WO2022017099A1 - 通信方法、cp设备及nat设备 - Google Patents

通信方法、cp设备及nat设备 Download PDF

Info

Publication number
WO2022017099A1
WO2022017099A1 PCT/CN2021/101344 CN2021101344W WO2022017099A1 WO 2022017099 A1 WO2022017099 A1 WO 2022017099A1 CN 2021101344 W CN2021101344 W CN 2021101344W WO 2022017099 A1 WO2022017099 A1 WO 2022017099A1
Authority
WO
WIPO (PCT)
Prior art keywords
address
nat
user
nat device
port block
Prior art date
Application number
PCT/CN2021/101344
Other languages
English (en)
French (fr)
Inventor
花荣荣
余舟毅
彭涛
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to MX2023000974A priority Critical patent/MX2023000974A/es
Priority to BR112023000834A priority patent/BR112023000834A2/pt
Priority to EP21846084.8A priority patent/EP4184873A4/en
Publication of WO2022017099A1 publication Critical patent/WO2022017099A1/zh
Priority to US18/157,662 priority patent/US20230171223A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/74—Address processing for routing
    • H04L45/741—Routing in networks with a plurality of addressing schemes, e.g. with both IPv4 and IPv6
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/09—Mapping addresses
    • H04L61/25—Mapping addresses of the same type
    • H04L61/2503—Translation of Internet protocol [IP] addresses
    • H04L61/2521—Translation architectures other than single NAT servers
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/2854—Wide area networks, e.g. public data networks
    • H04L12/2856—Access arrangements, e.g. Internet access
    • H04L12/2869—Operational details of access network equipments
    • H04L12/287—Remote access server, e.g. BRAS
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/302—Route determination based on requested QoS
    • H04L45/304—Route determination for signalling traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/76—Routing in software-defined topologies, e.g. routing between virtual machines
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/09—Mapping addresses
    • H04L61/25—Mapping addresses of the same type
    • H04L61/2503—Translation of Internet protocol [IP] addresses
    • H04L61/251—Translation of Internet protocol [IP] addresses between different IP versions
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/09—Mapping addresses
    • H04L61/25—Mapping addresses of the same type
    • H04L61/2503—Translation of Internet protocol [IP] addresses
    • H04L61/2514—Translation of Internet protocol [IP] addresses between local and global IP addresses
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/09—Mapping addresses
    • H04L61/25—Mapping addresses of the same type
    • H04L61/2503—Translation of Internet protocol [IP] addresses
    • H04L61/2517—Translation of Internet protocol [IP] addresses using port numbers
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/09—Mapping addresses
    • H04L61/25—Mapping addresses of the same type
    • H04L61/2503—Translation of Internet protocol [IP] addresses
    • H04L61/256—NAT traversal
    • H04L61/2571—NAT traversal for identification, e.g. for authentication or billing 
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/50—Address allocation
    • H04L61/5007—Internet protocol [IP] addresses
    • H04L61/503—Internet protocol [IP] addresses using an authentication, authorisation and accounting [AAA] protocol, e.g. remote authentication dial-in user service [RADIUS] or Diameter
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0892—Network architectures or network communication protocols for network security for authentication of entities by using authentication-authorization-accounting [AAA] servers or protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/24—Accounting or billing

