpoint设备。在部署微分段时，会将组策略和匹配条件配置在VTEP设备上，将Endpoint设备的EPG信息也配置在VTEP设备上。考虑到网络中Endpoint设备的数量往往众多，通常不会将网络中所有的Endpoint设备的EPG信息均配置在每个VTEP设备上，而是将Endpoint设备的EPG信息配置在Endpoint设备接入的VTEP设备上。换句话说，Endpoint设备接入了哪个VTEP设备，就在哪个VTEP设备上配置该Endpoint设备的EPG信息，使得VTEP设备会预先保存下挂的每个Endpoint设备的EPG信息。
在这一技术背景下，同一VTEP设备下不同Endpoint设备之间互相访问与不同VTEP设备下Endpoint设备之间的互相访问在实现时会存在区别，以下通过场景一和场景二分别举例说明。
场景一、同一VTEP设备下不同Endpoint设备之间互相访问。
场景一也称本地转发的场景，原始报文的源Endpoint设备和目的Endpoint设备接入至同一个VTEP设备，由该VTEP设备作为组策略的执行节点。具体地，场景一下，原始报文的转发路径包括源Endpoint设备→VTEP设备→目的Endpoint设备。由于VTEP设备既连接了源Endpoint设备，也连接了目的Endpoint设备，因此源Endpoint设备的EPG信息和了目的Endpoint设备的EPG信息均保存在该VTEP设备上，该VTEP设备能够利用源Endpoint设备的EPG信息和目的Endpoint设备的EPG信息执行组策略。
场景二、不同VTEP设备下Endpoint设备之间互相访问。
场景二也称跨EPG的转发场景，原始报文的源Endpoint设备和目的Endpoint设备分别接入至不同的VTEP设备，通常由目的Endpoint设备接入的VTEP设备作为组策略的执行节点。
以源Endpoint设备接入的VTEP设备称为源VTEP设备，目的Endpoint设备接入的VTEP设备称为目的VTEP设备为例，场景二下，原始报文的转发路径包括源Endpoint设备→源VTEP设备→一个或多个中间节点→目的VTEP设备→目的Endpoint设备。由于源Endpoint设备的EPG信息保存在源VTEP设备上，而未保存在目的VTEP设备上，因此源VTEP设备需要将源Endpoint设备的EPG信息通过某种方式传输至目的VTEP设备，以便目的VTEP设 备利用源Endpoint设备的EPG信息执行组策略。
以上介绍了微分段的两种转发场景。由于本申请的一些实施例侧重描述场景二下如何实现微分段，为了便于理解，以下对微分段在场景二中具体应用的情况进行介绍。
在一种可能的实现中，通过虚拟扩展局域网(Virtual Extensible Local Area Network，VXLAN)报文中的VXLAN头携带EPG信息。例如，请参考图1，图1示出了携带组策略ID(组策略ID，对应于EPG信息)的VXLAN头。具体地，原生VXLAN封装中有多处预留字段，该方法中使用VXLAN报文中的第3和第4字节携带组策略ID，同时将第一个比特(bit)设为标志G(G flag)，当G flag置1时，表示存在组策略ID。当来自源Endpoint设备的流量到达源VTEP设备时，如果源VTEP设备根据路由表判断目的Endpoint设备不与源VTEP设备直接相连，此时源VTEP设备对报文进行VXLAN封装，将VXLAN报文发送到目的Endpoint设备所在的目的VTEP设备。源VTEP设备在进行覆盖(Overlay，也称叠加)封装时，需要根据本地配置，将源Endpoint设备的EPG信息封装在组策略ID中，并将G flag置1。当VXLAN报文到达目的VTEP设备时，目的VTEP设备解VXLAN封装，并缓存组策略ID中的源Endpoint设备的EPG信息，同时根据内层报文的目的地址确定目的Endpoint设备所属的EPG。目的VTEP设备根据源Endpoint设备所属的EPG与目的Endpoint设备所属的EPG，确定要执行的组策略。
而采用上述方式时，会面临两个缺陷。
第一，策略的执行节点与VTEP设备这两种角色耦合。具体地，源Endpoint设备的EPG信息携带在叠加层头(Overlay header)中被传递到目的VTEP设备，因为中间节点不解封装Overlay header，因此源Endpoint设备的EPG信息对中间节点不可见，因此中间节点难以根据源Endpoint设备的EPG信息执行组策略。
第二，扩展性弱。因为VXLAN头的长度固定，预留字段数量有限，通过VXLAN头承载EPG信息后，无法基于Overlay头继续扩展其他特性。
在另一种可能的实现中，基于VXLAN通用协议(VXLAN Generic Protocol Encapsulation，VXLAN-GPE)、通用网络虚拟化封装(Generic Network Virtualization Encapsulation，GENEVE)等Overlay头的扩展头携带EPG信息。例如，请参考图2，图2示出了VXLAN-GPE头与携带EPG信息的扩展头，图3示出了GENEVE头与携带EPG信息的扩展头。图3中长度字段即length字段。版本号字段即version字段。选项长度字段即Opt Len字段。
具体地，VXLAN-GPE和GENEVE中定义了扩展头，可以用来承载EPG信息，此时VXLAN-GPE或GENEVE基本报头中的下一协议(Next protocol，对应于VXLAN-GPE)或协议类型(Protocol Type，对应于GENEVE)字段需要设置为索引EPG信息的对应值。
当来自源Endpoint设备的流量到达源VTEP设备时，如果源VTEP设备根据路由表判断目的Endpoint设备不与源VTEP设备直接相连，源VTEP设备本地没有目的Endpoint设备的EPG信息，此时源VTEP设备需要对报文进行Overlay封装(VXLAN-GPE或者GENEVE封装)并发送到目的Endpoint设备所在的目的VTEP设备。源VTEP设备在进行Overlay封装时，需要根据本地配置，将源Endpoint设备的EPG信息封装在扩展头的组策略ID中，并设置基础报头中的Next Protocol/Protocol Type字段。当VXLAN报文到达目的VTEP设备时， 目的VTEP设备解Overlay封装，并缓存扩展报头中组策略ID中的源Endpoint设备的EPG信息，同时根据内层报文的目的地址确定目的Endpoint设备所属的EPG。目的VTEP设备根据源Endpoint设备所属的EPG和目的Endpoint设备所属的EPG确定要执行的组策略。
另外，报头中可以同时携带源Endpoint设备的EPG信息和目的Endpoint设备的EPG信息。VXLAN-GPE中使用两个组策略扩展报头，且使用1比特区分源Endpoint设备的EPG信息和目的Endpoint设备的EPG信息。GENEVE中使用两个类型长度值(type length value，TLV)，且使用不同的类型(Type)区分源Endpoint设备的EPG信息和目的Endpoint设备的EPG信息。这种情况下，组策略可以在一个集中的网关/防火墙处进行，Overlay隧道需要分成两段，第一段是从源VTEP设备到集中式网关/防火墙，第二段是从集中式网关/防火墙到目的VTEP设备。网关也承担了VTEP设备的角色。此种技术下，源VTEP设备负责查找并封装内层报文源Endpoint设备的EPG信息和目的Endpoint设备的EPG信息，集中式网关/防火墙负责根据EPG信息执行组策略。
而采用上述方式时，会面临两个缺陷。
第一，策略的执行节点与VTEP设备这两种角色耦合。源Endpoint设备的EPG信息和目的Endpoint设备的EPG信息都携带在Overlay header后被传递到目的VTEP，中间节点必须解封装后才能看到源Endpoint设备的EPG信息，由于多出解封装VXLAN头的动作，导致中间节点处理复杂。
第二，封装不够简洁：加上扩展报头后，报头开销更大。
有鉴于此，本申请的一些实施例中，针对不同VTEP设备下Endpoint设备之间互相访问的场景，提供了一种使用IPv6携带EPG信息的方法，在实现微分段的功能的基础上，不再使用VXLAN、VXLAN-GPE或GENEVE等Overlay报头，使得报文封装更加简洁。在一些实施例下，源Endpoint设备的EPG信息和目的Endpoint设备的EPG信息对于中间节点可见，使得组策略能在中间节点执行，因此策略的执行节点与目的VTEP设备的角色解耦，因此组策略的部署更加灵活。
下面，将从系统架构、方法、虚拟装置、实体装置、介质等多个角度，对本申请实施例提供的技术方案进行描述。
下面介绍本申请实施例提供的系统架构。
参见附图4，本申请实施例提供了一种系统架构100。系统架构100是对基于IPv6实现微分段的组网拓扑的举例说明。系统架构100包括多个网络设备和多个计算设备。
网络设备对应于VTEP设备或不同VTEP设备之间的中间节点。网络设备例如是网络设备101、网络设备102、网络设备103或网络设备104。可选地，网络设备101和网络设备103被配置为VTEP设备。网络设备102和网络设备103被配置为报文的转发路径上的中间节点。
计算设备对应于微分段技术中的Endpoint设备。计算设备包括而不限于主机、服务器或个人计算机等。计算设备可以是实体设备，也可以是VM、容器等虚拟化设备。例如，参见附图4，计算设备是VM1、VM2、VM3、VM4、VM5、VM6、VM7或VM8。
系统架构100的网络设备支持IPv6。系统架构100的计算设备可以支持IPv6，也可以不支持IPv6。具体地，网络设备101、网络设备102、网络设备103或网络设备104属于同一个 IPv6网络，网络设备101、网络设备102、网络设备103或网络设备104支持IPv6的路由转发功能。VM1、VM2、VM3、VM4、VM5、VM6、VM7或VM8可以支持IPv6，也可以不支持IPv6而支持IPv4。
网络设备101与VM1、VM2、VM3和VM4相连，网络设备101上保存了VM1、VM2、VM3和VM4这四个VM的EPG信息。其中，VM1和VM2属于同一个EPG：EPG1。VM1的EPG信息用于标识EPG1，VM2的EPG信息用于标识EPG1。VM3和VM4属于同一个EPG：EPG2。VM3的EPG信息用于标识EPG2，VM4的EPG信息用于标识EPG2。此外，网络设备101还与网络设备102和网络设备104相连；网络设备102与网络设备101和网络设备103相连；网络设备104与网络设备101和网络设备103相连；网络设备103与VM5、VM6、VM7和VM8相连，网络设备103上保存了VM5、VM6、VM7和VM8这四个VM的EPG信息。其中，VM5和VM6属于同一个EPG：EPG3。VM1的EPG信息用于标识EPG3，VM2的EPG信息用于标识EPG3。VM7和VM8属于同一个EPG：EPG4。VM3的EPG信息用于标识EPG4，VM4的EPG信息用于标识EPG4。此外，网络设备101还与网络设备102和网络设备104相连；同时，网络设备103还与网络设备102和网络设备104相连。
系统架构100并未限定网络设备101、网络设备103与其对应的VM的具体连接方式，他们可以是直接相连，也可以是通过其他网络设备，如交换机、防火墙等设备与对应的VM相连。如图5所示，网络设备101通过网络设备201与VM1和VM3相连，网络设备101通过网络设备202与VM2和VM4相连。网络设备103通过网络设备203与VM5和VM6相连，网络设备103通过网络设备204与VM7和VM8相连。体现在网络设备101和网络设备103上，其为端点组划分对应的微分段的方式不限定于具体的连接方式，即不仅可以按照他们自身的物理或虚拟接口来进行微分段的划分，也可以基于最终端点组的特征，如IP地址，或DSCP，或两者的结合或更多的特征等来进行微分段的划分。
本领域技术人员可以知晓，系统架构100中的网络设备的数量可以更多或更少。比如上述网络设备可以为几十个或几百个，或者更多数量。本申请实施例对网络设备的数量和设备类型不加以限定。
以上介绍了系统架构100，以下通过方法200、方法300和方法400，示例性介绍基于上文提供的系统架构实现微分段的方法流程。
参见图6，图6是本申请实施例提供的一种报文处理方法200的流程图。
方法200以第一计算设备访问第二计算设备的场景为例，描述跨VTEP设备的EPG组间成员如何基于IPv6实现微分段。在方法200中，原始报文的转发路径包括第一计算设备→第一网络设备→第二网络设备→第二计算设备。
可选地，第一计算设备和第二计算设备对应于微分段技术中的Endpoint设备。第一计算设备对应于源Endpoint设备。第二计算设备对应于目的Endpoint设备。第一计算设备和第二计算设备不在同一个VTEP设备下，换句话说，第一计算设备相连的VTEP设备和第二计算设备相连的VTEP设备不同。第一计算设备和第二计算设备属于不同的EPG，第一计算设备和第二计算设备对应于微分段技术中的EPG的组间成员。
可选地，第一网络设备为第一计算设备相连的VTEP设备，第一网络设备对应于源VTEP设备。其中，源VTEP设备也称入口VTEP设备或Ingress VTEP，源VTEP设备是指与源 Endpoint设备相连的VTEP设备。
第二网络设备是原始报文的转发路径中第一网络设备的下游节点。可选地，第二网络设备为第二计算设备相连的VTEP设备，第二网络设备可对应于目的VTEP设备。或者，第二网络设备为中间节点。其中，目的VTEP设备也称出口VTEP设备或Egress VTEP。目的VTEP设备是指与目的Endpoint设备相连的VTEP设备。中间节点是原始报文的转发路径中源VTEP设备与目的VTEP设备之间的转发节点。中间节点也称非VTEP设备。例如，请参考图4，在VM1访问VM5的场景下，目的VTEP设备是网络设备103，中间节点是网络设备102或网络设备104。
可选地，方法200由系统架构100中的网络设备和计算设备执行。例如，方法200中的第一计算设备是VM1、VM2、VM3或VM4。方法200中第一网络设备是网络设备101。方法200中第二网络设备是网络设备102、网络设备103或网络设备104。方法200中的第二计算设备是VM5、VM6、VM7或VM8。
可选的，方法200由通用中央处理器(central processing unit，CPU)处理，也可以由CPU和网络处理器(network processer，NP)共同处理，也可以不用CPU或NP，而使用其他适合用于报文转发的处理器，本申请不做限制。例如，CPU用于承担S203、S206和S207对应的处理工作，NP用于承担S201、S202、S204、S205和S208对应的处理工作。
示例性地，方法200包括S201至S208。
S201、第一计算设备发送原始报文。
本段对原始报文进行解释说明。原始报文包括而不限于IPv4报文、IPv6报文或者以太网(英文：Ethernet)帧。可选地，原始报文是数据报文。原始报文的源IP地址包括第一计算设备的IP地址。原始报文的目的IP地址包括第二计算设备的IP地址。例如，请参考图4，以VM1访问VM5为例，第一计算设备为VM1，第二计算设备为VM5，VM1向VM5发送原始报文时，原始报文的源IP地址包括VM1的IP地址，原始报文的目的IP地址包括VM5的IP地址。
S202、第一网络设备接收原始报文。
第一网络设备如何接收到原始报文包括多种实现方式。在一种可能的实现中，第一网络设备与第一计算设备位于同一个实体设备中，第一网络设备与第一计算设备通过设备内部的通信方式通信，从而接收到第一计算设备发送的原始报文。例如，第一网络设备与第一计算设备位于同一个服务器中，第一计算设备为服务器中运行的VM，第一网络设备为服务器中的网卡或虚拟机监视器(Hypervisor，也称virtual machine monitor，VMM)。VM发送原始报文后，网卡或Hypervisor会接收到VM发送的原始报文。在另一种可能的实现中，第一网络设备与第一计算设备位于不同的实体设备，第一网络设备与第一计算设备通过网络通信，从而接收到第一计算设备发送的原始报文。例如，第一计算设备为服务器中运行的VM，第一网络设备是与服务器网络连接的数据中心交换机，VM发送原始报文后，数据中心交换机会接收到VM发送的原始报文。
