WO2023045871A1 - 报文处理方法、网络设备及系统 - Google Patents

报文处理方法、网络设备及系统 Download PDF

Info

Publication number
WO2023045871A1
WO2023045871A1 PCT/CN2022/119639 CN2022119639W WO2023045871A1 WO 2023045871 A1 WO2023045871 A1 WO 2023045871A1 CN 2022119639 W CN2022119639 W CN 2022119639W WO 2023045871 A1 WO2023045871 A1 WO 2023045871A1
Authority
WO
WIPO (PCT)
Prior art keywords
network device
connection
address
network
sid
Prior art date
Application number
PCT/CN2022/119639
Other languages
English (en)
French (fr)
Inventor
何宏伟
盛成
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2023045871A1 publication Critical patent/WO2023045871A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/74—Address processing for routing

Definitions

  • the present application relates to the technical field of communication, and in particular to a message processing method, network equipment and system.
  • Segment routing is a protocol designed based on the concept of source routing to forward packets on the network. SR divides the network path into segments and assigns segment IDs (segment IDs, SIDs) to these segments and forwarding nodes in the network. By arranging the segments and network nodes in an orderly manner, a segment list (segment list) can be obtained, and a forwarding path can be indicated through the segment list.
  • the basic process of packet forwarding based on SR technology is that when the headend device on the SR path receives the original packet sent by the source host, the headend device will encapsulate the original packet into an SR packet and hop to the next hop on the SR path.
  • a node sends an SR message.
  • the source IP address of the SR message is the Internet Protocol (internet protocol, IP) address of the head end.
  • IP Internet Protocol
  • the destination IP address of the SR message is the SID of the next-hop node.
  • the SR packet includes the SID of each node in the SR path.
  • the intermediate node that the SR path passes through will keep the source IP address of the SR packet unchanged, update the destination IP address of the SR packet to the SID of the next-hop node, and then send the SR packet Forward to the next hop node.
  • the tail end decapsulates the SR message into an original message, and sends the original message to the destination host.
  • the packet may be discarded because the unicast reverse path forwarding (URPF) check fails.
  • URPF unicast reverse path forwarding
  • the embodiment of the present application provides a message processing method, network device and system, which can avoid the problem of the message being discarded due to the failure of the URPF check.
  • the technical scheme is as follows.
  • a packet processing method is provided, and the method is optionally executed by a network device acting as an intermediate node on an SR path.
  • the method includes: the first network device receives a first packet from the second network device, the IP address of the first packet includes an IP address of an endpoint of the first connection, and the The first message includes a SID, the SID indicates a second connection, the first connection is a connection from the second network device to the first network device, and the second connection is a connection from the first network device A connection from a network device to a third network device; the first network device processes the first message to obtain a second message, and the source IP address of the second message is the endpoint IP of the second connection The address belongs to the IP address of the first network device, and the destination IP address of the second message is the IP address of the third network device among the endpoint IP addresses of the second connection; the first network The device sends the second packet to the third network device.
  • the intermediate node updates the source IP address of the message according to the IP address belonging to the local end in the connected endpoint IP address, and updates the destination IP address of the message according to the remote IP address in the connected endpoint IP address,
  • the SR path crosses multiple underlying (underlay) transmission networks in different routing domains, it avoids packet discarding due to URPF check failure due to the fact that the source IP address remains the IP address of the head end.
  • the underlay transmission network can naturally guarantee the routing reachability of the IP address, without requiring the underlay network device to run the IGP routing protocol supporting SR to learn the network segment route corresponding to the SID to ensure the routing reachability of the IP address, so the forwarding path The establishment does not need to depend on the routing protocol of the underlay transmission network.
  • the foregoing first connection and/or the second connection is a tunnel virtual connection (tunnel virtual connection, TVC).
  • a TVC is usually different from a physical link.
  • a TVC is a logical virtual connection.
  • a TVC usually passes through one or more underlay transmission networks. For example, the first connection passes through the first underlay network, and the second connection passes through the second underlay network.
  • the endpoint IP address of the first connection and/or the second connection is the IP address of the WAN interface of the wide area network allocated by the underlay network operator.
  • the underlay network operator Since the IP address of the WAN interface is allocated by the underlay network operator, the underlay network operator is responsible for ensuring the routing reachability of this IP address.
  • the network device does not need to advertise the route containing this IP address to the devices in the underlay network through the routing protocol. In this way, the dependence on the routing protocol of the underlay network is eliminated, and the overhead caused by advertising routes is saved.
  • the endpoint IP address of the first connection and/or the second connection is a public network IP address.
  • the foregoing first connection and/or second connection is a connection between different sites.
  • the second network device is deployed at the first site
  • the first network device is deployed at the second site
  • the third network device is deployed at the third site.
  • the above-mentioned first connection is a connection from the first site to the second site
  • the above-mentioned third connection is a connection from the second site to the third site.
  • the IP address of the endpoint of the first connection is an Internet Protocol version 6 IPv6 address
  • the first packet includes a segment routing header SRH
  • the SID is located in the SRH of the first packet.
  • the above-mentioned first message includes an IPv6 header, and the IPv6 header is encapsulated in the outer layer of the original message, and the IP address of the endpoint of the first connection is located in the IPv6 header of the first message.
  • the IP address of the endpoint of the second connection is an IPv6 address.
  • the second packet includes an IPv6 header, the IPv6 header is encapsulated in the outer layer of the original packet, and the IP address of the endpoint of the second connection is located in the IPv6 header of the second packet.
  • the two connected endpoints since the two connected endpoints transmit packets based on IPv6 addresses, and SRH is encapsulated in the packets, it helps to support the construction of SD-WAN SR tunnels on IPv6 transmission networks.
  • the IP address of the endpoint of the first connection is an Internet Protocol version 4 IPv4 address
  • the first packet includes an SRH
  • the SID is located in the SRH of the first packet.
  • the first message includes an IPv4 header
  • the IPv4 header is encapsulated in the outer layer of the original message
  • the IP address of the endpoint of the first connection is located in the IPv4 header of the first message.
  • the IP address of the endpoint of the second connection is an IPv4 address.
  • the second message includes an IPv4 header, and the IPv4 header is encapsulated in the outer layer of the original message, and the IP address of the endpoint of the second connection is located in the IPv4 header of the second message.
  • the packets are transmitted based on the IPv4 address between the two connected endpoints, it helps to support the construction of SD-WAN SR tunnels on the IPv4 transmission network.
  • the foregoing first packet includes a protocol type corresponding to the SRH.
  • the first message includes a GRE header
  • the GRE header is encapsulated in the outer layer of the SRH
  • the protocol type corresponding to the SRH is located in the GRE header of the first message.
  • the above-mentioned first message includes a VXLAN header
  • the VXLAN header is encapsulated in the outer layer of the SRH
  • the protocol type corresponding to the SRH is located in the VXLAN header of the above-mentioned first message.
  • the protocol type corresponding to the SRH is located in the IPv4 header of the first packet.
  • the protocol type corresponding to the SRH is included before the SRH in the message, it is convenient for the intermediate node to identify the SRH according to the protocol type, and then perform processing according to the SID in the SRH, reducing the implementation complexity.
  • the method provided in the first aspect further includes a process of reporting the IP address of the endpoint before the traffic forwarding stage.
  • the network device serving as the source reports the IP address of the endpoint of the connection to the controller device.
  • the second network device sends the endpoint IP address of the first connection to the controller device.
  • the first network device sends the IP address of the endpoint of the second connection to the controller device.
  • the network device serving as the destination reports the IP address of the endpoint of the connection to the controller device.
  • the first network device sends the endpoint IP address of the first connection to the controller device.
  • the third network device sends the IP address of the endpoint of the second connection to the controller device.
  • both the network device serving as the source end and the network device serving as the destination end report the IP addresses of the endpoints of the connection to the controller device, and the controller device selects one of the IP addresses of the connection endpoints reported by the two network devices. copies of IP addresses.
  • the second network device sends the endpoint IP address of the first connection to the controller device.
  • the first network device sends the endpoint IP address of the second connection and the endpoint IP address of the first connection to the controller device.
  • the third network device sends the IP address of the endpoint of the second connection to the controller device.
  • the controller device After receiving the endpoint IP address of the first connection sent by the second network device and the endpoint IP address of the first connection sent by the first network device, the controller device selects one copy of the first connection endpoint IP address from the two copies of the first connection endpoint IP address. The IP address of the endpoint is used for path calculation. After receiving the endpoint IP address of the second connection sent by the first network device and the endpoint IP address of the second connection sent by the third network device, the controller device selects one copy of the second connection endpoint IP address from the two copies of the second connection endpoint IP address. The IP address of the endpoint is used for path calculation.
  • the controller device is supported to perceive the endpoint IP address of each connection in the network, thereby assisting the controller device in orchestrating SR paths containing multiple connections, reducing the difficulty of path calculation by the controller.
  • the above-mentioned process of reporting the endpoint IP address of the connection includes: the above-mentioned first network device generates a border gateway protocol link state (border gateway protocol link-state, BGP LS) message, and the above-mentioned BGP-LS message includes the above-mentioned first
  • the endpoint IP address of the second connection and/or the endpoint IP address of the above-mentioned first connection, the above-mentioned BGP-LS message also includes the identification of the SD-WAN protocol; the above-mentioned first network device sends the above-mentioned BGP-LS message to the above-mentioned controller device .
  • the first network device before the first network device receives the first message from the second network device, the first network device also obtains the identifier of the site where the first network device is located, and sends the site ID of the site where the first network device is located to the controller device logo.
  • the network device reports the identifier of the station where it is located to the controller device, it is convenient for the controller device to perform path calculation using the station as an object.
  • the first network device before the first network device receives the first message from the second network device, the first network device also detects the on-off state of the first connection and/or the above-mentioned second connection, and sends the above-mentioned first message to the controller device. connection and/or the on-off state of the above-mentioned second connection.
  • the first network device periodically sends the on-off status of the first connection and/or the second connection to the controller device.
  • the on-off state of the first connection is updated, the first network device sends the on-off state of the first connection to the controller device.
  • the on-off state of the second connection when the on-off state of the second connection is updated, the first network device sends the on-off state of the second connection to the controller device.
  • the network device Since the network device reports the on-off status of the connection to the controller device, it helps the controller device to perceive the status of each connection in the SR path in a timely manner, realizing end-to-end path state awareness. If the controller finds that a connection in a certain SR path fails, the controller device can import the traffic to other SR paths by invalidating the SR path, revoking the SR path, or recalculating the SR path, so as to avoid traffic forwarding to the intermediate The case of being discarded.
  • the method further includes: service-level agreement (service-level agreement, SLA) information of the first connection and/or the second connection .
  • SLA information includes but not limited to at least one of packet loss rate, delay, jitter, or bandwidth utilization.
  • the network device Since the network device reports the connection SLA information to the controller device, it helps the controller device to perceive the SLA of each connection in the SR path in a timely manner, and calculate the path whose SLA meets the service requirements.
  • the controller device allocates a SID for the second connection.
  • the controller device sends the SID to the first network device.
  • the first network device receives the SID from the controller device.
  • a packet processing method is provided, and the method is optionally executed by a network device acting as a headend on an SR path.
  • the method includes: the second network device receives the original message; the second network device generates the first message according to the original message.
  • the source IP address of the first packet is an IP address belonging to the second network device among the endpoint IP addresses of the first connection.
  • the destination IP address of the first packet is an IP address belonging to the first network device among the endpoint IP addresses of the first connection.
  • the first connection is a connection from the second network device to the first network device.
  • the first packet includes a first SID.
  • the first SID indicates a second connection.
  • the second connection is a connection from the first network device to a third network device; the second network device sends a first packet to the first network device.
  • the above-mentioned first connection and/or the second connection is a TVC.
  • the above-mentioned first connection and/or second connection is a connection between different sites.
  • the headend since the headend uses the endpoint IP address of a TVC as the IP address of the message, and the message carries the SID indicating the next TVC, the message can be routed and forwarded to the next site through the endpoint IP address, And the SID is used to instruct the intermediate node to forward the message to the next site, thus solving the problem that the message cannot pass through multiple designated sites in the SD-WAN scenario.
  • the second network device receives the SR policy sent by the controller device.
  • the SR policy includes the above-mentioned first SID.
  • the second network device obtains the first SID from the SR policy.
  • the foregoing SR policy further includes a second SID, where the foregoing second SID indicates the foregoing first connection.
  • the first packet includes an IP header and an SRH encapsulated in an outer layer of the original packet.
  • the IP address of the endpoint of the first connection is located in the IP header of the first packet.
  • the first SID is located in the IP header of the first packet.
  • the foregoing first packet includes a protocol type corresponding to the SRH.
  • the above-mentioned first message includes a GRE header
  • the GRE header is encapsulated in the outer layer of the SRH
  • the protocol type corresponding to the SRH is located in the GRE header of the above-mentioned first message.
  • the above-mentioned first message includes a VXLAN header
  • the VXLAN header is encapsulated in the outer layer of the SRH
  • the protocol type corresponding to the SRH is located in the VXLAN header of the above-mentioned first message.
  • the protocol type corresponding to the SRH is located in the IPv4 header of the first packet.
  • a method for determining a path in which the controller device obtains the endpoint IP addresses of multiple connections; the above-mentioned controller device determines the segment routing SR path according to the endpoint IP addresses of the multiple connections, the above-mentioned
  • the SR path includes a first connection and a second connection among the above-mentioned multiple connections, the above-mentioned first connection is a connection from the above-mentioned first network device to the second network device, and the above-mentioned second connection is from the above-mentioned second network device to the third network Device connection.
  • the controller device sends the SR policy to the first network device, where the SR policy indicates the SR path.
  • the controller device uses the endpoint IP addresses of multiple connections to compile an SR path containing multiple connections, and sends an SR policy indicating the SR path to the head end of the SR path, so that the head end forwards the SR path according to the SR policy. message.
  • the controller device uses the endpoint IP addresses of multiple connections to compile an SR path containing multiple connections, and sends an SR policy indicating the SR path to the head end of the SR path, so that the head end forwards the SR path according to the SR policy. message.
  • this approach it helps to establish an end-to-end and orchestrated path across multiple sites, facilitating traffic planning.
  • each of the above-mentioned multiple connections is a connection between different sites
  • the process for the controller device to determine the SR path includes: the controller device determines, based on the endpoint IP addresses of the above-mentioned multiple connections, with the site as the path layout object SR path.
  • the process for the controller device to determine the SR path includes: the controller device selects a target connection from connections established by different network devices in the same site, and determines the SR path according to the target connection.
  • the network includes site 1 and site 2, site 1 includes network device a and network device b, and site 2 includes network device c and network device d.
  • the controller device determines that the network includes four connections according to the IP addresses of the connection endpoints reported by the network device.
  • the four connections are the connection from network device a to network device c, the connection from network device a to network device d, the connection from network device b to network device c, and the connection from network device b to network device d.
  • the controller device selects the target connection from the four connections according to the set constraint conditions, and determines the SR path according to the target connection.
  • the constraints are SLA requirements.
  • the controller device selects the connection whose SLA information meets the SLA requirement from multiple connections at the same site as the target connection.
  • SLA requirements include, but are not limited to, that the delay is less than the set duration, the packet loss rate is less than the set packet loss rate, the jitter is less than the set value, and the bandwidth utilization rate is greater than the set bandwidth utilization rate.
  • the controller device obtaining the endpoint IP addresses of multiple connections includes: the controller device receiving the endpoint IP address of the first connection sent by the first network device or the second network device.
  • the foregoing SR policy includes a first SID, and the foregoing first SID indicates the foregoing second connection.
  • the foregoing SR policy includes a second SID, and the foregoing second SID indicates the foregoing first connection.
  • the foregoing method further includes: the controller device assigning the first SID to the second connection, and assigning the second SID to the first connection.
  • the first SID indicates the second connection, and the second SID indicates the first connection; the controller device sends the first SID to the second network device, and sends the second SID to the first network device.
  • the controller device collects the endpoint IP address of each connection, allocates the corresponding SID for each connection, and sends the SID to the network device that needs the SID, so that the network device can pass the SID corresponding to the SID according to the SID carried in the packet during the traffic forwarding stage.
  • the connection sends packets, which helps to flexibly control the packet forwarding path through the SID.
  • a network device in a fourth aspect, has the function of implementing the first network device in the first aspect or any optional mode of the first aspect, and the network device includes at least one unit, at least one unit is used to implement the first aspect or any of the first aspects
  • An optional method is provided.
  • the network device has the function of realizing the second aspect or the second network device in any optional mode of the second aspect, and the network device includes at least one unit, at least one unit is used to realize the second aspect or the second The method provided by any optional mode of the aspect.
  • the units in the network device are implemented by software, and the units in the network device are program modules. In some other embodiments, the units in the network device are implemented by hardware or firmware. For specific details of the network device provided in the fourth aspect, refer to the first aspect or any optional manner of the first aspect or the second aspect or any optional manner of the second aspect, and details are not repeated here.
  • a controller device is provided, and the controller device has a function of realizing the above-mentioned third aspect or any optional manner of the third aspect.
  • the controller device includes at least one unit, and the at least one unit is configured to implement the method provided in the third aspect or any optional manner of the third aspect.
  • the units in the controller device are implemented by software, and the units in the controller device are program modules. In some other embodiments, the units in the controller device are implemented by hardware or firmware.
  • a network device in a sixth aspect, includes: a processor, the processor is coupled to a memory, and at least one computer program instruction is stored in the memory, and the at least one computer program instruction is executed by the processor The device is loaded and executed, so that the network device implements the method provided by the first aspect or any optional method of the first aspect or the second aspect or any optional method provided by the second aspect, and the method provided by the sixth aspect
  • the network device implements the method provided by the first aspect or any optional method of the first aspect or the second aspect or any optional method provided by the second aspect, and the method provided by the sixth aspect
  • a controller device in a seventh aspect, includes: a processor, the processor is coupled to a memory, and at least one computer program instruction is stored in the memory, and the at least one computer program instruction is controlled by The processor is loaded and executed, so that the controller device implements the method provided in the above third aspect or any optional manner of the third aspect.
  • the controller device includes: a processor, the processor is coupled to a memory, and at least one computer program instruction is stored in the memory, and the at least one computer program instruction is controlled by The processor is loaded and executed, so that the controller device implements the method provided in the above third aspect or any optional manner of the third aspect.
  • a computer-readable storage medium is provided, and at least one instruction is stored in the storage medium.
  • the instruction is run on a computer, the computer executes the first aspect or any one of the optional modes or methods of the first aspect.
  • a computer-readable storage medium at least one instruction is stored in the storage medium, and when the instruction is run on the computer, the computer executes the above-mentioned third aspect or any optional method of the third aspect. provided method.
  • a computer program product includes one or more computer program instructions, and when the computer program instructions are loaded and executed by a computer, the computer executes the above-mentioned first aspect or the first aspect.
  • the method provided in any one of the optional modes of the first aspect or the second aspect or any of the optional modes of the second aspect.
  • a computer program product includes one or more computer program instructions, and when the computer program instructions are loaded and executed by a computer, the computer executes the above-mentioned third aspect or The method provided in any optional manner of the third aspect.
  • a chip including a memory and a processor, the memory is used to store computer instructions, and the processor is used to call and execute the computer instructions from the memory to perform any one of the first aspect or the first aspect An optional mode or the second aspect or a method in any of the optional modes of the second aspect.
  • a chip including a memory and a processor, the memory is used to store computer instructions, and the processor is used to call and run the computer instructions from the memory to perform any one of the third aspect or the third aspect The method provided by the optional.
  • a fourteenth aspect provides a network system, the network system includes the network device described in the third aspect above and the controller device described in the fourth aspect above; or, the network system includes the network device described in the fifth aspect above A network device and the controller device described in the sixth aspect above.
  • FIG. 1 is a schematic diagram of an SD-WAN system architecture provided by an embodiment of the present application
  • FIG. 2 is a schematic diagram of an SD-WAN system architecture applied in an enterprise network provided by an embodiment of the present application
  • FIG. 3 is a schematic diagram of an SD-WAN system architecture applied in an operator POP network provided by an embodiment of the present application
  • FIG. 4 is a flow chart of a message processing method provided by an embodiment of the present application.
  • FIG. 5 is a schematic diagram of a message format provided by an embodiment of the present application.
  • FIG. 6 is a flow chart of a path determination method provided in an embodiment of the present application.
  • FIG. 7 is a schematic diagram of calculating an SR path in an overlay network provided by an embodiment of the present application.
  • FIG. 8 is a schematic diagram of establishing a TVC provided by an embodiment of the present application.
  • FIG. 9 is a schematic diagram of topology collection and reporting provided by an embodiment of the present application.
  • FIG. 10 is a schematic diagram of an SR policy issued by a controller device provided in an embodiment of the present application.
  • FIG. 11 is a schematic diagram of an SD-WAN system architecture provided by an embodiment of the present application.
  • Fig. 12 is a schematic diagram of service diversion into SD-WAN SRv6 tunnel and forwarding provided by the embodiment of the present application;
  • Fig. 13 is a schematic diagram of service diversion into SD-WAN SRv4 tunnel and forwarding provided by the embodiment of the present application;
  • Fig. 14 is a schematic diagram of a SD-WAN SRv6 and SRv4 hybrid tunnel forwarding method provided by the embodiment of the present application;
  • FIG. 15 is a schematic diagram of a method for forwarding L3 VPNv6 traffic through an SD-WAN SR tunnel provided by an embodiment of the present application;
  • FIG. 16 is a schematic diagram of a method for forwarding L2 VPN traffic through an SD-WAN SR tunnel provided by an embodiment of the present application
  • Fig. 17 is a schematic diagram of implementing multi-domain forwarding through SD-WAN SR provided by the embodiment of the present application.
  • FIG. 18 is a schematic structural diagram of a network device provided by an embodiment of the present application.
  • Fig. 19 is a schematic structural diagram of a controller device provided by an embodiment of the present application.
  • FIG. 20 is a schematic structural diagram of a network device or a controller device provided in an embodiment of the present application.
  • Fig. 21 is a schematic structural diagram of a network device or a controller device provided by an embodiment of the present application.
  • TVC is a logical virtual connection. TVCs typically span one or more transport networks.
  • connection in this embodiment of the present application may be replaced by a TVC, tunnel, path, virtual connection or wide area network (wide area network, WAN) link.
  • a connection refers to a connection between different sites, and the connection passes through one or more network devices in an underlay transmission network between the sites.
  • the endpoint Internet protocol (internet protocol, IP) address of the connection refers to the IP address of the WAN interface.
  • the connection is a one-way connection, and the connection has directionality.
  • the connection from network device a to network device b and the connection from network device b to network device a are not the same connection.
  • the connection from network device a to network device b is indicated by a segment ID (segment ID, SID), and the connection from network device b to network device a is indicated by another SID. That is, the forward connection and the direction connection are indicated by two different SIDs.
  • the connections are connections without direction.
  • the connection from network device a to network device b and the connection from network device b to network device a are indicated by the same SID.
  • segment routing segment routing
  • SR is a protocol designed based on the concept of source routing to forward packets on the network. SR divides the network path into segments and assigns SIDs to these segments and forwarding nodes in the network. By arranging the segments and network nodes in an orderly manner, a segment list (segment list) can be obtained, and a forwarding path can be indicated through the segment list.
  • the SR encodes the segment list representing the forwarding path in the header of the data message, and the segment list is transmitted along with the data message.
  • the receiving end receives the data message, it analyzes the segment list. If the active SID of the segment list is the SID of the node, it executes the operation corresponding to the SID on the data message; if the active SID is not the SID of the node, then The receiving end forwards the data message to the next node using a conventional routing forwarding method.
  • SRv6 is a method for forwarding IPv6 packets on the network based on the concept of source routing.
  • SR based on the IPv6 forwarding plane inserts a routing extension header (segment routing header, SRH) into the IPv6 message, pushes an explicit IPv6 address stack into the SRH, and continuously updates through the intermediate nodes
  • the operation of destination address and offset address stack is used to complete hop-by-hop forwarding.
  • the SRv6 technology adopts the existing IPv6 forwarding technology and implements network programmability through flexible IPv6 extension headers.
  • SRv6 defines some IPv6 addresses as instantiated SIDs. Each SID has its own explicit role and function. Through different SID operations, simplified virtual private network (virtual private network, VPN) and flexible path planning are realized.
  • the WAN interface is also called the transport network port (TNP).
  • TNP transport network port
  • the IP address of the WAN interface is different from the IP address of the SRv6 SID.
  • the main difference between these two IP addresses is that the SRv6 SID is an address in the local locator address pool of the network device, while the IP address of the WAN interface is an address assigned by the operator of the underlay network.
  • the network device For the IP address of SRv6 SID, the network device needs to run the IPv6 internal gateway protocol (internal gateway protocol, IGP) routing protocol with the device in the underlay network.
  • IGP IP gateway protocol
  • Network devices advertise locator routes to devices in the underlay network through the IPv6 IGP routing protocol, so that devices in the underlay network can perceive IP addresses such as SIDs, so that the reachability of IP addresses such as SRv6 SIDs can be guaranteed during the traffic forwarding phase.
  • IPv6 IGP routing protocol For the IP address of the WAN interface, the underlay network operator guarantees the routing reachability of the IP address of the WAN interface, and the network device does not need to advertise additional routes through the IPv6 IGP routing protocol, thus getting rid of the routing protocol for the underlay network dependency.