Definitions

  • the present application relates to the field of communication technologies, and in particular, to a communication method, a CP device and a NAT device.
  • IP addresses of the public network face the problem of insufficient resources.
  • IPv4 Internet Protocol version 4 addresses of the public network
  • a network address translation Network Address Translation, NAT
  • CGN Carrier Grade NAT
  • a gateway device such as a Broadband Network Gateway (BNG) will allocate a private network IP address to the user.
  • BNG Broadband Network Gateway
  • the NAT device converts the private network IP address to the public network IP address, so that users can access the public network through the converted public network IP address.
  • NAT devices are divided into independent NAT devices (such as independent CGN devices) and plug-in NAT devices (such as CGN boards).
  • the form of a standalone NAT device is a standalone device.
  • the stand-alone NAT device is connected to a network of gateway devices such as BNG through a wire.
  • the card-type NAT device is in the form of a board.
  • the card-type NAT device is inserted into the slot of a gateway device such as a BNG, so as to be integrated with the gateway device.
  • the gateway device When the gateway device is implemented by a miniaturized device (such as a mini BNG), since the miniaturized device does not have a separate slot for inserting a card-type NAT device, the NAT function is usually implemented by an independent NAT device. In this case, the traceability function is usually implemented through a log (Log) server during the traffic forwarding phase. Specifically, after the user equipment sends the data packet, the data packet will be forwarded to the NAT device. The NAT device receives the data packet and translates the source IP in the data packet from the private network IP address to the public network IP address. At the same time, the NAT device generates NAT logs based on the private network IP address and the public network IP address. The NAT device sends NAT logs to the log server.
  • Log log
  • NAT logs include the mapping relationship between private network IP addresses and public network IP addresses.
  • the log server queries the NAT log based on the public network IP address, and obtains the private network IP address corresponding to the public IP address from the NAT log, thereby implementing source tracing on the log server.
  • the source tracing method based on the independent NAT device relies on the log server. Therefore, operators need to invest in the construction of log servers to achieve the purpose of traceability, which leads to high traceability costs.
  • the embodiments of the present application provide a communication method, a CP device, and a NAT device, which help to reduce the cost of traceability.
  • the technical solution is as follows.
  • a communication method is provided.
  • the method is applied to a communication system in which a control plane (CP) and a user plane (UP) are separated.
  • CP control plane
  • UP user plane
  • the CP The device assigns IP addresses to users.
  • the CP device sends the assigned IP address to the NAT device.
  • the NAT device allocates the public IP address corresponding to the IP address sent by the CP device to the user.
  • the network IP address is reported to the CP device.
  • the CP device According to the public network IP address reported by the NAT device, the CP device carries the IP address assigned by the CP device and the public network IP address assigned by the NAT device in the accounting packet, and dials the authentication service (remote authentication dial in user service, RADIUS) to the remote user. ) server sends an accounting packet, thereby reporting the IP address assigned by the CP device and the public network IP address assigned by the NAT device to the RADIUS server, so that the NAT source can be traced on the RADIUS server.
  • RADIUS remote authentication dial in user service
  • the source tracing method can be performed by multiplexing the RADIUS server, which gets rid of the limitation of building a log server for source tracing and reduces the cost of source tracing.
  • the NAT device is implemented by an independent NAT device, and helps to solve the problems of insufficient UP slots and insufficient NAT processing capability when the NAT device is implemented by a plug-in NAT device such as a service board. problem.
  • the first IP address includes at least one of a private network IPv4 address or an internet protocol version 6 (internet protocol version 6, IPv6) address.
  • the CP device can help implement RADIUS source traceability in the NAT44 (NAT IPv4-IPv4) scenario by allocating the private network IPv4 address and delivering the private network IPv4 address to the NAT device.
  • NAT IPv4-IPv4 NAT IPv4-IPv4
  • the CP device helps to implement RADIUS source traceability in dual-stack networks such as lightweight dual-stack lite (DS-Lite) scenarios.
  • the communication system includes a gateway system, and the gateway system is a broadband network gateway BNG system or a broadband remote access server (virtual broadband remote access server, BRAS) system.
  • the gateway system is a broadband network gateway BNG system or a broadband remote access server (virtual broadband remote access server, BRAS) system.
  • BRAS broadband remote access server
  • the accounting message further includes a port block, where the port block includes at least one port number allocated by the NAT device for the user; the CP device receives the second IP address from the NAT device, The method includes: the CP device receives the information of the user from the NAT device, where the information of the user includes the correspondence between the first IP address, the second IP address and the port block.
  • the method further includes: the CP device receives a port block set from the RADIUS server, where the port block set includes the port block ; The CP device sends the port block set to the NAT device.
  • the RADIUS server delivers the port block set to the CP device, and then the CP device delivers the port block set to the NAT device.
  • Specifying a NAT device allocates port blocks within a set of port blocks, thus satisfying the need to specify a range of NAT port blocks.
  • the CP sends the port block set specified by RADIUS and the IP address to the NAT device, so that the process of specifying the port block range through RADIUS and the process of triggering the NAT device to allocate the public network IP can be executed simultaneously, reducing communication overhead and cost. Implementation complexity.
  • the method further includes at least one of the following: if the user goes offline, the CP device sends a delete message to the NAT device, the The delete message is used to instruct the NAT device to delete the user information stored on the NAT device; if the user goes offline, the CP device deletes the user information stored on the CP device.
  • the CP device instructs the NAT device to delete the user's information when the user goes offline, thereby releasing the storage space occupied by the information of the offline user on the NAT device in time, saving the storage resources of the NAT device. Avoid resource consumption problems on NAT devices.
  • the CP device deletes the locally saved user information when the user goes offline, thereby releasing the storage space occupied by the information of the offline user on the CP device in time, saving the storage resources of the CP device and avoiding resource consumption on the CP device The problem.
  • the NAT device includes a primary NAT device and a backup NAT device that are in a backup relationship with each other, and the CP device receives the second IP address from the NAT device, including: the CP device receives from the primary NAT device. the user's information.
  • the CP device delivers the user information sent by the primary NAT device to the backup NAT device, so that the backup NAT device obtains the user information stored on the primary NAT device.
  • the synchronization of user information between the standby NAT device and the main NAT device is realized, so that the active-standby switchover can be triggered when the main NAT device fails, so as to realize the normal operation of services.
  • the backup NAT device and the master NAT device do not need to deploy a master-slave election mechanism similar to the Virtual Router Redundancy Protocol (VRRP). Wiring, simplifying configuration and deployment of resources.
  • VRRP Virtual Router Redundancy Protocol
  • the method further includes:
  • the CP device sends the information of the user to the standby NAT device.
  • the method further includes: if the primary NAT device is in a fault state, the CP device sends a first update message to the backup NAT device, where the first update message is used to instruct the backup NAT device The routing priority corresponding to the second IP address is increased.
  • the CP device sends the first update message to the backup NAT device to notify the backup NAT device to adjust the routing priority corresponding to the public network address. Therefore, the traffic on the network side will be switched from the active NAT device to the standby NAT device, so that the standby NAT device is upgraded to the active NAT device and replaces the previously faulty active NAT device to handle the traffic on the network side to avoid interruption of traffic transmission.
  • the traffic switching is guided by the CP device, it can be ensured that there is no traffic bypass between the primary NAT device and the backup NAT device.
  • the method can be applied to the NAT44 scenario, which is helpful to realize dual-system backup in the NAT44 scenario.
  • the method further includes: if the primary NAT device is in a fault state, the CP device sends a second update message to the backup NAT device, where the second update message is used to instruct the backup NAT device A route priority corresponding to a third IP address is increased, where the third IP address is an IP address of a tunnel endpoint, and the tunnel endpoint includes the primary NAT device or the backup NAT device.
  • the CP device sends the first update message and the second update message to the backup NAT device to notify the backup NAT device to adjust the routing priority corresponding to the public network address and the routing priority corresponding to the tunnel endpoint address. Since the priority of the route corresponding to the public network address of the backup NAT device is increased, the traffic on the network side will be switched from the primary NAT device to the backup NAT device. The traffic on the network side will be switched from the active NAT device to the standby NAT device, so that the standby NAT device will be upgraded to the active NAT device, replacing the previously faulty active NAT device to handle network-side traffic and user-side traffic, avoiding interruption of traffic transmission.
  • this method can be applied to DS-Lite scenarios, which is helpful for realizing dual-system backup in DS-Lite scenarios.
  • a communication method is provided. Taking the method performed by a NAT device as an example, the NAT device receives a first IP address allocated by the CP device for a user from a CP device, and the CP device is a CP and an UP. A CP device in a separate communication system; the NAT device assigns a second IP address to the user, and the second IP address is a public network IP address; the NAT device sends the second IP address to the CP device address.
  • the NAT device After the NAT device assigns a public IP address, it reports the public IP address to the CP device, so that the CP device can carry the IP address assigned by the CP device and the public IP address assigned by the NAT device in the accounting packet, and dial the authentication service to the remote user.
  • the remote authentication dial in user service (RADIUS) server sends accounting packets to report the IP address assigned by the CP device and the public IP address assigned by the NAT device to the RADIUS server, so that NAT source tracing can be performed on the RADIUS server.
  • RADIUS remote authentication dial in user service
  • the source tracing method can be performed by multiplexing the RADIUS server, which gets rid of the limitation of building a log server for source tracing and reduces the cost of source tracing.
  • the NAT device is implemented by an independent NAT device, and helps to solve the problems of insufficient UP slots and insufficient NAT processing capability when the NAT device is implemented by a plug-in NAT device such as a service board. problem.
  • the method further includes: the NAT device allocates a port block for the user, where the port block includes at least A port number; the NAT device sends the port block to the CP device.
  • the method further includes: the NAT device receives a port block set from the CP device; the NAT device allocates a port block to the user, including: : The NAT device allocates a port block to the user within the port block set.
  • the method further includes: the NAT device saves information of the user, where the user information includes the first IP address, all The corresponding relationship between the second IP address and the port block.
  • the sending, by the NAT device, the second IP address to the CP device includes: the NAT device sending the information of the user to the CP device.
  • the method further includes: the NAT device receives a deletion message from the CP device; in response to the deletion message, the The NAT device deletes the user's information.
  • the NAT device is a backup NAT device in a primary NAT device and a backup NAT device in a mutual backup relationship, and before the NAT device allocates the second IP address to the user, the method further includes:
  • the standby NAT device receives the user information from the CP device, where the user information includes the correspondence between the first IP address, the second IP address, and a port block, where the port block includes at least one Port number; the NAT device assigns the second IP address to the user, including: when the primary NAT device fails, the backup NAT device assigns the second IP address to the user according to the user's information .
  • the method further includes: the standby NAT device receives a first update message from the CP device; in response to the first update message, the standby NAT device improves the route corresponding to the second IP address priority.
  • the method further includes: the standby NAT device receives a second update message from the CP device;
  • the standby NAT device increases the routing priority corresponding to the third IP address, where the third IP address is the IP address of the tunnel endpoint, and the tunnel endpoint includes the primary NAT device or the Describe the NAT device.
  • a CP device is provided, the CP device is located in a communication system in which the CP and the UP are separated, and the CP device includes:
  • an allocation unit used for allocating a first IP address to a user
  • a sending unit configured to send the first IP address to the NAT device
  • a receiving unit configured to receive a second IP address from the NAT device, where the second IP address is a public IP address allocated by the NAT device for the user;
  • the sending unit is further configured to send an accounting packet to the RADIUS server, where the accounting packet includes the first IP address and the second IP address.
  • the first IP address includes at least one of a private network IPv4 address or an IPv6 address.
  • the communication system includes a gateway system, and the gateway system is a BNG system or a BRAS system.
  • the accounting message further includes a port block, and the port block includes at least one port number allocated by the NAT device to the user;
  • the receiving unit is configured to receive the information of the user from the NAT device, where the information of the user includes the correspondence between the first IP address, the second IP address and the port block.
  • the receiving unit is further configured to receive a port block set from the RADIUS server, where the port block set includes the port block;
  • the sending unit is further configured to send the port block set to the NAT device.
  • the sending unit is further configured to send a delete message to the NAT device if the user goes offline, where the delete message is used to instruct the NAT device to delete the user saved on the NAT device Information;
  • the CP device further includes: a deletion unit, configured to delete the user's information saved on the CP device if the user goes offline.
  • the NAT device includes a primary NAT device and a backup NAT device that are in a backup relationship with each other, and the receiving unit is configured to receive the user information from the primary NAT device.
  • the sending unit is further configured to send the information of the user to the standby NAT device.
  • the sending unit is further configured to send a first update message to the backup NAT device if the primary NAT device is in a fault state, where the first update message is used to instruct the backup NAT device to improve the The routing priority corresponding to the second IP address.
  • the sending unit is further configured to send a second update message to the backup NAT device if the primary NAT device is in a fault state, where the second update message is used to instruct the backup NAT device to improve the first update message.
  • the units in the CP device provided by the third aspect are implemented by software, and the units in the CP device are program units. In other embodiments, the units in the CP device provided by the third aspect are implemented by hardware or firmware.
  • a NAT device in a fourth aspect, includes:
  • a receiving unit configured to receive the first IP address allocated by the CP device for the user from the CP device, where the CP device is the CP device in the communication system in which the CP and the UP are separated;
  • an allocation unit configured to allocate a second IP address to the user, where the second IP address is a public network IP address;
  • a sending unit configured to send the second IP address to the CP device.
  • the assigning unit is also configured to assign a port block to the user, and the port block includes at least one port number;
  • the sending unit is further configured to send the port block to the CP device.
  • the receiving unit is further configured to receive a port block set from the CP device;
  • the allocating unit is configured to allocate a port block to the user within the port block set.
  • the NAT device further includes: a saving unit, configured to save the information of the user, where the information of the user includes the correspondence between the first IP address, the second IP address and the port block .
  • the sending unit is configured to send the information of the user to the CP device.
  • the receiving unit is further configured to receive a delete message from the CP device;
  • the NAT device further includes: a deletion unit for, in response to the deletion message, the NAT device to delete the user's information.
  • the NAT device is a backup NAT device in a primary NAT device and a backup NAT device in a mutual backup relationship
  • the receiving unit is further configured to receive the information of the user from the CP device, the user
  • the information includes the correspondence between the first IP address, the second IP address and a port block, and the port block includes at least one port number;
  • the assigning unit is further configured to assign the second IP address to the user according to the user's information when the primary NAT device fails.
  • the receiving unit is further configured to receive a first update message from the CP device;
  • the NAT device further includes: an improving unit, configured to increase the second IP address in response to the first update message The route priority corresponding to the address.
  • the receiving unit is further configured to receive a second update message from the CP device;
  • the NAT device further includes: an improving unit, configured to, in response to the second update message, improve the correspondence of the third IP address
  • the third IP address is the IP address of the tunnel endpoint, and the tunnel endpoint includes the primary NAT device or the backup NAT device.
  • the unit in the NAT device provided by the fourth aspect is implemented by software, and the unit in the NAT device is a program unit. In other embodiments, the units in the NAT device provided in the fourth aspect are implemented by hardware or firmware.
  • a fifth aspect provides a CP device, the CP device includes a processor and a communication interface, and the processor is used to execute an instruction, so that the CP device executes the above-mentioned first aspect or any optional manner of the first aspect.
  • a communication method wherein the communication interface is used for receiving or sending messages.
  • a NAT device in a sixth aspect, includes a processor and a communication interface, and the processor is used to execute an instruction, so that the NAT device executes the above-mentioned second aspect or any optional manner of the second aspect.
  • a communication method wherein the communication interface is used for receiving or sending messages.
  • a computer-readable storage medium where at least one instruction is stored in the storage medium, and the instruction is read by a processor to cause the CP device to execute the first aspect or any optional manner of the first aspect.
  • a computer-readable storage medium is provided, and at least one instruction is stored in the storage medium, and the instruction is read by the processor to cause the NAT device to perform the above-mentioned second aspect or any optional manner of the second aspect.
  • a computer program product comprising computer instructions stored in a computer-readable storage medium.
  • the processor of the CP device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the CP device executes the first aspect or the communication method provided in any optional manner of the first aspect.
  • a computer program product comprising computer instructions stored in a computer-readable storage medium.
  • the processor of the NAT device reads the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction, so that the NAT device executes the first aspect or the communication method provided in any optional manner of the first aspect.
  • a chip is provided, when the chip runs on a CP device, the CP device is made to execute the communication method provided in the first aspect or any optional manner of the first aspect.
  • a twelfth aspect provides a chip that, when the chip runs on a NAT device, enables the NAT device to execute the communication method provided in the second aspect or any optional manner of the second aspect.
  • a thirteenth aspect provides a communication system, where the communication system includes a CP device and a NAT device, where the CP device is configured to execute the method described in the first aspect or any optional manner of the first aspect, the NAT device It is used to execute the method described in the second aspect or any optional manner of the second aspect.
  • a fourteenth aspect provides a CP device, where the CP device includes: a central processing unit, a network processor, and a physical interface.
  • the central processing unit is configured to perform the following operations: assign the first IP address to the user.
  • the network processor is configured to trigger the physical interface to perform the following operations: send the first IP address to the NAT device; receive the second IP address from the NAT device; and send an accounting packet to the RADIUS server.
  • the CP device includes a main control board and an interface board, the central processing unit is disposed on the main control board, the network processor and the physical interface are disposed on the interface board, and the main control A board is coupled to the interface board.
  • an inter-process communication (inter-process communication, IPC) channel is established between the main control board and the interface board, and the main control board and the interface board communicate through the IPC channel.
  • IPC inter-process communication
  • a fifteenth aspect provides a NAT device, where the NAT device includes: a central processing unit, a network processor, and a physical interface.
  • the central processing unit is configured to perform the following operations: assign a second IP address to the user.
  • the network processor is configured to trigger the physical interface to perform the following operations: receive the first IP address from the CP device; and send the second IP address to the CP device.
  • the NAT device includes a main control board and an interface board, the central processing unit is arranged on the main control board, the network processor and the physical interface are arranged on the interface board, and the main control A board is coupled to the interface board.
  • an inter-process communication (inter-process communication, IPC) channel is established between the main control board and the interface board, and the main control board and the interface board communicate through the IPC channel.
  • IPC inter-process communication
  • FIG. 1 is a schematic diagram of performing NAT in a BNG system provided by an embodiment of the present application
  • FIG. 2 is a schematic diagram of performing NAT through an independent CGN device and a log server provided by an embodiment of the present application;
  • FIG. 3 is a flowchart of interaction with a legal interception platform under a RADIUS traceability provided by an embodiment of the present application
  • FIG. 5 is a schematic diagram of a system architecture provided by an embodiment of the present application.
  • FIG. 6 is a schematic diagram of a system architecture provided by an embodiment of the present application.
  • FIG. 7 is a schematic diagram of a system architecture provided by an embodiment of the present application.
  • FIG. 8 is a flowchart of a communication method 200 provided by an embodiment of the present application.
  • FIG. 9 is a flowchart of a communication method 300 in a NAT44 scenario provided by an embodiment of the present application.
  • FIG. 10 is a flowchart of a communication method 400 in a NAT44 scenario provided by an embodiment of the present application.
  • FIG. 11 is a flowchart of a communication method 500 in a DS-Lite scenario provided by an embodiment of the present application.
  • FIG. 12 is a schematic diagram of a dual-machine backup of a CGN device provided by an embodiment of the present application.
  • FIG. 13 is a schematic diagram of dual-machine backup of CGN equipment in a DS-Lite scenario provided by an embodiment of the present application;
  • FIG. 14 is a schematic diagram of a UP dual-machine backup provided by an embodiment of the present application.
  • FIG. 15 is a schematic structural diagram of a CP device provided by an embodiment of the present application.
  • FIG. 16 is a schematic structural diagram of a NAT device provided by an embodiment of the present application.
  • FIG. 17 is a schematic structural diagram of a CP device provided by an embodiment of the present application.
  • FIG. 18 is a schematic structural diagram of a NAT device provided by an embodiment of the present application.
  • FIG. 19 is a schematic structural diagram of a network system 1500 provided by an embodiment of the present application.
  • Control plane and user plane disaggregated control plane and user plane disaggregated, CU separation
  • SDN software defined network
  • NFV network functions virtualization
  • CU separation refers to the network architecture in which CP and UP are decoupled.
  • CU separation includes, but is not limited to, implementation A and implementation B described below.
  • control plane and the forwarding plane are located on different hardware devices.
  • the CP device and the UP device are two separate and different devices.
  • the CP device and the UP device are distributed in different locations.
  • the CP device is located in the data center of the cloud, and the UP device is deployed in a suitable location in the network according to the requirements. In this way, the deployment of the control plane and the forwarding plane is more flexible.
  • control plane and the forwarding plane are located on the same hardware device and have separate functions.
  • the physical entity of the CP device and the physical entity of the UP device are the same device.
  • the CP device and the UP device run in the same host, the same server or the same terminal.
  • both the CP device and the UP device are implemented through virtualization technology.
  • the CP device is called, for example, a virtual CP (virtual CP, vCP), and the UP device is called, for example, a virtual UP (virtual UP, vUP).
  • the CP device is a virtual machine
  • the UP device is a virtual router or virtual switch.
  • both the CP device and the UP device are implemented based on a general physical server combined with NF) technology, and the CP device and the UP device are two different virtualized network functions (virtualized network functions, VNF).
  • VNF virtualized network functions
  • both the CP device and the UP device are network elements virtualized through the X86 server.
  • the CP device is implemented by a virtualization technology
  • the UP device is implemented by a traditional network device.
  • the UP device is called, for example, a physical UP (physical UP, pUP).
  • This embodiment does not limit the quantitative relationship between the CP device and the UP device in the communication system.
  • there is a one-to-many relationship between CP devices and UP devices that is, one CP device is used to control multiple UP devices.
  • there is a one-to-one correspondence between the CP device and the UP device that is, one CP device is used to control one UP device.
  • the CU-separated communication system includes multiple UP devices.
  • a plurality of UP devices are distributed in different locations in the communication system where the CU is separated.
  • multiple UP devices in a communication system where CUs are separated cooperate to share forwarding tasks based on a distributed architecture.
  • CU separation can have different names. For example, different standards, different versions of the same standard, different manufacturers, and different application scenarios may have different names for "CU separation".
  • CU separation may also sometimes be referred to as “control and forwarding separation”, “forwarding control separation”, “control plane and user plane separation”, “control and user separation”, and the like.
  • CP can have different names. For example, different standards, different versions of the same standard, different manufacturers, and different application scenarios may have different names for "CP”.
  • CP may also sometimes be referred to as "CP function (CPF)" or "CP face”.
  • CPF CP function
  • CP face CP face
  • CP device refers to any device that implements CP functionality.
  • UP can have a different name.
  • different standards, different versions of the same standard, different manufacturers, and different application scenarios may have different names for "UP”.
  • UP may also sometimes be referred to as “UP function (UPF)” or "UP face”.
  • UPF UP function
  • UP face is used interchangeably herein.
  • UP device refers to any device that implements UP functionality.
  • the BNG system is used to undertake the function of connecting user equipment to a broadband network, and is very important in user broadband access services and scenarios.
  • the main requirements for user access to the BNG system are user authentication, access control, and traffic scheduling.
  • BNG is mainly responsible for authentication and Internet Protocol (IP) address allocation.
  • IP Internet Protocol
  • the authentication process is implemented based on a remote authentication dial in user service (RADIUS).
  • RADIUS client RADIUS client
  • RADIUS server RADIUS server
  • the protocol stack processed by BNG includes but is not limited to the IP protocol over Ethernet (internet protocol over ethernet, IPoE), the point-to-point protocol over ethernet (PPPoE), 802.1ad protocol, Ethernet protocol and some 802.3 physical layer (some 802.3phy) protocols.
  • IPoE IP protocol over Ethernet
  • PPPoE point-to-point protocol over ethernet
  • 802.1ad protocol 802.1ad protocol
  • Ethernet protocol 802.3 physical layer
  • the BNG system realizes the decoupling of control and forwarding and the decoupling of software and hardware based on the SDN or NFV architecture.
  • the CP device in the BNG system controls multiple UP devices in the BNG system, the CP device schedules multiple UP devices to process traffic forwarding tasks, and the CP device allocates resources for multiple UPs. , the utilization and reliability of the equipment of the BNG system under the CU separation architecture can be greatly improved.
  • the "CU-separated BNG” may have different names.
  • different standards, different versions of the same standard, different manufacturers, and different application scenarios may have different names for the "CU-separated BNG”.
  • the term "CU-disaggregated BNG” may also sometimes be referred to as a “disaggregated BNG system (disaggregated BNG, DBNG)", and correspondingly, the CP device in the CU-disaggregated BNG may be referred to as a DBNG-CP, and the CU-disaggregated BNG may be referred to as a DBNG-CP.
  • the UP device in the BNG may be referred to as DBNG-UP.
  • CU-disaggregated BNG may also sometimes be referred to as "virtual broadband network gateway (virtual BNG, vBNG) control plane and user plane disaggregated system (control plane and user plane disaggregated System, CU system)", that is "vBNG CU system"
  • vBNG CU system virtual broadband network gateway
  • the CP device in the CU-separated BNG may be referred to as vBNG-CP
  • the UP device in the CU-separated BNG may be referred to as vBNG-UP.
  • CU-separated BNG may also sometimes be referred to as "virtual broadband remote access server (vBRAS) CU system", that is, “vBRAS CU system”, correspondingly, the CU-separated BNG
  • vBRAS-CP virtual broadband remote access server
  • UP device in the CU-split BNG may be referred to as vBRAS-UP.
  • DBNG "vBNG CU system”
  • vBRAS CU system are used interchangeably herein.
  • the users in the embodiments of the present application include but are not limited to customer premise equipment (customer premise equipment, CPE) or terminals.
  • CPE customer premise equipment
  • at least one terminal is connected to the CPE
  • the CPE is connected to the BNG system.
  • Assigning an IP address to a user by the BNG system means that the BNG system assigns an IP address to the CPE, and the CPE further assigns an IP address to each terminal.
  • assigning an IP address to a user by the BNG system means that the BNG system assigns an IP address to a terminal.
  • CGN refers to large-scale NAT, and specifically refers to a technology that achieves statistical multiplexing of the current public network IPv4 addresses through the large-scale deployment of Internet Protocol Version 4 (IPv4) private addresses.
  • IPv4 Internet Protocol Version 4
  • CGN can improve the utilization rate of IPv4 addresses, so as to solve the problem of IPv4 address exhaustion in a relatively long period of time, ensure a smooth transition of services, and buy time for the deployment of Internet Protocol Version 6 (IPv6) addresses.
  • IPv6 Internet Protocol Version 6
  • a stand-alone CGN device is an independent device that exclusively undertakes CGN functions.
  • Standalone CGN equipment for example, is side-mounted on the BNG system.
  • the IPv4 traffic of the user's private network is directed to the stand-alone CGN device.
  • the stand-alone CGN device After the stand-alone CGN device performs NAT processing, it returns the NAT-translated public network IPv4 traffic to the BNG system.
  • address translation subscriber management is performed, for example, on the CGN and BNG systems, respectively.
  • a card-type CGN device refers to a single board that undertakes the CGN function and is inserted into a device with other functions.
  • a card-type CGN device occupies one slot of the device.
  • NAT44 refers to the translation of one IPv4 address to another IPv4 address. For example, convert a private network IPv4 address to a public network IPv4 address.
  • Dual stack (dual stack, DS)
  • Dual stack means that both the IPv4 protocol stack and the IPv6 protocol stack are installed on the device, so as to realize information exchange with IPv4 nodes or IPv6 nodes respectively.
  • DS-Lite deploys IPv4-in-IPv6 tunnels in IPv6 networks to complete IPv4 service transmission, while IPv6 services are directly transmitted through IPv6 networks.
  • the routing CPE is used as the basic bridging broadband (B4) of DS-Lite
  • the BNG system is used as the IPv6 single-stack node
  • the CGN is deployed in the metropolitan area network
  • the CGN is used as the address family transition router of DS-Lite. router, AFTR).
  • IPv6-Only IPv6 single-stack
  • CGN BNG system
  • CGN CGN
  • core router CR
  • B4 has the capability of dual stack, which is implemented on the host or CPE device.
  • the CPE device is a home gateway in the operator's network.
  • B4 creates an IPv4-in-IPv6 tunnel to AFTR.
  • the AFTR terminates the IPv4-in-IPv6 tunnel and implements the function of NAT44.
  • the AFTR is a CGN in the operator's network; the CGN may be an independent CGN device or a plug-in CGN.
  • the deployment of the CGN feature hides the IP address information of private network users.
  • the national security department requires CGN deployment to be traceable, that is, the IP addresses of private network users can be queried based on the public network address and port number to further lock down specific users.
  • the address source tracing method adopts a RADIUS source tracing method.
  • RADIUS source tracing refers to performing address source tracing on the RADIUS server.
  • RADIUS traceability is implemented, for example, through the process of sending accounting packets. For example, after the BNG system assigns the public network IP address and port block to the user, the BNG system carries the public network IP address and port block in the accounting packet, and the BNG system sends the accounting packet to the RADIUS server to The IP address and port block are reported to the RADIUS server.
  • the BNG system sends an accounting start packet to the RADIUS server
  • the RADIUS server receives the accounting start packet, and records a RADIUS log according to the accounting start packet
  • the BNG system sends an accounting start packet to the RADIUS server.
  • the RADIUS server receives the accounting end packet and records a RADIUS log based on the accounting end packet.
  • the RADIUS server performs address tracing based on the RADIUS logs recorded twice.
  • the RADIUS log recorded according to the accounting start packet includes the correspondence between the private network IP address, the public network IP address, the port block, and the user online time.
  • the user online time is, for example, the accounting start time in the accounting start packet.
  • the RADIUS logs recorded according to the accounting end message include the correspondence between private network IP addresses, public network IP addresses, port blocks, and user online time.
  • the user offline time is, for example, the accounting end time in the accounting end packet.
  • Port blocks are also called port ranges.
  • the port block includes at least one port number assigned to the user by the NAT device.
  • the BNG system assigns a public IP address and a port segment to a private IP address.
  • the public IP address and the port number in the port segment are used.
  • Inter-chassis backup refers to the mutual backup relationship between the CPU in one device and the CPU in another device.
  • the primary NAT instance and the secondary NAT instance are CPUs on two different hardware devices.
  • the NAT instance is a specific NAT device.
  • the primary NAT instance is CPU 0 in slot 1 on CGN device 1
  • the backup NAT instance is CPU 0 in slot 2 on CGN device 2.
  • Inter-chassis warm backup means that in the normal service operation scenario, the primary NAT device processes services, and the backup NAT device backs up user information in real time.
  • the backup NAT device switches over to the primary NAT device and processes services based on pre-backed up user information.
  • NAT device selection is implemented through a card-in CGN device.
  • the UP device (such as the mini BNG device) in the BNG system is inserted into the plug-in CGN device to realize RADIUS traceability.
  • the NAT address translation is performed on the BNG system.
  • FIG. 1 shows the process of performing NAT on the BNG system, which specifically includes the following steps 1 to 5.
  • Step 1 The user sends a dial-up request, and the dial-up request is used to apply for an IP address to the BNG system.
  • the dialing request is transmitted from the terminal to the residential gateway (RGW), and then transmitted by the RGW to the switch (switch, SW) or the optical line termination (OLT), and then by the SW or The OLT is transmitted to the BNG system.
  • Step 2 The BNG system receives the dial-up request and initiates an authentication request to the RADIUS server.
  • Step 3 The RADIUS server receives the authentication request, generates an authentication result, and returns the authentication result to the BNG system.
  • Step 4 The BNG system allocates the private network IP address, the user's public network IP address, and a port block to the user according to the configuration.
  • the BNG system sends an accounting packet to the RADIUS server, carrying the user's public network IP address and port block through the RADIUS attribute, so as to implement the user's NAT source traceability.
  • Step 5 The terminal sends traffic, and the traffic is forwarded to the BNG system.
  • the BNG system After the BNG system performs NAT conversion on the traffic, it sends the converted traffic to the public network side so that users can access the public network.
  • the source IP address of the traffic is the private network IPv4 address (10.1.1.1)
  • the BNG system converts the private network IPv4 address (10.1.1.1) to the public network IPv4 address (100.1.1.1).
  • Refreshing the NAT source tracing information refers to saving the NAT source tracing information of the migrated user on the plug-in CGN device inserted into the target UP device.
  • the card-type CGN device inserted into the target UP device needs to allocate a public network IP address and a port block to each migrated user.
  • the plug-in CGN device needs to send an accounting update message for each migrated user.
  • the Steering scenario is also called the scenario of online dynamic migration of users, and the Steering scenario refers to the situation where an online user will be migrated from one UP device to another UP device.
  • FIG. 2 shows a process of performing NAT through an independent CGN device and a log server, which specifically includes the following steps 1 to 5.
  • Step 1 The user sends a dial-up request, and the dial-up request is used to apply for an IP address to the BNG system.