S203、第一网络设备根据原始报文和EPG信息，生成IPv6报文。
第一网络设备根据原始报文，获得EPG信息。第一网络设备将原始报文和EPG信息一起携带在IPv6报文中，得到包括原始报文和EPG信息的IPv6报文。第一网络设备在IPv6报文中携带的EPG信息包括多种情况，以下通过情况一至情况三举例说明。
情况一、第一网络设备在IPv6报文中携带源Endpoint设备的EPG信息。
本实施例以第一计算设备访问第二计算设备的场景为例说明，EPG信息包括第一计算设备的EPG信息或第二计算设备的EPG信息中的至少一项。为了区分描述第一计算设备的EPG信息和第二计算设备的EPG信息，将第一计算设备的EPG信息称为第一EPG信息，将第二计算设备的EPG信息称为第二EPG信息。其中，第一EPG信息是对源Endpoint设备的EPG信息的举例说明，第二EPG信息是对目的Endpoint设备的EPG信息的举例说明。
第一EPG信息用于标识第一计算设备所属的EPG。例如，请参考附图4，VM1向VM5发送原始报文，原始报文从VM1传输至网络设备101(第一网络设备)。在这个例子中，第一计算设备(源Endpoint设备)为VM1，VM1所属的EPG为EPG1，第一EPG信息用于标识EPG1，例如，第一EPG信息为EPG1的ID、VM1的IP地址前缀、VM1的IP地址或VM1与网络设备101相连的接口名称。
情况二、第一网络设备在IPv6报文中携带目的Endpoint设备的EPG信息。
第二EPG信息用于标识第二计算设备所属的EPG。例如，请参考附图4，VM1向VM5发送原始报文，原始报文从VM1传输至网络设备101(第一网络设备)。在这个例子中，第二计算设备(目的Endpoint设备)为VM5，VM5所属的EPG为EPG3，第二EPG信息(目的Endpoint设备的EPG信息)用于标识EPG3，例如，第二EPG信息为EPG3的ID、VM5的IP地址前缀、VM5的IP地址或VM5与网络设备103相连的接口名称。
情况三、第一网络设备在IPv6报文中携带源Endpoint设备的EPG信息和目的Endpoint设备的EPG信息。
具体地，第一网络设备在IPv6报文中携带的EPG信息包括第一EPG信息和第二EPG信息，从而将第一计算设备和第二计算设备的EPG信息均携带在IPv6报文中。
第一网络设备如何根据原始报文获得EPG信息包括多种实现方式。以下通过方式A和方式B举例说明。
方式A、第一网络设备根据原始报文包括的IP地址，确定EPG信息。
具体的，第一网络设备在本地预先保存IP地址与EPG信息之间的对应关系，第一网络设备根据原始报文包括的IP地址，查询IP地址与EPG信息之间的对应关系，得到IP地址对应的EPG信息。例如，第一网络设备根据原始报文的源IP地址，查询IP地址与EPG信息之间的对应关系，得到源IP地址对应的第一EPG信息。又如，第一网络设备根据原始报文包括的目的IP地址，查询IP地址与EPG信息之间的对应关系，得到目的IP地址对应的第二EPG信息。
其中，IP地址与EPG信息之间的对应关系可称为本地匹配策略。例如，IP地址与EPG信息之间的对应关系如以下表2所示。示例性地，第一网络设备接收到原始报文，原始报文的源IP地址为192.168.10.1/32，原始报文的目的IP地址为192.168.20.2/32，第一网络设备查询下表2，确定第一EPG信息为EPG1，并确定第二EPG信息为EPG2。
表2
IP地址 EPG信息
192.168.10.1/32 EPG1
192.168.20.2/32 EPG2
方式B、第一网络设备根据接收到原始报文的接口，确定EPG信息。例如，第一网络设 备保存接口名与EPG信息之间的对应关系，第一网络设备从接口接收到原始报文后，根据该接口的接口名，查询接口名与EPG信息之间的对应关系，得到EPG信息。
上述方式A和方式B仅是对确定EPG信息的举例说明。在另一些实施例中，第一网络设备根据原始报文，识别第一计算设备所属的IP网段、MAC地址、VM名、容器或操作系统，根据识别结果确定EPG信息。
第一网络设备生成的IPv6报文包括IPv6头(IPv6 Header)、IPv6扩展头(IPv6 extension header)和原始报文。IPv6头和IPv6扩展头是IPv6中的两种报头，例如，请参考图7，图7示出了两种结构的IPv6报文，一种IPv6报文包括IPv6头而不包括IPv6扩展头，另一种IPv6报文包括IPv6头和IPv6扩展头的IPv6报文。以下对IPv6头和IPv6扩展头进行介绍。
IPv6头也称IPv6基础报头或IPv6标准头，IPv6头通常是IPv6报文的第一个头，即最外层的头。IPv6头的结构可以参考图8。IPv6头包括版本号(Version)字段、流类型(Traffic Class)字段、流标签(flow label)字段、载荷长度(payload length)字段、下一个头的索引(Next Header)字段、源地址字段、目的地址字段。其中，源地址字段用于携带128比特的源IPv6地址。目的地址字段用于携带128比特的目的IPv6地址。
IPv6扩展头包括多种类型。例如，IPv6扩展头包括逐跳选项头、目的选项头和SRH。以下对几种IPv6扩展头分别进行介绍。
(1)逐跳选项头
逐跳选项头(Hop by hop options header，HBH)是一种IPv6扩展头。逐跳选项头可以由转发过程中途径的每个中间节点处理。在IPv6报文携带逐跳选项头的情况下，逐跳选项头的前一个报头的next header字段的值为0。可选地，逐跳选项头是IPv6头之后的第一个IPv6扩展头，换句话说，逐跳选项头的前一个报头为IPv6头，IPv6头的next header字段的值为0。请参考图9，图9示出了逐跳选项头的结构示意。逐跳选项头包括下一个头的索引字段、扩展头的长度(header Extended Length，简称：Hdr Ext Len)字段和至少一个选项。逐跳选项头中next header字段的值用于指示逐跳选项头之后的第一个报头的类型。逐跳选项头中Hdr Ext Len字段的值用于指示逐跳选项头的长度。逐跳选项头中的选项也称逐跳选项。逐跳选项通常编码为TLV的形式，逐跳选项包括选项类型字段、选项数据长度字段以及值字段。
(2)目的选项头
目的选项头(Destination option Header，DOH)是一种IPv6扩展头。目的选项头由IPv6报文的转发路径中的目的节点处理，该目的节点例如是IPv6头的目的IPv6地址对应的设备。在IPv6报文携带目的选项头的情况下，目的选项头的前一个报头的next header字段的值为60。请参考图9，目的选项头和逐跳选项头的格式类似，目的选项头包括next header字段、Hdr Ext Len字段和至少一个选项。其中，next header字段的值用于指示目的选项头之后的第一个报头的类型。Hdr Ext Len字段的值用于指示目的选项头的长度。目的选项头中的选项也称目的选项。目的选项通常编码为TLV的形式，目的选项包括选项类型字段、选项数据长度字段以及值字段。
(3)SRH
SRH是一种IPv6扩展头。具体地，SRH是一种IPv6路由头(IPv6 Routing Header)。SRH的路由类型(Routing Type)字段的值为4。参见图10，图10是本申请实施例提供的一种SRH的格式示意图。SRH包括段列表、剩余段数量(Segments Left，SL)、一个或多个 TLV、next header字段、Hdr Ext Len字段、Routing Type字段、最后一个元素索引(Last Entry)字段、标志(Flags)字段、用于标识同组数据包的Tag字段等。
如何通过IPv6报文携带EPG信息包括多种实现方式。在一种可能的实现中，请参考图7，第一网络设备利用IPv6扩展头携带EPG信息。具体地，第一网络设备生成包括EPG信息的IPv6扩展头，在原始报文的基础上添加该IPv6扩展头，得到IPv6报文。
通过IPv6扩展头携带的EPG信息包括多种情况，以下通过情况a至情况c举例说明。
情况a、通过IPv6扩展头携带源Endpoint设备的EPG信息。
例如，IPv6扩展头包括第一EPG信息。情况a的效果包括：通过在IPv6报文的IPv6扩展头携带源Endpoint设备的EPG信息，使得源Endpoint设备的EPG信息随着IPv6报文在IPv6网络中转发。组策略的执行节点在转发IPv6报文的过程中，能从IPv6扩展头获得源Endpoint设备的EPG信息，因此免去了预先在组策略的执行节点上配置源Endpoint设备的EPG信息带来的工作量，从而降低了组策略的执行节点的配置复杂度，有助于提高IPv6网络中部署微分段的效率。
情况b、通过IPv6扩展头携带目的Endpoint设备的EPG信息。
例如，IPv6扩展头包括第二EPG信息。情况b的效果包括：通过在IPv6网络中使用IPv6扩展头来传递目的Endpoint设备的EPG信息，使得组策略的执行节点在转发IPv6报文的过程中，能从IPv6扩展头获得目的Endpoint设备的EPG信息，因此免去了预先在组策略的执行节点上配置目的Endpoint设备的EPG信息带来的工作量，从而降低了组策略的执行节点的配置复杂度，有助于提高IPv6网络中部署微分段的效率。
情况c、通过IPv6扩展头携带源Endpoint设备的EPG信息和目的Endpoint设备的EPG信息。
例如，IPv6扩展头包括第一EPG信息和第二EPG信息。情况c的效果包括：通过在IPv6网络中使用IPv6扩展头来传递源Endpoint设备的EPG信息和目的Endpoint设备的EPG信息，使得组策略的执行节点在转发IPv6报文的过程中，能从IPv6扩展头获得源Endpoint设备的EPG信息和目的Endpoint设备的EPG信息，因此免去了预先在组策略的执行节点上配置源Endpoint设备和目的Endpoint设备的EPG信息带来的工作量，从而降低了组策略的执行节点的配置复杂度，有助于提高IPv6网络中部署微分段的效率。
结合EPG信息的多种情况以及IPv6扩展头的多种类型，请参考图11，图11是本申请实施例提供的一种携带EPG信息的IPv6扩展头的格式示意图，如何利用IPv6扩展头携带EPG信息包括多种实现方式，下面通过实现方式一至实现方式三举例说明。
实现方式一、使用逐跳选项头携带EPG信息。
在实现方式一中，第一网络设备生成的IPv6报文包括逐跳选项头，逐跳选项头包括EPG信息。例如请参考图11所示的具有逐跳选项头的IPv6报文，IPv6报文在40字节的IPv6头之后存在8字节的逐跳选项头，EPG信息位于逐跳选项头中。使用逐跳选项头携带的EPG信息包括而不限于源Endpoint设备的EPG信息或目的Endpoint设备的EPG信息中的至少一项，以下通过方式1A至方式1C举例说明。
方式1A、使用逐跳选项头携带源Endpoint设备和目的Endpoint设备的EPG信息。
例如，逐跳选项头包括第一EPG信息和第二EPG信息，例如，请参考图12，图12示出了包括第一EPG信息和第二EPG信息的逐跳选项头，逐跳选项头包括源EPG(Source EPG) 字段和目的EPG(Destination EPG)字段，源EPG字段包括第一EPG信息，目的EPG字段包括第二EPG信息。
方式1B、使用逐跳选项头携带源Endpoint设备的EPG信息。
例如，逐跳选项头包括第一EPG信息。例如，逐跳选项头包括源EPG字段，源EPG字段包括第一EPG信息。
方式1C、使用逐跳选项头携带目的Endpoint设备的EPG信息。
例如，逐跳选项头包括第二EPG信息。例如，逐跳选项头包括目的EPG字段，目的EPG字段包括第二EPG信息。
实现方式一达到的效果包括：由于逐跳选项头是可供中间节点解析的IPv6扩展头，通过使用逐跳选项头携带EPG信息，使得IPv6报文在转发过程中途径中间节点时，中间节点能从逐跳选项头得到源Endpoint设备的EPG信息和/或目的Endpoint设备的EPG信息，换句话说，源Endpoint设备的EPG信息和/或目的Endpoint设备的EPG信息是对中间节点可见的。因此，中间节点能够利用源Endpoint设备的EPG信息和/或目的Endpoint设备的EPG信息执行组策略，从而让中间节点这样的非VTEP设备也能作为组策略的执行节点。一方面，解决了VTEP设备才能支持微分段的局限性问题，为中间节点扩展了支持微分段的功能，从而让微分段适于的应用场景更多。另一方面，通过由中间节点执行组策略，能避免不必要的转发。比如，当组策略中的处理动作为丢弃时，报文会被中间节点丢弃，而不会再占用网络资源向目的VTEP转发。再一方面，相对于VXLAN等overlay报头的封装格式而言，逐跳选项头的封装格式更简洁，逐跳选项头占用的字节更少，因此能够降低报文的传输开销。并且。逐跳选项头的扩展性更强，可通过在逐跳选项头中扩展新的选项来继续支持其他特性。再一方面，这种方式能广泛地应用在支持IPv6的网络设备上，而不必要求中间节点支持SRv6-TE，因此这种方式的普适性更强。再一方面，由于免去在中间节点上预先配置源Endpoint设备和目的Endpoint设备的EPG信息的工作量，因此降低了中间节点的配置复杂度。
实现方式二、使用目的选项头携带EPG信息。
在实现方式二中，第一网络设备生成的IPv6报文包括目的选项头，目的选项头包括EPG信息。例如请参考图11所示的具有目的选项头的IPv6报文，IPv6报文在40字节的IPv6头之后存在8字节的目的选项头，EPG信息位于目的选项头中。使用目的选项头携带的EPG信息包括而不限于源Endpoint设备的EPG信息和目的Endpoint设备的EPG信息中的至少一项，以下通过方式2A至方式2C举例说明。
方式2A、使用目的选项头携带源Endpoint设备的EPG信息。
例如，目的选项头包括第一EPG信息。例如，请参考图13，图13示出了包括第一EPG信息的目的选项头，目的选项头包括源EPG字段，源EPG字段包括第一EPG信息。
方式2B、使用目的选项头携带目的Endpoint设备的EPG信息。
例如，目的选项头包括第二EPG信息。例如，目的选项头包括目的EPG字段，目的EPG字段包括第二EPG信息。
方式2C、使用目的选项头携带源Endpoint设备和目的Endpoint设备的EPG信息。
例如，目的选项头包括第一EPG信息和第二EPG信息。例如，目的选项头包括源EPG字段和目的EPG字段，源EPG字段包括第一EPG信息，目的EPG字段包括第二EPG信息。
实现方式二达到的效果包括：由于目的选项头是供目的节点解析的IPv6扩展头，通过使 用目的选项头携带EPG信息，能够指定由目的节点执行组策略。一方面，相对于VXLAN等overlay报头的封装格式而言，目的选项头的封装格式更简洁，目的选项头占用的字节更少，因此能够降低报文的传输开销。并且。目的选项头的扩展性更强，可通过在目的选项头中扩展新的选项来继续支持其他特性。再一方面，这种方式能广泛地应用在支持IPv6的网络设备上，而不必要求中间节点支持SRv6-TE，因此这种方式的普适性。再一方面，由于免去在目的节点上预先配置源Endpoint设备的EPG信息的工作量，因此降低了目的节点的配置复杂度。
上述实现方式一至实现方式二可以采用结合起来，形成以下实现方式三。
实现方式三、使用逐跳选项头和目的选项头携带EPG信息。
在实现方式三下，第一网络设备生成的IPv6报文包括逐跳选项头和目的选项头，逐跳选项头和目的选项头均包括EPG信息。例如请参考图11所示的具有逐跳选项头和目的选项头的IPv6报文，IPv6报文在40字节的IPv6头之后存在8字节的逐跳选项头和8字节的目的选项头，EPG信息位于逐跳选项头和目的选项头中。可选地，逐跳选项头位于目的选项头之前，逐跳选项头先被接收端解析，目的选项头后被接收端解析。如何利用逐跳选项头和目的选项头这2个IPv6扩展头携带的EPG信息包括多种实现方式，以下通过方式3A至方式3F举例说明。
方式3A、使用逐跳选项头携带源Endpoint设备的EPG信息和目的Endpoint设备的EPG信息，并使用目的选项头携带源Endpoint设备的EPG信息。
