WO2022127714A1 - 一种默认策略路由的芯片实现方法、数据报文的芯片处理方法及装置 - Google Patents

一种默认策略路由的芯片实现方法、数据报文的芯片处理方法及装置 Download PDF

Info

Publication number
WO2022127714A1
WO2022127714A1 PCT/CN2021/137228 CN2021137228W WO2022127714A1 WO 2022127714 A1 WO2022127714 A1 WO 2022127714A1 CN 2021137228 W CN2021137228 W CN 2021137228W WO 2022127714 A1 WO2022127714 A1 WO 2022127714A1
Authority
WO
WIPO (PCT)
Prior art keywords
route
matching
default
search
chip
Prior art date
Application number
PCT/CN2021/137228
Other languages
English (en)
French (fr)
Inventor
成伟
王俊杰
Original Assignee
苏州盛科通信股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 苏州盛科通信股份有限公司 filed Critical 苏州盛科通信股份有限公司
Publication of WO2022127714A1 publication Critical patent/WO2022127714A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/30—Routing of multiclass traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/54—Organization of routing tables

Definitions

  • the present invention requires the priority of the Chinese patent application filed on December 14, 2020 with the Chinese Patent Office, the application number is 202011472168.4, and the invention title is "a chip implementation method for default policy routing, and a chip processing method and device for data packets" , the entire contents of which are incorporated herein by reference.
  • the present invention relates to the technical field of implementing default policy routing, in particular to a chip implementation method of default policy routing, and a chip processing method and device for data packets.
  • PBR Policy Based Routing, Policy Routing
  • IP Internet Protocol, Internet Protocol
  • PBR policy routing is based on the source IP address forwarding, and the PBR matching priority is higher than the traditional IP routing technology. Therefore, in the case of mixed deployment with traditional routing entries, the PBR policy route forwarding will be preferentially matched.
  • PBR Packet Control Protocol
  • FDB Forwarding DataBase, maintained MAC address forwarding table
  • PBR Packet Data Network egress gateway
  • the gateway device needs to provide the internal server of the data center with the ability to access the external network, and the ability to access the private network address for the internal server of the data center. Due to the huge number of public network IP addresses, if all of them are delivered to the egress gateway device, hundreds of thousands of routing table entries need to be delivered. Therefore, the pressure on the routing table of the device is huge and cannot be directly based on IPDA (Internet Protocol Destination Address). , destination IP address) traditional routing technology to meet this demand.
  • IPDA Internet Protocol Destination Address
  • destination IP address Internet Protocol Destination Address
  • servers in different network segments need to be marked with different VLAN tags (Virtual Local Area Network Tag, virtual local area network tags) when accessing the public network. Therefore, PBR technology can be used to match the source IP network segment address. Forward and edit different VLAN tags.
  • the PBR policy routing is implemented through ACL (Access Control List, access control list). It is reserved for PBR, and the Key (keyword) of the ACL entry can be configured to match the source IP.
  • ACL Access Control List, access control list
  • the Key (keyword) of the ACL entry can be configured to match the source IP.
  • the problem brought by the above solution is that the ACL based on the source IP cannot directly meet the requirements of Default PBR (default policy routing).
  • the internal server IP-A of the data center accesses the public network IP-B and the private network server IP-C, and the gateway device sends a PBR entry matching the source IP-A, and the PBR entry matches The result is to perform an operation to access the public network IP-B.
  • a routing table entry matching the destination IP-C is issued on the gateway device, and the matching result of the routing table entry is to perform an operation of accessing the private network IP-C.
  • the Key (keyword) sent on the gateway device is the PBR entry of IP-A, which not only matches the data packets from IP-A to IP-B, but also matches the data packets from IP-A to IP-C. As a result, the data packets from IP-A to IP-C are incorrectly forwarded to the public network IP-B.
  • the purpose of the embodiments of the present invention is to overcome the defects of the prior art, and to provide a chip implementation method for default policy routing, a chip processing method and device for data packets.
  • a chip implementation method of default policy routing including: the search matching keyword of the default policy routing is configured to include at least a source IP address and a route matching state, the The route matching state is obtained according to the search result after the network chip performs the route search, and the matching priority of the default policy route is lower than the matching priority of the explicit route.
  • the default policy routing is implemented by multiplexing ACL entries.
  • the embodiment of the present invention also proposes another technical solution: a chip processing method for data packets based on default policy routing, including:
  • the chip performs a route search on the received data packet, performs corresponding processing on the packet according to the search result, and obtains a route matching state from the search result;
  • the chip uses the source IP address of the data packet and the route matching state as a matching keyword of the default policy route, and performs a default policy route lookup on the data packet, and if it does not match, enters S400;
  • the chip performs a policy routing lookup on the data packet, and if there is a match, performs forwarding next hop processing on the packet according to the policy routing lookup result.
  • the method further includes:
  • the chip parses the received data packet, and obtains packet matching information by parsing, where the packet matching information at least includes a source IP address and a destination IP address.
  • the S200 includes:
  • S201 Use the destination IP address of the data packet as a route search key, and perform a route search. If the search result matches the detailed route, execute the forwarding next hop processing of the detailed route, and if the search result matches the default route, enter S202;
  • step S300 if the default policy route is matched, the next hop processing is forwarded according to the default policy route.
  • the default route search priority of the route search ⁇ the search priority of the default policy route ⁇ the detailed route search priority of the route search ⁇ the search priority of the policy route.
  • step S400 the chip uses the source IP address of the data packet as a search key to perform policy routing search, and if there is a match, forwarding the next hop processing of the packet according to the policy routing search result.
  • the embodiment of the present invention also proposes another technical solution: a chip processing device for data packets routed based on a default policy, including:
  • the route lookup module is set to perform route lookup on the received data message, process the message accordingly according to the lookup result, and obtain the route matching state from the lookup result;
  • the default policy route matching module is set to use the source IP address of the data packet and the route matching state as the matching keyword of the default policy route, and perform a default policy route search on the data packet;
  • the policy-based route matching module is configured to perform policy-based route lookup on the data packet, and forward the next-hop processing of the packet according to the policy-based route lookup result.
  • the device further includes:
  • the packet parsing module is configured to parse the received data packet, and obtain packet matching information through parsing, where the packet matching information at least includes a source IP address and a destination IP address.
  • the default route search priority of the route search module ⁇ the search priority of the default policy route matching module ⁇ the detailed route search priority of the route search module ⁇ the search priority of the policy route matching module.
  • the embodiment of the present invention realizes default policy routing (Default PBR) by enhancing the matching ability of ACL matching keywords, and under the premise of not affecting the chip design of existing routing and PBR technology, by deploying Default PBR in data
  • Default PBR default policy routing
  • the embodiment of the present invention implements the Default PBR by multiplexing ACL entries, which simplifies the implementation of the Default PBR, thereby simplifying the logic design of the network switching chip, reducing the impact on the software and hardware upgrades of existing network equipment and the difficulty of deployment.
  • Fig. 1 is a schematic diagram of the principle of access between an existing public network server and a private network server;
  • FIG. 2 is a schematic diagram of the principle of access between a public network server and a private network server according to an embodiment of the present invention
  • FIG. 3 and FIG. 4 are schematic flowcharts of a chip processing method for a data packet according to an embodiment of the present invention
  • FIG. 5 is a structural block diagram of a chip processing apparatus for a data packet according to an embodiment of the present invention.
  • the matching capability of the server is enhanced to realize the default policy route, and by deploying the default policy route on the data center egress gateway device, normal access between the private network server and the public network server can be satisfied.
  • a method for implementing default policy routing in a network chip disclosed in an embodiment of the present invention implements default policy routing (Default PBR) by multiplexing ACL entries.
  • the search priority of the default policy route can be controlled by adding the route matching state of whether to match the default route in the matching keyword of the ACL, so that the search priority of the route, the search priority of the policy route and the search priority of the default policy route.
  • the priority relationship between the levels satisfies: the search priority of the policy route > the detailed route search priority of the route search > the search priority of the default policy route > the default route search priority of the route search.
  • the route matching state obtained from the route search result, whether the route matches the route is passed to the processing module of the ACL, and used as the keyword of the ACL search matching, that is, the added ACL matching keyword is at least the source IP address. Address and route match status. Then, at the system software level, the ACL entry is packaged into Default PBR.
  • the Default PBR is realized by enhancing the matching ability of the ACL Key.
  • the embodiment of the present invention implements the Default PBR by multiplexing ACL entries, it is not necessary to redesign the Default PBR chip function module independently, which simplifies the implementation of the Default PBR and reduces the impact and deployment on the software and hardware upgrades of existing network equipment. difficulty.
  • Deploying the above Default PBR on the data center egress gateway device can meet the normal access between the private network server and the public network server.
  • the internal server IP-A of the data center accesses the public network server IP-B and the private network server IP-C, and sends a Default PBR entry matching the source IP-A on the gateway device, and the Default PBR
  • the result of the entry matching is to perform the operation of accessing the public network IP-B.