  • Step 2 The BNG system receives the dial-up request and initiates an authentication request to the RADIUS server.
  • Step 3 The RADIUS server receives the authentication request, generates an authentication result, and returns the authentication result to the BNG system.
  • Step 4 The BNG system allocates a private network IP address to the user according to the configuration, and sends an accounting packet to the RADIUS server.
  • the accounting packet carries the user's private network IP address and does not carry the public network IP address.
  • Step 5 The terminal sends traffic, and the traffic is forwarded to the CGN device.
  • the CGN device After the CGN device performs NAT conversion on the traffic, it sends the converted traffic to the public network side, enabling users to access the public network.
  • the CGN device After receiving the traffic, the CGN device will establish a NAT session based on the received traffic, generate NAT logs based on the NAT session, and send the NAT logs to the log server, so that the log server can trace the source based on the NAT logs.
  • the stand-alone CGN device generates a NAT session when triggered by receiving user traffic, and then generates a NAT log used for traceability.
  • the stand-alone CGN device itself does not interact with the RADIUS server, and can only use the log server for address traceability.
  • the original RADIUS traceability method cannot be maintained. Operators need to invest additionally to build a new log server. The construction of an additional log server will result in excessive overhead and cost. too high.
  • the lawful interception function is realized through the interaction between the RADIUS server and the lawful interception device.
  • the lawful interception devices include, for example, a lawful interception gateway (LIG) and a law enforcement agency (LEA).
  • LIG lawful interception gateway
  • LEA law enforcement agency
  • the LEA interacts with the RADIUS server, and the LEA is based on the user's public network IP address and port block, Query the user's account information.
  • LIG initiates a legal interception request to the BNG system.
  • the CGN device cannot interact with the RADIUS server, and the CGN device cannot assign a public IP address according to the public IP address specified by the RADIUS server, and the CGN device cannot use the port specified by the RADIUS server.
  • Block allocation port blocks blocks.
  • some embodiments of the present application provide a solution for NAT traceability of users with private network IP addresses.
  • the CP of the BNG system is As a unified control plane, the CP device manages the independent CGN device while managing the UP device.
  • the stand-alone CGN device has stronger performance and higher capacity, and solves the problem of insufficient NAT capability of the plug-in CGN device.
  • some embodiments of the present application implement a RADIUS source traceability method, which solves the technical problem that it is difficult to trace the source through a RADIUS server when an independent CGN device is used.
  • address source traceability is implemented through a RADIUS server without the use of a log server, the limitation of adding a log server to the existing network is avoided when operators perform source traceability.
  • the limitation of modifying LIG devices when operators are traced is freed, and the huge workload and cost caused by modifying LIG devices are also saved.
  • the CP device can interact with the RADIUS server to meet the requirements of the public network IP address and port range when specifying users through the RADIUS server for NAT.
  • the management functions of the CP device to the CGN device include but are not limited to the following management functions 1 to 5.
  • the CP device sends the assigned user IP address (eg, private network IPv4 address or IPv6 address) to the CGN device.
  • the assigned user IP address eg, private network IPv4 address or IPv6 address
  • the CP device directs traffic to the backup CGN device.
  • the CP device synchronizes the user entries saved on the main CGN device to the standby CGN device.
  • Management function 4 After the user goes offline, the CP device clears the user entry on the CGN device.
  • the CP device specifies the range of the allocated port block for the CGN device.
  • the system architecture on which the CP device manages the UP device and the CGN device in a unified manner is illustrated by the system architecture shown in FIG. 5 .
  • the method 200 shown in FIG. 8 , the method 300 shown in FIG. 9 , the method 400 shown in FIG. 10 , and the method 500 shown in FIG. 11 are used to illustrate how the CP device implements the management function.
  • An example of how the CP device implements the management function 2 is illustrated with reference to FIG. 12 , S701 to S708 , S801 to S804 , FIG. 13 , and steps S901 to S903 .
  • Through S601 to S605 an example of how to implement the management function 3 for the CP device is described.
  • Through S201 to S241, an example of how the CP device realizes the management function 5 is given.
  • an embodiment of the present application provides a system architecture, where the system architecture includes a CP device, a UP device, an access network device, a CPE, and a NAT device.
  • the CP device is used to assume the function of the control plane.
  • the CP device is a CP device in a CU-separated BNG system, and the CP device assumes the function of a control plane in the BNG system.
  • the CP device processes the user's dialing request based on the dialing protocol.
  • the CP device interacts with authentication, authorization, and accounting (AAA) to perform user authentication, accounting, and authorization.
  • AAA authentication, authorization, and accounting
  • the CP device sends the user entry to the UP device accessed by the user.
  • the UP device generates the user's user entry and advertises the route to the outside.
  • the CP device includes a point-to-point protocol over ethernet (PPPoE) module over Ethernet or an IP protocol over Ethernet (IPoE) module, user management module, AAA module, UP management module, Address management module and RADIUS module.
  • PPPoE point-to-point protocol over ethernet
  • IPoE IP protocol over Ethernet
  • the CP device manages the UP device and the NAT device (eg, a standalone CGN device).
  • the CP device manages the NAT device through the user management module
  • the CP device manages the NAT device through the UP management module and the user management module.
  • One CP device for example, manages at least one UP device and at least one NAT device.
  • the CP device and the UP device are connected through the network.
  • the CP device and the NAT device are connected through the network.
  • the CP device is realized, for example, by virtualization technology.
  • the CP device is a VNF
  • the CP device is a network element virtualized by an X86 server
  • the physical entity of the CP device is an X86 server.
  • the UP device is used to undertake the functions of the user plane.
  • the UP device is an UP device in a BNG system separated by a CU, and the UP device assumes the function of the user plane in the BNG system.
  • the UP device sends the user's dial-up request to the CP device for processing through the service channel.
  • the CP device processes the dialing request, it delivers user entries to the UP device.
  • the UP device receives the user entry sent by the CP device, the UP device generates the user entry locally, and the UP device executes related service policies and forwards traffic according to the user entry.
  • the UP device advertises routes to the outside.
  • UP devices include various implementations.
  • the UP device is connected to the access network device through the network.
  • the UP device is implemented through virtualization technology.
  • the UP device is a VNF
  • the UP device is a network element virtualized by an X86 server
  • the hardware of the UP device is an X86 server.
  • the UP device is called, for example, a vUP device (VNF).
  • the UP device is a network device
  • the UP device is a PNF.
  • the UP device is either a hardware mini-BNG device or a box-type BNG system.
  • the UP device is, for example, called a pUP device (PNF).
  • the access network device includes, but is not limited to, any of an access node (AN) device, a SW or an OLT.
  • the access network device is connected to the CPE and the UP device through the network.
  • the access network device is used to aggregate the CPE to the UP device.
  • the access network device is also used to forward Layer 2 packets, and to isolate users in a virtual local area network (virtual LAN, VLAN) or QinQ.
  • VLAN virtual local area network
  • QinQ is also called stack VLAN (stacked VLAN) or double VLAN (double VLAN).
  • the CPE is a home gateway (RGW, also called home terminal) in an operator's network.
  • the CPE is used to access a personal computer (Personal Computer, PC) and a mobile phone in the home.
  • the CPE generally performs NAT processing and assigns private IP addresses to CP devices and mobile phones in the home.
  • the CPE also performs PPPoE and IPoE protocol dialing, obtains an IP address from the BNG system, and performs network access according to the obtained IP address.
  • the NAT device is used for NAT processing.
  • a NAT device translates a user's private IP address into a public IP address and port block.
  • the NAT device converts the user's IPv6 address into a public network IP address and a port block.
  • the NAT device is a CGN device.
  • the NAT device is a standalone CGN device.
  • Standalone CGN devices include a variety of implementations.
  • a standalone CGN device is a hardware device, eg, a standalone CGN device is a network device.
  • the stand-alone CGN device is implemented through virtualization technology.
  • a standalone CGN device is a network element virtualized by an X86 server.
  • the NAT device is a device other than the CGN device with a NAT processing function.
  • control packet redirect interface control packet redirect interface
  • management interface management interface
  • state control interface state control interface
  • the CPRi is implemented based on the Vxlan generic protocol (Vxlan generic protocol encapsulation, Vxlan-GPE) interface.
  • Vxlan generic protocol encapsulation Vxlan-GPE
  • the UP device receives the user's access packet.
  • the UP device encapsulates the access packet according to the packet encapsulation format corresponding to the CPRi, and sends the encapsulated access packet to the CP device for processing.
  • Mi is implemented using the XML-based Network Configuration Protocol (Netconf) interface.
  • the CP device uses the Mi to deliver the configuration to the UP device, and the UP device uses the Mi to report the running status of the UP device.
  • Netconf Network Configuration Protocol
  • SCi is implemented using the control plane and user plane separated protocol (CUSP) interface.
  • the CP device processes user access packets and completes the user's protocol interaction. After the user goes online, the CP device delivers the user's user entry to the UP device corresponding to the user's access through SCi.
  • CUSP control plane and user plane separated protocol
  • the CP device when the CP device manages the CGN device, it is also implemented by using CPRi, Mi, and SCi. For example, the master CGN device reports user entries to the CP device through SCi, and the CP device uses SCi to deliver user entries to the standby CGN device.
  • the communication system includes a gateway system, and the gateway system is a BNG system or a BRAS system.
  • the gateway system is a BNG system or a BRAS system.
  • the CP device is implemented by adopting the CP in the BNG system and other CU separation communication systems other than the BRAS system.
  • the CP device is implemented by adopting the CP in the serving gateway (serving gateway, S-GW) separated from the CU.
  • the CP device is implemented by adopting the CP in the packet data network gateway (PDN gateway, PGW) separated by the CU.
  • PDN gateway packet data network gateway
  • the CP device is implemented by using a mobility management function (access and mobility management function, AMF) network element.
  • AMF access and mobility management function
  • SMF session management function
  • the access gateway function access gateway function, AGF network element in the WT-456 fixed and mobile converged communication system is used to implement the CP device.
  • the NAT device is an independent CGN device
  • the IP address allocated by the CP device is a private network IPv4 address as an example, how to implement the embodiment of the present application based on the system architecture shown in FIG. 5 A brief description.
  • the CP device manages both mini-BNG devices and stand-alone CGN devices.
  • the user goes online from the mini-BNG device; the CP device allocates the private network IPv4 address to the user in response to the online request, and simultaneously issues the user's private network IPv4 address to the independent CGN device; the independent CGN device obtains the address pool from the local public network. , allocate the public IPv4 address and port block corresponding to the private network IPv4 address to the user; the independent CGN device reports the public network IPv4 address and port block to the CP device; the CP device carries the user's public network IPv4 address in the accounting message and port block to report accounting packets to AAA to implement user RADIUS source traceability.
  • FIG. 8 is a flowchart of a communication method 200 provided by an embodiment of the present application.
  • method 200 is performed by a CP device, a NAT device, and a RADIUS server.
  • the method 200 includes S210 to S280.
  • the CP device allocates a first IP address to the user.
  • the CP device and the NAT device will assign different IP addresses to the same user.
  • the IP address allocated to the user by the CP device is referred to as the first IP address
  • the IP address allocated to the user by the NAT device is referred to as the second IP address.
  • the first IP address and the second IP address are also referred to as the user's IP address.
  • the CP device sends the first IP address to the NAT device.
  • the first IP address includes at least one of a private network IPv4 address or an IPv6 address.
  • the first IP address is a private network IPv4 address.
  • the CP device allocates private network IPv4 addresses to users.
  • the first IP address is an IPv6 address.
  • the CP device allocates IPv6 addresses to users.
  • the CP device helps to implement RADIUS source traceability in dual-stack networks such as DS-Lite scenarios.
  • the first IP address includes a private network IPv4 address and an IPv6 address.
  • the CP device sends the first IP address to the NAT device based on CUSP. For example, the CP device generates and sends a CUSP message, and the CUSP message includes the first IP address. In other embodiments, the CP device sends the first IP address to the NAT device based on PFCP. For example, the CP device generates and sends a PFCP message, and the PFCP message includes the first IP address.
  • the NAT device receives the first IP address allocated by the CP device for the user from the CP device.
  • the NAT device allocates a second IP address to the user.
  • the second IP address is a public network IP address.
  • the second IP address is a public network IPv4 address.
  • the NAT device selects an unoccupied public network IP address from the address pool as the assigned IP address.
  • the NAT device sends the second IP address to the CP device.
  • the NAT device sends the correspondence between the first IP address and the second IP address to the CP device, so that the CP device knows that the public network IP address reported by the NAT device is the IP address of the user assigned by the NAT device .
  • the NAT device after the NAT device receives the first IP address issued by the CP device, the NAT device not only allocates a public network IP address to the user, but also allocates a port block to the user. Correspondingly, the NAT device not only reports the public network IP address to the CP device, but also reports the port block allocated for the user. Wherein, the port block includes at least one port number.
  • the triggering method of the NAT device to allocate the public network IP address in this embodiment is different from the related art. It is not triggered by the event of receiving traffic, but by the event of the IP address issued by the CP device.
  • the NAT device locally stores the assigned second IP address and port block.
  • the NAT device generates and saves user information, where the user information includes the correspondence between the first IP address, the second IP address and the port block.
  • the form of the user's information is, for example, an entry in a user table.
  • the NAT device creates a new user entry in the user table, and stores the correspondence between the first IP address, the second IP address, and the port block in the user entry, which stores the first IP address, the second IP address, and the port block.
  • the user entry of the corresponding relationship is the user's information.
  • the local user entry of the NAT device in addition to the correspondence between the first IP address, the second IP address and the port block, the local user entry of the NAT device also includes other information of the user, such as a user ID.
  • the NAT device saves the user's information locally, so that the forwarding entry can be generated according to the pre-stored user information in the data packet forwarding stage.
  • the NAT device In the data packet forwarding phase, when the NAT device receives an upstream data packet, it identifies the source IP address and source port number of the data packet, searches for user information based on the source IP address, and obtains the user information with the source IP address. The corresponding IP address and the port number corresponding to the source port number, convert the source IP address to the found IP address, and convert the source port number to the found port number, so as to perform NAT.
  • the source IP address of the data packet is the private network IPv4 address (the first IP address), and the IP address found is the second IP address, in other words, the private network IPv4 address pre-assigned by the CP device Convert to the public IP address pre-assigned by the NAT device.
  • the data packet is in the form of IPv4-in-IPv6, the data packet includes two IP headers, the outer IP header is an IPv6 header, and the inner data packet is an IPv6 header.
  • the IP header is the IPv4 header.
  • the outer IPv6 header belongs to the tunnel header.
  • the source IP address in the IPv6 header of the outer layer is the IPv6 address of the CPE.
  • the IPv6 address of the CPE is the first IP address allocated by the CP device.
  • the source IP address in the inner IPv4 header is the private network IPv4 address assigned by the CPE to the terminal.
  • the NAT device converts the private network IPv4 address in the IPv4 header to the public network IPv4 address. In other words, convert the private network IPv4 address pre-assigned by the CPE to the public network IP address pre-assigned by the NAT device.
  • the NAT device sends information of users local to the NAT device to the CP device, and the CP device receives the information of users from the NAT device. In this way, the local user entries of the NAT device are synchronized to the CP device.
  • the CP device receives a second IP address from the NAT device, where the second IP address is a public network IP address allocated by the NAT device to the user.
  • the NAT device reports the IP address and port block to the CP device.
  • the NAT device sends the second IP address and port block to the CP device based on the CUSP. For example, the NAT device generates and sends a CUSP message, the CUSP message includes a second IP address and a port block.
  • the NAT device sends the second IP address and port block to the CP device based on PFCP. For example, the NAT device generates and sends a PFCP message that includes a second IP address and a port block.
  • the CP device locally saves the assigned second IP address and port block.
  • the CP device generates and saves user information, where the user information includes the correspondence between the first IP address, the second IP address and the port block.
  • the form of the user's information is, for example, an entry in a user table.
  • the CP device creates a new user entry in the user table, and stores the correspondence between the first IP address, the second IP address, and the port block in the user entry, which stores the first IP address, the second IP address, and the port block.
  • the user entry of the corresponding relationship is the user's information.
  • the local user entry of the CP device further includes authorization information of the user, such as quality of service (quality of service, QoS) information, access control list (access control lists, ACL) information, media access information, and user authorization information.
  • quality of service quality of service
  • QoS quality of service
  • access control list access control lists, ACL
  • media access information media access information
  • user authorization information such as authorization information of the user, such as authorization information of the user, such as quality of service (quality of service, QoS) information, access control list (access control lists, ACL) information, media access information, and user authorization information.
  • Control media access control, Client MAC address, etc.
  • the CP device sends an accounting packet to the RADIUS server.
  • the CP device When the CP device generates an accounting packet, it will carry the public network IP address (second IP address) reported by the NAT device and the IP address (first IP address) allocated by the CP device in the accounting packet, so that the accounting The packet includes the first IP address and the second IP address.
  • the NAT device reports the port block to the CP device
  • the CP device will also carry the port block reported by the NAT device in the accounting packet, so that the accounting packet includes the first IP address, the second IP address and the port block.
  • the accounting message includes but is not limited to at least one of an accounting start message or an accounting end message.
  • the accounting start packet is used to request the RADIUS server to start accounting.
  • the accounting end packet is used to request the RADIUS server to end accounting.
  • the accounting message also includes a port block.
  • the accounting packet further includes at least one of the online time of the user or the offline time of the user.
  • the online time of the user is, for example, the accounting start time in the accounting start packet.
  • the offline time of the user is, for example, the accounting end time in the accounting start packet.
  • the first IP address, the second IP address, the port block, the online time of the user or the offline time of the user may be referred to as the NAT source tracing information of the user carried in the accounting packet.
  • the accounting packet includes at least one RADIUS attribute (Attribute) field, and the RADIUS attribute field includes at least one of the first IP address, the second IP address, the port block, the online time of the user, or the offline time of the user an item.
  • RADIUS attribute Attribute
  • the CP device reports the NAT source tracing information (first IP address, second IP address, port block, user online time, user offline time) to the RADIUS server by sending accounting packets.
  • the RADIUS server obtains the first IP address and the second IP address from the accounting packet, and stores the correspondence between the first IP address and the second IP address.
  • the RADIUS server After the RADIUS server receives the accounting packet, it executes the accounting process and saves the NAT source traceability information carried in the accounting packet locally.
  • a source tracing request is sent to the RADIUS server, and the source tracing request includes the second IP address.
  • the RADIUS server receives the source tracing request, obtains the second IP address from the source tracing request, queries the NAT source tracing information according to the second IP address, and obtains the first IP address, thereby realizing the RADIUS source tracing.
  • the CP device sends the assigned IP address to the NAT device, and the NAT device allocates the IP address corresponding to the IP address sent by the CP device to the user under the trigger condition of receiving the IP address sent by the CP device.
  • Public network IP address report the public network IP address to the CP device.
  • the CP device Based on the public network IP address reported by the NAT device, the CP device carries the IP address allocated by the CP device and the public network IP address allocated by the NAT device in the accounting packet, and sends an accounting packet to the RADIUS server.
  • the IP address and the public IP address assigned by the NAT device are reported to the RADIUS server for NAT source tracing on the RADIUS server.
  • the source tracing method can be performed by multiplexing the RADIUS server, which gets rid of the limitation of building a log server for source tracing and reduces the cost of source tracing.
  • it is suitable for the scenario where the NAT device is implemented by an independent NAT device, and helps to solve the problems of insufficient UP slots and insufficient NAT processing capability when the NAT device is implemented by a plug-in NAT device such as a service board. .
  • the CP device when the user goes offline, the CP device clears the user entry stored on the NAT device, so as to implement the management function 4 mentioned above.
  • the method 200 specifically includes the following steps S203 to S223.
  • the CP device If the user goes offline, the CP device generates a delete message, and sends the delete message to the NAT device.
  • the delete message is used to instruct the NAT device to delete the user information stored on the NAT device.
  • the delete message is, for example, a CUSP message.
  • the NAT device receives the delete message from the CP device.
  • the NAT device deletes the user's information.
  • the CP device instructs the NAT device to delete the user's information when the user goes offline, thereby releasing the storage space occupied by the information of the offline user on the NAT device in time, saving the storage resources of the NAT device and avoiding resource consumption on the NAT device.
  • the CP device deletes the user information stored on the CP device, so that the user information stored on the NAT device and the user information stored on the CP device are synchronously cleared.
  • the NAT device deletes the user entry corresponding to the offline user on the NAT device
  • the CP device deletes the user entry corresponding to the offline user on the CP device.
  • the NAT device and the CP device synchronously clear the user entry.
  • the CP device deletes the locally saved user information when the user goes offline, thereby releasing the storage space occupied by the information of the offline user on the CP device in time, saving the storage resources of the CP device and avoiding resource consumption on the CP device The problem.
  • the range to which the port block belongs during NAT is specified through the RADIUS server, so as to realize the management function 5 mentioned above.
  • the method 200 specifically includes the following steps S201 to S241.
  • the RADIUS server obtains and sends the port block set to the CP device.
  • the port block set is used as the value range of the port block allocated by the NAT device.
  • the port block set includes at least one port block.
  • the CP device receives the port block set from the RADIUS server.
  • the CP device sends the port block set to the NAT device.
  • the CP device when delivering the first IP address to the NAT device, also delivers the port block set to the NAT device, so that the first IP address and the port block set are transmitted to the NAT device together.
  • the NAT device receives the port block set from the CP device.
  • the NAT device allocates a port block to the user in the port block set.
  • the NAT device selects an unoccupied port block from the port block set, and assigns the selected port block to the user.
  • the RADIUS server delivers the port block set to the CP device, and then the CP device delivers the port block set to the NAT device, thereby specifying the NAT device in the port block set.
  • Port blocks are allocated within the NAT port block, thus satisfying the need to specify a range of NAT port blocks.
  • the CP sends the port block set specified by RADIUS and the IP address to the NAT device, so that the process of specifying the port block range through RADIUS and the process of triggering the NAT device to allocate the public network IP can be executed simultaneously, reducing communication overhead and cost. Implementation complexity.
  • the first IP address in the above method 200 is a private network IP address.
  • the CP device allocates the user's private network IP address.
  • the CP device delivers the user's private network IP address and related information to the CGN device.
  • the CGN device allocates the public network IP address and port block to the user, and reports the public network IP address and port block to the CP device.
  • the CP device adds the user's public network IP address and port block to the accounting packet, and sends the accounting packet to the RADIUS server, so that the source can be traced through the RADIUS server.
  • the method 300 shown in FIG. 9 is an example of how to implement the method 200 in the NAT44 scenario.
  • the method 300 shown in FIG. 9 is about how to implement source traceability through a RADIUS server in the case of using an independent CGN device in a NAT44 scenario.
  • the first IP address is a private network IPv4 address
  • the second IP address is a public network IPv4 address
  • the communication system is a BNG system
  • the NAT device is an independent CGN device
  • the user's information is stored in in the user table entry in the user table.
  • the method 300 shown in FIG. 9 includes the following S301 to S309.
  • the user sends a dialing request.
  • the dial-up request is used to apply for an IP address to the BNG system.
  • the CP device receives the dialing request. Triggered by the dial-up request, the CP device initiates an authentication request to the RADIUS server. After the RADIUS server authentication is passed, the CP device allocates private network IPv4 addresses to users from the private network address pool.
  • the CP device delivers the user's private network IPv4 address to the independent CGN device.
  • the independent CGN device receives the user's private network IPv4 address from the CP device.
  • the standalone CGN device locally selects an idle public network IPv4 address and port block according to the user's private network IPv4 address, and assigns the selected public network IPv4 address and port block to the user.
  • the stand-alone CGN equipment adds a user entry in the user table. The newly added user entry stores the correspondence between private network IPv4 addresses, public network IPv4 addresses, and port blocks.
  • the independent CGN device reports the user's private network IPv4 address, public network IPv4 address and port block to the CP device.
  • the CP device receives the user's private network IPv4 address, public network IPv4 address and port block from the independent CGN device.
  • the CP device updates the local user table and adds user table entries to the user table.
  • the newly added user entry stores the public network IPv4 address and port block.
  • the CP device sends an accounting packet.
  • the accounting message is, for example, an accounting start message.
  • the accounting packet carries the user's NAT source tracing information.
  • the NAT source tracing information includes the private network IPv4 address allocated by the CP device, the public network IPv4 address allocated by the CGN, and the port block allocated by the CGN.
  • the CP device delivers the private network IPv4 address to the user.
  • the CP device delivers the corresponding user entry to the UP device.
  • the method 400 shown in FIG. 10 is an example of the above-mentioned method 300 .
  • the UP device in the BNG system is a mini-BNG device (ie, the mBNG in FIG. 10).
  • the action of the CP device delivering the private network IPv4 address to the CGN device is implemented through an interface such as the SCi channel.
  • the action of the CGN device reporting the private network IPv4 address, the public network IPv4 address and the port block to the CP device is implemented through an interface such as the SCi channel.
  • the method 400 also relates to the interaction flow with the lawful interception device (LIG and LEA).
  • the method 400 in the NAT44 scenario shown in FIG. 10 includes the following S401 to S410.
  • the CPE sends a dialing request.
  • a dial-up request is also called a user online request.
  • the dial-up request is, for example, a PPPoE dial-up request or a dynamic host configuration protocol (dynamic host configuration protocol, DHCP) dial-up request.
  • the CP device broadcasts a dial-up request to the Layer 2 network.
  • the mini BNG device receives the dialing request.
  • the mini-BNG device sends the dial-up request to the CP device through the CPRi channel.
  • the CP device sends an authentication request to the RADIUS server. After the RADIUS server is authenticated, the RADIUS server assigns the private network IPv4 address to the user.
  • the CP device delivers the user's private network IPv4 address to the CGN device through the SCi channel.
  • the CGN device allocates a public network IPv4 address and a port block. And, the CGN device adds a user entry in the user table. The newly added user entry stores the correspondence between private network IPv4 addresses, public network IPv4 addresses, and port blocks.
  • the CGN device reports the user's private network IPv4 address, public network IPv4 address and port block to the CP device through the SCi.
  • the CP device sends an accounting start packet to the RADIUS server.
  • the accounting start packet carries the user's NAT source tracing information.
  • NAT source tracing information includes private network IPv4 addresses, public network IPv4 addresses, and port blocks.
  • the CP device delivers the private network IPv4 address to the CPE. At the same time, the CP device delivers user entries to the mini-BNG device.
  • the LIG requests the account information of the user from the RADIUS server according to the public network IPv4 address and the port block.
  • the user's account information includes, but is not limited to, at least one of the user's name, the user's account, and a session ID.
  • the LEA sends a legal interception request (LI request, LI request) to the LIG, and the legal interception request includes a public network IPv4 address and a port block.
  • the LIG receives the LI request and uses the public IPv4 address to search for the user's name, account number and session ID from the RADIUS server.
  • the LIG sends a monitoring policy to the mini-BNG device according to the user's account information.
  • the monitoring policy is, for example, monitoring packets in the ingress direction or data packets in the egress direction.
  • the monitoring strategy includes the user's account and session ID.
  • the monitoring strategy is, for example, a configuration command (Configure command) for the mini-BNG device.
  • the monitoring policy includes account 1, session ID1, and ingress direction, and the monitoring policy is used to instruct the mini-BNG device to monitor data packets in the ingress direction of session ID1 of account 1.
  • the mini-BNG device replicates the data packet of the user according to the monitoring policy, and forwards the copied data packet to the monitoring platform.
  • the method 500 shown in FIG. 11 is an example to illustrate how to implement the method 200 in the DS-Lite scenario.
  • the method 500 shown in FIG. 11 is about how to implement source traceability through a RADIUS server in a DS-Lite scenario when an independent CGN device is used.
  • the first IP address is an IPv6 address
  • the second IP address is a public network IPv4 address
  • the communication system is a BNG system
  • user information is stored in a user entry in the user table.
  • the UP device in the BNG system is a mini-BNG device (ie, the mBNG in FIG. 11 ).
  • the method 500 shown in FIG. 11 includes the following S501 to S511.
  • the CPE acts as a DHCP server to allocate a private network IPv4 address to the terminal.
  • the CPE sends a dialing request.
  • a dial-up request is also called a user online request.
  • the dial-up request is, for example, a PPPoE dial-up request or a DHCP dial-up request.
  • the CP device broadcasts a dial-up request to the Layer 2 network.
  • the mini BNG device receives the dialing request.
  • the mini-BNG device sends the dial-up request to the CP device through the CPRi channel.
  • the CP device sends an authentication request to the RADIUS server. After the RADIUS server is authenticated, the RADIUS server assigns an IPv6 address to the user.
  • the CP device delivers the user IPv6 address to the CGN device through the SCi.
  • the CGN device allocates the public network IPv4 address and the port block according to the user IPv6 address. And, the CGN device adds a user entry in the user table. The newly added user entry stores the correspondence between IPv6 addresses, public network IPv4 addresses, and port blocks.
  • the CGN device reports the user IPv6 address, the public network IPv4 address, and the port block to the CP device through the SCi channel.
  • the CP device sends an accounting start packet to the RADIUS server.
  • the accounting start packet carries the user's NAT source tracing information.
  • NAT source tracing information includes IPv6 addresses, public network IPv4 addresses, and port blocks.
  • the CP device delivers an IPv6 address to the CPE. At the same time, the CP device delivers user entries to the mini-BNG device through the SCi channel.
  • the LIG requests the user's account information from the RADIUS server according to the public network IPv4 address and the port block.
  • the user's account information includes, but is not limited to, at least one of the user's name, the user's account, and a session ID.
  • the LIG delivers a monitoring policy to the mini-BNG device according to the user's account information.
  • the mini-BNG device replicates the user's data message according to the monitoring policy, and forwards the copied data message to the monitoring platform.
  • the NAT device implements a reliability scheme
  • the NAT device is a backup NAT device among the primary NAT device and the backup NAT device in a mutual backup relationship.
  • the active/standby relationship of the NAT device is configured by the CP device.
  • the NAT device has one or more CPUs
  • the NAT device sends CPU information to the CP device
  • the CPU information indicates the CPU resources possessed by the NAT device.
  • the CP device receives the CPU information, and selects the first CPU and the second CPU from one or more CPUs possessed by the NAT device.
  • the CP device sends a configuration instruction to the first CPU to configure the first CPU as a primary NAT device, and the CP device sends a configuration instruction to the second CPU to configure the second CPU as a backup NAT device.
  • the CP device can synchronize the user entries on the primary NAT device to the backup NAT device to ensure data consistency between the primary NAT device and the backup NAT device, so that when the primary NAT device fails, the backup NAT device fails.
  • the device can process services according to the obtained user entries. Below, through S601 to S605, how the CP device synchronizes the user entries on the primary NAT device to the backup NAT device is illustrated as an example.
  • the primary NAT device sends user information to the CP device, where the user information includes the correspondence between the first IP address, the second IP address and the port block.
  • the CP device receives the user information from the primary NAT device.
  • the CP device sends the user information to the standby NAT device.
  • the standby NAT device receives the user information from the CP device.
  • the secondary NAT device allocates a second IP address to the user according to the user's information.
  • the CP device delivers the user information sent by the primary NAT device to the backup NAT device, so that the backup NAT device obtains the user information stored on the primary NAT device.
  • the synchronization of user information between the standby NAT device and the main NAT device is realized, so that the active-standby switchover can be triggered when the main NAT device fails, so as to realize the normal operation of services.
  • the standby NAT device and the active NAT device do not need to deploy a VRRP-like active-standby election mechanism, so there is no need to straighten the connection between the CGNs, simplifying configuration and deployment of resources.
  • the reliability schemes applicable to the above S601 to S605 include various situations.
  • the above S601 to S605 are applied in the case where two NAT devices perform inter-frame backup after the user goes online.
  • the above-mentioned S601 to S605 are applied to implement a 1:1 warm backup between two NAT devices after the user goes online, which is described below with reference to FIG. 12 as an example.
  • two NAT devices are in a backup relationship with each other.
  • One of the two NAT devices is the primary NAT device, that is, the primary NAT device.
  • the other NAT device in the two NAT devices is the backup NAT device, that is, the backup NAT device.
  • the two NAT devices are, for example, two independent CGN devices.
  • the main NAT device is the main CGN device, and the main CGN device is also called CGN(M); the backup NAT device is the backup CGN device, and the backup CGN device is also called CGN(S).
  • the CP device communicates with the main CGN device, the standby CGN device and the UP device through interfaces such as CPRi, Mi, and SCi.
  • the CP device communicates with the RADIUS server based on the RADIUS protocol.
  • two NAT devices are called two NAT instances.
  • the two NAT instances have different instance IDs.
  • One NAT instance is the NAT instance of the primary CGN device, and the other NAT instance is the NAT instance of the standby CGN device.
  • the 1:1 warm backup method shown in FIG. 12 includes the following S701 to S708.
  • the CP device determines the ID of the UP device on which the user goes online. Then, the CP device determines the primary CGN device and the backup CGN device bound under the ID of the UP device according to the configuration information.
  • the CP device After the CP device interacts with the RADIUS server, the CP device generates a user entry, and delivers the user entry to the master CGN device.
  • the master CGN device receives the user entry from the CP device, and completes the assignment of the user entry.
  • the master CGN device returns the assigned user entry to the CP device.