例如，第一网络设备生成的IPv6报文包括逐跳选项头和目的选项头，逐跳选项头包括第一EPG信息和第二EPG信息，目的选项头包括第一EPG信息。通过这种方式，在IPv6报文沿途转发的过程中，中间节点能通过逐跳选项头得到源Endpoint设备的EPG信息和目的Endpoint设备的EPG信息，因此中间节点能根据源Endpoint设备的EPG信息和目的Endpoint设备的EPG信息执行组策略。并且，目的VTEP能通过目的选项头得到源Endpoint设备的EPG信息，因此目的VTEP也能根据源Endpoint设备的EPG信息执行组策略。如此，同一个IPv6报文能够被中间节点和目的节点依次执行组策略。其中，中间节点执行的组策略和目的节点执行的组策略相同或不同。
方式3B、使用逐跳选项头携带源Endpoint设备的EPG信息，并使用目的选项头携带源Endpoint设备的EPG信息。
例如，IPv6报文包括逐跳选项头和目的选项头，逐跳选项头包括第一EPG信息，目的选项头包括第一EPG信息。
方式3C、使用逐跳选项头携带目的Endpoint设备的EPG信息，并使用目的选项头携带源Endpoint设备的EPG信息。
例如，IPv6报文包括逐跳选项头和目的选项头，逐跳选项头包括第二EPG信息，目的选项头包括第一EPG信息。
方式3D、使用逐跳选项头携带源Endpoint设备的EPG信息和目的Endpoint设备的EPG信息，并使用目的选项头携带源Endpoint设备的EPG信息和目的Endpoint设备的EPG信息。
例如，IPv6报文包括逐跳选项头和目的选项头，逐跳选项头包括第一EPG信息和第二EPG信息，目的选项头包括第一EPG信息和第二EPG信息。
方式3E、IPv6报文包括逐跳选项头和目的选项头，逐跳选项头包括第一EPG信息，目的选项头包括第一EPG信息和第二EPG信息。
方式3F、IPv6报文包括逐跳选项头和目的选项头，逐跳选项头包括第二EPG信息，目的选项头包括第一EPG信息和第二EPG信息。
以上通过实现方式一至实现方式三，列举了一些利用IPv6扩展头携带EPG信息可能的实现方式。IPv6扩展头除了逐跳选项头和目的选项头之外，还包括IPv6路由头。可选地，不通过IPv6路由头(例如SRH)携带EPG信息，换句话说，EPG信息不在IPv6路由头(例如SRH)中。EPG信息不在IPv6路由头包括多种情况，既包括IPv6报文并不携带IPv6路由头的情况，也包括IPv6报文虽然携带IPv6路由头但EPG信息不在该IPv6路由头的情况。例如，IPv6报文包括逐跳选项头且不包括IPv6路由头(例如SRH)，EPG信息位于逐跳选项头。又如，IPv6报文包括逐跳选项头和IPv6路由头(例如SRH)，EPG信息位于逐跳选项头而不位于IPv6路由头。例如，IPv6报文包括目的选项头且不包括IPv6路由头(例如SRH)，EPG信息位于目的选项头。又如，IPv6报文包括目的选项头和IPv6路由头(例如SRH)，EPG信息位于目的选项头而不位于IPv6路由头。
可选地，通过在IPv6报文中携带标识字段以指明组策略是否已被执行。具体地，IPv6报文包括标识字段，标识字段用于指示IPv6报文是否已被按照EPG信息对应的组策略处理。例如，标识字段在IPv6报文中占一个比特位，若该比特位置位，表示IPv6报文已被按照组策略处理，若比特位未置位，表示IPv6报文尚未被按照组策略处理。可选地，标识字段称为“A”bit。
如何在IPv6报文中携带标识字段包括多种实现方式。例如，通过IPv6扩展头携带标识字段。比如说，通过逐跳选项头携带标识字段，或通过目的选项头携带标识字段。标识字段和EPG信息之间的位置关系包括多种情况。可选地，标识字段和EPG信息在同一个IPv6扩展头中。例如，标识字段和EPG信息在同一个逐跳选项头中。又如，标识字段和EPG信息在同一个目的选项头中。又如，标识字段和EPG信息在同一个选项中。又如，标识字段和EPG信息在同一个TLV中。又如，标识字段和EPG信息在同一个字段中。比如说，IPv6报文中存在一个flag字段，该flag字段的高位比特为标识字段，该flag字段的低位比特携带EPG信息。
通过在IPv6报文中携带标识字段，在IPv6报文途径各个节点的过程中，如果上游节点已经执行了组策略，上游节点可通过标识字段来标识组策略已经被执行，使得下游节点不必重新执行组策略，在同一个组策略沿途只需执行一次的场景下，能够满足这种场景的需求，节省组策略的执行节点之后的节点的处理开销。
利用IPv6扩展头的哪些字段携带EPG信息包括多种实现方式。可选的，通过在IPv6扩展头中扩展新的TLV携带EPG信息。具体地，TLV是一种编码格式，一个TLV包括type字段、长度(length)字段和值(value)字段，IPv6报文中的IPv6扩展头包括TLV，EPG信息位于TLV的值字段中。
以携带EPG信息的TLV称为组策略TLV为例，组策略TLV是指携带了EPG信息的TLV。组策略TLV的值字段包括EPG信息。组策略TLV的类型包括多种情况。可选地，组策略TLV是新的顶级(top)TLV，该组策略TLV的类型(type)字段的值表示未使用的top TLV的类型。可选地，该组策略TLV是top TLV的新的子TLV，该组策略TLV的type字段的值表示未使用的子TLV的类型。可选地，该组策略TLV是top TLV的新的子子TLV(sub-sub-TLV)，该组策略TLV的type是未使用的sub-sub-TLV的类型。本实施例对组策略TLV是top TLV、 sub-TLV还是sub-sub-TLV不做限定。组策略TLV的长度字段用于指示组策略TLV的长度。
如何利用TLV携带EPG信息包括多种实现方式，以下通过实现方式I和实现方式II举例说明。
实现方式I、使用一个TLV携带源Endpoint设备的EPG信息或目的Endpoint设备的EPG信息中的至少一项。
例如，通过一个组策略TLV携带源Endpoint设备的EPG信息，该组策略TLV的值字段包括源EPG字段，源EPG字段包括第一EPG信息。又如，通过一个组策略TLV携带目的Endpoint设备的EPG信息，该组策略TLV的值字段包括目的EPG字段，目的EPG字段包括第二EPG信息。又如，通过一个组策略TLV携带源Endpoint设备的EPG信息和目的Endpoint设备的EPG信息，该组策略TLV的值字段包括源Endpoint设备的EPG信息和目的EPG字段，源EPG字段包括第一EPG信息，目的EPG字段包括第二EPG信息。当通过一个组策略TLV携带源Endpoint设备的EPG信息和目的Endpoint设备的EPG信息时，可选地，源Endpoint设备的EPG信息和目的Endpoint设备的EPG信息占据不同的比特位，根据EPG信息所在的比特位区分EPG信息是源Endpoint设备的EPG信息还是目的Endpoint设备的EPG信息。
实现方式II、使用多个TLV分别携带源Endpoint设备的EPG信息和目的Endpoint设备的EPG信息。
例如，组策略TLV包括源组策略TLV和目的组策略TLV，源组策略TLV的值字段包括源EPG字段，源EPG字段包括第一EPG信息。目的组策略TLV的值字段包括目的EPG字段，目的EPG字段包括第二EPG信息。可选地，源组策略TLV的类型字段的值和目的组策略TLV的类型字段的值不同，换句话说，通过不同的Type区分源组策略TLV和目的组策略TLV。或者，源组策略TLV和目的组策略TLV均包括flag字段，源组策略TLV的flag字段的值和目的组策略TLV的flag字段的值不同，换句话说，通过不同的flag区分源组策略TLV和目的组策略TLV。例如，请参考图14和图15，图14和图15是对组策略TLV的举例说明。
图14所示的组策略TLV中EPG字段用于携带1个Endpoint设备的EPG信息，例如携带源Endpoint设备的EPG信息和目的Endpoint设备的EPG信息。图14所示的组策略TLV中EPG字段例如占据2个字节，组策略TLV的长度字段取值例如为2。
图15所示的组策略TLV中用于携带源Endpoint设备的EPG信息、目的Endpoint设备的EPG信息和标识字段。其中，源EPG字段例如占据2个字节，目的EPG字段例如占据2个字节，标识字段占据1个比特。组策略TLV的长度字段取值例如大于4，比如为5。图15所示的组策略TLV中组策略TLV包括选项类型(OptionType)字段、选项数据长度(Opt Data Len)字段、标识字段、保留字段、源EPG字段和目的EPG字段。OptType字段的值为5，用于指示从OptLen之后的第1个字节至选项的最后一个字节的长度为5个字节。源EPG字段包括第一EPG信息。目的EPG字段包括第二EPG信息。其中，图15所示的源EPG(Source EPG)和源EPG持续(Source EPG con)是同一个字段，这样绘制表达的含义是，图15的一行表示32个比特，源EPG字段包括第一行的最后1个字节和第二行的第1个字节，截止至第一行的最后1个字节时源EPG字段尚未结束，需要持续读取第二行的第1个字节。
通过在IPv6扩展头中扩展一个新的TLV携带EPG信息，使得网络设备从新的TLV中即可得到EPG信息，由于免去了配置IP地址与EPG信息之间的对应关系的工作量，因此有助于减少网络设备的配置复杂度。
结合IPv6扩展头的不同类型，通过IPv6扩展头携带上述组策略TLV包括多种情况，以下通过情况(1)和情况(2)举例说明。
情况(1)通过逐跳选项头携带组策略TLV。
第一网络设备生成的IPv6报文包括逐跳选项头，逐跳选项头包括一个或多个组策略TLV。例如，请参考图12，图12是对逐跳选项头携带组策略TLV的举例说明。图12所示的组策略TLV包括源Endpoint设备的EPG信息(第一EPG信息)、目的Endpoint设备的EPG信息(第二EPG信息)和标识字段。此外，可选地，逐跳选项头还包括填充(Padding)字段，Padding字段用于进行对齐。
情况(2)通过目的选项头携带组策略TLV。
第一网络设备生成的IPv6报文包括目的选项头，目的选项头包括一个或多个组策略TLV。例如，请参考图13，图13是对目的选项头携带组策略TLV的举例说明。图13所示的组策略TLV包括源Endpoint设备的EPG信息(第一EPG信息)。此外，可选地，目的选项头还包括两字节的Padding字段，Padding字段用于进行对齐。
上述情况(1)和情况(2)可以结合，即，通过逐跳选项头和目的选项头携带组策略TLV。具体地，IPv6报文包括逐跳选项头和目的选项头，逐跳选项头和目的选项头均包括组策略TLV。逐跳选项头和目的选项头均包括组策略TLV的情况可以参考上述方式3A至方式3F。例如，参考上述方式3A，逐跳选项头中的组策略TLV包括第一EPG信息和第二EPG信息，目的选项头中的组策略TLV包括第一EPG信息。
通过扩展新的TLV携带EPG信息仅是可选方式。在另一些实施例中，不是通过扩展新的TLV，而是通过其他方式在IPv6扩展头携带EPG信息。例如，在IPv6扩展头中的flag字段携带EPG信息，从而节省策略TLV的type字段和length字段带来的开销。可选地，携带EPG信息的flag字段位于某个预留字段中，或者，携带EPG信息的flag字段位于某个TLV的V字段中，或者，携带EPG信息的flag字段占据原有的flag字段中的一个或多个比特位。
可选地，通过在IPv6扩展头中扩展新的选项(Option)携带EPG信息。具体地，IPv6报文中的IPv6扩展头包括一个或多个选项，EPG信息位于一个或多个选项中。以携带EPG信息的选项称为组策略选项(组策略Option)为例，可选地，使用逐跳选项头携带组策略选项，使得逐跳选项头包括一个或多个组策略选项。或者，使用目的选项头携带组策略选项，使得目的选项头包括一个或多个组策略选项。其中，组策略选项可以编码为TLV的形式，例如，将图14或图15所示的组策略TLV的类型(Type)字段替换为选项类型(OptionType)，将图14或图15所示的组策略TLV的长度(Length)字段替换为选项数据长度(Opt Data Len)字段，即可得到组策略选项的形式。例如，请参考图16，图16是对组策略选项的举例说明。其中，图16中OptLen字段的值为2，用于指示从OptLen之后的第1个比特至选项的最后一个比特之间的长度为2个字节。EPG字段占据2个字节。
使用组策略选项携带EPG信息包括多种情况。以下通过实现方式一至实现方式二举例说明。
方式一、使用一个组策略选项携带EPG信息。
例如，使用一个组策略选项携带源Endpoint设备的EPG信息。例如，IPv6扩展头包括一个组策略选项，该组策略选项包括第一EPG信息。
又如，使用一个组策略选项携带目的Endpoint设备的EPG信息。例如，IPv6扩展头包 括一个组策略选项，该组策略选项包括第二EPG信息。
又如，使用一个组策略选项携带源Endpoint设备和目的Endpoint设备的EPG信息，使得源Endpoint设备的EPG信息和目的Endpoint设备的EPG信息位于同一个选项中。例如，IPv6扩展头包括一个组策略选项，该组策略选项包括第一EPG信息和第二EPG信息。
方式二、使用多个组策略选项携带EPG信息。
例如，使用不同组策略选项分别携带不同Endpoint设备的EPG信息。例如，使用源组策略选项携带源Endpoint设备的EPG信息，使用目的组策略选项携带目的Endpoint设备的EPG信息。例如，源组策略选项包括第一EPG信息，目的组策略选项包括第二EPG信息，换句话说，第一EPG信息和第二EPG信息位于不同选项中。
其中，源组策略选项和目的组策略选项位于相同或不同的IPv6扩展头中。例如，使用同一个逐跳选项头携带源组策略选项和目的组策略选项。又如，使用逐跳选项头携带目的组策略选项，使用目的选项头携带源组策略选项。可选地，源组策略选项和目的组策略选项具有不同的Option type，或者，源组策略选项和目的组策略选项具有相同的Option type，而通过flag字段或者其他字段区分。
通过在IPv6扩展头中扩展新的选项携带EPG信息，使得网络设备从新的选项中即可得到EPG信息，因此有助于减少网络设备的配置复杂度。
可选地，不仅利用IPv6传输EPG信息，还利用尽力而为的段路由(Segment Routing-Best Effort，SR-BE)技术实现租户隔离。具体地，第一网络设备生成的IPv6报文为SRv6-BE报文，IPv6报文不包括SRH，IPv6报文包括位于原始报文外层的IPv6头，IPv6头的目的IP地址包括虚拟专用网络段标识(Virtual Private Network Segment ID，VPN SID)，通过不同VPN SID区分不同租户的流量，从而实现租户隔离。
本段对VPN SID进行介绍。VPN SID是一种互联网协议第6版段路由(英文：internet protocol version 6 for Segment Routing，简称：SRv6)段标识(Segment ID，SID)。VPN SID能起到虚拟专用网络标识(Virtual Private Network ID，VPN ID)，VPN SID能够标识对应的VPN。可选地，在方法200中，VPN SID是目的VTEP设备预先发布的SID，VPN SID的位置信息(Locator)用于定位至目的VTEP设备，VPN SID的功能信息(Function)用于指示目的VTEP设备向VPN实例发送报文。通过使用VPN SID作为IPv6头的目的IP地址，目的VTEP接收到IPv6报文时，使用目的IP地址查询本地SID表(local SID table)时，目的IP地址会命中.local SID table中的VPN SID，则目的VTEP会执行VPN SID对应的操作，将IPv6报文转发至对应的VPN实例，使得IPv6报文从目的VTEP进入对应的VPN，从而实现租户隔离。VPN SID与EPG信息在IPv6报文中的位置关系包括多种情况。例如，VPN SID位于EPG信息的外层。例如，请参见图17，按照从外层至内层的顺序，IPv6报文依次包括VPN SID的IPv6头、携带EPG信息的IPv6扩展头和原始报文。VPN SID的类型包括而不限于End.DX和End.DT。End.DX SID对应的操作包括解封装外层的IPv6报文头、将剩余报文从End.DX SID绑定的出接口转发出去。End.DX包括而不限于End.DX6、End.DX4、End.DX2或End.DX2V。End.DT SID对应的操作包括解封装外层的IPv6报文头、根据剩余报文包括的目的地址查找VPN实例路由表进行转发。End.DT包括而不限于End.DT4或End.DT6。