  • a routing table entry matching the destination IP-C is issued on the gateway device, and the matching result of the routing table entry is to perform an operation of accessing the private network IP-C.
  • IP-A server When the IP-A server sends out two data streams: one is the source IP of the data packet from IP-A to IP-B is IP-A, the destination IP is IP-B, and the other is the data from IP-A to IP-C The source IP of the packet is IP-A, and the destination IP is IP-C.
  • the data packets from IP-A to IP-B will only match the Default PBR, not the traditional detailed route; the data packets from IP-A to IP-C will only match the traditional detailed route, not the traditional detailed route.
  • the default PBR will be incorrectly matched, so as to satisfy the normal access between the private network server IP-C and the public network server IP-B.
  • the embodiment of the present invention can meet the requirements of the server accessing the public network service and the internal private network server on the data center egress gateway device through the Default PBR technology.
  • the advantages of using Default PBR to the gateway device in this scenario include: 1. There is no need to deliver a large number of public network routes on the gateway device, and 2. The implemented Default PBR will not affect traditional route forwarding and PBR policy routing. .
  • the method for processing data packets by the network chip based on the above-mentioned default policy routing design includes the following steps:
  • the chip parses the received data packet, and obtains packet matching information by parsing.
  • the chip when it receives the data message, it first performs message parsing processing on the data message, and parses to obtain message matching information, where the message matching information includes source MAC (Media Access Control, media access control layer) address (MACSA) , destination MAC address (MACDA), source IP address, destination IP address, etc., and carry the packet matching information obtained by parsing to the subsequent processing flow.
  • message matching information includes source MAC (Media Access Control, media access control layer) address (MACSA) , destination MAC address (MACDA), source IP address, destination IP address, etc.
  • the chip performs a route search on the received data packet, performs corresponding processing on the packet according to the search result, and obtains a route matching state from the search result.
  • the chip uses the parsed destination IP address as a route search key to search for a route forwarding entry. If the result of the search matches the detailed route, the forwarding next hop processing of the detailed route is performed; if the detailed route is not matched, the default route is matched. If the result of the search is to hit the default route, the forwarding next hop of the default route is performed. skip processing, and transmit the route matching status of whether the default route is matched to step S300.
  • the chip uses the source IP address of the data packet and the route matching state as a matching keyword of the default policy route, and performs a default policy route lookup on the data packet. If there is no match, the chip proceeds to S400 .
  • the data packet is searched and matched by the default policy route, that is, the matching keyword of the default policy route is matched with the ACL entry. If there is a match, the forwarding next hop processing of the default policy route is performed. Then enter S400.
  • the chip performs a policy routing lookup on the data packet, and if there is a match, performs forwarding next hop processing on the packet according to the policy routing lookup result.
  • the chip uses the source IP address as a policy routing search key to search for a PBR entry, and if the search result is a match, the PBR forwarding next hop processing is performed.
  • the PBR forwarding next hop is given priority; when the default route, the Default PBR entry and the PBR entry are matched at the same time, it is also given priority
  • the next hop is forwarded according to the PBR; when both the detailed route and the Default PBR entry are matched, the next hop is forwarded according to the detailed route; when both the default route and the Default PBR entry are matched, the next hop is forwarded according to the Default PBR first. deal with. That is to say, the relationship between the matching priorities of PBR, detailed route, Default PBR and default route is: the default route search priority of route search ⁇ the search priority of default policy route ⁇ the specific route search priority of route search ⁇ The search priority of policy routing.
  • a chip processing apparatus for data packets disclosed in an embodiment of the present invention includes:
  • the packet parsing module is configured to parse the received data packet, and obtain packet matching information through parsing.
  • the route lookup module is configured to perform route lookup on the received data message, perform corresponding processing on the message according to the lookup result, and obtain the route matching state from the lookup result.
  • the default policy route matching module is set to use the source IP address and route matching state of the data packet as the matching keyword of the default policy route, and perform the default policy route lookup on the data packet.
  • the policy-based route matching module is configured to perform policy-based route lookup on the data packet, and forward the next-hop processing of the packet according to the policy-based route lookup result.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本发明实施例揭示了一种默认策略路由的芯片实现方法、数据报文的芯片处理方法及装置，所述默认策略路由的查找匹配关键字配置为至少包括源IP地址和路由匹配状态，路由匹配状态根据网络芯片进行路由查找后的查找结果得到，默认策略路由的匹配优先级小于明确路由的匹配优先级。本发明实施例通过对ACL匹配关键字的匹配能力进行增强来实现默认策略路由，在不影响现有路由和PBR技术的芯片设计的前提下，通过将Default PBR部署在数据中心出口网关设备上，能够满足私网服务器与公网服务器之间的正常访问。

