WO2023029750A1

WO2023029750A1 - Mac learning method and apparatus, electronic device, and storage medium

Info

Publication number: WO2023029750A1
Application number: PCT/CN2022/104760
Authority: WO
Inventors: 刘冬梅; 王玉保
Original assignee: 中兴通讯股份有限公司
Priority date: 2021-08-30
Filing date: 2022-07-08
Publication date: 2023-03-09
Also published as: CN115733643A

Abstract

The embodiments of the present application relate to the field of data communications. Disclosed are a MAC learning method and apparatus, an electronic device, and a storage medium. The method comprises: according to a media access control (MAC) of a received data packet, acquiring a first MAC drift range corresponding to the MAC, wherein the first MAC drift range comprises trusted sender information; when the sender information of the data packet changes and the changed sender information is within the corresponding first MAC drift range, performing MAC learning on the data packet; and notifying other PEs in a belonging network of a MAC learning result of the data packet.

Description

MAC learning method, device, electronic equipment and storage medium

Cross References to Related Applications

This application is based on the Chinese patent application with the application number "202111007246.8" and the filing date is August 30, 2021, and claims the priority of the Chinese patent application. The entire content of the Chinese patent application is hereby incorporated by reference. Apply.

technical field

The present application relates to the EVPN technology in the field of data communication, and in particular to a MAC learning method, device, electronic equipment and storage medium.

Background technique

RFC7432 defines MAC (Media Access Control, media access control layer)/IP (Internet Protocol, protocol for interconnection between networks) address notification route, which is used to communicate from local PE (Provider Edge, operator edge router) to EVPN ( Other PEs in the Ethernet Virtual Private Network (Ethernet Virtual Private Network) network publish the reachability information of the MAC/IP address. At the same time, the extended attribute of MAC drift is defined for MAC/IP routing, and the attribute can carry a static mark, indicating that the MAC is a static MAC and does not allow drift. The dynamically learned MAC can carry the MAC drift sequence number. Whenever MAC drift occurs, the sequence number increases by 1, and each PE selects the MAC with the largest sequence number to take effect.

For dual-homing PEs, the MAC address notification carries the ESI (Ethernet Segment ID, Ethernet segment identifier) attribute. When other PEs receive the MAC address notification route and find that the ESI exists locally, they consider that the MAC address can also be local. Access, drifting is not considered to have occurred at this time.

When multiple ACs (Attachment Circuits, access links) of a PE are connected to devices that are all servers, the MAC source security requirements are relatively high, and the dual-homing access method is often used to ensure the reliability of AC access. For security, it is necessary to allow the local MAC address on the PE to drift between reliable ACs or multi-homed devices, but avoid drifting to unreliable ACs or remote devices.

In the method of preventing network attacks, MAC routing notifications carry special tags. If static tags are carried in MAC notifications learned by PEs, although the purpose of not drifting to the remote end can be solved, it cannot be achieved between multi-homed devices. drift between.

Contents of the invention

An embodiment of the present application provides a MAC learning method, which is applied to an edge router PE, including: acquiring a first MAC drift range corresponding to the MAC according to the MAC of the received data packet; wherein, the first A MAC drift range includes credible sender information; when the sender information of the data packet changes and the changed sender information is within the corresponding first MAC drift range, the data packet Performing MAC learning; notifying the MAC learning result of the data packet to other PEs in the network to which it belongs.

An embodiment of the present application provides a MAC learning device, including: an acquisition module, configured to acquire a first MAC drift range corresponding to the MAC according to the MAC of the received data packet; wherein, the first The MAC drift range includes credible sender information; the learning module is configured to, when the sender information of the data packet changes and the changed sender information is within the corresponding first MAC drift range, performing MAC learning on the data packet; notifying the MAC learning result of the data packet to other PEs in the network to which it belongs.

An embodiment of the present application also provides an electronic device, including: at least one processor; and a memory connected in communication with the at least one processor; wherein, the memory stores information that can be executed by the at least one processor. An instruction, the instruction is executed by the at least one processor, so that the at least one processor can execute the above MAC learning method applied to PE.

The embodiment of the present application also provides a computer-readable storage medium storing a computer program, and when the computer program is executed by a processor, the above-mentioned MAC learning method is implemented.

