WO2024099200A1 - 一种云服务的接入方法、平台、设备和存储介质 - Google Patents

一种云服务的接入方法、平台、设备和存储介质 Download PDF

Info

Publication number
WO2024099200A1
WO2024099200A1 PCT/CN2023/128819 CN2023128819W WO2024099200A1 WO 2024099200 A1 WO2024099200 A1 WO 2024099200A1 CN 2023128819 W CN2023128819 W CN 2023128819W WO 2024099200 A1 WO2024099200 A1 WO 2024099200A1
Authority
WO
WIPO (PCT)
Prior art keywords
service
controller
cloud
resource pool
tunnel
Prior art date
Application number
PCT/CN2023/128819
Other languages
English (en)
French (fr)
Inventor
闫兴安
费怡超
薛舒洋
谢佳
王燕
戴中华
齐骥
Original Assignee
中移(苏州)软件技术有限公司
中国移动通信集团有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中移(苏州)软件技术有限公司, 中国移动通信集团有限公司 filed Critical 中移(苏州)软件技术有限公司
Publication of WO2024099200A1 publication Critical patent/WO2024099200A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4633—Interconnection of networks using encapsulation techniques, e.g. tunneling
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4641—Virtual LANs, VLANs, e.g. virtual private networks [VPN]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/50—Routing or path finding of packets in data switching networks using label swapping, e.g. multi-protocol label switch [MPLS]