Description

一种默认策略路由的芯片实现方法、数据报文的芯片处理方法及装置
本发明要求于2020年12月14日提交中国专利局、申请号为202011472168.4、发明名称“一种默认策略路由的芯片实现方法、数据报文的芯片处理方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本发明中。
技术领域
本发明涉及一种默认策略路由实现技术领域，尤其是涉及一种默认策略路由的芯片实现方法、数据报文的芯片处理方法及装置。
背景技术
PBR(Policy Based Routing，策略路由)是一种策略路由技术，PBR支持匹配数据流的源IP(Internet Protocol，互联网协议)地址进行转发。与基于目的IP地址的传统路由转发技术不同，PBR策略路由是基于源IP地址转发，PBR匹配优先级高于传统IP路由技术。因此，在和传统路由表项混合部署的情况下，会优先匹配PBR策略路由转发。
PBR其中一种典型的应用场景是利用PBR实现安全过滤，针对攻击的者的特征IP地址在网络设备上下发PBR表项对攻击者流量执行丢弃处理。因此，并不需要调整其它的业务相关的路由表项和FDB(Forwarding DataBase，维护的MAC地址转发表)表项，通过PBR执行安全策略能够在降低现网业务和设备表项的影响。
PBR另一种应用场景是数据中心出口网关，该网关设备需要为数据中心内部服务器提供访问外网的能力，以及为数据中心内部服务器提供私网地址访问能力。由于公网IP地址数量巨大，如果全部下发到该出口网关设备上，则需要下发几十万条路由表项，因此，对设备的路由表压力巨大， 无法直接基于IPDA(Internet Protocol Destination Address，目的IP地址)的传统路由技术满足该需求。但是，在实际应用过程中，需要针对不同网段的服务器在访问公网时打上不同的VLAN Tag(Virtual Local Area Network Tag，虚拟局域网标识)，因此，可借助PBR技术来匹配源IP网段地址进行转发并编辑不同的VLAN Tag。
在现有的实现PBR的芯片方案中，是通过ACL(Access Control List，访问控制列表)实现PBR策略路由，可以是通过将一部分ACL TCAM(Ternary Content Addressable Memory，三态内容寻址存储器)资源预留给PBR使用，将ACL表项的Key(关键字)配置为匹配源IP即可。但是上述方案带来的问题是：基于源IP的ACL无法直接满足Default PBR(默认策略路由)的需求。
如图1所示，在数据中心内部服务器IP-A访问公网IP-B和私网服务器IP-C，在该网关设备上下发匹配源IP-A的PBR表项，且该PBR表项匹配结果是执行访问公网IP-B的操作。在该网关设备上下发匹配目的IP-C的路由表项，且该路由表项匹配结果是执行访问私网IP-C的操作。当IP-A服务器发出两种数据流：一是IP-A到IP-B的数据报文的源IP为IP-A，目的IP为IP-B，二是IP-A到IP-C的数据报文的源IP为IP-A，目的IP为IP-C。在网关设备上下发的Key(关键字)为IP-A的PBR表项，不仅会匹配IP-A到IP-B的数据报文，还会匹配IP-A到IP-C的数据报文，导致将IP-A到IP-C的数据报文错误的转到公网IP-B。
因此，在数据中心出口网关设备上，还需要区分对于访问内网服务器的地址的流量需要执行基于IPDA路由转发，不能被PBR策略匹配，所以，传统的PBR技术无法直接满足该需求。
发明内容
本发明实施例的目的在于克服现有技术的缺陷，提供一种默认策略路由的芯片实现方法、数据报文的芯片处理方法及装置。
为实现上述目的，本发明实施例提出如下技术方案：一种默认策略路由的芯片实现方法，包括：所述默认策略路由的查找匹配关键字配置为至少包括源IP地址和路由匹配状态，所述路由匹配状态根据网络芯片进行路由查找后的查找结果得到，所述默认策略路由的匹配优先级小于明确路由的匹配优先级。
可选地，所述默认策略路由通过复用ACL表项实现。
本发明实施例还提出另外一种技术方案：一种基于默认策略路由的数据报文的芯片处理方法，包括：
S200，芯片对接收到的数据报文进行路由查找，根据查找结果对报文进行相应的处理，并由查找结果得到路由匹配状态；
S300，芯片将数据报文的源IP地址和所述路由匹配状态作为默认策略路由的匹配关键字，对数据报文进行默认策略路由查找，若不匹配，则进入S400；
S400，芯片对数据报文进行策略路由查找，若匹配，则根据策略路由查找结果对报文进行转发下一跳处理。