Description of drawings

FIG. 1 is a schematic structural diagram of an application environment provided by an embodiment of the present application;

FIG. 2 is a flow chart 1 of a MAC learning method provided by an embodiment of the present application;

FIG. 3 is a second flow chart of a MAC learning method provided by an embodiment of the present application;

FIG. 4 is a schematic structural diagram of a MAC learning device provided by an embodiment of the present application;

Fig. 5 is a schematic structural diagram of an electronic device provided by an embodiment of the present application.

Detailed ways

The purpose of this application is to solve the above problems, provide a MAC learning method, device, electronic equipment and storage medium, to realize that the local MAC on the PE is allowed to drift between reliable ACs or between multi-homing access devices, but avoid Drift to unreliable AC or remote to prevent MAC spoofing.

In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, various implementations of the present application will be described in detail below in conjunction with the accompanying drawings. However, those of ordinary skill in the art can understand that, in each implementation manner of the present application, many technical details are provided for readers to better understand the present application. However, even without these technical details and various changes and modifications based on the following implementation modes, the technical solution claimed in this application can also be realized.

The embodiment of this application can be used in a variety of EVPN scenarios without distinguishing VxLAN (Virtual Extensible Local Area Network, virtual extended local area network), MPLS (Multi-Protocol Label Switching, multi-protocol label switching), SRv6 (Segment Routing IPv6, based on IPv6 forwarding plane Segment routing) and other encapsulation types of EVPN.

The application environment of this embodiment is described in detail below, and the specific content is shown in FIG. 1 .

In the new MAN, the EVPN solution is mainly promoted. PE1\PE2\PE3 form an EVPN network and propagate MAC\IP routes through the BGP protocol. CE1 and CE2 are connected to multiple gateway devices, and the gateway can be migrated between CE1 and CE2. CE3 and CE4 are connected to unreliable user access. If a user on CE3 or CE4 forges the MAC address of CE1/CE2, the simulated service in the entire area will be interrupted.

To solve this problem, a policy is required to ensure that the MAC addresses learned by PE1 and PE2 from the AC interfaces connected to CE1 and CE2 on the local gateway will not drift to the AC connected to CE3.

An embodiment of the present application relates to a MAC learning method, which is applied to PEs. In this embodiment, according to the media access control layer MAC of the received data packet, the first MAC drift range corresponding to the MAC is obtained; wherein, the first MAC drift range includes credible sender information; in the When the sender information of the data packet changes and the changed sender information is within the corresponding first MAC drift range, perform MAC learning on the data packet; notify the MAC learning result of the data packet to Other PEs in the network to which it belongs. This application allows the local MAC on the PE to drift between reliable ACs or multi-homing access devices, and also achieves the purpose of not drifting the local MAC to the unreliable AC or the remote end, and the configuration of this application is simple , Flexible operation.

The implementation details of the MAC learning method in this embodiment are described in detail below. The following content is only for the convenience of understanding the implementation details of the solution, and is not necessary for implementing the solution.

In this embodiment, the second MAC drift range of the MAC is configured through a user interface. For example, the MAC is MACA, and the second MAC drift range is configured for MACA through a user interface. There may be one MAC or multiple MACs. If there are multiple MACs, corresponding second MAC drift ranges are respectively configured for the multiple MACs. The MAC drift range includes sender information, for example, the sender information includes the AC interface.

If the second MAC drift range of the locally configured MAC matches the third MAC drift range of the MAC learned from the access link AC, that is, the second drift range and the third drift range contain a common sender message, then The commonly included sender information is saved as the first MAC drift range corresponding to the MAC, and the MAC drift range corresponding to the MAC is notified to other PEs in the network to which the MAC belongs. For example, the third MAC drift range of the MACA learned from the AC is AC1 interface, AC2 interface, and AC3 interface, and the second MAC drift range of the locally configured MACA is also AC1 interface, AC2 interface, AC3 interface, and AC4. interface, since the third drift range and the second drift range jointly include the sender message: AC1 interface, AC2 interface, and AC3 interface, then it means that the locally configured second MAC drift range and the third MAC drift of the same MAC learned from AC For range matching, the commonly included sender information: AC1 interface, AC2 interface, and AC3 interface are stored as the first MAC drift range corresponding to the MACA. And notify other PEs in the network of the MAC drift range corresponding to the MAC. Taking PE1 in Figure 1 as an example, PE1 notifies PE2 and/or PE3 in Figure 1 of the first MAC drift range of the MACA, that is, both PE2 and/or PE3 can receive MAC routes and form a MAC table, And save the "MAC Drift Range" information. In another example, PE2 may configure and match the MAC drift range, and notify PE1 and/or PE3 of the first MAC drift range of the matched MAC.

