WO2024109009A1

WO2024109009A1 - Method and system for device to interface with firewall, and computer-readable storage medium

Info

Publication number: WO2024109009A1
Application number: PCT/CN2023/101875
Authority: WO
Inventors: 林宁
Original assignee: 中兴通讯股份有限公司
Priority date: 2022-11-21
Filing date: 2023-06-21
Publication date: 2024-05-30
Also published as: CN118057786A

Abstract

Disclosed in the present application are a method and system for a device to interface with a firewall, and a computer-readable storage medium. The method for a device to interface with a firewall comprises: after it is detected that flow data to be transmitted in a device needs to be subjected to shunting transmission, determining a plurality of equal-cost egresses corresponding to an equal-cost multipath routing group in the device; selecting one or more target equal-cost egresses from among the plurality of equal-cost egresses to switch from pointing to a firewall to pointing to a preset best-effort path; and performing shunting transmission of the flow data on the basis of the best-effort path and the firewall.

Description

Method, system and computer-readable storage medium for connecting device to firewall

Related Applications

This application claims priority to Chinese patent application No. 202211464353.8 filed on November 21, 2022, the entire contents of which are incorporated by reference into this application.

Technical Field

The present application relates to the field of information security technology, and in particular to a method, system and computer-readable storage medium for connecting a device to a firewall.

Background technique

At present, in order to ensure information security, a firewall is usually set up between the public network and the private network to clean the traffic data passing through the firewall. Therefore, when the firewall is overloaded, the firewall will discard part of the traffic data in order to reduce the pressure of traffic data, which will cause irreparable losses in some scenarios where the integrity of traffic data must be guaranteed.

Summary of the invention

The main purpose of the present application is to provide a method, system and computer-readable storage medium for connecting a device to a firewall, aiming to solve the technical problem of how to avoid the phenomenon that the flow data of the network device is discarded when the firewall is overloaded.

To achieve the above object, the present application provides a method for connecting a digital device to a firewall, comprising:

After detecting that traffic data to be transmitted in a device needs to be split for transmission, determining a plurality of equal-cost exits corresponding to an equal-cost multipath routing group in the device;

Selecting one or more target equivalent exits from the plurality of equivalent exits to change the exits from pointing to the firewall to pointing to a preset escape path;

The flow data is transmitted in a split manner based on the escape path and the firewall.

In addition, to achieve the above-mentioned purpose, the present application also provides a device docking firewall system, which includes a memory, a processor, and a device docking firewall program stored in the memory and executable on the processor. When the device docking firewall program is executed by the processor, the steps of the device docking firewall method as described above are implemented.

In addition, to achieve the above-mentioned purpose, the present application also provides a computer-readable storage medium, on which a program for connecting a device to a firewall is stored. When the program for connecting a device to a firewall is executed by a processor, the steps of the device connecting to a firewall method as described above are implemented.

The present application selects one or more target equivalent exits from the equivalent exits corresponding to the equivalent multi-path routing group determined in the device after detecting that the traffic data to be transmitted in the device needs to be diverted for transmission, and changes the above-mentioned target equivalent exits from pointing to the firewall to pointing to the escape path, and then controls the diversion and transmission of the traffic data to the escape path and the firewall. The traffic data leading to the firewall can be automatically adjusted by controlling the target equivalent exits in the equivalent multi-path routing group, thereby reducing the load on the firewall and avoiding the phenomenon of discarding the traffic data of the network device when the firewall is overloaded.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG1 is a schematic diagram of a terminal\device structure of a hardware operating environment involved in an embodiment of the present application;

FIG2 is a flow chart of a first embodiment of a method for connecting a device to a firewall according to the present application;

FIG3 is a schematic diagram of ECMP egress orientation in the first embodiment of the method for connecting a device to a firewall according to the present application;

FIG4 is another schematic diagram of the ECMP egress pointing of the first embodiment of the method for connecting a device to a firewall of the present application;

FIG5 is a schematic diagram of ECMP egress orientation in a second embodiment of a method for connecting a device to a firewall according to the present application;

FIG. 6 is a schematic diagram of the LACP protocol for device docking in the method for device docking with a firewall in the present application.

The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with embodiments and with reference to the accompanying drawings.

Detailed ways

It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

Refer to Figure 1, which is a schematic diagram of the structure of a firewall device connected to the hardware operating environment involved in the embodiment of the present application.

As shown in FIG1 , the device connected to the firewall device may include: a processor 1001, such as a central processing unit (CPU), a communication bus 1002, a user interface 1003, a network interface 1004, and a memory 1005. The communication bus 1002 is used to realize the connection and communication between these components. The user interface 1003 may include a display screen (Display), an input unit such as a keyboard (Keyboard), and the user interface 1003 may also include a standard wired interface and a wireless interface. Network The interface 1004 may include a standard wired interface, a wireless interface (such as a wireless fidelity (Wireless-Fidelity, WI-FI) interface). The memory 1005 may be a high-speed random access memory (Random Access Memory, RAM), or a stable non-volatile memory (Non-Volatile Memory, NVM), such as a disk memory. The memory 1005 may also be a storage device independent of the aforementioned processor 1001.

Those skilled in the art will appreciate that the structure shown in FIG. 1 does not constitute a limitation on the device docking with the firewall device, and may include more or fewer components than shown in the figure, or a combination of certain components, or a different arrangement of components.