可选地，在步骤S200之前，所述方法还包括：
S100，芯片对接收到的数据报文进行解析，解析得到报文匹配信息，所述报文匹配信息至少包括源IP地址和目的IP地址。
可选地，所述S200包括：
S201，将数据报文的目的IP地址作为路由查找关键字，并进行路由查找，若查找结果是匹配明细路由，则执行明细路由的转发下一跳处理，若查找结果是匹配默认路由，则进入S202；
S202，将数据报文执行默认路由的转发下一跳处理，并将查找得到的路由匹配状态用作默认策略路由查找。
可选地，步骤S300中，若匹配默认策略路由，则按照默认策略路由转发下一跳处理。
可选地，路由查找的默认路由查找优先级＜默认策略路由的查找优先级＜路由查找的明细路由查找优先级＜策略路由的查找优先级。
可选地，步骤S400中，芯片将数据报文的源IP地址作为查找关键字进行策略路由查找，若匹配，则根据策略路由查找结果对报文进行转发下一跳处理。
本发明实施例还提出另外一种技术方案：一种基于默认策略路由的数据报文的芯片处理装置，包括：
路由查找模块，被设置为对接收到的数据报文进行路由查找，根据查找结果对报文进行相应的处理，并由查找结果得到路由匹配状态；
默认策略路由匹配模块，被设置为将数据报文的源IP地址和所述路由匹配状态作为默认策略路由的匹配关键字，对数据报文进行默认策略路由查找；
策略路由匹配模块，被设置为对数据报文进行策略路由查找，并根据策略路由查找结果对报文进行转发下一跳处理。
可选地，所述装置还包括：
报文解析模块，被设置为对接收到的数据报文进行解析，解析得到报文匹配信息，所述报文匹配信息至少包括源IP地址和目的IP地址。
可选地，所述路由查找模块的默认路由查找优先级＜默认策略路由匹配模块的查找优先级＜路由查找模块的明细路由查找优先级＜策略路由匹配模块的查找优先级。
本发明实施例的有益效果是：
1、本发明实施例通过对ACL匹配关键字的匹配能力进行增强来实现 默认策略路由(Default PBR)，在不影响现有路由和PBR技术的芯片设计的前提下，通过将Default PBR部署在数据中心出口网关设备上，能够满足私网服务器与公网服务器之间的正常访问。
2、本发明实施例通过复用ACL表项实现Default PBR，简化了Default PBR的实现，从而简化了网络交换芯片的逻辑设计，降低对现网设备的软硬件升级的影响及部署的难度。
附图说明
图1是现有公网服务器和私网服务器之间访问的原理示意图；
图2是本发明实施例公网服务器和私网服务器之间访问的原理示意图；
图3、图4均是本发明实施例数据报文的芯片处理方法的流程示意图；
图5是本发明实施例数据报文的芯片处理装置的结构框图。
具体实施方式
下面将结合本发明实施例的附图，对本发明实施例的技术方案进行清楚、完整的描述。
本发明实施例所揭示的一种默认策略路由的芯片实现方法、数据报文的芯片处理方法及装置，在不影响现有路由技术和PBR技术的芯片设计的前提下，通过对ACL匹配关键字的匹配能力进行增强来实现默认策略路由，且通过将默认策略路由部署在数据中心出口网关设备上，能够满足私网服务器与公网服务器之间的正常访问。
结合图2～图4所示，本发明实施例所揭示的一种网络芯片中默认策略路由的实现方法，通过复用ACL表项实现默认策略路由(Default PBR)。可以是通过在ACL的匹配关键字中增加是否匹配默认路由的路由匹配状态，来控制默认策略路由的查找优先级，使得路由的查找优先级、策略路由的查找优先级和默认策略路由的查找优先级之间的优先级关系满足：策 略路由的查找优先级＞路由查找的明细路由查找优先级＞默认策略路由的查找优先级＞路由查找的默认路由查找优先级。
可选地，本发明实施例将由路由查找结果得到的是否匹配路由的路由匹配状态传递到ACL的处理模块中，并作为ACL查找匹配的关键字，即增加后的ACL匹配关键字至少为源IP地址和路由匹配状态。之后在系统软件层面将ACL表项包装成Default PBR。本发明实施例在尽可能地降低芯片设计难度及在充分利用芯片的ACL资源的基础上，结合Default PBR的需求，通过对ACL Key的匹配能力进行增强来实现Default PBR。本发明实施例因是通过复用ACL表项来实现Default PBR，所以不需要重新单独设计Default PBR芯片功能模块，简化了Default PBR的实现，降低了对现网设备的软硬件升级的影响及部署的难度。
将上述Default PBR部署在数据中心出口网关设备上，能够满足私网服务器与公网服务器之间的正常访问。