The specific process is shown in Figure 2, and may include the following steps:

Step 201: Configure a second MAC drift range of the MAC through the ESI. Wherein, the MAC drift range includes sender information. In this embodiment, the sender information includes an AC interface, and the AC interface is represented by ESI.

Specifically, the PE can set the second MAC drifting range of the MAC by configuring an ESI list or ESI group that allows MAC drifting.

In one example, the purpose of controlling MAC flapping can be achieved by configuring an ESI list or ESI group that allows MAC flapping on the user interface. The PE in this embodiment can be a dual-homed PE, as shown in Figure 1. PE1 or PE2.

In this embodiment, the general ESI list or ESI group is planned in advance, and the configuration is relatively simple. It is simpler and more convenient than the current configuration of ACL filter table based on each MAC command, and it is flexible enough.

In step 202, match the second MAC drift range of the MAC locally configured with the third MAC drift range of the MAC learned from the access link AC according to preset rules, and determine that the MAC corresponds to Save the first MAC drifting range of the MAC, and notify other PEs in the network of the first MAC drifting range corresponding to the MAC; wherein, the locally configured MAC and the learned MAC are the same MAC.

That is to say, the PE that is not configured with the second MAC drifting range of the MAC may obtain the first MAC drifting range corresponding to the MAC according to the notification of other PEs in the network.

Specifically, the PE obtains sender information contained in both the second MAC drift range and the third MAC drift range, and saves the sender information contained in common as the first MAC drift range corresponding to the MAC .

In this embodiment, other PEs are notified through the Border Gateway Protocol BGP. That is to say, the MAC drift range carried by BGP can be a series of ESI values that allow drift. It can also be abstracted, the ESI group name or group ID formed by a series of ESIs. For example ESI1 and ESI2 are allowed to drift, but not allowed to drift to ESI3 and the far end.

In step 203, according to the MAC of the received data packet, a first MAC drift range corresponding to the MAC of the data packet is obtained. For example, if the MAC of the data packet received from the AC is MACA, then in this step, the first MAC drift range corresponding to MACA is obtained.

In an example, the PE may also receive data packets from other PEs in the network to which it belongs, and obtain the MAC drift range corresponding to the MAC of the data packets.

In step 204, if the sender information of the data packet is changed, and the changed sender information is still within the corresponding first MAC drift range, MAC learning is performed on the data packet, and the The MAC learning result of the above data packet is notified to other PEs in the network to which it belongs.

For example, the first MAC drift range of MACA is the AC1 interface, AC2 interface, and AC3 interface. The previous MACA data packet was transmitted to the PE through the AC1 interface, but the MACA data packet received this time is transmitted to the PE through the AC2 interface. For the local PE, it is necessary to determine whether the AC2 interface is within the first MAC drift range of the MACA. If it is within the first MAC drift range of MACA, the AC2 interface is considered reliable, and MACA drift is allowed, and the learning result of MACA is obtained, that is, it has drifted from the AC1 interface to the AC2 interface, and the MACA learning result is notified to the network to which it belongs. Other PEs in . Take PE1 as an example. After obtaining the MACA learning result, PE1 notifies PE2 and PE3 of the MACA learning result. Both PE2 and PE3 can receive the MAC route and form a MAC table, and save the drift range information.

If the MACA data packet received this time is transmitted to the PE through the AC4 interface, since the AC4 interface is not within the drift range of the MACA, the MACA is not learned, that is, the MACA data packet is kept as the information transmitted through the AC1 interface constant.

The PE in this embodiment may include the following components: a command configuration component, a BGP packet sending component, a BGP packet receiving component, and a MAC drift policy component.