下面对尽力而为(Best effort)条件下EPG信息的各种封装形式进行比较。
针对携带1个EPG信息的各种封装形式，示例性地，以携带源Endpoint设备的EPG信 息(第一EPG信息)为例，参考图18，使用VXLAN报文封装第一EPG信息时，外层的IPv6头占据40字节，UDP头占据8字节，携带第一EPG信息的VXLAN头占据8字节。使用VXLAN-GPE报文封装第一EPG信息时，外层的IPv6头占据40字节，UDP头占据8字节，VXLAN-GPE头占据8字节。第一EPG信息占据4字节。使用GENEVE报文封装第一EPG信息时，外层的IPv6头占据40字节，UDP头占据8字节，GENEVE头占据8字节。第一EPG信息占据8字节。使用IPv6(SRv6-BE)和目的选项头封装第一EPG信息时，外层的IPv6头占据40字节，携带第一EPG信息的目的选项头占据8字节。使用IPv6(SRv6-BE)和逐跳选项头封装第一EPG信息时，外层的IPv6头占据40字节，携带第一EPG信息的逐跳选项头占据8字节。通过对比可见，通过使用SRv6-BE和逐跳选项头携带第一EPG信息，或使用SRv6-BE和目的选项头携带第一EPG信息，在实现相同功能的情况下，比VXLAN节省8字节，比VXLAN-GPE节省12字节，比GENEVE节省16字节。同理地，在携带目的Endpoint设备的EPG信息(第二EPG信息)的情况下，通过使用SRv6-BE和逐跳选项头携带第二EPG信息，或使用SRv6-BE和目的选项头携带第二EPG信息，同样能在实现相同功能的情况下，比VXLAN节省8字节，比VXLAN-GPE节省12字节，比GENEVE节省16字节。显然，在实现与其他封装方式相同效果的前提下，使用SRv6-BE和IPv6扩展头的封装方式更简洁，显著节省了报头的开销。
针对携带2个EPG信息的各种封装形式，示例性地，以携带第一EPG信息和第二EPG信息为例，请参考图19，通过使用SRv6-BE和逐跳选项头携带第一EPG信息和第二EPG信息，在实现相同功能的情况下，比VXLAN-GPE节省8字节，比GENEVE节省12字节。显然，在实现与其他封装方式相同效果的前提下，使用SRv6-BE和逐跳选项头的封装方式更简洁，显著节省了报头的开销。
如何添加IPv6扩展头包括多种具体的方式，以下通过方式a和方式b举例说明。
方式a、采用封装(Encapsulation)的模式添加IPv6扩展头。
可选地，第一网络设备生成IPv6头和IPv6扩展头，以原始报文为载荷，在原始报文的外层添加IPv6头和IPv6扩展头，得到IPv6报文，从而实现IPv6报文的生成。在原始报文为IP报文的情况下，采用方式a生成的IPv6报文为移动IP数据封装和隧道(IP in IP)报文的形式，生成的IPv6报文包括多个IP头，外层的IP头包括添加的IPv6扩展头，内层的IP头包括原始报文的IP头。例如，如果原始报文为IPv6报文，采用方式a生成的IPv6报文包括两个IPv6头，外层的IPv6头是第一网络设备添加的，内层的IPv6头为原始报文本身的IPv6头。又如，如果原始报文为IPv4报文，采用方式a生成的IPv6报文包括一个IPv6头和一个IPv4头，外层的IPv6头是第一网络设备添加的，内层的IPv4头是原始报文本身的IPv4头。
方式b、采用插入(insert)的模式添加IPv6扩展头。
具体地，第一网络设备生成IPv6扩展头，在原始报文的IPv6头和原始报文的载荷之间插入IPv6扩展头，从而实现IPv6报文的生成。
可选地，在方式b下，第一网络设备无需生成和添加外层的IPv6头，而是利用原始报文原有的IPv6头生成IPv6报文。
S204、第一网络设备发送IPv6报文。
第一网络设备将IPv6报文发送至第二网络设备后，由于IPv6报文包括原始报文和EPG信息，使得原始报文和EPG信息一起传递给第二网络设备。
S205、IPv6网络中的第二网络设备接收IPv6报文。
可选地，第二网络设备接收到IPv6报文后，先识别IPv6报文中的标识字段，第二网络设备根据标识字段的值，判断IPv6报文是否已被按照组策略处理。如果第二网络设备根据标识字段，确定IPv6报文尚未被按照组策略处理，即组策略还没有被上游节点执行，则第二网络设备执行以下S206。
如果第二网络设备根据标识字段，确定IPv6报文已经被按照组策略处理，即组策略已被上游节点执行，第二网络设备执行的动作包括多种情况。可选地，如果组策略已被上游节点执行，则第二网络设备不执行组策略，即，第二网络设备不执行以下S206和S207，而是跳过S206和S207，去执行S208。例如，在标识字段在IPv6报文中占一个比特位的情况下，第二网络设备判断标识字段是否置位，如果标识字段未置位。则第二网络设备确定IPv6报文尚未被按照组策略处理，执行以下S206。如果标识字段已经置位，则第二网络设备确定IPv6报文已被按照组策略处理，不执行以下S206，转发IPv6报文。
可选地，这种技术手段应用在中间节点支持微分段功能的场景。比如说，如果IPv6报文途径的中间节点和目的VTEP设备均支持微分段功能，当IPv6报文被中间节点按照组策略处理后，目的VTEP设备(第二网络设备)根据标识字段的指示，不再对IPv6报文按照组策略处理。又比如说，如果IPv6报文途径的多跳中间节点均支持微分段功能，当IPv6报文被某一跳中间节点按照组策略处理后，执行组策略的中间节点的下游中间节点根据标识字段的指示，不再对IPv6报文按照组策略处理。如此，能够指定IPv6报文仅被一跳中间节点处理，避免同一个组策略被不同节点多次执行带来的转发时延和处理开销。
S206、第二网络设备从IPv6扩展头中，获得EPG信息。
结合携带EPG信息的不同情况，获得EPG信息的过程也包括多种情况，以下通过情况一至情况三举例说明。
情况一、第二网络设备从逐跳选项头中获得EPG信息。
例如，第二网络设备从逐跳选项头中，获得第一EPG信息。又如，第二网络设备从逐跳选项头中，获得第一EPG信息和第二EPG信息。又如，第二网络设备从逐跳选项头中，获得第二EPG信息。
情况二、第二网络设备从目的选项头中获得EPG信息。
例如，第二网络设备从目的选项头中，获得第一EPG信息。又如，第二网络设备从目的选项头中，获得第一EPG信息和第二EPG信息。又如，第二网络设备从目的选项头中，获得第二EPG信息。
情况三、第二网络设备从逐跳选项头和目的选项头中，分别获得不同的EPG信息。
例如，第二网络设备从逐跳选项头获得第一EPG信息，从目的选项头获得第二EPG信息。又如，第二网络设备从逐跳选项头获得第二EPG信息，从目的选项头获得第一EPG信息。
S207、第二网络设备按照EPG信息对应的组策略，对IPv6报文进行处理。
可选地，第二网络设备根据IPv6报文中的EPG信息，获得组策略。具体地，第二网络设备预先获得并保存组策略，第二网络设备接收到IPv6报文后，从IPv6报文中获取EPG信息，根据EPG信息查找到预先保存的组策略。其中，保存组策略的位置包括多种实现方式。可选地，第二网络设备在GBP表项中保存组策略。
如何获得组策略包括多种实现方式，以下通过方式一至方式二举例说明。
方式一、静态配置的方式。
具体地，第二网络设备接收配置指令，第二网络设备根据配置指令获得组策略。可选地，该配置指令通过运维人员的配置操作触发。或者，该配置指令由网管系统、网络应用向第二网络设备下发。
方式二、生产时即预置的方式。
例如，第二网络设备通过在处理器中烧录或者其他硬编码的方式，在出厂时就保存好组策略。
如何按照组策略处理报文包括多种实现方式。具体地，第二网络设备会根据IPv6报文携带的EPG信息，查询策略矩阵，使用IPv6报文携带的EPG信息与匹配条件进行匹配。当IPv6报文携带的EPG信息与匹配条件匹配时，第二网络设备会执行匹配条件对应的组策略。其中，执行组策略的过程即为按照组策略对IPv6报文进行处理的过程。
匹配的方式包括严格匹配的方式和最长匹配的方式。严格匹配的方式是指，当IPv6报文中的EPG信息完全满足匹配条件时，确定EPG信息满足匹配条件。采用严格匹配的方式时，被完全满足的匹配条件对应的处理动作会被执行。最长匹配的方式是指，确定IPv6报文中的EPG信息与每个匹配条件之间的匹配长度，找到匹配长度最长的匹配条件，将匹配长度最长的匹配条件作为被满足的匹配条件。采用最长匹配的方式时，匹配长度最长的匹配条件对应的处理动作会被执行。可选地，当存在多条匹配长度相等的组策略时，执行第一条命中组策略，或执行最后一条命中的组策略，或执行最高优先级命中的组策略。其中，如何计算匹配长度包括多种实现方式。例如，将第一EPG信息与匹配条件中的源Endpoint设备的EPG信息匹配，若两个EPG信息匹配，则将匹配长度加一。并且，将第二EPG信息与匹配条件中的目的Endpoint设备的EPG信息匹配，若两个EPG信息匹配，则将匹配长度加一。
IPv6报文携带源Endpoint设备的EPG信息且不携带目的Endpoint设备的EPG信息的情况、IPv6报文携带目的Endpoint设备的EPG信息且不携带源Endpoint设备的EPG信息的情况、IPv6报文携带源Endpoint设备的EPG信息和目的Endpoint设备的EPG信息的情况下，第二网络设备均能够执行S207，实现微分段的功能，以下通过实现方式A至实现方式C，对IPv6报文携带源Endpoint设备的EPG信息与目的Endpoint设备的EPG信息中的一者的情况下如何实现微分段进行举例说明。
实现方式A、预先保存IP地址与EPG信息之间的对应关系。
具体地，第二网络设备预先保存了Endpoint设备的IP地址与EPG信息之间的对应关系，在IPv6报文携带源Endpoint设备的EPG信息且不携带目的Endpoint设备的EPG信息的情况下，当第二网络设备接收到IPv6报文时，不仅从IPv6报文的IPv6扩展头获得第一EPG信息，还根据IPv6报文包括的目的IP地址，查询IP地址与EPG信息之间的对应关系，得到第二EPG信息，按照第一EPG信息和第二EPG信息对应的组策略，对IPv6报文进行处理。在IPv6报文携带目的Endpoint设备的EPG信息且不携带源Endpoint设备的EPG信息的情况下，当第二网络设备接收到IPv6报文时，不仅从IPv6报文的IPv6扩展头获得第二EPG信息，还根据IPv6报文包括的源IP地址，查询IP地址与EPG信息之间的对应关系，得到第一EPG信息，按照第一EPG信息和第二EPG信息对应的组策略，对IPv6报文进行处理。
实现方式B、组策略的匹配条件包括源Endpoint设备的EPG信息或目的Endpoint设备的 EPG信息中的一者。
例如，组策略的匹配条件包括源Endpoint设备的EPG信息且不包括目的Endpoint设备的EPG信息，比如说组策略的匹配条件为EPG1 to*，当第二网络设备接收到IPv6报文时，从IPv6报文的IPv6扩展头获得第一EPG信息，使用第一EPG信息与EPG1进行匹配即可。采用这种方式时，IPv6报文可以仅携带源Endpoint设备的EPG信息而不携带目的Endpoint设备的EPG信息。
又如，第二网络设备是防火墙一类的设备，组策略对应的匹配条件包括目的Endpoint设备的EPG信息且不包括源Endpoint设备的EPG信息，比如说组策略的匹配条件为*to EPG1。当第二网络设备接收到IPv6报文时，从IPv6报文的IPv6扩展头获得第二EPG信息，使用第二EPG信息与EPG1进行匹配即可。采用这种方式时，IPv6报文可以仅携带目的Endpoint设备的EPG信息而不携带源Endpoint设备的EPG信息。
实现方式C、按照最长匹配的方式的查找组策略。
例如，在判断IPv6报文中的EPG信息与组策略的匹配条件的EPG信息是否匹配时，并不要求组策略中的源Endpoint设备的EPG信息和目的Endpoint设备的EPG信息均被匹配，当组策略中的源Endpoint设备的EPG信息和目的Endpoint设备的EPG信息中的一者被匹配时，组策略与IPv6报文之间的匹配长度就会被加一。那么，当IPv6报文中携带源Endpoint设备的EPG信息和目的Endpoint设备的EPG信息中的一者时，与源Endpoint设备的EPG信息和目的Endpoint设备的EPG信息中的一者匹配的组策略具有被执行的概率。
按照组策略对报文的处理方式包括多种情况，以下通过S2071至S2074举例说明。
S2071、当组策略为丢弃时，第二网络设备丢弃IPv6报文，结束流程。
S2072、当组策略为镜像时，第二网络设备向指定的地址镜像IPv6报文，结束流程。
S2073、当组策略为重定向时，第二网络设备更改IPv6报文的目的地址，结束流程。
S2074、当组策略为转发或标记时，第二网络设备执行以下S308。
S208、第二网络设备发送原始报文。
具体地，第二网络设备根据IPv6报文中外层的IPv6头的目的IP地址，对IPv6报文进行转发处理。在转发处理的过程中，第二网络设备至少会发送IPv6报文中的原始报文，而是否发送外层的IPv6头以及IPv6扩展头包括多种情况，以下通过情况A至情况C举例说明。
情况A、第二网络设备剥离外层的IPv6头和IPv6扩展头，发送内层的原始报文。情况A适于第二网络设备为目的VTEP设备的场景。
情况B、第二网络设备剥离IPv6扩展头，发送外层的IPv6头和内层的原始报文。
在情况B下，第二网络设备并不剥离外层的IPv6头。以下通过情况B1和情况B2举例说明。
情况B1、外层的IPv6头用于供下游的中间节点路由转发。
情况B1适于第二网络设备为中间节点的场景。例如，中间节点根据IPv6扩展头(如逐跳选项头)中的EPG信息执行组策略后，就去除IPv6扩展头，将剩余的IPv6报文转发给下一跳中间节点，该剩余的IPv6报文包括外层的IPv6头和内层的原始报文，以便下一跳中间节点根据外层的IPv6头进行路由转发。
情况B2、外层的IPv6头是原始报文本身携带的报头。
例如，在原始报文是IPv6报文的情况下，第二网络设备接收的IPv6报文中外层的IPv6 头可以不是第一网络设备添加的，而是原始报文本身携带的。在这一情况下，第二网络设备不剥离IPv6头，以便将原始报文本身携带的IPv6头传递给下一跳节点。
可选地，情况B2应用在第二网络设备是尾节点的情况，尾节点不剥离IPv6头，而剥离IPv6扩展头，将剥离后的报文发送至用户边缘(Customer Edge，CE)节点，以使CE节点接收到的报文保留了原始报文自身的IPv6头且不包含路由转发过程中添加的IPv6扩展头。当然，情况B2也可以应用在第二网络设备是中间节点的情况。
情况C、第二网络设备不剥离IPv6扩展头，发送外层的IPv6头、IPv6扩展头和内层的原始报文。情况C适于第二网络设备为中间节点的场景。例如，IPv6扩展头(如逐跳选项头)不仅携带执行组策略所需的EPG信息，还携带一些其他转发面所需使用的信息，比如说网络分片的分片标识、要求的时延、要求的带宽等，中间节点根据IPv6扩展头中的EPG信息执行组策略后，将包括IPv6头、IPv6扩展头和原始报文的IPv6报文转发给下一跳中间节点，以便下一跳中间节点使用IPv6扩展头中的信息。
可选地，IPv6报文为SRv6-BE报文，IPv6报文外层的IPv6头中的目的IP地址为VPN SID，以下通过方式1、方式2和方式3，对SRv6-BE场景下第二网络设备如何转发报文进行举例说明。其中，方式1关于使用SRv6-BE时目的VTEP设备如何转发报文，方式2关于使用SRv6-BE时不支持SRv6的中间节点如何转发报文，方式3关于使用SRv6-BE时支持SRv6的中间节点如何转发报文。