如图2所示，在数据中心内部服务器IP-A访问公网服务器IP-B和私网服务器IP-C，在该网关设备上下发匹配源IP-A的Default PBR表项，且该Default PBR表项匹配结果是执行访问公网IP-B的操作。在该网关设备上下发匹配目的IP-C的路由表项，且该路由表项匹配结果是执行访问私网IP-C的操作。当IP-A服务器发出两种数据流：一是IP-A到IP-B的数据报文的源IP为IP-A，目的IP为IP-B，二是IP-A到IP-C的数据报文的源IP为IP-A，目的IP为IP-C。在网关设备上，IP-A到IP-B的数据报文只会匹配Default PBR，而不会匹配传统明细路由；IP-A到IP-C的数据报文只会匹配传统明细路由，而不会误匹配Default PBR，从而满足私网服务器IP-C与公网服务器IP-B之间的正常访问。
本发明实施例通过Default PBR技术能够解决在数据中心出口网关设备上满足服务器访问公网服务和内部私网服务器的需求。且采用Default PBR给该场景下的网关设备带来的好处包括：一、在网关设备上不需要下发大量的公网路由，二、实现的Default PBR也不会影响传统路由转发以 及PBR策略路由。
结合图3和图4所示，基于上述默认策略路由设计的网络芯片对数据报文的处理方法，包括以下步骤：
S100，芯片对接收到的数据报文进行解析，解析得到报文匹配信息。
可选地，芯片接收到数据报文，首先对数据报文进行报文解析处理，解析得到报文匹配信息，报文匹配信息包括源MAC(Media Access Control，介质访问控制层)地址(MACSA)、目的MAC地址(MACDA)、源IP地址，目的IP地址等，并将解析获取的报文匹配信息携带到后续的处理流程中。
S200，芯片对接收到的数据报文进行路由查找，根据查找结果对报文进行相应的处理，并由查找结果得到路由匹配状态。
可选地，芯片将解析得到的目的IP地址作为路由查找关键字，查找路由转发表项。如果查找的结果是匹配明细路由，就执行明细路由的转发下一跳处理；如果不匹配明细路由，则进行默认路由的匹配，如果查找的结果是命中默认路由，就执行默认路由的转发下一跳处理，并将是否匹配默认路由的路由匹配状态传送给步骤S300。
S300，芯片将数据报文的源IP地址和路由匹配状态作为默认策略路由的匹配关键字，对数据报文进行默认策略路由查找，若不匹配，则进入S400。
可选地，将数据报文进行默认策略路由的查找匹配，即将默认策略路由的匹配关键字与ACL表项进行匹配，若匹配，则执行默认策略路由的转发下一跳处理，若不匹配，则进入S400。
S400，芯片对数据报文进行策略路由查找，若匹配，则根据策略路由查找结果对报文进行转发下一跳处理。
可选地，芯片将源IP地址作为策略路由查找关键字进行查找PBR表 项，如果查找的结果是匹配，则执行PBR转发下一跳处理。
在上述查找匹配中，若同时匹配明细路由、Default PBR表项以及PBR表项时，则优先按照PBR转发下一跳处理；当同时匹配默认路由、Default PBR表项以及PBR表项时，也优先按照PBR转发下一跳处理；当同时匹配明细路由与Default PBR表项时，优先按照明细路由转发下一跳处理；当同时匹配默认路由与Default PBR表项时，优先按照Default PBR转发下一跳处理。也就是说，PBR、明细路由、Default PBR和默认路由的匹配优先级之间的关系为：路由查找的默认路由查找优先级＜默认策略路由的查找优先级＜路由查找的明细路由查找优先级＜策略路由的查找优先级。
与上述数据报文的芯片处理方法相对应的，如图5所示，本发明实施例所揭示的一种数据报文的芯片处理装置，包括：
报文解析模块，被设置为对接收到的数据报文进行解析，解析得到报文匹配信息。
路由查找模块，被设置为对接收到的数据报文进行路由查找，根据查找结果对报文进行相应的处理，并由查找结果得到路由匹配状态。
默认策略路由匹配模块，被设置为将数据报文的源IP地址和路由匹配状态作为默认策略路由的匹配关键字，对数据报文进行默认策略路由查找。
策略路由匹配模块，被设置为对数据报文进行策略路由查找，并根据策略路由查找结果对报文进行转发下一跳处理。
其中，报文解析模块、路由查找模块、默认策略路由匹配模块和策略路由匹配模块的原理可分别参照上述步骤S200～S400的描述，这里不做赘述。
本发明实施例的技术内容及技术特征已揭示如上，然而熟悉本领域的技术人员仍可能基于本发明实施例的教示及揭示而作种种不背离本发明 实施例精神的替换及修饰，因此，本发明保护范围应不限于实施例所揭示的内容，而应包括各种不背离本发明实施例的替换及修饰，并为本专利申请权利要求所涵盖。