  • SD-WAN Software-defined wide area network
  • SDN software-defined networking
  • the SD-WAN achieves the independence of the SD-WAN network and the underlay transmission network by establishing an end-to-end upper layer (overlay) tunnel between the edge devices of the two sites.
  • the underlay network link can be a multi-protocol label Switching (multi-protocol label switching, MPLS) leased line, can also be the public Internet (Internet) or long term evolution (long term evolution, LTE), etc.
  • SD-WAN usually uses application identification technologies such as deep packet inspection (DPI) to identify enterprise traffic, and then performs classification statistics, quality inspection, and path control based on application latitude.
  • DPI deep packet inspection
  • high-value application traffic is preferentially designated to be transmitted on high-quality but high-cost paths such as MPLS
  • low-value application traffic is designated to be transmitted on low-quality but low-cost paths such as the Internet.
  • centralized network monitoring and visualization Through centralized network monitoring and visualization, centralized management is realized, and the efficiency of WAN end-to-end management and operation and maintenance is improved.
  • IGP refers to the routing protocol running inside an AS.
  • the IGP protocol is, for example, open shortest path first (open shortest path first, OSPF), intermediate system-to-intermediate system (intermediate system-to-intermediate system, IS-IS), and the like.
  • FIG. 1 is a schematic diagram of a system architecture of an SD-WAN network provided by an embodiment of the present application.
  • the system architecture shown in Figure 1 is optionally provided as SD-WAN overlay SR architecture.
  • the system architecture shown in FIG. 1 includes a management plane 10 , an overlay network 20 and an underlay network 30 .
  • the management plane 10 includes a controller device 11 .
  • the management and control plane 10 further includes a route reflector (router reflector, RR) 12.
  • route reflector route reflector
  • the controller device 11 is the manager of the SD-WAN network.
  • the controller device 11 is used to manage the network device 201, the network device 202, the network device 203, the network device 204, and the RR 12.
  • the controller device 11 is also used for SD-WAN network service arrangement and configuration, SR path arrangement and calculation, etc. .
  • the controller device 11 is, for example, a server, a host, a terminal, a network device, and the like.
  • RR 12 is a control component of the SD-WAN network. RR 12 is responsible for collecting the network topology between network devices 201, 202, 203, and 204 in the SD-WAN network, and distributing user routes, filtering, and control. RR 12 is, for example, a server, a host, a terminal, a network device, and the like. In other embodiments, the SD-WAN network does not include the RR 12, and the functions of the RR 12 are all implemented by the controller device 11.
  • FIG. 1 takes the controller device 11 and the RR 12 as an example for illustration, that is, the controller device 11 and the RR 12 are realized by different physical devices having communication coupling with each other.
  • the controller device 11 and the RR 12 are co-located, that is, the controller device 11 and the RR 12 are integrated in the same physical device.
  • controller device 11 and one RR 12 in the network shown in FIG. 1 is only an example, and the number of controller devices 11 and RR 12 may be more. This embodiment does not limit the number of controller devices 11 and RR 12. Do limited.
  • the overlay network 20 includes a plurality of network devices.
  • the network device is the forwarding actuator of the SD-WAN service.
  • Network devices are used to collect physical network topology information, tunnel encapsulation, encryption, and policy routing for user traffic.
  • Network devices are, for example, routers, switches, firewalls, and the like.
  • the network devices in the overlay network 20 are edge devices, point of presence (point of presence, POP) or convergence devices. Multiple network devices in the overlay network 20 are respectively deployed in multiple sites. Different network devices in the overlay network 20 are connected through TVCs.
  • FIG. 1 takes the network device 201 , the network device 202 , the network device 203 or the network device 204 as an example for illustration.
  • Network device 201 is deployed at branch site 1.
  • the network device 202 is deployed at the aggregation site.
  • Network device 203 is deployed at branch site 2.
  • the network device 204 is deployed at the headquarters site.
  • Network device 201 and network device 202 are connected through TVC 212.
  • Network device 202 is connected to network device 204 through TVC 224.
  • Network device 204 is connected to network device 203 through TVC 243.
  • the scenario of deploying a network device in a site shown in FIG. 1 is only an example, and the number of network devices deployed in a site may be more, for example, dozens, hundreds or more network devices are deployed in a site. For network devices, this embodiment does not limit the number of network devices deployed in one site.
  • the situation that there are four network devices in the network shown in FIG. 1 is only an example, and the number of network devices may be more or less. For example, there are 3 network devices, and if there are tens or hundreds of network devices, or more, this embodiment does not limit the number of network devices.
  • Each device in Figure 1 is optionally an independent hardware device, or a cluster or distributed system containing multiple hardware devices, or is implemented based on cloud computing and network functions virtualization (network functions virtualization, NFV) technology Virtualization device.
  • Virtualization appliances include, without limitation, virtual machines or containers.
  • the underlay network 30 includes, but is not limited to, an operator's dedicated line, the Internet, or a private network built by an enterprise.
  • the underlay network 30 includes at least one network device 301 .
  • Each network device 301 in the underlay network 30 is respectively connected to each network device in the overlay network through physical links.
  • the system architecture provided in this embodiment of the present application is applied to a scenario where traffic needs to be controlled to pass through one or more designated sites.
  • the controller device is used to orchestrate SR paths of network devices including multiple sites.
  • the SR path programmed by the controller device is network device 201 in branch site 1—network device 202 in aggregation site—network device 204 in headquarters site—network device 203 in branch site 2.
  • the end points of the SR path include the network device 201 and the network device 203 .
  • the intermediate nodes that the SR path passes through include network device 202 and network device 204 .
  • the SR path includes TVC 212, TVC 224 and VC 243.
  • FIG. 1 The system architecture shown in FIG. 1 is applicable to many application scenarios, and two typical application scenarios are illustrated below with examples.
  • FIG. 2 is a schematic diagram of a scenario where the SD-WAN overlay SR architecture provided by the embodiment of the present application is applied to an enterprise network.
  • the enterprise realizes the interconnection and intercommunication of each branch site through the rented operator's dedicated line, or the Internet or 5G transmission network, to meet the business needs of enterprise networking, cloud access, and Internet access.
  • SR path 1 is branch site 1-aggregation site-headquarters site-cloud site 5 in the public cloud.
  • SR path 2 includes branch site 1-aggregation site-cloud site 5 in the public cloud.
  • FIG. 3 is a schematic diagram of the application of the SD-WAN overlay SR architecture provided by the embodiment of the present application in the SD-WAN POP networking scenario of the operator.
  • Operators or managed service providers can quickly and flexibly build a coverage network by deploying SD-WAN devices as POP gateways (gateway, GW) in different regions and using inter-cloud Internet and cloud dedicated line resources. National or even global SD-WAN backbone network.
  • the branch site of the enterprise is connected to the POP access point of the operator/MSP through the local Internet line, and when cross-regional service exchange is realized through the SD-WAN backbone network, there is a requirement for SR path arrangement through multiple POP nodes.
  • SD-WAN controller 590 arranges two SR paths, SR path 1 is customer A site 1-POP GW 502-POP GW 504-customer A headquarters, SR path 2 is customer A site 1-POP GW 502-POP GW 503-POP GW 504-customer A headquarters.
  • border gateway protocol link state border gateway protocol link-state, BGP LS
  • border gateway protocol border gateway protocol, BGP
  • SRv6 policy BGP SRv6 policy
  • BGP Ethernet VPN Ethernet VPN, EVPN
  • the BGP LS protocol is used to support the function of network topology collection and the function of traffic engineering (traffic engineering, TE) database (data base, DB) information collection.
  • traffic engineering traffic engineering, TE
  • DB data base
  • the BGP LS protocol acts between the controller device and the network device, and between network devices.
  • the BGP LS protocol also acts between the controller and RRs, and between RRs and network devices.
  • the BGP SRv6 policy protocol is used to support the function of delivering tunnel policies.
  • the BGP SRv6 policy protocol acts between the controller device and the network device, and between network devices.
  • the BGP SRv6 policy protocol also acts between the controller and RRs, and between RRs and network devices.
  • the BGP EVPN protocol is used to support the function of publishing SD-WAN TNP routes and the function of publishing VPN service routes.
  • the BGP EVPN protocol acts between network devices.
  • the BGP EVPN protocol also acts between the RRs and network devices.
  • Fig. 4 is a flow chart of a message processing method provided by an embodiment of the present application.
  • network device a is an intermediate node through which the SR path passes.
  • network device a is a head end on the SR path or an intermediate node that the SR path passes through.
  • network device c is the tail end of the SR path or an intermediate node through which the SR path passes.
  • connection ab is used to refer to the connection from network device a to network device b
  • connection bc is used to refer to the connection from network device b to network device c.
  • network device a in the method shown in FIG. 4 is network device 201 in FIG. 1
  • network device b in the method shown in FIG. 4 is network device 202 in FIG. 1
  • the network device c in the method is the network device 204 in FIG. 1; or, the network device a in the method shown in FIG. 4 is the network device 202 in FIG. 1, and the network device b in the method shown in FIG. 4 is the network device b in FIG.
  • the network device c in the method shown in FIG. 4 is the network device 203 in FIG. 1 .
  • the method shown in Fig. 4 is optionally applied to SD-WAN network.
  • a typical application scenario of the method shown in FIG. 4 is interconnection of branch sites in an enterprise network. Take the networking scenario shown in Figure 2 as an example, apply the method shown in Figure 4 to the scenario shown in Figure 2, and control the traffic of users at branch site 1 to access site 5 in the public cloud through SR path 1 , the network device a in the method shown in FIG. 4 is the edge device 401 in FIG. 2 , the network device b in the method shown in FIG. 4 is the edge device 406 in FIG. 2 , and the network device c in the method shown in FIG. 4 is Edge device 404 in FIG. 2, connection ab in the method shown in FIG. 4 is TVC 416 in FIG. 2, and connection bc in the method shown in FIG. 4 is TVC 464 in FIG. 2.
  • the network device a in the method shown in Figure 4 is the edge device 401 in Figure 2
  • the network in the method shown in Figure 4 Device b is the edge device 406 in Figure 2
  • the network device c in the method shown in Figure 4 is the edge device 405 in Figure 2
  • the connection ab in the method shown in Figure 4 is TVC 416 in Figure 2
  • shown in Figure 4 Connection bc in the shown method is TVC 465 among Fig. 2.
  • a typical application scenario of the method shown in Figure 4 is SD-WAN POP networking of operators. Take the networking scenario shown in Figure 3 as an example, apply the method shown in Figure 4 to the scenario shown in Figure 3, and control the traffic from Site 1 of customer A to access the corporate headquarters through SR path 1, as shown in Figure 4
  • the network device a in the shown method is the edge device 501 in the site 1 in Fig. 3, the network device b in the method shown in Fig. 4 is the POP GW 502 in Fig. 3, and the network device c in the method shown in Fig. 4 is POP GW 504 in Fig. 3, connection ab in the method shown in Fig. 4 is TVC 512 in Fig. 3, and connection bc in the method shown in Fig.
  • the network device a in the method shown in Figure 4 is the edge device 501 in site 1 in Figure 3
  • the network in the method shown in Figure 4 Equipment b is POP GW 502 in Fig. 3
  • network device c in the method shown in Fig. 4 is POP GW 503 in Fig. 3
  • connection ab in the method shown in Fig. 4 is TVC 512 in Fig. 3
  • Connection bc in the shown method is TVC 523 among Fig. 3.
  • the method shown in FIG. 4 is optionally used in the scenario of processing multiple packets, such as the scenario of processing each packet in a data stream. To facilitate readers' understanding, the method shown in FIG. 4 is described by taking a processing flow of a first message as an example. For the processing manner of other packets, refer to the processing manner of the first packet.
  • Network device a sends a first packet to network device b.
  • the IP address of the first packet includes the IP address of the endpoint of the connection ab.
  • the endpoint IP address of connection ab includes an IP address belonging to network device a and an IP address belonging to network device b.
  • the source IP address of the first message is the IP address belonging to network device a among the endpoint IP addresses of connection ab.
  • the destination IP address of the first message is the IP address belonging to network device b among the endpoint IP addresses of the connection ab.
  • the first packet includes an original packet and an outer IP header.
  • the original packet refers to a data packet sent by the user equipment.
  • the outer IP header refers to the IP header encapsulated in the outer layer of the original packet.
  • the IP address of the endpoint of the connection ab is located in the outer IP header of the first packet. Specifically, among the endpoint IP addresses of the connection ab, the IP address belonging to the network device a is located in the source address field in the outer IP header of the first packet. Among the endpoint IP addresses of the connection ab, the IP address belonging to the network device b is located in the destination address field in the outer IP header of the first packet.
  • the IP address of the endpoint of the connection ab is the IP address of the WAN interface allocated by the underlay network operator.
  • a connection established through a WAN interface is also called a WAN link.
  • network device a has a WAN interface a.
  • Network device b has WAN interface b.
  • the above connection ab is a network connection established between WAN interface a of network device a and WAN interface b of network device b.
  • the above connection ab passes through one or more network devices in the underlay network 1 .
  • the IP address of the endpoint of the above connection ab includes the IP address of WAN interface a and the IP address of WAN interface b.
  • the IP address of WAN interface a and the IP address of WAN interface b are IP addresses assigned by the carrier of the underlay network 1.
  • the source IP address of the above first packet is the IP address of WAN interface a.
  • the destination IP address of the first packet is the IP address of WAN interface b.
  • the first packet includes SID bc.
  • SID bc is the SID used to indicate connection bc.
  • SID bc can act as an identifier for connection bc.
  • the SID bc is in the form of an MPLS label.
  • the SID bc is of the form SRv6 SID.
  • the form of SID bc is a combination of the identifier of the source site, the identifier of the destination site, the identifier of the source TNP, and the identifier of the destination TNP.
  • network device b is a network device in site b.
  • Network device c is a network device in site c.
  • connection bc is a network connection established between WAN interface b of network device b and WAN interface c of network device c
  • the form of SID bc is the identification of site b, the identification of site c, the identification of WAN interface b, and the identification of WAN interface c
  • SID in the form of SRv6 SID
  • the existing SRv6 mechanism can be reused.
  • SID in the form of short tags there are fewer bytes, less bandwidth consumption, and higher transmission efficiency.
  • the first packet includes a segment routing header.
  • SID bc is located in the segment routing header of the first packet.
  • the segment routing header of the first packet is an SRv6 header.
  • the SRv6 header of the first packet includes a segment list (segment list).
  • the SID bc is located in the segment list of the SRv6 header of the first packet.
  • the segment routing header of the first packet is an SR-MPLS header.
  • the SR-MPLS header of the first message includes a label stack, and the SID bc is located in the label stack of the SR-MPLS header of the first message.
  • SID bc is the top label of the label stack of the first message.
  • the first message further includes SID ab, where SID ab indicates connection ab.
  • Network device b receives the first packet from network device a.
  • the first packet reaches the network device in the underlay network 1 first.
  • the network device in the underlay network 1 queries the routing table according to the destination IP address of the first packet (that is, the IP address of WAN interface b of network device b), so as to obtain the outbound interface and next hop corresponding to the IP address of WAN interface b .
  • the network device in the underlay network 1 forwards the packet according to the outgoing interface and the next hop corresponding to the IP address of the WAN interface b, so that the first packet is forwarded to the WAN interface b of the network device b.
  • Network device b receives the first packet through WAN interface b.
  • the network device b processes the first packet to obtain the second packet.
  • Network device b obtains SID bc from the first packet.
  • Network device b determines connection bc based on SID bc.
  • Network device b obtains the endpoint IP address of connection bc.
  • Network device b uses the IP address belonging to network device b among the endpoint IP addresses connected to bc to update the source IP address of the first packet, and uses the IP address belonging to network device c among the endpoint IP addresses connected to bc to update the source IP address of the first packet The destination IP address, thereby updating the first packet to the second packet.
  • the IP address of the second packet includes the IP address of the endpoint of the connection bc, specifically, the IP address of the endpoint of the connection bc includes the IP address belonging to network device b and the IP address belonging to network device c.
  • the source IP address of the second message is the IP address belonging to network device b among the endpoint IP addresses of the connection bc.
  • the destination IP address of the second message is the IP address belonging to the network device c among the endpoint IP addresses of the connection bc.
  • the second packet includes the original packet and an outer IP header.
  • the original message in the second message is the same as the original message in the first message.
  • the IP address of the endpoint of the connection bc is located in the outer IP header of the second packet. Specifically, among the endpoint IP addresses of the connection bc, the IP address belonging to the network device b is located in the source address field in the outer IP header of the second packet. Among the endpoint IP addresses of the connection bc, the IP address belonging to the network device c is located in the destination address field in the outer IP header of the second packet.
  • the IP address of the endpoint of the connection bc is the IP address of the WAN interface assigned by the underlay network operator.
  • network device b has WAN interface b.
  • Network device c has a WAN interface c.
  • the above-mentioned connection bc is a network connection established between the WAN interface b of the network device b and the WAN interface c of the network device c.
  • the above connection bc passes through one or more network devices in the underlay network 2 .
  • the IP address of the endpoint of the connection bc includes the IP address of the WAN interface b and the IP address of the WAN interface c.
  • the IP address of the WAN interface c and the IP address of the WAN interface b are IP addresses assigned by the operator of the underlay network 2 .
  • the source IP address of the second packet is the IP address of the WAN interface b.
  • the destination IP address of the second packet is the IP address of the WAN interface c.
  • the second packet includes the segment routing header, and the content of the segment routing header in the case where the second packet includes the segment routing header have multiple conditions.
  • the second message includes a segment routing header
  • the segment list of the segment routing header in the second message includes the SID of the downstream node of network device c, so that the downstream node of network device c continues to forward the message according to the SID.
  • the segment list of the segment routing header in the second message is the same as the segment list of the segment routing header in the first message.
  • network device b keeps the segment list content of the segment routing header unchanged, and updates the SL field of the segment routing header, so that the SID pointed to by the SL field in the message changes from SID bc to SID bc.
  • a SID, the next SID of SID bc is the SID of network device c.
  • the segment list of the segment routing header in the second message is different from the segment list of the segment routing header in the first message, and the segment list of the segment routing header in the second message does not include SID bc.
  • network device b performs a label switching operation during packet processing, and updates SID bc to another label.
  • the second packet does not include a segment routing header.
  • network device b is the penultimate hop node on the SR path
  • network device c is the tail node of the SR path
  • network device b adopts the penultimate hop pop-up feature in the process of processing packets, and pops up the Segment routing header.
  • the second packet further includes SID ab, where SID ab indicates the first connection.
  • network device c advertises the TNP route in advance.
  • the TNP route contains the IP address belonging to the network device c among the endpoint IP addresses of the connection bc.
  • Network device b receives the TNP route advertised by network device c, and network device b obtains the IP address of network device c from the TNP route.
  • network device c establishes a BGP neighbor with the RR, and network device c reports the TNP route to the RR based on the BGP protocol.
  • the RR reflects the TNP route reported by network device c, and sends the TNP route to network device b.
  • How to determine the value of the SID includes multiple implementation manners, and the following two implementation manners are used as examples to illustrate.
  • the controller device assigns SID ab to connection ab and SID bc to connection bc.
  • the controller device sends SID ab to network device a, and the controller device sends SID bc to network device b.
  • Network device a receives the SID ab sent by the controller device.
  • Network device b receives the SID bc sent by the controller device.
  • Implementation method 2 The network device allocates a SID for each connection established at the local end.
  • network device a assigns SID ab to connection ab.
  • Network device a sends SID ab to the controller device.
  • Network device b assigns SID bc to connection bc.
  • Network device b sends SID bc to controller device.
  • Network device b sends the second packet to network device c.
  • connection ab is a connection between different sites.
  • network device a is a network device in site a.
  • Network device b is a network device in site b.
  • Connection ab is the connection between site a and site b. Connection ab passes through the underlay network between site a and site b.
  • connection bc is a connection between different sites.
  • network device b is a network device in site b.
  • Network device c is a network device in site c.
  • Connection bc is the connection between site b and site c.
  • Connection bc passes through the underlay network between site b and site c.
  • the downstream node of network device c on the SR path includes network device d.
  • the WAN interface c of the network device c is connected to the WAN interface d of the network device d through a connection cd.
  • the above-mentioned first message and second message also include SID cd, and SID cd indicates connection cd.
  • the network device serving as an intermediate node on the SR path updates the source IP address of the message according to the IP address of the connected endpoint IP address, and updates the source IP address of the message according to the connected endpoint IP address.
  • the destination IP address of the update message belonging to the remote IP address.
  • the endpoint IP address of the connection is usually the IP address of the WAN interface of the network device
  • this IP address is usually the IP address assigned by the operator of the transmission network, and the transmission network can naturally guarantee the routing reachability of the IP address , without requiring the underlay network device to run the IGP protocol supporting SR-MPLS or the IGP protocol supporting SRv6 to ensure the routing reachability of the destination IP address, so it can be independent of the routing protocol of the underlay transmission network.
  • the SID bc in the method shown in Figure 4 is an End.X-SD-WAN type SID.
  • End.X-SD-WAN is a new type of SID provided by the embodiment of this application.
  • the endpoint behavior corresponding to End.X-SD-WAN includes updating the source IP address of the message with the IP address belonging to the local end in the connected endpoint IP address, and updating the purpose of the message with the IP address belonging to the remote end in the connected endpoint IP address IP address.
  • the endpoint behavior corresponding to End.X-SD-WAN specifically includes: according to the active (active) SID in the message, query the TVC database and the TVC source IP address corresponding to the active SID (that is, in the IP address of the connected endpoint The IP address belonging to the local end), the TVC destination IP address corresponding to the active SID in the TVC database (that is, the IP address belonging to the peer end in the IP address of the connected endpoint), and the TVC outbound interface corresponding to the active SID in the TVC database.
  • the source address of the message is updated by using the TVC source IP address
  • the destination address of the message is updated by using the TVC destination IP address, so as to obtain an updated message.
  • the updated packet is sent through the outbound interface of the TVC corresponding to the active SID.
  • the active SID refers to the SID to be processed by the device.
  • the active SID refers to the SID in the segment list indicated by the SL field in the SRH in the message; for SR-MPLS, the active SID refers to the top label of the label stack in the message.
  • the pseudocode to implement End.X-SD-WAN is as follows.
  • S14 Use the SID indicated by the segment list remaining segment quantity (segments left, SL) field to search the TVC database.
  • the processing process of the first message by the network device b includes: the network device b performs the end point behavior corresponding to End.X-SD-WAN on the first message to obtain the second message.
  • network device b has created and saved a local SID table in advance.
  • the local SID table is used to store the correspondence between SID, SID type, and outgoing interface.
  • the SID type corresponding to SID bc in the local SID table is End.X-SD-WAN, and the outgoing interface corresponding to SID bc is WAN interface b.
  • network device b After network device b receives the first message, network device b queries the local SID table according to the SID bc in the first message, and finds that the SID type corresponding to SID bc is End.X-SD-WAN, and the outgoing interface is WAN interface b. Therefore, network device b will execute the endpoint behavior corresponding to End.X-SD-WAN, that is: network device b uses the endpoint IP address connected to bc to update the source address and destination address of the first message, and the second message will be obtained Send out through WAN interface b.
  • the network device establishes the correspondence between the End.X-SD-WAN type SID and the TVC and the correspondence between the TVC and the WAN interface.
  • the network device first queries the corresponding TVC according to the SID in the message, and then queries the corresponding WAN interface according to the TVC, and forwards the message through the WAN interface.
  • network device b first queries the corresponding outgoing interface according to SID bc to obtain TVC bc (ie connection bc), and then queries the corresponding outgoing interface of TVC bc to obtain WAN interface b.
  • SID ab is the SID of the above-mentioned End.X-SD-WAN type.
  • the specific process for network device a to send the first packet includes: network device a receives the original packet from the user equipment. Network device a queries the routing table according to the destination IP address of the original packet. Network device a finds that the destination IP address of the original packet corresponds to the SR policy.
  • the segment list (segment list) in the SR policy includes the SID ab corresponding to the connection ab and the SID bc corresponding to the connection bc.
  • SID ab is the first SID in the segment list.
  • Network device a queries the local SID table according to SID ab, and determines that the connection corresponding to SID ab is connection ab, the outgoing interface corresponding to SID ab is WAN interface a, and the endpoint behavior corresponding to SID ab includes: use the endpoint IP address of the connection that belongs to this
  • the source IP address of the message is updated with the IP address of the end point
  • the destination IP address of the message is updated with the IP address of the peer end in the IP address of the connected end point.
  • Network device a adds an outer layer IP header and SRH to the original packet according to the endpoint behavior corresponding to SID ab to obtain the first packet.
  • the source IP address of the outer IP header of the first message is the IP address belonging to network device a among the IP addresses of the connected endpoints, and the destination IP address of the outer layer IP header is the IP address belonging to network device b among the connected endpoint IP addresses .
  • SRH contains SID bc.
  • Network device a sends the first packet through WAN interface a.
  • the edge device by providing the above End.X-SD-WAN type SID, it supports forwarding traffic based on the SR path containing multiple TVCs, and encapsulates the message according to the IP address of the TVC's endpoint (without using the SID), so as to realize the decoupling of the underlay network overlay SR tunneling technology.
  • the End.X function in the existing SRv6 technology is to obtain the next-hop SID in the middle segment list of the SRH as the destination IP of the IPv6 message, and send the message with the destination IP as the SID from the specified link.
  • the edge device needs to connect to the IGP protocol with the intermediate transmission network device.
  • the edge device needs to advertise the Locator prefix route corresponding to the SID to all devices in the transmission network. Otherwise, the internal device in the transmission network cannot find the route according to the destination IP address of the packet. Therefore, the packet cannot be forwarded to the edge device corresponding to the SID.
  • the function of End.X-SD-WAN includes searching the TVC database according to the next-hop SID in the SRH mid-segment list, updating the IPv6 message according to the source IP address of TVC in the TVC database and the destination IP address of TVC source IP address and destination IP address, and then send the updated message through the physical link corresponding to the TVC.
  • the TVC’s source IP address and TVC’s destination IP address are the IP addresses of the WAN interface on the edge device.
  • the IP address of the WAN interface is often allocated by the intermediate transmission network. Naturally, there is a route on the transmission network that can be forwarded, so it is encapsulated in this way. SR packets do not have problems such as route lookup and URPF check failure on the intermediate transmission network.
  • the following describes a specific implementation method in a scenario where the underlay network is an IPv6 network.
  • the implementation described below can be provided as an SD-WAN SRv6 tunneling technology.
  • the IP address of the connection endpoint added by the network device to the packet is an IPv6 address.
  • the outer IP header of the packet is an IPv6 header.
  • the source IP address and destination IP address in the IPv6 header are IPv6 addresses.
  • both network device a and network device b are network devices supporting IPv6.
  • the IP address of the endpoint connecting ab in the first packet is an IPv6 address.
  • the first packet includes the outer IPv6 header, the SRH and the original packet.
  • the IP address of the endpoint of connection ab is located in the outer IPv6 header of the first packet.
  • the IPv6 address belonging to the network device a is located in the source address field in the outer IPv6 header of the first packet.
  • the IPv6 address belonging to network device b among the endpoint IP addresses of connection ab is located in the destination address field in the outer IPv6 header of the first packet.
  • the first packet includes the SRH.