Definitions

  • the present application relates to the field of communication technology, and in particular to a cloud service access method, a software-defined wide area network access management platform, a software-defined wide area network access management device and a storage medium.
  • SD-WAN construction solutions (1) For SD-WAN service providers, they generally do not have their own cloud resource pools, and use cloud service providers’ cloud resources to deploy point-of-presence (PoP) and rent the network provided by cloud service providers to achieve inter-PoP connectivity; (2) For some cloud service providers, they choose to enter the cloud network through a hardware router at the cloud egress area to achieve tunnel access, and SD-WAN only serves as an access channel to the cloud; however, there is no corresponding technical solution for how to enter the cloud network.
  • PoP point-of-presence
  • the present application provides a method for accessing cloud services, which solves the problem in related technologies that there is no corresponding technical solution for how to enter the cloud network, realizes the setting of cloud-entering business flows, and provides a new type of cloud network service that integrates cloud resource pools and networks.
  • a cloud service access method is applied to a software-defined wide area network access management platform, the method comprising:
  • the service orchestrator When the user client CPE initiates a service request, the service orchestrator responds to the service request and obtains the configuration information corresponding to the service request;
  • the controller establishes a tunnel according to the configuration information, and connects the service request to the corresponding resource pool based on the tunnel.
  • a software-defined wide area network access management platform comprising:
  • the service orchestrator is used to respond to the service request initiated by the user client CPE. the service request, and obtaining configuration information corresponding to the service request;
  • the service arranger is used to send the configuration information to the controller
  • the controller is used to establish a tunnel according to the configuration information, and access the service request to a corresponding resource pool based on the tunnel.
  • a software-defined wide area network access management device comprising:
  • a memory for storing executable instructions
  • the processor is used to execute the executable instructions stored in the memory to implement the cloud service access method as described above.
  • a storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the steps of the cloud service access method as described above.
  • a cloud service access method provided by the present application obtains configuration information corresponding to the service request by responding to the service request through a service orchestrator when a user client initiates a service request; sends the configuration information to a controller through the service orchestrator; establishes a tunnel through the controller according to the configuration information, and connects the service request to the corresponding resource pool based on the tunnel; that is, the SD-WAN access management platform connects the service request initiated by the CPE to the corresponding resource pool through components such as the service orchestrator and the controller, realizes the setting of the service flow into the cloud, and provides a new cloud network service that integrates the cloud resource pool and the network.
  • FIG1 is a flow chart of a method for accessing a cloud service provided in an embodiment of the present application
  • FIG2 is a schematic diagram of a cloud PoP networking architecture diagram provided in an embodiment of the present application.
  • FIG3 is a schematic diagram of an SD-WAN cloud access system architecture diagram provided in an embodiment of the present application.
  • FIG4 is a second flow chart of a method for accessing a cloud service provided in an embodiment of the present application.
  • FIG5 is a schematic diagram of a CPE accessing a nearby local cloud VPC traffic diagram provided in an embodiment of the present application
  • FIG6 is a schematic diagram of the logical topology of a branch entering a local cloud provided in an embodiment of the present application
  • FIG7 is a schematic diagram of a customer network that needs to access a VPC in a remote resource pool according to an embodiment of the present application
  • FIG8 is a schematic diagram of a branch-into-cross-province cloud logical topology provided in an embodiment of the present application.
  • FIG9 is a schematic diagram of a process for activating a branch-to-cloud service according to an embodiment of the present application.
  • FIG10 is a schematic diagram of an allocation process provided in an embodiment of the present application.
  • FIG11 is a schematic diagram of the structure of an SD-WAN access management platform provided in an embodiment of the present application.
  • Figure 12 is a structural diagram of an SD-WAN cloud access device provided in an embodiment of the present application.
  • SD-WAN construction solutions There are two SD-WAN construction solutions in related technologies: (1) When SD-WAN cloud service providers enter the cloud, they generally need to deploy virtual client equipment (Virtual CPE, vCPE) in the customer's private network (Virtual Private Cloud, VPC) to achieve cloud access. This method requires customers to pay additional public Internet Protocol addresses (Internet Protocol Address, IP), bandwidth, and cloud host fees, which increases customer costs. If a high-availability solution is required, two sets of vCPE need to be deployed, further increasing customer costs. (2) Implementing the cloud access function through hardware routers in the cloud egress area is not conducive to rapid expansion.
  • Virtual CPE Virtual CPE
  • VPC Virtual Private Cloud
  • this application proposes a method for accessing cloud services. Based on the PoP networking solution deployed at the bottom layer of the public cloud, priority access to the entire network resource pool can be achieved. Furthermore, by forwarding through the high-quality Data Center Interconnect (DCI) network between clouds (hereinafter referred to as the cloud private network), the network quality of accessing the remote resource pool can be improved.
  • DCI Data Center Interconnect
  • the present application provides a cloud service access method, which is applied to an SD-WAN access management platform. As shown in FIG1 , the method includes the following steps:
  • Step 101 When a user client initiates a service request, the service orchestrator responds to the service request and obtains configuration information corresponding to the service request.
  • the SD-WAN access management platform i.e., the SD-WAN cloud access system
  • the SD-WAN access management platform includes the following parts: a business portal (Portal), a business orchestrator, and a controller.
  • the business portal provides users with an autonomous service platform page and provides operation and maintenance personnel with a centralized operation and maintenance management service page.
  • the business orchestrator connects to the controller to realize end-to-end automated service activation and management services, and provides business-level abstraction for the business portal.
  • the controller realizes automated configuration.
  • SD-WAN is a service formed by applying SDN technology to wide area network scenarios. This service is used to connect enterprise networks, data centers, Internet applications and cloud services over a wide geographical range.
  • the service orchestrator when a customer premises equipment (CPE) initiates a service request, the service orchestrator responds to the service request and obtains the service request response.
  • CPE customer premises equipment
  • the information should be configured, where the business request is used to request access to the VPC on the cloud.
  • Step 102 Send configuration information to the controller through the service orchestrator.
  • the SD-WAN access management platform sends configuration information to the controller through the service orchestrator, so that the controller can realize automatic configuration.
  • Step 103 A tunnel is established through the controller according to the configuration information, and the service request is connected to the corresponding resource pool based on the tunnel.
  • the established tunnel includes a forwarding tunnel from CPE to vCPE, and the service request can be connected to the corresponding resource pool through the established tunnel.
  • the cloud service access method obtaineds configuration information corresponding to the service request by responding to the service request through the service orchestrator when the user client initiates the service request; the configuration information is sent to the controller through the service orchestrator; a tunnel is established by the controller according to the configuration information, and the service request is connected to the corresponding resource pool based on the tunnel; that is, the SD-WAN access management platform connects the service request initiated by the CPE to the corresponding resource pool through components such as the service orchestrator and the controller, realizes the setting of the service flow into the cloud, and provides a new cloud network service that integrates the cloud resource pool and the network.
  • the controller includes a first controller and a second controller.
  • the first controller is called an AR controller
  • the second controller is called a BR controller.
  • the functions of the AR controller include, but are not limited to, automatically configuring the customer premises equipment (CPE) and the virtual access router (vAR), and providing activation services for the CPE through the public network.
  • the functions of the BR controller include, but are not limited to, configuring the virtual border router (vBR) and the virtual extended local area network (Virtual Extensible Local Area Network) gateway (VxLAN GateWay, vGW) and other SDN-related devices in the cloud to achieve automatic configuration of the vBR and cloud access levels.
  • vBR virtual border router
  • VxLAN GateWay Virtual Extensible Local Area Network gateway
  • a method for building a cloud-native SD-WAN PoP network based on the bottom layer of the cloud resource pool can realize the application scenario of branch acceleration to the cloud nearby; the cloud-native PoP is deployed in the public cloud resource pool, and the PoP points are interconnected through the resource pool DCI network; as shown in Figure 2, the PoP based on the cloud bottom layer in this application includes three parts: vAR, vBR, and vGW, and each component implements different functions.
  • vAR is implemented by vCPE controlled by SD-WAN, which is used to terminate the SD-WAN encrypted tunnel to the cloud after nearby access.
  • vBR is used to access the customer VPC or forward traffic to other resource pools.
  • vGW is used to access the high-speed Internet cloud private network between resource pools.
  • the cloud PoP networking architecture shown in Figure 2 can be obtained through the following networking method: PoP is deployed at the bottom layer of the cloud resource pool, where vAR, vBR, and vGW are all deployed in a general server in a virtualized manner; further, vAR can deploy multiple pairs of instances to provide external services based on the number of user access and bandwidth load conditions; vBR can deploy different instances according to scenarios such as access to local cloud and remote cloud, and can also deploy multiple pairs of instances based on the number of user access and bandwidth load conditions to support horizontal expansion; vGW is mainly used to connect to the cloud private network and forward the traffic accessing the remote cloud to the cloud private network.
  • SD-WAN cloud access system is provided as an example.
  • the system architecture diagram is shown in Figure 3.
  • the system consists of the following parts: Business Portal, which provides users with an autonomous service platform page and provides operation and maintenance personnel with a centralized operation and maintenance management service page; Business Orchestrator, which connects to the AR controller and BR controller to achieve end-to-end automated service activation and management services, and provides business-level abstraction for the business portal; AR controller, which automates the configuration of CPE and vAR, and provides activation services for CPE through the public network; BR controller, which configures SDN-related devices in the cloud such as BR and vGW, and achieves automated configuration of vBR and cloud access.
  • step 103 establishes a tunnel through the controller according to the configuration information, and connects the service request to the corresponding resource pool based on the tunnel, including the steps shown in FIG4:
  • Step 1031 Invoke the CPE through the first controller to establish a first tunnel between the CPE and a first virtual access router vAR to be accessed, and send service traffic corresponding to the service request to the first vAR through the first tunnel.
  • the first tunnel includes but is not limited to a VxLAN over IPsec tunnel.
  • Step 1032 Invoke the first vAR through the first controller to encapsulate the virtual local area network VLAN tag for the service traffic, and forward the service traffic encapsulated with the VLAN tag to the first virtual border router vBR.
  • a VxLAN over IPsec tunnel is established between the CPE and the vAR, and the customer traffic is tunneled.
  • the tunnel terminates at the vAR, and after the tunnel is stripped, a dynamically allocated virtual local area network (VLAN) tag is added, and the service traffic encapsulated with the VLAN tag is forwarded to the first virtual border router vBR.
  • VLAN virtual local area network
  • Step 1033 forward the service traffic carrying the VLAN tag to the corresponding resource pool through the second controller.
  • priority access to the nearest resource pool of the entire network can be achieved.
  • it can also be forwarded through the high-quality cloud private network between clouds to improve the network quality of accessing the remote resource pool.
  • the cloud service access method proposed in this application can enable customers to access the cloud nearby, and forward through the cloud private network to improve the network quality of accessing the remote resource pool.
  • the public cloud that customers need to access is distributed all over the country. If they only access it directly through the Internet, the cloud access experience is not good due to the quality of the public network.