  • the CP device receives the user entry from the master CGN device, and delivers the user entry to the standby CGN device.
  • the primary CGN device delivers the user entry to the standby CGN device.
  • the CP device detects that the main CGN device is faulty.
  • the main CGN device is the main CPU that implements the CGN function
  • detecting the failure of the main CGN device by the CP device refers to detecting the failure of the main CPU or the failure of the service board where the main CPU is located.
  • the CP device determines the backup relationship between the primary CGN device and the backup CGN device through the UP device ID bound to the CGN device.
  • the CP device determines the backup CGN device according to the backup relationship between the master CGN device and the backup CGN device and the master CGN device.
  • the CP device directs traffic to the standby CGN device, so that the traffic is switched from the primary CGN device to the standby CGN device.
  • the CP device implements traffic switching in the NAT44 scenario by refreshing the routing priority corresponding to the public network address (second IP address) on the standby NAT device.
  • the same public IP address segment is stored on the primary NAT device and the secondary NAT device.
  • the route priority of the public IP address segment stored on the primary NAT device is higher, and the route priority of the public IP address segment stored on the standby NAT device is lower. Therefore, when the primary NAT device is normal, the downstream traffic will be routed and forwarded to the secondary NAT device.
  • the CP device and the backup NAT device will interactively execute the following steps S801 to S804.
  • the downlink traffic refers to the traffic sent from the UP device to the user equipment.
  • the downlink traffic is also called network side traffic or public network side traffic.
  • the source IP address in the downlink traffic is the public network IP address.
  • the CP device If the primary NAT device is in a fault state, the CP device generates a first update message.
  • the CP device sends a first update message to the standby NAT device.
  • the first update message is also called a routing priority update command.
  • the first update message is used to instruct the standby NAT device to increase the routing priority corresponding to the second IP address.
  • the routing priority corresponding to the second IP address is, for example, the routing priority of the network segment to which the second IP address belongs, and each IP address in the network segment corresponds to the same routing priority.
  • the routing priority corresponding to the second IP address is also called the routing priority of the public network IP network segment.
  • the standby NAT device receives the first update message from the CP device.
  • the standby NAT device increases the routing priority corresponding to the second IP address.
  • the CP device sends the first update message to the backup NAT device to notify the backup NAT device to adjust the routing priority corresponding to the public network address. Therefore, the traffic on the network side will be switched from the active NAT device to the standby NAT device, so that the standby NAT device is upgraded to the active NAT device and replaces the previously faulty active NAT device to handle the traffic on the network side to avoid interruption of traffic transmission.
  • the traffic switching is guided by the CP device, it can be ensured that there is no traffic bypass between the primary NAT device and the backup NAT device.
  • the method can be applied to the NAT44 scenario, which is helpful to realize dual-system backup in the NAT44 scenario.
  • CGN1 and CGN2 are masters and slaves of each other.
  • Each of CGN1 and CGN2 optionally includes multiple CPUs.
  • CGN1 and CGN2 report CPU resources to the CP device respectively.
  • the active/standby relationship of CGN is configured on the CP device. Among them, multiple pairs of active and standby CPU instances are associated with the same loopback address.
  • the route priority corresponding to the loopback address of the primary CGN is higher.
  • a pair of active and standby CPUs serving as CGNs share a public network address, such as 100.1.1.0/24.
  • the route priority of the address segment to which the public network address of the active CPU belongs is higher than that of the address segment to which the public network address of the standby CPU belongs.
  • CGN1 reports the failure event to the CP device.
  • the CP device issues a command to adjust the routing priority to CGN2 (the standby CGN), and raises the priority of the public network address segment of the CPU of the standby CGN.
  • the CR performs policy routing on the UNI traffic according to the policy, and redirects the UNI traffic to CGN1 (the original main CGN). Then, the CR forwards the UNI traffic to the current active CGN2 through the bypass tunnel or direct link between the CGNs. Because the route of the public network address segment has been updated for NNI traffic, NNI traffic is sent directly to CGN2.
  • the primary NAT device and the secondary NAT device not only store the same public network IP address segment, but also configure the same IP address for the tunnel endpoint.
  • the CP device refreshes the routing priority corresponding to the public network address (second IP address) and the priority corresponding to the IP address of the tunnel endpoint on the secondary NAT device to implement dual-system backup in the DS-Lite scenario.
  • the CP device and the backup NAT device will interactively execute the following steps S901 to S903 to implement traffic switching.
  • the CP device sends a first update message and a second update message to the backup NAT device.
  • the first update message is used to instruct the standby NAT device to increase the routing priority corresponding to the second IP address.
  • the second update message is used to instruct the standby NAT device to increase the routing priority corresponding to the third IP address.
  • the third IP address is the IP address of the tunnel endpoint.
  • the tunnel is, for example, a tunnel between the UP device and the NAT device.
  • the tunnel is, for example, a DS-Lite tunnel.
  • the tunnel endpoint is, for example, a NAT device.
  • the tunnel endpoint includes the primary NAT device or the secondary NAT device. Specifically, when the primary NAT device is normal, the tunnel endpoint is the primary NAT device. When the primary NAT device fails, the tunnel endpoint is switched from the original primary NAT device to the backup NAT device.
  • the tunnel endpoint corresponds to a loopback port on the NAT device, and the third IP address is the loopback address.
  • the route priority corresponding to the third IP address on the primary NAT device is high, and the route priority corresponding to the third IP address on the standby NAT device is high.
  • CGN1 and CGN2 are associated with the same loopback address.
  • the loopback address of the tunnel endpoint on CGN1 is 1.1.1.1/32
  • the loopback address of the tunnel endpoint on CGN2 is also 1.1.1.1/32.
  • the route priority of the tunnel endpoint IP address 1.1.1.1/32 on CGN1 is high, and the route priority of the tunnel endpoint IP address 1.1.1.1/32 on CGN2 is low.
  • the loopback address 1.1.1.1/32 is an illustration of the third IP address.
  • CGN1 and CGN2 in FIG. 13 are examples of the primary NAT device and the backup NAT device in a backup relationship with each other.
  • CGN1 and CGN2 are, for example, referred to as a pair of active and standby CPUs.
  • CGN1 and CGN2 share the same public IP address.
  • the public IP address segment on CGN1 is 100.1.1.0/24.
  • the public IP address segment on CGN2 is also 100.1.1.0/24.
  • the route priority of the public network IP address segment 100.1.1.0/24 on CGN1 is high, and the route priority of the public network IP address segment 100.1.1.0/24 on CGN2 is low.
  • the public network IP address segment 100.1.1.0/24 is an example of the network segment to which the second IP address belongs.
  • the standby NAT device receives the first update message and the second update message from the CP device.
  • the standby NAT device In response to the first update message, the standby NAT device increases the routing priority corresponding to the second IP address. And, in response to the second update message, the standby NAT device increases the routing priority corresponding to the third IP address.
  • CGN1 reports the CPU failure event to the CP device.
  • the CP device delivers the first update message and the second update message to CGN2 (standby CGN device), thereby increasing the routing priority of the IP address of the tunnel endpoint of CGN2 (standby CGN device).
  • CGN2 standby CGN device
  • Pre-failure NNI traffic travels between CGN1 and the transport network. NNI traffic is transmitted between CGN2 and the transport network after a failure.
  • the NNI refers to the interface between the CGN device and the PSN (Packet Encapsulation Network) network.
  • NNI traffic is also called public network side traffic, such as the traffic transmitted between the CGN and the network. Before the failure, UNI traffic was transmitted between CGN1 and the UP device. After the failure, the UNI traffic is transmitted between the CGN2 and the UP device.
  • the UNI refers to the communication interface between the network side and the user side, that is, the communication interface between the CGN equipment and the user equipment.
  • UNI traffic is also called user-side traffic, for example, the traffic transmitted between the user equipment and the CGN.
  • the CP device sends the first update message and the second update message to the backup NAT device to notify the backup NAT device to adjust the routing priority corresponding to the public network address and the routing priority corresponding to the tunnel endpoint address. Since the priority of the route corresponding to the public network address of the backup NAT device is increased, the traffic on the network side will be switched from the primary NAT device to the backup NAT device. The traffic on the network side will be switched from the active NAT device to the standby NAT device, so that the standby NAT device will be upgraded to the active NAT device, replacing the previously faulty active NAT device to handle network-side traffic and user-side traffic, avoiding interruption of traffic transmission.
  • this method can be applied to DS-Lite scenarios, which is helpful for realizing dual-system backup in DS-Lite scenarios.
  • Some embodiments of the present application provide a method of how to implement 1:1 hot backup between two UP devices after a user goes online, which is described below with reference to FIG. 14 as an example.
  • the two UP devices are in a backup relationship with each other.
  • One of the two UP devices is the main UP device, that is, the main UP device, and the main UP device is also called the UP device (M).
  • the other UP device in the two UP devices is the standby UP device, that is, the standby UP device, and the standby UP device is also called the UP device (S).
  • the two UP devices are, for example, two independent CGN devices.
  • the CP device communicates with the main UP device and the standby UP device through interfaces such as CPRi, Mi, and SCi.
  • the NAT device is a stand-alone CGN device.
  • the 1:1 hot backup method shown in FIG. 14 includes the following S1001 to S1004.
  • the user goes online, and the CP device delivers the user entry to the primary UP device and the backup UP device at the same time.
  • the terminal sends traffic.
  • the main UP device receives traffic from the terminal.
  • the master UP device forwards the traffic to the CGN device.
  • the traffic sent by the terminal is also called upstream traffic.
  • the CGN device receives traffic from the main UP device, and generates a NAT translation table entry according to the traffic. It can be seen from this step that in this embodiment, the upstream traffic still has to pass through the CGN device.
  • the primary UP device fails, the UP device accessed by the user is switched from the primary UP device to the backup UP device. After the terminal sends traffic, the standby UP device receives the traffic and forwards the traffic to the CGN device. Among them, since the user's private network IPv4 address has not changed, the CGN device does not perceive the fault of the UP device.
  • FIG. 15 shows a possible schematic structural diagram of the CP device.
  • the CP device 110 shown in FIG. 15 implements the functions of the CP device involved in the above method embodiments.
  • the CP device 110 includes an allocation unit 1101 , a sending unit 1102 and a receiving unit 1103 .
  • Each unit in the CP device 110 is implemented in whole or in part by software, hardware, firmware, or any combination thereof.
  • Each unit in the CP device 110 is used to perform each corresponding function of the CP device in the above method 200 .
  • the allocation unit 1101 is configured to support the CP device 110 to perform S210.
  • the sending unit 1102 is configured to support the CP device 110 to perform S220 and S270.
  • the receiving unit 1103 is configured to support the CP device 110 to perform S260.
  • the receiving unit 1103, the allocating unit 1101, or the transmitting unit 1102 are also used to support the CP device 110 to perform other processes performed by the CP device in the techniques described herein.
  • the receiving unit 1103 is configured to support the CP device 110 to perform various receiving operations performed by the CP device in the embodiments of method 300, method 400, method 500, etc., such as S602, S704, and so on.
  • the allocation unit 1101 is used to support the CP device 110 to perform various allocation operations performed by the CP device in embodiments such as method 200, method 300, method 400, method 500, etc., such as S302, S403, etc.; the sending unit 1102 is used to support the CP device 110 to perform Various sending operations performed by the CP device in embodiments such as method 200, method 300, method 400, and method 500, such as S303, S309, S402, S406, S503, S504, S507, S603, S702, S802, S901, or S1001, etc.
  • the various units in the CP device 110 are integrated into one processing unit.
  • each unit in the CP device 110 is integrated on the same chip.
  • the chip includes a processing circuit, an input interface and an output interface that are internally connected and communicated with the processing circuit.
  • the distribution unit 1101 is implemented by a processing circuit in the chip.
  • the receiving unit 1103 is implemented through an input interface in the chip.
  • the sending unit 1102 is implemented through an output interface in the chip.
  • the chip uses one or more field programmable gate arrays (full name in English: field-programmable gate array, English abbreviation: FPGA), programmable logic device (full English name: programmable logic device, English abbreviation: PLD), controller , state machines, gate logic, discrete hardware components, any other suitable circuit, or any combination of circuits capable of performing the various functions described throughout this application.
  • field programmable gate arrays full name in English: field-programmable gate array, English abbreviation: FPGA
  • programmable logic device full English name: programmable logic device, English abbreviation: PLD
  • controller state machines, gate logic, discrete hardware components, any other suitable circuit, or any combination of circuits capable of performing the various functions described throughout this application.
  • each unit of the CP device 110 physically exists independently. In other embodiments, a part of the units of the CP device 110 physically exist separately, and another part of the units are integrated into one unit.
  • allocating unit 1101 and sending unit 1102 are the same unit. In other embodiments, the allocating unit 1101 and the sending unit 1102 are different units.
  • the integration of different units is implemented in the form of hardware, that is, different units correspond to the same hardware. For another example, the integration of different units is implemented in the form of software units.
  • the allocation unit 1101 in the CP device 110 is implemented by, for example, the processor 1401 in the device 1400 .
  • the receiving unit 1103 and the sending unit 1102 in the CP device 110 are implemented, for example, by the communication interface 1404 in the device 1400 .
  • the allocation unit 1101 in the CP device 110 is implemented by, for example, at least one of the central processing unit 1311 , the central processing unit 1331 or the network processor 1332 in the device 1300 .
  • the receiving unit 1103 and the sending unit 1102 in the CP device 110 are implemented, for example, by at least one of the physical interface card 1333 or the physical interface card 1343 in the device 1300 .
  • each unit in the CP device 110 is, for example, software generated after the processor in the device 1400 or the device 1300 reads the program code stored in the memory.
  • the CP device 110 is a virtualized device.
  • the virtualization device includes, but is not limited to, at least one of a virtual machine, a container, and a Pod.
  • the CP device 110 is deployed on a hardware device (eg, a physical server) in the form of a virtual machine.
  • the CP device 110 is implemented based on a general physical server combined with a Network Functions Virtualization (NFV) technology.
  • NFV Network Functions Virtualization
  • the CP device 110 When implemented by a virtual machine, the CP device 110 is, for example, a virtual host, a virtual router or a virtual switch. Those skilled in the art can virtualize the CP device 110 on a general physical server in combination with the NFV technology by reading this application.
  • the CP device 110 is deployed on a hardware device in the form of a container (eg, a docker container).
  • a container e.g, a docker container
  • the process of the CP device 110 executing the above method embodiments is encapsulated in an image file, and the hardware device creates the CP device 110 by running the image file.
  • the CP device 110 is deployed on a hardware device in the form of a Pod.
  • a Pod includes a plurality of containers, each of which is used to implement one or more units in the CP device 110 .
  • FIG. 16 shows a possible schematic structural diagram of a NAT device.
  • the NAT device eg, CGN device
  • the NAT device 120 includes a receiving unit 1201 , an assigning unit 1202 and a sending unit 1203 .
  • Each unit in the NAT device 120 is implemented in whole or in part by software, hardware, firmware, or any combination thereof.
  • Each unit in the NAT device 120 is configured to perform each corresponding function of the NAT device in the above method 200 .
  • the receiving unit 1201 is configured to support the NAT device 120 to perform S230.
  • the allocation unit 1202 is used to support the NAT device 120 to perform S24.
  • the sending unit 1203 is configured to support the NAT device 120 to perform S250.
  • the receiving unit 1201, the allocating unit 1202, or the sending unit 1203 are also used to support the NAT device 120 to perform other processes performed by a NAT device or other processes performed by a CGN device in the techniques described herein.
  • the receiving unit 1201 is configured to support the NAT device 120 to perform various receiving operations performed by the NAT device in embodiments such as method 300, method 400, and method 500, such as at least one of S604, S703, S803, S902, and S1003.
  • the allocation unit 1202 is configured to support the NAT device 120 to perform various processing operations performed by the NAT device in embodiments such as method 300, method 400, and method 500, such as at least one of S304, S404, S505, and S605; the sending unit 1203 is configured to The NAT device 120 is supported to perform various sending operations performed by the NAT device in embodiments such as method 300, method 400, and method 500, such as at least one of S305 and S601.
  • the specific execution process please refer to the detailed description of the corresponding steps in the embodiments such as the method 300 , the method 400 , and the method 500 , which will not be repeated here.
  • the various units in the NAT device 120 are integrated into one processing unit.
  • each unit in the NAT device 120 is integrated on the same chip.
  • the chip includes a processing circuit, an input interface and an output interface that are internally connected and communicated with the processing circuit.
  • the distribution unit 1202 is implemented by a processing circuit in the chip.
  • the receiving unit 1201 is implemented by an input interface in the chip.
  • the sending unit 1203 is implemented through an output interface in the chip.
  • the chip uses one or more field programmable gate arrays (full name in English: field-programmable gate array, English abbreviation: FPGA), programmable logic device (full English name: programmable logic device, English abbreviation: PLD), controller , state machines, gate logic, discrete hardware components, any other suitable circuit, or any combination of circuits capable of performing the various functions described throughout this application.
  • field programmable gate arrays full name in English: field-programmable gate array, English abbreviation: FPGA
  • programmable logic device full English name: programmable logic device, English abbreviation: PLD
  • controller state machines, gate logic, discrete hardware components, any other suitable circuit, or any combination of circuits capable of performing the various functions described throughout this application.
  • each unit of the NAT device 120 exists physically separately. In other embodiments, some units of the NAT device 120 exist physically alone, and some units are integrated into one unit. For example, in some embodiments, allocating unit 1202 and sending unit 1203 are the same unit. In other embodiments, the allocating unit 1202 and the sending unit 1203 are different units. In some embodiments, the integration of different units is implemented in the form of hardware, that is, different units correspond to the same hardware. For another example, the integration of different units is implemented in the form of software units.
  • the allocation unit 1202 in the NAT device 120 is implemented, for example, by the processor 1401 in the device 1400 .
  • the receiving unit 1201 and the sending unit 1203 in the NAT device 120 are implemented, for example, by the communication interface 1404 in the device 1400 .
  • the allocation unit 1202 in the NAT device 120 is implemented by, for example, at least one of the central processing unit 1311 , the central processing unit 1331 or the network processing unit 1332 in the device 1300 .
  • the receiving unit 1201 and the sending unit 1203 in the NAT device 120 are implemented, for example, by at least one of the physical interface card 1333 or the physical interface card 1343 in the device 1300 .
  • each unit in the NAT device 120 is, for example, software generated after the processor in the device 1400 or the device 1300 reads the program code stored in the memory.
  • NAT device 120 is a virtualized device.
  • the virtualization device includes, but is not limited to, at least one of a virtual machine, a container, and a Pod.
  • the NAT device 120 is deployed on a hardware device (eg, a physical server) in the form of a virtual machine.
  • the NAT device 120 is implemented based on a general physical server combined with a Network Functions Virtualization (NFV) technology.
  • NFV Network Functions Virtualization
  • the NAT device 120 When implemented by a virtual machine, the NAT device 120 is, for example, a virtual host, a virtual router or a virtual switch. Those skilled in the art can virtualize the NAT device 120 on a general physical server in combination with the NFV technology by reading this application.
  • the NAT device 120 is deployed on a hardware device in the form of a container (eg, a docker container).
  • the process of the NAT device 120 executing the above method embodiments is encapsulated in an image file, and the hardware device creates the NAT device 120 by running the image file.
  • the NAT device 120 is deployed on a hardware device in the form of a Pod.
  • a Pod includes a plurality of containers, each of which is used to implement one or more units in the NAT device 120 .
  • the above describes how to implement the CP device and the NAT device respectively from the perspective of logical functions.
  • the following describes how to implement the CP device and the NAT device from the perspective of hardware through the device 1300 or the device 1400 .
  • the device 1300 shown in FIG. 17 or the device 1400 shown in FIG. 18 is an example of the hardware structure of the CP device and the NAT device.
  • the device 1300 or the device 1400 corresponds to the CP device or the NAT device in each of the above method embodiments, and the hardware, modules and the above-mentioned other operations and/or functions in the device 1300 or the device 1400 are respectively for realizing the CP device or the NAT device in the method embodiments.
  • the various steps and methods implemented, and the detailed process of how the device 1300 or the device 1400 implements RADIUS-based NAT source tracing, can refer to the above-mentioned respective method embodiments for details, which are not repeated here for brevity. Wherein, each step of each method embodiment is completed by an integrated logic circuit of hardware in the processor of the device 1300 or the device 1400 or an instruction in the form of software.
  • the steps of the methods disclosed in conjunction with the embodiments of the present application may be directly embodied as executed by a hardware processor, or executed by a combination of hardware and software modules in the processor.
  • the software modules are located in, for example, random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory, registers and other storage media mature in the art.
  • the storage medium is located in the memory, and the processor reads the information in the memory, and completes the steps of the above method in combination with its hardware, which will not be described in detail here to avoid repetition.
  • FIG. 17 shows a schematic structural diagram of a device 1300 provided by an exemplary embodiment of the present application.
  • the device 1300 is configured as a CP device or a NAT device, for example.
  • the device 1300 includes: a main control board 1310 and an interface board 1330 .
  • the main control board is also called the main processing unit (MPU) or the route processor card (route processor card).
  • the main control board 1310 is used to control and manage various components in the device 1300, including route calculation, device management, Equipment maintenance, protocol processing functions.
  • the main control board 1310 includes: a central processing unit 1311 and a memory 1312 .
  • the interface board 1330 is also referred to as a line processing unit (LPU), a line card or a service board.
  • the interface board 1330 is used to provide various service interfaces and realize data packet forwarding.
  • the service interface includes, but is not limited to, an Ethernet interface, a POS (Packet over SONET/SDH) interface, etc.
  • the Ethernet interface is, for example, a flexible Ethernet service interface (Flexible Ethernet Clients, FlexE Clients).
  • the interface board 1330 includes: a central processing unit 1331 , a network processor 1332 , a forwarding table entry memory 1334 and a physical interface card (PIC) 1333 .
  • PIC physical interface card
  • the central processing unit 1331 on the interface board 1330 is used to control and manage the interface board 1330 and communicate with the central processing unit 1311 on the main control board 1310 .
  • the network processor 1332 is used to implement packet forwarding processing.
  • the form of the network processor 1332 is, for example, a forwarding chip.
  • the network processor 1332 is configured to forward the received message based on the forwarding table stored in the forwarding table entry memory 1334. If the destination address of the message is the address of the device 1300, the message is sent to the CPU (eg The central processing unit 1311) processes; if the destination address of the message is not the address of the device 1300, the next hop and outgoing interface corresponding to the destination address are found from the forwarding table according to the destination address, and the message is forwarded to the destination The outbound interface corresponding to the address.
  • the processing of the uplink packet includes: processing the incoming interface of the packet, and searching the forwarding table; processing of the downlink packet: searching the forwarding table, and so on.
  • the physical interface card 1333 is used to realize the interconnection function of the physical layer, the original traffic enters the interface board 1330 through this, and the processed packets are sent from the physical interface card 1333 .
  • the physical interface card 1333 also called a daughter card, can be installed on the interface board 1330, and is responsible for converting the optoelectronic signal into a message, and after checking the validity of the message, it is forwarded to the network processor 1332 for processing.
  • the central processing unit may also perform the functions of the network processor 1332, such as implementing software forwarding based on a general-purpose CPU, so that the network processor 1332 is not required in the physical interface card 1333.
  • the device 1300 includes multiple interface boards, for example, the device 1300 further includes an interface board 1340 , and the interface board 1340 includes a central processing unit 1341 , a network processor 1342 , a forwarding table entry storage 1344 and a physical interface card 1343 .
  • the interface board 1340 includes a central processing unit 1341 , a network processor 1342 , a forwarding table entry storage 1344 and a physical interface card 1343 .
  • the device 1300 further includes a switch fabric board 1320 .
  • the switch fabric 1320 is also called, for example, a switch fabric unit (switch fabric unit, SFU).
  • SFU switch fabric unit
  • the switching network board 1320 is used to complete data exchange between the interface boards.
  • the communication between the interface board 1330 and the interface board 1340 is through the switch fabric board 1320, for example.
  • the main control board 1310 and the interface board 1330 are coupled.
  • the main control board 1310 , the interface board 1330 , the interface board 1340 , and the switch fabric board 1320 are connected to the system backplane through a system bus to realize intercommunication.
  • an inter-process communication (inter-process communication, IPC) channel is established between the main control board 1310 and the interface board 1330, and the main control board 1310 and the interface board 1330 communicate through the IPC channel.
  • IPC inter-process communication
  • the device 1300 includes a control plane and a forwarding plane
  • the control plane includes the main control board 1310 and the central processing unit 1331
  • the forwarding plane includes various components that perform forwarding, such as the forwarding entry memory 1334, the physical interface card 1333 and the network processor 1332.
  • the control plane performs functions such as routers, generating forwarding tables, processing signaling and protocol packets, configuring and maintaining device status, etc.
  • the control plane delivers the generated forwarding tables to the forwarding plane.
  • the network processor 1332 based on the control plane
  • the delivered forwarding table is forwarded to the packet received by the physical interface card 1333 by looking up the table.
  • the forwarding table issued by the control plane is stored in the forwarding table entry storage 1334, for example.
  • the control plane and the forwarding plane are, for example, completely separate and not on the same device.
  • the operations on the interface board 1340 in the embodiments of the present application are the same as the operations on the interface board 1330, and for brevity, details are not repeated here.
  • the device 1300 in this embodiment may correspond to the CP device or the NAT device in the above method embodiments, and the main control board 1310, the interface board 1330 and/or 1340 in the device 1300, for example, implement the above method embodiments
  • the functions of the CP device or the NAT device and/or the various steps implemented are not repeated here.
  • main control boards there may be one or more main control boards, and when there are multiple main control boards, for example, the main control board and the backup main control board are included.
  • a network device may have at least one switching network board, and the switching network board realizes data exchange between multiple interface boards, providing large-capacity data exchange and processing capabilities. Therefore, the data access and processing capabilities of network devices in a distributed architecture are greater than those in a centralized architecture.
  • the form of the network device can also be that there is only one board, that is, there is no switching network board, and the functions of the interface board and the main control board are integrated on this board.
  • the central processing unit on the board can be combined into a central processing unit on this board to perform the functions of the two superimposed, the data exchange and processing capacity of this form of equipment is low (for example, low-end switches or routers and other networks. equipment).
  • the specific architecture used depends on the specific networking deployment scenario, and there is no restriction here.
  • FIG. 18 shows a schematic structural diagram of a device 1400 provided by an exemplary embodiment of the present application.
  • the device 1400 may be configured as a CP device or a NAT device.
  • the device 1400 may be a host computer, a server, or a personal computer, among others.
  • the device 1400 may be implemented by a general bus architecture.
  • Device 1400 includes at least one processor 1401, communication bus 1402, memory 1403, and at least one communication interface 1404.
  • the processor 1401 is, for example, a general-purpose central processing unit (central processing unit, CPU), a network processor (network processor, NP), a graphics processing unit (Graphics Processing Unit, GPU), a neural-network processing unit (neural-network processing units, NPU) ), a data processing unit (Data Processing Unit, DPU), a microprocessor or one or more integrated circuits for implementing the solution of the present application.
  • the processor 1401 includes an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof.
  • the PLD is, for example, a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.
  • a communication bus 1402 is used to transfer information between the aforementioned components.
  • the communication bus 1402 can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is shown in FIG. 18, but it does not mean that there is only one bus or one type of bus.
  • the memory 1403 is, for example, a read-only memory (read-only memory, ROM) or other types of static storage devices that can store static information and instructions, or a random access memory (random access memory, RAM) or a memory device that can store information and instructions.
  • Other types of dynamic storage devices such as electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disk storage, optical disks storage (including compact discs, laser discs, compact discs, digital versatile discs, Blu-ray discs, etc.), magnetic disk storage media, or other magnetic storage devices, or capable of carrying or storing desired program code in the form of instructions or data structures and capable of Any other medium accessed by a computer without limitation.
  • the memory 1403 exists independently, for example, and is connected to the processor 1401 through the communication bus 1402 .
  • the memory 1403 may also be integrated with the processor 1401.
  • the Communication interface 1404 uses any transceiver-like device for communicating with other devices or a communication network.
  • the communication interface 1404 includes a wired communication interface and may also include a wireless communication interface.
  • the wired communication interface may be, for example, an Ethernet interface.
  • the Ethernet interface can be an optical interface, an electrical interface or a combination thereof.
  • the wireless communication interface may be a wireless local area network (wireless local area networks, WLAN) interface, a cellular network communication interface or a combination thereof, and the like.
  • the processor 1401 may include one or more CPUs, such as CPU0 and CPU1 shown in FIG. 18 .
  • the device 1400 may include multiple processors, such as the processor 1401 and the processor 1405 shown in FIG. 18 .
  • processors can be a single-core processor (single-CPU) or a multi-core processor (multi-CPU).
  • a processor herein may refer to one or more devices, circuits, and/or processing cores for processing data (eg, computer program instructions).
  • the device 1400 may further include an output device and an input device.
  • the output device communicates with the processor 1401 and can display information in a variety of ways.
  • the output device may be a liquid crystal display (LCD), a light emitting diode (LED) display device, a cathode ray tube (CRT) display device, a projector, or the like.
  • the input device communicates with the processor 1401 and can receive user input in a variety of ways.
  • the input device may be a mouse, a keyboard, a touch screen device, or a sensor device, or the like.
  • the memory 1403 is used to store the program code 1410 for executing the solutions of the present application, and the processor 1401 can execute the program code 1410 stored in the memory 1403 . That is, the device 1400 can implement the method provided by the method embodiment through the processor 1401 and the program code 1410 in the memory 1403 .
  • the device 1400 in this embodiment of the present application may correspond to the CP device or the NAT device in the foregoing method embodiments, and the processor 1401, the communication interface 1404, and the like in the device 1400 may implement the CP device or the NAT device in the foregoing method embodiments.
  • the functions and/or the various steps and methods implemented by the NAT device are not repeated here.
  • an embodiment of the present application provides a communication system 1500 .
  • the system 1500 includes: a CP device 1501 and a NAT device 1502 .
  • the CP device 1501 is the CP device 1100 shown in FIG. 15 or the device 1300 shown in FIG. 17 or the device 1400 shown in FIG. 18
  • the NAT device 1502 is the NAT device 1200 shown in FIG. 16 or The apparatus 1300 shown in FIG. 17 or the apparatus 1400 shown in FIG. 18 .
  • the disclosed system, apparatus and method may be implemented in other manners.
  • the apparatus embodiments described above are only illustrative.
  • the division of the unit is only a logical function division.
  • there may be other division methods for example, multiple units or components may be combined or Integration into another system, or some features can be ignored, or not implemented.
  • the shown or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or units, and may also be electrical, mechanical or other forms of connection.
  • the unit described as a separate component may or may not be physically separated, and the component displayed as a unit may or may not be a physical unit, that is, it may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solutions of the embodiments of the present application.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit.
  • the above-mentioned integrated units may be implemented in the form of hardware, or may be implemented in the form of software functional units.
  • the integrated unit if implemented in the form of a software functional unit and sold or used as a stand-alone product, may be stored in a computer-readable storage medium.
  • the technical solutions of the present application are essentially or part of contributions to the prior art, or all or part of the technical solutions can be embodied in the form of software products, and the computer software products are stored in a storage medium , including several instructions to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods in the various embodiments of the present application.
  • the aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), magnetic disk or optical disk and other media that can store program codes .
  • first and second are used to distinguish the same or similar items with basically the same function and function. It should be understood that there is no logic or sequence between “first” and “second”. There are no restrictions on the number and execution order. It will also be understood that, although the following description uses the terms first, second, etc. to describe various elements, these elements should not be limited by the terms. These terms are only used to distinguish one element from another. For example, a first IP address may be referred to as a second IP address, and similarly, a second IP address may be referred to as a first IP address, without departing from the scope of various examples. Both the first IP address and the second IP address may be IP addresses, and in some cases, may be separate and distinct IP addresses.
  • the above-mentioned embodiments it may be implemented in whole or in part by software, hardware, firmware or any combination thereof.
  • software it can be implemented in whole or in part in the form of a computer program product.
  • the computer program product includes one or more computer program instructions.
  • the computer program instructions When the computer program instructions are loaded and executed on a computer, the procedures or functions according to the embodiments of the present application are generated in whole or in part.
  • the computer may be a general purpose computer, a special purpose computer, a computer network, or other programmable device.
  • the computer instructions may be stored in or transmitted from one computer readable storage medium to another computer readable storage medium, for example, the computer program instructions may be transmitted from a website site, computer, server or data center via Wired or wireless transmission to another website site, computer, server or data center.
  • the computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server, data center, etc. that includes one or more available media integrated.
  • the available media may be magnetic media (eg, floppy disks, hard disks, magnetic tapes), optical media (eg, digital video discs (DVDs), or semiconductor media (eg, solid state drives), and the like.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Business, Economics & Management (AREA)
  • Accounting & Taxation (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请提供了一种通信方法、CP设备及NAT设备，属于通信技术领域，涉及基于CU分离BNG进行NAT溯源的场景。CP设备将为用户分配的IP地址下发给NAT设备，NAT设备在接收到CP设备下发的IP地址的触发条件下为用户分配公网IP地址，将公网IP地址上报给CP设备。CP设备在计费报文中携带CP设备分配的IP地址以及NAT设备分配的公网IP地址，向RADIUS服务器发送计费报文，从而将公网IP地址上报给RADIUS服务器，以便在RADIUS服务器上进行NAT溯源。由于NAT溯源采用了RADIUS溯源的方式，摆脱了需要建设日志服务器才能NAT溯源的限制，因此节省了建设日志服务器带来的成本。