  • SID bc is located in the SRH of the first packet.
  • both network device b and network device c are network devices supporting IPv6.
  • the IP address of the endpoint connecting bc in the second message is an IPv6 address.
  • the second packet includes the outer IPv6 header and the original packet.
  • the IP address of the endpoint of the connection bc is located in the outer IPv6 header of the second packet.
  • the IPv6 address belonging to the network device b is located in the source address field in the outer IPv6 header of the second packet.
  • the IPv6 address belonging to the network device c among the endpoint IP addresses of the connection bc is located in the destination address field in the outer IPv6 header of the second packet.
  • the following describes specific implementation methods in a scenario where the underlay network is an IPv4 network.
  • the implementation described below can be provided as an SD-WAN SRv4 tunneling technology.
  • the IP address of the connection endpoint added by the network device to the message is an IPv4 address.
  • the outer IP header of the packet is an IPv4 header.
  • the source IP address and destination IP address in the IPv4 header are IPv4 addresses.
  • the message includes the protocol type corresponding to the SRH, and the protocol type corresponding to the SRH is located in the outer layer of the SRH in the message.
  • the specific carrying position of the protocol type corresponding to the SRH includes multiple implementation manners, and the following three implementation manners are used for illustration.
  • Implementation method 1 The network device encapsulates a generic routing encapsulation (GRE) header between the outer layer IPv4 header and the SRH.
  • the GRE header contains the protocol type corresponding to SRH.
  • the protocol type corresponding to the SRH is located in the payload protocol (payload protocol) field in the GRE header.
  • Figure 5 shows a schematic diagram of SD-WAN SRv4 tunnel packet encapsulation format implemented through GRE. As shown in Figure 5, the packet includes an outer IP header, a GRE header, an SRH, and an original packet.
  • Implementation method 2 The network device encapsulates a virtual extended local area network (virtual extensible local area network, VXLAN) header between the outer layer IPv4 header and the SRH.
  • VXLAN virtual extensible local area network
  • the VXLAN header contains the protocol type corresponding to the SRH.
  • the protocol type corresponding to the SRH is located in the next protocol (next protocol) field in the VXLAN header.
  • Implementation mode 3 The network device carries the protocol type corresponding to the SRH in the IPv4 header of the outer layer.
  • both network device a and network device b are network devices supporting IPv4.
  • the IP address of the endpoint connecting ab in the first packet is an IPv4 address.
  • the first packet includes an outer IPv4 header, an SRH, and an original packet.
  • the IP address of the endpoint of the connection ab is located in the outer IPv4 header of the first packet.
  • the IPv4 address belonging to the network device a is located in the source address field in the outer IPv4 header of the first packet.
  • the IPv4 address belonging to network device b among the endpoint IP addresses of connection ab is located in the destination address field in the outer IPv4 header of the first packet.
  • the first packet includes the SRH.
  • SID bc is located in the SRH of the first packet.
  • the first message includes the protocol type corresponding to the SRH.
  • the first packet includes a GRE header.
  • the GRE header of the first packet is located between the outer layer IPv4 header and the SRH.
  • the protocol type corresponding to the SRH is located in the GRE header of the first packet.
  • the first packet includes a VXLAN header.
  • the VXLAN header of the first packet is located between the outer IPv4 header and the SRH, and the protocol type corresponding to the SRH is located in the VXLAN header of the first packet.
  • the protocol type corresponding to the SRH is located in the IPv4 header of the first packet.
  • network device b and network device c are optionally both network devices supporting IPv4.
  • the IP address of the endpoint connecting bc in the second message is an IPv4 address.
  • the second packet includes the outer IPv4 header and the original packet.
  • the IP address of the endpoint of the connection bc is located in the outer IPv4 header of the second packet.
  • the IPv4 address belonging to network device b is located in the source address field in the outer IPv4 header of the second packet.
  • the IPv4 address belonging to the network device c among the endpoint IP addresses of the connection bc is located in the destination address field in the outer IPv4 header of the second message.
  • the underlay network includes an IPv6 network and an IPv4 network.
  • the implementation described below can be provided as a SD-WAN SRv6 and SRv4 hybrid tunneling technology.
  • the network device will convert the packet encapsulation format, update the outer IP header of the packet from the IPv4 header to the IPv6 header, or change the outer IP header of the packet from IPv6 headers are updated to IPv4 headers.
  • network device a is a device supporting an IPv4 network
  • network device b is A device that supports an IPv4 network and supports an IPv6 network
  • network device c is a device that supports an IPv6 network.
  • the IP address of the endpoint connecting ab in the first packet is an IPv4 address.
  • the IP address of the endpoint connecting bc in the second message is an IPv6 address.
  • the process of network device b processing the packet includes: network device b decapsulates the outer IPv4 header containing the IP address of the endpoint of connection ab from the first packet.
  • Network device b generates an outer IPv6 header containing the IP address of the endpoint of connection bc.
  • the network device b encapsulates the outer IPv6 header containing the IP address of the end point of the connection bc into the packet to obtain the second packet.
  • network device a is a device that supports an IPv6 network
  • network device b is a device that supports both an IPv4 network and an IPv6 network
  • Network device c is a device supporting an IPv4 network.
  • the IP address of the endpoint connecting ab in the first packet is an IPv6 address.
  • the IP address of the endpoint connecting bc in the second message is an IPv4 address.
  • the process of network device b processing the packet includes: network device b decapsulates the outer IPv6 header containing the IP address of the endpoint of connection ab from the first packet.
  • Network device b generates an outer IPv4 header containing the IP address of the endpoint of connection bc.
  • the network device b encapsulates the outer IPv4 header including the IP address of the end point of the connection bc into the packet to obtain the second packet.
  • the network device stores the correspondence between connections and encapsulation types.
  • the network device determines which packet header to encapsulate in the original packet according to the encapsulation type corresponding to the connection. For example, after network device b determines the connection corresponding to the SID, if the encapsulation type corresponding to the connection is SRv6, network device b encapsulates the IPv6 header and SRH into the first packet. If the encapsulation type corresponding to the connection is SRv4-GRE, network device b encapsulates the IPv4 header, the GRE header, and the SRH into the first packet. If the encapsulation type corresponding to the connection is SRv4-VXLAN, network device b encapsulates the IPv4 header, the VXLAN header, and the SRH into the first packet.
  • FIG. 4 provides a basic flow of the forwarding plane.
  • Some embodiments of the present application also provide a basic flow of the control plane, which will be described in detail below.
  • FIG. 6 is a flow chart of a method for determining a path provided by an embodiment of the present application. The method shown in FIG. 6 includes the following steps S702 to S704.
  • step S702 the controller device obtains IP addresses of endpoints of multiple connections.
  • the network device sends the IP address of the endpoint of the connection to the controller device, and the controller device receives the IP address of the endpoint of the connection sent by the network device, thereby obtaining multiple IP addresses of the endpoints of the connection.
  • Implementation A The network device serving as the source reports the IP address of the connected endpoint to the controller device.
  • the network device a sends the IP address of the endpoint of the connection ab to the controller device.
  • Network device b sends the endpoint IP address of connection bc to the controller device.
  • the controller device receives the endpoint IP address of the connection ab sent by the network device a, and receives the endpoint IP address of the connection bc sent by the network device b, thereby obtaining the endpoint IP address of the connection ab and the endpoint IP address of the connection bc.
  • Implementation B The network device serving as the destination reports the IP address of the connection endpoint to the controller device.
  • the network device b sends the IP address of the endpoint of the connection ab to the controller device.
  • the network device c sends the endpoint IP address of the connection bc to the controller device.
  • both the network device acting as the source end and the network device acting as the destination end report the IP address of the connection endpoint to the controller device, and the controller device selects an IP address from the connection endpoint IP addresses reported by the two network devices.
  • network device a sends the endpoint IP address of connection ab to the controller device
  • network device b sends the endpoint IP address of connection ab and the endpoint IP address of connection bc to the controller device.
  • the network device c sends the endpoint IP address of the connection bc to the controller device.
  • the controller device selects one of the two IP addresses of the endpoint IP address of the connection ab sent by the network device a and the endpoint IP address of the connection ab sent by the network device b as the endpoint IP address of the connection ab.
  • the controller device selects one of the two IP addresses of the endpoint IP address of the connection bc sent by the network device b and the endpoint IP address of the connection bc sent by the network device c as the endpoint IP address of the connection bc.
  • the network device also obtains the identification (site ID) of the site where it is located, and reports the identification of the site to the controller device. For example, network device a is deployed at site a, network device b is deployed at site b, network device c is deployed at site c, network device a sends the identifier of site a to the controller device, and network device b sends the identifier of site a to the controller device The identifier of station b, and the network device c sends the identifier of station c to the controller device.
  • site ID the identification of the site where it is located
  • the network device detects the on-off state of the connection, and the network device also reports the on-off state of the connection to the controller device.
  • the on-off state of the connection includes a connected (up) state and a closed (down) state.
  • the network device periodically sends a detection message to the peer end of the connection, and determines whether the connection is on or off according to whether a response message returned by the peer end is received within a predetermined time period.
  • the network device serving as the source reports the on-off state of the connection to the controller device.
  • the network device a sends the on-off state of the connection ab to the controller device.
  • the network device b sends the on-off state of the connection bc to the controller device.
  • the network device serving as the destination reports the on-off state of the connection to the controller device.
  • the network device b sends the on-off state of the connection ab to the controller device.
  • the network device c sends the on-off state of the connection bc to the controller device.
  • both the network device serving as the source end and the network device serving as the destination end report the on-off state of the connection to the controller device.
  • the network device detects service-level agreement (service-level agreement, SLA) information of the connection, and the network device reports the SLA information of the connection to the controller device.
  • SLA information of the connection includes but not limited to at least one of packet loss rate, delay, jitter, or bandwidth utilization.
  • the network device serving as the source reports the SLA information of the connection to the controller device.
  • network device a sends the SLA information of connection ab to the controller device.
  • network device b sends the SLA information of connection bc to the controller device.
  • the network device serving as the destination reports the SLA information of the connection to the controller device.
  • network device b sends SLA information of connection ab to the controller device.
  • the network device c sends the SLA information of the connection bc to the controller device.
  • both the network device serving as the source end and the network device serving as the destination end report the SLA information of the connection to the controller device.
  • the network device also reports the SID corresponding to the connection to the controller device. For example, in combination with the method shown in FIG. 4, the network device a sends the SID ab corresponding to the connection ab to the controller device. The network device b sends the SID bc corresponding to the connection bc to the controller device.
  • the network device when the network device has established multiple connections with multiple peers, the network device sends to the controller device the endpoint IP address of each connection in the multiple connections, the on-off status of each connection in the multiple connections Status, SLA information of each connection among multiple connections, and SID corresponding to each connection among multiple connections.
  • the network device reports various information such as the endpoint IP address of the connection, connection status, SID, and site identification to the controller device based on the BGP LS protocol.
  • various information such as the endpoint IP address of the connection, connection status, SID, and site identification.
  • the protocol-ID definition is extended, and a new protocol-ID is defined to support the reporting of various information such as the endpoint IP address of the connection, thereby supporting BGP SD-WAN TVC topology database.
  • the protocol identifier is, for example, a protocol number indicating the source of the topology information.
  • Table 1 shows the extended protocol identification, adding a new SD-WAN protocol identification, SD-WAN protocol identification indicates the network layer reachability information (network layer reachability information, NLRI) information in the message (that is, the endpoint of the connection IP address, connection status and other information) the source protocol is SD-WAN protocol.
  • the process of network device b reporting the IP address of the endpoint of the connection includes: network device b generates a BGP-LS packet, the BGP-LS packet includes the endpoint IP address of the connection bc and/or the endpoint IP address of the connection ab, and the BGP-LS
  • the message also includes the identification of the SD-WAN protocol; network device b sends the BGP-LS message to the controller device.
  • the controller device can identify the new topology data collected by the BGP LS through the identification of the protocol in the BGP LS message.
  • BGP LS node routing (node routing) is extended based on RFC 7752.
  • the BGP LS node route contains the identification of the SD-WAN protocol and the identification of the SD-WAN site (SD-WAN site ID).
  • SD-WAN site ID is used to identify the site corresponding to the network equipment in SD-WAN.
  • Other information in BGP LS node routing reuses existing standard definitions. Exemplarily, the content of the BGP LS node route of SD-WAN is shown in Table 2 below.
  • BGP LS link routing (link routing) is extended based on RFC 7752.
  • the BGP LS link route contains the identification of the SD-WAN protocol, the TVC status attribute, and the segment identification attribute.
  • the TVC status attribute is also called SD-WAN-TVC-status attribute, and the TVC status attribute is used to carry the tunnel status of SD-WAN TVC.
  • the segment identification attribute is also called SD-WAN-segment-id attribute, and the segment identification attribute is used to carry the SID of SD-WAN TVC.
  • Table 3 the content of the BGP LS link route of SD-WAN is shown in Table 3 below.
  • Step S703 the controller device determines the SR path according to the IP addresses of the endpoints of multiple connections.
  • nodes on the SR path include network device a, network device b, and network device c.
  • the connections on the SR path include connection ab and connection bc.
  • the controller device performs path calculation using a station as an object instead of performing path calculation using a single network device as an object.
  • the following is an introduction to the features related to path calculation with stations as objects.
  • the controller device specifically acquires an IP address of an endpoint of a connection between different sites among the multiple sites.
  • the controller device determines the SR path with the site as the path composition object according to the IP addresses of the endpoints of the multiple connections.
  • the endpoint in the SR policy sent by the controller device corresponds to the site.
  • the value of the endpoint in the SR policy may optionally be the identifier of the site, rather than the IP address of a specific device.
  • each network device in the same site sends the IP address of the endpoint of the established connection and the identifier of the site to the controller device respectively.
  • the site ID reported by each network device in the same site is the same. Endpoint IP addresses of connections reported by different network devices in the same site are optionally different.
  • the controller device regards multiple network devices in the same site as a node for path calculation.
  • the controller device selects a connection from connections established by different network devices in the same site to perform path calculation.
  • the network includes site 1 and site 2, site 1 includes network device a and network device b, and site 2 includes network device c and network device d.
  • the controller device determines that the network includes four connections according to the topology information reported by the network device.
  • the four connections are the connection from network device a to network device c, the connection from network device a to network device d, the connection from network device b to network device c, and the connection from network device b to network device d.
  • the controller device selects one of the four connections for orchestration according to the set constraints.
  • the constraint condition is, for example, the SLA requirement on the path.
  • SLA requirements include, but are not limited to, that the delay is less than the set duration, the packet loss rate is less than the set packet loss rate, the jitter is less than the set value, and the bandwidth utilization rate is greater than the set bandwidth utilization rate.
  • the user equipment acquires the route calculation intention set by the user, and the user equipment sends the route calculation intention to the controller device.
  • the controller device receives the route calculation intent sent by the user equipment.
  • the controller device performs route calculation according to the route calculation intention set by the user.
  • the route calculation intention includes source site, destination site and constraints.
  • the controller device selects multiple TVCs satisfying the path calculation intention from the TVC topology database, and forms the selected TVCs into an SR path.
  • Fig. 7 shows a schematic diagram of calculating an SR path in an overlay network.
  • the headquarters site includes edge2-1 and edge2-2.
  • Branch sites include edge1.
  • Aggregation sites include edge3.
  • TNP1 on edge1 establishes a TVC with TNP21 on edge2-1.
  • the SID corresponding to the TVC between edge1 and edge2-1 is SID 1021.
  • TNP1 on edge1 and TNP3 on edge3 establish a TVC.
  • the SID corresponding to the TVC between edge1 and edge3 is SID103.
  • TNP3 on edge3 establishes a TVC with TNP22 on edge2-2.
  • the SID corresponding to the TVC between edge3 and edge2-2 is SID 3022.
  • edge2-1, edge2-2, edge1, and edge3 respectively report the topology information of the TVC to the controller device.
  • the controller implements site-based policy orchestration according to the topology information of the TVC. Specifically, in the route calculation intention set by the user, the source site is the branch site, the destination site is the headquarters site, and the constraint condition is that the delay is less than the set duration or the packet loss rate is less than the set packet loss rate.
  • the controller device calculates the SR path from the branch site to the headquarters site according to the topology information of the TVC and the path calculation intent to obtain two SR paths.
  • the two SR paths calculated by the controller device are SR path (1) and SR path (2).
  • SR path (1) includes TVCs from edge1 to edge2-1.
  • the SR path (1) satisfies the constraint condition that the delay is less than the set duration.
  • SR path (2) includes a TVC from edge1 to edge3 and a TVC from edge3 to edge2-2.
  • the SR path (2) satisfies the constraint condition that the packet loss rate is less than the set packet loss rate.
  • the controller device generates SR policy 1 and SR policy 2 according to the path calculation result.
  • SR policy 1 contains a list of segments for SR path (1).
  • SR policy 2 contains the segment list of SR path (2.
  • the specific content of SR policy 1 is shown in Table 4 below, and the specific content of SR policy 2 is shown in Table 5 below.
  • the network device after the network device sends the connection status to the controller device, the network device also detects the connection status. If the state of a connection on the network device is updated, the network device sends the updated state of the connection to the controller device.
  • the controller device updates the topology data stored in the topology database according to the updated connection state reported by the network device, and recalculates the SR policy according to the updated topology data.
  • the state update of the connection includes but not limited to the update of the on-off state of the connection from the up state to the down state, the update of the on-off state of the connection from the down state to the up state, and the change of the SLA information of the connection (such as SLA drop or SLA rise) .
  • the network device detects the connectivity status of each TVC it establishes. If a physical network link failure causes a TVC status to be updated from up to down, the network device sends a BGP-LS packet to the controller device, and the BGP-LS packet indicates that the TVC is in the down state. After the controller device receives the BGP-LS message, the controller device updates the status of the TVC in the topology database to the down state, and invalidates the SR path containing the TVC or revokes the SR path containing the TVC, or recalculates a new one. SR path.
  • the network device detects the connectivity status or SLA of each TVC established by it, and reports to the controller device after the status of the TVC is updated, which helps the controller device to perceive the SR path in a timely manner.
  • the state of each TVC realizes end-to-end path state awareness.
  • the controller device can import the traffic to other SR paths by invalidating the SR path, revoking the SR path, or recalculating the SR path, so as to avoid traffic forwarding to the intermediate The case of being discarded.
  • Step S704 the controller device sends the SR policy to the network device a.
  • the controller device generates an SR policy (policy) according to the determined SR path.
  • the SR policy indicates the SR path.
  • SR policy includes color (color), endpoint (endpoint), one or more candidate paths (candidate Path), priority (preference), and segment list (segment list).
  • a segment list in an SR policy contains one or more SIDs. Each SID indicates a connection.
  • the SR policy includes SID ab corresponding to connection ab and SID bc corresponding to connection bc.
  • the SR policy is applied to SD-WAN, and the segment list in the SR policy indicates the path in the overlay network in SD-WAN, and the SR policy is also called SD-WAN policy.
  • the controller sends the SR policy based on the BGP SR policy (BGP SR policy) protocol.
  • BGP SR policy BGP SR policy
  • the controller device sends the SR policy to the network device a according to that the head end in the SR path is the network device a.
  • network device a After network device a receives the SR policy, network device a obtains a segment list from the SR policy, and uses the segment list in the SR policy to execute the method shown in FIG. 4 .
  • the network device is an edge device, and the connection between network devices is a TVC.
  • Fig. 8 is a schematic diagram of establishing a TVC. As shown in FIG. 8, the TVC establishment process includes step (1) to step (4).
  • the edge device transmits TNP routing information through the BGP SD-WAN protocol.
  • a dynamic TVC is established between edge devices.
  • edge1 at the branch site establishes a unidirectional tunnel table (TVC table, ie, an entry about connection) from the branch site to the headquarters site according to the pairing of the local TNP1 and the TNP2 at the headquarters site.
  • edge1 establishes a TVC table according to the local TNP1 paired with the aggregation site TNP3.
  • the headquarters site of the enterprise establishes two TVCs, namely, a TVC from the headquarters site to branch sites, and a TVC from the headquarters site to the aggregation site.
  • the aggregation site establishes two TVCs, the TVC from the aggregation site to the branch site, and the TVC from the aggregation site to the headquarters site.
  • Each edge device saves locally to form a distributed TVC database.
  • Step (2) The edge device automatically deploys the SLA detection protocol on the TVC.
  • the edge device detects the on-off status of the TVC and the SLA status of the TVC (packet loss, delay, and jitter).
  • the edge device regularly saves the on-off status of the TVC and the SLA information of the TVC to the TVC database.
  • the content of the TVC database on edge1 is shown in Table 6 below.
  • the content of the TVC database on edge2 is shown in Table 7 below.
  • the content of the TVC database on edge3 is shown in Table 8 below.
  • Step (3) The edge device dynamically assigns a network-wide unique SID to each TVC through BGP EVPN.
  • the SID can optionally have multiple forms, such as an MPLS-like label, or an SRv6 SID address, or a label format spliced in the form of source site identifier + source TNP ID + destination site identifier + destination TNP ID.
  • the SID is optionally assigned by the TVC's source node.
  • edge1 at the branch site allocates SID 102 to the TVC at the headquarters site
  • edge1 allocates SID 103 to the TVC at the aggregation site
  • edge2 at the enterprise headquarters site allocates SID 201 and SID to the two TVCs at the branch site and the aggregation site respectively 203.
  • Aggregation site edge3 assigns SID 301 and SID 302 to the two TVCs to the branch site and headquarters site respectively.
  • Step (4) The edge device sets the SID type of each SID to a custom End.X-SD-WAN, and saves the correspondence between the SID, SID type, and outgoing interface to the local SID table.
  • the content of the local SID table on edge1 is shown in Table 9 below.
  • the content of the local SID table on edge2 is shown in Table 10 below.
  • the content of the local SID table on edge3 is shown in Table 11 below.
  • FIG. 9 is a schematic diagram of topology collection and reporting provided by an embodiment of the present application.
  • the process of topology collection and reporting includes the following steps (1) to (2).
  • Step (1) Deploy the BGP LS protocol between the edge device and the RR.
  • the edge device implements protocol interoperability with BGP EVPN through BGP LS protocol extension.
  • the edge device collects TVC information from BGP EVPN and reports the TVC information to the RR.
  • TVC information includes, but is not limited to, TVC basic encapsulation information (such as IP address), SID, status, SLA, bandwidth utilization rate, and the like.
  • Step (2) The BGP LS protocol is also deployed between the RR and the controller device.
  • the RR reports TVC information to the controller device through the extension of the BGP LS protocol.
  • the controller device receives and saves the TVC information reported by the RR.
  • the controller device creates a TVC topology database according to the TVC information reported by the RR, so as to use the TVC topology database to calculate the global SR path.
  • the content of the TVC topology database created by the controller device is shown in Table 12 below.
  • FIG. 10 is a schematic diagram of a controller device delivering an SR policy provided in this embodiment.
  • edge1 is the head end of the SR path, and edge1 is an example of network device a.
  • the controller device uses the BGP SR policy to deliver the SD-WAN SR policy.
  • the content of the SR policy should be as compatible as possible with the original SRv6 policy.
  • the process of delivering the SR policy by the controller device specifically includes the following steps (1) to (2).
  • Step (1) Deploy the BGP SR policy protocol between the controller device and the RR.
  • the controller sends the SD-WAN SR policy to the RR through the extension of the BGP SR policy protocol.
  • the controller device delivers two SR policies as shown in Table 13 and Table 14 below.
  • Step (2) The BGP SR policy protocol is also deployed between the RR and the edge device.
  • the RR distributes the SD-WAN SR policy to the headend edge device through the extension of the BGP SR policy protocol.
  • FIG. 4 and FIG. 6 are illustrated below in conjunction with five specific examples.
  • the headend edge1 in the following examples 1 to 5 is the network device a in the methods shown in Figure 4 and Figure 6, and the intermediate node edge3 in the following examples 1 to 5 is the network device a in the methods shown in Figure 4 and Figure 6
  • the network device b, the tail edge edge2 in the following examples 1 to 5 is the network device c in the methods shown in FIG. 4 and FIG. 6 .
  • TVC1-3 in the following example 1 to example 5 is the connection ab in the method shown in Figure 4 and Figure 6, and TVC3-2 in the following example 1 to example 5 is the connection in the method shown in Figure 4 and Figure 6 bc.
  • SID 302 in the following example 1 to example 5 is SID bc in the method shown in Figure 4 and Figure 6, and SID 103 in the following example 1 to example 5 is the SID ab in the method shown in Figure 4 and Figure 6.
  • IP1 and IP3 in the following examples 1 to 5 are the endpoint IP addresses of connection ab in the methods shown in FIG. 4 and FIG. 6 .
  • IP3 and IP2 in the following examples 1 to 5 are the endpoint IP addresses of the connection bc in the methods shown in FIG. 4 and FIG. 6 .
  • Example 1 uses EVPNv4 as an example to describe the forwarding process of building SD-WAN SRv6 tunnels on the IPv6 transport network.
  • Figure 12 shows a schematic diagram of service diversion into SD-WAN SRv6 tunnel and forwarding in Example 1. As shown in FIG. 12 , Example 1 includes the following steps (1) to (5).
  • Step (1) The end edge2 publishes the private network route of the local user through BGP EVPN.
  • the RR receives the EVPN private network route advertised by the end edge2, and the RR reflects the EVPN private network route to the head end edge1.
  • EVPN private network routing includes routing prefix, VPN SID, color, and next hop information.
  • the route prefix in the EVPN private network route is, for example, 10.1.1.0/24.
  • the VPN SID in the EVPN private network route is, for example, 10000.
  • the color in the EVPN private network route is 20.
  • the next hop in the EVPN private network route is, for example, the site ID of the headquarters site.
  • Step (2) The controller device has issued different SD-WAN SRv6 policies to the headend edge1 in advance.
  • the head-end edge1 learns the EVPN private network route advertised by the tail-end edge2 from the RR through step (1).
  • the headend edge1 iterates to the SR policy named "Branch to HQ Low Packet Loss" according to the color and next hop carried in the EVPN private network route.
  • Step (3) When the headend edge1 receives the traffic sent from user A (user A's IPv4 address is 10.2.1.1) to the headquarters site user Z (user Z's IPv4 address is 10.1.1.1), the headend edge1 according to the data in the traffic Query the destination address of the message.
  • the headend edge1 obtains the segment list ⁇ 103,302> from the SR policy, and the VPN SID is 10000.
  • the headend edge1 adds the SRH label stack (10000, 302, 103) to the data packet, and the headend edge1 matches the local SID table according to the SID 103 at the top of the stack.
  • the headend edge1 finds that the endpoint behavior corresponding to SID 103 in the local SID table is End.X-SD-WAN and the outbound interface corresponding to SID 103 is TVC1-3. Therefore, edge1 at the head end obtains the information of TVC1-3, and adds a layer of SR tunnel encapsulation (that is, the outer IPv6 header and SRH) to the data packet according to the information of TVC1-3.
  • the information of TVC1-3 includes the interface IP address (IP1) corresponding to the source TNP1 of TVC1-3 and the interface address IP (IP3) of the destination TNP3 of TVC1-3.
  • IP1 interface IP address
  • IP3 interface address IP
  • the source address in the IPv6 header of the outer layer is IP1, and the destination address is IP3.
  • the headend edge1 pops up SID 103.
  • the packet after popping SID 103 carries the SRH label stack (10000,302).
  • the head end edge1 sends the message from the link corresponding to TNP1 to the intermediate node edge3.
  • the information of TVC1-3 on the headend edge1 comes from the TNP route advertised by the intermediate node edge3.
  • the intermediate node edge3 publishes the TNP route in advance, and the TNP route includes the IP address (IP3) of TNP3.
  • IP3 IP address