  • step 1031 before establishing the first tunnel between the CPE and the first virtual access router vAR to be accessed in step 1031, the following steps are also included:
  • the public Internet Protocol address IP corresponding to the service request is identified through the service orchestrator.
  • PoP point of presence
  • the service orchestrator determines that the vAR corresponding to the nearest PoP point is the first vAR.
  • PoP provides links to external services and sites.
  • PoP can be directly connected to one or more Internet Service Providers (ISPs), so that internal users can access the Internet through these links.
  • ISPs Internet Service Providers
  • the remote sites of the enterprise are also connected together through PoP, and the wide area links between these remote sites are established by the service provider.
  • PoP is located outside the edge of the network enterprise and is the entry point to the internal enterprise network. The services provided by the outside world enter through the PoP, including Internet access, wide area connection and telephone service.
  • the service request includes a service request for accessing a local resource pool
  • step 1033 forwards the service traffic carrying the VLAN tag to the corresponding resource pool through the second controller, including:
  • A11 Call the first vBR through the second controller, remove the VLAN tag from the service traffic carrying the VLAN tag, and encapsulate it with a Virtual Extensible Local Area Network (VxLAN) tag.
  • VxLAN Virtual Extensible Local Area Network
  • A12. Call the first vBR through the second controller to forward the business traffic encapsulated with the VxLAN label to the first virtual switch (Virtual Switch, vSW).
  • A13 Call the first vSW through the second controller to strip the VxLAN label, and forward the service traffic stripped of the VxLAN label to the corresponding local resource pool through the first vSW.
  • the branch can access the local nearest resource pool.
  • a physical device CPE is deployed on the customer side, and a vCPE is deployed on the cloud bottom vAR.
  • the forwarding tunnel from CPE to vCPE is configured through the SD-WAN controller.
  • cloud service providers such as Mobile Cloud
  • multiple cloud resource pools are deployed in each province. When a customer accesses a resource pool within the province, the CPE directly establishes a tunnel with the PoP of the nearest resource pool via a short-distance public network.
  • the vBR removes the VLAN tag and adds the VxLAN tag corresponding to the tenant and sends it to the vSW of the corresponding computing node of the cloud host.
  • vSW After receiving the packet, vSW removes the VxLAN tunnel and sends it to the corresponding cloud host.
  • FIG. 6 a schematic diagram of the logical topology of the branch-to-province cloud is provided.
  • Figure 6 shows the business logical topology.
  • One or more subnets are connected to the CPE side (as an example, only one subnet is shown in the figure).
  • the customer-side subnet PC can achieve three-layer interconnection with the cloud subnet.
  • the configurations on the intermediate components CPE, vAR, and vBR are all automatically configured, and routing information can be automatically synchronized through dynamic routing protocols.
  • the service request includes a service request for accessing a remote resource pool
  • forwarding the service traffic carrying the VLAN tag to the corresponding resource pool through the second controller includes:
  • the first vGW is a cloud private network used to access the local resource pool.
  • a dedicated virtual private network (VPN) tunnel is established between the first vGW and the second vGW through the second controller.
  • the business traffic encapsulated with the VxLAN label can be transparently transmitted to the second vGW through the VPN tunnel.
  • the second vGW is a cloud-specific network used to access the remote resource pool.
  • the second controller calls the second vAR to forward the service traffic encapsulated with the VxLAN label to the corresponding remote resource pool, including:
  • the second controller calls the second vAR to decapsulate the service traffic encapsulated with the VxLAN tag, and then encapsulates the decapsulated service traffic with a VLAN tag and forwards it to the third vBR.
  • the second controller calls the third vBR to establish a second tunnel with the second vSW, and forwards the service traffic encapsulated with the VLAN tag to the second vSW.
  • the second controller calls the second vSW to strip the second tunnel, and forwards the service traffic stripped from the second tunnel to the corresponding remote resource pool through the second vSW.
  • the customer network needs to access the VPC in the remote resource pool.
  • the data flow is as follows:
  • vAR1 establishes a VxLAN over IPsec tunnel with the remote resource pool vAR2 (for some customers who do not require end-to-end encryption, VxLAN tunnel can also be selected).
  • VxLAN tunnel can also be selected.
  • the traffic from vAR1 to the vBR can be tagged with different VLAN tags.
  • vBR1 removes the VLAN tag and adds the VxLAN tag corresponding to the tenant and sends it to vGW1, the exit of the resource pool.
  • vGW1 and vGW2 communicate with each other through a dedicated VPN channel.
  • vGW2 forwards the tunnel traffic to vAR2 through vBR2.
  • vAR2 After vAR2 decapsulates the tunnel, it sends the tenant's traffic with a VLAN tag to vBR3.
  • vBR3 establishes a tunnel with the vSW of the computing node and sends tenant traffic to vSW2.
  • vSW2 After receiving the packet, vSW2 removes the tunnel and sends it to the corresponding cloud host.
  • FIG. 8 a schematic diagram of the branch-into-cross-province cloud logic topology is provided.
  • Figure 8 shows the business logic topology.
  • the CPE side is connected to one or more customer subnets (only one subnet is shown in the figure), and there are multiple subnets in the customer VPC on the remote cloud.
  • the customer-side subnet PC can achieve three-layer interconnection with the cloud subnet.
  • the configurations on the intermediate components CPE, vAR1, vAR2, and vBR are all automatically configured, and the routing information can be automatically synchronized through the dynamic routing protocol.
  • the branch cloud service provisioning can be implemented by the following steps:
  • Step 11 The business portal obtains CPE information and the resource pool information that needs to be accessed.
  • the customer orders a product on the business portal, including CPE information, and selects the resource pool information to be accessed, thereby obtaining the CPE information and the resource pool information to be accessed.
  • client-side subnet information input by a user may also be obtained.
  • the CPE information includes but is not limited to the installation location and device model.
  • Step 12 The business portal sends the subscription information to the business orchestrator.
  • the business orchestrator selects the nearest resource pool information based on the access location information and selects the AR to be accessed.
  • the business orchestrator allocates AR and BR intercommunication parameters based on the resource pool information to be accessed.
  • Step 13 The service orchestrator calls the BR controller to configure the BR and vGW, completes the SDN side configuration, calls the AR controller to configure the AR, and configures the CPE.
  • the configuration will be temporarily stored in the database.
  • Step 14 After the CPE is powered on, it automatically authenticates with the AR controller and goes online.
  • the CPE installation is completed by the backend through mailing/installation personnel on site, and the CPE goes online.
  • Step 15 The AR controller sends configurations to the CPE.
  • the CPE establishes a tunnel with the AR and statically sends routes to access the cloud subnet through the AR controller, or dynamically learns routes with the AR.
  • the cloud statically sends the route to access the CPE side subnet through the BR controller, or dynamically learns the route with the AR.
  • the following steps are also included:
  • the service orchestrator selects the BR to be connected based on the resource pool corresponding to the service request.
  • the service orchestrator searches for available VLANs in the VLAN address allocation table based on the BR that needs to be accessed and the resource pool corresponding to the service request.
  • the service orchestrator searches for available interconnect subnets in the interconnect subnet allocation table
  • the service orchestrator determines the VLAN tag based on the available VLANs and available interconnected subnets.
  • the configuration information corresponding to the request is obtained in step 101, and the configuration information also includes AR and BR intercommunication parameters; in the process of interconnection between AR and BR, the present application uniformly allocates interconnection VLANs and interconnection subnets.
  • the tables maintained globally on the management plane include: VLAN address allocation table and interconnect subnet allocation table.
  • the maintained VLAN address allocation table adopts the strategy of allocating addresses by BR, and different BRs can use different VLAN spaces. Add a field to the table to indicate whether it is used. In this way, even if the VLAN has a 4k limit, the number of tenants can still be increased.
  • the allocation strategies of the interconnected subnet allocation table maintained are: allocation by resource pool, which can be repeated in different resource pools; or global allocation, where all interconnected subnets in all resource pools are not repeated.
  • allocation strategies of the interconnected subnet allocation table maintained are: allocation by resource pool, which can be repeated in different resource pools; or global allocation, where all interconnected subnets in all resource pools are not repeated.
  • the allocation process can be implemented by the following steps:
  • Step 21 In the resource pool to be accessed, select a BR according to the pre-specified policy.
  • the management platform allocates the VLANs and subnets interconnected by the AR and BR.
  • the pre-specified strategies include: load balancing mode (average allocation based on load conditions) and priority mode (preferentially selecting a BR for allocation).
  • Step 22 According to the selected BR, query the database and select an available VLAN.
  • Step 23 Query the available Internet subnets.
  • this resource pool is selected first; otherwise, the global subnet list is selected.
  • Step 24 Assign VLAN and subnet, and record the associated tenant and VPC information.
  • the available VLAN and subnet found are saved in the database and marked as "occupied”.
  • the tenant and VPC information corresponding to the VLAN are also recorded.
  • management plane configures the allocated VLANs and interconnected subnets to the AR and BR.
  • the cloud service access method provided by this application proposes a SD-WAN PoP network networking solution, which consists of three components: vAR, vBR, and vGW, which can realize branch point access to local cloud and remote cloud scenarios.
  • vAR adopts virtualization deployment; vAR can deploy multiple instances at the same time, can provide multiple services to the outside world at the same time, realize high-availability deployment and load balancing, and facilitate rapid business expansion; vAR is a multi-tenant shared device that can allow different Customers, different branches access; vBR adopts virtualized deployment; vBR can deploy multiple instances at the same time, which can achieve high-availability deployment and load balancing, and facilitate rapid business expansion; through vBR, different customer VPCs can be accessed; vBR cooperates with vGW to provide vAR intranet interconnection network for different resource pools; vAR and vBR adopt high-availability solutions, synchronize tenant routes through dynamic routing protocols, and achieve rapid fault switching.
  • this application provides a PoP point technical solution and is designed for business flows entering the cloud; the components of this application are deployed in a virtualized manner, making full use of the technical concept of cloud native to create a new cloud network service that integrates cloud resource pools and networks.
  • the present application provides a software-defined wide area network access management platform, which can be applied to a cloud service access method provided in the embodiment corresponding to FIG. 1 .
  • the SD-WAN access management platform 200 includes:
  • the service orchestrator 201 is used to respond to the service request and obtain the configuration information corresponding to the service request when the user client CPE initiates the service request;
  • the service orchestrator 201 is used to send configuration information to the controller
  • the controller 202 is used to establish a tunnel according to the configuration information, and connect the service request to the corresponding resource pool based on the tunnel.
  • the controller 202 includes a first controller 2021 and a second controller 2022.
  • the first controller 2021 is used to call the CPE, establish a first tunnel between the CPE and a first virtual access router vAR that needs to be accessed, and send the service traffic corresponding to the service request to the first vAR through the first tunnel;
  • the first controller 2021 is used to call the first vAR to encapsulate the virtual local area network VLAN tag for the service traffic, and forward the service traffic encapsulated with the VLAN tag to the first virtual border router vBR;
  • the second controller 2022 is used to forward the service traffic carrying the VLAN tag to the corresponding resource pool.
  • the service request includes a service request for accessing a local resource pool
  • the second controller 2022 is used to call the first vBR to strip the VLAN tag from the service traffic carrying the VLAN tag and encapsulate the virtual extended local area network VxLAN tag
  • the second controller 2022 is used to call the first vBR to forward the service traffic encapsulated with the VxLAN label to the first virtual switch vSW;
  • the second controller 2022 is used to call the first vSW, strip the VxLAN label, and forward the business traffic stripped of the VxLAN label to the corresponding local resource pool through the first vSW.
  • the service request includes a service request for accessing a remote resource pool
  • the second controller 2022 is used to call the first vBR, remove the VLAN tag from the service traffic carrying the VLAN tag, encapsulate the VxLAN tag, and forward the service traffic encapsulated with the VxLAN tag to the first VxLAN gateway vGW
  • the first vGW is a cloud private network for accessing the local resource pool
  • the second controller 2022 is used to establish a dedicated virtual private network VPN tunnel between the first vGW and the second vGW, and the service traffic encapsulated with the VxLAN label can be transparently transmitted to the first vGW through the VPN tunnel.