Description

通信方法、CP设备及NAT设备
本申请要求于2020年07月22日提交的申请号为202010712973.3、发明名称为“通信方法、CP设备及NAT设备”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域，特别涉及一种通信方法、CP设备及NAT设备。
背景技术
随着宽带用户数量的激增，公网的互联网协议(Internet Protocol，IP)地址(如公网互联网协议第四版(Internet Protocol version 4，IPv4)地址)面临资源不足的问题。有鉴于此，提供了网络地址转换(Network Address Translation，NAT)技术以及运营商级NAT(Carrier Grade NAT，CGN)等执行NAT技术的NAT设备来解决这一问题。具体地，宽带网络网关(Broadband Network Gateway，BNG)等网关设备会为用户分配私网IP地址。NAT设备会将私网IP地址转换为公网IP地址，以便通过转换后的公网IP地址支持用户访问公网。由于多个私网IP地址能够转换为同一个公网IP地址，从而有效解决了公网IP地址资源不足的问题。其中，由于NAT功能的部署会隐藏用户的私网IP地址，通常要求在部署NAT功能的同时实现溯源的功能。溯源是指能够根据用户的公网IP地址查询到用户的私网IP地址，以便根据私网IP地址锁定到具体用户。
从存在形态的角度来说，NAT设备分为独立式NAT设备(如独立式CGN设备)和插卡式NAT设备(如CGN板卡)。独立式NAT设备的形态是一个独立的设备。独立式NAT设备通过线路和BNG等网关设备网络相连。插卡式NAT设备的形态是一个板卡，插卡式NAT设备插在BNG等网关设备的槽位上，从而与网关设备集成在一起。
在网关设备采用小型化设备(如迷你BNG)实现的情况下，由于小型化设备不具备单独的槽位以插放插卡式NAT设备，NAT的功能通常采用独立式NAT设备实现。在这一情况下，溯源功能通常是在流量转发阶段通过日志(Log)服务器实现的。具体地，当用户设备发送数据报文后，数据报文会被转发至NAT设备。NAT设备接收数据报文，将数据报文中的源IP从私网IP地址转换为公网IP地址。同时，NAT设备根据私网IP地址和公网IP地址生成NAT日志。NAT设备将NAT日志发送至日志服务器。NAT日志包括私网IP地址与公网IP地址之间的映射关系。当需要溯源时，日志服务器根据公网IP地址查询NAT日志，从NAT日志中得到公网IP地址对应的私网IP地址，从而在日志服务器上实现溯源。
目前基于独立式NAT设备进行溯源的方法依赖于日志服务器。因此，运营商需要投资建设日志服务器才能实现溯源的目的，这导致溯源的成本过高。
发明内容
本申请实施例提供了一种通信方法、CP设备及NAT设备，有助于减少溯源的成本。所述技术方案如下。
第一方面，提供了一种通信方法，该方法应用于控制面(control plane，CP)和用户面(user plane，UP)分离的通信系统中，以CP设备执行该方法为例，所述CP设备为用户分配IP地址。CP设备将分配的IP地址下发给NAT设备，NAT设备在接收到CP设备下发的IP地址的触发条件下，为用户分配CP设备下发的IP地址所对应的公网IP地址，将公网IP地址上报给CP设备。CP设备根据NAT设备上报的公网IP地址，在计费报文中携带CP设备分配的IP地址以及NAT设备分配的公网IP地址，向远程用户拨号认证服务(remote authentication dial in user service，RADIUS)服务器发送计费报文，从而将CP设备分配的IP地址以及NAT设备分配的公网IP地址上报给RADIUS服务器，以便在RADIUS服务器上进行NAT溯源。
一方面，由于NAT溯源采用了RADIUS溯源的方式，能够通过复用RADIUS服务器进行溯源，摆脱了需要建设日志服务器才能溯源的限制，减少溯源的成本。另一方面，适于应用在NAT设备采用独立式NAT设备实现的场景，有助于解决NAT设备采用业务单板等插卡式NAT设备实现时会面临的UP槽位不足、NAT处理能力不足等问题。
可选地，所述第一IP地址包括私网IPv4地址或者互联网协议第六版(internet protocol version 6，IPv6)地址中的至少一项。
通过这种可选方式，CP设备通过分配私网IPv4地址以及向NAT设备下发私网IPv4地址，有助于支持NAT44(NAT IPv4-IPv4)场景下实现RADIUS溯源。CP设备通过分配IPv6地址以及向NAT设备下发IPv6地址，有助于支持轻量级双栈(dual stack lite，DS-Lite)场景等双栈网络中实现RADIUS溯源。
可选地，所述通信系统包括网关系统，所述网关系统为宽带网络网关BNG系统或者宽带远程接入服务器(virtual broadband remote access server，BRAS)系统。
通过这种可选方式，通过选用BNG系统中的CP或者BRAS系统中的CP实现本实施例方案，有助于复用BNG系统或者BRAS系统的网络架构，降低实现复杂度。
可选地，所述计费报文还包括端口块，所述端口块包括所述NAT设备为所述用户分配的至少一个端口号；所述CP设备从所述NAT设备接收第二IP地址，包括：所述CP设备从所述NAT设备接收所述用户的信息，所述用户的信息包括所述第一IP地址、所述第二IP地址和所述端口块的对应关系。
可选地，所述CP设备从所述NAT设备接收所述端口块之前，所述方法还包括：所述CP设备从所述RADIUS服务器接收端口块集合，所述端口块集合包括所述端口块；所述CP设备向所述NAT设备发送所述端口块集合。
通过这种可选方式，在运营商需要指定用户的端口块的范围的场景下，通过由RADIUS服务器向CP设备下发端口块集合，再由CP设备将端口块集合下发给NAT设备，从而指定NAT设备在端口块集合内分配端口块，因此满足了指定NAT端口块范围的需求。尤其是，CP通过将RADIUS指定的端口块集合和IP地址一起下发给NAT设备，使得通过RADIUS指定端口块范围的过程和触发NAT设备分配公网IP的过程得以同时执行，减少了通信开销和实现复杂度。
可选地，所述CP设备向RADIUS服务器发送计费报文之后，所述方法还包括以下至少一项：若所述用户下线，所述CP设备向所述NAT设备发送删除消息，所述删除消息用于指示所述NAT设备删除所述NAT设备上保存的所述用户的信息；若所述用户下线，所述CP设备删除所述CP设备上保存的所述用户的信息。
通过这种可选方式，CP设备通过在用户下线时指示NAT设备删除用户的信息，从而及时释放已下线的用户的信息在NAT设备上占用的存储空间，节省了NAT设备的存储资源，避免NAT设备上资源耗空的问题。CP设备通过在用户下线时删除本地保存的用户的信息，从而及时释放已下线的用户的信息在CP设备上占用的存储空间，节省了CP设备的存储资源，避免CP设备上资源耗空的问题。
可选地，所述NAT设备包括互为备份关系的主NAT设备和备NAT设备，所述CP设备从所述NAT设备接收第二IP地址，包括：所述CP设备从所述主NAT设备接收所述用户的信息。
通过这种可选方式，CP设备通过将主NAT设备发来的用户的信息下发给备NAT设备，使得备NAT设备获得了主NAT设备上保存的用户的信息。一方面，实现了备NAT设备与主NAT设备之间用户的信息的同步，从而能在主NAT设备故障时触发主备倒换，实现业务正常运行。另一方面，备NAT设备与主NAT设备不需要部署类似虚拟路由冗余协议(Virtual Router Redundancy Protocol，VRRP)的主备选举机制，这样就不需要在主NAT设备与备NAT设备之间拉直连线，简化配置和部署资源。
可选地，所述CP设备从所述主NAT设备接收所述用户的信息之后，所述方法还包括：
所述CP设备向所述备NAT设备发送所述用户的信息。
可选地，所述方法还包括：若所述主NAT设备处于故障状态，所述CP设备向所述备NAT设备发送第一更新消息，所述第一更新消息用于指示所述备NAT设备提高所述第二IP地址对应的路由优先级。
当主NAT设备发生故障时，CP设备通过向备NAT设备下发第一更新消息，从而通知备NAT设备调整公网地址对应的路由优先级，由于备NAT设备的公网地址对应的路由优先级升高，因此网络侧的流量会从主NAT设备切换至备NAT设备上，使得备NAT设备升级为主NAT设备，代替之前故障的主NAT设备处理网络侧的流量，避免流量传输中断。此外，由于流量的切换是CP设备引导的，能够保证主NAT设备与备NAT设备不会存在流量绕行。尤其是，该方法能够适用于NAT44场景，有助于NAT44场景下实现双机备份。
可选地，所述方法还包括：若所述主NAT设备处于故障状态，所述CP设备向所述备NAT设备发送第二更新消息，所述第二更新消息用于指示所述备NAT设备提高第三IP地址对应的路由优先级，所述第三IP地址为隧道端点的IP地址，所述隧道端点包括所述主NAT设备或者所述备NAT设备。
当主NAT设备发生故障时，CP设备通过向备NAT设备下发第一更新消息和第二更新消息，从而通知备NAT设备调整公网地址对应的路由优先级以及隧道端点地址对应的路由优先级，由于备NAT设备的公网地址对应的路由优先级升高，因此网络侧的流量会从主NAT设备切换至备NAT设备，由于备NAT设备的隧道端点地址对应的路由优先级升高，因此用户侧的流量会从主NAT设备切换至备NAT设备，使得备NAT设备升级为主NAT设备，代替之前故障的主NAT设备处理网络侧的流量和用户侧的流量，避免流量传输中断。此外，由于流量的切换是CP设备引导的，能够保证主NAT设备与备NAT设备不会存在流量绕行。尤其是，该方法能够适用于DS-Lite场景，有助于DS-Lite场景下实现双机备份。
第二方面，提供了一种通信方法，以该方法由NAT设备执行为例，所述NAT设备从CP 设备接收所述CP设备为用户分配的第一IP地址，所述CP设备是CP和UP分离的通信系统中的CP设备；所述NAT设备为所述用户分配第二IP地址，所述第二IP地址为公网IP地址；所述NAT设备向所述CP设备发送所述第二IP地址。NAT设备分配公网IP地址后向CP设备上报该公网IP地址，以便CP设备在计费报文中携带CP设备分配的IP地址以及NAT设备分配的公网IP地址，向远程用户拨号认证服务(remote authentication dial in user service，RADIUS)服务器发送计费报文，从而将CP设备分配的IP地址以及NAT设备分配的公网IP地址上报给RADIUS服务器，以便在RADIUS服务器上进行NAT溯源。
一方面，由于NAT溯源采用了RADIUS溯源的方式，能够通过复用RADIUS服务器进行溯源，摆脱了需要建设日志服务器才能溯源的限制，减少溯源的成本。另一方面，适于应用在NAT设备采用独立式NAT设备实现的场景，有助于解决NAT设备采用业务单板等插卡式NAT设备实现时会面临的UP槽位不足、NAT处理能力不足等问题。
可选地，所述NAT设备从CP设备接收所述CP设备为用户分配的第一IP地址之后，所述方法还包括：所述NAT设备为所述用户分配端口块，所述端口块包括至少一个端口号；所述NAT设备向所述CP设备发送所述端口块。
可选地，所述NAT设备为所述用户分配端口块之前，所述方法还包括：所述NAT设备从所述CP设备接收端口块集合；所述NAT设备为所述用户分配端口块，包括：所述NAT设备在所述端口块集合内，为所述用户分配端口块。
可选地，所述NAT设备为所述用户分配第二IP地址之后，所述方法还包括：所述NAT设备保存所述用户的信息，所述用户的信息包括所述第一IP地址、所述第二IP地址和所述端口块的对应关系。
可选地，所述NAT设备向所述CP设备发送所述第二IP地址，包括：所述NAT设备向所述CP设备发送所述用户的信息。
可选地，所述NAT设备向所述CP设备发送所述第二IP地址之后，所述方法还包括：所述NAT设备从所述CP设备接收删除消息；响应于所述删除消息，所述NAT设备删除所述用户的信息。
可选地，所述NAT设备为互为备份关系的主NAT设备和备NAT设备中的备NAT设备，所述NAT设备为所述用户分配第二IP地址之前，所述方法还包括：
所述备NAT设备从所述CP设备接收所述用户的信息，所述用户的信息包括所述第一IP地址、所述第二IP地址和端口块的对应关系，所述端口块包括至少一个端口号；所述NAT设备为所述用户分配第二IP地址，包括：在所述主NAT设备故障时，所述备NAT设备根据所述用户的信息为所述用户分配所述第二IP地址。
可选地，所述方法还包括：所述备NAT设备从所述CP设备接收第一更新消息；响应于所述第一更新消息，所述备NAT设备提高所述第二IP地址对应的路由优先级。
可选地，所述方法还包括：所述备NAT设备从所述CP设备接收第二更新消息；
响应于所述第二更新消息，所述备NAT设备提高第三IP地址对应的路由优先级，所述第三IP地址为隧道端点的IP地址，所述隧道端点包括所述主NAT设备或者所述备NAT设备。
第三方面，提供了一种CP设备，所述CP设备位于CP和UP分离的通信系统中，所述 CP设备包括：
分配单元，用于为用户分配第一IP地址；
发送单元，用于向NAT设备发送所述第一IP地址；
接收单元，用于从所述NAT设备接收第二IP地址，所述第二IP地址为所述NAT设备为所述用户分配的公网IP地址；
所述发送单元，还用于向RADIUS服务器发送计费报文，所述计费报文包括所述第一IP地址和所述第二IP地址。
可选地，所述第一IP地址包括私网IPv4地址或者IPv6地址中的至少一项。
可选地，所述通信系统包括网关系统，所述网关系统为BNG系统或者BRAS系统。
可选地，所述计费报文还包括端口块，所述端口块包括所述NAT设备为所述用户分配的至少一个端口号；
所述接收单元，用于从所述NAT设备接收所述用户的信息，所述用户的信息包括所述第一IP地址、所述第二IP地址和所述端口块的对应关系。
可选地，所述接收单元，还用于从所述RADIUS服务器接收端口块集合，所述端口块集合包括所述端口块；
所述发送单元，还用于向所述NAT设备发送所述端口块集合。
可选地，所述发送单元，还用于若所述用户下线，向所述NAT设备发送删除消息，所述删除消息用于指示所述NAT设备删除所述NAT设备上保存的所述用户的信息；
所述CP设备还包括：删除单元，用于若所述用户下线，删除所述CP设备上保存的所述用户的信息。
可选地，所述NAT设备包括互为备份关系的主NAT设备和备NAT设备，所述接收单元，用于从所述主NAT设备接收所述用户的信息。
可选地，所述发送单元，还用于向所述备NAT设备发送所述用户的信息。
可选地，所述发送单元，还用于若所述主NAT设备处于故障状态，向所述备NAT设备发送第一更新消息，所述第一更新消息用于指示所述备NAT设备提高所述第二IP地址对应的路由优先级。
可选地，所述发送单元，还用于若所述主NAT设备处于故障状态，向所述备NAT设备发送第二更新消息，所述第二更新消息用于指示所述备NAT设备提高第三IP地址对应的路由优先级，所述第三IP地址为隧道端点的IP地址，所述隧道端点包括所述主NAT设备或者所述备NAT设备。
在一些实施例中，第三方面提供的CP设备中的单元通过软件实现，CP设备中的单元是程序单元。在另一些实施例中，第三方面提供的CP设备中的单元通过硬件或固件实现。
第四方面，提供了一种NAT设备，所述NAT设备包括：
接收单元，用于从CP设备接收所述CP设备为用户分配的第一IP地址，所述CP设备是CP和UP分离的通信系统中的CP设备；
分配单元，用于为所述用户分配第二IP地址，所述第二IP地址为公网IP地址；
发送单元，用于向所述CP设备发送所述第二IP地址。
可选地，所述分配单元，还用于为所述用户分配端口块，所述端口块包括至少一个端口 号；
所述发送单元，还用于向所述CP设备发送所述端口块。
可选地，所述接收单元，还用于从所述CP设备接收端口块集合；
所述分配单元，用于在所述端口块集合内，为所述用户分配端口块。
可选地，所述NAT设备还包括：保存单元，用于保存所述用户的信息，所述用户的信息包括所述第一IP地址、所述第二IP地址和所述端口块的对应关系。
可选地，所述发送单元，用于向所述CP设备发送所述用户的信息。
可选地，所述接收单元，还用于从所述CP设备接收删除消息；
所述NAT设备还包括：删除单元，用于响应于所述删除消息，所述NAT设备删除所述用户的信息。
可选地，所述NAT设备为互为备份关系的主NAT设备和备NAT设备中的备NAT设备，所述接收单元，还用于从所述CP设备接收所述用户的信息，所述用户的信息包括所述第一IP地址、所述第二IP地址和端口块的对应关系，所述端口块包括至少一个端口号；
所述分配单元，还用于在所述主NAT设备故障时，根据所述用户的信息为所述用户分配所述第二IP地址。
可选地，所述接收单元，还用于从所述CP设备接收第一更新消息；所述NAT设备还包括：提高单元，用于响应于所述第一更新消息，提高所述第二IP地址对应的路由优先级。
可选地，所述接收单元，还用于从所述CP设备接收第二更新消息；所述NAT设备还包括：提高单元，用于响应于所述第二更新消息，提高第三IP地址对应的路由优先级，所述第三IP地址为隧道端点的IP地址，所述隧道端点包括所述主NAT设备或者所述备NAT设备。
在一些实施例中，第四方面提供的NAT设备中的单元通过软件实现，NAT设备中的单元是程序单元。在另一些实施例中，第四方面提供的NAT设备中的单元通过硬件或固件实现。
第五方面，提供了一种CP设备，该CP设备包括处理器和通信接口，该处理器用于执行指令，使得该CP设备执行上述第一方面或第一方面任一种可选方式所提供的通信方法，所述通信接口用于接收或发送报文。第五方面提供的CP设备的具体细节可参见上述第一方面或第一方面任一种可选方式，此处不再赘述。
第六方面，提供了一种NAT设备，该NAT设备包括处理器和通信接口，该处理器用于执行指令，使得该NAT设备执行上述第二方面或第二方面任一种可选方式所提供的通信方法，所述通信接口用于接收或发送报文。第六方面提供的NAT设备的具体细节可参见上述第二方面或第二方面任一种可选方式，此处不再赘述。
第七方面，提供了一种计算机可读存储介质，该存储介质中存储有至少一条指令，该指令由处理器读取以使CP设备执行上述第一方面或第一方面任一种可选方式所提供的通信方法。
第八方面，提供了一种计算机可读存储介质，该存储介质中存储有至少一条指令，该指令由处理器读取以使NAT设备执行上述第二方面或第二方面任一种可选方式所提供的通信 方法。
第九方面，提供了一种计算机程序产品，该计算机程序产品包括计算机指令，该计算机指令存储在计算机可读存储介质中。CP设备的处理器从计算机可读存储介质读取该计算机指令，处理器执行该计算机指令，使得该CP设备执行上述第一方面或第一方面任一种可选方式所提供的通信方法。
第十方面，提供了一种计算机程序产品，该计算机程序产品包括计算机指令，该计算机指令存储在计算机可读存储介质中。NAT设备的处理器从计算机可读存储介质读取该计算机指令，处理器执行该计算机指令，使得该NAT设备执行上述第一方面或第一方面任一种可选方式所提供的通信方法。
第十一方面，提供了一种芯片，当该芯片在CP设备上运行时，使得CP设备执行上述第一方面或第一方面任一种可选方式所提供的通信方法。
第十二方面，提供了一种芯片，当该芯片在NAT设备上运行时，使得NAT设备执行上述第二方面或第二方面任一种可选方式所提供的通信方法。
第十三方面，提供了一种通信系统，该通信系统包括CP设备以及NAT设备，该CP设备用于执行上述第一方面或第一方面任一种可选方式所述的方法，该NAT设备用于执行上述第二方面或第二方面任一种可选方式所述的方法。
第十四方面，提供了一种CP设备，该CP设备包括：中央处理器、网络处理器和物理接口。中央处理器用于执行如下操作：为用户分配第一IP地址。
网络处理器用于触发物理接口执行如下操作：向NAT设备发送所述第一IP地址；从所述NAT设备接收第二IP地址；向RADIUS服务器发送计费报文。
可选地，所述CP设备包括主控板和接口板，所述中央处理器设置在所述主控板上，所述网络处理器和所述物理接口设置在接口板上，所述主控板和所述接口板耦合。
在一种可能的实现方式中，主控板和接口板之间建立进程间通信协议(inter-process communication，IPC)通道，主控板和接口板之间通过IPC通道进行通信。
第十五方面，提供了一种NAT设备，该NAT设备包括：中央处理器、网络处理器和物理接口。中央处理器用于执行如下操作：为所述用户分配第二IP地址。
网络处理器用于触发物理接口执行如下操作：从CP设备接收第一IP地址；向所述CP设备发送第二IP地址。
可选地，所述NAT设备包括主控板和接口板，所述中央处理器设置在所述主控板上，所述网络处理器和所述物理接口设置在接口板上，所述主控板和所述接口板耦合。
在一种可能的实现方式中，主控板和接口板之间建立进程间通信协议(inter-process communication，IPC)通道，主控板和接口板之间通过IPC通道进行通信。
附图说明
图1是本申请实施例提供的一种BNG系统进行NAT的示意图；
图2是本申请实施例提供的一种通过独立式CGN设备和日志服务器进行NAT的示意图；
图3是本申请实施例提供的一种RADIUS溯源下与合法监听平台交互的流程图；
图4是本申请实施例提供的一种日志服务器溯源下与合法监听平台交互的流程图；
图5是本申请实施例提供的一种系统架构的示意图；
图6是本申请实施例提供的一种系统架构的示意图；
图7是本申请实施例提供的一种系统架构的示意图；
图8是本申请实施例提供的一种通信方法200的流程图；
图9是本申请实施例提供的一种NAT44场景下通信方法300的流程图；
图10是本申请实施例提供的一种NAT44场景下通信方法400的流程图；
图11是本申请实施例提供的一种DS-Lite场景下通信方法500的流程图；
图12是本申请实施例提供的一种CGN设备双机备份的示意图；
图13是本申请实施例提供的一种DS-Lite场景下CGN设备双机备份的示意图；
图14是本申请实施例提供的一种UP双机备份的示意图；
图15是本申请实施例提供的一种CP设备的结构示意图；
图16是本申请实施例提供的一种NAT设备的结构示意图；
图17是本申请实施例提供的一种CP设备的结构示意图；
图18是本申请实施例提供的一种NAT设备的结构示意图；
图19是本申请实施例提供的一种网络系统1500的结构示意图。
具体实施方式
为使本申请的目的、技术方案和优点更加清楚，下面将结合附图对本申请实施方式作进一步地详细描述。
下面先对本申请实施例涉及的一些术语相关概念进行介绍。
(1)控制面和用户面分离(control plane and user plane disaggregated，CU分离)
随着软件定义网络(software defined network，SDN)技术和网络功能虚拟化(network functions virtualization，NFV)技术的发展，城域网由传统以网络为核心的架构向以数据中心为核心的网络架构演进。传统的网元设备也从专业化朝着通用化演进。传统网元设备从专业化朝着通用化演进主要解决两个解耦：控制与转发的解耦、软件与硬件的解耦。
有鉴于此，CU分离技术应运而生，成为本领域的研究热点。CU分离是指CP和UP解耦的网络架构。CU分离包括而不限于下述实现方式A和实现方式B。
实现方式A、控制面和转发面位于不同硬件设备上。
在采用实现方式A时，CP设备和UP设备是两个单独且不同的设备。可选地，CP设备与UP设备分布式在不同的地点。例如，CP设备位于云端的数据中心，UP设备根据需求部署在网络中合适的位置。通过这种方式，使得控制面和转发面的部署更加灵活。
实现方式B、控制面和转发面位于同一个硬件设备上且功能分离。
在采用实现方式B时，CP设备的物理实体和UP设备的物理实体为同一个设备。例如， CP设备与UP设备运行在同一个主机、同一个服务器或同一个终端中。
在一些实施例中，CP设备和UP设备均通过虚拟化技术实现。CP设备例如称为虚拟CP(virtual CP，vCP)，UP设备例如称为虚拟UP(virtual UP，vUP)。例如，CP设备为虚拟机，UP设备为虚拟路由器或虚拟交换机。在一些实施例中，CP设备和UP设备均是基于通用的物理服务器结合NF)技术实现的，CP设备和UP设备是两个不同的虚拟网络功能(virtualized network function，VNF)。例如，CP设备和UP设备均是通过X86服务器虚拟化出的网元。
在另一些实施例中，CP设备通过虚拟化技术实现，UP设备通过传统的网络设备实现。UP设备例如称为物理UP(physical UP，pUP)。
本实施例对通信系统中CP设备与UP设备之间的数量关系不做限定。在一些实施例中，CP设备与UP设备是一对多的关系，即，一个CP设备用于控制多个UP设备。在另一些实施例中，CP设备与UP设备是一一对应的关系，即，一个CP设备用于控制一个UP设备。
本实施例对通信系统中UP设备的数量不做限定。可选地，CU分离的通信系统包括多个UP设备。可选地，CU分离的通信系统中多个UP设备分布在不同的地点。可选地，CU分离的通信系统中多个UP设备基于分布式架构协同分担转发任务。
值得说明的一点是，“CU分离”可以具有不同的名称。例如，不同标准、同一标准的不同版本、不同厂商、不同应用场景对“CU分离”可以具有不同的称呼。例如，术语CU分离”有时也可以被称为“控制和转发分离”、“转控分离”、“控制面和用户面分离”、“控制和用户分离”等。
值得说明的一点是，“CP”可以具有不同的名称。例如，不同标准、同一标准的不同版本、不同厂商、不同应用场景对“CP”可以具有不同的称呼。例如，术语“CP”有时也可以被称为“CP功能(CP function，CPF)”或“CP面”。本文中“CP”、“CPF”和“CP面”可互换使用。术语“CP设备”是指实现了CP功能的任意设备。
值得说明的一点是，“UP”可以具有不同的名称。例如，不同标准、同一标准的不同版本、不同厂商、不同应用场景对“UP”可以具有不同的称呼。例如，术语“UP”有时也可以被称为“UP功能(UP function，UPF)”或“UP面”。本文中“UP”、“UPF”和“UP面”可互换使用。术语“UP设备”是指实现了UP功能的任意设备。
(2)BNG系统
BNG系统作为传统的宽带接入网关设备，用于承担将用户设备接入宽带网络的功能，在用户宽带接入业务和场景中非常重要。对BNG系统在用户接入上的主要的要求是用户认证、接入控制、流量调度等。BNG主要负责认证以及互联网协议(internet protocol，IP)地址分配。在一些实施例中，认证过程基于远程用户拨号认证服务(remote authentication dial in user service，RADIUS)实现。例如，BNG作为RADIUS客户端(RADIUS client)，会和RADIUS服务器(RADIUS server)交互完成终端的认证。BNG处理的协议栈包括而不限于以太网承载IP协议(internet protocol over ethernet，IPoE)、以太网承载点到点协议(point-to-point protocol over ethernet，PPPoE)、802.1ad协议、以太网协议和一些802.3物理层(some 802.3phy)协议。
(3)CU分离的BNG系统
随着各种互联网业务的层出不穷，对BNG系统支持的用户的会话数量要求不断提高、对用户接入带宽不断提高、尤其对BNG系统对外提供业务开放、可编程的能力的要求越来越高。 有鉴于这些需求，BNG系统基于SDN或NFV的架构实现控制与转发的解耦以及软件与硬件的解耦，成为CU分离的BNG系统，从而具备CU分离的架构带来的优势，
例如，BNG系统中的CP设备控制BNG系统中的多个UP设备，CP设备调度多个UP设备处理流量的转发任务，CP设备为多个UP分配资源，因此与单机实现BNG系统的方式相比，CU分离架构下BNG系统的设备的利用率和可靠性都能得到大幅的提升。
值得说明的一点是，本申请实施例中“CU分离的BNG”可以具有不同的名称。例如，不同标准、同一标准的不同版本、不同厂商、不同应用场景对“CU分离的BNG”可以具有不同的称呼。例如，术语“CU分离的BNG”有时也可以被称为“分离的BNG系统(disaggregated BNG，DBNG)”，相应地，CU分离的BNG中的CP设备可以被称为DBNG-CP，CU分离的BNG中的UP设备可以被称为DBNG-UP。又如，术语“CU分离的BNG”有时也可以被称为“虚拟宽带网络网关(virtual BNG，vBNG)控制面和用户面分离的系统(control plane and user plane disaggregated System，CU系统)”，即“vBNG CU系统”，相应地，CU分离的BNG中的CP设备可以被称为vBNG-CP，CU分离的BNG中的UP设备可以被称为vBNG-UP。又如，术语“CU分离的BNG”有时也可以被称为“虚拟宽带远程接入服务器(virtual broadband remote access server，vBRAS)CU系统”，即“vBRAS CU系统”，相应地，CU分离的BNG中的CP设备可以被称为vBRAS-CP，CU分离的BNG中的UP设备可以被称为vBRAS-UP。本文中“DBNG”、“vBNG CU系统”和“vBRAS CU系统”可互换使用。
(4)用户
本申请实施例中的用户包括而不限于客户前置设备(customer premise equipment，CPE)或者终端。在一些实施例中，至少一个终端接入至CPE，CPE接入至BNG系统。BNG系统为用户分配IP地址是指BNG系统为CPE分配IP地址，CPE为每个终端进一步分配IP地址。在另一些实施例中，BNG系统为用户分配IP地址是指BNG系统为终端分配IP地址。
(5)运营商级NAT(carrier-grade NAT，CGN)
CGN狭义上指大规模的NAT，具体是指通过规模化部署互联网协议第四版(internet protocol version 4，IPv4)私有地址，以达到对目前公网IPv4地址的统计复用的技术。CGN能够提高IPv4地址的利用率，从而可以在相当长的时间内解决IPv4地址耗尽问题，保证业务的平滑过渡，为互联网协议第六版(internet protocol version 6，IPv6)地址的部署争取时间。按CGN设备的存在形式而言，CGN设备分为独立式CGN设备和插卡式CGN设备。
(6)独立式CGN设备
独立式CGN设备是一个独立的设备，该设备专门承担CGN功能。独立式CGN设备例如旁挂在BNG系统上。例如，在上行流量转发的过程中，用户私网IPv4的流量引导到独立式CGN设备，独立式CGN设备进行NAT处理后，将NAT转换后的公网IPv4流量返回到BNG系统。在使用独立式CGN设备的情况下，地址转换用户管理例如分别在CGN和BNG系统上进行。
插卡式CGN设备是指承担CGN功能的一个单板插在其他功能的设备上。插卡式CGN设备占用设备的一个槽位。
(7)NAT44
NAT44(NAT IPv4-IPv4)是指将一个IPv4地址转换为另一个IPv4地址。例如，将私网IPv4地址转换为公网IPv4地址。
(8)双栈(dual stack，DS)
双栈是指在设备上既安装IPv4的协议栈，又安装IPv6的协议栈，从而实现分别与IPv4节点或IPv6节点间的信息互通。
(9)轻量级双栈(dual stack lite，DS-Lite)
DS-Lite技术不存在不同地址族之间的转换。DS-Lite本质上是在IPv6的网络中部署IPv4-in-IPv6隧道完成IPv4业务传输，而IPv6业务则直接通过IPv6网络传输。例如，路由型CPE作为DS-Lite的基本桥接宽带(basic bridging broadband，B4)，BNG系统作为IPv6单栈节点，在城域网部署CGN，CGN作为DS-Lite的地址族转换路由器(address family transition router，AFTR)。CPE、BNG系统和CGN之间是IPv6单栈(IPv6-Only)网络，CGN和核心路由器(core router，CR)之间是双栈网络。由于使用DS-Lite时城域网只需要部署部分双栈，是轻量级的双栈，称为DS-Lite方案。
(10)B4
B4具备双栈的能力，在主机或者CPE设备上实现。其中，CPE设备在运营商组网中为家庭网关。B4向AFTR创建IPv4-in-IPv6的隧道。
(11)AFTR
AFTR终结了IPv4-in-IPv6隧道，并且实现了NAT44的功能。其中，AFTR在运营商网络中为CGN；该CGN可为独立CGN设备，也可以为插卡式CGN。
(12)地址溯源
CGN特性的部署隐藏了私网用户的IP地址信息，国家安全部门要求CGN部署具备可溯源的能力，即可以根据公网地址和端口号查询到私网用户的IP地址，进一步锁定具体用户。本申请的一些实施例中，地址溯源采用RADIUS溯源的方式。
(13)RADIUS溯源
RADIUS溯源是指在RADIUS服务器上进行地址溯源。RADIUS溯源例如通过发送计费报文的过程实现。例如，BNG系统为用户分配公网IP地址以及端口块后，BNG系统将公网IP地址以及端口块携带在计费报文中，BNG系统通过向RADIUS服务器发送计费报文，从而将公网IP地址以及端口块上报给RADIUS服务器。例如，当用户上线时，BNG系统向RADIUS服务器发送计费开始报文，RADIUS服务器接收计费开始报文，根据计费开始报文记录一次RADIUS日志；当用户下线时，BNG系统向RADIUS服务器发送计费结束报文，RADIUS服务器接收计费结束报文，根据计费结束报文记录一次RADIUS日志。RADIUS服务器根据两次记录的RADIUS日志进行地址溯源。其中，根据计费开始报文记录的RADIUS日志包括私网IP地址、公网IP地址、端口块、用户上线时间的对应关系。用户上线时间例如是计费开始报文中的计费开始时间。根据计费结束报文记录的RADIUS日志包括私网IP地址、公网IP地址、端口块、用户上线时间的对应关系。用户下线时间例如是计费结束报文中的计费结束时间。
(14)端口块(port block)
端口块也称端口范围(port Range)。端口块包括NAT设备为用户分配的至少一个端口号。例如，BNG系统为一个私网IP地址分配一个公网IP地址和一个端口段，当对该私网IP地址进行NAT处理时，均使用该公网IP地址和端口段中的端口号。
(15)框间备份
框间备份是指一台设备中的CPU与另一台设备中的CPU互为备份关系。采用框间备份方案时，主NAT实例和备NAT实例是两个不同硬件设备上的CPU。其中，NAT实例是一个具体的NAT设备。例如，主NAT实例是CGN设备1上1号槽位的0号CPU，备NAT实例是CGN设备2上2号槽位的0号CPU。
(16)框间温备
框间温备是指业务正常运行场景下，由主NAT设备进行业务处理，同时备NAT设备实时备份用户的信息。故障倒换场景下，主NAT设备发生故障，备NAT设备倒换为主NAT设备，根据预先备份的用户的信息进行业务的处理。
由于本申请实施例涉及NAT技术的应用，为了便于理解，下面对NAT技术的应用场景以及NAT技术在应用中的一些情况进行介绍。
由于公网的IP地址(如公网IPv4地址)数量有限，IP地址耗尽已成为亟需解决的技术问题。有鉴于此，宽带拨号用户一般由BNG系统分配私网IP地址，并且用户的流量会被进行NAT地址转换，将用户的私网IP地址转换成公网IP地址。由于公网IP地址与用户之间为一对多的关系，达到了公网IP地址统计复用的功能，提高了公网IP地址的利用率，从而解决了公网IP地址数量有限的问题。NAT技术在应用中时，面临以下情况一至情况二。
情况一、通过插卡式CGN设备以及RADIUS服务器实现溯源的情况
在一些实施例中，NAT设备选择通过插卡式CGN设备实现。BNG系统中的UP设备(如迷你BNG设备)插入插卡式CGN设备，实现RADIUS溯源。在这种情况下，由于UP设备和CGN设备集成在一起，NAT地址转换是在BNG系统上进行的。例如，请参见附图1，附图1示出了在BNG系统上进行NAT的过程，具体包括以下步骤1至步骤5。
步骤1、用户发送拨号请求，拨号请求用于向BNG系统申请IP地址。例如，在附图1中，拨号请求从终端传输至家庭网关(residential gateway，RGW)，再由RGW传输至交换机(switch，SW)或光线路终端(optical line termination，OLT)，再由SW或OLT传输至BNG系统。