Claims (10)

  1. 一种默认策略路由的芯片实现方法，所述方法包括：所述默认策略路由的查找匹配关键字配置为至少包括源IP地址和路由匹配状态，所述路由匹配状态根据网络芯片进行路由查找后的查找结果得到，所述默认策略路由的匹配优先级小于明确路由的匹配优先级。
  2. 根据权利要求1所述的一种默认策略路由的芯片实现方法，其中，所述默认策略路由通过复用ACL表项实现。
  3. 一种基于默认策略路由的数据报文的芯片处理方法，所述方法包括：
    S200，芯片对接收到的数据报文进行路由查找，根据查找结果对报文进行相应的处理，并由查找结果得到路由匹配状态；
    S300，芯片将数据报文的源IP地址和所述路由匹配状态作为默认策略路由的匹配关键字，对数据报文进行默认策略路由查找，若不匹配，则进入S400；
    S400，芯片对数据报文进行策略路由查找，若匹配，则根据策略路由查找结果对报文进行转发下一跳处理。
  4. 根据权利要求3所述的数据报文的芯片处理方法，其中，在步骤S200之前，所述方法还包括：
    S100，芯片对接收到的数据报文进行解析，解析得到报文匹配信息，所述报文匹配信息至少包括源IP地址和目的IP地址。
  5. 根据权利要求3或4所述的数据报文的芯片处理方法，其中，所述S200包括：
    S201，将数据报文的目的IP地址作为路由查找关键字，并进行路由查找，若查找结果是匹配明细路由，则执行明细路由的转发下一跳处理，若查找结果是匹配默认路由，则进入S202；
    S202，将数据报文执行默认路由的转发下一跳处理，并将查找得到的路由匹配状态用作默认策略路由查找。
  6. 根据权利要求5所述的数据报文的芯片处理方法，其中，步骤S300中，若匹配默认策略路由，则按照默认策略路由转发下一跳处理。
  7. 根据权利要求5所述的数据报文的芯片处理方法，其中，路由查找的默认路由查找优先级＜默认策略路由的查找优先级＜路由查找的明细路由查找优先级＜策略路由的查找优先级。
  8. 一种基于默认策略路由的数据报文的处理装置，所述装置包括：
    路由查找模块，被设置为对接收到的数据报文进行路由查找，根据查找结果对报文进行相应的处理，并由查找结果得到路由匹配状态；
    默认策略路由匹配模块，被设置为将数据报文的源IP地址和所述路由匹配状态作为默认策略路由的匹配关键字，对数据报文进行默认策略路由查找；
    策略路由匹配模块，被设置为对数据报文进行策略路由查找，并根据策略路由查找结果对报文进行转发下一跳处理。
  9. 根据权利要求8所述的数据报文的处理装置，其中，所述装置还包括：
    报文解析模块，被设置为对接收到的数据报文进行解析，解析得到报文匹配信息，所述报文匹配信息至少包括源IP地址和目的IP地址。
  10. 根据权利要求8所述的数据报文的处理装置，其中，所述路由查找模块的默认路由查找优先级＜默认策略路由匹配模块的查找优先级＜路由查找模块的明细路由查找优先级＜策略路由匹配模块的查找优先级。
PCT/CN2021/137228 2020-12-14 2021-12-10 一种默认策略路由的芯片实现方法、数据报文的芯片处理方法及装置 WO2022127714A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202011472168.4A CN112600752A (zh) 2020-12-14 2020-12-14 一种默认策略路由的芯片实现方法、数据报文的芯片处理方法及装置
CN202011472168.4 2020-12-14

Publications (1)

Publication Number Publication Date
WO2022127714A1 true WO2022127714A1 (zh) 2022-06-23

Family

ID=75195759

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/137228 WO2022127714A1 (zh) 2020-12-14 2021-12-10 一种默认策略路由的芯片实现方法、数据报文的芯片处理方法及装置

Country Status (2)

Country Link
CN (1) CN112600752A (zh)
WO (1) WO2022127714A1 (zh)

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112600752A (zh) * 2020-12-14 2021-04-02 盛科网络（苏州）有限公司 一种默认策略路由的芯片实现方法、数据报文的芯片处理方法及装置
CN113783778B (zh) * 2021-08-23 2023-02-28 杭州安恒信息技术股份有限公司 基于DDoS设备的策略路由方法、系统、计算机及存储介质
CN114401222B (zh) * 2021-12-28 2024-03-26 网络通信与安全紫金山实验室 一种基于策略路由的数据转发方法、装置及存储介质