  • the second vGW is a cloud-specific network for accessing a remote resource pool;
  • the second controller 2022 is used to call the second vGW to forward the service traffic encapsulated with the VxLAN label to the second vAR through the second vBR;
  • the second controller 2022 is used to call the second vAR to forward the business traffic encapsulated with the VxLAN label to the corresponding remote resource pool.
  • the second controller 2022 is used to call the second vAR to decapsulate the service traffic encapsulated with the VxLAN tag, and encapsulate the decapsulated service traffic with the VLAN tag and forward it to the third vBR;
  • the second controller 2022 is used to call the third vBR to establish a second tunnel with the second vSW, and forward the service traffic encapsulated with the VLAN tag to the second vSW;
  • the second controller 2022 is used to call the second vSW to strip the second tunnel, and forward the service traffic stripped of the second tunnel to the corresponding remote resource pool through the second vSW.
  • the service orchestrator 201 is used to identify the public Internet Protocol address IP corresponding to the service request; obtain the point of presence PoP where the public IP is located; and determine that the vAR corresponding to the nearest PoP point is the first vAR.
  • the service scheduler 201 is used to select a BR to be accessed according to a resource pool corresponding to a service request; find an available VLAN in a VLAN address allocation table according to the BR to be accessed and the resource pool corresponding to the service request; find an available interconnected subnet in an interconnected subnet allocation table; and determine a VLAN tag according to the available VLAN and the available interconnected subnet.
  • the access platform for cloud services obtains configuration information corresponding to a service request by responding to the service request through a service orchestrator when a user client initiates a service request; sends the configuration information to a controller through the service orchestrator; establishes a tunnel through the controller according to the configuration information, and connects the service request to a corresponding resource pool based on the tunnel; that is, the SD-WAN access management platform connects the service request initiated by the CPE to a corresponding resource pool through components such as the service orchestrator and the controller, thereby realizing the setting of the service flow into the cloud and providing a new type of cloud network service that integrates the cloud resource pool with the network.
  • the present application provides an SD-WAN cloud access device, which can be applied to a cloud service access method provided in the embodiment corresponding to Figure 1.
  • the SD-WAN cloud access device 300 includes: a processor 301, a memory 302 and a communication bus 303, wherein: the communication bus 303 is used to realize the communication connection between the processor 301 and the memory 302.
  • the processor 301 is used to execute the cloud service access program stored in the memory 302 to implement the following steps:
  • the service orchestrator When the user client CPE initiates a service request, the service orchestrator responds to the service request and obtains the configuration information corresponding to the service request;
  • the controller establishes a tunnel based on the configuration information, and connects the service request to the corresponding Resource pool.
  • the processor 301 is used to execute the cloud service access program stored in the memory 302 to implement the following steps:
  • the service traffic carrying the VLAN tag is forwarded to the corresponding resource pool through the second controller.
  • the service request includes a service request for accessing a local resource pool
  • the processor 301 is used to execute the cloud service access program stored in the memory 302 to implement the following steps:
  • the first vBR is called by the second controller to remove the VLAN tag from the service traffic carrying the VLAN tag and encapsulate the virtual extended local area network VxLAN tag;
  • the first vSW is called through the second controller to strip off the VxLAN label, and the business traffic stripped of the VxLAN label is forwarded to the corresponding local resource pool through the first vSW.
  • the service request includes a service request for accessing a remote resource pool
  • the processor 301 is used to execute the access program of the cloud service stored in the memory 302 to implement the following steps:
  • the first vBR is called through the second controller to remove the VLAN tag from the service traffic carrying the VLAN tag, encapsulate the VxLAN tag, and forward the service traffic encapsulated with the VxLAN tag to the first VxLAN gateway vGW;
  • the first vGW is a cloud private network for accessing the local resource pool;
  • a dedicated virtual private network VPN tunnel is established between the first vGW and the second vGW through the second controller, and the service traffic encapsulated with the VxLAN label can be transparently transmitted to the second vGW through the VPN tunnel; wherein the second vGW is a cloud private network for accessing a remote resource pool;
  • the second controller calls the second vGW to forward the service traffic encapsulated with the VxLAN label to the second vAR through the second vBR;
  • the second controller calls the second vAR to forward the business traffic encapsulated with the VxLAN label to the corresponding remote resource pool.
  • the processor 301 is used to execute the cloud service access program stored in the memory 302 to implement the following steps:
  • the second controller calls the second vAR to decapsulate the service traffic encapsulated with the VxLAN tag, and encapsulates the decapsulated service traffic with a VLAN tag and forwards it to the third vBR;
  • the second controller calls the third vBR to establish a second tunnel with the second vSW, and forwards the service traffic encapsulated with the VLAN tag to the second vSW;
  • the second controller calls the second vSW to strip the second tunnel, and the second vSW forwards the service traffic stripped from the second tunnel to the corresponding remote resource pool.
  • the processor 301 is used to execute the cloud service access program stored in the memory 302 to implement the following steps:
  • the service orchestrator determines that the vAR corresponding to the nearest PoP point is the first vAR.
  • the processor 301 is used to execute the cloud service access program stored in the memory 302 to implement the following steps:
  • the service orchestrator selects the BR to be connected based on the resource pool corresponding to the service request.
  • the service orchestrator searches for available VLANs in the VLAN address allocation table based on the BR that needs to be accessed and the resource pool corresponding to the service request.
  • the service orchestrator determines the VLAN tag based on the available VLANs and available interconnected subnets.
  • the access device for the cloud service obtaineds configuration information corresponding to the service request by responding to the service request through the service orchestrator when the user client initiates the service request; sends the configuration information to the controller through the service orchestrator; establishes a tunnel according to the configuration information through the controller, and connects the service request to the corresponding resource pool based on the tunnel; that is, the SD-WAN access management platform connects the service request initiated by the CPE to the corresponding resource pool through components such as the service orchestrator and the controller, realizes the setting of the service flow into the cloud, and provides a new cloud network service that integrates the cloud resource pool and the network.
  • the present application provides a computer storage medium, which stores one or more programs, and the one or more programs can be executed by one or more processors to implement the following steps:
  • the service orchestrator When the user client CPE initiates a service request, the service orchestrator responds to the service request and obtains the configuration information corresponding to the service request;
  • the controller establishes a tunnel according to the configuration information, and connects the service request to the corresponding resource pool based on the tunnel.
  • the one or more programs may be executed by one or more processors to implement the following steps:
  • the service traffic carrying the VLAN tag is forwarded to the corresponding resource pool through the second controller.
  • the one or more programs may be executed by one or more processors to implement the following steps: calling the first vBR through the second controller to strip the VLAN tag from the service traffic carrying the VLAN tag and encapsulate a virtual extended local area network VxLAN tag;
  • the first vSW is called through the second controller to strip off the VxLAN label, and the business traffic stripped of the VxLAN label is forwarded to the corresponding local resource pool through the first vSW.
  • the one or more programs may be executed by one or more processors to implement the following steps: calling the first vBR through the second controller, stripping the VLAN tag from the service traffic carrying the VLAN tag, encapsulating the VxLAN tag, and forwarding the service traffic encapsulated with the VxLAN tag to the first VxLAN gateway vGW;
  • the first vGW is a cloud private network for accessing a local resource pool;
  • the second vGW is a cloud private network for accessing a remote resource pool;
  • the second controller calls the second vGW to forward the service traffic encapsulated with the VxLAN label to the second vAR through the second vBR;
  • the second controller calls the second vAR to forward the business traffic encapsulated with the VxLAN label to the corresponding remote resource pool.
  • the one or more programs may be executed by one or more processors to implement the following steps:
  • the second controller calls the second vAR to decapsulate the service traffic encapsulated with the VxLAN tag, and encapsulates the decapsulated service traffic with a VLAN tag and forwards it to the third vBR;
  • the second controller calls the third vBR to establish a second tunnel with the second vSW, and forwards the service traffic encapsulated with the VLAN tag to the second vSW;
  • the second controller calls the second vSW to strip the second tunnel, and the second vSW forwards the service traffic stripped from the second tunnel to the corresponding remote resource pool.
  • the one or more programs may be executed by one or more processors to implement the following steps:
  • the service orchestrator determines that the vAR corresponding to the nearest PoP point is the first vAR.
  • the one or more programs may be executed by one or more processors to implement the following steps:
  • the service orchestrator selects the BR to be connected based on the resource pool corresponding to the service request.
  • the service orchestrator searches for available VLANs in the VLAN address allocation table based on the BR that needs to be accessed and the resource pool corresponding to the service request.
  • the service orchestrator determines the VLAN tag based on the available VLANs and available interconnected subnets.
  • the above-mentioned computer storage medium/memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic random access memory (FRAM), a flash memory, a magnetic surface memory, an optical disc, or a compact disc (CD-ROM) and other memories; it can also be various terminals including one or any combination of the above-mentioned memories, such as mobile phones, computers, tablet devices, personal digital assistants, etc.
  • ROM read-only memory
  • PROM programmable read-only memory
  • EPROM erasable programmable read-only memory
  • EEPROM electrically erasable programmable read-only memory
  • FRAM magnetic random access memory
  • flash memory a flash memory
  • CD-ROM compact disc
  • the disclosed devices and methods can be implemented in other ways.
  • the device embodiments described above are only schematic.
  • the division of units is only a logical function division.
  • the coupling, direct coupling, or communication connection between the components shown or discussed can be through some interfaces, and the indirect coupling or communication connection of devices or units can be electrical, mechanical or other forms.
  • the units described above as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units; some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.
  • all functional units in the embodiments of the present application can be integrated into one processing module, or each unit can be a separate unit, or two or more units can be integrated into one unit; the above-mentioned integrated unit can be implemented in the form of hardware or in the form of hardware plus software functional units.
  • a person of ordinary skill in the art can understand that all or part of the steps of implementing the above-mentioned method embodiment can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium.
  • the program When the program is executed, it executes the steps of the above-mentioned method embodiment; and the aforementioned storage medium includes: mobile storage devices, read-only memory (ROM), random access memory (RAM), disks or optical disks, and other media that can store program codes.
  • ROM read-only memory
  • RAM random access memory
  • disks or optical disks and other media that can store program codes.
  • the present application discloses a cloud service access method, a software-defined wide area network access management platform, a software-defined wide area network access management device and a storage medium.
  • the method comprises: when a user client initiates a service request, a service orchestrator responds to the service request and obtains configuration information corresponding to the service request; the service orchestrator sends the configuration information to a controller; the controller establishes a tunnel according to the configuration information, and based on the tunnel, the service request is connected to the corresponding resource pool, thereby realizing the setting of the service flow into the cloud and providing a new type of cloud network service integrating the cloud resource pool and the network.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请实施例公开了一种云服务的接入方法、软件定义广域网接入管理平台、软件定义广域网接入管理设备和存储介质，方法包括：在用户客户端发起业务请求的情况下，通过业务编排器响应业务请求，获得业务请求对应的配置信息；通过业务编排器下发配置信息给控制器；通过控制器根据配置信息建立隧道，基于隧道将业务请求接入对应的资源池，实现了入云的业务流的设置，提供了云资源池与网络融合的新型云网络服务。