  • the headend edge1 receives the TNP route published by the intermediate node edge3, and obtains the IP address of TNP3 from the TNP route.
  • the headend edge1 saves the correspondence between the identifiers of TVC1-3, the IP address of TNP1 and the IP address of TNP3 in the TVC table.
  • the headend edge1 creates an entry in the TVC table, and the content of the entry includes ID: TVC1-3; destination site: aggregation site; IP address of the source TNP: IP1; IP address of the destination TNP: IP3.
  • the headend edge1 queries the IP address of the source TNP and the IP address of the destination TNP corresponding to the TVC table TVC1-3 according to TVC1-3, thereby obtaining IP1 and IP3.
  • Step (4) After the intermediate node edge3 receives the message sent by the headend edge1, the intermediate node edge3 obtains the stack top SID (ie SID 302) indicated by the SL field from the SRH header. The intermediate node edge3 queries the local SID table according to SID 302, and finds that the endpoint behavior corresponding to SID 302 in the local SID table is End.X-SD-WAN, and the sending tunnel corresponding to SID 302 is TVC3-2. The intermediate node edge3 simultaneously modifies the source IP of the message and the destination IP of the message according to the TVC3-2 encapsulation information. The intermediate node edge3 forwards the modified message to the tail end edge2 through the physical link corresponding to TVC3-2.
  • the stack top SID ie SID 302
  • the intermediate node edge3 queries the local SID table according to SID 302, and finds that the endpoint behavior corresponding to SID 302 in the local SID table is End.X-SD-WAN, and the sending tunnel corresponding to SID 302 is
  • Step (5) The end edge2 receives the message sent by the intermediate node edge3.
  • the tail edge2 searches the local SID table according to the remaining VPN SID10000 of the SRH in the message, and determines that the VPN SID10000 hits the End.DT4 SID.
  • the tail edge2 performs SR tunnel decapsulation processing on the packet, and removes the SRH in the packet and the outer IPv6 packet header.
  • the tail edge2 checks the private network route of the corresponding VPN instance according to the destination IP address (10.1.1.1) of the inner layer message and sends it to host Z. In this way, the end-to-end SR forwarding path control of A->edge1->edge3->edge2->Z is realized.
  • Example 1 is aimed at how to build SD-WAN SRv6 tunnels on the IPv6 underlay transmission network.
  • the underlay transmission network is an IPv4 network
  • SD-WAN SRv4 tunnel encapsulation includes various types (such as GRE/VXLAN, etc.).
  • GRE GRE/VXLAN, etc.
  • the following uses GRE as an example to describe a method of service introduction into SD-WAN SRv4 tunnel and forwarding. See Example 2 for details.
  • Example 2 is a GRE-based method for diverting services into SD-WAN SRv4 tunnels and forwarding provided by the embodiment of this application.
  • FIG. 13 shows a flowchart of Example 2. As shown in FIG. 13 , Example 2 includes steps (1) to (5).
  • Steps (1) and (2) of Example 2 can refer to Steps (1) and (2) of Example 1.
  • the edge device when the edge device generates TVC, the edge device defines TVC according to the TNP type is IPv4 GRE
  • the encapsulation type is SRv4-GRE.
  • the edge device defines the TVC encapsulation type as SRv4-VXLAN.
  • Step (3) When the headend edge1 receives the traffic sent from user A (10.2.1.1) to the headquarters site user Z (10.1.1.1), the headend edge1 matches the local SID table according to the SID 103 at the top of the stack, and finds the corresponding SID 103 The outgoing interface is TVC1-3.
  • the headend edge1 adds the GRE header and SRH to the data packet according to the TVC encapsulation type corresponding to TVC1-3 is SRv4-GRE, and sends the packet encapsulated with the GRE header and SRH to the intermediate node edge3 through the interface corresponding to TVC1-3.
  • the intermediate node edge3 identifies the SRH header according to the payload protocol field in the GRE, and then the intermediate node edge3 obtains the stack top SID 302 indicated by the SL field from the SRH.
  • the intermediate node edge3 checks the local SID table according to SID 302, finds that the endpoint behavior corresponding to SID 302 is End.X-SD-WAN and specifies the sending tunnel as TVC3-2.
  • the intermediate node edge3 encapsulates the SRv4-GRE tunnel header into the packet according to the TVC3-2 encapsulation information.
  • Step (5) The end edge2 receives the message, the end edge2 decapsulates the SRv4-GRE tunnel header, searches the local SID table according to the remaining VPN SID of the SRH, and hits the End.DT4 SID. Edge2 at the tail end removes the SRH and GRE packet headers. The tail edge2 checks the corresponding VPN instance private network route according to the inner packet IP (10.1.1.1) and sends it to host Z. In this way, the end-to-end SR forwarding path control of A->edge1->edge3->edge2->Z is realized.
  • Example 3 is a SD-WAN SRv6 and SRv4 hybrid tunnel forwarding method provided by this embodiment.
  • FIG. 14 shows a flowchart of Example 3.
  • Example 3 includes step (1) to step (5).
  • Step (1) to step (5) of Example 3 can refer to step (1) to step (5) of Example 1 and Example 2.
  • the difference is that in the step (3) of Example 3, the intermediate node edge3 will adopt the following implementation method (1) or implementation method (2) to convert the encapsulation format of the SRv6 tunnel and the SRv4 tunnel.
  • the intermediate node edge3 converts the encapsulation format from the SRv6 tunnel to the SRv4 tunnel. Specifically, the intermediate node edge3 receives the message sent by edge1, the intermediate node edge3 decapsulates the SRv6 tunnel header, and the intermediate node edge3 obtains the stack top SID (SID 302) indicated by the SL field from the SRH. The intermediate node edge3 checks the local SID table according to SID 302, and finds that the endpoint behavior corresponding to SID 302 is End.X-SD-WAN, and the sending tunnel corresponding to SID 302 is TVC3-2. The intermediate node edge3 encapsulates the SRv4-GRE tunnel header according to the TVC3-2 encapsulation information.
  • the intermediate node edge3 converts the encapsulation format from the SRv4 tunnel to the SRv6 tunnel. Specifically, if the intermediate node edge3 receives the message sent by edge2, the intermediate node edge3 decapsulates the SRv4-GRE tunnel header, and the intermediate node edge3 obtains the stack top SID (SID 301) indicated by the SL field from the SRH. The intermediate node edge3 checks the local SID table according to SID301, and finds that the endpoint behavior corresponding to SID 301 is End.X-SD-WAN, and the sending tunnel corresponding to SID 301 is TVC3-1. The intermediate node edge3 encapsulates the SRv6 tunnel header according to the TVC3-1 encapsulation information.
  • Examples 1 through 3 describe how to carry Layer 3 (L3) VPNv4 traffic over SD-WAN SR tunnels.
  • the embodiment of this application also supports other VPN services other than L3 VPNv4, such as L3VPNv6, Layer 2 VPN (L2VPN), etc., to be carried on SD-WAN SR tunnels.
  • L3VPNv6 Layer 3 VPNv6
  • L2VPN Layer 2 VPN
  • the following uses Example 4 to describe the implementation of carrying L3VPNv6 traffic on the SD-WAN SR tunnel, and uses Example 5 to describe the implementation of carrying L2VPN traffic on the SD-WAN SR tunnel.
  • Example 4 is a method for forwarding L3 VPNv6 traffic through an SD-WAN SR tunnel provided by the embodiment of this application.
  • FIG. 15 shows a schematic diagram of Example 4.
  • the private network routes of IPv6 users are transmitted through BGP EVPN, and the colors and next hops in the private network routes containing IPv6 users are used to select Iterate to the SD-WAN SR tunnel, so that IPv6L3VPN traffic can be forwarded on the SD-WAN SR tunnel.
  • the EVPN private network route advertised by edge2 is an IPv6 route.
  • the prefix carried by the EVPN private network route is an IPv6 prefix, for example, FC00:1:1::/64.
  • the main difference between the packet encapsulation format in the L3VPNv6 scenario and the packet encapsulation format in the L3VPNv4 scenario is that the IP header in the inner data packet is an IPv6 header.
  • the data packet sent by user A to edge1 is an IPv6 packet.
  • the IP header in the data packet sent by user A is an IPv6 header
  • the source address carried in the IP header in the data packet sent by user A is the IPv6 address of user A, for example, FC00:2:1::1.
  • the destination address carried in the IP header of the data packet sent by user A is the IPv6 address of user Z, for example, FC00:1:1::1.
  • Example 5 is a method for forwarding L2VPN traffic through an SD-WAN SR tunnel provided by the embodiment of this application.
  • FIG. 16 shows a schematic diagram of Example 5.
  • the Ethernet auto-discovery (Ethernet AD) route, MAC route advertisement (advertisement route) route, integration Multicast routing (inclusive multicast route) routing, Ethernet segment (ethernet segment, ES) routing, etc. use color and next hop to select and iterate to the SD-WAN SR tunnel, so as to realize L2VPN traffic carried on the SD-WAN SR tunnel forwarded.
  • the EVPN private network route advertised by edge2 is an EVPN MAC route.
  • the prefix carried by the EVPN private network route published by edge2 includes a MAC address, for example, user Z's MAC address (MAC2).
  • the main difference between the packet encapsulation format in the L2VPN scenario and the packet encapsulation format in the L3VPN scenario is that the inner layer data packets including the Ethernet header are encapsulated in the tunnel as a whole.
  • the SR tunnel technology provided in this embodiment only requires the underlay network to provide WAN link IP routing reachability, and does not require the underlay network device to run the IGP protocol supporting SR-MPLS or the IGP protocol supporting SRv6.
  • the underlay network and overlay network are decoupled, the protocol deployment is simple, and it can adapt to various transmission network types, such as supporting the establishment of overlay SR tunnels on IP public networks such as the Internet.
  • Fig. 17 shows a schematic diagram of forwarding SR messages across multiple domains in an SD-WAN network.
  • the intermediate node edge3 connects to edge1 through transmission network 1 and connects to edge2 through transmission network 2 .
  • the intermediate node edge3 receives the packet sent by edge1, and the source IP address of the packet is IP1 (the IP address of TNP1 on edge1).
  • the intermediate node edge3 keeps the source IP address of the packet unchanged, that is, the source IP address of the packet sent by the intermediate node edge3 to edge2 is still IP1.
  • the network device in transmission network 2 will fail to pass the URPF check because it cannot find the route to IP1, so the network device in transmission network 2 will discard the packet.
  • the intermediate node since the intermediate node will re-change the source IP address of the SR tunnel message according to each piece of TVC information, the problem of the URPF check of the cross-domain tunnel is solved. For example, as shown in Figure 17, the source IP address of the message received by the intermediate node edge3 is IP1, and the source IP address of the message sent by the intermediate node edge3 is updated to IP4 (the address of TNP4 on the intermediate node edge3).
  • the existing SRv6 tunnel technology can only establish a tunnel on the transmission network that supports IPv6 routing and forwarding, but the SD-WAN SR tunnel in this embodiment has nothing to do with the underlying underlay transmission network protocol, and can support the case where the underlay network is an IPv6 network , can also support the situation that the underlay network is an IPv4 network, and even support the establishment of end-to-end SR tunnels across IPv4 and IPv6 heterogeneous transmission networks.
  • the SD-WAN SR tunneling method provided in this embodiment only requires the relevant SD-WAN edge devices to support necessary protocols such as BGP EVPN, BGP LS, and BGP SR, and the underlay network as a whole is regarded as a black-box IP forwarding network. Devices in the network do not need to run additional IGP for SR extension protocols such as OSPFv3/ISISv6 to establish SR. Therefore, the method provided in this embodiment can be called an overlay SR method independent of the underlay transmission network protocol.
  • FIG. 18 is a schematic structural diagram of a network device 610 provided by an embodiment of the present application.
  • the network device 610 includes a receiving unit 611 , a processing unit 612 and a sending unit 613 .
  • the network device 610 shown in FIG. 18 is the network device 202 or the network device 204 in FIG. 1 .
  • the network device 610 shown in FIG. 18 is the edge device 406 in FIG. 2 .
  • the network device 610 shown in FIG. 18 is the POP GW 502 in FIG. 3 .
  • the network device 610 shown in FIG. 18 is network device b in the method flow shown in FIG. 4 .
  • the receiving unit 611 is configured to support the network device 610 to execute S602.
  • the processing unit 612 is configured to support the network device 610 to execute S603.
  • the sending unit 613 is configured to support the network device 610 to execute S604.
  • the network device 610 shown in FIG. 18 is edge3 in FIG. 7 .
  • the network device 610 shown in FIG. 18 is edge3 in FIG. 8 .
  • the network device 610 shown in FIG. 18 is edge3 in FIG. 9 .
  • the network device 610 shown in FIG. 18 is edge3 in FIG. 10 .
  • the network device 610 shown in FIG. 18 is edge3 in FIG. 11 .
  • the network device 610 shown in FIG. 18 is edge3 in FIG. 12 .
  • the network device 610 shown in FIG. 18 is edge3 in FIG. 13 .
  • the network device 610 shown in FIG. 18 is edge3 in FIG. 14 .
  • the network device 610 shown in FIG. 18 is edge3 in FIG. 15 .
  • the network device 610 shown in FIG. 18 is edge3 in FIG. 16 .
  • the device embodiment described in Figure 18 is only schematic.
  • the division of the above units is only a logical function division.
  • there may be other division methods for example, multiple units or components can be combined or integrated. to another system, or some features may be ignored, or not implemented.
  • Each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may physically exist separately, or two or more units may be integrated into one unit.
  • Each unit in the network device 610 is fully or partially implemented by software, hardware, firmware or any combination thereof.
  • the processing unit 612 is implemented by a software functional unit generated by at least one processor 801 in FIG. 20 after reading the program code stored in the memory 802 .
  • the processing unit 612 is implemented by a software function unit generated by the central processing unit 911 on the main control board 910 in FIG. 21 after reading the program code stored in the memory 912 .
  • the processing unit 612 is processed by a part of at least one processor 801 in FIG. 20 (for example, a multi-core processor One core or two cores in ), or the processing unit 612 is implemented by using a programmable device such as a field-programmable gate array (field-programmable gate array, FPGA) or a coprocessor.
  • the receiving unit 611 and the sending unit 613 are implemented by the network interface 803 in FIG. 20 .
  • the receiving unit 611 and the sending unit 613 are implemented by the physical interface card 933 in FIG. 21 .
  • FIG. 19 is a schematic structural diagram of a controller device 710 provided by an embodiment of the present application.
  • the controller device 710 includes an acquisition unit 711 , a processing unit 712 and a sending unit 713 .
  • the controller device 710 shown in FIG. 19 is the controller device 11 in FIG. 1 .
  • the controller device 710 shown in FIG. 19 is the SD-WAN controller 490 in FIG. 2 .
  • the controller device 710 shown in FIG. 19 is the SD-WAN controller 590 in FIG. 3 .
  • the controller device 710 shown in FIG. 19 is the controller device in the method flow shown in FIG. 6 .
  • the obtaining unit 711 is configured to support the controller device 710 to execute S702.
  • the processing unit 712 is configured to support the controller device 710 to execute S703.
  • the sending unit 713 is configured to support the controller device 710 to execute S704.
  • the controller device 710 shown in FIG. 19 is the SD-WAN controller in FIG. 7 .
  • the controller device 710 shown in FIG. 19 is the SD-WAN controller in FIG. 9 .
  • the controller device 710 shown in FIG. 19 is the SD-WAN controller in FIG. 10 .
  • the controller device 710 shown in FIG. 19 is the SD-WAN controller in FIG. 11 .
  • the device embodiment described in Figure 19 is only schematic.
  • the division of the above units is only a logical function division.
  • there may be other division methods for example, multiple units or components can be combined or integrated. to another system, or some features may be ignored, or not implemented.
  • Each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may physically exist separately, or two or more units may be integrated into one unit.
  • Each unit in the controller device 710 is fully or partially implemented by software, hardware, firmware or any combination thereof.
  • the processing unit 712 is implemented by a software functional unit generated by at least one processor 801 in FIG. 20 after reading the program code stored in the memory 802 .
  • the processing unit 712 is processed by a part of at least one processor 801 in FIG. One core or two cores in the device), or the processing unit 712 or a programmable device such as a field-programmable gate array (field-programmable gate array, FPGA) or a coprocessor is used to complete.
  • the acquiring unit 711 and the sending unit 713 are realized by the network interface 803 in FIG. 20 .
  • the acquiring unit 711 and the sending unit 713 are implemented by the physical interface card 933 in FIG. 21 .
  • the basic hardware structure of the network device and the controller device is illustrated as an example below.
  • FIG. 20 is a schematic structural diagram of a device 800 provided in an embodiment of the present application.
  • the device 800 shown in FIG. 20 may be provided as a network device or a controller device.
  • the device 800 includes at least one processor 801 , a memory 802 and at least one network interface 803 .
  • the device 800 shown in FIG. 20 is the network device 202 or the network device 204 or the controller device 11 in FIG. 1 .
  • the device 800 shown in FIG. 20 is the edge device 406 or the SD-WAN controller 490 in FIG. 2 .
  • the device 800 shown in FIG. 20 is the POP GW 502 or SD-WAN controller 590 in FIG. 3 .
  • the device 800 shown in FIG. 20 is network device b in the method flow shown in FIG. 4 .
  • the network interface 803 is used to support the device 800 to execute S602 and S604.
  • the processor 801 is configured to support the device 800 to execute S603.
  • the device 800 shown in FIG. 20 is an SD-WAN controller in the method flow shown in FIG. 6 .
  • the network interface 803 is used to support the device 800 to execute S702 and S704.
  • the processor 801 is configured to support the device 800 to execute S703.
  • the device 800 shown in FIG. 20 is the edge3 or SD-WAN controller in FIG. 7 .
  • the device 800 shown in FIG. 20 is edge3 in FIG. 8 .
  • the device 800 shown in FIG. 20 is the edge3 or SD-WAN controller in FIG. 9 .
  • the device 800 shown in FIG. 20 is the edge3 or SD-WAN controller in FIG. 10 .
  • the device 800 shown in FIG. 20 is the edge3 or SD-WAN controller in FIG. 11 .
  • the device 800 shown in FIG. 20 is edge3 in FIG. 12 .
  • the device 800 shown in FIG. 20 is edge3 in FIG. 13 .
  • the device 800 shown in FIG. 20 is edge3 in FIG. 14 .
  • the device 800 shown in FIG. 20 is edge3 in FIG. 15 .
  • the device 800 shown in FIG. 20 is edge3 in FIG. 16 .
  • the processor 801 is, for example, a general-purpose central processing unit (central processing unit, CPU), a network processor (network processor, NP), a graphics processing unit (graphics processing unit, GPU), a neural network processor (neural-network processing units, NPU) ), a data processing unit (data processing unit, DPU), a microprocessor, or one or more integrated circuits for implementing the solution of this application.
  • the processor 801 includes an application-specific integrated circuit (application-specific integrated circuit, ASIC), a programmable logic device (programmable logic device, PLD) or a combination thereof.
  • the PLD is, for example, a complex programmable logic device (complex programmable logic device, CPLD), a field-programmable gate array (field-programmable gate array, FPGA), a general array logic (generic array logic, GAL) or any combination thereof.
  • complex programmable logic device complex programmable logic device, CPLD
  • field-programmable gate array field-programmable gate array
  • GAL general array logic
  • the memory 802 is, for example, a read-only memory (read-only memory, ROM) or other types of static storage devices that can store static information and instructions, or a random access memory (random access memory, RAM) or a storage device that can store information and instructions.
  • Other types of dynamic storage devices such as electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc Storage (including Compact Disc, Laser Disc, Optical Disc, Digital Versatile Disc, Blu-ray Disc, etc.), magnetic disk storage medium, or other magnetic storage device, or is capable of carrying or storing desired program code in the form of instructions or data structures and capable of Any other medium accessed by a computer, but not limited to.
  • the memory 802 exists independently and is connected to the processor 801 through an internal connection 804 . Or, optionally, the memory 802 and the processor 801 are integrated together.
  • Network interface 803 uses any transceiver-like device for communicating with other devices or communication networks.
  • the network interface 803 includes, for example, at least one of a wired network interface or a wireless network interface.
  • the wired network interface is, for example, an Ethernet interface.
  • the Ethernet interface is, for example, an optical interface, an electrical interface or a combination thereof.
  • the wireless network interface is, for example, a wireless local area network (wireless local area networks, WLAN) interface, a cellular network interface or a combination thereof.
  • the processor 801 includes one or more CPUs, such as CPU0 and CPU1 as shown in FIG. 20 .
  • device 800 optionally includes multiple processors, such as processor 801 and processor 805 as shown in FIG. 20 .
  • processors are, for example, a single-core processor (single-CPU), or a multi-core processor (multi-CPU).
  • a processor herein alternatively refers to one or more devices, circuits, and/or processing cores for processing data such as computer program instructions.
  • device 800 also includes internal connections 804 .
  • the processor 801 , memory 802 and at least one network interface 803 are connected by an internal connection 804 .
  • Internal connections 804 include pathways that carry information between the components described above.
  • internal connection 804 is a single board or a bus.
  • internal connections 804 are divided into address bus, data bus, control bus, and the like.
  • device 800 also includes an input-output interface 806 .
  • the input and output interface 806 is connected to the internal connection 804 .
  • the processor 801 implements the methods in the foregoing embodiments by reading the program code 810 stored in the memory 802, or, the processor 801 implements the methods in the foregoing embodiments through internally stored program codes.
  • the processor 801 implements the method in the foregoing embodiment by reading the program code 810 stored in the memory 802
  • the memory 802 stores the program code for implementing the method provided in the embodiment of the present application.
  • processor 801 For more details of the processor 801 implementing the above functions, please refer to the descriptions in the foregoing method embodiments, which will not be repeated here.
  • FIG. 21 is a schematic structural diagram of a device 900 provided in an embodiment of the present application.
  • the device 900 shown in FIG. 21 may be provided as a network device or a controller device.
  • the device 900 includes: a main control board 910 and an interface board 930 .
  • the device 900 shown in FIG. 21 is the network device 202 or the network device 204 or the controller device 11 in FIG. 1 .
  • the device 900 shown in FIG. 21 is the edge device 406 or the SD-WAN controller 490 in FIG. 2 .
  • the device 900 shown in FIG. 21 is the POP GW 502 or SD-WAN controller 590 in FIG. 3 .
  • the device 900 shown in FIG. 21 is network device b in the method flow shown in FIG. 4 .
  • the physical interface card 933 on the interface board 930 is used to support the device 800 to execute S602 and S604.
  • the network processor 932 on the interface board 930 and the central processing unit 911 on the main control board 910 are used to support the device 800 to execute S603.
  • the device 900 shown in FIG. 21 is an SD-WAN controller in the method flow shown in FIG. 6 .
  • the physical interface card 933 on the interface board 930 executes S702 and S704 on the support device 800 .
  • the CPU 911 on the main control board 910 is used to support the device 800 to execute S703.
  • the device 900 shown in FIG. 21 is the edge3 or SD-WAN controller in FIG. 7 .
  • the device 900 shown in FIG. 21 is edge3 in FIG. 8 .
  • the device 900 shown in FIG. 21 is the edge3 or SD-WAN controller in FIG. 9 .
  • the device 900 shown in FIG. 21 is the edge3 or SD-WAN controller in FIG. 10 .
  • the device 900 shown in FIG. 21 is the edge3 or SD-WAN controller in FIG. 11 .
  • the device 900 shown in FIG. 21 is edge3 in FIG. 12 .
  • the device 900 shown in FIG. 21 is edge3 in FIG. 13 .
  • the device 900 shown in FIG. 21 is edge3 in FIG. 14 .
  • the device 900 shown in FIG. 21 is edge3 in FIG. 15 .
  • the device 900 shown in FIG. 21 is edge3 in FIG. 16 .
  • the main control board is also called a main processing unit (main processing unit, MPU) or a route processing card (route processor card). Equipment maintenance, protocol processing functions.
  • the main control board 910 includes: a CPU 911 and a memory 912 .
  • the interface board 930 is also called a line interface unit card (line processing unit, LPU), a line card (line card), or a service board.
  • the interface board 930 is used to provide various service interfaces and implement forwarding of data packets.
  • the service interface includes but is not limited to an Ethernet interface, a POS (packet over sONET/SDH) interface, etc., and the Ethernet interface is, for example, a flexible ethernet service interface (flexible ethernet clients, FlexE clients).
  • the interface board 930 includes: a central processing unit 931 , a network processor 932 , a forwarding entry storage 934 and a physical interface card (physical interface card, PIC) 933 .
  • the CPU 931 on the interface board 930 is used to control and manage the interface board 930 and communicate with the CPU 911 on the main control board 910 .
  • the network processor 932 is configured to implement message forwarding processing.
  • the form of the network processor 932 is, for example, a forwarding chip.
  • the network processor 932 is used to forward the received message based on the forwarding table stored in the forwarding table item memory 934, and if the destination address of the message is the address of the device 900, the message is sent to the CPU (such as If the destination address of the message is not the address of the device 900, the next hop and the outgoing interface corresponding to the destination address are found from the forwarding table according to the destination address, and the message is forwarded to the destination The outbound interface corresponding to the address.
  • the processing of the uplink message includes: processing of the inbound interface of the message, forwarding table lookup; downlink message processing: forwarding table lookup and so on.
  • the physical interface card 933 is used to realize the interconnection function of the physical layer.
  • the original traffic enters the interface board 930 through this, and the processed packets are sent out from the physical interface card 933 .
  • the physical interface card 933 is also called a daughter card, which can be installed on the interface board 930, and is responsible for converting the photoelectric signal into a message, checking the validity of the message and forwarding it to the network processor 932 for processing.
  • the central processing unit can also perform the functions of the network processor 932 , such as implementing software forwarding based on a general-purpose CPU, so that the network processor 932 is not required in the physical interface card 933 .
  • the device 900 includes multiple interface boards.
  • the device 900 further includes an interface board 940 , and the interface board 940 includes: a central processing unit 941 , a network processor 942 , a forwarding entry storage 944 and a physical interface card 943 .
  • the device 900 further includes a switching fabric unit 920 .
  • the SFU 920 is also called, for example, a switch fabric unit (SFU).
  • SFU switch fabric unit
  • the switching fabric board 920 is used to complete the data exchange between the interface boards.
  • the interface board 930 communicates with the interface board 940 through, for example, the switching fabric board 920 .
  • the main control board 910 is coupled to the interface board 930 .
  • the main control board 910, the interface board 930 and the interface board 940, and the switching fabric board 920 are connected to the system backplane through the system bus to realize intercommunication.
  • an inter-process communication protocol IPC
  • IPC inter-process communication
  • the device 900 includes a control plane and a forwarding plane.
  • the control plane includes a main control board 910 and a central processing unit 931.
  • the forwarding plane includes various components for performing forwarding, such as a forwarding entry storage 934, a physical interface card 933, and a network processor. 932.
  • the control plane executes router functions, generates forwarding tables, processes signaling and protocol packets, configures and maintains device status, and other functions.
  • the control plane sends the generated forwarding tables to the forwarding plane.
  • the network processor 932 The issued forwarding table looks up and forwards the packets received by the physical interface card 933 .
  • the forwarding table issued by the control plane is saved in the forwarding table item storage 934, for example.
  • the control plane and the forwarding plane are, for example, completely separated and not on the same device.
  • the operations on the interface board 940 are the same as those on the interface board 930 , and the operations on the interface board 940 will not be repeated for brevity.
  • the device 900 in this embodiment may correspond to the network device or controller device in each of the above method embodiments, and the main control board 910, interface board 930 and/or 940 in the device 900, for example, implement the network device in each of the above method embodiments Or the functions of the controller device and/or various steps implemented, for the sake of brevity, details are not repeated here.
  • main control boards there may be one or more main control boards, and when there are multiple main control boards, it includes, for example, an active main control board and a standby main control board.
  • the network device can have at least one SFU, through which the data exchange between multiple interface boards can be realized, and large-capacity data exchange and processing capabilities can be provided. Therefore, the data access and processing capabilities of network devices with a distributed architecture are greater than those with a centralized architecture.
  • the form of the network device can also be that there is only one board, that is, there is no switching fabric board, and the functions of the interface board and the main control board are integrated on this board.
  • the central processing unit and the main control board on the interface board The central processing unit on the board can be combined into one central processing unit on the board to perform the superimposed functions of the two.
  • the data exchange and processing capabilities of this form of equipment are low (for example, low-end switches or routers and other network equipment). Which architecture to use depends on the specific networking deployment scenario, and there is no limitation here.
  • the term “and/or” refers to and encompasses any and all possible combinations of one or more of the associated listed items.
  • the term “and/or” is an association relationship describing associated objects, which means that there may be three kinds of relationships, for example, A and/or B can mean: A exists alone, A and B exist simultaneously, and B exists independently. situation.
  • the character "/" in this application generally indicates that the contextual objects are an "or" relationship.
  • a reference to B means that A is the same as B or A is a simple variation of B.
  • first and second in the description and claims of the embodiments of the present application are used to distinguish different objects, not to describe a specific order of objects, nor can they be interpreted as indicating or implying relative importance sex.
  • first connection and the second connection are used to distinguish different connections, but not to describe a specific sequence of the connections, nor can it be understood that the first connection is more important than the second connection.
  • the above-mentioned embodiments may be fully or partially implemented by software, hardware, firmware or any combination thereof.
  • software When implemented using software, it may be implemented in whole or in part in the form of a computer program product.
  • the computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on the computer, all or part of the processes or functions described in accordance with the embodiments of the present application will be generated.
  • the computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable devices.
  • the computer instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website, computer, server or data center Transmission to another website site, computer, server, or data center by wired (eg, coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (eg, infrared, wireless, microwave, etc.).
  • the computer-readable storage medium may be any available medium that can be accessed by a computer, or a data storage device such as a server or a data center integrated with one or more available media.
  • the available medium may be a magnetic medium (for example, a floppy disk, a hard disk, or a magnetic tape), an optical medium (for example, DVD), or a semiconductor medium (for example, a Solid State Disk (SSD)).
  • SSD Solid State Disk