步骤2、BNG系统接收拨号请求，向RADIUS服务器发起认证请求。
步骤3、RADIUS服务器接收认证请求，生成认证结果，向BNG系统回复认证结果。
步骤4、BNG系统根据配置向用户分配私网IP地址、用户的公网IP地址以及端口块。并且，BNG系统向RADIUS服务器发送计费报文，通过RADIUS属性携带用户的公网IP地址以及端口块，从而实现用户的NAT溯源。
步骤5、终端发送流量，流量转发至BNG系统。BNG系统对流量进行NAT转换后，向公网侧发送转换后的流量，使得用户访问公网。例如，如附图1所示，流量的源IP地址为私网IPv4地址(10.1.1.1)，BNG系统将私网IPv4地址(10.1.1.1)转换为公网IPv4地址(100.1.1.1)。
在NAT场景下应用情况一时，具有两个方面的缺陷。
一方面，时下海外存在很多二级运营商租用一级运营商的城域网，自己部署高挂的大容量框式BNG系统。但是，随着CDN的下沉以及出于便于维护的考虑，运营商希望将BNG下沉到边缘，选择采用迷你BNG设备实现BNG系统。由于BNG系统是小型化的，可以满足机房空间和功耗的要求。然而，由于比较大的框式BNG设备才有适于插入插卡式CGN设备的槽位，而迷你BNG设备没有单独的槽位插入插卡式CGN设备，造成插卡式CGN设备 只能放在比较大的框式BNG设备上实现。而迷你BNG设备自身线路处理板的NAT转发能力非常弱，不能满足NAT转换的要求。
另一方面，在迁移(steering)场景下，当UP设备插入了插卡式CGN设备后，如果CP设备将用户从原始CP设备迁移至目标UP设备，NAT溯源信息需要被刷新。NAT溯源信息刷新是指在目标UP设备上插入的插卡式CGN设备上保存迁移的用户的NAT溯源信息。具体地，目标UP设备上插入的插卡式CGN设备要为每一个迁移的用户分配公网IP地址以及端口块。并且，插卡式CGN设备要为每一个迁移的用户发送计费更新报文。然而，由于插卡式CGN设备只是个板卡，插卡式CGN设备的算力不足，难以承担大量用户迁移产生的NAT溯源信息刷新任务，造成刷新NAT溯源信息的速度非常慢，与CP设备下发用户表项的速率无法匹配，导致用户业务中断的时间会非常长。其中，Steering场景也称用户在线动态迁移的场景，Steering场景是指已上线的用户会从一个UP设备迁移到另外一个UP设备的情况。
情况二、通过独立式CGN设备以及日志服务器实现溯源的情况
独立式CGN设备高挂结合日志服务器的架构可以解决情况一中插卡式CGN设备具有的NAT转换能力不足的问题。例如，请参见附图2，附图2示出了通过独立式CGN设备以及日志服务器进行NAT的过程，具体包括以下步骤1至步骤5。
步骤1、用户发送拨号请求，拨号请求用于向BNG系统申请IP地址。
步骤2、BNG系统接收拨号请求，向RADIUS服务器发起认证请求。
步骤3、RADIUS服务器接收认证请求，生成认证结果，向BNG系统回复认证结果。
步骤4、BNG系统根据配置向用户分配私网IP地址，并向RADIUS服务器发送计费报文，计费报文携带用户私网IP地址且不携带公网IP地址。
步骤5、终端发送流量，流量转发至CGN设备。CGN设备对流量进行NAT转换后，向公网侧发送转换后的流量，使得用户访问公网。在此步骤中，CGN设备接收到流量后，会根据接收的流量建立NAT会话，并根据NAT会话生成NAT日志，将NAT日志发送给日志服务器，以便日志服务器根据NAT日志进行溯源。
在NAT场景下应用情况二时，具有两个方面的缺陷。
一方面，由上述步骤5可见，独立式CGN设备是在收到用户流量的触发下生成NAT会话，进而生成溯源使用的NAT日志。独立式CGN设备自身不会与RADIUS服务器交互，只能采用日志服务器进行地址溯源，无法保持原有的RADIUS溯源方式，运营商需要额外投资新建日志服务器，建设额外的日志服务器造成开销过大，成本过高。
另一方面，很多运营商部署了合法监听(lawful interception，LI)。合法监听功能是通过RADIUS服务器与合法监听设备交互实现的。合法监听设备例如包括合法监听网关(lawful interception gateway，LIG)以及监听中心(law enforcement agency，LEA)例如，参见附图3，LEA与RADIUS服务器交互，LEA根据用户的公网IP地址以及端口块，查询用户的账号信息。LIG根据用户账号信息，向BNG系统发起合法监听请求。
而参见附图4，如果采用独立式CGN设备以及日志服务器进行溯源的方式，由于NAT溯源采用了日志服务器而非RADIUS服务器，因此运营商对应的合法监听设备也需要被重新改造，导致客户需要改造的设备比较多，增加了客户的建设和维护成本，无疑费用会非常大。而且，部分客户在用户上线时，具有由RADIUS服务器指定用户进行NAT时被分配的公网IP地址和端口块的需求。但是在采用日志服务器进行溯源的方式时，CGN设备与RADIUS 服务器无法交互，CGN设备也就无法根据RADIUS服务器指定的公网IP地址分配公网IP地址，CGN设备也就无法根据RADIUS服务器指定的端口块分配端口块。
有鉴于上述情况一和情况二存在的需求，本申请的一些实施例中，提供一种对具有私网IP地址的用户进行NAT溯源的方案，通过采用CU分离的BNG系统，将BNG系统的CP设备作为统一的控制面，由CP设备在管理UP设备的同时，还管理独立式CGN设备。
针对情况一来说，由于本申请的一些实施例采用了独立式CGN设备进行NAT处理，独立式CGN设备的性能更强、容量更高，解决了插卡式CGN设备的NAT能力不足的问题，有助于支持对CGN设备性能要求高的Steering场景。并且，摆脱了对BNG设备需要具备额外槽位的限制，适于采用迷你BNG设备实现BNG系统的场景。
针对情况二来说，本申请的一些实施例实现了RADIUS溯源的方式，解决了使用独立式CGN设备时难以通过RADIUS服务器进行通过溯源的技术问题。一方面，由于地址溯源是通过RADIUS服务器实现的，而无需借助日志服务器，从而摆脱了运营商进行溯源时在现网中增加日志服务器的限制。另一方面，摆脱了运营商进行溯源时修改LIG设备的限制，也就节省了修改LIG设备会带来的巨大工作量以及成本。另一方面，CP设备能够通过与RADIUS服务器进行交互，满足通过RADIUS服务器指定用户进行NAT时公网IP地址和端口范围的需求。
CP设备对CGN设备的管理功能包括而不限于以下管理功能一至管理功能五。
管理功能一、CP设备将分配的用户IP地址(如私网IPv4地址或IPv6地址)下发给CGN设备。
管理功能二、在主CGN设备故障时，CP设备将流量引导至备CGN设备。
管理功能三、CP设备将主CGN设备上保存的用户表项同步至备CGN设备。
管理功能四、用户下线后，CP设备清除CGN设备上的用户表项。
管理功能五、CP设备为CGN设备指定分配的端口块的范围。
下面，通过附图5示出的系统架构，对CP设备统一管理UP设备以及CGN设备所基于的系统架构举例说明。通过附图8所示的方法200、附图9所示的方法300、附图10所示的方法400、附图11所示的方法500，对CP设备如何实现管理功能一举例说明。通过附图12以及S701至S708、S801至S804、附图13以及步骤S901至S903对CP设备如何实现管理功能二举例说明。通过S601至S605，对对CP设备如何实现管理功能三举例说明。通过S203至S223，对CP设备如何实现管理功能四举例说明。通过S201至S241，对CP设备如何实现管理功能五举例说明。
参见附图5，本申请实施例提供了一种系统架构，系统架构包括CP设备、UP设备、接入网络设备、CPE以及NAT设备。
CP设备用于承担控制面的功能。在一些实施例中，CP设备是CU分离的BNG系统中的CP设备，CP设备承担BNG系统中控制面的功能。例如，CP设备基于拨号协议处理用户的拨号请求。CP设备与认证授权计费(authentication、authorization、accounting，AAA)交互，进行用户认证、计费以及授权。其中，当用户认证后通过后，CP设备将用户表项下发到用户接入的UP设备。UP设备生成该用户的用户表项，并向外发布路由。CP设备包括以太网承 载点到点协议(point-to-point protocol over ethernet，PPPoE)模块或以太网承载IP协议(internet protocol over ethernet，IPoE)模块、用户管理模块、AAA模块、UP管理模块、地址管理模块以及RADIUS模块。
在本申请的一些实施例中，由CP设备管理UP设备以及NAT设备(如独立式CGN设备)。例如，CP设备通过用户管理模块管理NAT设备，CP设备通过UP管理模块用户管理模块管理NAT设备。一个CP设备例如管理至少一个UP设备以及至少一个NAT设备。CP设备与UP设备通过网络相连。CP设备与NAT设备通过网络相连。
CP设备例如通过虚拟化技术实现。例如，参见附图6，CP设备为VNF，CP设备是通过X86服务器虚拟化出的网元，CP设备的物理实体为X86服务器。
UP设备用于承担用户面的功能。在一些实施例中，UP设备是CU分离的BNG系统中的UP设备，UP设备承担BNG系统中用户面的功能。当用户请求上线时，UP设备将用户的拨号请求通过业务通道上送至CP设备处理。CP设备处理拨号请求后，向UP设备下发用户表项。UP设备接收CP设备下发的用户表项，UP设备在本地生成用户表项，UP设备根据用户表项进行相关的业务策略执行和流量转发。并且，UP设备向外发布路由。UP设备包括多种实现方式。UP设备通过网络与接入网络设备相连。
在一些实施例中，UP设备通过虚拟化技术实现。例如，参见附图6，UP设备为VNF，UP设备是通过X86服务器虚拟化出的网元，UP设备的硬件是X86服务器。在采用虚拟化技术实现UP设备时，UP设备例如称为vUP设备(VNF)。在另一些实施例中，UP设备为网络设备，UP设备为PNF。例如，UP设备是硬件迷你BNG设备或框式BNG系统中的任一种。在采用网络设备实现UP设备时，UP设备例如称为pUP设备(PNF)。接入网络设备包括而不限于接入节点(access node，AN)设备、SW或OLT中的任一种。接入网络设备通过网络与CPE以及UP设备相连。接入网络设备用于将CPE汇聚至UP设备。接入网络设备还用于进行二层报文的转发，并对用户进行虚拟局域网(virtual LAN，VLAN)或QinQ的隔离。其中，QinQ也称堆栈VLAN(stacked VLAN)或双VLAN(double VLAN)。
CPE在运营商组网中为家庭网关(RGW，也称家庭终端)。CPE用于接入家庭内的个人计算机(Personal Computer，PC)、手机。CPE一般会进行NAT处理，向家庭内的CP设备、手机分配私网IP地址。此外，CPE还进行PPPoE、IPoE协议拨号，向BNG系统获取IP地址，根据获取的IP地址进行网络访问。
NAT设备用于进行NAT处理。例如，NAT设备将用户的私网IP地址转换成公网IP地址以及端口块。又如，NAT设备将用户的IPv6地址转换成公网IP地址以及端口块。在一些实施例中，NAT设备为CGN设备。例如，NAT设备为独立式CGN设备。独立式CGN设备包括多种实现方式。例如，独立式CGN设备是硬件设备，例如，独立式CGN设备是网络设备。又如，独立式CGN设备通过虚拟化技术实现。例如，独立式CGN设备是通过X86服务器虚拟化出的网元。在另一些实施例中，NAT设备为CGN设备之外的其他具备NAT处理功能的设备。
参见附图7，CP设备与UP设备之间具有三种接口，三种接口分别是控制报文重定向接口(control packet redirect interface，CPRi)、管理接口(management interface，Mi)以及状态控制接口(state control interface，SCi)。
CPRi采用基于Vxlan通用协议(Vxlan generic protocol encapsulation，Vxlan-GPE)接口 实现。UP设备接收用户的接入报文，UP设备会根据CPRi对应的报文封装格式，对接入报文进行封装，将封装后的接入报文上送至CP设备处理。
Mi采用基于XML的网络配置协议(Netconf)接口实现。CP设备采用Mi向UP设备下发配置，UP设备采用Mi上报UP设备的运行状态。
SCi采用转控分离协议(control plane and user plane separated protocol，CUSP)接口实现。CP设备处理用户接入报文，完成用户的协议交互，用户上线后，CP设备通过SCi向对应用户接入的UP设备下发用户的用户表项。
在本申请的一些实施例中，CP设备在管理CGN设备时，同样采用CPRi、Mi以及SCi实现。例如，主CGN设备通过SCi向CP设备上报用户表项，CP设备采用SCi向备CGN设备下发用户表项。
在一些实施例中，通信系统包括网关系统，网关系统为BNG系统或者BRAS系统。通过选用BNG系统中的CP或者BRAS系统中的CP实现本实施例方案，有助于复用BNG系统或者BRAS系统的网络架构，降低实现复杂度。可选地，采用BNG系统以及BRAS系统之外其他的CU分离通信系统中的CP实现CP设备。例如，采用CU分离的服务网关(serving gateway，S-GW)中的CP实现CP设备。又如，采用CU分离的分组数据网网关(PDN gateway，PGW)中的CP实现CP设备。又如，采用移动性管理功能(access and mobility management function，AMF)网元实现CP设备。又如，采用会话管理功能(session management function，SMF)网元实现CP设备。又如，采用WT-456固定、移动融合的通信系统中的接入网关功能(access gateway function，AGF)网元实现CP设备。
下面，以UP设备为迷你BNG设备、NAT设备为独立式CGN设备、CP设备分配的IP地址为私网IPv4地址的情况为例，对如何基于附图5示出的系统架构实现本申请实施例简要说明。
CP设备同时管理迷你BNG设备和独立式CGN设备。用户从迷你BNG设备上线；CP设备响应于上线请求，为用户分配私网IPv4地址后，同时将用户的私网IPv4地址下发给独立式CGN设备；独立式CGN设备从本地公网地址池中，为用户分配私网IPv4地址对应的公网IPv4地址以及端口块；独立式CGN设备将公网IPv4地址以及端口块上报给CP设备；CP设备在计费报文中携带用户的公网IPv4地址以及端口块，将计费报文上报给AAA，实现用户RADIUS溯源。
参见附图8，附图8是本申请实施例提供的一种通信方法200的流程图。可选地，方法200由CP设备、NAT设备以及RADIUS服务器执行。
示例性地，方法200包括S210至S280。
S210、CP设备为用户分配第一IP地址。
本实施例中，CP设备和NAT设备会为同一个用户分配不同的IP地址。为了区分描述，将CP设备为用户分配的IP地址称为第一IP地址，将NAT设备为用户分配的IP地址称为第二IP地址。第一IP地址以及第二IP地址也称为用户的IP地址。
S220、CP设备向NAT设备发送第一IP地址。
在一些实施例中，第一IP地址包括私网IPv4地址或者IPv6地址中的至少一项。
可选地，第一IP地址为私网IPv4地址。例如，在NAT44场景下，CP设备为用户分配私网IPv4地址。NAT44场景具体的处理流程请参考下述附图9所示的方法300或附图10所示的方法400。CP设备通过分配私网IPv4地址以及向NAT设备下发私网IPv4地址，有助于支持NAT44场景下实现RADIUS溯源。可选地，第一IP地址为IPv6地址。例如，在DS-Lite场景下，CP设备为用户分配IPv6地址。DS-Lite场景具体的处理流程请参考下述附图11所示的方法500。CP设备通过分配IPv6地址以及向NAT设备下发IPv6地址，有助于支持DS-Lite场景等双栈网络中实现RADIUS溯源。可选地，第一IP地址包括私网IPv4地址以及IPv6地址。
CP设备如何向NAT设备下发IP地址包括多种方式。在一些实施例中，CP设备基于CUSP向NAT设备发送第一IP地址。例如，CP设备生成并发送CUSP消息，CUSP消息包括第一IP地址。在另一些实施例中，CP设备基于PFCP向NAT设备发送第一IP地址。例如，CP设备生成并发送PFCP消息，PFCP消息包括第一IP地址。
S230、NAT设备从CP设备接收CP设备为用户分配的第一IP地址。
S240、NAT设备为用户分配第二IP地址。
第二IP地址为公网IP地址。例如，第二IP地址为公网IPv4地址。在一些实施例中，NAT设备从地址池中选择未被占用的公网IP地址，作为分配的IP地址。
S250、NAT设备向CP设备发送第二IP地址。
在一些实施例中，NAT设备向CP设备发送第一IP地址和第二IP地址之间的对应关系，以便CP设备知道NAT设备上报的公网IP地址是NAT设备为哪个用户的IP地址分配的。
在一些实施例中，NAT设备收到CP设备下发的第一IP地址之后，NAT设备不仅为用户分配公网IP地址，还为用户分配端口块。相应地，NAT设备不仅向CP设备上报公网IP地址，还上报为用户分配的端口块。其中，端口块包括至少一个端口号。
从步骤S230至步骤S250可见，本实施例中NAT设备分配公网IP地址的触发方式与相关技术存在区别，不是由收到流量的事件触发，而是由CP设备下发IP地址的事件触发。
在一些实施例中，NAT设备在本地保存分配的第二IP地址和端口块。例如，NAT设备生成并保存用户的信息，用户的信息包括第一IP地址、第二IP地址和端口块的对应关系。其中，用户的信息的形式例如是用户表中的表项。例如，NAT设备在用户表中新建用户表项，在用户表项中保存第一IP地址、第二IP地址和端口块的对应关系，该保存了第一IP地址、第二IP地址和端口块的对应关系的用户表项即为用户的信息。在一些实施例中，NAT设备本地的用户表项除了包括第一IP地址、第二IP地址和端口块的对应关系之外，还包括用户的其他信息，例如用户标识等。
NAT设备通过在本地保存用户的信息，以便后续在数据报文转发阶段根据预先保存的用户的信息生成转发表项。在数据报文转发阶段，当NAT设备接收到上行的数据报文时，识别数据报文的源IP地址以及源端口号，根据源IP地址查找用户的信息，得到用户的信息中与源IP地址对应的IP地址以及源端口号对应的端口号，将源IP地址转换为查找到的IP地址，将源端口号转换为查找到的端口号，从而进行NAT。在一些实施例中，数据报文的源IP地址是私网IPv4地址(第一IP地址)，查找到的IP地址为第二IP地址，换句话说，将CP设备预先分配的私网IPv4地址转换为NAT设备预先分配的公网IP地址。在另一些实施例中，例如在DS-Lite场景下，数据报文是IPv4-in-IPv6的形式，数据报文包括两个IP头，外层的IP 头是IPv6头，数据报文内层的IP头是IPv4头。外层的IPv6头属于隧道头。外层的IPv6头中的源IP地址是CPE的IPv6地址。CPE的IPv6地址为CP设备分配的第一IP地址。内层的IPv4头中的源IP地址是CPE为终端分配的私网IPv4地址。NAT设备会将IPv4头中的私网IPv4地址转换为公网IPv4地址。换句话说，将CPE预先分配的私网IPv4地址转换为NAT设备预先分配的公网IP地址。
在一些实施例中，NAT设备向CP设备发送NAT设备本地的用户的信息，CP设备从NAT设备接收用户的信息。通过这种方式，将NAT设备本地的用户表项同步给了CP设备。
S260、CP设备从NAT设备接收第二IP地址，第二IP地址为NAT设备为用户分配的公网IP地址。
NAT设备如何向CP设备上报IP地址和端口块包括多种方式。在一些实施例中，NAT设备基于CUSP向CP设备发送第二IP地址和端口块。例如，NAT设备生成并发送CUSP消息，CUSP消息包括第二IP地址和端口块。在另一些实施例中，NAT设备基于PFCP向CP设备发送第二IP地址和端口块。例如，NAT设备生成并发送PFCP消息，PFCP消息包括第二IP地址和端口块。
在一些实施例中，CP设备在本地保存分配的第二IP地址和端口块。例如，CP设备生成并保存用户的信息，用户的信息包括第一IP地址、第二IP地址和端口块的对应关系。其中，用户的信息的形式例如是用户表中的表项。例如，CP设备在用户表中新建用户表项，在用户表项中保存第一IP地址、第二IP地址和端口块的对应关系，该保存了第一IP地址、第二IP地址和端口块的对应关系的用户表项即为用户的信息。在一些实施例中，CP设备本地的用户表项还包括用户的授权信息，用户的授权信息例如服务质量(quality of service，QoS)信息、访问控制列表(access control lists，ACL)信息、媒体访问控制(media access control，Client MAC)地址等。
S270、CP设备向RADIUS服务器发送计费报文。
CP设备在生成计费报文时，会将NAT设备上报的公网IP地址(第二IP地址)以及CP设备分配的IP地址(第一IP地址)携带在计费报文中，使得计费报文包括第一IP地址和第二IP地址。此外，在NAT设备向CP设备上报端口块的情况下，CP设备还会将NAT设备上报的端口块携带在计费报文中，使得计费报文包括第一IP地址和第二IP地址以及端口块。
计费报文包括而不限于计费开始报文或者计费结束报文中的至少一项。计费开始报文用于请求RADIUS服务器开始计费。计费结束报文用于请求RADIUS服务器结束计费。在一些实施例中，计费报文还包括端口块。在一些实施例中，计费报文还包括用户的上线时间或者用户的下线时间中的至少一项。用户的上线时间例如为计费开始报文中的计费开始时间。用户的下线时间例如为计费开始报文中的计费结束时间。第一IP地址、第二IP地址、端口块、用户的上线时间或者用户的下线时间可称为计费报文携带的用户的NAT溯源信息。在一些实施例中，计费报文包括至少一个RADIUS属性(Attribute)字段，RADIUS属性字段包括第一IP地址、第二IP地址、端口块、用户的上线时间或者用户的下线时间中的至少一项。
CP设备通过发送计费报文，从而将NAT溯源信息(第一IP地址、第二IP地址、端口块、用户上线时间、用户下线时间)上报给RADIUS服务器。
S280、RADIUS服务器从计费报文获得第一IP地址和第二IP地址，保存第一IP地址和第二IP地址之间的对应关系。
RADIUS服务器接收计费报文后，会执行计费流程，并将计费报文携带的NAT溯源信息保存在本地。当需要根据第一IP地址溯源时，向RADIUS服务器发送溯源请求，溯源请求包括第二IP地址。RADIUS服务器接收溯源请求，从溯源请求获得第二IP地址，根据第二IP地址查询NAT溯源信息，得到第一IP地址，从而实现RADIUS溯源。
本实施例提供的方法，CP设备将分配的IP地址下发给NAT设备，NAT设备在接收到CP设备下发的IP地址的触发条件下，为用户分配CP设备下发的IP地址所对应的公网IP地址，将公网IP地址上报给CP设备。CP设备根据NAT设备上报的公网IP地址，在计费报文中携带CP设备分配的IP地址以及NAT设备分配的公网IP地址，向RADIUS服务器发送计费报文，从而将CP设备分配的IP地址以及NAT设备分配的公网IP地址上报给RADIUS服务器，以便在RADIUS服务器上进行NAT溯源。一方面，由于NAT溯源采用了RADIUS溯源的方式，能够通过复用RADIUS服务器进行溯源，摆脱了需要建设日志服务器才能溯源的限制，减少溯源的成本。另一方面，适于应用在NAT设备采用独立式NAT设备实现的场景，有助于解决NAT设备采用业务单板等插卡式NAT设备实现时面临的UP槽位不足、NAT处理能力不足等问题。
在一些实施例中，当用户下线时，CP设备清除NAT设备上保存的用户表项，从而实现上文涉及的管理功能四。例如，方法200具体包括以下步骤S203至S223。
S203、若用户下线，CP设备生成删除消息，向NAT设备发送删除消息。
其中，删除消息用于指示NAT设备删除NAT设备上保存的用户的信息。删除消息例如为CUSP消息。
S213、NAT设备从CP设备接收删除消息。
S223、响应于删除消息，NAT设备删除用户的信息。
CP设备通过在用户下线时指示NAT设备删除用户的信息，从而及时释放已下线的用户的信息在NAT设备上占用的存储空间，节省了NAT设备的存储资源，避免NAT设备上资源耗空的问题。
此外，在一些实施例中，若用户下线，CP设备删除CP设备上保存的用户的信息，使得NAT设备上保存的用户的信息和CP设备上保存的用户的信息被同步清除。例如，在用户的信息的形式为用户表项的情况下，NAT设备删除NAT设备上已下线的用户对应的用户表项，CP设备删除CP设备上已下线的用户对应的用户表项，从而完成NAT设备和CP设备同步清除用户表项的动作。CP设备通过在用户下线时删除本地保存的用户的信息，从而及时释放已下线的用户的信息在CP设备上占用的存储空间，节省了CP设备的存储资源，避免CP设备上资源耗空的问题。
在一些实施例中，通过RADIUS服务器，指定NAT时端口块所属的范围，从而实现上文涉及的管理功能五。例如，方法200具体包括以下步骤S201至S241。
S201、RADIUS服务器获得并向CP设备发送端口块集合。
其中，端口块集合用于作为NAT设备分配的端口块的取值范围。端口块集合包括至少一个端口块。
S211、CP设备从RADIUS服务器接收端口块集合。
S221、CP设备向NAT设备发送端口块集合。
例如，CP设备在向NAT设备下发第一IP地址时，还向NAT设备下发端口块集合，从而将第一IP地址和端口块集合一起传输至NAT设备上。
S231、NAT设备从CP设备接收端口块集合。
S241、NAT设备在端口块集合内，为用户分配端口块。
例如，NAT设备从端口块集合中选择未被占用的端口块，将选择的端口块分配给用户。
在运营商需要指定用户的端口块的范围的场景下，通过由RADIUS服务器向CP设备下发端口块集合，再由CP设备将端口块集合下发给NAT设备，从而指定NAT设备在端口块集合内分配端口块，因此满足了指定NAT端口块范围的需求。尤其是，CP通过将RADIUS指定的端口块集合和IP地址一起下发给NAT设备，使得通过RADIUS指定端口块范围的过程和触发NAT设备分配公网IP的过程得以同时执行，减少了通信开销和实现复杂度。
在一些实施例中，上述方法200中的第一IP地址为私网IP地址。具体地，当用户上线，由CP设备对用户的私网IP地址进行分配。同时，CP设备下发用户私网IP地址以及相关信息给CGN设备。CGN设备从CP设备接收私网IP地址以及相关信息后，为用户分配公网IP地址和端口块，将公网IP地址和端口块上报给CP设备。CP设备在计费报文中增加用户公网IP地址和端口块，向RADIUS服务器发送计费报文，从而实现通过RADIUS服务器进行溯源。
请参见附图9，附图9所示的方法300是对NAT44场景下如何实现方法200的举例说明。换句话说，附图9所示的方法300关于NAT44场景下如何在采用独立式CGN设备的情况下实现通过RADIUS服务器进行溯源。在附图9所示的方法300中，第一IP地址为私网IPv4地址，第二IP地址为公网IPv4地址，通信系统为BNG系统，NAT设备为独立式CGN设备，用户的信息保存在用户表中的用户表项中。
附图9所示的方法300包括以下S301至S309。
S301、用户发送拨号请求。拨号请求用于向BNG系统申请IP地址。
S302、CP设备接收拨号请求。CP设备在拨号请求的触发下，向RADIUS服务器发起认证请求。RADIUS服务器认证通过后，CP设备从私网地址池中，分配私网IPv4地址给用户。
S303、CP设备将用户的私网IPv4地址下发给独立式CGN设备。
S304、独立式CGN设备从CP设备接收用户的私网IPv4地址。独立式CGN设备根据用户的私网IPv4地址，在本地选择空闲的公网IPv4地址和端口块，将选择的公网IPv4地址和端口块分配给用户。并且，独立式CGN设备在用户表中增加用户表项。新增的用户表项保存了私网IPv4地址、公网IPv4地址和端口块的对应关系。
S305、独立式CGN设备将用户的私网IPv4地址、公网IPv4地址和端口块上报给CP设备。
S306、CP设备从独立式CGN设备接收用户的私网IPv4地址、公网IPv4地址和端口块。CP设备更新本地的用户表，在用户表中增加用户表项。新增的用户表项保存了公网IPv4地址和端口块。
S307、CP设备发送计费报文。计费报文例如是计费开始报文。计费报文携带用户的NAT溯源信息。NAT溯源信息包括CP设备分配的私网IPv4地址、CGN分配的公网IPv4地址以及CGN分配的端口块。
S308、CP设备向用户下发私网IPv4地址。
S309、CP设备向UP设备下发对应的用户表项。
请参见附图10，附图10所示的方法400是对上述方法300的举例说明。在方法400中，BNG系统中的UP设备为迷你BNG设备(即附图10中的mBNG)。CP设备向CGN设备下发私网IPv4地址的动作通过SCi通道这种接口实现。CGN设备向CP设备上报私网IPv4地址、公网IPv4地址和端口块的动作通过SCi通道这种接口实现。此外，方法400还涉及与合法监听设备(LIG以及LEA)的交互流程。附图10所示的NAT44场景下的方法400包括以下S401至S410。
S401、CPE发送拨号请求。拨号请求也称用户上线请求。拨号请求例如是PPPoE拨号请求或动态主机配置协议(dynamic host configuration protocol，DHCP)拨号请求。CP设备例如向二层网络广播拨号请求。迷你BNG设备(UP设备)接收拨号请求。迷你BNG设备(UP设备)通过CPRi通道，将拨号请求上送至CP设备。
S402、CP设备向RADIUS服务器发送认证请求。RADIUS服务器认证通过后，RADIUS服务器分配私网IPv4地址给用户。
S403、CP设备通过SCi通道，将用户的私网IPv4地址下发给CGN设备。
S404、CGN设备分配公网IPv4地址以及端口块。并且，CGN设备在用户表中增加用户表项。新增的用户表项保存了私网IPv4地址、公网IPv4地址和端口块的对应关系。
S405、CGN设备通过SCi将用户私网IPv4地址、公网IPv4地址和端口块上报给CP设备。
S406、CP设备向RADIUS服务器发送计费开始报文。计费开始报文携带用户的NAT溯源信息。NAT溯源信息包括私网IPv4地址、公网IPv4地址和端口块。
S407、CP设备向CPE下发私网IPv4地址。同时，CP设备向迷你BNG设备下发用户表项。
S408、LIG根据公网IPv4地址和端口块，向RADIUS服务器请求用户的账号信息。用户的账号信息包括而不限于用户的名称、用户的账号和会话ID中的至少一项。具体地，参见附图10，LEA向LIG发送合法监听请求(LI request，LI请求)，合法监听请求包括公网IPv4地址和端口块。LIG接收LI请求，使用公网IPv4地址，从RADIUS服务器搜索用户的名称、账号和会话ID。
S409、LIG根据用户的账号信息，向迷你BNG设备下发监听策略。监听策略例如为监听入口方向的报文或出口方向的数据报文。监听策略包括用户的账号以及会话ID。监听策略例如为对迷你BNG设备的配置指令(Configure command)。例如，监听策略包括账号1、会话ID1以及入口方向，监听策略用于指示迷你BNG设备监听账号1的会话ID1的入口方向的数据报文。
S410、迷你BNG设备根据监听策略对用户的数据报文进行复制，将复制出的数据报文转发至监听平台。
请参见附图11，附图11所示的方法500是对DS-Lite场景下如何实现方法200的举例说明。换句话说，附图11所示的方法500关于DS-Lite场景下如何在采用独立式CGN设备的 情况下实现通过RADIUS服务器进行溯源。在附图11所示的方法500中，第一IP地址为IPv6地址，第二IP地址为公网IPv4地址，通信系统为BNG系统，用户的信息保存在用户表中的用户表项中。BNG系统中的UP设备为迷你BNG设备(即附图11中的mBNG)。
附图11所示的方法500包括以下S501至S511。
S501、CPE作为DHCP服务器，向终端分配私网IPv4地址。
S502、CPE发送拨号请求。拨号请求也称用户上线请求。拨号请求例如是PPPoE拨号请求或DHCP拨号请求。CP设备例如向二层网络广播拨号请求。迷你BNG设备(UP设备)接收拨号请求。迷你BNG设备(UP设备)通过CPRi通道，将拨号请求上送至CP设备。
S503、CP设备向RADIUS服务器发送认证请求。RADIUS服务器认证通过后，RADIUS服务器分配IPv6地址给用户。
S504、CP设备通过SCi将用户IPv6地址下发给CGN设备。
S505、CGN设备根据用户IPv6地址分配公网IPv4地址以及端口块。并且，CGN设备在用户表中增加用户表项。新增的用户表项保存了IPv6地址、公网IPv4地址和端口块的对应关系。
S506、CGN设备通过SCi通道，将用户IPv6地址、公网IPv4地址以及端口块上报给CP设备。
S507、CP设备向RADIUS服务器发送计费开始报文。计费开始报文携带用户的NAT溯源信息。NAT溯源信息包括IPv6地址、公网IPv4地址和端口块。
S508、CP设备向CPE下发IPv6地址。同时，CP设备通过SCi通道，向迷你BNG设备下发用户表项。
S509、LIG根据公网IPv4地址和端口块，向RADIUS服务器请求用户的账号信息。用户的账号信息包括而不限于用户的名称、用户的账号和会话ID中的至少一项。
S510、LIG根据用户的账号信息向迷你BNG设备下发监听策略。
S511、迷你BNG设备根据监听策略对用户的数据报文进行复制，将复制出的数据报文转发至监听平台。
在一些实施例中，NAT设备实现了可靠性方案，NAT设备为互为备份关系的主NAT设备和备NAT设备中的备NAT设备。
在一些实施例中，NAT设备的主备关系是CP设备配置的。例如，NAT设备具有一个或多个CPU，NAT设备向CP设备发送CPU信息，CPU信息指示NAT设备具有的CPU资源。CP设备接收CPU信息，从NAT设备具有的一个或多个CPU，选择第一CPU和第二CPU。CP设备向第一CPU发送配置指令，将第一CPU配置为主NAT设备，CP设备向第二CPU发送配置指令，将第二CPU配置为备NAT设备。
在一些实施例中，CP设备能够将主NAT设备上的用户表项同步至备NAT设备上，保证主NAT设备与备NAT设备之间的数据的一致性，使得主NAT设备故障时，备NAT设备能够根据获得的用户表项处理业务。下面，通过S601至S605对CP设备如何将主NAT设备上的用户表项同步至备NAT设备举例说明。
S601、主NAT设备向CP设备发送用户的信息，用户的信息包括第一IP地址、第二IP地址和端口块的对应关系。
S602、CP设备从主NAT设备接收用户的信息。
S603、CP设备向备NAT设备发送用户的信息。
S604、备NAT设备从CP设备接收用户的信息。
S605、在主NAT设备故障时，备NAT设备根据用户的信息为用户分配第二IP地址。
CP设备通过将主NAT设备发来的用户的信息下发给备NAT设备，使得备NAT设备获得了主NAT设备上保存的用户的信息。一方面，实现了备NAT设备与主NAT设备之间用户的信息的同步，从而能在主NAT设备故障时触发主备倒换，实现业务正常运行。另一方面，备NAT设备与主NAT设备不需要部署类似VRRP的主备选举机制，这样就不需要在CGN之间拉直连线，简化配置和部署资源。
上述S601至S605适用的可靠性方案包括多种情况。例如，上述S601至S605应用在用户上线后两台NAT设备进行框间备份的情况。例如，上述S601至S605应用在用户上线后两台NAT设备之间实现1:1温备的情况，以下结合附图12举例说明。在附图12所示的方法中，两台NAT设备互为备份关系。两台NAT设备中一台NAT设备为主NAT设备，即主用NAT设备。两台NAT设备中另一台NAT设备为备NAT设备，即备用NAT设备。两台NAT设备例如是两台独立式CGN设备。其中，主NAT设备为主CGN设备，主CGN设备也称CGN(M)；备NAT设备为备CGN设备，备CGN设备也称CGN(S)。其中，CP设备与主CGN设备、备CGN设备以及UP设备均通过CPRi、Mi、SCi等接口通信。CP设备与RADIUS服务器基于RADIUS协议通信。两台NAT设备例如称为两个NAT实例，两个NAT实例具有不同的实例ID，一个NAT实例是主CGN设备的NAT实例，另一个NAT实例是备CGN设备的NAT实例。
附图12所示的1:1温备方法包括以下S701至S708。