Description

一种云服务的接入方法、平台、设备和存储介质
相关申请的交叉引用
本申请基于申请号为202211386019.5、申请日为2022年11月07日的中国专利申请提出，并要求该中国专利申请的优先权，该中国专利申请的全部内容在此以全文引入的方式引入本申请。
技术领域
本申请涉及通信技术领域，尤其是涉及一种云服务的接入方法、软件定义广域网接入管理平台、软件定义广域网接入管理设备和存储介质。
背景技术
当前软件定义广域网(Software Defined Wide Area Network，SD-WAN)主要有如下几种SD-WAN建设方案：(1)对于SD-WAN服务商，一般没有自己的云资源池，采用租用云服务商的云上资源部署入网点(PoP-point-of-presence，PoP)，租用云服务商提供的网络实现PoP间互通；(2)对于部分云服务商，选择在云出口区通过硬件路由器实现隧道接入后进入云内网络入云，SD-WAN仅作为入云的接入通道；然而，对于如何进入云内网络尚未有对应的技术方案。
发明内容
本申请提供一种云服务的接入方法，解决相关技术中如何进入云内网络尚未有对应的技术方案的问题，实现了入云的业务流的设置，提供了云资源池与网络融合的新型云网络服务。
本申请的技术方案是这样实现的：
一种云服务的接入方法，应用于软件定义广域网接入管理平台，所述方法包括：
在用户客户端CPE发起业务请求的情况下，通过业务编排器响应业务请求，获得业务请求对应的配置信息；
通过业务编排器下发配置信息给控制器；
通过控制器根据配置信息建立隧道，基于隧道将业务请求接入对应的资源池。
一种软件定义广域网接入管理平台，所述软件定义广域网接入管理平台包括：
业务编排器，用于在用户客户端CPE发起业务请求的情况下，响应所 述业务请求，获得所述业务请求对应的配置信息；
所述业务编排器，用于下发所述配置信息给控制器；
所述控制器，用于根据所述配置信息建立隧道，基于所述隧道将所述业务请求接入对应的资源池。
一种软件定义广域网接入管理设备，所述软件定义广域网接入管理设备包括：
存储器，用于存储可执行指令；
处理器，用于执行所述存储器中存储的可执行指令，实现如上述的云服务的接入方法。
一种存储介质，所述存储介质存储有一个或者多个程序，所述一个或者多个程序可被一个或者多个处理器执行，以实现如上述的云服务的接入方法的步骤。
本申请所提供的一种云服务的接入方法，通过在用户客户端发起业务请求的情况下，通过业务编排器响应业务请求，获得业务请求对应的配置信息；通过业务编排器下发配置信息给控制器；通过控制器根据配置信息建立隧道，基于隧道将业务请求接入对应的资源池；也就是说，SD-WAN接入管理平台通过业务编排器、控制器等组件将CPE发起的业务请求接入对应的资源池，实现了入云的业务流的设置，提供了云资源池与网络融合的新型云网络服务。
附图说明
图1为本申请实施例提供的云服务的接入方法的流程示意图一；
图2为本申请实施例提供的云PoP组网架构图的示意图；
图3为本申请实施例提供的SD-WAN入云系统架构图的示意图；
图4为本申请实施例提供的云服务的接入方法的流程示意图二；
图5为本申请实施例提供的CPE访问就近本地云VPC流量图的示意图；
图6为本申请实施例提供的分支入本省云逻辑拓扑示意图；
图7为本申请实施例提供的客户网络需要访问远端资源池里的VPC的示意图；
图8为本申请实施例提供的分支入跨省云逻辑拓扑示意图；
图9为本申请实施例提供的分支入云业务开通的流程示意图；
图10为本申请实施例提供的分配流程示意图；
图11为本申请实施例提供的一种SD-WAN接入管理平台的结构示意图；
图12为本申请实施例提供的一种SD-WAN入云设备的结构示意图。
具体实施方式
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述。
应理解，说明书通篇中提到的“本申请实施例”或“前述实施例”意味着与实施例有关的特定特征、结构或特性包括在本申请的至少一个实施例中。因此，在整个说明书各处出现的“本申请实施例中”或“在前述实施例中”未必一定指相同的实施例。此外，这些特定的特征、结构或特性可以任意适合的方式结合在一个或多个实施例中应用。在本申请的各种实施例中，上述各过程的序号的大小并不意味着执行顺序的先后，各过程的执行顺序应以其功能和内在逻辑确定，而不应对本申请实施例的实施过程构成任何限定。上述本申请实施例序号仅仅为了描述，不代表实施例的优劣。
针对相关技术中的两种SD-WAN建设方案：其中，(1)SD-WAN云服务商入云时，一般是需要在客户专有网络(Virtual Private Cloud，VPC)中部署虚拟客户端设备(Virtual CPE，vCPE)实现入云，该方式客户需要额外公网互联网协议地址(Internet Protocol Address，IP)、带宽、云主机费用，增加了客户成本；如果需要部署高可用方案，需要部署两套vCPE，进一步增加了客户成本；(2)在云出口区通过硬件路由器实现入云功能不便于快速扩容。
为此，本申请提出了一种云服务的接入方法，基于公有云底层部署的PoP组网方案，可实现优先就近接入访问全网资源池，进一步地，经云间高质量数据中心互联(Data Center Interconnect，DCI)网络(后文简称云专网)转发，可以提升接入远端资源池的网络质量。
本申请提供一种云服务的接入方法，应用于SD-WAN接入管理平台，参照图1所示，该方法包括以下步骤：
步骤101、在用户客户端发起业务请求的情况下，通过业务编排器响应业务请求，获得业务请求对应的配置信息。
本申请实施例中，SD-WAN接入管理平台即SD-WAN入云系统，包括如下几个部分：业务门户网站(Portal)、业务编排器、控制器。其中，业务Portal为用户提供自主化服务平台页面，为运维人员提供集中运维管理服务页面。业务编排器，对接控制器，实现端到端的业务的自动化开通及管理服务，面向业务Portal提供业务层面的抽象。控制器实现自动化配置。
这里，SD-WAN是将SDN技术应用到广域网场景中所形成的一种服务，这种服务用于连接广阔地理范围的企业网络、数据中心、互联网应用及云服务。
在一些实施例中，在用户客户端(Customer Premise Equipment，CPE)发起业务请求的情况下，通过业务编排器响应业务请求，获得业务请求对 应配置信息，其中，业务请求用于请求对云上VPC进行访问。
步骤102、通过业务编排器下发配置信息给控制器。
本申请实施例中，SD-WAN接入管理平台通过业务编排器下发配置信息给控制器，从而控制器便可以实现自动化配置。
步骤103、通过控制器根据配置信息建立隧道，基于隧道将业务请求接入对应的资源池。
本申请实施例中，建立的隧道包括CPE到vCPE的转发隧道，通过建立的隧道可以将业务请求接入对应的资源池。
本申请实施例提供的云服务的接入方法，通过在用户客户端发起业务请求的情况下，通过业务编排器响应业务请求，获得业务请求对应的配置信息；通过业务编排器下发配置信息给控制器；通过控制器根据配置信息建立隧道，基于隧道将业务请求接入对应的资源池；也就是说，SD-WAN接入管理平台通过业务编排器、控制器等组件将CPE发起的业务请求接入对应的资源池，实现了入云的业务流的设置，提供了云资源池与网络融合的新型云网络服务。
本申请一些实施例中，控制器包括第一控制器和第二控制器，示例性的，第一控制器称为AR控制器，第二控制器称为BR控制器，其中，AR控制器的功能包括但不限于：对客户终端设备(Customer Premise Equipment，CPE)、虚拟接入路由器(virtual Access Router，vAR)进行自动化配置，并通过公网为CPE提供激活服务。BR控制器的功能包括但不限于：对虚拟边界路由器(virtual Border Router，vBR)及虚拟扩展局域网(Virtual Extensible Local Area Network)网关(即VxLAN GateWay，简称vGW)等云内SDN相关设备进行配置，实现vBR及入云层面的自动化配置。
在一些实施例中，基于云资源池底层构建云原生的SD-WAN PoP网络构建的方法，该方案可实现分支就近加速入云应用场景；云原生PoP在公有云资源池中进行部署，PoP点通过资源池DCI网络实现互通；参见图2所示，本申请中基于云底层的PoP包含vAR、vBR、vGW三个部分组成，每个组件实现不同的功能。其中，vAR由SD-WAN控制的vCPE实现，用于就近接入后终结SD-WAN加密隧道入云。vBR用于接入客户VPC或者转发到其他资源池的流量。vGW用于接入资源池间的高速互联网络云专网。
图2所示的云PoP组网架构图，可以通过如下的组网方式得到：PoP部署在云资源池底层，其中，vAR、vBR、vGW均采用虚拟化方式部署在通用服务器中；进一步地，vAR可根据用户接入数、带宽负载情况部署多对实例对外提供服务；vBR可按照接入本地云、远端云等场景分别部署不同的实例，也可根据用户接入数、带宽负载情况部署多对实例，支持水平扩容；vGW主要用于与云专网对接，将接入远端云的流量转发到云专网中。
在图2的云PoP组网架构的基础上，示例性的，提供SD-WAN入云系 统架构图参见图3所示，该系统由如下几部分组成：业务Portal，为用户提供自主化服务平台页面，为运维人员提供集中运维管理服务页面；业务编排器，对接AR控制器、BR控制器，实现端到端的业务的自动化开通及管理服务，面向业务Portal提供业务层面的抽象；AR控制器，对CPE、vAR进行自动化配置，并通过公网为CPE提供激活服务；BR控制器，对BR及vGW等云内SDN相关设备进行配置，实现vBR及入云层面的自动化配置。
进一步地，步骤103通过控制器根据配置信息建立隧道，基于隧道将业务请求接入对应的资源池，包括如图4所示的步骤：
步骤1031、通过第一控制器调用CPE，建立CPE与需要接入的第一虚拟接入路由器vAR之间的第一隧道，通过第一隧道将业务请求对应的业务流量发往第一vAR。
本申请实施例中，第一隧道包括但不限于VxLAN over ipsec隧道。
步骤1032、通过第一控制器调用第一vAR为业务流量封装虚拟局域网VLAN标签，并将封装有VLAN标签的业务流量转发至第一虚拟边界路由器vBR。
本申请实施例中，CPE与vAR间建立VxLAN over ipsec隧道，将客户流量打上隧道。隧道在vAR处终结，剥去隧道后，打上动态分配的虚拟局域网(Virtual Local Area Network，VLAN)标签，并将封装有VLAN标签的业务流量转发至第一虚拟边界路由器vBR。
步骤1033、通过第二控制器，将携带有VLAN标签的业务流量转发至对应的资源池。
本申请实施例中，将业务流量转发至对应的资源池的过程中，可实现优先就近接入访问全网资源池，当然，也可以经云间高质量云专网转发，提升接入远端资源池的网络质量。
也就是说，本申请提出的云服务的接入方法，可以实现客户就近入云，以及经云专网转发，提升接入远端资源池的网络质量。然而，相关技术中，客户需要访问的公有云会分布在全国各地，如果仅通过互联网直接访问，受限于公网质量，入云体验不好。
本申请一些实施例中，步骤1031中建立CPE与需要接入的第一虚拟接入路由器vAR之间的第一隧道之前，还包括：
首先、通过业务编排器识别业务请求对应的公网互联网协议地址IP。
其次、通过业务编排器获取公网IP所在的入网点PoP点。
最后、通过业务编排器确定距离最近的PoP点对应的vAR为第一vAR。
在实际应用中，在企业中，PoP提供通往外部服务和站点的链路，PoP可以直接连接到一家或多家互联网服务提供商(Internet Service Provider，ISP)，这样内部用户便可以通过这些链路来访问Internet。企业的远程站点也通过PoP连接在一起，这些远程站点之间的广域链路由服务商建立。在计算机网络中，PoP位于网络企业的边缘外侧，是访问企业网络内部的进入 点，外界提供的服务通过PoP进入，这些服务包括Internet接入，广域连接以及电话服务。
在一个可实现的业务流程中，分支入就近本地云的过程可以通过A11-A13来实现：
本申请一些实施例中，业务请求包括访问本地资源池的业务请求，步骤1033通过第二控制器，将携带有VLAN标签的业务流量转发至对应的资源池，包括：