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请提供了一种报文处理方法、网络设备及系统，属于通信技术领域。本申请提供的方法中，中间节点通过根据连接的端点IP地址中属于本端的IP地址更新报文的源IP地址，并根据连接的端点IP地址中属于远端的IP地址更新报文的目的IP地址，从而在SR路径跨越多个不同路由域的underlay传输网络的场景下，避免由于源IP地址保持为头端的IP地址造成URPF检查不通过导致报文被丢弃，并且，转发路径的建立无需依赖于underlay传输网络的路由协议。

Description

报文处理方法、网络设备及系统
本申请要求于2021年09月23日提交的申请号为202111115406.0，发明名称为“报文处理方法、网络设备及系统”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域，特别涉及一种报文处理方法、网络设备及系统。
背景技术
段路由(segment routing，SR)是基于源路由理念而设计的在网络上转发报文的一种协议。SR将网络路径分成一个个段，并且为这些段和网络中的转发节点分配段标识(segment ID，SID)。通过对段和网络节点进行有序排列，得到段列表(segment list)，就可以通过段列表指示一条转发路径。
目前基于SR技术转发报文的基本流程为，当SR路径上头端设备接收到源主机发送的原始报文后，头端设备会将原始报文封装为SR报文，并向SR路径上下一跳节点发送SR报文。SR报文的源IP地址为头端的互联网协议(internet protocol，IP)地址。SR报文的目的IP地址为下一跳节点的SID。SR报文包括SR路径中每个节点的SID。SR路径经过的中间节点接收到SR报文后，中间节点会保持SR报文的源IP地址不变，并将SR报文的目的IP地址更新为下一跳节点的SID，再将SR报文转发至下一跳节点。当SR报文转发至尾端时，尾端将SR报文解封装为原始报文，将原始报文发送给目的主机。
如果SR路径要跨越多个不同路由域的underlay网络，可能由于单播反向路由查找(unicast reverse path forwarding，URPF)检查不通过导致报文被丢弃。
发明内容
本申请实施例提供了一种报文处理方法、网络设备及系统，能够避免由于URPF检查不通过导致报文被丢弃的问题。所述技术方案如下。
第一方面，提供了一种报文处理方法，该方法可选地由SR路径上充当中间节点的网络设备执行。以第一网络设备充当中间节点为例，该方法包括：第一网络设备接收来自第二网络设备的第一报文，所述第一报文的IP地址包括第一连接的端点IP地址，所述第一报文包括SID，所述SID指示第二连接，所述第一连接为从所述第二网络设备至所述第一网络设备的连接，所述第二连接为从所述第一网络设备至第三网络设备的连接；所述第一网络设备处理所述第一报文，以得到第二报文，所述第二报文的源IP地址为所述第二连接的端点IP地址中属于所述第一网络设备的IP地址，所述第二报文的目的IP地址为所述第二连接的端点IP地址中属于所述第三网络设备的IP地址；所述第一网络设备向所述第三网络设备发送所述第二报文。
在上述方法中，由于中间节点根据连接的端点IP地址中属于本端的IP地址更新报文的源IP地址，并根据连接的端点IP地址中属于远端的IP地址更新报文的目的IP地址，一方 面，在SR路径跨越多个不同路由域的下层(underlay)传输网络的场景下，避免由于源IP地址保持为头端的IP地址造成URPF检查不通过导致报文被丢弃。另一方面，由于连接的端点IP地址与SID这种IP地址不同，连接的端点IP地址通常是网络设备的WAN接口的IP地址，连接的端点IP地址通常是underlay传输网络的运营商分配的IP地址，underlay传输网络天然能够保证该IP地址的路由可达性，而不必要求underlay网络设备运行支持SR的IGP路由协议学习SID对应的网段路由来保证IP地址的路由可达性，因此转发路径的建立无需依赖于underlay传输网络的路由协议。
可选地，上述第一连接和/或第二连接是隧道虚拟连接(tunnel virtual connection，TVC)。TVC通常与物理链路不同，TVC是逻辑上的虚拟连接，一条TVC通常会经过一个或多个underlay传输网络。例如，上述第一连接经过了第一underlay网络，上述第二连接经过了第二underlay网络。
可选地，上述第一连接和/或第二连接的端点IP地址是underlay网络运营商分配的广域网WAN接口的IP地址。
由于WAN接口的IP地址是underlay网络运营商分配的，这种IP地址的路由可达性underlay网络运营商负责保证，网络设备无需通过路由协议向underlay网络中设备通告包含这种IP地址的路由，从而摆脱了对underlay网络的路由协议的依赖性，节省了通告路由带来的开销。
可选地，上述第一连接和/或第二连接的端点IP地址是公网IP地址。
可选地，上述第一连接和/或第二连接是不同站点(site)之间的连接。例如，上述第二网络设备部署在第一站点中，上述第一网络设备部署在第二站点中，上述第三网络设备部署在第三站点中。上述第一连接为从第一站点至第二站点的连接，上述第三连接为从第二站点至第三站点的连接。
通过上述实现方式，支持在多个站点之间建立转发路径，有助于更灵活的进行流量规划。
可选地，上述第一连接的端点IP地址为互联网协议第6版IPv6地址，上述第一报文包括段路由头SRH，上述SID位于上述第一报文的SRH中。上述第一报文包括IPv6头，IPv6头封装于原始报文的外层，第一连接的端点IP地址位于第一报文的IPv6头中。
可选地，上述第二连接的端点IP地址为IPv6地址。第二报文包括IPv6头，IPv6头封装于原始报文的外层，第二连接的端点IP地址位于第二报文的IPv6头中。
通过上述实现方式，由于连接的两个端点之间基于IPv6地址传输报文，并在报文中封装了SRH，从而有助于支持在IPv6传输网络上构建SD-WAN SR隧道。
可选地，上述第一连接的端点IP地址为互联网协议第4版IPv4地址，上述第一报文包括SRH，上述SID位于上述第一报文的SRH中。上述第一报文包括IPv4头，IPv4头封装于原始报文的外层，上述第一连接的端点IP地址为位于第一报文的IPv4头中。
可选地，上述第二连接的端点IP地址为IPv4地址。第二报文包括IPv4头，IPv4头封装于原始报文的外层，上述第二连接的端点IP地址为位于第二报文的IPv4头中。
通过上述实现方式，由于连接的两个端点之间基于IPv4地址传输报文，从而有助于支持在IPv4传输网络上构建SD-WAN SR隧道。
可选地，上述第一报文包括SRH对应的协议类型。
可选地，上述第一报文包括GRE头，该GRE头封装于SRH的外层，SRH对应的协议类 型位于上述第一报文的GRE头中。
可选地，上述第一报文包括VXLAN头，该VXLAN头封装于SRH的外层，SRH对应的协议类型位于上述第一报文的VXLAN头中。
可选地，SRH对应的协议类型位于上述第一报文的IPv4头中。
通过上述实现方式，由于报文中SRH之前包含SRH对应的协议类型，便于中间节点根据协议类型识别出SRH，进而根据SRH中的SID进行处理，降低了实现复杂度。
可选地，第一方面提供的方法还包括流量转发阶段之前上报端点的IP地址的过程。在一种可能的实现中，由充当源端的网络设备向控制器设备上报连接的端点IP地址。例如，第二网络设备向控制器设备发送第一连接的端点IP地址。第一网络设备向控制器设备发送上述第二连接的端点IP地址。在另一种可能的实现中，由充当目的端的网络设备向控制器设备上报连接的端点IP地址。例如，第一网络设备向控制器设备发送第一连接的端点IP地址。第三网络设备向控制器设备发送上述第二连接的端点IP地址。在另一种可能的实现中，充当源端的网络设备和充当目的端的网络设备均向控制器设备上报连接的端点IP地址，控制器设备从两个网络设备上报的连接的端点IP地址中选择一份IP地址。例如，第二网络设备向控制器设备发送第一连接的端点IP地址。所述第一网络设备向控制器设备发送所述第二连接的端点IP地址和所述第一连接的端点IP地址。第三网络设备向控制器设备发送上述第二连接的端点IP地址。控制器设备接收第二网络设备发送的第一连接的端点IP地址、第一网络设备发送的第一连接的端点IP地址之后，从两份第一连接的端点IP地址中选择一份第一连接的端点IP地址用于算路。控制器设备接收第一网络设备发送的第二连接的端点IP地址、第三网络设备发送的第二连接的端点IP地址之后，从两份第二连接的端点IP地址中选择一份第二连接的端点IP地址用于算路。
通过上述实现方式，支持控制器设备感知网络中每条连接的端点IP地址，从而辅助控制器设备编排出包含多条连接的SR路径，降低了控制器算路的难度。
可选地，上述上报连接的端点IP地址的过程包括：上述第一网络设备生成边界网关协议链路状态(border gateway protocol link-state，BGP LS)报文，上述BGP-LS报文包括上述第二连接的端点IP地址和/或上述第一连接的端点IP地址，上述BGP-LS报文还包括SD-WAN协议的标识；上述第一网络设备向上述控制器设备发送上述BGP-LS报文。
由于在BGP-LS中扩展出一种新的协议标识，使得控制器设备接收到BGP-LS报文时，能够通过该协议标识，识别出网络设备上报的数据属于SD-WAN的拓扑数据。
可选地，第一网络设备接收来自第二网络设备的第一报文之前，第一网络设备还获取第一网络设备所在的站点的标识，向控制器设备发送上述第一网络设备所在的站点的标识。
由于网络设备向控制器设备上报了其所在的站点的标识，便于控制器设备以站点为对象进行路径计算。
可选地，第一网络设备接收来自第二网络设备的第一报文之前，第一网络设备还检测第一连接和/或上述第二连接的通断状态，向控制器设备发送上述第一连接和/或上述第二连接的通断状态。在一种可能的实现中，第一网络设备周期性地向控制器设备发送上述第一连接和/或上述第二连接的通断状态。在一种可能的实现中，当第一连接的通断状态发生更新时，第一网络设备向控制器设备发送上述第一连接的通断状态。在一种可能的实现中，当第二连接的通断状态发生更新时，第一网络设备向控制器设备发送上述第二连接的通断状态。
由于网络设备向控制器设备上报了连接的通断状态，有助于控制器设备及时感知到SR路径中每条连接的状态，实现端到端路径状态感知。如果控制器发现某一条SR路径中某一段连接发生故障，控制器设备可通过失效SR路径、撤销SR路径或者重新计算SR路径等方式，将流量导入到其他SR路径上，从而避免流量转发到中间被丢弃的情况。
可选地，第一网络设备接收来自第二网络设备的第一报文之前，上述方法还包括：上述第一连接和/或上述第二连接的服务等级协议(service-level agreement，SLA)信息。SLA信息包括而不限于丢包率、时延、抖动或带宽利用率中至少一项。
由于网络设备向控制器设备上报了连接的SLA信息，有助于控制器设备及时感知到SR路径中每条连接的SLA，计算出SLA满足业务需求的路径。
可选地，控制器设备为第二连接分配SID。控制器设备向第一网络设备发送SID。第一网络设备接收来自控制器设备的SID。
通过由控制器设备为连接分配SID，保证连接的两个端点对于同一个连接使用同一个SID指示，防止SID冲突。
第二方面，提供了一种报文处理方法，该方法可选地由SR路径上充当头端的网络设备执行。以第二网络设备充当头端为例，该方法包括：第二网络设备接收原始报文；第二网络设备根据原始报文生成第一报文。第一报文的源IP地址为第一连接的端点IP地址中属于所述第二网络设备的IP地址。第一报文的目的IP地址为第一连接的端点IP地址中属于所述第一网络设备的IP地址。第一连接为从所述第二网络设备至所述第一网络设备的连接。第一报文包括第一SID。所述第一SID指示第二连接。所述第二连接为从所述第一网络设备至第三网络设备的连接；第二网络设备向第一网络设备发送第一报文。
可选地，上述第一连接和/或第二连接是TVC。上述第一连接和/或第二连接是不同站点之间的连接。
在上述方法中，由于头端将一条TVC的端点IP地址作为报文的IP地址，且在报文中携带了指示下一条TVC的SID，报文能通过端点IP地址路由转发至下一个站点，并通过SID指示中间节点将报文转发至下下一个站点，从而解决了SD-WAN场景中无法实现报文经过指定的多个站点的问题。
可选地，第二网络设备接收原始报文之前，第二网络设备接收控制器设备发送的SR策略。SR策略包括上述第一SID。第二网络设备从SR策略中获得第一SID。
可选地，上述SR策略还包括第二SID，上述第二SID指示上述第一连接。
可选地，第一报文包括封装于原始报文外层的IP头以及SRH。第一连接的端点IP地址位于第一报文的IP头中。第一SID位于第一报文的IP头中。
可选地，上述第一报文包括SRH对应的协议类型。
可选地，上述第一报文包括GRE头，该GRE头封装于SRH的外层，SRH对应的协议类型位于上述第一报文的GRE头中。
可选地，上述第一报文包括VXLAN头，该VXLAN头封装于SRH的外层，SRH对应的协议类型位于上述第一报文的VXLAN头中。
可选地，SRH对应的协议类型位于上述第一报文的IPv4头中。
第三方面，提供了一种路径确定方法，在该方法中，控制器设备获取多个连接的端点IP地址；上述控制器设备根据上述多个连接的端点IP地址，确定段路由SR路径，上述SR路径包括上述多个连接中第一连接和第二连接，上述第一连接为从上述第一网络设备至第二网络设备的连接，上述第二连接为从上述第二网络设备至第三网络设备的连接。上述控制器设备向上述第一网络设备发送SR策略，上述SR策略指示上述SR路径。
在上述方法中，控制器设备利用多个连接的端点IP地址，编排出包含多个连接的SR路径，向SR路径的头端下发指示该SR路径的SR策略，以便头端按照SR策略转发报文。利用该方法，有助于跨多个站点建立端到端且可编排的路径，便于进行流量规划。
可选地，上述多个连接中每个连接为不同站点之间的连接，控制器设备确定SR路径的过程包括：控制器设备根据上述多个连接的端点IP地址，以站点为路径编排对象确定SR路径。
可选地，控制器设备确定SR路径的过程包括：控制器设备从同一个站点中不同网络设备建立的连接中选择目标连接，根据目标连接确定SR路径。例如，网络中包含站点1和站点2，站点1中包含网络设备a和网络设备b，站点2中包含网络设备c和网络设备d。控制器设备根据网络设备上报的连接的端点IP地址确定网络中包含四个连接。四个连接分别是从网络设备a到网络设备c的连接、从网络设备a到网络设备d的连接、从网络设备b到网络设备c的连接、从网络设备b到网络设备d的连接。控制器设备根据设定的约束条件，从四个连接中选择目标连接，根据目标连接确定SR路径。
在一种可能的实现中，约束条件为SLA要求。控制器设备根据网络设备发送的连接的SLA信息，从同一个站点的多个连接中选择SLA信息满足SLA要求的连接，作为目标连接。SLA要求包括而不限于时延小于设定时长、丢包率小于设定丢包率、抖动小于设定值、带宽利用率大于设定的带宽利用率等。
可选地，上述控制器设备获取多个连接的端点IP地址包括：控制器设备接收上述第一网络设备或上述第二网络设备发送的上述第一连接的端点IP地址。
可选地，上述SR策略包括第一SID，上述第一SID指示上述第二连接。
可选地，上述SR策略包括第二SID，上述第二SID指示上述第一连接。
可选地，上述方法还包括：控制器设备为第二连接分配上述第一SID，并为第一连接分配第二SID。第一SID指示上述第二连接，第二SID指示上述第一连接；控制器设备向上述第二网络设备发送上述第一SID，并向上述第一网络设备发送上述第二SID。
控制器设备通过收集每条连接的端点IP地址，为每条连接分配对应的SID，将SID下发给需要SID的网络设备，使得流量转发阶段网络设备能够根据报文携带的SID通过SID对应的连接发送报文，有助于通过SID灵活地控制报文的转发路径。
第四方面，提供了一种网络设备。该网络设备具有实现上述第一方面或第一方面任一种可选方式中第一网络设备的功能，该网络设备包括至少一个单元，至少一个单元用于实现上述第一方面或第一方面任一种可选方式所提供的方法。或者，该网络设备具有实现上述第二方面或第二方面任一种可选方式中第二网络设备的功能，该网络设备包括至少一个单元，至少一个单元用于实现上述第二方面或第二方面任一种可选方式所提供的方法。
在一些实施例中，网络设备中的单元通过软件实现，网络设备中的单元是程序模块。在 另一些实施例中，网络设备中的单元通过硬件或固件实现。第四方面提供的网络设备的具体细节可参见上述第一方面或第一方面任一种可选方式或第二方面或第二方面任一种可选方式，此处不再赘述。
第五方面，提供了一种控制器设备，该控制器设备具有实现上述第三方面或第三方面任一种可选方式的功能。该控制器设备包括至少一个单元，至少一个单元用于实现上述第三方面或第三方面任一种可选方式所提供的方法。在一些实施例中，控制器设备中的单元通过软件实现，控制器设备中的单元是程序模块。在另一些实施例中，控制器设备中的单元通过硬件或固件实现。第五方面提供的控制器设备的具体细节可参见上述第三方面或第三方面任一种可选方式，此处不再赘述。
第六方面，提供了一种网络设备，该网络设备包括：处理器，所述处理器与存储器耦合，所述存储器中存储有至少一条计算机程序指令，所述至少一条计算机程序指令由所述处理器加载并执行，以使所述网络设备实现上述第一方面或第一方面任一种可选方式或第二方面或第二方面任一种可选方式所提供的方法，第六方面提供的网络设备的具体细节可参见上述第一方面或第一方面任一种可选方式或第二方面或第二方面任一种可选方式，此处不再赘述。
第七方面，提供了一种控制器设备，所述控制器设备包括：处理器，所述处理器与存储器耦合，所述存储器中存储有至少一条计算机程序指令，所述至少一条计算机程序指令由所述处理器加载并执行，以使所述控制器设备实现上述第三方面或第三方面任一种可选方式所提供的方法。第七方面提供的控制器设备的具体细节可参见上述第三方面或第三方面任一种可选方式，此处不再赘述。
第八方面，提供了一种计算机可读存储介质，该存储介质中存储有至少一条指令，该指令在计算机上运行时，使得计算机执行上述第一方面或第一方面任一种可选方式或第二方面或第二方面任一种可选方式所提供的方法。
第九方面，提供了一种计算机可读存储介质，该存储介质中存储有至少一条指令，该指令在计算机上运行时，使得计算机执行上述第三方面或第三方面任一种可选方式所提供的方法。
第十方面，提供了一种计算机程序产品，所述计算机程序产品包括一个或多个计算机程序指令，当所述计算机程序指令被计算机加载并运行时，使得所述计算机执行上述第一方面或第一方面任一种可选方式或第二方面或第二方面任一种可选方式所提供的方法。
第十一方面，提供了一种计算机程序产品，所述计算机程序产品包括一个或多个计算机程序指令，当所述计算机程序指令被计算机加载并运行时，使得所述计算机执行上述第三方面或第三方面任一种可选方式所提供的方法。
第十二方面，提供了一种芯片，包括存储器和处理器，存储器用于存储计算机指令，处理器用于从存储器中调用并运行该计算机指令，以执行上述第一方面或第一方面任一种可选方式或第二方面或第二方面任一种可选方式中的方法。
第十三方面，提供了一种芯片，包括存储器和处理器，存储器用于存储计算机指令，处理器用于从存储器中调用并运行该计算机指令，以执行上述第三方面或第三方面任一种可选方式所提供的方法。
第十四方面，提供了一种网络系统，该网络系统包括上述第三方面所述的网络设备以及上述第四方面所述的控制器设备；或者，该网络系统包括上述第五方面所述的网络设备以及 上述第六方面所述的控制器设备。
附图说明
图1是本申请实施例提供的一种SD-WAN系统架构示意图；
图2是本申请实施例提供的一种企业网络中应用SD-WAN系统架构的示意图；
图3是本申请实施例提供的一种运营商POP组网中应用SD-WAN系统架构的示意图；
图4是本申请实施例提供的一种报文处理方法的流程图；
图5是本申请实施例提供的一种报文格式的示意图；
图6是本申请实施例提供的一种路径确定方法的流程图；
图7是本申请实施例提供的一种计算overlay网络中SR路径的示意图；
图8是本申请实施例提供的一种建立TVC的示意图；
图9是本申请实施例提供的一种拓扑收集和上报的示意图；
图10是本申请实施例提供的一种控制器设备下发SR策略的示意图；
图11是本申请实施例提供的一种SD-WAN系统架构示意图；
图12是本申请实施例提供的一种业务引流入SD-WAN SRv6隧道及转发的示意图；
图13是本申请实施例提供的一种业务引流入SD-WAN SRv4隧道及转发的示意图；
图14是本申请实施例提供的一种SD-WAN SRv6和SRv4混合隧道转发的方法示意图；
图15是本申请实施例提供的一种通过SD-WAN SR隧道转发L3 VPNv6流量的方法示意图；
图16是本申请实施例提供的一种通过SD-WAN SR隧道转发L2 VPN流量的方法示意图；
图17是本申请实施例提供的一种通过SD-WAN SR实现多域转发的示意图；
图18是本申请实施例提供的一种网络设备的结构示意图；
图19是本申请实施例提供的一种控制器设备的结构示意图；
图20是本申请实施例提供的一种网络设备或者控制器设备的结构示意图；
图21是本申请实施例提供的一种网络设备或者控制器设备的结构示意图。
具体实施方式
为使本申请的目的、技术方案和优点更加清楚，下面将结合附图对本申请实施方式作进一步地详细描述。
下面对本申请实施例涉及的一些术语概念做解释说明。
(1)隧道虚拟连接(tunnel virtual connection，TVC)
TVC是逻辑上的虚拟连接。TVC通常会跨一个或多个传输网络。
(2)连接
本申请实施例中“连接”这一术语可替换为TVC、隧道、路径、虚拟连接或者广域网(wide area network，WAN)链路。
可选地，连接是指不同站点之间的连接，连接经过了站点之间的下层(underlay)传输网络中一个或多个网络设备。
可选地，连接的端点互联网协议(internet protocol，IP)地址是指WAN接口的IP地址。 可选地，连接是单向连接，连接具有方向性。例如，从网络设备a至网络设备b的连接、从网络设备b至网络设备a的连接不是同一个连接。从网络设备a至网络设备b的连接通过一个段标识(segment ID，SID)指示，从网络设备b至网络设备a的连接通过另一个SID指示。也就是说，正向连接和方向连接通过两个不同的SID指示。可替代地，连接是没有方向的连接。例如，从网络设备a至网络设备b的连接、从网络设备b至网络设备a的连接通过同一个SID指示。
(3)段路由(segment routing，SR)
SR是基于源路由理念而设计的在网络上转发报文的一种协议。SR将网络路径分成一个个段，并且为这些段和网络中的转发节点分配SID。通过对段和网络节点进行有序排列，得到段列表(segment list)，就可以通过段列表指示一条转发路径。
SR将代表转发路径的段列表编码在数据报文的头部，段列表随数据报文传输。接收端收到数据报文后，对段列表进行解析，如果段列表的活跃SID是本节点的SID时，则对数据报文执行该SID对应的操作；如果活跃SID不是本节点的SID，则接收端使用常规的路由转发方式将数据报文转发到下一节点。
(4)基于互联网协议第6版的段路由(internet protocol version 6 for segment routing，SRv6)
SRv6是基于源路由理念而设计的在网络上转发IPv6报文的一种方法。基于IPv6转发面的SR，通过在IPv6报文中插入一个路由扩展头-段路由头(segment routing header，SRH)，在SRH中压入一个显式的IPv6地址栈，通过中间节点不断的进行更新目的地址和偏移地址栈的操作来完成逐跳转发。SRv6技术就是采用现有的IPv6转发技术，通过灵活的IPv6扩展头，实现网络可编程。SRv6将一些IPv6地址定义成实例化的SID，每个SID有着自己显式的作用和功能，通过不同的SID操作，实现简化的虚拟专用网络(virtual private network，VPN)以及灵活的路径规划。
(5)WAN接口的IP地址
WAN接口也称为传输网络接口(transport network port，TNP)。WAN接口的IP地址与SRv6 SID这种IP地址不同。这两种IP地址的主要区别在于，SRv6 SID是网络设备本地定位(locator)地址池中的地址，而WAN接口的IP地址是underlay网络的运营商分配的地址。对于SRv6 SID这种IP地址而言，网络设备需要与underlay网络中设备运行IPv6内部网关协议(internal gateway protocol，IGP)路由协议。网络设备通过IPv6 IGP路由协议向underlay网络中设备通告locator路由，让underlay网络中设备感知SID这种IP地址，才能在流量转发阶段保证SRv6 SID这种IP地址的可达性，所以会导致依赖于underlay网络的路由协议的技术问题。对于WAN接口这种IP地址而言，由underlay网络运营商保证WAN接口的IP地址的路由可达性，网络设备无需通过IPv6 IGP路由协议通告额外的路由，也就摆脱了对underlay网络的路由协议的依赖性。
(6)软件定义广域网(software-defined wide area network，SD-WAN)
软件定义广域网(software-defined wide area network，SD-WAN)是软件定义网络(software defined networking，SDN)的重要实践。SD-WAN通过引入网络控制器，融合网络、安全和广域优化等技术，实现企业WAN网络配置和业务的自动化发放，对外提供一种简易、灵活和高品质的企业WAN互联能力。SD-WAN通常具备以下基本特征：
1、基于混合WAN链路，实现灵活的IP Overlay组网
SD-WAN通过采用在两个站点的边缘(edge)设备间建立端到端上层(overlay)隧道的方法，实现SD-WAN网络和underlay传输网络的独立性，underlay网络链路可以是多协议标签交换(multi-protocol label switching，MPLS)专线，也可以是公共因特网(Internet)或长期演进(long term evolution，LTE)等。
2、智能应用选路，保障应用体验
企业应用种类繁多，常见的有生产类、协同类、云化、娱乐类等各类应用。不同类型应用对带宽和链路质量要求各不相同。SD-WAN通常通过深度报文检测(deep packet inspection，DPI)等应用识别技术，对企业流量进行识别，然后基于应用纬度进行分类统计、质量检测和路径控制。如高价值应用流量优先指定在MPLS等有高线路品质但是成本较高的路径上传输，低价值的应用流量指定在Internet等低线路品质但也是成本低的路径上传输。
3、集中管控和可视化，简单易运维
通过集中的网络监控和可视化，实现了集中的管理，提升了WAN端到端的管理和运维效率。
(7)IGP
IGP是指在一个AS内部运行的路由协议。IGP协议例如为开放式最短路径优先(open shortest path first，OSPF)、中间系统到中间系统(intermediate system-to-intermediate system，IS-IS)等。
下面对本申请实例的系统架构举例说明。
图1是本申请实施例提供的一种SD-WAN网络的系统架构示意图。图1所示的系统架构可选地提供为SD-WAN overlay SR架构。图1所示的系统架构包括管控平面10、overlay网络20以及underlay网络30。
管控平面10包括控制器设备11。可选地，管控平面10还包括路由反射器(router reflector，RR)12。
控制器设备11为SD-WAN网络的管理者。控制器设备11用于管理网络设备201、网络设备202、网络设备203、网络设备204以及RR 12，控制器设备11还用于进行SD-WAN网络业务编排与配置，SR路径编排与计算等功能。控制器设备11例如为服务器、主机、终端、网络设备等。
RR 12为SD-WAN网络的控制部件。RR 12负责收集SD-WAN网络中网络设备201、网络设备202、网络设备203、网络设备204之间的网络拓扑、分发用户路由、过滤以及控制等。RR 12例如为服务器、主机、终端、网络设备等。在另一些实施例中，SD-WAN网络不包含RR 12，RR 12的功能均通过控制器设备11实现。
图1以控制器设备11与RR 12分设为例进行说明，即，控制器设备11与RR 12由相互有通信耦合的不同物理设备实现。在另一些实施例中，控制器设备11与RR 12合设，即，控制器设备11与RR 12集成在同一物理设备中。
图1示出的网络中存在一个控制器设备11以及一个RR 12仅是举例，控制器设备11和RR 12的数量可选地更多，本实施例对控制器设备11和RR 12的数量不做限定。
overlay网络20包括多个网络设备。网络设备为SD-WAN业务的转发执行器。网络设备 用于收集物理网络拓扑信息、对用户流量进行隧道封装、加密、策略选路等。网络设备例如为路由器、交换机、防火墙等。
可选地，overlay网络20中的网络设备为边缘设备、入网点(point of presence，POP)或者汇聚设备。overlay网络20中的多个网络设备分别部署在多个站点中。overlay网络20中不同网络设备之间通过TVC相连。
图1以网络设备为网络设备201、网络设备202、网络设备203或者网络设备204为例进行说明。网络设备201部署在分支站点1。网络设备202部署在汇聚站点。网络设备203部署在分支站点2。网络设备204部署在总部站点。网络设备201与网络设备202通过TVC 212相连。网络设备202与网络设备204通过TVC 224相连。网络设备204与网络设备203通过TVC 243相连。
图1示出的一个站点中部署一个网络设备的场景仅是举例，一个站点中部署的网络设备的数量可选地更多，例如一个站点中部署几十个、几百个或者更多数量的网络设备，本实施例对一个站点中部署的网络设备的数量不做限定。
图1示出的网络中存在四个网络设备的情况仅是举例，网络设备的数量可选地更多或更少。例如网络设备为3个，又如网络设备为几十个或几百个，或者更多数量，本实施例对网络设备的数量不做限定。
图1中每个设备可选地是独立的硬件设备、或者是包含多个硬件设备的集群或者分布式系统，或者是基于云计算以及网络功能虚拟化(network functions virtualization，NFV)技术所实现的虚拟化设备。虚拟化设备包括而不限于虚拟机或容器。
underlay网络30包括而不限于运营商专线或因特网或者企业自建的私有网络。underlay网络30包括至少一个网络设备301。underlay网络30中的各个网络设备301通过物理链路分别与overlay网络中的各个网络设备相连。
可选地，本申请实施例提供的系统架构应用于需要控制流量经过指定的一个或多个站点的场景。控制器设备用于编排包含多个站点的网络设备的SR路径。例如，请参考图1，控制器设备编排的SR路径为分支站点1中网络设备201—汇聚站点中网络设备202—总部站点中网络设备204—分支站点2中网络设备203。其中，SR路径的端点包括网络设备201和网络设备203。SR路径经过的中间节点包括网络设备202和网络设备204。SR路径包括TVC 212、TVC 224以及VC 243。
图1示出的系统架构适用于很多种应用场景，下面结合两种典型应用场景举例说明。
本申请实施例的一个典型应用场景为企业SD-WAN场景。图2为本申请实施例提供的SD-WAN overlay SR架构的应用在企业网络的场景示意图。企业通过SD-WAN隧道，经过租用的运营商专线、或因特网或5G等传送网络，实现各分支站点互联互通，满足企业组网、入云、上网等业务的需求。在有些企业组网规模较大时，还可能会有层次化组网场景，具有经过SD-WAN站点进行多节点SR路径编排和控制的需求。例如，请参考图2，为了满足分支站点1用户访问公有云的需求，SD-WAN控制器490编排了两个SR路径。SR路径1为分支站点1-汇聚站点-总部站点-公有云中云上站点5。SR路径2包括分支站点1-汇聚站点-公有云中云上站点5。
本申请实施例的另一个典型应用场景为运营商SD-WAN POP组网场景。图3为本申请实 施例提供的SD-WAN overlay SR架构的应用在运营商SD-WAN POP组网场景示意图。运营商或管理服务提供商(managed service provider，MSP)通过在不同地域部署SD-WAN设备作为POP网关(gateway，GW)，并利用云间互联网和云专线资源，可以快速灵活地构建一张覆盖全国甚至全球的SD-WAN骨干网。企业分支站点通过本地互联网线路就近接入到运营商/MSP的POP接入点，经过SD-WAN骨干网实现跨区域的业务互访时，具有经过多POP节点SR路径编排的需求。例如，为了满足客户A站点1用户要访问企业总部的需求，SD-WAN控制器590编排了两个SR路径，SR路径1为客户A站点1-POP GW 502-POP GW 504-客户A总部，SR路径2为客户A站点1-POP GW 502-POP GW 503-POP GW 504-客户A总部。
下面对本申请的一些实施例涉及的通信协议进行介绍。
本申请的一些实施例涉及的通信协议包括边界网关协议链路状态(border gateway protocol link-state，BGP LS)协议、边界网关协议(border gateway protocol，BGP)SRv6策略(BGP SRv6 policy)协议以及BGP以太网VPN(Ethernet VPN，EVPN)协议。
BGP LS协议用于支持网络拓扑收集的功能以及流量工程(traffic engineering，TE)数据库(data base，DB)信息收集的功能。
BGP LS协议作用在控制器设备和网络设备之间、网络设备之间。可选地，在网络中包含RR的情况下，BGP LS协议作用还作用在控制器和RR之间、RR和网络设备之间。
BGP SRv6 policy协议用于支持隧道策略下发的功能。BGP SRv6 policy协议作用在控制器设备和网络设备之间、网络设备之间。可选地，在网络中包含RR的情况下，BGP SRv6 policy协议作用还作用在控制器和RR之间、RR和网络设备之间。
BGP EVPN协议用于支持发布SD-WAN TNP路由的功能以及发布VPN业务路由的功能。BGP EVPN协议作用在网络设备之间。可选地，在网络中包含RR的情况下，BGP EVPN协议作用还作用在RR和网络设备之间。
下面对本申请实施例的方法流程举例说明。
图4是本申请实施例提供的一种报文处理方法的流程图。
图4所示方法涉及多个网络设备之间的交互。为了区分不同的网络设备，用“网络设备a”、“网络设备b”、“网络设备c”区分描述多个不同的网络设备。其中，网络设备b为SR路径经过的中间节点。网络设备a为SR路径上的头端或者SR路径经过的中间节点。网络设备c为SR路径的尾端或者SR路径经过的中间节点。
图4所示方法涉及不同网络设备之间的连接。为了区分描述不同的连接，使用“连接ab”指代从网络设备a至网络设备b的连接，使用“连接bc”指代从网络设备b至网络设备c的连接。
图4所示方法所基于的网络部署场景可选地如上述图1所示。例如，结合图1来看，图4所示方法中的网络设备a为图1中的网络设备201，图4所示方法中的网络设备b为图1中的网络设备202，图4所示方法中的网络设备c为图1中的网络设备204；或者，图4所示方法中的网络设备a为图1中的网络设备202，图4所示方法中的网络设备b为图1中的网络设备204，图4所示方法中的网络设备c为图1中的网络设备203。
图4所示方法可选地应用于SD-WAN网络中。
图4所示方法的一个典型应用场景是企业网络中各分支站点互联。以图2所示的组网场景为例，将图4所示方法应用在图2所示的场景中，在需要控制分支站点1用户的流量通过SR路径1访问公有云中站点5的情况下，图4所示方法中的网络设备a为图2中的edge设备401，图4所示方法中的网络设备b为图2中的edge设备406，图4所示方法中的网络设备c为图2中的edge设备404，图4所示方法中的连接ab为图2中的TVC 416，图4所示方法中的连接bc为图2中的TVC 464。在需要控制分支站点1用户的流量通过SR路径2访问公有云中站点5的情况下，图4所示方法中的网络设备a为图2中的edge设备401，图4所示方法中的网络设备b为图2中的edge设备406，图4所示方法中的网络设备c为图2中的edge设备405，图4所示方法中的连接ab为图2中的TVC 416，图4所示方法中的连接bc为图2中的TVC 465。
图4所示方法的一个典型应用场景运营商SD-WAN POP组网。以图3所示的组网场景为例，将图4所示方法应用在图3所示的场景中，在需要控制客户A站点1的流量通过SR路径1访问企业总部的情况下，图4所示方法中的网络设备a为图3中的站点1中edge设备501，图4所示方法中的网络设备b为图3中的POP GW 502，图4所示方法中的网络设备c为图3中的POP GW 504，图4所示方法中的连接ab为图3中的TVC 512，图4所示方法中的连接bc为图3中的TVC 524。在需要控制客户A站点1的流量通过SR路径2访问企业总部的情况下，图4所示方法中的网络设备a为图3中的站点1中edge设备501，图4所示方法中的网络设备b为图3中的POP GW 502，图4所示方法中的网络设备c为图3中的POP GW 503，图4所示方法中的连接ab为图3中的TVC 512，图4所示方法中的连接bc为图3中的TVC 523。
图4所示方法可选地用于对多个报文处理的场景，如对一条数据流中每个报文处理的场景。为了便于读者理解，图4所示方法以针对一个第一报文的处理流程为例进行说明。其他报文的处理方式可参考对第一报文的处理方式。
S601、网络设备a向网络设备b发送第一报文。