方式1、第二网络设备根据外层的IPv6头中的目的IP地址，查询Local SID表，确定目的地址与本地SID表中的VPN SID匹配，则剥掉IPv6头和IPv6扩展头，向VPN实例(如第二计算设备或与第二计算设备相连的CE设备)发送原始报文，使得原始报文最终转发至第二计算设备。例如，第二网络设备根据Local SID表，判定目的IP地址的类型为End.DX，则第二网络设备将原始报文从End.DX SID绑定的出接口发送出去。又如，第二网络设备根据Local SID表，判定目的IP地址的类型为End.DT，则根据原始报文中的目的地址，查询VPN实例路由表进行转发。
方式2、第二网络设备根据外层的IPv6头中的目的IP地址，查询IPv6的路由转发表，按照IPv6的路由转发表，对IPv6报文进行最长匹配转发，使得IPv6报文被转发至目的VTEP设备。
方式3、第二网络设备根据外层的IPv6头中的目的IP地址，先查询Local SID表，确定目的地址与本地SID表中的每个SID均不匹配，则再查询IPv6的路由转发表，按照IPv6的路由转发表，对IPv6报文进行最长匹配转发，使得IPv6报文被转发至目的VTEP设备。
可选地，在IPv6报文包括标识字段的情况下，第二网络设备先更新标识字段的值，再转发更新了标识字段的IPv6报文。例如，在第二网络设备为中间节点的情况下，第二网络设备不仅执行组策略，还将标识字段置位，向下游的中间节点发送标识字段置位的、被按照组策略处理后的IPv6报文。通过这种可选方式，由于策略的执行节点在执行组策略后更新了标识字段，能够指明组策略已经被执行过，使得IPv6报文后续转发过程中，不必被重复执行组策略，因此减少了策略的执行节点的下游节点的处理开销。
本实施例提供了一种在IPv6网络中实现微分段的方法通过使用IPv6报文的IPv6扩展头携带EPG信息，使得EPG信息对IPv6报文的接收端可见，以便IPv6报文的接收端不需要解封装VXLAN头，即可根据IPv6扩展头中的EPG信息执行组策略，从而实现微分段的功能， 降低处理复杂度。且由于IPv6扩展头的扩展性更强，因此解决了通过VXLAN头携带EPG信息存在的扩展性弱的问题，有助于继续扩展新的功能。并且，由于报文的封装格式更加简洁，报头占用的字节更少，因此节省了传输报文带来的开销。
以上方法200介绍了一种基于IPv6实现微分段的方法，以下通过方法300和方法400，对方法200分别进行举例说明。
请参考图20和图21，在下面的方法300中，第一计算设备(源Endpoint设备)为VM1，第一网络设备为源VTEP设备，第二网络设备为目的VTEP设备，第二计算设备(目的Endpoint设备)为VM4。换句话说，方法300描述的方法流程关于VM1访问VM4的过程中目的VTEP设备如何基于IPv6执行组策略。方法300与方法F00同理的步骤还请参见方法F00，在方法S00中不做赘述。
图20示出了通过服务器实现VTEP设备的场景，VTEP设备是服务器中的虚拟交换机，虚拟交换机可通过Hypervisor或网卡实现。例如，源VTEP设备是VM1所在的服务器中的虚拟交换机1。目的VTEP设备是VM4所在的服务器中的虚拟交换机2。
图21示出了通过网络设备实现VTEP设备的场景，VTEP设备是网络设备(比如数据中心TOR交换机)。例如，源VTEP设备是Leaf1。目的VTEP设备是Leaf2。
请参考图22，示例性地，方法300包括S301至S308。
S301、VM1发送原始报文。
S302、IPv6网络中的源VTEP设备接收原始报文。
例如，请参考图20或图21，报文流的传输方向为从VM1至VM4。VM1发送原始报文，原始报文到达源VTEP设备。源VTEP设备根据原始报文的IP地址，识别VM1所属的EPG为Group B，并判定原始报文的目的端VM4不在源VTEP设备下，则执行S303。
S303、源VTEP设备根据原始报文和VM1的EPG信息，生成IPv6报文，IPv6报文的目的选项头包括VM1的EPG信息。
VM1的EPG信息是对方法200中的第一EPG信息(源Endpoint设备的EPG信息)的举例说明。VM1的EPG信息用于标识VM1所属的EPG，例如，如果VM1所属的EPG为EPG B，VM1的EPG信息是为EPG B的ID。源VTEP设备将EPG B的ID封装在目的选项头中，例如封装在目的选项头中的TLV中。源VTEP设备向原始报文封装目的选项头，封装完成后向目的VTEP设备的方向进行转发。
S304、源VTEP设备发送IPv6报文。
S305、IPv6网络中的目的VTEP设备接收IPv6报文。
S306、目的VTEP设备从目的选项头中，获得VM1的EPG信息。
方法300中，目的VTEP设备具有两个角色：VTEP设备和组策略的执行节点。报文到达目的VTEP后，目的VTEP设备从目的选项头中的TLV读取并缓存VM1的EPG信息。
S307、目的VTEP设备按照VM1的EPG信息和VM4的EPG信息对应的组策略，对IPv6报文进行处理。
VM4的EPG信息是对方法200中的第二EPG信息(目的Endpoint设备的EPG信息)的举例说明。VM4的EPG信息用于标识VM4所属的EPG。具体地，目的VTEP设备解外层IPv6封装，暴露原始报文，目的VTEP设备根据原始报文中的目的IP地址，匹配到VM4的 EPG信息。目的VTEP设备根据VM1的EPG信息和VM4的EPG信息，查找策略矩阵得出对应的组策略；目的VTEP设备根据组策略对原始报文进行处理。
S308、目的VTEP设备向VM4发送原始报文。
本实施例提供了一种目的VTEP设备基于IPv6网络执行组策略的方法，利用IPv6的目的选项头携带源Endpoint设备的EPG信息，使得源Endpoint设备的EPG信息通过目的选项头传递给目的VTEP设备，因此目的VTEP设备不需要解封装VXLAN头，即可根据源Endpoint设备的EPG信息执行组策略，从而实现微分段的功能，降低处理复杂度。且由于目的选项头的扩展性更强，因此解决了通过VXLAN头携带EPG信息存在的扩展性弱的问题，有助于继续扩展新的功能。并且，由于目的选项头的封装格式更简洁，报文外层封装Overhead更小，因此节省了传输报文带来的开销。
请参考图23，在下面的方法400中，第一计算设备为VM1，第一网络设备为源VTEP设备，第二网络设备为中间节点，第二计算设备为VM4。换句话说，方法400描述的方法流程关于VM1访问VM4的过程中间节点如何基于IPv6执行组策略。方法400与方法200或方法300同理的步骤还请参见方法200或方法300，在方法400中不做赘述。
请参考图24，示例性地，方法400包括S401至S409。
S401、VM1发送原始报文。
S402、IPv6网络中的源VTEP设备接收原始报文。
S403、源VTEP设备根据原始报文、VM1的EPG信息和VM4的EPG信息，生成IPv6报文，IPv6报文包括逐跳选项头和原始报文，逐跳选项头包括VM1的EPG信息和VM4的EPG信息。
VM1的EPG信息是对方法200中的第一EPG信息(源Endpoint设备的EPG信息)的举例说明。VM4的EPG信息是对方法200中的第二EPG信息(目的Endpoint设备的EPG信息)的举例说明。具体地，在方法400中，数据中心服务器上的vSwitch作为VTEP设备，VTEP设备根据内层的原始报文的源IP地址、目的IP地址和本地表项信息，查找VM1的EPG信息和VM4的EPG信息，将VM1的EPG信息和VM4的EPG信息封装在IPv6的逐跳选项头中，转发封装了逐跳选项头的IPv6报文。
S404、源VTEP设备发送IPv6报文。
S405、IPv6网络中的中间节点接收IPv6报文。
S406、中间节点从逐跳选项头中，获得VM1的EPG信息和VM4的EPG信息。
S407、中间节点按照VM1的EPG信息和VM4的EPG信息对应的组策略，对IPv6报文进行处理。
由于逐跳选项头携带了源Endpoint设备的EPG信息和目的Endpoint设备的EPG信息，转发路径上的任一跳中间节点都可以根据源Endpoint设备的EPG信息和目的Endpoint设备的EPG信息执行组策略。其中，中间节点例如是数据中心叶(Leaf)交换机或脊(Spine)交换机。例如，图23示出了在Spine交换机上执行组策略。其中，当组策略为转发或标记时，中间节点执行以下S408。当组策略为丢弃时，中间节点结束流程。
S408、中间节点发送IPv6报文。
S409、目的VTEP设备接收IPv6报文，对IPv6报文解封装，得到原始报文，向VM4发 送原始报文。
本实施例提供了一种中间节点基于IPv6网络执行组策略的方法，利用IPv6的逐跳选项头携带源Endpoint设备的EPG信息和目的Endpoint设备的EPG信息，使得源Endpoint设备的EPG信息和目的Endpoint设备的EPG信息通过逐跳选项头传递给中间节点，因此中间节点不需要解封装VXLAN头，即可根据源Endpoint设备和目的Endpoint设备的EPG信息执行组策略，从而实现微分段的功能，降低处理复杂度。且由于逐跳选项头的扩展性更强，因此解决了通过VXLAN头携带EPG信息存在的扩展性弱的问题，有助于继续扩展新的功能。一方面，由于逐跳选项头的封装格式更简洁，报文外层封装Overhead更小，因此节省了传输报文带来的开销。另一方面，打破了仅能由VTEP设备执行组策略的限制，将策略的执行节点与VTEP设备的角色解耦，使得中间节点也能够执行组策略，从而支持微分段的功能。另一方面，中间节点执行组策略时不需要解外层封装，因此免去了解外层封装的处理开销，简化了处理流程。
以上介绍了本申请实施例的方法200、方法300和方法400，以下介绍本申请实施例的网络设备，以下介绍的网络设备具有上述方法200、方法300或方法400中第一网络设备或第二网络设备的任意功能。
图25是本申请实施例提供的一种网络设备500的结构示意图，如图25所示，网络设备500包括：接收模块501，用于执行S202、S302或S402；生成模块502，用于执行S203、S303或S403；发送模块503，用于执行S204、S304或S404。
网络设备500对应于上述方法实施例中的第一网络设备，网络设备500中的各模块和上述其他操作和/或功能分别为了实现方法实施例中的第一网络设备所实施的各种步骤和方法，具体细节可参见上述方法200、方法300或方法400，为了简洁，在此不再赘述。
网络设备500在处理报文时，仅以上述各功能模块的划分进行举例说明，实际应用中，可以根据需要而将上述功能分配由不同的功能模块完成，即将网络设备500的内部结构划分成不同的功能模块，以完成以上描述的全部或者部分功能。另外，上述实施例提供的网络设备500与上述方法200、方法300或方法400属于同一构思，其具体实现过程详见方法200、方法300或方法400，这里不再赘述。
图26是本申请实施例提供的一种网络设备600的结构示意图，如图26所示，网络设备600包括：接收模块601，用于执行S205、S305或S405；获得模块602，用于执行S206、S306或S406；处理模块603，用于执行S207、S307或S407。
网络设备600对应于上述方法实施例中的第二网络设备，网络设备600中的各模块和上述其他操作和/或功能分别为了实现方法实施例中的第二网络设备所实施的各种步骤和方法，具体细节可参见上述方法200、方法300或方法400，为了简洁，在此不再赘述。
网络设备600在处理报文时，仅以上述各功能模块的划分进行举例说明，实际应用中，可以根据需要而将上述功能分配由不同的功能模块完成，即将网络设备600的内部结构划分成不同的功能模块，以完成以上描述的全部或者部分功能。另外，上述实施例提供的网络设备600与上述方法200、方法300或方法400属于同一构思，其具体实现过程详见方法200、方法300或方法400，这里不再赘述。
与本申请提供的方法实施例以及虚拟装置实施例相对应，本申请实施例还提供了一种网络设备，下面对网络设备的硬件结构进行介绍。
下面描述的网络设备700或网络设备800对应于上述方法实施例中的第一网络设备或第二网络设备，网络设备700或网络设备800中的各硬件、模块和上述其他操作和/或功能分别为了实现方法实施例中的网络设备700或网络设备800所实施的各种步骤和方法，关于网络设备700或网络设备800如何基于IPv6实现微分段的详细流程，具体细节可参见上述方法实施例，为了简洁，在此不再赘述。其中，上文方法200、方法300或方法400的各步骤通过网络设备700或网络设备800处理器中的硬件的集成逻辑电路或者软件形式的指令完成。结合本申请实施例所公开的方法的步骤可以直接体现为硬件处理器执行完成，或者用处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存储器，闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器，处理器读取存储器中的信息，结合其硬件完成上述方法的步骤。为避免重复，这里不再详细描述。
网络设备700或网络设备800对应于上述虚拟装置实施例中的网络设备500或网络设备600，网络设备500或网络设备600中的每个功能模块采用网络设备700或网络设备800的软件实现。换句话说，网络设备500或网络设备600包括的功能模块为网络设备700或网络设备800的处理器读取存储器中存储的程序代码后生成的。
参见图27，图27示出了本申请一个示例性实施例提供的网络设备700的结构示意图，该网络设备700可以配置为第一网络设备或第二网络设备。该网络设备700可以由一般性的总线体系结构来实现。
网络设备700包括至少一个处理器701、通信总线702、存储器703以及至少一个通信接口704。
处理器701可以是一个通用CPU、NP、微处理器、或者可以是一个或多个用于实现本申请方案的集成电路，例如，专用集成电路(application-specific integrated circuit，ASIC)，可编程逻辑器件(programmable logic device，PLD)或其组合。上述PLD可以是复杂可编程逻辑器件(complex programmable logic device，CPLD)，现场可编程逻辑门阵列(field-programmable gate array，FPGA)，通用阵列逻辑(generic array logic，GAL)或其任意组合。
通信总线702用于在上述组件之间传送信息。通信总线702可以分为地址总线、数据总线、控制总线等。为便于表示，图27中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
存储器703可以是只读存储器(read-only memory，ROM)或可存储静态信息和指令的其它类型的静态存储设备，也可以是随机存取存储器(random access memory，RAM)或者可存储信息和指令的其它类型的动态存储设备，也可以是电可擦可编程只读存储器(electrically erasable programmable read-only Memory，EEPROM)、只读光盘(compact disc read-only memory，CD-ROM)或其它光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘存储介质或者其它磁存储设备，或者是能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其它介质，但不 限于此。存储器703可以是独立存在，并通过通信总线702与处理器701相连接。存储器703也可以和处理器701集成在一起。
通信接口704使用任何收发器一类的装置，用于与其它设备或通信网络通信。通信接口704包括有线通信接口，还可以包括无线通信接口。其中，有线通信接口例如可以为以太网接口。以太网接口可以是光接口，电接口或其组合。无线通信接口可以为无线局域网(wireless local area networks，WLAN)接口，蜂窝网络通信接口或其组合等。
在具体实现中，作为一种实施例，处理器701可以包括一个或多个CPU，如图27中所示的CPU0和CPU1。
在具体实现中，作为一种实施例，网络设备700可以包括多个处理器，如图27中所示的处理器701和处理器705。这些处理器中的每一个可以是一个单核处理器(single-CPU)，也可以是一个多核处理器(multi-CPU)。这里的处理器可以指一个或多个设备、电路、和/或用于处理数据(如计算机程序指令)的处理核。