Specifically, the command configuration component is used to configure the ESI list or ESI group that allows MAC drift; the BGP packet sending component is used to send MAC/IP routing to carry the ESI list or ESI group information that allows drift; the BGP packet receiving component is used to save The MAC entry records the ESI list or ESI group information that allows drifting; the MAC drifting policy component is used to receive MAC updates and find that the new MAC points to the ESI list that allows drifting, then allow drifting; otherwise, drifting is not allowed.

In this embodiment, the PE configures the local second MAC drift range in advance through the ESI, which is simpler and more convenient than configuring the ACL filter table based on the MAC command. Using MAC/IP routing packets to carry ESI groups that allow drifting allows MACs to drift between pooled CEs, that is, ESI groups, but does not allow MACs to be drifted from untrusted CEs or remote ends, thereby achieving the purpose of preventing MAC spoofing.

Another embodiment of the present application relates to a MAC learning method, and the specific process is shown in FIG. 3 . May include the following steps:

In step 301, a second MAC drift range of the MAC is configured through IP. Wherein, the second MAC drift range includes sender information, and in this embodiment, the sender message includes an IP address. In an example, a peer IP whitelist that allows MAC flapping can be configured on the PE.

In an example, the purpose of controlling MAC flapping can be achieved by configuring neighbor addresses that allow MAC flapping on the user interface.

In this embodiment, the general BGP neighbors are planned in advance, and the configuration is relatively simple, which is simpler and more convenient than the current configuration of the ACL filter table based on each MAC command, and is flexible enough.

In step 302, match the second MAC drift range of the MAC locally configured with the third MAC drift range of the MAC learned from the access link AC according to preset rules, and determine that the MAC corresponds to Save the first MAC drifting range of the MAC, and notify other PEs in the network of the first MAC drifting range corresponding to the MAC, where the locally configured MAC and the learned MAC are the same MAC.

That is to say, the PE that is not configured with the second MAC drifting range of the MAC may obtain the first MAC drifting range corresponding to the MAC according to the notification of other PEs in the network. In this embodiment, other PEs may be notified through the border gateway protocol.

In step 303, according to the MAC of the received data packet, a first MAC drift range corresponding to the MAC of the data packet is acquired.

For example, if the MAC of the data packet received from the AC is MACA, the first MAC drift range of MACA is obtained in this step.

In an example, the PE may also receive data packets from other PEs in the network to which it belongs, and obtain the first MAC drift range corresponding to the MAC of the data packets.

In step 304, if the sender information of the data packet to which it belongs is changed, and the changed sender information is still within the corresponding first MAC drift range, MAC learning is performed on the data packet, and the The MAC learning result of the data packet is notified to other PEs in the network to which it belongs.

For example, the first MAC drift range of MACA is IP1, IP2, and IP3. The previous MACA data packet was transmitted to the PE through IP1, and the MACA data packet received this time was transmitted to the current PE through IP2. It is necessary to determine whether IP2 is within the first MAC drift range of the MACA. If it is within the MAC drift range of MACA, then IP2 is considered reliable, MACA drift is allowed, and the learning result of MACA is obtained, that is, it has drifted from IP1 to IP2. And notify the learning result of the MACA to other PEs in the network to which it belongs. If the MACA data packet received this time is transmitted to the PE through IP4, since IP4 is not within the drift range of MACA, the MACA is not learned, that is, the information that the MACA data packet is transmitted through IP1 remains unchanged.

In this embodiment, neighbor addresses that allow MAC flapping are configured in advance on the user interface, and the configuration is relatively simple, which is simpler and more convenient than configuring an ACL filter table based on MAC commands. It can also realize that the local MAC on the PE is allowed to drift between IPs or multi-homing access devices, and at the same time avoid the problem of drifting to unreliable IPs or remote ends, and achieve the purpose of preventing MAC spoofing.

The step division of the above various methods is only for the sake of clarity of description. During implementation, it can be combined into one step or some steps can be split and decomposed into multiple steps. As long as they include the same logical relationship, they are all within the scope of protection of this patent. ; Adding insignificant modifications or introducing insignificant designs to the algorithm or process, but not changing the core design of the algorithm and process are all within the scope of protection of this patent.