A11、通过第二控制器调用第一vBR，将将携带有VLAN标签的业务流量剥去VLAN标签，封装上虚拟扩展局域网(Virtual Extensible Local Area Network，VxLAN)标签。
A12、通过第二控制器调用第一vBR，将封装上VxLAN标签的业务流量转发至第一虚拟交换机(Virtual Switch，vSW)。
A13、通过第二控制器调用第一vSW剥去VxLAN标签，并通过第一vSW将剥去VxLAN标签的业务流量转发至对应的本地资源池。
参照图5所示的CPE访问就近本地云VPC流量图，可以实现分支接入本地就近资源池，对于分支接入本地就近资源池的场景，在客户侧部署物理设备CPE，在云底层vAR部署vCPE，通过SD-WAN控制器配置CPE到vCPE的转发隧道。对于像移动云这样的云服务商，每个省份均有部署多个云资源池。客户在访问入省内资源池时，CPE直接与就近的资源池的PoP经短距离的公网建立隧道。
参照5所示，分支入云时，CPE客户侧子网对云上VPC进行访问，数据流程如下：
1)、CPE与vAR间建立加密隧道例如VxLAN over ipsec隧道，将客户流量打上隧道。
2)、隧道在vAR处终结，剥去隧道后，打上动态分配的VLAN标签。
3)、vBR剥去VLAN标签并打上租户对应的VxLAN标签送往云主机对应计算节点的vSW。
4)、vSW收到后，剥去VxLAN隧道送往对应的云主机。
在一个实际应用场景中，参见图6所示，提供了分支入本省云逻辑拓扑示意图，图6展示了业务逻辑拓扑，CPE侧连接了一个或多个子网(作为示例，图中仅展示了一个子网)，云上客户VPC中有多个子网，客户侧子网PC可与云上子网实现三层互通。中间的组件CPE、vAR、vBR上的配置均自动化配置，可通过动态路由协议自动同步路由信息。
在一个可实现的业务流程中，分支入远端云的过程可以通过B11-B14来实现：
本申请一些实施例中，业务请求包括访问远端资源池的业务请求，通过第二控制器，将携带有VLAN标签的业务流量转发至对应的资源池，包括：
B11、通过第二控制器调用第一vBR，将将携带有VLAN标签的业务流量剥去VLAN标签，封装上VxLAN标签，并将封装上VxLAN标签的业务流量转发至第一VxLAN网关vGW。
其中，第一vGW是用于接入本地资源池的云专网。
B12、通过第二控制器建立第一vGW与第二vGW之间的专用虚拟专用网络(Virtual Private Network，VPN)隧道，封装上VxLAN标签的业务流量能通过VPN隧道透传至第二vGW。
其中，第二vGW是用于接入远端资源池的云专网。
B13、通过第二控制器调用第二vGW，将封装上VxLAN标签的业务流量通过第二vBR转发给第二vAR。
B14、通过第二控制器调用第二vAR，将封装上VxLAN标签的业务流量转发至对应的远端资源池。
进一步地，通过第二控制器调用第二vAR，将封装上VxLAN标签的业务流量转发至对应的远端资源池，包括：
首先、通过第二控制器调用第二vAR对封装上VxLAN标签的业务流量解封装，并将解封装后的业务流量封装上VLAN标签转发至第三vBR。
其次、通过第二控制器调用第三vBR与第二vSW建立第二隧道，将封装上VLAN标签的业务流量转发给第二vSW。
最后、通过第二控制器调用第二vSW剥去第二隧道，并通过第二vSW将剥去第二隧道的业务流量转发至对应的远端资源池。
参照图7所示的CPE访问跨省云VPC流量图，对于需要访问远端资源池的场景，为提升入云质量，可以先就近接入本地资源池的PoP节点，然后经过云专网网络到达需要访问的目的资源池，访问资源池内VPC。
参照图7所示，客户网络需要访问远端资源池里的VPC，数据流程如下：
1)、CPE与本地资源池的vAR1间建立加密隧道例如VxLAN over ipsec隧道，将客户流量打上隧道；不同的客户可以与同一个vAR1实例建立隧道。
2)、vAR1与远端资源池vAR2建立VxLAN over ipsec隧道(对于部分客户对端到端加密要求不高的客户，也可以选择VxLAN隧道)。为了区分入本地云和远端云的流量，vAR1进入vBR的流量可以打上不同的VLAN标签。
3)、vBR1剥去VLAN标签并打上租户对应的VxLAN标签送往本资源池出口vGW1。
4)、vGW1与vGW2间通过专用VPN通道实现互通。
5)、vGW2将隧道流量通过vBR2转发给vAR2。
6)、vAR2将隧道解封装后，将租户的流量并打上vlan标签送到vBR3中。
7)、vBR3与计算节点的vSW建立隧道，将租户流量送给vSW2。
8)、vSW2收到后，剥去隧道送往对应的云主机。
在一个实际应用场景中，参见图8所示，提供了分支入跨省云逻辑拓扑示意图，图8展示了业务逻辑拓扑，CPE侧连接了一个或多个客户子网(图中仅展示了一个子网)，远端云上客户VPC中有多个子网，客户侧子网PC可与云上子网实现三层互通。中间的组件CPE、vAR1、vAR2、vBR上的配置均自动化配置，可通过动态路由协议自动同步路由信息。
在本申请一些实施例中，参见图9所示，分支入云业务开通可以通过如下步骤实现：
Step11、业务Portal获得CPE信息和需要访问的资源池信息。
这里，客户在业务Portal上订购产品，包含CPE信息，选择需要访问的资源池信息，由此，可以获得CPE信息和需要访问的资源池信息。
在一些实施例中，还可以获得用户输入的客户侧子网信息。
其中，CPE信息包括但不限于安装位置、设备型号。
Step12、业务Portal向业务编排器下发订购信息，业务编排器根据接入地信息，选择就近的资源池信息，并选择需要接入AR，业务编排根据需要访问的资源池信息，分配AR、BR互通参数。
Step13、业务编排器调用BR控制器对BR、vGW进行配置，完成SDN侧配置，调用AR控制器对AR进行配置，对CPE进行配置。
因CPE此时尚未上线，配置会暂存在数据库中。
Step14、待CPE上电后，CPE自动与AR控制器进行认证、激活上线。
这里，由后台通过邮寄/安装人员上门完成CPE安装，CPE上线。
Step15、AR控制器向CPE下发配置，CPE与AR建立隧道，通过AR控制器静态下发访问云上子网的路由，或者动态与AR进行路由学习。
这里，云上通过BR控制器静态下发访问CPE侧子网的路由，或者动态与AR进行路由学习。
本申请一些实施例中，步骤1032中通过第一控制器调用第一vAR为业务流量封装虚拟局域网VLAN标签之前，还包括：
首先、通过业务编排器根据业务请求对应的资源池，选取需要接入的BR；
其次、通过业务编排器根据需要接入的BR和业务请求对应的资源池，在VLAN地址分配表中找可用VLAN；
再次、通过业务编排器在互联子网分配表中查找可用的互联子网；
最后、通过业务编排器根据可用VLAN和可用的互联子网，确定VLAN标签。
本申请一些实施例中，步骤101中获得请求对应的配置信息，该配置信息还包括AR、BR互通参数；在AR与BR互联过程中，本申请统一分配互联vlan、互联子网。
在管理面全局维护的表包括：vlan地址分配表和互联子网分配表。
其中，维护的vlan地址分配表采用按BR分配的策略，不同的BR可以使用不同的VLAN空间。在表的字段中添加字段表示是否已使用。如此，即使vlan有4k的限制，仍旧可以提升接入的租户数目。
表1vlan地址分配表
其中，维护的互联子网分配表的分配策略有：按资源池分配，不同资源池可重复；或者，全局分配，所有资源池互联子网均不重复。从而，综合了互联子网有发布到其他资源池的需求；同样，在互联子网分配表中可以添加字段表示是否已分配。
表2互联子网分配表
在一个可实现的分配流程中，参见图10所示，可以通过如下步骤实现：
Step21、在需要接入的资源池中，按照预先指定的策略选择一个BR。
这里，对于一个需要入云的业务，管理平台对AR、BR互联vlan及子网进行分配。其中，预先指定的策略包括：负载均衡模式(根据负载情况平均分配)、优先模式(优先选择一个BR进行分配)。
Step22、根据选择的BR，查询数据库，选择一个可用的vlan。
这里，如果查询不到，异常结束。
Step23、查询可用的互联子网。
这里，如果子网表中有配置指定的资源池，优先选择该资源池；否则选择全局的子网列表。
Step24、分配VLAN、子网，记录关联的租户、VPC信息。
这里，将查询到的可用VLAN、子网保存数据库中，标记为“已占用”。并记录该vlan所对应的租户、VPC信息。
进一步地，管理面将分配到的VLAN、互联子网配置到AR、BR中。
由上述内容可知，本申请提供的云服务的接入方法，提出了一种SD-WAN PoP网络的组网方案，由vAR、vBR、vGW三种组件组成，可实现分支一点接入访问本地云、远端云场景。其中，vAR采用虚拟化部署；vAR可同时部署多个实例，可同时对外提供多个服务、实现高可用部署及负载均衡，方便业务快速扩容；vAR是多租户共享设备，可以允许不同的 客户、不同的分支接入；vBR采用虚拟化部署；vBR可同时部署多个实例，可实现高可用部署及负载均衡，方便业务快速扩容；通过vBR，可实现接入不同的客户VPC；vBR与vGW配合，为不同资源池提供vAR内网互通网络；vAR与vBR间采用高可用方案，通过动态路由协议同步租户路由，实现快速故障倒换。可见，本申请给出了PoP点技术方案，并针对入云的业务流进行了设计；本申请的组件采用虚拟化部署，充分利用云原生的技术理念，打造云资源池与网络融合的新型云网络服务。
本申请提供一种软件定义广域网接入管理平台，该软件定义广域网接入管理平台可以应用于图1对应的实施例提供的一种云服务的接入方法中，参照图11所示，该SD-WAN接入管理平台200包括：
业务编排器201，用于在用户客户端CPE发起业务请求的情况下，响应业务请求，获得业务请求对应的配置信息；
业务编排器201，用于下发配置信息给控制器；
控制器202，用于根据配置信息建立隧道，基于隧道将业务请求接入对应的资源池。
本申请一些实施例中，控制器202包括第一控制器2021和第二控制器2022，
第一控制器2021，用于调用CPE，建立CPE与需要接入的第一虚拟接入路由器vAR之间的第一隧道，通过第一隧道将业务请求对应的业务流量发往第一vAR；
第一控制器2021，用于调用第一vAR为业务流量封装虚拟局域网VLAN标签，并将封装有VLAN标签的业务流量转发至第一虚拟边界路由器vBR；
第二控制器2022，用于将携带有VLAN标签的业务流量转发至对应的资源池。
本申请一些实施例中，业务请求包括访问本地资源池的业务请求，第二控制器2022，用于调用第一vBR，将将携带有VLAN标签的业务流量剥去VLAN标签，封装上虚拟扩展局域网VxLAN标签；
第二控制器2022，用于调用第一vBR，将封装上VxLAN标签的业务流量转发至第一虚拟交换机vSW；
第二控制器2022，用于调用第一vSW，剥去VxLAN标签，并通过第一vSW将剥去VxLAN标签的业务流量转发至对应的本地资源池。
本申请一些实施例中，业务请求包括访问远端资源池的业务请求，第二控制器2022，用于调用第一vBR，将将携带有VLAN标签的业务流量剥去VLAN标签，封装上VxLAN标签，并将封装上VxLAN标签的业务流量转发至第一VxLAN网关vGW；第一vGW是用于接入本地资源池的云专网；
第二控制器2022，用于建立第一vGW与第二vGW之间的专用虚拟专用网络VPN隧道，封装上VxLAN标签的业务流量能通过VPN隧道透传至 第二vGW；其中，第二vGW是用于接入远端资源池的云专网；
第二控制器2022，用于调用第二vGW，将封装上VxLAN标签的业务流量通过第二vBR转发给第二vAR；
第二控制器2022，用于调用第二vAR，将封装上VxLAN标签的业务流量转发至对应的远端资源池。
本申请一些实施例中，第二控制器2022，用于调用第二vAR对封装上VxLAN标签的业务流量解封装，并将解封装后的业务流量封装上VLAN标签转发至第三vBR；
第二控制器2022，用于调用第三vBR与第二vSW建立第二隧道，将封装上VLAN标签的业务流量转发给第二vSW；
第二控制器2022，用于调用第二vSW剥去第二隧道，并通过第二vSW将剥去第二隧道的业务流量转发至对应的远端资源池。
本申请一些实施例中，业务编排器201，用于识别业务请求对应的公网互联网协议地址IP；获取公网IP所在的入网点PoP点；确定距离最近的PoP点对应的vAR为第一vAR。