第一报文的IP地址包括连接ab的端点IP地址。具体地，连接ab的端点IP地址包括属于网络设备a的IP地址以及属于网络设备b的IP地址。第一报文的源IP地址为连接ab的端点IP地址中属于网络设备a的IP地址。第一报文的目的IP地址为连接ab的端点IP地址中属于网络设备b的IP地址。
在一些实施例中，第一报文包括原始报文以及外层IP头。原始报文是指用户设备发送的数据报文。外层IP头是指封装于原始报文外层的IP头。连接ab的端点IP地址位于第一报文的外层IP头中。具体地，连接ab的端点IP地址中属于网络设备a的IP地址位于第一报文的外层IP头中源地址字段。连接ab的端点IP地址中属于网络设备b的IP地址位于第一报文的外层IP头中目的地址字段。
可选地，连接ab的端点IP地址是underlay网络运营商分配的WAN接口的IP地址。通过WAN接口建立的连接也称为WAN链路。在一个示例性实施例中，网络设备a具有WAN接口a。网络设备b具有WAN接口b。上述连接ab是网络设备a的WAN接口a与网络设备b的WAN接口b建立的网络连接。上述连接ab经过了underlay网络1中一个或多个网络设备。上述连接ab的端点IP地址包括WAN接口a的IP地址以及WAN接口b的IP地址。WAN接口a的IP地址以及WAN接口b的IP地址是underlay网络1的运营商分配的IP地 址。上述第一报文的源IP地址是WAN接口a的IP地址。第一报文的目的IP地址是WAN接口b的IP地址。
第一报文包括SID bc。SID bc是用于指示连接bc的SID。SID bc能够充当连接bc的标识。
可选地，SID bc的形式为MPLS标签。或者，SID bc的形式为SRv6 SID。或者，SID bc的形式为源站点的标识、目的站点的标识、源TNP的标识、目的TNP的标识的组合。例如，网络设备b为站点b中的网络设备。网络设备c为站点c中的网络设备。上述连接bc是网络设备b的WAN接口b与网络设备c的WAN接口c建立的网络连接，SID bc的形式为站点b的标识、站点c的标识、WAN接口b的标识、WAN接口c的标识的组合。采用SRv6 SID的形式实现SID时能复用已有的SRv6机制，采用短标签的形式实现SID时字节少，带宽额外消耗少，传输效率更高。
在一种可能的实现中，第一报文包括段路由头。SID bc位于第一报文的段路由头中。可选地，第一报文的段路由头为SRv6头。第一报文的SRv6头包括段列表(segment list)。SID bc位于第一报文的SRv6头的segment list中。可选地，第一报文的段路由头为SR-MPLS头。第一报文的SR-MPLS头包含标签栈，SID bc位于第一报文的SR-MPLS头的标签栈中。SID bc为第一报文的标签栈的栈顶标签。
可选地，第一报文还包括SID ab，SID ab指示连接ab。
S602、网络设备b接收来自网络设备a的第一报文。
在一些实施例中，网络设备a通过WAN接口a发送第一报文后，第一报文先到达underlay网络1中的网络设备。underlay网络1中的网络设备根据第一报文的目的IP地址(即网络设备b的WAN接口b的IP地址)查询路由表，从而得到与WAN接口b的IP地址对应的出接口和下一跳。underlay网络1中的网络设备根据与WAN接口b的IP地址对应的出接口和下一跳转发报文，使得第一报文转发至网络设备b的WAN接口b。网络设备b通过WAN接口b接收第一报文。
S603、网络设备b处理第一报文，以得到第二报文。
网络设备b从第一报文获得SID bc。网络设备b根据SID bc确定连接bc。网络设备b获取连接bc的端点IP地址。网络设备b使用连接bc的端点IP地址中属于网络设备b的IP地址更新第一报文的源IP地址，且使用连接bc的端点IP地址中属于网络设备c的IP地址更新第一报文的目的IP地址，从而将第一报文更新为第二报文。
第二报文的IP地址包括连接bc的端点IP地址，具体地，连接bc的端点IP地址包括属于网络设备b的IP地址以及属于网络设备c的IP地址。第二报文的源IP地址为连接bc的端点IP地址中属于网络设备b的IP地址。第二报文的目的IP地址为连接bc的端点IP地址中属于网络设备c的IP地址。
在一些实施例中，第二报文包括原始报文以及外层IP头。第二报文中原始报文与第一报文中原始报文相同。连接bc的端点IP地址位于第二报文的外层IP头中。具体地，连接bc的端点IP地址中属于网络设备b的IP地址位于第二报文的外层IP头中源地址字段。连接bc的端点IP地址中属于网络设备c的IP地址位于第二报文的外层IP头中目的地址字段。
可选地，连接bc的端点IP地址是underlay网络运营商分配的WAN接口的IP地址。在一个示例性实施例中，网络设备b具有WAN接口b。网络设备c具有WAN接口c。上述连 接bc是网络设备b的WAN接口b与网络设备c的WAN接口c建立的网络连接。上述连接bc经过了underlay网络2中一个或多个网络设备。上述连接bc的端点IP地址包括WAN接口b的IP地址以及WAN接口c的IP地址。WAN接口c的IP地址以及WAN接口b的IP地址是underlay网络2的运营商分配的IP地址。上述第二报文的源IP地址是WAN接口b的IP地址。第二报文的目的IP地址是WAN接口c的IP地址。
第二报文是否包含段路由头，以及第二报文包含段路由头情况下段路由头的内容存在多种情况。可选地，第二报文包含段路由头，第二报文中段路由头的segment list包含网络设备c的下游节点的SID，以便网络设备c的下游节点根据SID继续转发报文。可选地，第二报文中段路由头的segment list与第一报文中段路由头的segment list相同。例如，网络设备b在处理报文的过程中，保持段路由头的segment list内容不变，更新段路由头的SL字段，使得报文中SL字段指向的SID从SID bc变为SID bc的下一个SID，SID bc的下一个SID即网络设备c的SID。可选地，第二报文中段路由头的segment list与第一报文中段路由头的segment list不同，第二报文中段路由头的segment list不包含SID bc。例如，网络设备b在处理报文的过程中执行标签交换操作，将SID bc更新为另一个标签。可选地，第二报文不包含段路由头。例如，网络设备b为SR路径上的倒数第二跳节点，网络设备c为SR路径的尾节点，网络设备b在处理报文的过程中采用倒数第二跳弹出特性，弹出第一报文的段路由头。
可选地，第二报文还包括SID ab，SID ab指示第一连接。
网络设备b如何获得连接bc的端点IP地址中属于网络设备c的IP地址包括多种实现方式。在一种可能的实现中，网络设备c预先发布TNP路由。TNP路由中包含连接bc的端点IP地址中属于网络设备c的IP地址。网络设备b接收网络设备c发布的TNP路由，网络设备b从TNP路由中获得网络设备c的IP地址。可选地，网络设备c与RR建立BGP协议邻居，网络设备c基于BGP协议向RR上报TNP路由。RR反射网络设备c上报的TNP路由，将TNP路由发送至网络设备b。
SID的值如何确定包括多种实现方式，下面结合两种实现方式举例说明。
实现方式一、控制器设备为每个连接分配SID。
例如，控制器设备为连接ab分配SID ab，为连接bc分配SID bc。控制器设备向网络设备a发送SID ab，控制器设备向网络设备b发送SID bc。网络设备a接收控制器设备发送的SID ab。网络设备b接收控制器设备发送的SID bc。
实现方式二、网络设备为本端建立的每个连接分配SID。
例如，网络设备a为连接ab分配SID ab。网络设备a向控制器设备发送SID ab。网络设备b为连接bc分配SID bc。网络设备b向控制器设备发送SID bc。
S604、网络设备b向网络设备c发送第二报文。
可选地，连接ab是不同站点之间的连接。例如，网络设备a为站点a中的网络设备。网络设备b为站点b中的网络设备。连接ab为站点a与站点b之间的连接。连接ab经过了站点a与站点b之间的underlay网络。
可选地，连接bc是不同站点之间的连接。例如，网络设备b为站点b中的网络设备。网络设备c为站点c中的网络设备。连接bc为站点b与站点c之间的连接。连接bc经过了站点b与站点c之间的underlay网络。
可选地，SR路径上网络设备c的下游节点包括网络设备d。网络设备c的WAN接口c 与网络设备d的WAN接口d通过连接cd相连。上述第一报文和第二报文还包括SID cd，SID cd指示连接cd。
本实施例提供的方法，通过在流量转发阶段，充当SR路径上中间节点的网络设备根据连接的端点IP地址中属于本端的IP地址更新报文的源IP地址，并根据连接的端点IP地址中属于远端的IP地址更新报文的目的IP地址，一方面，在SR路径跨越多个不同路由域的underlay传输网络的场景下，避免由于源IP地址保持为头端的IP地址造成URPF检查不通过导致报文被丢弃的问题。另一方面，由于连接的端点IP地址通常是网络设备的WAN接口的IP地址，这种IP地址通常是传输网络的运营商分配的IP地址，传输网络自然能够保证该IP地址的路由可达性，而不必要求underlay网络设备运行支持SR-MPLS的IGP协议或者支持SRv6的IGP协议来保证目的IP地址的路由可达性，因此能够不依赖于underlay传输网络的路由协议。
可选地，图4所示方法中SID bc是End.X-SD-WAN类型的SID。
End.X-SD-WAN是本申请实施例提供的一种新类型的SID。End.X-SD-WAN对应的端点行为包括使用连接的端点IP地址中属于本端的IP地址更新报文的源IP地址，且使用连接的端点IP地址中属于对端的IP地址更新报文的目的IP地址。在一些实施例中，End.X-SD-WAN对应的端点行为具体包括：根据报文中活跃(active)SID，查询TVC数据库与活跃SID对应的TVC源IP地址(即连接的端点IP地址中属于本端的IP地址)、TVC数据库中与活跃SID对应的TVC目的IP地址(即连接的端点IP地址中属于对端的IP地址)、TVC数据库中与活跃SID对应的TVC出接口。使用TVC源IP地址更新报文的源地址，使用TVC目的IP地址更新报文的目的地址，以得到更新后的报文。通过活跃SID对应的TVC出接口发送更新后的报文。其中，活跃SID是指本设备待处理的SID。对于SRv6而言，活跃SID是指报文中SRH中SL字段指示的segment list中的SID；对于SR-MPLS而言，活跃SID是指报文中标签栈的栈顶标签。
在一些实施例中，实现End.X-SD-WAN的伪代码如下所示。
End.x-sdwan:
S01.When an SRH is processed{
S02.If(Segments Left＝＝0){
S03.Stop processing the SRH,and proceed to process the next
header in the packet,whose type is identified by
the Next Header field in the routing header.
S04.}
…
S12.Decrement IPv6 Hop Limit by 1
S13.Decrement Segments Left by 1
S14.Lookup Tunnel virtual connection DB with Segment List[Segments Left],update IPv6 SA and DA with TVC source IP and destination ip
S15.Submit the packet to the Tunnel virtual connection
S16.}
以上所示的伪代码的含义如下所示。
End.X-SD-WAN：
S01.当处理SRH时{
S02.如果(剩余段＝＝0){
S03.停止处理SRH，继续处理报文中SRH的下一个头(next header)，下一个头的类型是通过路由头中下一个头字段定义的。}
...
S12.将IPv6跳数限制减1。
S13.将剩余的段减1。
S14.使用段列表剩余段数量(segments left，SL)字段指示的SID，查找TVC数据库。使用查找到的TVC的源IP地址更新报文的IPv6源地址(source address，SA)，使用查找到的TVC的目的IP地址更新报文的IPv6目的地址(destination address，DA)字段。
S15.将报文提交给IPv6转发模块，通过对应的TVC出接口转发到新目的地。
S16.}
网络设备b对第一报文的处理过程包括：网络设备b对第一报文执行End.X-SD-WAN对应的端点行为，以得到第二报文。具体地，网络设备b预先创建并保存了本地SID表。本地SID表用于保存SID、SID类型以及出接口之间的对应关系。本地SID表中SID bc对应的SID类型是End.X-SD-WAN，SID bc对应的出接口为WAN接口b。网络设备b接收到第一报文之后，网络设备b根据第一报文中的SID bc查询本地SID表，从而查找到SID bc对应的SID类型是End.X-SD-WAN，且出接口为WAN接口b。因此，网络设备b会执行End.X-SD-WAN对应的端点行为，即：网络设备b使用连接bc的端点IP地址更新第一报文的源地址和目的地址，将得到的第二报文通过WAN接口b发送出去。
可选地，网络设备建立End.X-SD-WAN类型的SID与TVC之间的对应关系以及TVC与WAN接口之间的对应关系。在转发报文的过程中，网络设备先根据报文中的SID查询对应的TVC，再根据TVC查询对应的WAN接口，通过WAN接口转发报文。例如，图4所示方法中，网络设备b先根据SID bc查询对应的出接口，得到TVC bc(即连接bc)，再查询TVC bc对应的出接口，得到WAN接口b。
可选地，图4所示方法中SID ab是上述End.X-SD-WAN类型的SID。网络设备a发送第一报文的具体过程包括：网络设备a接收来自用户设备的原始报文。网络设备a根据原始报文的目的IP地址查询路由表。网络设备a找到原始报文的目的IP地址对应于SR策略。SR策略中段列表(segment list)包括连接ab对应的SID ab以及连接bc对应的SID bc。SID ab为段列表中第一个SID。网络设备a根据SID ab查询本地SID表，确定SID ab对应的连接为连接ab，SID ab对应的出接口为WAN接口a，且SID ab对应的端点行为包括：使用连接的端点IP地址中属于本端的IP地址更新报文的源IP地址，且使用连接的端点IP地址中属于对端的IP地址更新报文的目的IP地址。网络设备a根据SID ab对应的端点行为，向原始报文添加外层IP头以及SRH以得到第一报文。第一报文的外层IP头的源IP地址为连接的端点IP地址中属于网络设备a的IP地址，外层IP头的目的IP地址为连接的端点IP地址中属于网络设备b的IP地址。SRH包含SID bc。网络设备a通过WAN接口a发送第一报文。
本实施例通过提供以上End.X-SD-WAN类型的SID，支持基于包含多段TVC的SR路径 转发流量，根据TVC的端点IP地址封装报文(而不用SID)，从而实现underlay网络解耦的overlay SR隧道技术。具体地，现有SRv6技术中End.X功能是获取SRH中段列表下一跳SID作为IPv6报文的目的IP，并将目的IP为SID的报文从指定的链路发送出去。这样导致edge设备需要和中间传输网络设备对接IGP协议，edge设备需要把SID对应的Locator前缀路由通告到传输网络内部所有设备上去，否则传输网络内部设备无法根据报文的目的IP地址查到路由，也就无法将报文转发到SID对应的edge设备。而本实施例中，由于End.X-SD-WAN的功能包括根据SRH中段列表中下一跳SID查找TVC数据库，根据TVC数据库中TVC的源IP地址和TVC的目的IP地址更新IPv6报文的源IP地址和目的IP地址，然后将更新后的报文从该TVC对应的物理链路发送出去。而TVC的源IP地址和TVC的目的IP地址是edge设备上WAN接口的IP地址，WAN接口的IP地址往往是中间传输网络分配的，在传输网络上天然是有路由可以转发的，因此这样封装的SR报文在中间传输网络上不存在路由查找和URPF检查不通过等问题。
下面对underlay网络是IPv6网络的场景下具体实现方式进行介绍。以下介绍的实现方式可提供为一种SD-WAN SRv6隧道技术。
在underlay网络是IPv6网络的场景下，网络设备向报文中添加的连接的端点IP地址为IPv6地址。报文的外层IP头为IPv6头。IPv6头中源IP地址和目的IP地址为IPv6地址。
以图4所示方法为例，在连接ab对应的underlay网络1是IPv6网络的场景下，可选地，网络设备a和网络设备b均是支持IPv6的网络设备。第一报文中连接ab的端点IP地址为IPv6地址。第一报文包含外层IPv6头、SRH以及原始报文。连接ab的端点IP地址位于第一报文的外层IPv6头中。具体地，连接ab的端点IP地址中属于网络设备a的IPv6地址位于第一报文的外层IPv6头中源地址字段。连接ab的端点IP地址中属于网络设备b的IPv6地址位于第一报文的外层IPv6头中目的地址字段。第一报文包括SRH。SID bc位于第一报文的SRH中。
同理地，在连接bc的underlay网络是IPv6网络的场景下，可选地，网络设备b和网络设备c均是支持IPv6的网络设备。第二报文中连接bc的端点IP地址为IPv6地址。第二报文包含外层IPv6头以及原始报文。连接bc的端点IP地址位于第二报文的外层IPv6头中。具体地，连接bc的端点IP地址中属于网络设备b的IPv6地址位于第二报文的外层IPv6头中源地址字段。连接bc的端点IP地址中属于网络设备c的IPv6地址位于第二报文的外层IPv6头中目的地址字段。
下面对underlay网络是IPv4网络的场景下具体实现方式进行介绍。以下介绍的实现方式可提供为一种SD-WAN SRv4隧道技术。
在underlay网络是互联网协议第4版(internet protocol version 4，IPv4)网络的场景下，网络设备向报文中添加的连接的端点IP地址为IPv4地址。报文的外层IP头为IPv4头。IPv4头中源IP地址和目的IP地址为IPv4地址。报文中包含SRH对应的协议类型，SRH对应的协议类型在报文中位于SRH的外层。SRH对应的协议类型的具体携带位置包括多种实现方式，下面结合三种实现方式举例说明。
实现方式一、网络设备在外层IPv4头与SRH之间封装通用路由封装(generic routing  encapsulation，GRE)头。GRE头包含SRH对应的协议类型。在一种可能的实现中，SRH对应的协议类型位于GRE头中载荷协议(payload protocol)字段。图5示出了通过GRE实现SD-WAN SRv4隧道报文封装格式示意图。如图5所示，报文包含外层IP头、GRE头、SRH以及原始报文。
实现方式二、网络设备在外层IPv4头与SRH之间封装虚拟扩展局域网(virtual extensible local area network，VXLAN)头。VXLAN头包含SRH对应的协议类型。在一种可能的实现中，SRH对应的协议类型位于VXLAN头中下一协议(next protocol)字段。
实现方式三、网络设备在外层的IPv4头中携带SRH对应的协议类型。
以图4所示方法为例，在连接ab的underlay网络是IPv4网络的场景下，可选地，网络设备a和网络设备b均是支持IPv4的网络设备。第一报文中连接ab的端点IP地址为IPv4地址。第一报文包含外层IPv4头、SRH以及原始报文。连接ab的端点IP地址位于第一报文的外层IPv4头中。具体地，连接ab的端点IP地址中属于网络设备a的IPv4地址位于第一报文的外层IPv4头中源地址字段。连接ab的端点IP地址中属于网络设备b的IPv4地址位于第一报文的外层IPv4头中目的地址字段。第一报文包括SRH。SID bc位于第一报文的SRH中。第一报文包括SRH对应的协议类型。
在采用上述实现方式一的情况下，第一报文包括GRE头。第一报文的GRE头位于外层IPv4头与SRH之间。SRH对应的协议类型位于第一报文的GRE头中。在采用上述实现方式二的情况下，第一报文包括VXLAN头。第一报文的VXLAN头位于外层IPv4头与SRH之间，SRH对应的协议类型位于第一报文的VXLAN头中。在采用上述实现方式三的情况下，SRH对应的协议类型位于第一报文的IPv4头中。
同理地，在连接bc的underlay网络是IPv4网络的场景下，网络设备b和网络设备c可选地均是支持IPv4的网络设备。第二报文中连接bc的端点IP地址为IPv4地址。第二报文包含外层IPv4头以及原始报文。连接bc的端点IP地址位于第二报文的外层IPv4头中。具体地，连接bc的端点IP地址中属于网络设备b的IPv4地址位于第二报文的外层IPv4头中源地址字段。连接bc的端点IP地址中属于网络设备c的IPv4地址位于第二报文的外层IPv4头中目的地址字段。
下面对underlay网络包含IPv6网络和IPv4网络的场景下具体实现方式进行介绍。以下介绍的实现方式可提供为一种SD-WAN SRv6和SRv4混合隧道技术。
在underlay网络包含IPv6网络和IPv4网络的场景下，网络设备会进行报文封装格式的转换，将报文的外层IP头从IPv4头更新为IPv6头，或者将报文的外层IP头从IPv6头更新为IPv4头。
例如，在图4所示方法中，在连接ab的underlay网络是IPv4网络且连接bc的underlay网络是IPv6网络的场景下，可选地，网络设备a是支持IPv4网络的设备，网络设备b是支持IPv4网络且支持IPv6网络的设备，网络设备c是支持IPv6网络的设备。第一报文中连接ab的端点IP地址为IPv4地址。第二报文中连接bc的端点IP地址为IPv6地址。网络设备b处理报文的过程包括：网络设备b从第一报文中解封装包含连接ab的端点IP地址的外层IPv4头。网络设备b生成包含连接bc的端点IP地址的外层IPv6头。网络设备b向报文中封装包含连接bc的端点IP地址的外层IPv6头，以得到第二报文。
在连接ab的underlay网络是IPv6网络且连接bc的underlay网络是IPv4网络的场景下，可选地，网络设备a是支持IPv6网络的设备，网络设备b是支持IPv4网络且支持IPv6网络的设备，网络设备c是支持IPv4网络的设备。第一报文中连接ab的端点IP地址为IPv6地址。第二报文中连接bc的端点IP地址为IPv4地址。网络设备b处理报文的过程包括：网络设备b从第一报文中解封装包含连接ab的端点IP地址的外层IPv6头。网络设备b生成包含连接bc的端点IP地址的外层IPv4头。网络设备b向报文中封装包含连接bc的端点IP地址的外层IPv4头，以得到第二报文。
在一种可能的实现中，网络设备保存连接与封装类型之间的对应关系。网络设备根据连接对应的封装类型确定向原始报文封装哪种报文头。例如，网络设备b确定SID对应的连接后，如果连接对应的封装类型为SRv6，则网络设备b向第一报文封装IPv6头和SRH。如果连接对应的封装类型为SRv4-GRE，则网络设备b向第一报文封装IPv4头、GRE头和SRH。如果连接对应的封装类型为SRv4-VXLAN，则网络设备b向第一报文封装IPv4头、VXLAN头和SRH。
以上介绍的图4所示实施例提供了转发面的基本流程。本本申请的一些实施例还提供了控制面的基本流程，下面进行具体说明。
图6是本申请实施例提供的一种路径确定方法的流程图。图6所示方法包括以下步骤S702至步骤S704。
步骤S702、控制器设备获取多个连接的端点IP地址。
在一些实施例中，网络设备向控制器设备发送连接的端点IP地址，控制器设备接收网络设备发送的连接的端点IP地址，从而获得多个连接的端点IP地址。下面结合三种实现方式举例说明。
实现方式A、充当源端的网络设备向控制器设备上报连接的端点IP地址。
例如，结合图4所示方法，网络设备a向控制器设备发送连接ab的端点IP地址。网络设备b向控制器设备发送连接bc的端点IP地址。控制器设备接收网络设备a发送的连接ab的端点IP地址，并接收网络设备b发送的连接bc的端点IP地址，从而获得连接ab的端点IP地址和连接bc的端点IP地址。
实现方式B、充当目的端的网络设备向控制器设备上报连接的端点IP地址。
例如，结合图4所示方法，网络设备b向控制器设备发送连接ab的端点IP地址。网络设备c向控制器设备发送连接bc的端点IP地址。
实现方式C、充当源端的网络设备和充当目的端的网络设备均向控制器设备上报连接的端点IP地址，控制器设备从两个网络设备上报的连接的端点IP地址中选择一份IP地址。
例如，结合图4所示方法，网络设备a向控制器设备发送连接ab的端点IP地址，网络设备b向控制器设备发送连接ab的端点IP地址和连接bc的端点IP地址。网络设备c向控制器设备发送连接bc的端点IP地址。控制器设备从网络设备a发送的连接ab的端点IP地址、网络设备b发送的连接ab的端点IP地址这两份IP地址中选择一份作为连接ab的端点IP地址。控制器设备从网络设备b发送的连接bc的端点IP地址、网络设备c发送的连接bc的端点IP地址这两份IP地址中选择一份作为连接bc的端点IP地址。
在一些实施例中，网络设备还获取其所在的站点的标识(site ID)，向控制器设备上报站 点的标识。例如，网络设备a部署在站点a中，网络设备b部署在站点b中，网络设备c部署在站点c中，网络设备a向控制器设备发送站点a的标识，网络设备b向控制器设备发送站点b的标识，网络设备c向控制器设备发送站点c的标识。
在一些实施例中，网络设备会检测连接的通断状态，网络设备还向控制器设备上报连接的通断状态。连接的通断状态包括连通(up)状态和关闭(down)状态。在一种可能的实现中，网络设备向连接的对端周期性地发送探测报文，根据预定时长内是否接收到对端返回的响应报文来确定连接的通断状态。
可选地，充当源端的网络设备向控制器设备上报连接的通断状态。例如，结合图4所示方法，网络设备a向控制器设备发送连接ab的通断状态。网络设备b向控制器设备发送连接bc的通断状态。可选地，充当目的端的网络设备向控制器设备上报连接的通断状态。例如，结合图4所示方法，网络设备b向控制器设备发送连接ab的通断状态。网络设备c向控制器设备发送连接bc的通断状态。可选地，充当源端的网络设备和充当目的端的网络设备均向控制器设备上报连接的通断状态。
在一些实施例中，网络设备会检测连接的服务等级协议(service-level agreement，SLA)信息，网络设备向控制器设备上报连接的SLA信息。连接的SLA信息包括而不限于丢包率、时延、抖动或带宽利用率中至少一项。
可选地，充当源端的网络设备向控制器设备上报连接的SLA信息。例如，结合图4所示方法，网络设备a向控制器设备发送连接ab的SLA信息。网络设备b向控制器设备发送连接bc的SLA信息。可选地，充当目的端的网络设备向控制器设备上报连接的SLA信息。例如，结合图4所示方法，网络设备b向控制器设备发送连接ab的SLA信息。网络设备c向控制器设备发送连接bc的SLA信息。可选地，充当源端的网络设备和充当目的端的网络设备均向控制器设备上报连接的SLA信息。
在一些实施例中，网络设备还向控制器设备上报连接对应的SID。例如，结合图4所示方法，网络设备a向控制器设备发送连接ab对应的SID ab。网络设备b向控制器设备发送连接bc对应的SID bc。
可选地，在网络设备与多个对端建立了多个连接的情况下，网络设备向控制器设备发送多个连接中每个连接的端点IP地址、多个连接中每个连接的通断状态、多个连接中每个连接的SLA信息、多个连接中每个连接对应的SID。
在一些实施例中，网络设备基于BGP LS协议向控制器设备上报上述连接的端点IP地址、连接的状态、SID、站点的标识等各种信息。下面对基于BGP LS协议上报上述各种信息的具体实现方式举例说明。
在一种可能的实现中，基于RFC 7752，对协议标识(protocol-ID)定义进行扩展，定义一种新的协议标识以支持上报连接的端点IP地址等各种信息，从而支持BGP SD-WAN TVC拓扑数据库。协议标识例如是表示拓扑信息来源的协议号。表1示出了扩展的协议标识，新增一种SD-WAN协议的标识，SD-WAN协议的标识表示报文中网络层可达信息(network layer reachability information，NLRI)信息(即连接的端点IP地址、连接的状态等各种信息)中源协议为SD-WAN协议。
表1
Figure PCTCN2022119639-appb-000001
Figure PCTCN2022119639-appb-000002
例如，网络设备b上报连接的端点IP地址的过程包括：网络设备b生成BGP-LS报文，BGP-LS报文包括连接bc的端点IP地址和/或连接ab的端点IP地址，BGP-LS报文还包括SD-WAN协议的标识；网络设备b向控制器设备发送BGP-LS报文。通过扩展SD-WAN协议的标识，控制器设备能够通过BGP LS报文中协议的标识识别BGP LS收集到的是本实施例提供的新的拓扑数据。
在一些实施例中，基于RFC 7752对BGP LS节点路由(node路由)进行扩展。BGP LS节点路由中包含SD-WAN协议的标识以及SD-WAN站点的标识(SD-WAN site ID)。SD-WAN site ID用于标识SD-WAN中网络设备对应的站点。BGP LS节点路由中其他信息复用现有的标准定义。示例性地，SD-WAN的BGP LS节点路由的内容如下表2所示。
表2
Figure PCTCN2022119639-appb-000003
在一些实施例中，基于RFC 7752对BGP LS链路路由(link路由)进行扩展。BGP LS链路路由中包含SD-WAN协议的标识、TVC状态属性以及段标识属性。TVC状态属性也称SD-WAN-TVC-status属性，TVC状态属性用于携带SD-WAN TVC的隧道状态。段标识属性也称SD-WAN-segment-id属性，段标识属性用于携带SD-WAN TVC的SID。示例性地，SD-WAN的BGP LS链路路由的内容如下表3所示。
表3
Figure PCTCN2022119639-appb-000004
Figure PCTCN2022119639-appb-000005
步骤S703、控制器设备根据多个连接的端点IP地址，确定SR路径。
例如，SR路径上的节点包括网络设备a、网络设备b和网络设备c。SR路径上的连接包括连接ab和连接bc。
可选地，控制器设备以站点为对象进行路径计算，而不是以单台网络设备为对象进行路径计算。下面对以站点为对象进行路径计算相关的特征进行介绍。
例如，在步骤S702中，控制器设备具体获取多个站点中不同站点之间的连接的端点IP地址。在步骤S703中，控制器设备根据多个连接的端点IP地址，以站点为路径编排对象确定SR路径。在步骤S704中，控制器设备发送的SR策略中的端点对应于站点。SR策略中的 端点的值可选地为站点的标识，而不是具体的某台设备的IP地址。
在一个站点包括多个网络设备的情况下，同一个站点中每个网络设备分别向控制器设备发送其建立的连接的端点IP地址和站点的标识。同一个站点中每个网络设备上报的站点的标识是相同的。同一个站点中不同网络设备上报的连接的端点IP地址可选地是不同的。控制器设备将同一个站点中的多个网络设备视为一个节点进行路径计算。
可选地，控制器设备从同一个站点中不同网络设备建立的连接中选择一个连接进行路径计算。例如，网络中包含站点1和站点2，站点1中包含网络设备a和网络设备b，站点2中包含网络设备c和网络设备d。控制器设备根据网络设备上报的拓扑信息确定网络中包含四个连接。四个连接分别是从网络设备a到网络设备c的连接、从网络设备a到网络设备d的连接、从网络设备b到网络设备c的连接、从网络设备b到网络设备d的连接。控制器设备根据设定的约束条件，从四个连接中选择一个连接进行编排。其中，约束条件例如为对路径的SLA要求。SLA要求包括而不限于时延小于设定时长、丢包率小于设定丢包率、抖动小于设定值、带宽利用率大于设定的带宽利用率等。
在一种可能的实现中，用户设备获取用户设定的算路意图，用户设备向控制器设备发送算路意图。控制器设备接收用户设备发送的算路意图。控制器设备根据用户设定的算路意图进行路径计算。算路意图包括源站点、目的站点以及约束条件。控制器设备从TVC拓扑数据库中选择出满足算路意图的多个TVC，将选择出的多个TVC组成SR路径。
图7示出了一种计算overlay网络中SR路径的示意图。如图7所示，总部站点包括edge2-1和edge2-2。分支站点包括edge1。汇聚站点包括edge3。edge1上的TNP1与edge2-1上的TNP21建立了一条TVC。edge1与edge2-1之间的TVC对应的SID为SID 1021。edge1上的TNP1与edge3上的TNP3建立了一条TVC。edge1与edge3之间的TVC对应的SID为SID103。edge3上的TNP3与edge2-2上的TNP22建立了一条TVC。edge3与edge2-2之间的TVC对应的SID为SID 3022。edge2-1、edge2-2、edge1、edge3分别向控制器设备上报TVC的拓扑信息。控制器设备根据TVC的拓扑信息，基于站点进行策略编排。具体地，用户设定的算路意图中源站点是分支站点，目的站点是总部站点，约束条件为时延小于设定时长或者丢包率小于设定丢包率。控制器设备根据TVC的拓扑信息以及算路意图，计算从分支站点至总部站点的SR路径，以得到两条SR路径。控制器设备计算出的两条SR路径分别是SR路径(1)和SR路径(2)。SR路径(1)包括从edge1至edge2-1的TVC。SR路径(1)满足时延小于设定时长的约束条件。SR路径(2)包括从edge1至edge3的TVC以及从edge3至edge2-2的TVC。SR路径(2)满足丢包率小于设定丢包率的约束条件。控制器设备根据算路结果生成SR策略1和SR策略2。SR策略1包含SR路径(1)的段列表。SR策略2包含SR路径(2的段列表。SR策略1的具体内容如下表4所示，SR策略2的具体内容如下表5所示。
表4
Figure PCTCN2022119639-appb-000006
表5
Figure PCTCN2022119639-appb-000007
可选地，网络设备向控制器设备发送连接的状态之后，网络设备还会检测连接的状态。如果网络设备上某一条连接的状态发生更新，网络设备向控制器设备发送该连接更新后的状态。控制器设备根据网络设备上报的连接的更新后的状态，更新拓扑数据库中保存的拓扑数据，并根据更新后的拓扑数据重新计算SR策略。其中，连接的状态更新包括而不限于连接的通断状态从up状态更新为down状态、连接的通断状态从down状态更新为up状态、连接的SLA信息发生变化(如SLA下降或SLA上升)。
示例性地，网络设备对其建立的每条TVC进行连通性状态检测。如果物理网络链路故障导致某条TVC状态从up状态更新为down状态，网络设备向控制器设备发送BGP-LS报文，BGP-LS报文指示TVC处于down状态。控制器设备接收到BGP-LS报文后，控制器设备将拓扑数据库中TVC的状态更新为down状态，并失效包含该TVC的SR路径或者撤销包含该TVC的SR路径，或者重新计算一条新的SR路径。
以往的SD-WAN方案由于没有端到端路径状态感知，当其中一段TVC故障或质量下降时，该TVC连接的两个网络设备之外的其他网络设备并不能联动感知TVC的故障或者质量下降，出现流量转发到中间被丢弃的情况。而本实施例中，网络设备通过对其建立的每条TVC进行连通性状态检测或者SLA检测，在TVC的状态发生更新后上报给控制器设备，有助于控制器设备及时感知到SR路径中每条TVC的状态，实现端到端路径状态感知。如果某一条SR路径中某一段TVC发生故障或者质量下降，控制器设备可通过失效SR路径、撤销SR路径或者重新计算SR路径等方式，将流量导入到其他SR路径上，从而避免流量转发到中间被丢弃的情况。
步骤S704、控制器设备向网络设备a发送SR策略。
控制器设备根据确定出的SR路径生成SR策略(policy)。SR策略指示SR路径。SR策略包括颜色(color)、端点(endpoint)、一个或多个候选路径(candidate Path)、优先级(preference)以及段列表(segment list)。SR策略中的段列表包含一个或多个SID。每个SID指示一个连接。例如，SR策略包括连接ab对应的SID ab以及连接bc对应的SID bc。在一些实施例中，SR策略应用于SD-WAN，SR策略中的段列表指示SD-WAN中overlay网络中的路径，SR策略也称SD-WAN策略。可选地，控制器基于BGP SR策略(BGP SR policy)协议发送SR策略。
在一种可能的实现中，控制器设备根据SR路径中的头端为网络设备a，向网络设备a发送SR策略。网络设备a接收SR策略后，网络设备a从SR策略获得段列表，SR策略中利用段列表执行图4所示方法。
下面再结合一个具体的应用场景对上述实施例举例说明，以下应用场景中的网络设备为 edge设备，网络设备之间的连接为TVC。
下面介绍动态建立TVC与SID的分配过程。
图8是一种建立TVC的示意图。如图8所示，TVC的建立过程包括步骤(1)至步骤(4)。
步骤(1)所有edge设备和RR建立BGP协议会话。edge设备通过BGP SD-WAN协议传递TNP路由信息。edge设备之间建立动态的TVC。如图8所示，分支站点的edge1根据本地的TNP1和总部站点的TNP2配对建立一条从分支站点到总部站点的单向隧道表(TVC表，即关于连接的表项)。edge1根据本地的TNP1和汇聚站点TNP3配对建立一条TVC表。同样，企业的总部站点分别建立从总部站点到分支站点的TVC、从总部站点到汇聚站点的TVC这两条TVC。汇聚站点建立从汇聚站点到分支站点的TVC、从汇聚站点到总部站点的TVC这两条TVC。每台edge设备在本地保存形成分布式TVC数据库。
步骤(2)edge设备在TVC上自动部署SLA检测协议。edge设备检测TVC的通断状态和TVC的SLA情况(丢包、时延、抖动)。edge设备把TVC的通断状态、TVC的SLA信息定时保存到TVC数据库中。