S701、用户上线后，CP设备确定用户上线的UP设备的ID。然后，CP设备根据配置信息，确定UP设备的ID下绑定的主CGN设备和备CGN设备。
S702、CP设备与RADIUS服务器交互后，CP设备生成用户表项，下发用户表项给主CGN设备。
S703、主CGN设备从CP设备接收用户表项，完成用户表项分配。主CGN设备将分配的用户表项返回给CP设备。
S704、CP设备从主CGN设备接收用户表项，给备CGN设备下发用户表项。在另一些实施例中，由主CGN设备向备CGN设备下发用户表项。
S705、CP设备完成RADIUS溯源。
S706、CP设备检测到主CGN设备故障。
在一些实施例中，主CGN设备是实现CGN功能的主CPU，CP设备检测主CGN设备故障是指检测到主CPU故障或者主CPU所在的业务板故障。
S707、CP设备通过CGN设备绑定的UP设备ID，确定主CGN设备与备CGN设备之间的备份关系。CP设备根据主CGN设备与备CGN设备之间的备份关系以及主CGN设备，确定备CGN设备。
S708、CP设备将流量引导到备CGN设备上，使得流量从主CGN设备切换至备CGN设备上。
在主备倒换过程中，CP设备如何将流量引导至备NAT设备(备CGN设备)上包括多种方式，以下结合两类场景进行举例说明。
场景一、NAT44场景下双机备份
在一些实施例中，CP设备通过刷新备NAT设备上公网地址(第二IP地址)对应的路由优先级，实现NAT44场景下的流量切换。具体地，主NAT设备和备NAT设备上会保存同一个公网IP地址段。主NAT设备上保存的公网IP地址段的路由优先级高，备NAT设备上保存的公网IP地址段的路由优先级低。因此，在主NAT设备正常时，下行流量会路由转发至备NAT设备。在主NAT设备故障时，CP设备与备NAT设备会交互执行以下步骤S801至S804。其中，下行流量是指从UP设备发往用户设备的流量，下行流量也称网络侧流量或公网侧流量，下行流量中的源IP地址为公网IP地址。
S801、若主NAT设备处于故障状态，CP设备生成第一更新消息。
S802、CP设备向备NAT设备发送第一更新消息。
第一更新消息也称路由优先级更新命令。第一更新消息用于指示备NAT设备提高第二IP地址对应的路由优先级。其中，第二IP地址对应的路由优先级例如为第二IP地址所属的网段的路由优先级，该网段中的每个IP地址对应于同一个路由优先级。第二IP地址对应的路由优先级也称公网IP网段的路由优先级。
S803、备NAT设备从CP设备接收第一更新消息。
S804、响应于第一更新消息，备NAT设备提高第二IP地址对应的路由优先级。
当主NAT设备发生故障时，CP设备通过向备NAT设备下发第一更新消息，从而通知备NAT设备调整公网地址对应的路由优先级，由于备NAT设备的公网地址对应的路由优先级升高，因此网络侧的流量会从主NAT设备切换至备NAT设备上，使得备NAT设备升级为主NAT设备，代替之前故障的主NAT设备处理网络侧的流量，避免流量传输中断。此外，由于流量的切换是CP设备引导的，能够保证主NAT设备与备NAT设备不会存在流量绕行。尤其是，该方法能够适用于NAT44场景，有助于NAT44场景下实现双机备份。
例如，参见附图12，CGN1和CGN2互为主备。CGN1和CGN2中每个CGN可选地包括多个CPU。CGN1和CGN2分别将CPU资源上报给CP设备。CP设备配置CGN的主备关系。其中，多对主备CPU实例和同一个loopback地址关联。主CGN的loopback地址对应的路由优先级高。此外，一对充当CGN的主备CPU共享一段公网地址，公网地址例如为100.1.1.0/24。主CPU的公网地址所属的地址段的路由优先级高于备CPU的公网地址所属的地址段的路由优先级。当CGN1(主CGN)的CPU出现故障，CGN1将故障事件上报给CP设备。CP设备向CGN2(备CGN)下发调整路由优先级的命令，将备CGN的CPU的公网地址段优先级升高。当CPU故障后，CR根据策略对UNI流量进行策略路由，将UNI流量重定向到CGN1(原来的主CGN)。然后，CR再通过CGN之间的绕行隧道或者直连链路，将UNI流量转发至现在的主用CGN2。NNI流量由于公网地址段路由已经更新，所以NNI流量直接发到CGN2。
场景二、DS-Lite场景下双机备份
在一些实施例中，主NAT设备和备NAT设备上不仅会保存同一个公网IP地址段，还会为隧道端点配置同一个IP地址。在主NAT设备故障时，CP设备通过刷新备NAT设备上公 网地址(第二IP地址)对应的路由优先级以及隧道端点的IP地址对应的优先级，实现DS-Lite场景下双机备份。例如，在主NAT设备故障时，CP设备与备NAT设备会交互执行以下步骤S901至S903，实现流量切换。
S901、若主NAT设备处于故障状态，CP设备向备NAT设备发送第一更新消息和第二更新消息。
第一更新消息用于指示备NAT设备提高第二IP地址对应的路由优先级。第二更新消息用于指示备NAT设备提高第三IP地址对应的路由优先级。
第三IP地址为隧道端点的IP地址。隧道例如是UP设备与NAT设备之间的隧道。隧道例如是DS-Lite隧道。隧道端点例如是NAT设备。隧道端点包括主NAT设备或者备NAT设备。具体地，在主NAT设备正常时，隧道端点为主NAT设备。在主NAT设备故障时，隧道端点从原来的主NAT设备切换为备NAT设备。在一些实施例中，隧道端点对应于NAT设备上的回环(loopback)端口，第三IP地址为loopback地址。且，主NAT设备上第三IP地址对应的路由优先级高，备NAT设备上第三IP地址对应的路由优先级高。例如，请参见附图13，CGN1和CGN2和同一个loopback地址关联。CGN1上隧道端点的loopback地址为1.1.1.1/32，CGN2的隧道端点的loopback地址也为1.1.1.1/32。并且，CGN1上隧道端点IP地址1.1.1.1/32的路由优先级高，CGN2上隧道端点IP地址为1.1.1.1/32的路由优先级低。在这个例子中，loopback地址1.1.1.1/32是对第三IP地址的举例说明。
此外，主NAT设备上保存的公网IP地址段的路由优先级高，备NAT设备上保存的公网IP地址段的路由优先级低。例如，请参见附图13，附图13中的CGN1和CGN2是对互为备份关系的主NAT设备和备NAT设备的举例说明。在采用CPU实现CGN设备时，CGN1和CGN2例如称为一对主备CPU。CGN1和CGN2上共享同一段公网IP地址。例如，CGN1上公网IP地址段是100.1.1.0/24。CGN2上公网IP地址段也是100.1.1.0/24。CGN1上公网IP地址段100.1.1.0/24的路由优先级高，CGN2上公网IP地址段100.1.1.0/24的路由优先级低。在这个例子中，公网IP地址段100.1.1.0/24是对第二IP地址所属的网段的举例说明。
S902、备NAT设备从CP设备接收第一更新消息和第二更新消息。
S903、响应于第一更新消息，备NAT设备提高第二IP地址对应的路由优先级。并且，响应于第二更新消息，备NAT设备提高第三IP地址对应的路由优先级。
例如，参见附图13，当CGN1(主CGN设备)的CPU出现故障时，CGN1将CPU故障事件上报给CP设备。CP设备向CGN2(备CGN设备)下发第一更新消息和第二更新消息，从而将CGN2(备CGN设备)的隧道端点IP地址的路由优先级提高。同时将CGN2(备CGN设备)的公网地址段优先级升高。故障前NNI流量在CGN1与传输网络之间传输。故障后NNI流量在CGN2与传输网络之间传输。其中，NNI是指CGN设备与PSN(包封装网络)网络间的接口。NNI流量也称公网侧流量，例如是CGN与之间传输的流量。故障前UNI流量在CGN1与UP设备之间传输。故障后UNI流量在CGN2与UP设备之间传输。其中，UNI是指网络侧与用户侧间的通信接口，即CGN设备与用户设备之间的通信接口。UNI流量也称用户侧流量，例如是用户设备与CGN之间传输的流量。
当主NAT设备发生故障时，CP设备通过向备NAT设备下发第一更新消息和第二更新消息，从而通知备NAT设备调整公网地址对应的路由优先级以及隧道端点地址对应的路由优先级，由于备NAT设备的公网地址对应的路由优先级升高，因此网络侧的流量会从主NAT设 备切换至备NAT设备，由于备NAT设备的隧道端点地址对应的路由优先级升高，因此用户侧的流量会从主NAT设备切换至备NAT设备，使得备NAT设备升级为主NAT设备，代替之前故障的主NAT设备处理网络侧的流量和用户侧的流量，避免流量传输中断。此外，由于流量的切换是CP设备引导的，能够保证主NAT设备与备NAT设备不会存在流量绕行。尤其是，该方法能够适用于DS-Lite场景，有助于DS-Lite场景下实现双机备份。
本申请的一些实施例提供了用户上线后两台UP设备之间如何实现1:1热备的方法，以下结合附图14举例说明。在附图14所示的方法中，两台UP设备之间互为备份关系。两台UP设备中一台UP设备为主UP设备，即主用UP设备，主UP设备也称UP设备(M)。两台UP设备中另一台UP设备为备UP设备，即备用UP设备，备UP设备也称UP设备(S)。两台UP设备例如是两台独立式CGN设备。其中，CP设备与主UP设备、备UP设备均通过CPRi、Mi、SCi等接口通信。在附图14所示的方法中，NAT设备是独立式CGN设备。
附图14所示的1:1热备方法包括以下S1001至S1004。
S1001、用户上线，CP设备将用户表项同时下发至主UP设备和备UP设备。
S1002、终端发送流量。主UP设备从终端接收流量。主UP设备将流量转发至CGN设备。其中，终端发送的流量也称上行流量。
S1003、CGN设备从主UP设备接收流量，根据流量生成NAT转换表项。从这一步骤可见，本实施例中上行流量仍然要经过CGN设备。
S1004、当主UP设备故障时，用户接入的UP设备从主UP设备切换至备UP设备。终端发送流量后，备UP设备接收流量，将流量转发至CGN设备。其中，由于用户的私网IPv4地址没有发生变化，所以CGN设备不感知UP设备故障情况。
附图15示出了CP设备的一种可能的结构示意图。附图15所示的CP设备110例如实现上述方法实施例中所涉及中CP设备的功能。
请参考附图15，CP设备110包括分配单元1101、发送单元1102和接收单元1103。CP设备110中的各个单元全部或部分地通过软件、硬件、固件或者其任意组合来实现。CP设备110中的各个单元用于执行上述方法200中CP设备各个相应的功能。具体地，分配单元1101用于支持CP设备110执行S210。发送单元1102用于支持CP设备110执行S220、S270。接收单元1103用于支持CP设备110执行S260。
在一些实施例中，接收单元1103、分配单元1101或发送单元1102还用于支持CP设备110执行本文所描述的技术中CP设备执行的其它过程。例如，接收单元1103用于支持CP设备110执行方法300、方法400、方法500等实施例中CP设备执行的各种接收操作，例如S602、S704等。分配单元1101用于支持CP设备110执行方法200、方法300、方法400、方法500等实施例中CP设备执行的各种分配操作，例如S302、S403等；发送单元1102用于支持CP设备110执行方法200、方法300、方法400、方法500等实施例中CP设备执行的各种发送操作，例如S303、S309、S402、S406、S503、S504、S507、S603、S702、S802、S901或S1001等。具体执行过程请参考上述方法实施例中相应步骤的详细描述，这里不再一一赘述。
本申请实施例中对单元的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可选 地有另外的划分方式。
在一些实施例中，CP设备110中各个单元集成在一个处理单元中。例如，CP设备110中各个单元集成在同一个芯片上。该芯片包括处理电路和与该处理电路内部连接通信的输入接口以及输出接口。分配单元1101通过芯片中的处理电路实现。接收单元1103通过芯片中的输入接口实现。发送单元1102通过芯片中的输出接口实现。例如，该芯片通过一个或多个现场可编程门阵列(英文全称：field－programmable gate array，英文简称：FPGA)、可编程逻辑器件(英文全称：programmable logic device，英文简称：PLD)、控制器、状态机、门逻辑、分立硬件部件、任何其它适合的电路、或者能够执行本申请通篇所描述的各种功能的电路的任意组合实现。
在另一些实施例中，CP设备110各个单元单独物理存在。在另一些实施例中，CP设备110一部分单元单独物理存在，另一部分单元集成在一个单元中。例如，在一些实施例中，分配单元1101和发送单元1102是同一个单元。在另一些实施例中，分配单元1101和发送单元1102是不同的单元。在一些实施例中，不同单元的集成采用硬件的形式实现，即，不同单元对应于同一个硬件。又如，不同单元的集成采用软件单元的形式实现。
在CP设备110中通过硬件实现的情况下，例如，CP设备110中分配单元1101例如通过设备1400中的处理器1401实现。CP设备110中接收单元1103、发送单元1102例如通过设备1400中的通信接口1404实现。又如，CP设备110中分配单元1101例如通过设备1300中的中央处理器1311、中央处理器1331或者网络处理器1332中的至少一项实现。CP设备110中接收单元1103、发送单元1102例如通过设备1300中的物理接口卡1333或物理接口卡1343中的至少一项实现。
在CP设备110中通过软件实现的情况下，CP设备110中各个单元例如为设备1400或设备1300中的处理器读取存储器中存储的程序代码后生成的软件。例如，CP设备110为虚拟化设备。虚拟化设备包括而不限于虚拟机、容器、Pod中的至少一种。在一些实施例中，CP设备110以虚拟机的形式，部署在硬件设备(如物理服务器)上。例如，基于通用的物理服务器结合网络功能虚拟化(Network Functions Virtualization，NFV)技术来实现CP设备110。采用虚拟机的方式实现时，CP设备110例如为虚拟主机、虚拟路由器或虚拟交换机。本领域技术人员通过阅读本申请即可结合NFV技术在通用物理服务器上虚拟出CP设备110。在另一些实施例中，CP设备110以容器(例如docker容器)的形式，部署在硬件设备上。例如，CP设备110执行上述方法实施例的流程被封装在镜像文件中，硬件设备通过运行镜像文件来创建CP设备110。在另一些实施例中，CP设备110以Pod的形式，部署在硬件设备上。Pod包括多个容器，每个容器用于实现CP设备110中的一个或多个单元。
附图16示出了NAT设备的一种可能的结构示意图。附图16所示的NAT设备120例如实现上述方法实施例中NAT设备(如CGN设备)的功能。
请参考附图16，NAT设备120包括接收单元1201、分配单元1202和发送单元1203。NAT设备120中的各个单元全部或部分地通过软件、硬件、固件或者其任意组合来实现。NAT设备120中的各个单元用于执行上述方法200中NAT设备各个相应的功能。具体地，接收单元1201用于支持NAT设备120执行S230。分配单元1202用于支持NAT设备120执行S24。发送单元1203用于支持NAT设备120执行S250。
在一些实施例中，接收单元1201、分配单元1202或发送单元1203还用于支持NAT设备120执行本文所描述的技术中NAT设备执行的其它过程或CGN设备执行的其它过程。例如，接收单元1201用于支持NAT设备120执行方法300、方法400、方法500等实施例中NAT设备执行的各种接收操作，如S604，S703、S803、S902、S1003中的至少一项。分配单元1202用于支持NAT设备120执行方法300、方法400、方法500等实施例中NAT设备执行的各种处理操作，如S304、S404、S505、S605中的至少一项；发送单元1203用于支持NAT设备120执行方法300、方法400、方法500等实施例中NAT设备执行的各种发送操作，如S305、S601中的至少一项。具体执行过程请参考方法300、方法400、方法500等实施例中相应步骤的详细描述，这里不再一一赘述。
本申请实施例中对单元的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可选地有另外的划分方式。
在一些实施例中，NAT设备120中各个单元集成在一个处理单元中。例如，NAT设备120中各个单元集成在同一个芯片上。该芯片包括处理电路和与该处理电路内部连接通信的输入接口以及输出接口。分配单元1202通过芯片中的处理电路实现。接收单元1201通过芯片中的输入接口实现。发送单元1203通过芯片中的输出接口实现。例如，该芯片通过一个或多个现场可编程门阵列(英文全称：field－programmable gate array，英文简称：FPGA)、可编程逻辑器件(英文全称：programmable logic device，英文简称：PLD)、控制器、状态机、门逻辑、分立硬件部件、任何其它适合的电路、或者能够执行本申请通篇所描述的各种功能的电路的任意组合实现。
在另一些实施例中，NAT设备120各个单元单独物理存在。在另一些实施例中，NAT设备120一部分单元单独物理存在，另一部分单元集成在一个单元中。例如，在一些实施例中，分配单元1202和发送单元1203是同一个单元。在另一些实施例中，分配单元1202和发送单元1203是不同的单元。在一些实施例中，不同单元的集成采用硬件的形式实现，即，不同单元对应于同一个硬件。又如，不同单元的集成采用软件单元的形式实现。
在NAT设备120中通过硬件实现的情况下，NAT设备120中分配单元1202例如通过设备1400中的处理器1401实现。NAT设备120中接收单元1201、发送单元1203例如通过设备1400中的通信接口1404实现。又如，NAT设备120中分配单元1202例如通过设备1300中的中央处理器1311、中央处理器1331或者网络处理器1332中的至少一项实现实现。NAT设备120中接收单元1201、发送单元1203例如通过设备1300中的物理接口卡1333或物理接口卡1343中的至少一项实现。
在NAT设备120中通过软件实现的情况下，NAT设备120中各个单元例如为设备1400或设备1300中的处理器读取存储器中存储的程序代码后生成的软件。例如，NAT设备120为虚拟化设备。虚拟化设备包括而不限于虚拟机、容器、Pod中的至少一种。在一些实施例中，NAT设备120以虚拟机的形式，部署在硬件设备(如物理服务器)上。例如，基于通用的物理服务器结合网络功能虚拟化(Network Functions Virtualization，NFV)技术来实现NAT设备120。采用虚拟机的方式实现时，NAT设备120例如为虚拟主机、虚拟路由器或虚拟交换机。本领域技术人员通过阅读本申请即可结合NFV技术在通用物理服务器上虚拟出NAT设备120。在另一些实施例中，NAT设备120以容器(例如docker容器)的形式，部署在硬件设备上。例如，NAT设备120执行上述方法实施例的流程被封装在镜像文件中，硬件设备 通过运行镜像文件来创建NAT设备120。在另一些实施例中，NAT设备120以Pod的形式，部署在硬件设备上。Pod包括多个容器，每个容器用于实现NAT设备120中的一个或多个单元。
以上通过CP设备110和NAT设备120，从逻辑功能的角度分别介绍了如何实现CP设备和NAT设备。以下通过设备1300或设备1400，从硬件的角度介绍如何实现CP设备和NAT设备。附图17所示的设备1300或附图18所示的设备1400是对CP设备和NAT设备的硬件结构的举例说明。
设备1300或设备1400对应于上述各个方法实施例的CP设备或者NAT设备，设备1300或设备1400中的各硬件、模块和上述其他操作和/或功能分别为了实现方法实施例中CP设备或者NAT设备所实施的各种步骤和方法，关于设备1300或设备1400如何实现基于RADIUS的NAT溯源的详细流程，具体细节可参见上述各个方法实施例，为了简洁，在此不再赘述。其中，各个方法实施例的各步骤通过设备1300或设备1400处理器中的硬件的集成逻辑电路或者软件形式的指令完成。结合本申请实施例所公开的方法的步骤可以直接体现为硬件处理器执行完成，或者用处理器中的硬件及软件模块组合执行完成。软件模块例如位于随机存储器，闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器，处理器读取存储器中的信息，结合其硬件完成上述方法的步骤，为避免重复，这里不再详细描述。
参见附图17，附图17示出了本申请一个示例性实施例提供的设备1300的结构示意图，设备1300例如配置为CP设备或者NAT设备。设备1300包括：主控板1310和接口板1330。
主控板也称为主处理单元(main processing unit，MPU)或路由处理卡(route processor card)，主控板1310用于对设备1300中各个组件的控制和管理，包括路由计算、设备管理、设备维护、协议处理功能。主控板1310包括：中央处理器1311和存储器1312。
接口板1330也称为线路接口单元卡(line processing unit，LPU)、线卡(line card)或业务板。接口板1330用于提供各种业务接口并实现数据包的转发。业务接口包括而不限于以太网接口、POS(Packet over SONET/SDH)接口等，以太网接口例如是灵活以太网业务接口(Flexible Ethernet Clients，FlexE Clients)。接口板1330包括：中央处理器1331、网络处理器1332、转发表项存储器1334和物理接口卡(physical interface card，PIC)1333。
接口板1330上的中央处理器1331用于对接口板1330进行控制管理并与主控板1310上的中央处理器1311进行通信。
网络处理器1332用于实现报文的转发处理。网络处理器1332的形态例如是转发芯片。具体而言，网络处理器1332用于基于转发表项存储器1334保存的转发表转发接收到的报文，如果报文的目的地址为设备1300的地址，则将该报文上送至CPU(如中央处理器1311)处理；如果报文的目的地址不是设备1300的地址，则根据该目的地址从转发表中查找到该目的地址对应的下一跳和出接口，将该报文转发到该目的地址对应的出接口。其中，上行报文的处理包括：报文入接口的处理，转发表查找；下行报文的处理：转发表查找等等。
物理接口卡1333用于实现物理层的对接功能，原始的流量由此进入接口板1330，以及处理后的报文从该物理接口卡1333发出。物理接口卡1333也称为子卡，可安装在接口板1330上，负责将光电信号转换为报文并对报文进行合法性检查后转发给网络处理器1332处理。在 一些实施例中，中央处理器也可执行网络处理器1332的功能，比如基于通用CPU实现软件转发，从而物理接口卡1333中不需要网络处理器1332。
可选地，设备1300包括多个接口板，例如设备1300还包括接口板1340，接口板1340包括：中央处理器1341、网络处理器1342、转发表项存储器1344和物理接口卡1343。
可选地，设备1300还包括交换网板1320。交换网板1320也例如称为交换网板单元(switch fabric unit，SFU)。在网络设备有多个接口板1330的情况下，交换网板1320用于完成各接口板之间的数据交换。例如，接口板1330和接口板1340之间例如通过交换网板1320通信。
主控板1310和接口板1330耦合。例如。主控板1310、接口板1330和接口板1340，以及交换网板1320之间通过系统总线与系统背板相连实现互通。在一种可能的实现方式中，主控板1310和接口板1330之间建立进程间通信协议(inter-process communication，IPC)通道，主控板1310和接口板1330之间通过IPC通道进行通信。
在逻辑上，设备1300包括控制面和转发面，控制面包括主控板1310和中央处理器1331，转发面包括执行转发的各个组件，比如转发表项存储器1334、物理接口卡1333和网络处理器1332。控制面执行路由器、生成转发表、处理信令和协议报文、配置与维护设备的状态等功能，控制面将生成的转发表下发给转发面，在转发面，网络处理器1332基于控制面下发的转发表对物理接口卡1333收到的报文查表转发。控制面下发的转发表例如保存在转发表项存储器1334中。在有些实施例中，控制面和转发面例如完全分离，不在同一设备上。
应理解，本申请实施例中接口板1340上的操作与接口板1330的操作一致，为了简洁，不再赘述。应理解，本实施例的设备1300可对应于上述各个方法实施例中的CP设备或者NAT设备，该设备1300中的主控板1310、接口板1330和/或1340例如实现上述各个方法实施例中的CP设备或者NAT设备所具有的功能和/或所实施的各种步骤，为了简洁，在此不再赘述。
值得说明的是，主控板可能有一块或多块，有多块的时候例如包括主用主控板和备用主控板。接口板可能有一块或多块，网络设备的数据处理能力越强，提供的接口板越多。接口板上的物理接口卡也可以有一块或多块。交换网板可能没有，也可能有一块或多块，有多块的时候可以共同实现负荷分担冗余备份。在集中式转发架构下，网络设备可以不需要交换网板，接口板承担整个系统的业务数据的处理功能。在分布式转发架构下，网络设备可以有至少一块交换网板，通过交换网板实现多块接口板之间的数据交换，提供大容量的数据交换和处理能力。所以，分布式架构的网络设备的数据接入和处理能力要大于集中式架构的设备。可选地，网络设备的形态也可以是只有一块板卡，即没有交换网板，接口板和主控板的功能集成在该一块板卡上，此时接口板上的中央处理器和主控板上的中央处理器在该一块板卡上可以合并为一个中央处理器，执行两者叠加后的功能，这种形态设备的数据交换和处理能力较低(例如，低端交换机或路由器等网络设备)。具体采用哪种架构，取决于具体的组网部署场景，此处不做任何限定。
参见附图18，附图18示出了本申请一个示例性实施例提供的设备1400的结构示意图，该设备1400可以配置为CP设备或者NAT设备。该设备1400可以是主机、服务器或个人计算机等。该设备1400可以由一般性的总线体系结构来实现。
设备1400包括至少一个处理器1401、通信总线1402、存储器1403以及至少一个通信接 口1404。
处理器1401例如是通用中央处理器(central processing unit，CPU)、网络处理器(network processer，NP)、图形处理器(Graphics Processing Unit，GPU)、神经网络处理器(neural-network processing units，NPU)、数据处理单元(Data Processing Unit，DPU)、微处理器或者一个或多个用于实现本申请方案的集成电路。例如，处理器1401包括专用集成电路(application-specific integrated circuit，ASIC)，可编程逻辑器件(programmable logic device，PLD)或其组合。PLD例如是复杂可编程逻辑器件(complex programmable logic device，CPLD)、现场可编程逻辑门阵列(field-programmable gate array，FPGA)、通用阵列逻辑(generic array logic，GAL)或其任意组合。
通信总线1402用于在上述组件之间传送信息。通信总线1402可以分为地址总线、数据总线、控制总线等。为便于表示，附图18中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
存储器1403例如是只读存储器(read-only memory，ROM)或可存储静态信息和指令的其它类型的静态存储设备，又如是随机存取存储器(random access memory，RAM)或者可存储信息和指令的其它类型的动态存储设备，又如是电可擦可编程只读存储器(electrically erasable programmable read-only Memory，EEPROM)、只读光盘(compact disc read-only memory，CD-ROM)或其它光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘存储介质或者其它磁存储设备，或者是能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其它介质，但不限于此。存储器1403例如是独立存在，并通过通信总线1402与处理器1401相连接。存储器1403也可以和处理器1401集成在一起。
通信接口1404使用任何收发器一类的装置，用于与其它设备或通信网络通信。通信接口1404包括有线通信接口，还可以包括无线通信接口。其中，有线通信接口例如可以为以太网接口。以太网接口可以是光接口，电接口或其组合。无线通信接口可以为无线局域网(wireless local area networks，WLAN)接口，蜂窝网络通信接口或其组合等。
在具体实现中，作为一种实施例，处理器1401可以包括一个或多个CPU，如附图18中所示的CPU0和CPU1。
在具体实现中，作为一种实施例，设备1400可以包括多个处理器，如附图18中所示的处理器1401和处理器1405。这些处理器中的每一个可以是一个单核处理器(single-CPU)，也可以是一个多核处理器(multi-CPU)。这里的处理器可以指一个或多个设备、电路、和/或用于处理数据(如计算机程序指令)的处理核。
在具体实现中，作为一种实施例，设备1400还可以包括输出设备和输入设备。输出设备和处理器1401通信，可以以多种方式来显示信息。例如，输出设备可以是液晶显示器(liquid crystal display，LCD)、发光二级管(light emitting diode，LED)显示设备、阴极射线管(cathode ray tube，CRT)显示设备或投影仪(projector)等。输入设备和处理器1401通信，可以以多种方式接收用户的输入。例如，输入设备可以是鼠标、键盘、触摸屏设备或传感设备等。
在一些实施例中，存储器1403用于存储执行本申请方案的程序代码1410，处理器1401可以执行存储器1403中存储的程序代码1410。也即是，设备1400可以通过处理器1401以及存储器1403中的程序代码1410，来实现方法实施例提供的方法。
本申请实施例的设备1400可对应于上述各个方法实施例中的CP设备或者NAT设备，并且，该设备1400中的处理器1401、通信接口1404等可以实现上述各个方法实施例中的CP设备或者NAT设备所具有的功能和/或所实施的各种步骤和方法。为了简洁，在此不再赘述。
参见附图19，本申请实施例提供了一种通信系统1500，系统1500包括：CP设备1501和NAT设备1502。可选的，CP设备1501为如附图15所示的CP设备1100或附图17所示的设备1300或附图18所示的设备1400，NAT设备1502为如附图16的NAT设备1200或附图17所示的设备1300或附图18所示的设备1400。
本领域普通技术人员可以意识到，结合本文中所公开的实施例中描述的各方法步骤和单元，能够以电子硬件、计算机软件或者二者的结合来实现，为了清楚地说明硬件和软件的可互换性，在上述说明中已经按照功能一般性地描述了各实施例的步骤及组成。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。本领域普通技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
所属领域的技术人员可以清楚地了解到，为了描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参见前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，该单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另外，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口、装置或单元的间接耦合或通信连接，也可以是电的，机械的或其它的形式连接。
该作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本申请实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以是两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
该集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分，或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例中方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(read-only memory，ROM)、随机存取存储器(random access memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
本申请中术语“第一”“第二”等字样用于对作用和功能基本相同的相同项或相似项进行区分，应理解，“第一”、“第二”之间不具有逻辑或时序上的依赖关系，也不对数量和执行顺序进行限定。还应理解，尽管以下描述使用术语第一、第二等来描述各种元素，但这些元素不 应受术语的限制。这些术语只是用于将一元素与另一元素区别分开。例如，在不脱离各种示例的范围的情况下，第一IP地址可以被称为第二IP地址，并且类似地，第二IP地址可以被称为第一IP地址。第一IP地址和第二IP地址都可以是IP地址，并且在某些情况下，可以是单独且不同的IP地址。
本申请中术语“至少一个”的含义是指一个或多个。本文中术语“系统”和“网络”经常可互换使用。
还应理解，术语“若”或“如果”可被解释为意指“当...时”(“when”或“upon”)或“响应于确定”或“响应于检测到”。类似地，根据上下文，短语“如果确定...”或“如果检测到[所陈述的条件或事件]”可被解释为意指“在确定...时”或“响应于确定...”或“在检测到[所陈述的条件或事件]时”或“响应于检测到[所陈述的条件或事件]”。
以上描述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到各种等效的修改或替换，这些修改或替换都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以权利要求的保护范围为准。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。该计算机程序产品包括一个或多个计算机程序指令。在计算机上加载和执行该计算机程序指令时，全部或部分地产生按照本申请实施例中的流程或功能。该计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。
该计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，该计算机程序指令可以从一个网站站点、计算机、服务器或数据中心通过有线或无线方式向另一个网站站点、计算机、服务器或数据中心进行传输。该计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。该可用介质可以是磁性介质(例如软盘、硬盘、磁带)、光介质(例如，数字视频光盘(digital video disc，DVD)、或者半导体介质(例如固态硬盘)等。
本领域普通技术人员可以理解实现上述实施例的全部或部分步骤可以通过硬件来完成，也可以通过程序来指令相关的硬件完成，该程序可以存储于一种计算机可读存储介质中，上述提到的存储介质可以是只读存储器，磁盘或光盘等。
以上，以上实施例仅用以说明本申请的技术方案，而非对其限制；尽管参照前述实施例对本申请进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本申请各实施例技术方案的范围。