在具体实现中，作为一种实施例，网络设备700还可以包括输出设备706和输入设备707。输出设备706和处理器701通信，可以以多种方式来显示信息。例如，输出设备706可以是液晶显示器(liquid crystal display，LCD)、发光二级管(light emitting diode，LED)显示设备、阴极射线管(cathode ray tube，CRT)显示设备或投影仪(projector)等。输入设备707和处理器701通信，可以以多种方式接收用户的输入。例如，输入设备707可以是鼠标、键盘、触摸屏设备或传感设备等。
在一些实施例中，存储器703用于存储执行本申请方案的程序代码710，处理器701可以执行存储器703中存储的程序代码710。也即是，网络设备700可以通过处理器701以及存储器703中的程序代码710，来实现方法实施例提供的方法200、方法300或方法400。
本申请实施例的网络设备700可对应于上述各个方法实施例中的第一网络设备或第二网络设备，并且，该网络设备700中的处理器701、通信接口704等可以实现上述各个方法实施例中的第一网络设备或第二网络设备所具有的功能和/或所实施的各种步骤和方法。为了简洁，在此不再赘述。
网络设备500中的接收模块501、发送模块503相当于网络设备700中的通信接口704；网络设备500中的生成模块502可以相当于网络设备700中的处理器701。
网络设备600中的接收模块601相当于网络设备700中的通信接口704；网络设备600中的获得模块602和处理模块603可以相当于网络设备700中的处理器701。
参见图28，图28示出了本申请一个示例性实施例提供的网络设备800的结构示意图，该网络设备800可以配置为第一网络设备或第二网络设备。网络设备800包括：主控板810和接口板830。
主控板810也称为主处理单元(main processing unit，MPU)或路由处理卡(route processor card)，主控板810用于对网络设备800中各个组件的控制和管理，包括路由计算、设备管理、设备维护、协议处理功能。主控板810包括：中央处理器811和存储器812。
接口板830也称为线路接口单元卡(line processing unit，LPU)、线卡(line card)或业务板。接口板830用于提供各种业务接口并实现数据包的转发。业务接口包括而不限于以太网接口、POS(Packet over SONET/SDH)接口等，以太网接口例如是灵活以太网业务接口 (Flexible Ethernet Clients，FlexE Clients)。接口板830包括：中央处理器831、网络处理器832、转发表项存储器834和物理接口卡(physical interface card，PIC)833。
接口板830上的中央处理器831用于对接口板830进行控制管理并与主控板810上的中央处理器811进行通信。
网络处理器832用于实现报文的转发处理。网络处理器832的形态可以是转发芯片。具体而言，网络处理器832用于基于转发表项存储器834保存的转发表转发接收到的报文，如果报文的目的地址为网络设备800的地址，则将该报文上送至CPU(如中央处理器811)处理；如果报文的目的地址不是网络设备800的地址，则根据该目的地址从转发表中查找到该目的地址对应的下一跳和出接口，将该报文转发到该目的地址对应的出接口。其中，上行报文的处理包括：报文入接口的处理，转发表查找；下行报文的处理：转发表查找等等。
物理接口卡833用于实现物理层的对接功能，原始的流量由此进入接口板830，以及处理后的报文从该物理接口卡833发出。物理接口卡833也称为子卡，可安装在接口板830上，负责将光电信号转换为报文并对报文进行合法性检查后转发给网络处理器832处理。在一些实施例中，中央处理器也可执行网络处理器832的功能，比如基于通用CPU实现软件转发，从而物理接口卡833中不需要网络处理器832。
可选地，网络设备800包括多个接口板，例如网络设备800还包括接口板840，接口板840包括：中央处理器841、网络处理器842、转发表项存储器844和物理接口卡843。
可选地，网络设备800还包括交换网板820。交换网板820也可以称为交换网板单元(switch fabric unit，SFU)。在网络设备有多个接口板830的情况下，交换网板820用于完成各接口板之间的数据交换。例如，接口板830和接口板840之间可以通过交换网板820通信。
主控板810和接口板830耦合。例如。主控板810、接口板830和接口板840，以及交换网板820之间通过系统总线与系统背板相连实现互通。在一种可能的实现方式中，主控板810和接口板830之间建立进程间通信协议(inter-process communication，IPC)通道，主控板810和接口板830之间通过IPC通道进行通信。
在逻辑上，网络设备800包括控制面和转发面，控制面包括主控板810和中央处理器831，转发面包括执行转发的各个组件，比如转发表项存储器834、物理接口卡833和网络处理器832。控制面执行路由器、生成转发表、处理信令和协议报文、配置与维护设备的状态等功能，控制面将生成的转发表下发给转发面，在转发面，网络处理器832基于控制面下发的转发表对物理接口卡833收到的报文查表转发。控制面下发的转发表可以保存在转发表项存储器834中。在有些实施例中，控制面和转发面可以完全分离，不在同一设备上。
如果网络设备800被配置为第一网络设备，物理接口卡833接收原始报文，发送给网络处理器832，网络处理器832根据原始报文和EPG信息，生成IPv6报文，根据出接口等信息，在完成链路层封装后，将IPv6报文从物理接口卡833发送出去，使得IPv6报文传输至第二网络设备。
如果网络设备800被配置为第二网络设备，物理接口卡833接收IPv6报文，发送给网络处理器832，网络处理器832从IPv6扩展头中，获得EPG信息；按照EPG信息对应的组策略，对IPv6报文进行处理。
网络设备500中的接收模块501，发送模块503相当于网络设备800中的物理接口卡833；网络设备500中的生成模块502可以相当于网络处理器832或中央处理器811。
网络设备600中的接收模块601相当于网络设备800中的物理接口卡833；网络设备600中的获得模块602和处理模块603可以相当于网络处理器832或中央处理器811。
本申请实施例中接口板840上的操作与接口板830的操作一致，为了简洁，不再赘述。本实施例的网络设备800可对应于上述各个方法实施例中的第一网络设备或第二网络设备，该网络设备800中的主控板810、接口板830和/或840可以实现上述各个方法实施例中的第一网络设备或第二网络设备所具有的功能和/或所实施的各种步骤，为了简洁，在此不再赘述。
值得说明的是，主控板可能有一块或多块，有多块的时候可以包括主用主控板和备用主控板。接口板可能有一块或多块，网络设备的数据处理能力越强，提供的接口板越多。接口板上的物理接口卡也可以有一块或多块。交换网板可能没有，也可能有一块或多块，有多块的时候可以共同实现负荷分担冗余备份。在集中式转发架构下，网络设备可以不需要交换网板，接口板承担整个系统的业务数据的处理功能。在分布式转发架构下，网络设备可以有至少一块交换网板，通过交换网板实现多块接口板之间的数据交换，提供大容量的数据交换和处理能力。所以，分布式架构的网络设备的数据接入和处理能力要大于集中式架构的设备。可选地，网络设备的形态也可以是只有一块板卡，即没有交换网板，接口板和主控板的功能集成在该一块板卡上，此时接口板上的中央处理器和主控板上的中央处理器在该一块板卡上可以合并为一个中央处理器，执行两者叠加后的功能，这种形态设备的数据交换和处理能力较低(例如，低端交换机或路由器等网络设备)。具体采用哪种架构，取决于具体的组网部署场景，此处不做任何限定。
在一些可能的实施例中，上述第一网络设备或第二网络设备可以实现为虚拟化设备。
例如，虚拟化设备可以是运行有用于发送报文功能的程序的虚拟机(英文：Virtual Machine，VM)，虚拟机部署在硬件设备上(例如，物理服务器)。虚拟机指通过软件模拟的具有完整硬件系统功能的、运行在一个完全隔离环境中的完整计算机系统。可以将虚拟机配置为第一网络设备或第二网络设备。例如，可以基于通用的物理服务器结合网络功能虚拟化(Network Functions Virtualization，NFV)技术来实现第一网络设备或第二网络设备。第一网络设备或第二网络设备为虚拟主机、虚拟路由器或虚拟交换机。本领域技术人员通过阅读本申请即可结合NFV技术在通用物理服务器上虚拟出具有上述功能的第一网络设备或第二网络设备。此处不再赘述。
例如，虚拟化设备可以是容器，容器是一种用于提供隔离的虚拟化环境的实体，例如，容器可以是docker容器。可以将容器配置为第一网络设备或第二网络设备。例如，可以通过对应的镜像来创建出第一网络设备或第二网络设备，例如可以通过proxy-container(提供代理服务的容器)的镜像，为proxy-container创建2个容器实例，分别是容器实例proxy-container1、容器实例proxy-container2，将容器实例proxy-container1提供为第一网络设备或第一计算设备，将容器实例proxy-container2提供为第二网络设备或第二计算设备。采用容器技术实现时，第一网络设备或第二网络设备可以利用物理机的内核运行，多个第一网络设备或第二网络设备可以共享物理机的操作系统。通过容器技术可以将不同的第一网络设备或第二网络设备隔离开来。容器化的第一网络设备或第二网络设备可以在虚拟化的环境中运行，例如可以在虚拟机中运行，容器化的第一网络设备或第二网络设备可也可以直接在物理机中运行。
例如，虚拟化设备可以是Pod，Pod是Kubernetes(Kubernetes是谷歌开源的一种容器编排引擎，英文简称为K8s)为部署、管理、编排容器化应用的基本单位。Pod可以包括一个或多个容器。同一个Pod中的每个容器通常部署在同一主机上，因此同一个Pod中的每个容器可以通过该主机进行通信，并且可以共享该主机的存储资源和网络资源。可以将Pod配置为第一网络设备或第二网络设备。例如，具体地，可以指令容器即服务(英文全称：container as a service，英文简称：CaaS，是一种基于容器的PaaS服务)来创建Pod，将Pod提供为第一网络设备或第二网络设备。
当然，第一网络设备或第二网络设备还可以是其他虚拟化设备，在此不做一一列举。
在一些可能的实施例中，上述第一网络设备或第二网络设备也可以由通用处理器来实现。例如，该通用处理器的形态可以是一种芯片。具体地，实现第一网络设备或第二网络设备的通用处理器包括处理电路和与该处理电路内部连接通信的输入接口以及输出接口，该处理电路用于通过输入接口执行上述各个方法实施例中的报文的生成步骤，该处理电路用于通过输入接口执行上述各个方法实施例中的接收步骤，该处理电路用于通过输出接口执行上述各个方法实施例中的发送步骤。可选地，该通用处理器还可以包括存储介质，该处理电路用于通过存储介质执行上述各个方法实施例中的存储步骤。存储介质可以存储处理电路执行的指令，该处理电路用于执行存储介质存储的指令以执行上述各个方法实施例。
参见图29，本申请实施例提供了一种网络系统900，所述系统900包括：第一网络设备901和第二网络设备902。可选的，第一网络设备901为如网络设备500、网络设备700或网络设备800，第二网络设备902为网络设备600、网络设备700或网络设备800。
本申请实施例提供了一种计算机程序产品，当该计算机程序产品在第一网络设备或第二网络设备上运行时，使得第一网络设备或第二网络设备执行上述方法实施例中的方法200、方法300或方法400。
本申请实施例提供了一种芯片，当该芯片在第一网络设备或第二网络设备上运行时，使得第一网络设备或第二网络设备执行上述方法实施例中的方法200、方法300或方法400。
上述各种产品形态的网络设备，分别具有上述方法实施例中第一网络设备或第二网络设备的任意功能，此处不再赘述。
本领域普通技术人员可以意识到，结合本文中所公开的实施例中描述的各方法步骤和单元，能够以电子硬件、计算机软件或者二者的结合来实现，为了清楚地说明硬件和软件的可互换性，在上述说明中已经按照功能一般性地描述了各实施例的步骤及组成。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。本领域普通技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
所属领域的技术人员可以清楚地了解到，为了描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参见前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，该单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集 成到另一个系统，或一些特征可以忽略，或不执行。另外，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口、装置或单元的间接耦合或通信连接，也可以是电的，机械的或其它的形式连接。
该作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本申请实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以是两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
该集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分，或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例中方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(read-only memory，ROM)、随机存取存储器(random access memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
以上描述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到各种等效的修改或替换，这些修改或替换都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以权利要求的保护范围为准。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。该计算机程序产品包括一个或多个计算机程序指令。在计算机上加载和执行该计算机程序指令时，全部或部分地产生按照本申请实施例中的流程或功能。该计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。该计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，该计算机程序指令可以从一个网站站点、计算机、服务器或数据中心通过有线或无线方式向另一个网站站点、计算机、服务器或数据中心进行传输。该计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。该可用介质可以是磁性介质(例如软盘、硬盘、磁带)、光介质(例如，数字视频光盘(digital video disc，DVD)、或者半导体介质(例如固态硬盘)等。
本领域普通技术人员可以理解实现上述实施例的全部或部分步骤可以通过硬件来完成，也可以通过程序来指令相关的硬件完成，该程序可以存储于一种计算机可读存储介质中，上述提到的存储介质可以是只读存储器，磁盘或光盘等。
以上描述仅为本申请的可选实施例，并不用以限制本申请，凡在本申请的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本申请的保护范围之内。