示例性地，edge1上TVC数据库的内容如下表6所示。
表6
Figure PCTCN2022119639-appb-000008
示例性地，edge2上TVC数据库的内容如下表7所示。
表7
Figure PCTCN2022119639-appb-000009
示例性地，edge3上TVC数据库的内容如下表8所示。
表8
Figure PCTCN2022119639-appb-000010
步骤(3)edge设备通过BGP EVPN为每条TVC动态分配一个全网唯一的SID。SID可 选地具有多种形式，例如是类MPLS的标签，或是SRv6 SID地址形式，或者是通过源站点的标识+源TNP ID+目的站点的标识+目的TNP ID形式拼接的标签格式。SID可选地是TVC的源节点分配的。如图8所示，分支站点的edge1为到总部站点TVC分配SID 102，edge1为到汇聚站点TVC分配SID 103；企业总部站点edge2为到分支站点、汇聚站点的两条TVC分别分配SID 201、SID 203。汇聚站点edge3为到分支站点和总部站点的两条TVC分别分配SID301、SID 302。
步骤(4)edge设备设定每个SID的SID类型为自定义的End.X-SD-WAN，将SID、SID类型与出接口之间的对应关系保存至本地SID表。
示例性地，edge1上本地SID表的内容如下表9所示。
表9
Figure PCTCN2022119639-appb-000011
示例性地，edge2上本地SID表的内容如下表10所示。
表10
Figure PCTCN2022119639-appb-000012
示例性地，edge3上本地SID表的内容如下表11所示。
表11
Figure PCTCN2022119639-appb-000013
下面对上述场景中拓扑收集和拓扑上报的过程说明。
图9是本申请实施例提供的一种拓扑收集和上报的示意图。拓扑收集和上报的过程包括如下步骤(1)至步骤(2)。
步骤(1)edge设备和RR间部署BGP LS协议。edge设备通过BGP LS协议扩展，和BGP EVPN进行协议互操作。edge设备从BGP EVPN收集TVC信息，并将TVC信息上报给RR。TVC信息包含但不限于TVC基础封装信息(如IP地址)、SID、状态、SLA、带宽利用率等。
步骤(2)RR和控制器设备间同样部署BGP LS协议。RR通过BGP LS协议扩展上报TVC信息给控制器设备。控制器设备接收并保存RR上报的TVC信息。控制器设备根据RR上报的TVC信息创建TVC拓扑数据库，以便利用TVC拓扑数据库计算全局SR路径。
示例性地，控制器设备创建的TVC拓扑数据库的内容如下表12所示。
表12
Figure PCTCN2022119639-appb-000014
Figure PCTCN2022119639-appb-000015
下面对上述场景中下发SR策略的过程说明。
图10是本实施例提供的一种控制器设备下发SR策略的示意图。图10中edge1是SR路径的头端，edge1是对网络设备a的举例说明。如图10所示，控制器设备使用BGP SR policy下发SD-WAN的SR策略。SR策略的内容尽量兼容原有的SRv6 policy。控制器设备下发SR策略的过程具体包括以下步骤(1)至步骤(2)。
步骤(1)控制器设备和RR间部署BGP SR policy协议。控制器设备通过BGP SR policy协议扩展向RR下发SD-WAN SR策略。
示例性地，控制器设备下发了如下表13和表14所示的两个SR策略。
表13
Figure PCTCN2022119639-appb-000016
表14
Figure PCTCN2022119639-appb-000017
步骤(2)RR和edge设备间同样部署BGP SR policy协议。RR通过BGP SR policy协议扩展向头端edge设备分发SD-WAN SR策略。
下面结合5个具体实例，对图4以及图6所示方法举例说明。
下述实例1至实例5的网络架构可参考图11。下述实例1至实例5中的头端edge1是图4以及图6所示方法中的网络设备a，下述实例1至实例5中的中间节点edge3是图4以及图6所示方法中的网络设备b，下述实例1至实例5中的尾端edge2是图4以及图6所示方法中的网络设备c。下述实例1至实例5中的TVC1-3是图4以及图6所示方法中的连接ab，下 述实例1至实例5中的TVC3-2是图4以及图6所示方法中的连接bc。下述实例1至实例5中的SID 302是图4以及图6所示方法中SID bc，下述实例1至实例5中的SID 103是图4以及图6所示方法中的SID ab。下述实例1至实例5中的IP1和IP3是图4以及图6所示方法中的连接ab的端点IP地址。下述实例1至实例5中的IP3和IP2是图4以及图6所示方法中的连接bc的端点IP地址。
实例1
实例1以EVPNv4为例描述流量在IPv6传输网络上构建SD-WAN SRv6隧道的转发处理流程。图12示出了实例1中业务引流入SD-WAN SRv6隧道及转发的示意图。如图12所示，实例1包括如下步骤(1)至步骤(5)。
步骤(1)尾端edge2通过BGP EVPN发布本地用户私网路由。RR接收尾端edge2发布的EVPN私网路由，RR将EVPN私网路由反射给头端edge1。EVPN私网路由包括路由前缀、VPN SID、颜色以及下一跳等信息。EVPN私网路由中的路由前缀例如为10.1.1.0/24。EVPN私网路由中的VPN SID例如为10000。EVPN私网路由中的颜色例如为20。EVPN私网路由中的下一跳例如为总部站点的站点标识。
步骤(2)控制器设备预先已经给头端edge1下发了不同的SD-WAN SRv6策略。头端edge1通过步骤(1)从RR学习到了尾端edge2发布的EVPN私网路由。头端edge1根据EVPN私网路由携带的颜色和下一跳迭代到名称为“分支至总部低丢包”的SR策略。
步骤(3)头端edge1接收到用户A(用户A的IPv4地址为10.2.1.1)发送到总部站点用户Z(用户Z的IPv4地址为10.1.1.1)的流量时，头端edge1根据流量中数据报文的目的地址查询。
私网路由，从而确定需要将流量导入SD-WAN SR隧道进行转发。头端edge1从SR策略中获得段列表为<103,302>，VPN SID为10000。头端edge1为数据报文添加SRH标签栈(10000,302,103)，头端edge1根据栈顶的SID 103匹配本地SID表。头端edge1找到本地SID表中SID 103对应的端点行为是End.X-SD-WAN且SID 103对应的出接口为TVC1-3。因此头端edge1获取TVC1-3的信息，根据TVC1-3的信息向数据报文添加一层SR隧道封装(即外层的IPv6头和SRH)。
TVC1-3的信息包括TVC1-3的源TNP1对应的接口IP地址(IP1)以及TVC1-3的目的TNP3的接口地址IP(IP3)。外层的IPv6头中源地址为IP1，目的地址为IP3。之后头端edge1将SID 103弹出。弹出SID 103后的报文携带SRH标签栈(10000,302)。头端edge1将报文从TNP1对应的链路发送给中间节点edge3。
在一些实施例中，头端edge1上TVC1-3的信息来自于中间节点edge3发布的TNP路由。具体地，中间节点edge3预先发布TNP路由，TNP路由包括TNP3的IP地址(IP3)。头端edge1接收中间节点edge3发布的TNP路由，从TNP路由中获得TNP3的IP地址。头端edge1在TVC表中保存TVC1-3的标识、TNP1的IP地址和TNP3的IP地址之间的对应关系。例如，头端edge1在TVC表中创建一条表项，表项的内容包括ID：TVC1-3；目的站点：汇聚站点；源TNP的IP地址：IP1；目的TNP的IP地址：IP3。头端edge1根据TVC1-3，查询TVC表TVC1-3对应的源TNP的IP地址和目的TNP的IP地址，从而得到IP1和IP3。
步骤(4)中间节点edge3接收到头端edge1发送的报文后，中间节点edge3从SRH头中 获得SL字段指示的栈顶SID(即SID 302)。中间节点edge3根据SID 302查询本地SID表，找到本地SID表中SID 302对应的端点行为是End.X-SD-WAN，且SID 302对应的发送隧道为TVC3-2。中间节点edge3根据TVC3-2封装信息同时修改报文的源IP和报文的目的IP。中间节点edge3将修改后的报文通过TVC3-2对应的物理链路转发给尾端edge2。
步骤(5)尾端edge2接收到中间节点edge3发送的报文。尾端edge2根据报文中SRH剩余的VPN SID10000查找本地SID表，确定VPN SID10000命中到End.DT4 SID。尾端edge2对报文进行SR隧道解封装处理，去掉报文中的SRH和外层的IPv6报文头。尾端edge2根据内层报文的目的IP地址(10.1.1.1)查对应的VPN实例私网路由后发送给主机Z。这样实现了A->edge1->edge3->edge2->Z的端到端SR转发路径控制。
实例1针对的是IPv6underlay传输网络上如何构建SD-WAN SRv6隧道。当underlay传输网络是IPv4网络时，需要对隧道封装做进一步改造，实现一种SD-WAN SRv4隧道技术。其中SD-WAN SRv4隧道封装包括多种类型(如GRE/VXLAN等)，下面以GRE为例描述一种业务引流入SD-WAN SRv4隧道及转发的方法，详见实例2。
实例2
实例2是本申请实施例提供的一种基于GRE实现业务引流入SD-WAN SRv4隧道及转发的方法。图13示出了实例2的流程图。如图13所示，实例2包括步骤(1)至步骤(5)。
实例2的步骤(1)和步骤(2)可参考实例1的步骤(1)和步骤(2)，相区别的是，edge设备在生成TVC时，edge设备根据TNP类型是IPv4 GRE，定义TVC封装类型为SRv4-GRE。此外，如果TNP类型是IPv4 VXLAN，则edge设备定义TVC封装类型为SRv4-VXLAN。
步骤(3)头端edge1在收到用户A(10.2.1.1)发送到总部站点用户Z(10.1.1.1)的流量时头端edge1根据栈顶的SID 103匹配本地SID表，找到SID 103对应的出接口为TVC1-3。头端edge1根据TVC1-3对应的TVC封装类型为SRv4-GRE，向数据报文添加GRE头和SRH，将封装了GRE头和SRH的报文通过TVC1-3对应的接口发送至中间节点edge3。
步骤(4)中间节点edge3收到该报文后，中间节点edge3解封装SRv4-GRE隧道头。中间节点edge3根据GRE中载荷协议字段识别出SRH头，然后中间节点edge3从SRH中获得SL字段指示的栈顶SID 302。中间节点edge3根据SID 302查本地SID表，找到SID 302对应的端点行为是End.X-SD-WAN且指定发送隧道为TVC3-2。中间节点edge3根据TVC3-2封装信息向报文封装SRv4-GRE隧道头。
步骤(5)尾端edge2收到该报文，尾端edge2解封装SRv4-GRE隧道头，根据SRH剩余的VPN SID查找本地SID表命中到End.DT4 SID。尾端edge2去掉SRH和GRE报文头。尾端edge2根据内层报文IP(10.1.1.1)查对应的VPN实例私网路由后发送给主机Z。这样实现了A->edge1->edge3->edge2->Z的端到端SR转发路径控制。
当SD-WAN的underlay传输网络由多个分别支持IPv4或IPv6的不同区域网络组成时，通过实例1和实例2描述的方法，能够组合实现端到端的异构SD-WAN overlay SR隧道，下面通过实例3进行具体介绍。
实例3
实例3是本实施例提供的一种SD-WAN SRv6和SRv4混合隧道转发的方法。
图14示出了实例3的流程图。实例3包括步骤(1)至步骤(5)。实例3的步骤(1)至步骤(5)可参考实例1、实例2的步骤(1)至步骤(5)。相区别的是，实例3在步骤(3)中，中间节点edge3会采用以下实现方式(1)或实现方式(2)进行SRv6隧道和SRv4隧道封装格式的转换。
实现方式(1)中间节点edge3进行从SRv6隧道至SRv4隧道的封装格式转换。具体地，中间节点edge3收到edge1发送的报文，中间节点edge3解封装SRv6隧道头，中间节点edge3从SRH中获得SL字段指示的栈顶SID(SID 302)。中间节点edge3根据SID 302查本地SID表，找到SID 302对应的端点行为是End.X-SD-WAN，且SID 302对应的发送隧道为TVC3-2。中间节点edge3根据TVC3-2封装信息封装SRv4-GRE隧道头。
实现方式(2)中间节点edge3进行从SRv4隧道至SRv6隧道的封装格式转换。具体地，如果中间节点edge3收到edge2发送的报文，中间节点edge3解封装SRv4-GRE隧道头，中间节点edge3从SRH中获得SL字段指示的栈顶SID(SID 301)。中间节点edge3根据SID301查本地SID表，找到SID 301对应的端点行为是End.X-SD-WAN，且SID 301对应的发送隧道为TVC3-1。中间节点edge3根据TVC3-1封装信息封装SRv6隧道头。
实例1至实例3描述了如何将三层(L3)VPNv4流量承载在SD-WAN SR隧道上。本申请实施例还支持L3 VPNv4之外的其它VPN业务如L3VPNv6、二层VNP(L2VPN)等承载在SD-WAN SR隧道上。下面通过实例4描述将L3VPNv6流量承载在SD-WAN SR隧道上的实现方式，通过实例5描述将L2VPN流量承载在SD-WAN SR隧道上的实现方式。
实例4
实例4是本申请实施例提供的一种通过SD-WAN SR隧道转发L3 VPNv6流量的方法。图15示出了实例4的示意图。如图15所示，对于控制面路由发布的流程而言，在实例1的基础上通过BGP EVPN传递IPv6用户的私网路由，使用包含IPv6用户的私网路由中的颜色和下一跳来选择迭代到SD-WAN SR隧道上，从而实现IPv6L3VPN流量承载在SD-WAN SR隧道上转发。具体地，如图15所示，在步骤(1)中，edge2发布的EVPN私网路由为IPv6路由。EVPN私网路由携带的前缀为IPv6前缀，例如为FC00:1:1::/64。对于转发面转发报文的流程而言，L3VPNv6场景中报文封装格式与L3VPNv4场景中报文封装格式的主要区别是内层的数据报文中IP头是IPv6头。具体地，如图15所示，用户A向edge1发送的数据报文为IPv6报文。用户A发送的数据报文中的IP头为IPv6头，用户A发送的数据报文中的IP头中携带的源地址为用户A的IPv6地址，例如为FC00:2:1::1。用户A发送的数据报文中的IP头中携带的目的地址为用户Z的IPv6地址，例如为FC00:1:1::1。
实例5
实例5是本申请实施例提供的一种通过SD-WAN SR隧道转发L2VPN流量的方法。图16示出了实例5的示意图。
如图16所示，在实例1的基础上，在步骤(1)中，通过BGP EVPN传递以太网自动发现路由(ethernet auto-discovery，Ethernet AD)路由、MAC路由通告(advertisement route)路由、集成多播路由(inclusive multicast route)路由、以太网段(ethernet segment，ES)路由等，使用颜色和下一跳来选择迭代到SD-WAN SR隧道上，从而实现L2VPN流量承载在SD- WAN SR隧道上转发。具体地，如图16所示，在步骤(1)中，edge2发布的EVPN私网路由为EVPN MAC路由。edge2发布的EVPN私网路由携带的前缀包括MAC地址，例如为用户Z的MAC地址(MAC2)。对于转发面转发报文的流程而言，L2VPN场景中报文封装格式与L3VPN场景中报文封装格式的主要区别是内层数据报文包括以太头被整体封装在隧道里面。
总结上述各个实施例可见，本申请的实施例带来的有益效果包括而不限于以下(1)至(3)。
(1)本实施例提供的SR隧道技术只需要underlay网络提供WAN链路IP的路由可达性，无需underlay网络设备运行支持SR-MPLS的IGP协议或者支持SRv6的IGP协议。underlay网络和overlay网络解耦，协议部署简单，能适应各种传输网络类型，如支持在Internet等IP公共网络上建立overlay SR隧道。
(2)现有SRv6隧道技术中外层IP头中源IP地址在头端设备上指定，源IP地址在中间网络转发时不会变更。如果隧道要跨越多个不同路由域的underlay传输网络，有可能由于URPF检查不通过导致报文被丢弃。图17示出了SD-WAN网络中跨越多域转发SR报文的示意图。如图17所示，中间节点edge3通过传输网络1连接edge1，通过传输网络2连接edge2。中间节点edge3接收到edge1发送的报文，报文的源IP地址是IP1(edge1上TNP1的IP地址)。如果中间节点edge3保持报文的源IP地址不变，即，中间节点edge3向edge2发送的报文的源IP地址仍是IP1。当报文到了edge3与edge2之间的传输网络2时，传输网络2中的网络设备会因为查不到IP1的路由，导致报文URPF检查无法通过，因此传输网络2中的网络设备会丢弃报文。而本实施例中，由于中间节点会根据每段TVC信息重新变更SR隧道报文的源IP地址，解决了跨域隧道URPF检查的问题。例如，如图17所示，中间节点edge3接收到的报文的源IP地址是IP1，中间节点edge3发送出去的报文的源IP地址刷新成了IP4(中间节点edge3上TNP4的地址)。
(3)现有的SRv6隧道技术只能在支持IPv6路由转发的传输网络上建立隧道，而本实施例的SD-WAN SR隧道和底层underlay传输网络协议无关，能支持underlay网络是IPv6网络的情况，也能支持underlay网络是IPv4网络的情况，甚至支持跨越IPv4和IPv6异构的传输网络建立端到端的SR隧道。
综上，本实施例提供的SD-WAN SR隧道方法，只需要相关的SD-WAN edge设备支持BGP EVPN、BGP LS、BGP SR等必要协议，而underlay网络整体当做一个黑盒IP转发网络，underlay网络中设备无需为建立SR而运行OSPFv3/ISISv6等额外IGP for SR扩展协议。因此，本实施例提供的方法可以称为是underlay传输网络协议无关的overlay SR方法。
图18是本申请实施例提供的一种网络设备610的结构示意图。网络设备610包括接收单元611、处理单元612和发送单元613。
可选地，结合图1所示的应用场景来看，图18所示的网络设备610是图1中的网络设备202或者网络设备204。
可选地，结合图2所示的应用场景来看，图18所示的网络设备610是图2中的edge设备406。
可选地，结合图3所示的应用场景来看，图18所示的网络设备610是图3中的POP GW502。
可选地，结合图4来看，图18所示的网络设备610是图4所示方法流程中的网络设备b。接收单元611用于支持网络设备610执行S602。处理单元612用于支持网络设备610执行S603。发送单元613用于支持网络设备610执行S604。
可选地，结合图7来看，图18所示的网络设备610是图7中的edge3。
可选地，结合图8来看，图18所示的网络设备610是图8中的edge3。
可选地，结合图9来看，图18所示的网络设备610是图9中的edge3。
可选地，结合图10来看，图18所示的网络设备610是图10中的edge3。
可选地，结合图11来看，图18所示的网络设备610是图11中的edge3。
可选地，结合图12来看，图18所示的网络设备610是图12中的edge3。
可选地，结合图13来看，图18所示的网络设备610是图13中的edge3。
可选地，结合图14来看，图18所示的网络设备610是图14中的edge3。
可选地，结合图15来看，图18所示的网络设备610是图15中的edge3。
可选地，结合图16来看，图18所示的网络设备610是图16中的edge3。
图18所描述的装置实施例仅仅是示意性的，例如，上述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
网络设备610中的各个单元全部或部分地通过软件、硬件、固件或者其任意组合来实现。
在采用软件实现的情况下，例如，上述处理单元612是由图20中的至少一个处理器801读取存储器802中存储的程序代码后，生成的软件功能单元来实现。又如，上述处理单元612是由图21中主控板910上的中央处理器911读取存储器912中存储的程序代码后，生成的软件功能单元来实现。
在采用硬件实现的情况下，例如，图18中上述各个单元由网络设备中的不同硬件分别实现，例如处理单元612由图20中的至少一个处理器801中的一部分处理资源(例如多核处理器中的一个核或两个核)实现，或者处理单元612采用现场可编程门阵列(field－programmable gate array，FPGA)、或协处理器等可编程器件来完成。例如，接收单元611和发送单元613由图20中的网络接口803实现。又如，接收单元611和发送单元613由图21中的物理接口卡933实现。
图19是本申请实施例提供的一种控制器设备710的结构示意图，控制器设备710包括获取单元711、处理单元712和发送单元713。
可选地，结合图1所示的应用场景来看，图19所示的控制器设备710是图1中的控制器设备11。
可选地，结合图2所示的应用场景来看，图19所示的控制器设备710是图2中的SD-WAN控制器490。
可选地，结合图3所示的应用场景来看，图19所示的控制器设备710是图3中的SD-WAN控制器590。
可选地，结合图6来看，图19所示的控制器设备710是图6所示方法流程中的控制器设 备。获取单元711用于支持控制器设备710执行S702。处理单元712用于支持控制器设备710执行S703。发送单元713用于支持控制器设备710执行S704。
可选地，结合图7来看，图19所示的控制器设备710是图7中的SD-WAN控制器。
可选地，结合图9来看，图19所示的控制器设备710是图9中的SD-WAN控制器。
可选地，结合图10来看，图19所示的控制器设备710是图10中的SD-WAN控制器。
可选地，结合图11来看，图19所示的控制器设备710是图11中的SD-WAN控制器。
图19所描述的装置实施例仅仅是示意性的，例如，上述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
控制器设备710中的各个单元全部或部分地通过软件、硬件、固件或者其任意组合来实现。
在采用软件实现的情况下，例如，上述处理单元712是由图20中的至少一个处理器801读取存储器802中存储的程序代码后，生成的软件功能单元来实现。
在采用硬件实现的情况下，例如，图19中上述各个单元由控制器设备中的不同硬件分别实现，例如处理单元712由图20中的至少一个处理器801中的一部分处理资源(例如多核处理器中的一个核或两个核)实现，或者处理单元712或者采用现场可编程门阵列(field－programmable gate array，FPGA)、或协处理器等可编程器件来完成。例如，获取单元711和发送单元713由图20中的网络接口803实现。又如，获取单元711和发送单元713由图21中的物理接口卡933实现。
下面对网络设备以及控制器设备的基本硬件结构举例说明。
图20是本申请实施例提供的一种设备800的结构示意图，图20所示的设备800可以提供为网络设备或者控制器设备。设备800包括至少一个处理器801、存储器802以及至少一个网络接口803。
可选地，结合图1所示的应用场景来看，图20所示的设备800是图1中的网络设备202或者网络设备204或者控制器设备11。
可选地，结合图2所示的应用场景来看，图20所示的设备800是图2中的edge设备406或者SD-WAN控制器490。
可选地，结合图3所示的应用场景来看，图20所示的设备800是图3中的POP GW 502或者SD-WAN控制器590。
可选地，结合图4来看，图20所示的设备800是图4所示方法流程中的网络设备b。网络接口803用于支持设备800执行S602和S604。处理器801用于支持设备800执行S603。
可选地，结合图6来看，图20所示的设备800是图6所示方法流程中的SD-WAN控制器。网络接口803用于支持设备800执行S702和S704。处理器801用于支持设备800执行S703。
可选地，结合图7来看，图20所示的设备800是图7中的edge3或者SD-WAN控制器。
可选地，结合图8来看，图20所示的设备800是图8中的edge3。
可选地，结合图9来看，图20所示的设备800是图9中的edge3或者SD-WAN控制器。
可选地，结合图10来看，图20所示的设备800是图10中的edge3或者SD-WAN控制器。
可选地，结合图11来看，图20所示的设备800是图11中的edge3或者SD-WAN控制器。
可选地，结合图12来看，图20所示的设备800是图12中的edge3。
可选地，结合图13来看，图20所示的设备800是图13中的edge3。
可选地，结合图14来看，图20所示的设备800是图14中的edge3。
可选地，结合图15来看，图20所示的设备800是图15中的edge3。
可选地，结合图16来看，图20所示的设备800是图16中的edge3。
处理器801例如是通用中央处理器(central processing unit，CPU)、网络处理器(network processer，NP)、图形处理器(graphics processing unit，GPU)、神经网络处理器(neural-network processing units，NPU)、数据处理单元(data processing unit，DPU)、微处理器或者一个或多个用于实现本申请方案的集成电路。例如，处理器801包括专用集成电路(application-specific integrated circuit，ASIC)，可编程逻辑器件(programmable logic device，PLD)或其组合。PLD例如是复杂可编程逻辑器件(complex programmable logic device，CPLD)、现场可编程逻辑门阵列(field-programmable gate array，FPGA)、通用阵列逻辑(generic array logic，GAL)或其任意组合。
存储器802例如是只读存储器(read-only memory，ROM)或可存储静态信息和指令的其它类型的静态存储设备，又如是随机存取存储器(random access memory，RAM)或者可存储信息和指令的其它类型的动态存储设备，又如是电可擦可编程只读存储器(electrically erasable programmable read-only Memory，EEPROM)、只读光盘(compact disc read-only memory，CD-ROM)或其它光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘存储介质或者其它磁存储设备，或者是能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其它介质，但不限于此。可选地，存储器802独立存在，并通过内部连接804与处理器801相连接。或者，可选地存储器802和处理器801集成在一起。
网络接口803使用任何收发器一类的装置，用于与其它设备或通信网络通信。网络接口803例如包括有线网络接口或者无线网络接口中的至少一项。其中，有线网络接口例如为以太网接口。以太网接口例如是光接口，电接口或其组合。无线网络接口例如为无线局域网(wireless local area networks，WLAN)接口，蜂窝网络网络接口或其组合等。
在一些实施例中，处理器801包括一个或多个CPU，如图20中所示的CPU0和CPU1。
在一些实施例中，设备800可选地包括多个处理器，如图20中所示的处理器801和处理器805。这些处理器中的每一个例如是一个单核处理器(single-CPU)，又如是一个多核处理器(multi-CPU)。这里的处理器可选地指一个或多个设备、电路、和/或用于处理数据(如计算机程序指令)的处理核。
在一些实施例中，设备800还包括内部连接804。处理器801、存储器802以及至少一个网络接口803通过内部连接804连接。内部连接804包括通路，在上述组件之间传送信息。可选地，内部连接804是单板或总线。可选地，内部连接804分为地址总线、数据总线、控 制总线等。
在一些实施例中，设备800还包括输入输出接口806。输入输出接口806连接到内部连接804上。
可选地，处理器801通过读取存储器802中保存的程序代码810实现上述实施例中的方法，或者，处理器801通过内部存储的程序代码实现上述实施例中的方法。在处理器801通过读取存储器802中保存的程序代码810实现上述实施例中的方法的情况下，存储器802中保存实现本申请实施例提供的方法的程序代码。
处理器801实现上述功能的更多细节请参考前面各个方法实施例中的描述，在这里不再重复。
参见图21，图21是本申请实施例提供的一种设备900的结构示意图。图21所示的设备900可以提供为网络设备或者控制器设备。设备900包括：主控板910和接口板930。
可选地，结合图1所示的应用场景来看，图21所示的设备900是图1中的网络设备202或者网络设备204或者控制器设备11。
可选地，结合图2所示的应用场景来看，图21所示的设备900是图2中的edge设备406或者SD-WAN控制器490。
可选地，结合图3所示的应用场景来看，图21所示的设备900是图3中的POP GW 502或者SD-WAN控制器590。
可选地，结合图4来看，图21所示的设备900是图4所示方法流程中的网络设备b。接口板930上物理接口卡933用于支持设备800执行S602和S604。接口板930上的网络处理器932以及主控板910上的中央处理器911用于支持设备800执行S603。
可选地，结合图6来看，图21所示的设备900是图6所示方法流程中的SD-WAN控制器。接口板930上物理接口卡933于支持设备800执行S702和S704。主控板910上的中央处理器911用于支持设备800执行S703。
可选地，结合图7来看，图21所示的设备900是图7中的edge3或者SD-WAN控制器。
可选地，结合图8来看，图21所示的设备900是图8中的edge3。
可选地，结合图9来看，图21所示的设备900是图9中的edge3或者SD-WAN控制器。
可选地，结合图10来看，图21所示的设备900是图10中的edge3或者SD-WAN控制器。
可选地，结合图11来看，图21所示的设备900是图11中的edge3或者SD-WAN控制器。
可选地，结合图12来看，图21所示的设备900是图12中的edge3。
可选地，结合图13来看，图21所示的设备900是图13中的edge3。
可选地，结合图14来看，图21所示的设备900是图14中的edge3。
可选地，结合图15来看，图21所示的设备900是图15中的edge3。
可选地，结合图16来看，图21所示的设备900是图16中的edge3。
主控板也称为主处理单元(main processing unit，MPU)或路由处理卡(route processor card)，主控板910用于对设备900中各个组件的控制和管理，包括路由计算、设备管理、设备维护、协议处理功能。主控板910包括：中央处理器911和存储器912。
接口板930也称为线路接口单元卡(line processing unit，LPU)、线卡(line card)或业务板。接口板930用于提供各种业务接口并实现数据包的转发。业务接口包括而不限于以太网接口、POS(packet over sONET/SDH)接口等，以太网接口例如是灵活以太网业务接口(flexible ethernet clients，FlexE clients)。接口板930包括：中央处理器931、网络处理器932、转发表项存储器934和物理接口卡(physical interface card，PIC)933。
接口板930上的中央处理器931用于对接口板930进行控制管理并与主控板910上的中央处理器911进行通信。
网络处理器932用于实现报文的转发处理。网络处理器932的形态例如是转发芯片。具体而言，网络处理器932用于基于转发表项存储器934保存的转发表转发接收到的报文，如果报文的目的地址为设备900的地址，则将该报文上送至CPU(如中央处理器911)处理；如果报文的目的地址不是设备900的地址，则根据该目的地址从转发表中查找到该目的地址对应的下一跳和出接口，将该报文转发到该目的地址对应的出接口。其中，上行报文的处理包括：报文入接口的处理，转发表查找；下行报文的处理：转发表查找等等。
物理接口卡933用于实现物理层的对接功能，原始的流量由此进入接口板930，以及处理后的报文从该物理接口卡933发出。物理接口卡933也称为子卡，可安装在接口板930上，负责将光电信号转换为报文并对报文进行合法性检查后转发给网络处理器932处理。在一些实施例中，中央处理器也可执行网络处理器932的功能，比如基于通用CPU实现软件转发，从而物理接口卡933中不需要网络处理器932。
可选地，设备900包括多个接口板，例如设备900还包括接口板940，接口板940包括：中央处理器941、网络处理器942、转发表项存储器944和物理接口卡943。
可选地，设备900还包括交换网板920。交换网板920也例如称为交换网板单元(switch fabric unit，SFU)。在网络设备有多个接口板930的情况下，交换网板920用于完成各接口板之间的数据交换。例如，接口板930和接口板940之间例如通过交换网板920通信。
主控板910和接口板930耦合。例如。主控板910、接口板930和接口板940，以及交换网板920之间通过系统总线与系统背板相连实现互通。在一种可能的实现方式中，主控板910和接口板930之间建立进程间通信协议(inter-process communication，IPC)通道，主控板910和接口板930之间通过IPC通道进行通信。
在逻辑上，设备900包括控制面和转发面，控制面包括主控板910和中央处理器931，转发面包括执行转发的各个组件，比如转发表项存储器934、物理接口卡933和网络处理器932。控制面执行路由器、生成转发表、处理信令和协议报文、配置与维护设备的状态等功能，控制面将生成的转发表下发给转发面，在转发面，网络处理器932基于控制面下发的转发表对物理接口卡933收到的报文查表转发。控制面下发的转发表例如保存在转发表项存储器934中。在有些实施例中，控制面和转发面例如完全分离，不在同一设备上。
接口板940上的操作与接口板930的操作一致，为了简洁，不再赘述接口板940的操作。
本实施例的设备900可对应于上述各个方法实施例中的网络设备或者控制器设备，该设备900中的主控板910、接口板930和/或940例如实现上述各个方法实施例中网络设备或者控制器设备所具有的功能和/或所实施的各种步骤，为了简洁，在此不再赘述。
值得说明的是，主控板可能有一块或多块，有多块的时候例如包括主用主控板和备用主控板。接口板可能有一块或多块，网络设备的数据处理能力越强，提供的接口板越多。接口 板上的物理接口卡也可以有一块或多块。交换网板可能没有，也可能有一块或多块，有多块的时候可以共同实现负荷分担冗余备份。在集中式转发架构下，网络设备可以不需要交换网板，接口板承担整个系统的业务数据的处理功能。在分布式转发架构下，网络设备可以有至少一块交换网板，通过交换网板实现多块接口板之间的数据交换，提供大容量的数据交换和处理能力。所以，分布式架构的网络设备的数据接入和处理能力要大于集中式架构的设备。可选地，网络设备的形态也可以是只有一块板卡，即没有交换网板，接口板和主控板的功能集成在该一块板卡上，此时接口板上的中央处理器和主控板上的中央处理器在该一块板卡上可以合并为一个中央处理器，执行两者叠加后的功能，这种形态设备的数据交换和处理能力较低(例如，低端交换机或路由器等网络设备)。具体采用哪种架构，取决于具体的组网部署场景，此处不做任何限定。
本说明书中的各个实施例均采用递进的方式描述，各个实施例之间相同相似的部分可互相参考，每个实施例重点说明的都是与其他实施例的不同之处。
本文中所使用的术语“和/或”是指并且涵盖相关联的所列出的项目中的一个或多个项目的任何和全部可能的组合。术语“和/或”，是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。另外，本申请中的字符“/”，一般表示前后关联对象是一种“或”的关系。
A参考B，指的是A与B相同或者A为B的简单变形。
本申请实施例的说明书和权利要求书中的术语“第一”和“第二”等是用于区别不同的对象，而不是用于描述对象的特定顺序，也不能理解为指示或暗示相对重要性。例如，第一连接和第二连接用于区别不同的连接，而不是用于描述连接的特定顺序，也不能理解为第一连接比第二连接更重要。
本申请实施例，除非另有说明，“至少一个”的含义是指一个或多个，“多个”的含义是指两个或两个以上。例如，多个连接是指两个或两个以上的连接。
上述实施例可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本申请实施例描述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质(例如固态硬盘Solid State Disk(SSD))等。
以上实施例仅用以说明本申请的技术方案，而非对其限制；尽管参照前述实施例对本申请进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不 使相应技术方案的本质脱离本申请各实施例技术方案的范围。