Claims (24)

  1. 一种通信方法，其特征在于，应用于控制面CP和用户面UP分离的通信系统中的CP设备，所述方法包括：
    所述CP设备为用户分配第一互联网协议IP地址；
    所述CP设备向网络地址转换NAT设备发送所述第一IP地址；
    所述CP设备从所述NAT设备接收第二IP地址，所述第二IP地址为所述NAT设备为所述用户分配的公网IP地址；
    所述CP设备向远程用户拨号认证系统RADIUS服务器发送计费报文，所述计费报文包括所述第一IP地址和所述第二IP地址。
  2. 根据权利要求1所述的方法，其特征在于，所述第一IP地址包括私网互联网协议第四版IPv4地址或者互联网协议第六版IPv6地址中的至少一项。
  3. 根据权利要求1或2所述的方法，其特征在于，所述通信系统包括网关系统，所述网关系统为宽带网络网关BNG系统或者宽带远程接入服务器BRAS系统。
  4. 根据权利要求1至3中任一项所述的方法，其特征在于，所述计费报文还包括端口块，所述端口块包括所述NAT设备为所述用户分配的至少一个端口号；
    所述CP设备从所述NAT设备接收第二IP地址，包括：所述CP设备从所述NAT设备接收所述用户的信息，所述用户的信息包括所述第一IP地址、所述第二IP地址和所述端口块的对应关系。
  5. 根据权利要求4所述的方法，其特征在于，所述CP设备从所述NAT设备接收所述端口块之前，所述方法还包括：
    所述CP设备从所述RADIUS服务器接收端口块集合，所述端口块集合包括所述端口块；
    所述CP设备向所述NAT设备发送所述端口块集合。
  6. 根据权利要求4至5中任一项所述的方法，其特征在于，所述CP设备向远程用户拨号认证系统RADIUS服务器发送计费报文之后，所述方法还包括以下至少一项：
    若所述用户下线，所述CP设备向所述NAT设备发送删除消息，所述删除消息用于指示所述NAT设备删除所述NAT设备上保存的所述用户的信息；
    若所述用户下线，所述CP设备删除所述CP设备上保存的所述用户的信息。
  7. 根据权利要求4至6中任一项所述的方法，其特征在于，所述NAT设备包括互为备份关系的主NAT设备和备NAT设备，所述CP设备从所述NAT设备接收第二IP地址，包括：
    所述CP设备从所述主NAT设备接收所述用户的信息。
  8. 根据权利要求7所述的方法，其特征在于，所述CP设备从所述主NAT设备接收所述用户的信息之后，所述方法还包括：
    所述CP设备向所述备NAT设备发送所述用户的信息。
  9. 根据权利要求7所述的方法，其特征在于，所述方法还包括：
    若所述主NAT设备处于故障状态，所述CP设备向所述备NAT设备发送第一更新消息，所述第一更新消息用于指示所述备NAT设备提高所述第二IP地址对应的路由优先级。
  10. 根据权利要求9所述的方法，其特征在于，所述方法还包括：
    若所述主NAT设备处于故障状态，所述CP设备向所述备NAT设备发送第二更新消息，所述第二更新消息用于指示所述备NAT设备提高第三IP地址对应的路由优先级，所述第三IP地址为隧道端点的IP地址，所述隧道端点包括所述主NAT设备或者所述备NAT设备。
  11. 一种通信方法，其特征在于，应用于网络地址转换NAT设备，所述方法包括：
    所述NAT设备从控制面CP设备接收所述CP设备为用户分配的第一互联网协议IP地址，所述CP设备是CP和用户面UP分离的通信系统中的CP设备；
    所述NAT设备为所述用户分配第二IP地址，所述第二IP地址为公网IP地址；
    所述NAT设备向所述CP设备发送所述第二IP地址。
  12. 根据权利要求11所述的方法，其特征在于，所述NAT设备从控制面CP设备接收所述CP设备为用户分配的第一互联网协议IP地址之后，所述方法还包括：
    所述NAT设备为所述用户分配端口块，所述端口块包括至少一个端口号；
    所述NAT设备向所述CP设备发送所述端口块。
  13. 根据权利要求12所述的方法，其特征在于，所述NAT设备为所述用户分配端口块之前，所述方法还包括：所述NAT设备从所述CP设备接收端口块集合；
    所述NAT设备为所述用户分配端口块，包括：所述NAT设备在所述端口块集合内，为所述用户分配端口块。
  14. 根据权利要求12所述的方法，其特征在于，所述NAT设备为所述用户分配第二IP地址之后，所述方法还包括：
    所述NAT设备保存所述用户的信息，所述用户的信息包括所述第一IP地址、所述第二IP地址和所述端口块的对应关系。
  15. 根据权利要求14所述的方法，其特征在于，所述NAT设备向所述CP设备发送所述第二IP地址，包括：
    所述NAT设备向所述CP设备发送所述用户的信息。
  16. 根据权利要求14或15中任一项所述的方法，其特征在于，所述NAT设备向所述CP 设备发送所述第二IP地址之后，所述方法还包括：
    所述NAT设备从所述CP设备接收删除消息；
    响应于所述删除消息，所述NAT设备删除所述用户的信息。
  17. 根据权利要求11所述的方法，其特征在于，所述NAT设备为互为备份关系的主NAT设备和备NAT设备中的备NAT设备，所述NAT设备为所述用户分配第二IP地址之前，所述方法还包括：
    所述备NAT设备从所述CP设备接收所述用户的信息，所述用户的信息包括所述第一IP地址、所述第二IP地址和端口块的对应关系，所述端口块包括至少一个端口号；
    所述NAT设备为所述用户分配第二IP地址，包括：
    在所述主NAT设备故障时，所述备NAT设备根据所述用户的信息为所述用户分配所述第二IP地址。
  18. 根据权利要求17所述的方法，其特征在于，所述方法还包括：
    所述备NAT设备从所述CP设备接收第一更新消息；
    响应于所述第一更新消息，所述备NAT设备提高所述第二IP地址对应的路由优先级。
  19. 根据权利要求17或18所述的方法，其特征在于，所述方法还包括：
    所述备NAT设备从所述CP设备接收第二更新消息；
    响应于所述第二更新消息，所述备NAT设备提高第三IP地址对应的路由优先级，所述第三IP地址为隧道端点的IP地址，所述隧道端点包括所述主NAT设备或者所述备NAT设备。
  20. 一种控制平面CP设备，其特征在于，所述CP设备位于CP和用户平面UP分离的通信系统中，所述CP设备包括：
    分配单元，用于为用户分配第一互联网协议IP地址；
    发送单元，用于向网络地址转换NAT设备发送所述第一IP地址；
    接收单元，用于从所述NAT设备接收第二IP地址，所述第二IP地址为所述NAT设备为所述用户分配的公网IP地址；
    所述发送单元，还用于向远程用户拨号认证系统RADIUS服务器发送计费报文，所述计费报文包括所述第一IP地址和所述第二IP地址。
  21. 一种网络地址转换NAT设备，其特征在于，所述NAT设备包括：
    接收单元，用于从控制面CP设备接收所述CP设备为用户分配的第一互联网协议IP地址，所述CP设备是CP和用户面UP分离的通信系统中的CP设备；
    分配单元，用于为所述用户分配第二IP地址，所述第二IP地址为公网IP地址；
    发送单元，用于向所述CP设备发送所述第二IP地址。
  22. 一种通信系统，其特征在于，所述通信系统包括如权利要求20所述的CP设备以及如 权利要求21所述的NAT设备。
  23. 一种计算机可读存储介质，其特征在于，所述存储介质中存储有至少一条指令，所述指令由处理器读取以使控制平面CP设备和用户面UP分离的通信系统中的CP设备执行如权利要求1至权利要求10中任一项所述的方法。
  24. 一种计算机可读存储介质，其特征在于，所述存储介质中存储有至少一条指令，所述指令由处理器读取以使网络地址转换NAT设备执行如权利要求11至权利要求19中任一项所述的方法。
PCT/CN2021/101344 2020-07-22 2021-06-21 通信方法、cp设备及nat设备 WO2022017099A1 (zh)

Priority Applications (4)

Application Number Priority Date Filing Date Title
MX2023000974A MX2023000974A (es) 2020-07-22 2021-06-21 Metodo de comunicacion, dispositivo cp y dispositivo nat.
BR112023000834A BR112023000834A2 (pt) 2020-07-22 2021-06-21 Método de comunicação, dispositivo de cp, e dispositivo de nat
EP21846084.8A EP4184873A4 (en) 2020-07-22 2021-06-21 COMMUNICATION METHOD, CP DEVICE, AND NAT DEVICE
US18/157,662 US20230171223A1 (en) 2020-07-22 2023-01-20 Communication Method, CP Device, and NAT Device

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202010712973.3A CN113973022A (zh) 2020-07-22 2020-07-22 通信方法、cp设备及nat设备
CN202010712973.3 2020-07-22

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US18/157,662 Continuation US20230171223A1 (en) 2020-07-22 2023-01-20 Communication Method, CP Device, and NAT Device

Publications (1)

Publication Number Publication Date
WO2022017099A1 true WO2022017099A1 (zh) 2022-01-27

Family

ID=79585150

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/101344 WO2022017099A1 (zh) 2020-07-22 2021-06-21 通信方法、cp设备及nat设备

Country Status (6)

Country Link
US (1) US20230171223A1 (zh)
EP (1) EP4184873A4 (zh)
CN (1) CN113973022A (zh)
BR (1) BR112023000834A2 (zh)
MX (1) MX2023000974A (zh)
WO (1) WO2022017099A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114640574A (zh) * 2022-02-28 2022-06-17 天翼安全科技有限公司 一种主备设备的切换方法及装置

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115580465B (zh) * 2022-09-29 2024-05-14 中国联合网络通信集团有限公司 专网数据的传输方法、装置、设备及存储介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105791452A (zh) * 2014-12-23 2016-07-20 中兴通讯股份有限公司 获取nat信息的方法及bras设备
CN106549790A (zh) * 2015-09-22 2017-03-29 华为技术有限公司 一种用于溯源的映射表的更新方法和装置
CN108234139A (zh) * 2016-12-14 2018-06-29 中国电信股份有限公司 宽带网络中用户身份溯源的方法和系统及溯源设备
US10129207B1 (en) * 2015-07-20 2018-11-13 Juniper Networks, Inc. Network address translation within network device having multiple service units

Family Cites Families (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2005217974A (ja) * 2004-01-30 2005-08-11 Canon Inc 電子機器及びその制御方法
US8650279B2 (en) * 2011-06-29 2014-02-11 Juniper Networks, Inc. Mobile gateway having decentralized control plane for anchoring subscriber sessions
RU2676533C1 (ru) * 2015-07-14 2019-01-09 Хуавэй Текнолоджиз Ко., Лтд. Способ и устройство назначения ip-адреса
MY194638A (en) * 2015-10-30 2022-12-08 Huawei Tech Co Ltd Control plane gateway, user plane gateway and gateway configuration method
US10142221B2 (en) * 2016-09-07 2018-11-27 T-Mobile Usa, Inc. Network address translation in networks using multiple NAT devices
CN109561164B (zh) * 2017-09-27 2021-02-09 华为技术有限公司 Nat表项的管理方法、装置及nat设备
CN111131044B (zh) * 2018-10-30 2021-10-22 华为技术有限公司 路由管理方法和装置

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105791452A (zh) * 2014-12-23 2016-07-20 中兴通讯股份有限公司 获取nat信息的方法及bras设备
US10129207B1 (en) * 2015-07-20 2018-11-13 Juniper Networks, Inc. Network address translation within network device having multiple service units
CN106549790A (zh) * 2015-09-22 2017-03-29 华为技术有限公司 一种用于溯源的映射表的更新方法和装置
CN108234139A (zh) * 2016-12-14 2018-06-29 中国电信股份有限公司 宽带网络中用户身份溯源的方法和系统及溯源设备

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP4184873A4

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114640574A (zh) * 2022-02-28 2022-06-17 天翼安全科技有限公司 一种主备设备的切换方法及装置
CN114640574B (zh) * 2022-02-28 2023-11-28 天翼安全科技有限公司 一种主备设备的切换方法及装置

Also Published As

Publication number Publication date
MX2023000974A (es) 2023-05-03
US20230171223A1 (en) 2023-06-01
EP4184873A1 (en) 2023-05-24
CN113973022A (zh) 2022-01-25
BR112023000834A2 (pt) 2023-03-21
EP4184873A4 (en) 2023-11-29

Similar Documents

Publication Publication Date Title
US11398956B2 (en) Multi-Edge EtherChannel (MEEC) creation and management
US10063470B2 (en) Data center network system based on software-defined network and packet forwarding method, address resolution method, routing controller thereof
EP3509253A1 (en) Inter-cloud communication method and related device, inter-cloud communication configuration method and related device
CN111510378A (zh) Evpn报文处理方法、设备及系统
CN108199963B (zh) 报文转发方法和装置
CN111614541B (zh) 公有云网络物理主机加入vpc的方法
US20230171223A1 (en) Communication Method, CP Device, and NAT Device
JP2016152567A (ja) 通信装置及び通信方法
CN113872845B (zh) 建立vxlan隧道的方法及相关设备
EP2584742B1 (en) Method and switch for sending packet
US11546267B2 (en) Method for determining designated forwarder (DF) of multicast flow, device, and system
CN113746717A (zh) 网络设备通信方法及网络设备通信装置
CN113381936B (zh) 网络信息处理方法、装置及网络设备
US11621915B2 (en) Packet forwarding method, route sending and receiving method, and apparatus
CN113037883B (zh) 一种mac地址表项的更新方法及装置
CN115987778B (zh) 一种基于Kubernetes集群的容器通信方法
CN113938353A (zh) 室内机与室外机之间的多pdn实现方法及存储介质
JP2023543199A (ja) ルーティング情報伝送方法および装置
WO2022012383A1 (zh) 一种报文传输的方法、装置、系统及存储介质
WO2023174339A1 (zh) 发送组播业务的方法、装置、系统及存储介质
WO2023143186A1 (zh) 一种数据传输方法、系统及装置
WO2022213822A1 (zh) 一种控制用户设备接入网络的方法、装置及设备
CN108768704B (zh) 配置更新方法及装置
CN114697220A (zh) 一种报文处理方法及相关装置
CN116938693A (zh) 用户迁移的方法、装置、系统及存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21846084

Country of ref document: EP

Kind code of ref document: A1

REG Reference to national code

Ref country code: BR

Ref legal event code: B01A

Ref document number: 112023000834

Country of ref document: BR

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2021846084

Country of ref document: EP

Effective date: 20230220

ENP Entry into the national phase

Ref document number: 112023000834

Country of ref document: BR

Kind code of ref document: A2

Effective date: 20230116