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102664811A (zh) * 2012-05-04 2012-09-12 杭州华三通信技术有限公司 报文转发方法和装置
CN102833164A (zh) * 2012-08-23 2012-12-19 福建星网锐捷网络有限公司 策略路由的实现方法、装置和交换设备
CN104780103A (zh) * 2015-04-14 2015-07-15 杭州华三通信技术有限公司 报文转发方法及装置
US20190372895A1 (en) * 2018-06-05 2019-12-05 Arista Networks, Inc. System and method of a data processing pipeline with policy based routing
CN111181861A (zh) * 2020-01-13 2020-05-19 山东汇贸电子口岸有限公司 策略路由实现方法和装置
CN112600752A (zh) * 2020-12-14 2021-04-02 盛科网络（苏州）有限公司 一种默认策略路由的芯片实现方法、数据报文的芯片处理方法及装置

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102664811A (zh) * 2012-05-04 2012-09-12 杭州华三通信技术有限公司 报文转发方法和装置
CN102833164A (zh) * 2012-08-23 2012-12-19 福建星网锐捷网络有限公司 策略路由的实现方法、装置和交换设备
CN104780103A (zh) * 2015-04-14 2015-07-15 杭州华三通信技术有限公司 报文转发方法及装置
US20190372895A1 (en) * 2018-06-05 2019-12-05 Arista Networks, Inc. System and method of a data processing pipeline with policy based routing
CN111181861A (zh) * 2020-01-13 2020-05-19 山东汇贸电子口岸有限公司 策略路由实现方法和装置
CN112600752A (zh) * 2020-12-14 2021-04-02 盛科网络（苏州）有限公司 一种默认策略路由的芯片实现方法、数据报文的芯片处理方法及装置

Also Published As

Publication number Publication date
CN112600752A (zh) 2021-04-02

Similar Documents

Publication Publication Date Title
WO2022127714A1 (zh) 一种默认策略路由的芯片实现方法、数据报文的芯片处理方法及装置
RU2735725C1 (ru) Способ и устройство обработки и отправки пакетов, узел pe и узел
US8730967B1 (en) Policy-based virtual routing and forwarding (VRF) assignment
EP1408655B1 (en) Method and device for double tagging of data packets
US9237132B2 (en) Load balancing in a network with session information
US7529186B2 (en) Control plane security and traffic flow management
US7069336B2 (en) Policy based routing system and method for caching and VPN tunneling
EP1942617B1 (en) Method, device and system for Ethernet-supported Source Specific Multicast forwarding
CN101072183B (zh) 数据流的服务质量保证方法和装置
US8542580B2 (en) Method and system for transporting service flow securely in an IP network
EP1811728B2 (en) Method, system and device of traffic management in a multi-protocol label switching network
EP1816789B1 (en) A method and system for controlling the selection of the transmitting path for the media flow in the next generation network
WO2017133647A1 (zh) 一种报文处理方法、流分类器和业务功能实例
WO2022135274A1 (zh) 一种路由扩展的芯片实现方法、数据报文的芯片处理方法及装置
WO2007019755A1 (fr) Méthode pour fournir différentes qualités de service de flux de données
US20210258251A1 (en) Method for Multi-Segment Flow Specifications
US20100202312A1 (en) Quality of service routing architecture
US20060114904A1 (en) Differentiated services multicast system and method using encapsulation and unicast
WO2007082405A1 (fr) Procédé d'exécution pour détecter la légitimité d'un chemin de message à étiquette
JP2001249866A (ja) ファイアウォール機能を分散させたネットワーク、ファイアウォール分散機能を有するファイアウォールサーバ、及びファイアウォール機能を有するエッジノード
US20070124495A1 (en) Methods and systems for policy based routing
MXPA03008476A (es) Sistema, metodo y aparato que aisla la red privada virtual (vpn) y el transito de mejor esfuerzo para resistir el ataque de negacion del servicio.
US11909591B2 (en) Dynamic user private networks of a shared virtual network
WO2023125993A1 (zh) 隧道加密，转发和解密方法以及装置
JP2004533149A (ja) ＩＰＱｏＳのサービス拒否攻撃に耐えるための仮想私設網を採用するシステム、方法および装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21905643

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC ( EPO FORM 1205A DATED 10/11/2023 )

122 Ep: pct application non-entry in european phase

Ref document number: 21905643

Country of ref document: EP

Kind code of ref document: A1