Claims (30)

  1. 一种报文处理方法，其特征在于，所述方法包括：
    第一网络设备接收来自第二网络设备的第一报文，所述第一报文的互联网协议IP地址包括第一连接的端点IP地址，所述第一报文包括段标识SID，所述SID指示第二连接，所述第一连接为从所述第二网络设备至所述第一网络设备的连接，所述第二连接为从所述第一网络设备至第三网络设备的连接；
    所述第一网络设备处理所述第一报文，以得到第二报文，所述第二报文的源IP地址为所述第二连接的端点IP地址中属于所述第一网络设备的IP地址，所述第二报文的目的IP地址为所述第二连接的端点IP地址中属于所述第三网络设备的IP地址；
    所述第一网络设备向所述第三网络设备发送所述第二报文。
  2. 根据权利要求1所述的方法，其特征在于，
    所述第一连接的端点IP地址为互联网协议第6版IPv6地址，所述第一报文包括段路由头SRH，所述SID位于所述SRH中。
  3. 根据权利要求1所述的方法，其特征在于，
    所述第一连接的端点IP地址为互联网协议第4版IPv4地址，所述第一报文包括SRH，所述SID位于所述SRH中。
  4. 根据权利要求3所述的方法，其特征在于，所述第一连接的端点IP地址位于所述第一报文的IPv4头中，所述第一报文包括SRH对应的协议类型，所述协议类型位于所述第一报文的通用路由封装GRE头中，或者所述协议类型位于所述第一报文的虚拟扩展局域网VXLAN头中，或者所述协议类型位于所述第一报文的IPv4头中。
  5. 根据权利要求1至4中任一项所述的方法，其特征在于，所述第二连接的端点IP地址为IPv6地址或者IPv4地址。
  6. 根据权利要求1至5中任一项所述的方法，其特征在于，所述第一连接和/或所述第二连接的端点IP地址是下层underlay网络运营商分配的广域网WAN接口的IP地址。
  7. 根据权利要求1至6中任一项所述的方法，其特征在于，所述第一连接和/或所述第二连接是不同站点之间的连接。
  8. 根据权利要求1至7中任一项所述的方法，其特征在于，所述第一网络设备接收来自第二网络设备的第一报文之前，所述方法还包括：
    所述第一网络设备向控制器设备发送所述第二连接的端点IP地址和/或所述第一连接的端点IP地址。
  9. 根据权利要求8所述的方法，其特征在于，所述第一网络设备向控制器设备发送所述第二连接的端点IP地址和/或所述第一连接的端点IP地址，包括：
    所述第一网络设备生成边界网关协议-链路状态BGP-LS报文，所述BGP-LS报文包括所述第二连接的端点IP地址和/或所述第一连接的端点IP地址，所述BGP-LS报文还包括软件定义广域网SD-WAN协议的标识；
    所述第一网络设备向所述控制器设备发送所述BGP-LS报文。
  10. 根据权利要求1至9中任一项所述的方法，其特征在于，所述第一网络设备接收来自第二网络设备的第一报文之前，所述方法还包括以下至少一项：
    所述第一网络设备向控制器设备发送所述第一网络设备所在的站点的标识；或者，
    所述第一网络设备向控制器设备发送所述第一连接和/或所述第二连接的通断状态；或者，
    所述第一网络设备向控制器设备发送所述第一连接和/或所述第二连接的服务等级协议SLA信息。
  11. 根据权利要求1至10中任一项所述的方法，其特征在于，所述第一网络设备接收来自第二网络设备的第一报文之前，所述方法还包括：
    所述第一网络设备接收来自控制器设备的所述SID。
  12. 一种路径确定方法，其特征在于，所述方法包括：
    控制器设备获取多个连接的端点IP地址；
    所述控制器设备根据所述多个连接的端点IP地址，确定段路由SR路径，所述SR路径包括所述多个连接中第一连接和第二连接，所述第一连接为从所述第一网络设备至第二网络设备的连接，所述第二连接为从所述第二网络设备至第三网络设备的连接；
    所述控制器设备向所述第一网络设备发送SR策略，所述SR策略指示所述SR路径。
  13. 根据权利要求12所述的方法，其特征在于，所述SR策略包括第一SID，所述第一SID指示所述第二连接。
  14. 根据权利要求12或13所述的方法，其特征在于，所述方法还包括：
    所述控制器设备为所述第二连接分配所述第一SID，并为所述第一连接分配第二SID，所述第一SID指示所述第二连接，所述第二SID指示所述第一连接；
    所述控制器设备向所述第二网络设备发送所述第一SID，并向所述第一网络设备发送所述第二SID。
  15. 根据权利要求12至14中任一项所述的方法，其特征在于，所述多个连接中每个连接为不同站点之间的连接，所述控制器设备根据所述多个连接的端点IP地址，确定SR路径，包括：
    所述控制器设备根据所述多个连接的端点IP地址，以站点为路径编排对象确定SR路径。
  16. 根据权利要求12至15中任一项所述的方法，其特征在于，所述控制器设备获取多个连接的端点IP地址包括：
    所述控制器设备接收所述第一网络设备或所述第二网络设备发送的所述第一连接的端点IP地址。
  17. 一种网络设备，其特征在于，所述网络设备为第一网络设备，所述网络设备包括：
    接收单元，用于接收来自第二网络设备的第一报文，所述第一报文的互联网协议IP地址包括第一连接的端点IP地址，所述第一报文包括段标识SID，所述SID指示第二连接，所述第一连接为从所述第二网络设备至所述第一网络设备的连接，所述第二连接为从所述第一网络设备至第三网络设备的连接；
    处理单元，用于处理所述第一报文，以得到第二报文，所述第二报文的源IP地址为所述第二连接的端点IP地址中属于所述第一网络设备的IP地址，所述第二报文的目的IP地址为所述第二连接的端点IP地址中属于所述第三网络设备的IP地址；
    发送单元，用于向所述第三网络设备发送所述第二报文。
  18. 根据权利要求17所述的网络设备，其特征在于，所述发送单元，还用于向控制器设备发送所述第二连接的端点IP地址和/或所述第一连接的端点IP地址。
  19. 根据权利要求18所述的网络设备，其特征在于，所述处理单元，还用于生成边界网关协议-链路状态BGP-LS报文，所述BGP-LS报文包括所述第二连接的端点IP地址和/或所述第一连接的端点IP地址，所述BGP-LS报文还包括软件定义广域网SD-WAN协议的标识；
    所述发送单元，用于向所述控制器设备发送所述BGP-LS报文。
  20. 根据权利要求17至19中任一项所述的网络设备，其特征在于，所述发送单元，还用于执行以下至少一项：
    向控制器设备发送所述第一网络设备所在的站点的标识；或者，
    向控制器设备发送所述第一连接和/或所述第二连接的通断状态；或者，
    向控制器设备发送所述第一连接和/或所述第二连接的服务等级协议SLA信息。
  21. 根据权利要求17至20中任一项所述的网络设备，其特征在于，
    所述接收单元，还用于接收来自控制器设备的所述SID。
  22. 一种控制器设备，其特征在于，所述控制器设备包括：
    获取单元，用于获取多个连接的端点IP地址；
    处理单元，用于根据所述多个连接的端点IP地址，确定段路由SR路径，所述SR路径包括所述多个连接中第一连接和第二连接，所述第一连接为从所述第一网络设备至第二网络设备的连接，所述第二连接为从所述第二网络设备至第三网络设备的连接；
    发送单元，用于向所述第一网络设备发送SR策略，所述SR策略指示所述SR路径。
  23. 根据权利要求22所述的控制器设备，其特征在于，所述处理单元，还用于为所述第二连接分配所述第一SID，并为所述第一连接分配第二SID，所述第一SID指示所述第二连接，所述第二SID指示所述第一连接；
    所述发送单元，还用于向所述第二网络设备发送所述第一SID，并向所述第一网络设备发送所述第二SID。
  24. 根据权利要求22或23所述的控制器设备，其特征在于，所述多个连接中每个连接为不同站点之间的连接，所述处理单元，用于根据所述多个连接的端点IP地址，以站点为路径编排对象确定SR路径。
  25. 根据权利要求22至24中任一项所述的控制器设备，其特征在于，所述获取单元，用于接收所述第一网络设备或所述第二网络设备发送的所述第一连接的端点IP地址。
  26. 一种网络系统，其特征在于，所述系统包括如权利要求17至21中任一项所述的网络设备以及如权利要求22至25中任一项所述的控制器设备。
  27. 一种计算机可读存储介质，其特征在于，所述存储介质中存储有至少一条计算机程序指令，所述计算机程序指令在计算机上运行时，使得计算机执行如权利要求1至权利要求16中任一项所述的方法。
  28. 一种计算机程序产品，其特征在于，所述计算机程序产品包括一个或多个计算机程序指令，当所述计算机程序指令被计算机加载并运行时，使得所述计算机执行权利要求1至权利要求16中任一项所述的方法。
  29. 一种网络设备，其特征在于，所述网络设备包括：处理器，所述处理器与存储器耦合，所述存储器中存储有至少一条计算机程序指令，所述至少一条计算机程序指令由所述处理器加载并执行，以使所述网络设备实现权利要求1-11中任一项所述的方法。
  30. 一种控制器设备，其特征在于，所述控制器设备包括：处理器，所述处理器与存储器耦合，所述存储器中存储有至少一条计算机程序指令，所述至少一条计算机程序指令由所述处理器加载并执行，以使所述控制器设备实现权利要求12-16中任一项所述的方法。
PCT/CN2022/119639 2021-09-23 2022-09-19 报文处理方法、网络设备及系统 WO2023045871A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202111115406.0A CN115865769A (zh) 2021-09-23 2021-09-23 报文处理方法、网络设备及系统
CN202111115406.0 2021-09-23

Publications (1)

Publication Number Publication Date
WO2023045871A1 true WO2023045871A1 (zh) 2023-03-30

Family

ID=85652991

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/119639 WO2023045871A1 (zh) 2021-09-23 2022-09-19 报文处理方法、网络设备及系统

Country Status (2)

Country Link
CN (1) CN115865769A (zh)
WO (1) WO2023045871A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116915544A (zh) * 2023-08-12 2023-10-20 深圳市赛柏特通信技术有限公司 多控制域sd-wan网络的通信方法、装置及存储介质

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117478596B (zh) * 2023-12-26 2024-02-23 苏州元脑智能科技有限公司 一种sdn流量转发系统、设备及方法

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20170054626A1 (en) * 2015-08-21 2017-02-23 Cisco Technology, Inc. Distribution of segment identifiers in network functions virtualization and software defined network environments
CN110266594A (zh) * 2019-06-28 2019-09-20 Ut斯达康通讯有限公司 跨网络切片的分段路由转发方法及装置
CN110708243A (zh) * 2018-07-09 2020-01-17 华为技术有限公司 段路由中获取数据包的转发路径的信息的方法和装置
CN113079089A (zh) * 2020-01-03 2021-07-06 华为技术有限公司 业务链的故障保护方法、装置、设备、系统及存储介质
WO2021180077A1 (zh) * 2020-03-09 2021-09-16 中国移动通信有限公司研究院 路径建立方法、数据传输方法、装置、网络节点及存储介质

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20170054626A1 (en) * 2015-08-21 2017-02-23 Cisco Technology, Inc. Distribution of segment identifiers in network functions virtualization and software defined network environments
CN110708243A (zh) * 2018-07-09 2020-01-17 华为技术有限公司 段路由中获取数据包的转发路径的信息的方法和装置
CN110266594A (zh) * 2019-06-28 2019-09-20 Ut斯达康通讯有限公司 跨网络切片的分段路由转发方法及装置
CN113079089A (zh) * 2020-01-03 2021-07-06 华为技术有限公司 业务链的故障保护方法、装置、设备、系统及存储介质
WO2021180077A1 (zh) * 2020-03-09 2021-09-16 中国移动通信有限公司研究院 路径建立方法、数据传输方法、装置、网络节点及存储介质

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116915544A (zh) * 2023-08-12 2023-10-20 深圳市赛柏特通信技术有限公司 多控制域sd-wan网络的通信方法、装置及存储介质
CN116915544B (zh) * 2023-08-12 2024-06-11 深圳市赛柏特通信技术有限公司 多控制域sd-wan网络的通信方法、装置及存储介质

Also Published As

Publication number Publication date
CN115865769A (zh) 2023-03-28

Similar Documents

Publication Publication Date Title
US11700198B2 (en) Transmission control method, node, network system and storage medium
US10193812B2 (en) Multicast load balancing in multihoming EVPN networks
US10412019B2 (en) Path computation element central controllers (PCECCs) for network services
US10003531B2 (en) Method for establishing tunnel, method for allocating label, device and network system
US8068442B1 (en) Spanning tree protocol synchronization within virtual private networks
WO2023045871A1 (zh) 报文处理方法、网络设备及系统
US20150043348A1 (en) Traffic Flow Redirection between Border Routers using Routing Encapsulation
US20040174887A1 (en) Hybrid virtual private LAN extensions
CN112929273A (zh) 一种处理路由的方法、设备及系统
US11546254B2 (en) Method, node, and medium for establishing connection between a source and endpoint via one or more border nodes
CN109417508B (zh) 一种分层路径计算单元pce网络拓扑构建方法及装置
US20230300070A1 (en) Packet Sending Method, Device, and System
US11240063B2 (en) Methods, nodes and computer readable media for tunnel establishment per slice
US11362954B2 (en) Tunneling inter-domain stateless internet protocol multicast packets
CN113973027B (zh) 具有物理网络功能和虚拟化网络功能的服务链
WO2022110535A1 (zh) 一种报文发送方法、设备及系统
WO2023274083A1 (zh) 路由发布和转发报文的方法、装置、设备和存储介质
EP3396897B1 (en) Multicast load balancing in multihoming evpn networks
WO2023011149A1 (zh) 一种基于第6版互联网协议的段路由SRv6的通信方法
WO2021103744A1 (zh) 一种异构网络通信方法、系统和控制器
WO2024007762A1 (zh) 一种路由发布方法、通信方法及装置
WO2023236880A1 (zh) 一种报文控制方法以及相关装置
WO2024113867A1 (zh) 一种通信方法及装置
US20230336458A1 (en) Route Transmission Method and Apparatus
WO2023051179A1 (zh) 边界网关协议路由的接收、发送方法及装置和存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22871917

Country of ref document: EP

Kind code of ref document: A1

REG Reference to national code

Ref country code: BR

Ref legal event code: B01A

Ref document number: 112024005474

Country of ref document: BR

WWE Wipo information: entry into national phase

Ref document number: 2022871917

Country of ref document: EP

ENP Entry into the national phase

Ref document number: 2022871917

Country of ref document: EP

Effective date: 20240402

NENP Non-entry into the national phase

Ref country code: DE