The embodiment of the present application also provides a MAC learning device. As shown in FIG. 4 , it includes: an acquisition module 401 and a learning module 402 .

Specifically, the acquiring module 401 is configured to acquire a first MAC drift range corresponding to the MAC according to the MAC of the received data packet; wherein the first MAC drift range includes trusted sender information The learning module 402 is configured to perform MAC learning on the data packet when the sender information of the data packet changes and the changed sender information is within the corresponding first MAC drift range; The MAC learning result of the data packet is notified to other PEs in the network to which it belongs.

In an example, the MAC learning device may also include a configuration module (not shown in the figure), configured to configure the second MAC drift range of the MAC through a user interface; if the locally configured second MAC drift range of the MAC is the same as that from The third MAC drift range of the MAC learned by the access link AC matches, that is, the second drift range and the third drift range contain a common sender message, and the commonly contained sender information is used as the MAC The corresponding first MAC drift range is saved, and the first MAC drift range corresponding to the MAC is notified to other PEs in the network to which the MAC belongs. The PEs may be dual-homed PEs.

In an example, the MAC learning device may further include a MAC drift range acquisition module (not shown in the figure), configured to acquire the first MAC drift range corresponding to each MAC according to notifications from other PEs in the network to which it belongs.

In one example, the sender information includes the AC interface. Specifically, the AC interface may be represented by an Ethernet segment identifier ESI list or an ESI group. In another example, the sender information may include an IP address.

That is to say, comparing the sender information of the newly obtained MAC data packet with the previously saved sender information of the MAC, if the changed sender information is still within the first MAC drift range, then The MAC is learned. And notify the learning results to other PEs in the network to which it belongs. If the drift range is set by the ESI list or ESI group, then the changed sender information is the AC interface. If the drift range is set by the peer IP address , then the changed sender information is the IP address.

The MAC learning device provided by this embodiment can configure the ESI list or ESI group that allows MAC drifting on the user interface, and can also configure the neighbor addresses that allow MAC drifting on the user interface to achieve the purpose of controlling MAC drifting. Generally, ESI and BGP neighbors are It is planned in advance and the configuration is relatively simple, which is easier and more convenient than configuring the ACL filter table based on MAC commands. This application allows the local MAC on the PE to drift between reliable ACs or multi-homing access devices, and also achieves the purpose of not drifting the local MAC to the unreliable AC or the remote end, and the configuration of this application is simple , Flexible operation.

It is not difficult to find that this embodiment is an apparatus embodiment corresponding to the above-mentioned method embodiment applied to PE, and this embodiment may be implemented in cooperation with the above-mentioned method embodiment applied to a base station. The relevant technical details mentioned in the foregoing embodiment of the method applied to PE are still valid in this implementation manner, and will not be repeated here in order to reduce repetition. Correspondingly, the relevant technical details mentioned in this implementation manner can also be applied to the above embodiments of the MAC learning method applied to PEs.

It is worth mentioning that all the modules involved in the above embodiments of the present application are logical modules. In practical applications, a logical unit can be a physical unit, or a part of a physical unit, and can also Combination of physical units. In addition, in order to highlight the innovative part of the present application, units that are not closely related to solving the technical problems proposed in the present application are not introduced in this embodiment, but this does not mean that there are no other units in this embodiment.

An embodiment of the present application also provides an electronic device, as shown in FIG. 5 , including at least one processor 501; and a memory 502 communicatively connected to the at least one processor 501; An instruction executed by the at least one processor 501, where the instruction is executed by the at least one processor 501, so that the at least one processor can execute the foregoing MAC learning method applied to PEs.

Wherein, the memory and the processor are connected by a bus, and the bus may include any number of interconnected buses and bridges, and the bus connects one or more processors and various circuits of the memory together. The bus may also connect together various other circuits such as peripherals, voltage regulators, and power management circuits, all of which are well known in the art and therefore will not be further described herein. The bus interface provides an interface between the bus and the transceivers. A transceiver may be a single element or multiple elements, such as multiple receivers and transmitters, providing means for communicating with various other devices over a transmission medium. The data processed by the processor is transmitted on the wireless medium through the antenna, and further, the antenna receives the data and transmits the data to the processor.