本申请一些实施例中，业务编排器201，用于根据业务请求对应的资源池，选取需要接入的BR；根据需要接入的BR和业务请求对应的资源池，在VLAN地址分配表中找可用VLAN；在互联子网分配表中查找可用的互联子网；根据可用VLAN和可用的互联子网，确定VLAN标签。
本申请提供的云服务的接入平台，通过在用户客户端发起业务请求的情况下，通过业务编排器响应业务请求，获得业务请求对应的配置信息；通过业务编排器下发配置信息给控制器；通过控制器根据配置信息建立隧道，基于隧道将业务请求接入对应的资源池；也就是说，SD-WAN接入管理平台通过业务编排器、控制器等组件将CPE发起的业务请求接入对应的资源池，实现了入云的业务流的设置，提供了云资源池与网络融合的新型云网络服务。
需要说明的是，本实施例中与其它实施例中相同步骤和相同内容的说明，可以参照其它实施例中的描述，此处不再赘述。
本申请提供一种SD-WAN入云设备，该SD-WAN入云设备可以应用于图1对应的实施例提供的一种云服务的接入方法中，参照图12所示，该SD-WAN入云设备300包括：处理器301、存储器302和通信总线303，其中：通信总线303用于实现处理器301和存储器302之间的通信连接。
处理器301用于执行存储器302中存储的云服务的接入程序，以实现以下步骤：
在用户客户端CPE发起业务请求的情况下，通过业务编排器响应业务请求，获得业务请求对应的配置信息；
通过业务编排器下发配置信息给控制器；
通过控制器根据配置信息建立隧道，基于隧道将业务请求接入对应的 资源池。
本申请一些实施例中，处理器301用于执行存储器302中存储的云服务的接入程序，以实现以下步骤：
通过第一控制器调用CPE，建立CPE与需要接入的第一虚拟接入路由器vAR之间的第一隧道，通过第一隧道将业务请求对应的业务流量发往第一vAR；
通过第一控制器调用第一vAR为业务流量封装虚拟局域网VLAN标签，并将封装有VLAN标签的业务流量转发至第一虚拟边界路由器vBR；
通过第二控制器，将携带有VLAN标签的业务流量转发至对应的资源池。
本申请一些实施例中，业务请求包括访问本地资源池的业务请求，处理器301用于执行存储器302中存储的云服务的接入程序，以实现以下步骤：
通过第二控制器调用第一vBR，将将携带有VLAN标签的业务流量剥去VLAN标签，封装上虚拟扩展局域网VxLAN标签；
通过第二控制器调用第一vBR，将封装上VxLAN标签的业务流量转发至第一虚拟交换机vSW；
通过第二控制器调用第一vSW剥去VxLAN标签，并通过第一vSW将剥去VxLAN标签的业务流量转发至对应的本地资源池。
本申请一些实施例中，业务请求包括访问远端资源池的业务请求，处理器301用于执行存储器302中存储的云服务的接入程序，以实现以下步骤：
通过第二控制器调用第一vBR，将将携带有VLAN标签的业务流量剥去VLAN标签，封装上VxLAN标签，并将封装上VxLAN标签的业务流量转发至第一VxLAN网关vGW；第一vGW是用于接入本地资源池的云专网；
通过第二控制器建立第一vGW与第二vGW之间的专用虚拟专用网络VPN隧道，封装上VxLAN标签的业务流量能通过VPN隧道透传至第二vGW；其中，第二vGW是用于接入远端资源池的云专网；
通过第二控制器调用第二vGW，将封装上VxLAN标签的业务流量通过第二vBR转发给第二vAR；
通过第二控制器调用第二vAR，将封装上VxLAN标签的业务流量转发至对应的远端资源池。
本申请一些实施例中，处理器301用于执行存储器302中存储的云服务的接入程序，以实现以下步骤：
通过第二控制器调用第二vAR对封装上VxLAN标签的业务流量解封装，并将解封装后的业务流量封装上VLAN标签转发至第三vBR；
通过第二控制器调用第三vBR与第二vSW建立第二隧道，将封装上VLAN标签的业务流量转发给第二vSW；
通过第二控制器调用第二vSW剥去第二隧道，并通过第二vSW将剥去第二隧道的业务流量转发至对应的远端资源池。
本申请一些实施例中，处理器301用于执行存储器302中存储的云服务的接入程序，以实现以下步骤：
通过业务编排器识别业务请求对应的公网互联网协议地址IP；
通过业务编排器获取公网IP所在的入网点PoP点；
通过业务编排器确定距离最近的PoP点对应的vAR为第一vAR。
本申请一些实施例中，处理器301用于执行存储器302中存储的云服务的接入程序，以实现以下步骤：
通过业务编排器根据业务请求对应的资源池，选取需要接入的BR；
通过业务编排器根据需要接入的BR和业务请求对应的资源池，在VLAN地址分配表中找可用VLAN；
通过业务编排器在互联子网分配表中查找可用的互联子网；
通过业务编排器根据可用VLAN和可用的互联子网，确定VLAN标签。
本申请提供的云服务的接入设备，通过在用户客户端发起业务请求的情况下，通过业务编排器响应业务请求，获得业务请求对应的配置信息；通过业务编排器下发配置信息给控制器；通过控制器根据配置信息建立隧道，基于隧道将业务请求接入对应的资源池；也就是说，SD-WAN接入管理平台通过业务编排器、控制器等组件将CPE发起的业务请求接入对应的资源池，实现了入云的业务流的设置，提供了云资源池与网络融合的新型云网络服务。
需要说明的是，本实施例中与其它实施例中相同步骤和相同内容的说明，可以参照其它实施例中的描述，此处不再赘述。
本申请提供一种计算机存储介质，该计算机存储介质存储有一个或者多个程序，该一个或者多个程序可被一个或者多个处理器执行，以实现如下步骤：
在用户客户端CPE发起业务请求的情况下，通过业务编排器响应业务请求，获得业务请求对应的配置信息；
通过业务编排器下发配置信息给控制器；
通过控制器根据配置信息建立隧道，基于隧道将业务请求接入对应的资源池。
本申请一些实施例中，该一个或者多个程序可被一个或者多个处理器执行，以实现如下步骤：
通过第一控制器调用CPE，建立CPE与需要接入的第一虚拟接入路由器vAR之间的第一隧道，通过第一隧道将业务请求对应的业务流量发往第一vAR；
通过第一控制器调用第一vAR为业务流量封装虚拟局域网VLAN标签，并将封装有VLAN标签的业务流量转发至第一虚拟边界路由器vBR；
通过第二控制器，将携带有VLAN标签的业务流量转发至对应的资源池。
本申请一些实施例中，该一个或者多个程序可被一个或者多个处理器执行，以实现如下步骤：通过第二控制器调用第一vBR，将将携带有VLAN标签的业务流量剥去VLAN标签，封装上虚拟扩展局域网VxLAN标签；
通过第二控制器调用第一vBR，将封装上VxLAN标签的业务流量转发至第一虚拟交换机vSW；
通过第二控制器调用第一vSW剥去VxLAN标签，并通过第一vSW将剥去VxLAN标签的业务流量转发至对应的本地资源池。
本申请一些实施例中，该一个或者多个程序可被一个或者多个处理器执行，以实现如下步骤：通过第二控制器调用第一vBR，将将携带有VLAN标签的业务流量剥去VLAN标签，封装上VxLAN标签，并将封装上VxLAN标签的业务流量转发至第一VxLAN网关vGW；第一vGW是用于接入本地资源池的云专网；通过第二控制器建立第一vGW与第二vGW之间的专用虚拟专用网络VPN隧道，封装上VxLAN标签的业务流量能通过VPN隧道透传至第二vGW；其中，第二vGW是用于接入远端资源池的云专网；
通过第二控制器调用第二vGW，将封装上VxLAN标签的业务流量通过第二vBR转发给第二vAR；
通过第二控制器调用第二vAR，将封装上VxLAN标签的业务流量转发至对应的远端资源池。
本申请一些实施例中，该一个或者多个程序可被一个或者多个处理器执行，以实现如下步骤：
通过第二控制器调用第二vAR对封装上VxLAN标签的业务流量解封装，并将解封装后的业务流量封装上VLAN标签转发至第三vBR；
通过第二控制器调用第三vBR与第二vSW建立第二隧道，将封装上VLAN标签的业务流量转发给第二vSW；
通过第二控制器调用第二vSW剥去第二隧道，并通过第二vSW将剥去第二隧道的业务流量转发至对应的远端资源池。
本申请一些实施例中，该一个或者多个程序可被一个或者多个处理器执行，以实现如下步骤：
通过业务编排器识别业务请求对应的公网互联网协议地址IP；
通过业务编排器获取公网IP所在的入网点PoP点；
通过业务编排器确定距离最近的PoP点对应的vAR为第一vAR。
本申请一些实施例中，该一个或者多个程序可被一个或者多个处理器执行，以实现如下步骤：
通过业务编排器根据业务请求对应的资源池，选取需要接入的BR；
通过业务编排器根据需要接入的BR和业务请求对应的资源池，在VLAN地址分配表中找可用VLAN；
通过业务编排器在互联子网分配表中查找可用的互联子网；
通过业务编排器根据可用VLAN和可用的互联子网，确定VLAN标签。
需要说明的是，本实施例中与其它实施例中相同步骤和相同内容的说明，可以参照其它实施例中的描述，此处不再赘述。
需要说明的是，上述计算机存储介质/存储器可以是只读存储器(Read Only Memory，ROM)、可编程只读存储器(Programmable Read-Only Memory，PROM)、可擦除可编程只读存储器(Erasable Programmable Read-Only Memory，EPROM)、电可擦除可编程只读存储器(Electrically Erasable Programmable Read-Only Memory，EEPROM)、磁性随机存取存储器(Ferromagnetic Random Access Memory，FRAM)、快闪存储器(Flash Memory)、磁表面存储器、光盘、或只读光盘(Compact Disc Read-Only Memory，CD-ROM)等存储器；也可以是包括上述存储器之一或任意组合的各种终端，如移动电话、计算机、平板设备、个人数字助理等。
在本申请所提供的几个实施例中，应该理解到，所揭露的设备和方法，可以通过其它的方式实现。以上所描述的设备实施例仅仅是示意性的，例如，单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，如：多个单元或组件可以结合，或可以集成到另一个系统，或一些特征可以忽略，或不执行。另外，所显示或讨论的各组成部分相互之间的耦合、或直接耦合、或通信连接可以是通过一些接口，设备或单元的间接耦合或通信连接，可以是电性的、机械的或其它形式的。
上述作为分离部件说明的单元可以是、或也可以不是物理上分开的，作为单元显示的部件可以是、或也可以不是物理单元，即可以位于一个地方，也可以分布到多个网络单元上；可以根据实际的需要选择其中的部分或全部单元来实现本实施例方案的目的。
另外，在本申请各实施例中的各功能单元可以全部集成在一个处理模块中，也可以是各单元分别单独作为一个单元，也可以两个或两个以上单元集成在一个单元中；上述集成的单元既可以采用硬件的形式实现，也可以采用硬件加软件功能单元的形式实现。本领域普通技术人员可以理解：实现上述方法实施例的全部或部分步骤可以通过程序指令相关的硬件来完成，前述的程序可以存储于一计算机可读取存储介质中，该程序在执行时，执行包括上述方法实施例的步骤；而前述的存储介质包括：移动存储设备、只读存储器(Read-Only Memory，ROM)、随机存取存储器(Random Access Memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
本申请所提供的几个方法实施例中所揭露的方法，在不冲突的情况下可以任意组合，得到新的方法实施例。
本申请所提供的几个产品实施例中所揭露的特征，在不冲突的情况下可以任意组合，得到新的产品实施例。
本申请所提供的几个方法或设备实施例中所揭露的特征，在不冲突的情况下可以任意组合，得到新的方法实施例或设备实施例。
以上，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以权利要求的保护范围为准。
工业实用性
本申请公开了一种云服务的接入方法、软件定义广域网接入管理平台、软件定义广域网接入管理设备和存储介质，方法包括：在用户客户端发起业务请求的情况下，通过业务编排器响应业务请求，获得业务请求对应的配置信息；通过业务编排器下发配置信息给控制器；通过控制器根据配置信息建立隧道，基于隧道将业务请求接入对应的资源池，实现了入云的业务流的设置，提供了云资源池与网络融合的新型云网络服务。