Claims (34)

  1. 一种报文处理方法，其特征在于，应用于互联网协议第6版IPv6网络，所述方法包括：
    所述IPv6网络中的第一网络设备接收原始报文；
    所述第一网络设备根据所述原始报文和端点组EPG信息，生成IPv6报文，所述IPv6报文包括IPv6扩展头和所述原始报文，所述IPv6扩展头包括所述EPG信息；
    所述第一网络设备发送所述IPv6报文。
  2. 根据权利要求1所述的方法，其特征在于，所述EPG信息包括第一EPG信息和第二EPG信息中的至少一项，所述第一EPG信息用于标识第一计算设备所属的EPG，所述原始报文的源互联网协议IP地址包括所述第一计算设备的IP地址，所述第二EPG信息用于标识第二计算设备所属的EPG，所述原始报文的目的IP地址包括所述第二计算设备的IP地址。
  3. 根据权利要求1或2所述的方法，其特征在于，所述IPv6扩展头包括逐跳选项头和目的选项头中的至少一项，所述逐跳选项头和所述目的选项头中的至少一项包括所述EPG信息。
  4. 根据权利要求1所述的方法，其特征在于，所述IPv6扩展头包括类型长度值TLV，所述EPG信息位于所述TLV的值字段中。
  5. 根据权利要求1所述的方法，其特征在于，所述IPv6扩展头包括一个或多个选项，所述EPG信息包括第一EPG信息和第二EPG信息；
    所述第一EPG信息和所述第二EPG信息位于所述IPv6扩展头的同一个选项中；或，所述第一EPG信息和所述第二EPG信息分别位于所述IPv6扩展头的不同选项中。
  6. 根据权利要求1所述的方法，其特征在于，所述IPv6报文包括位于所述原始报文外层的IPv6头，所述IPv6头的目的IP地址包括虚拟专用网络段标识VPN SID。
  7. 根据权利要求1所述的方法，其特征在于，所述IPv6报文包括标识字段，所述标识字段用于指示所述IPv6报文是否已被按照所述EPG信息对应的组策略处理。
  8. 一种报文处理方法，其特征在于，应用于互联网协议第6版IPv6网络，所述方法包括：
    所述IPv6网络中的第二网络设备接收IPv6报文，所述IPv6报文包括IPv6扩展头和原始报文，所述IPv6扩展头包括端点组EPG信息；
    所述第二网络设备从所述IPv6扩展头中，获得所述EPG信息；
    所述第二网络设备按照所述EPG信息对应的组策略，对所述IPv6报文进行处理。
  9. 根据权利要求8所述的方法，其特征在于，所述EPG信息包括第一EPG信息和第二EPG信息中的至少一项，所述第一EPG信息用于标识第一计算设备所属的EPG，所述原始报文的源互联网协议IP地址包括所述第一计算设备的IP地址，所述第二EPG信息用于标识 第二计算设备所属的EPG，所述原始报文的目的IP地址包括所述第二计算设备的IP地址。
  10. 根据权利要求8或9所述的方法，其特征在于，所述IPv6扩展头包括逐跳选项头或目的选项头中的至少一项，所述逐跳选项头和所述目的选项头中的至少一项包括所述EPG信息。
  11. 根据权利要求8所述的方法，其特征在于，所述第二网络设备从所述IPv6扩展头中，获得所述EPG信息之后，所述方法还包括：
    所述第二网络设备根据所述EPG信息，获得所述组策略。
  12. 根据权利要求8所述的方法，其特征在于，所述IPv6扩展头包括类型长度值TLV，所述EPG信息位于所述TLV的值字段中。
  13. 根据权利要求8所述的方法，其特征在于，所述IPv6扩展头包括一个或多个选项，所述EPG信息包括第一EPG信息和第二EPG信息；
    所述第一EPG信息和所述第二EPG信息位于所述IPv6扩展头的同一个选项中；或，所述第一EPG信息和所述第二EPG信息分别位于所述IPv6扩展头的不同选项中。
  14. 根据权利要求8所述的方法，其特征在于，所述IPv6报文包括位于所述原始报文外层的IPv6头，所述IPv6头的目的IP地址包括虚拟专用网络段标识VPN SID。
  15. 根据权利要求8所述的方法，其特征在于，所述IPv6报文包括标识字段，所述标识字段用于指示所述IPv6报文是否已被按照所述EPG信息对应的组策略处理，所述第二网络设备按照所述EPG信息对应的组策略，对所述IPv6报文进行处理之前，所述方法还包括：
    所述第二网络设备根据所述标识字段的值，确定所述IPv6报文尚未被按照所述组策略处理。
  16. 根据权利要求15所述的方法，其特征在于，所述第二网络设备按照所述EPG信息对应的组策略，对所述IPv6报文进行处理，包括：
    所述第二网络设备更新所述标识字段的值。
  17. 一种第一网络设备，其特征在于，所述设备应用于互联网协议第6版IPv6网络，所述设备包括：
    接收模块，用于接收原始报文；
    生成模块，用于根据所述原始报文和端点组EPG信息，生成IPv6报文，所述IPv6报文包括IPv6扩展头和所述原始报文，所述IPv6扩展头包括所述EPG信息；
    发送模块，用于发送所述IPv6报文。
  18. 根据权利要求17所述的设备，其特征在于，所述EPG信息包括第一EPG信息和第二EPG信息中的至少一项，所述第一EPG信息用于标识第一计算设备所属的EPG，所述原始报文的源互联网协议IP地址包括所述第一计算设备的IP地址，所述第二EPG信息用于标识 第二计算设备所属的EPG，所述原始报文的目的IP地址包括所述第二计算设备的IP地址。
  19. 根据权利要求17或18所述的设备，其特征在于，所述IPv6扩展头包括逐跳选项头和目的选项头中的至少一项，所述逐跳选项头和所述目的选项头中的至少一项包括所述EPG信息。
  20. 根据权利要求17所述的设备，其特征在于，所述IPv6扩展头包括类型长度值TLV，所述EPG信息位于所述TLV的值字段中。
  21. 根据权利要求17所述的设备，其特征在于，所述IPv6扩展头包括一个或多个选项，所述EPG信息包括第一EPG信息和第二EPG信息；
    所述第一EPG信息和所述第二EPG信息位于所述IPv6扩展头的同一个选项中；或，所述第一EPG信息和所述第二EPG信息分别位于所述IPv6扩展头的不同选项中。
  22. 根据权利要求17所述的设备，其特征在于，所述IPv6报文包括位于所述原始报文外层的IPv6头，所述IPv6头的目的IP地址包括虚拟专用网络段标识VPN SID。
  23. 根据权利要求17所述的设备，其特征在于，所述IPv6报文包括标识字段，所述标识字段用于指示所述IPv6报文是否已被按照所述EPG信息对应的组策略处理。
  24. 一种第二网络设备，其特征在于，所述设备应用于互联网协议第6版IPv6网络，所述设备包括：
    接收模块，用于接收IPv6报文，所述IPv6报文包括IPv6扩展头和原始报文，所述IPv6扩展头包括端点组EPG信息；
    获得模块，用于从所述IPv6扩展头中，获得所述EPG信息；
    处理模块，用于按照所述EPG信息对应的组策略，对所述IPv6报文进行处理。
  25. 根据权利要求24所述的设备，其特征在于，所述EPG信息包括第一EPG信息和第二EPG信息中的至少一项，所述第一EPG信息用于标识第一计算设备所属的EPG，所述原始报文的源互联网协议IP地址包括所述第一计算设备的IP地址，所述第二EPG信息用于标识第二计算设备所属的EPG，所述原始报文的目的IP地址包括所述第二计算设备的IP地址。
  26. 根据权利要求24或25所述的设备，其特征在于，所述IPv6扩展头包括逐跳选项头和目的选项头中的至少一项，所述逐跳选项头和所述目的选项头中的至少一项包括所述EPG信息。
  27. 根据权利要求24所述的设备，其特征在于，所述获得模块，还用于根据所述EPG信息，获得所述组策略。
  28. 根据权利要求24所述的设备，其特征在于，所述IPv6扩展头包括类型长度值TLV，所述EPG信息位于所述TLV的值字段中。
  29. 根据权利要求24所述的设备，其特征在于，所述IPv6扩展头包括一个或多个选项，所述EPG信息包括第一EPG信息和第二EPG信息；
    所述第一EPG信息和所述第二EPG信息位于所述IPv6扩展头的同一个选项中；或，所述第一EPG信息和所述第二EPG信息分别位于所述IPv6扩展头的不同选项中。
  30. 根据权利要求24所述的设备，其特征在于，所述IPv6报文包括位于所述原始报文外层的IPv6头，所述IPv6头的目的IP地址包括虚拟专用网络段标识VPN SID。
  31. 根据权利要求24所述的设备，其特征在于，所述IPv6报文包括标识字段，所述标识字段用于指示所述IPv6报文是否已被按照所述EPG信息对应的组策略处理，所述设备还包括：确定模块，用于根据所述标识字段的值，确定所述IPv6报文尚未被按照所述组策略处理。
  32. 根据权利要求31所述的设备，其特征在于，所述处理模块，还用于更新所述标识字段的值。
  33. 一种网络系统，其特征在于，所述网络系统包括第一网络设备和第二网络设备，所述第一网络设备为权利要求17至23任一项的所述第一网络设备，所述第二网络设备为权利要求24至32任一项的所述第二网络设备。
  34. 一种计算机可读存储介质，其特征在于，所述存储介质中存储有至少一条指令，所述指令由处理器读取以使网络设备执行如权利要求1至权利要求16中任一项所述的方法。
PCT/CN2021/078660 2020-03-31 2021-03-02 报文处理方法、设备、系统及存储介质 WO2021196952A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP21780245.3A EP4109830A4 (en) 2020-03-31 2021-03-02 PACKET PROCESSING METHOD, DEVICE, SYSTEM, AND STORAGE MEDIA
US17/936,593 US20230043721A1 (en) 2020-03-31 2022-09-29 Packet Processing Method, Device, System, and Storage Medium