The processor is responsible for managing the bus and general processing, and can also provide various functions, including timing, peripheral interface, voltage regulation, power management, and other control functions. Instead, memory can be used to store data that the processor uses when performing operations.

The above-mentioned products can execute the method provided in the embodiment of this application, and have corresponding functional modules and beneficial effects for executing the method. For technical details not described in detail in this embodiment, please refer to the method provided in the embodiment of this application.

Embodiments of the present application also provide a computer-readable storage medium storing a computer program. The above method embodiments are implemented when the computer program is executed by the processor.

Those skilled in the art can understand that all or part of the steps in the method of the above-mentioned embodiments can be completed by instructing related hardware through a program, the program is stored in a storage medium, and includes several instructions to make a device (which can be A single chip microcomputer, a chip, etc.) or a processor (processor) executes all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage media include: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic disk or optical disc, etc., which can store program codes. .

The above-mentioned embodiments are provided for those of ordinary skill in the art to implement and use this application. Those of ordinary skill in the art can make various modifications or changes to the above-mentioned embodiments without departing from the inventive idea of this application. Therefore, this application The scope of protection is not limited by the above-mentioned embodiments, but should conform to the maximum scope of the innovative features mentioned in the claims.

Claims

A MAC learning method applied to an edge router PE, comprising:

Acquiring a first MAC drift range corresponding to the MAC according to the media access control layer MAC of the received data packet; wherein the first MAC drift range includes credible sender information;

When the sender information of the data packet changes and the changed sender information is within the corresponding first MAC drift range, perform MAC learning on the data packet;

Notify the MAC learning result of the data packet to other PEs in the network to which it belongs.
The MAC learning method according to claim 1, wherein, before obtaining the first MAC drift range corresponding to the MAC according to the media access control layer MAC of the received data packet, further comprising:

configuring a second MAC drift range of the MAC through a user interface;

matching the second MAC drift range of the MAC locally configured with the third MAC drift range of the MAC learned from the access link AC according to a preset rule, and determining the first MAC drift corresponding to the MAC The first MAC drift range corresponding to the MAC is notified to other PEs in the network to which the MAC belongs.
The MAC learning method according to claim 2, wherein the second MAC drift range of the locally configured MAC is combined with the third MAC drift range of the target MAC learned from the access link AC Matching is performed according to preset rules, and the first MAC drift range corresponding to the MAC is determined for storage, including:

Acquiring sender information contained in both the second MAC drift range and the third MAC drift range;

Save the commonly included sender information as the first MAC drift range corresponding to the MAC.
The MAC learning method according to any one of claims 1 to 3, wherein the PE is a dual-homed PE.
The MAC learning method according to any one of claims 1 to 4, wherein the media intervention control layer MAC according to the received data packet, before obtaining the first MAC drift range corresponding to the MAC, further includes :

Obtain the first MAC drift range corresponding to each of the MACs according to the notifications of other PEs in the network to which the network belongs.
The MAC learning method according to any one of claims 1 to 5, wherein the sender information includes an AC interface.
The MAC learning method according to claim 6, wherein the AC interface is represented by an Ethernet segment identifier (ESI) list or ESI group.
The MAC learning method according to any one of claims 1 to 7, wherein the sender information includes an IP address.
The MAC learning method according to any one of claims 1 to 8, wherein the received data packets include: data packets received from the access link AC and/or from the Packets received by other PEs.
A MAC learning device, characterized in that, comprising:

An acquisition module, configured to acquire a first MAC drift range corresponding to the MAC according to the MAC of the received data packet; wherein the first MAC drift range includes credible sender information;

A learning module, configured to perform MAC learning on the data packet when the sender information of the data packet changes and the changed sender information is within the corresponding first MAC drift range; The MAC learning result of the data packet is notified to other PEs in the network to which it belongs.
An electronic device, characterized in that it comprises:

at least one processor; and,

a memory communicatively coupled to the at least one processor; wherein,

The memory stores instructions executable by the at least one processor, the instructions are executed by the at least one processor, so that the at least one processor can perform the operation described in any one of claims 1 to 9 The MAC learning method described above.
A computer-readable storage medium storing a computer program, wherein the computer program implements the MAC learning method according to any one of claims 1 to 9 when executed by a processor.