Claims (10)

  1. 一种云服务的接入方法，所述方法应用于软件定义广域网接入管理平台，所述方法包括：
    在用户客户端CPE发起业务请求的情况下，通过业务编排器响应所述业务请求，获得所述业务请求对应的配置信息；
    通过业务编排器下发所述配置信息给控制器；
    通过所述控制器根据所述配置信息建立隧道，基于所述隧道将所述业务请求接入对应的资源池。
  2. 根据权利要求1所述的云服务的接入方法，所述控制器包括第一控制器和第二控制器，所述通过所述控制器根据所述配置信息建立隧道，基于所述隧道将所述业务请求接入对应的资源池，包括：
    通过所述第一控制器调用所述CPE，建立所述CPE与需要接入的第一虚拟接入路由器vAR之间的第一隧道，通过所述第一隧道将所述业务请求对应的业务流量发往所述第一vAR；
    通过所述第一控制器调用所述第一vAR为所述业务流量封装虚拟局域网VLAN标签，并将封装有VLAN标签的业务流量转发至第一虚拟边界路由器vBR；
    通过所述第二控制器，将携带有VLAN标签的业务流量转发至所述对应的资源池。
  3. 根据权利要求2所述的云服务的接入方法，所述业务请求包括访问本地资源池的业务请求，所述通过所述第二控制器，将携带有VLAN标签的业务流量转发至所述对应的资源池，包括：
    通过所述第二控制器调用所述第一vBR，将所述将携带有VLAN标签的业务流量剥去VLAN标签，封装上虚拟扩展局域网VxLAN标签；
    通过所述第二控制器调用所述第一vBR，将封装上VxLAN标签的业务流量转发至第一虚拟交换机vSW；
    通过所述第二控制器调用所述第一vSW剥去VxLAN标签，并通过第一vSW将剥去VxLAN标签的业务流量转发至对应的本地资源池。
  4. 根据权利要求2所述的云服务的接入方法，所述业务请求包括访问远端资源池的业务请求，所述通过所述第二控制器，将携带有VLAN标签的业务流量转发至所述对应的资源池，包括：
    通过所述第二控制器调用所述第一vBR，将所述将携带有VLAN标签的业务流量剥去所述VLAN标签，封装上VxLAN标签，并将封装上VxLAN标签的业务流量转发至第一VxLAN网关vGW；所述第一vGW是用于接入本地资源池的云专网；
    通过所述第二控制器建立所述第一vGW与第二vGW之间的专用虚拟专用网络VPN隧道，所述封装上VxLAN标签的业务流量能通过所述VPN 隧道透传至所述第二vGW；其中，所述第二vGW是用于接入远端资源池的云专网；
    通过所述第二控制器调用所述第二vGW，将所述封装上VxLAN标签的业务流量通过第二vBR转发给第二vAR；
    通过所述第二控制器调用所述第二vAR，将所述封装上VxLAN标签的业务流量转发至对应的远端资源池。
  5. 根据权利要求4所述的云服务的接入方法，通过所述第二控制器调用所述第二vAR，将所述封装上VxLAN标签的业务流量转发至对应的远端资源池，包括：
    通过所述第二控制器调用所述第二vAR对封装上VxLAN标签的业务流量解封装，并将解封装后的业务流量封装上VLAN标签转发至第三vBR；
    通过所述第二控制器调用所述第三vBR与第二vSW建立第二隧道，将封装上VLAN标签的业务流量转发给第二vSW；
    通过所述第二控制器调用所述第二vSW剥去第二隧道，并通过所述第二vSW将剥去第二隧道的业务流量转发至所述对应的远端资源池。
  6. 根据权利要求2所述的云服务的接入方法，所述建立所述CPE与需要接入的第一虚拟接入路由器vAR之间的第一隧道之前，还包括：
    通过所述业务编排器识别所述业务请求对应的公网互联网协议地址IP；
    通过所述业务编排器获取所述公网IP所在的入网点PoP点；
    通过所述业务编排器确定距离最近的PoP点对应的vAR为所述第一vAR。
  7. 根据权利要求2所述的云服务的接入方法，所述通过所述第一控制器调用所述第一vAR为所述业务流量封装虚拟局域网VLAN标签之前，还包括：
    通过所述业务编排器根据所述业务请求对应的资源池，选取需要接入的BR；
    通过所述业务编排器根据所述需要接入的BR和所述业务请求对应的资源池，在VLAN地址分配表中找可用VLAN；
    通过所述业务编排器在互联子网分配表中查找可用的互联子网；
    通过所述业务编排器根据所述可用VLAN和所述可用的互联子网，确定所述VLAN标签。
  8. 一种软件定义广域网接入管理平台，所述软件定义广域网接入管理平台包括：
    业务编排器，用于在用户客户端CPE发起业务请求的情况下，响应所述业务请求，获得所述业务请求对应的配置信息；
    所述业务编排器，用于下发所述配置信息给控制器；
    所述控制器，用于根据所述配置信息建立隧道，基于所述隧道将所述 业务请求接入对应的资源池。
  9. 一种软件定义广域网接入管理设备，所述软件定义广域网接入管理设备包括：
    存储器，用于存储可执行指令；
    处理器，用于执行所述存储器中存储的可执行指令，实现如权利要求1至7中任一项所述的云服务的接入方法。
  10. 一种存储介质，存储有可执行指令，当所述可执行指令被执行时，用于引起处理器执行权利要求1至7中任一项所述的云服务的接入方法。
PCT/CN2023/128819 2022-11-07 2023-10-31 一种云服务的接入方法、平台、设备和存储介质 WO2024099200A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202211386019.5 2022-11-07
CN202211386019.5A CN116781693A (zh) 2022-11-07 2022-11-07 一种云服务的接入方法、平台、设备和存储介质

Publications (1)

Publication Number Publication Date
WO2024099200A1 true WO2024099200A1 (zh) 2024-05-16

Family

ID=87990323

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/128819 WO2024099200A1 (zh) 2022-11-07 2023-10-31 一种云服务的接入方法、平台、设备和存储介质

Country Status (2)

Country Link
CN (1) CN116781693A (zh)
WO (1) WO2024099200A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116781693A (zh) * 2022-11-07 2023-09-19 中移(苏州)软件技术有限公司 一种云服务的接入方法、平台、设备和存储介质

Citations (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2017148219A1 (zh) * 2016-03-01 2017-09-08 中兴通讯股份有限公司 虚拟专用网业务实现方法、装置及通信系统
CN111106991A (zh) * 2018-10-29 2020-05-05 中国移动通信集团浙江有限公司 一种云专线系统及其业务发放和开通方法
CN112422397A (zh) * 2020-11-05 2021-02-26 中国联合网络通信集团有限公司 业务转发方法及通信装置
CN112804112A (zh) * 2021-04-12 2021-05-14 杭州网银互联科技股份有限公司 一种sd-wan网络环境中多云访问的方法
US20210337014A1 (en) * 2020-04-28 2021-10-28 At&T Intellectual Property I, L.P. Service Correlation across Hybrid Cloud Architecture to Support Container Hybridization
CN113709194A (zh) * 2020-05-20 2021-11-26 中国移动通信集团浙江有限公司 云资源接入的方法、装置、系统及计算设备
CN113923785A (zh) * 2021-10-20 2022-01-11 中国联合网络通信集团有限公司 基于云网协同的网络管理系统及方法
CN114500376A (zh) * 2021-12-30 2022-05-13 网络通信与安全紫金山实验室 一种访问云资源池的方法、装置、服务器及存储介质
CN116781693A (zh) * 2022-11-07 2023-09-19 中移(苏州)软件技术有限公司 一种云服务的接入方法、平台、设备和存储介质

Patent Citations (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2017148219A1 (zh) * 2016-03-01 2017-09-08 中兴通讯股份有限公司 虚拟专用网业务实现方法、装置及通信系统
CN111106991A (zh) * 2018-10-29 2020-05-05 中国移动通信集团浙江有限公司 一种云专线系统及其业务发放和开通方法
US20210337014A1 (en) * 2020-04-28 2021-10-28 At&T Intellectual Property I, L.P. Service Correlation across Hybrid Cloud Architecture to Support Container Hybridization
CN113709194A (zh) * 2020-05-20 2021-11-26 中国移动通信集团浙江有限公司 云资源接入的方法、装置、系统及计算设备
CN112422397A (zh) * 2020-11-05 2021-02-26 中国联合网络通信集团有限公司 业务转发方法及通信装置
CN112804112A (zh) * 2021-04-12 2021-05-14 杭州网银互联科技股份有限公司 一种sd-wan网络环境中多云访问的方法
CN113923785A (zh) * 2021-10-20 2022-01-11 中国联合网络通信集团有限公司 基于云网协同的网络管理系统及方法
CN114500376A (zh) * 2021-12-30 2022-05-13 网络通信与安全紫金山实验室 一种访问云资源池的方法、装置、服务器及存储介质
CN116781693A (zh) * 2022-11-07 2023-09-19 中移(苏州)软件技术有限公司 一种云服务的接入方法、平台、设备和存储介质

Also Published As

Publication number Publication date
CN116781693A (zh) 2023-09-19

Similar Documents

Publication Publication Date Title
US11784927B1 (en) Layer three instances for a cloud-based services exchange
US11563602B2 (en) Method and apparatus for providing a point-to-point connection over a network
US9965317B2 (en) Location-aware virtual service provisioning in a hybrid cloud environment
US10708125B1 (en) Gateway configuration using a network manager
US10164868B2 (en) Hypervisor routing between networks in a virtual networking environment
US7751409B1 (en) Logical service domains for enabling network mobility
JP5976942B2 (ja) ポリシーベースのデータセンタネットワーク自動化を提供するシステムおよび方法
US20120216194A1 (en) Hypervisor application of service tags in a virtual networking environment
US11516126B2 (en) Techniques for high performant virtual routing capabilities
CN111224821B (zh) 安全服务部署系统、方法及装置
CN104584491A (zh) 提供分布式虚拟路由和交换(dvrs)的系统和方法
WO2017214883A1 (en) Network system and method for cross region virtual private network peering
WO2024099200A1 (zh) 一种云服务的接入方法、平台、设备和存储介质
US9716688B1 (en) VPN for containers and virtual machines in local area networks
CN110324244B (zh) 一种基于Linux虚拟服务器的路由方法及服务器
CN110650077A (zh) 一种l2tp协议控制与转发分离的方法及系统
WO2024067338A1 (zh) 云组网系统、安全访问方法、设备及存储介质
CN109756409B (zh) 桥接转发方法
CN112671811B (zh) 一种网络接入方法和设备
US11540131B2 (en) Customer control of their mobile assets
Lor et al. Scalable network-aware data centre federation

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23887890

Country of ref document: EP

Kind code of ref document: A1