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010245961.4A CN113472650A (zh) 2020-03-31 2020-03-31 报文处理方法、设备、系统及存储介质
CN202010245961.4 2020-03-31

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/936,593 Continuation US20230043721A1 (en) 2020-03-31 2022-09-29 Packet Processing Method, Device, System, and Storage Medium

Publications (1)

Publication Number Publication Date
WO2021196952A1 true WO2021196952A1 (zh) 2021-10-07

Family

ID=77866082

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/078660 WO2021196952A1 (zh) 2020-03-31 2021-03-02 报文处理方法、设备、系统及存储介质

Country Status (4)

Country Link
US (1) US20230043721A1 (zh)
EP (1) EP4109830A4 (zh)
CN (1) CN113472650A (zh)
WO (1) WO2021196952A1 (zh)

Families Citing this family (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116346716A (zh) * 2021-12-24 2023-06-27 华为技术有限公司 报文处理方法及装置、通信系统
WO2023125767A1 (zh) * 2021-12-31 2023-07-06 华为技术有限公司 一种报文传输方法、网络设备及系统
CN114697230B (zh) * 2022-03-18 2023-12-15 国网浙江省电力有限公司绍兴市上虞区供电公司 一种基于零信任的能源站安全监控系统及方法
CN115002808B (zh) * 2022-05-31 2024-05-03 中国联合网络通信集团有限公司 一种信息转发方法、装置、设备及存储介质
CN115134275B (zh) * 2022-06-06 2024-06-18 中国信息通信研究院 利用IPv6逐跳扩展头实现单向网络测试的方法、电子设备及存储介质
WO2024041064A1 (zh) * 2022-08-25 2024-02-29 华为技术有限公司 Quic报文的传输方法及相关设备
US11831548B1 (en) * 2022-11-29 2023-11-28 Ciena Corporation Distinguishing SRv6 micro-SID destination address from IPv6 destination address

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102088391A (zh) * 2009-12-07 2011-06-08 华为技术有限公司 一种IPv6报文的处理方法、设备和系统
US20180191673A1 (en) * 2016-12-29 2018-07-05 Riverbed Technology, Inc. AUTO DISCOVERY BETWEEN PROXIES IN AN IPv6 NETWORK
CN109218158A (zh) * 2017-07-05 2019-01-15 中国电信股份有限公司 基于VxLAN的数据传输方法、控制方法及控制器、网关、中间网元和系统
CN109428888A (zh) * 2017-08-31 2019-03-05 柯尼卡美能达美国研究所有限公司 具有用于ipv6扩展头和目的地选项的应用的方法和系统
CN109728990A (zh) * 2017-10-31 2019-05-07 中兴通讯股份有限公司 一种隧道的建立方法、装置和软件定义网络控制器

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109861924B (zh) * 2017-11-30 2022-06-21 中兴通讯股份有限公司 报文的发送、处理方法及装置，pe节点，节点
CN110650075B (zh) * 2018-06-26 2022-02-18 华为技术有限公司 基于vxlan的组策略实现方法、网络设备和组策略实现系统
US10567293B1 (en) * 2018-08-23 2020-02-18 Cisco Technology, Inc. Mechanism to coordinate end to end quality of service between network nodes and service provider core

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102088391A (zh) * 2009-12-07 2011-06-08 华为技术有限公司 一种IPv6报文的处理方法、设备和系统
US20180191673A1 (en) * 2016-12-29 2018-07-05 Riverbed Technology, Inc. AUTO DISCOVERY BETWEEN PROXIES IN AN IPv6 NETWORK
CN109218158A (zh) * 2017-07-05 2019-01-15 中国电信股份有限公司 基于VxLAN的数据传输方法、控制方法及控制器、网关、中间网元和系统
CN109428888A (zh) * 2017-08-31 2019-03-05 柯尼卡美能达美国研究所有限公司 具有用于ipv6扩展头和目的地选项的应用的方法和系统
CN109728990A (zh) * 2017-10-31 2019-05-07 中兴通讯股份有限公司 一种隧道的建立方法、装置和软件定义网络控制器

Also Published As

Publication number Publication date
CN113472650A (zh) 2021-10-01
EP4109830A4 (en) 2023-08-16
US20230043721A1 (en) 2023-02-09
EP4109830A1 (en) 2022-12-28

Similar Documents

Publication Publication Date Title
WO2021196952A1 (zh) 报文处理方法、设备、系统及存储介质
US20230078123A1 (en) Method for Forwarding Packet in SRV6 Service Function Chain and SF Device
WO2021135420A1 (zh) 业务链的故障保护方法、装置、设备、系统及存储介质
US20150355934A1 (en) Method for generating configuration information, and network control unit
CN112953831A (zh) 一种报文转发方法及装置
WO2022001835A1 (zh) 发送报文的方法、装置、网络设备、系统及存储介质
US20220255772A1 (en) Packet sending method, apparatus, and system
US11595303B2 (en) Packet handling in software-defined net working (SDN) environments
WO2022078415A1 (zh) 报文转发方法以及网络设备
EP4175248A1 (en) Route advertisement method and related device
WO2021093372A1 (zh) 一种数据报文的处理方法、设备、存储介质及系统
WO2022012489A1 (zh) 一种能力通告方法及相关设备
US20230327986A1 (en) Route Advertisement Method, Apparatus, and System
WO2022222750A1 (zh) 报文转发方法、装置、网络设备及存储介质
CN114024888A (zh) 一种路由通告方法及相关设备
EP4175252A1 (en) Router advertisement method and related device
EP4333390A1 (en) Packet processing method, apparatus and system
US20230224245A1 (en) Packet Transmission Method and Apparatus
EP4207644A1 (en) Message transmission method and apparatus, device, and computer readable storage medium
US20240214298A1 (en) Method, apparatus, device, and system for transmitting network layer reachability information, and medium
BR102021023868A2 (pt) Aparelho e método de comunicação
CN116938830A (zh) 报文转发方法、装置及系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21780245

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2021780245

Country of ref document: EP

Effective date: 20220922

NENP Non-entry into the national phase

Ref country code: DE