As shown in FIG. 1 , the memory 1005 as a storage medium may include an operating system, a data storage module, a network communication module, a user interface module, and a device docking firewall program.

In the device docking firewall device shown in Figure 1, the network interface 1004 is mainly used for data communication with other devices; the user interface 1003 is mainly used for data interaction with the user; the processor 1001 and the memory 1005 in the device docking firewall device of the present application can be set in the device docking firewall device, and the device docking firewall device calls the device docking firewall program stored in the memory 1005 through the processor 1001, and executes the device docking firewall method provided in the embodiment of the present application.

2, the present application provides a method for connecting a device to a firewall. In a first embodiment of the method for connecting a device to a firewall, the method for connecting a device to a firewall includes:

Step S10, after detecting that the traffic data to be transmitted in the device needs to be split and transmitted, determining a plurality of equal-cost exits corresponding to the equal-cost multipath routing group in the device;

The network device uses a physical port or a link aggregation group to connect to the firewall, and cleans the network traffic data through the firewall, wherein the use of the link aggregation group to connect is to increase the bandwidth of the connection between the network device and the firewall. In this embodiment, in order to ensure the isolation of the public network and the private network, the firewall device is generally set at the junction of the public network and the private network, and the traffic data of the network device entering the firewall and the traffic data after cleaning from the firewall belong to different VRFs (Virtual Routing Forwarding, virtual equivalent routing). However, in the networking mode of the above network device and the firewall, when the traffic data of the firewall is overloaded, the network device has no additional path to escape, and the traffic data will be discarded. In the scenario where the traffic data must be strictly cleaned by the firewall, it is normal for the traffic data to be discarded; however, in some scenarios where the traffic data is not required to be strictly cleaned by the firewall, that is, in the scenario where the traffic data must not be discarded, it will cause irreparable losses. In addition, when the firewall is overloaded, if the network device forwards the public network route traffic that was originally destined for the firewall to be cleaned to the private network through other paths, it must be configured through the VRF mutual guidance function. Such configuration is relatively complex and cannot be triggered automatically. Configuring the VRF mutual guidance function will cause the routing table in the network device to be deleted and added again, resulting in a long period of network device interruption.

Therefore, in order to avoid the above defects, in this embodiment, when the firewall is overloaded with traffic, the network device can automatically escape part of the traffic to other links to keep the entire traffic data uninterrupted, and the escape traffic data can automatically complete the public and private network isolation operation of VRF without any manual configuration, and can automatically adjust the proportion of the escape traffic data according to the firewall overload situation.

In this embodiment, the routing export of the network device can be set not to point directly to the firewall, but to point to ECMP (Equal Cost Multi Path, equal cost multi-path routing group), and then all the equivalent exports of the ECMP group are pointed to the firewall, and after receiving the overload message sent by the firewall to the network device, the escape path is added to the ECMP group, so that the escape path and the firewall path form a load balance, reduce the load of the firewall, and the proportion of the firewall load can be adjusted by the number of ECMP exports. At the same time, in order to support VRF automatic isolation without VRF mutual conduction configuration, the loopback port can be used as an escape path. For this purpose, different VRFs are configured at the export and import of the loopback port to complete the automatic processing of VRF public and private network isolation.

In this embodiment, when the physical exit in the network device points to the firewall, the routing exit of the router in the network device can be set to point to an ECMP group in the device. The ECMP group contains several equal-port exits. When the firewall is not overloaded, all ECMP exits are written as the next-hop exit pointing to the firewall, thereby ensuring that 100% of the traffic can be sent to the firewall.

In this embodiment, when the network device detects that the firewall is overloaded, or detects that the firewall is not overloaded but forces the traffic data not to pass through the firewall, or when the firewall fails, it is necessary to process the traffic data flowing to the firewall, such as diverting the traffic data to be transmitted in the device. After determining that the traffic data to be transmitted needs to be diverted, multiple equivalent exports corresponding to the equivalent multipath routing group in the device can be determined first, and after the ECMP group receives the traffic data sent by the routing export, the traffic data is transmitted to the escape path or the firewall. The traffic data transmitted to the escape path is looped back to the network device by the escape path, and after the firewall recovers from being overloaded, the traffic data is transmitted to the firewall. Among them, when the firewall is overloaded, the firewall device sends overload information to the network device (it can be sent directly to the network device through a message, or through flow control frame processing, or it can be learned through the network management station and then notified by the network management station). Network settings After receiving the overload information, it is determined that the firewall is overloaded and subsequent traffic diversion processing is performed.

Among them, all the exports of the ECMP group are equivalent exports, wherein the equivalent export means that the path cost values of the transmission paths corresponding to the exports are equal. Since the ECMP group will give priority to the export with the smallest path cost value to transmit data, and the path cost values of the equivalent exports are equal, all the equivalent exports of the ECMP group will determine an equivalent export to transmit data based on the hash rule, wherein the hash rule refers to transforming an input of any length into an output of a fixed length through a hash algorithm, and the output is the hash value. In one embodiment, the traffic data in the network is composed of several data streams, and each data stream has identification information that can uniquely identify the data stream, namely, a data identifier. The data identifier is processed based on the hash rule, and a hash value, namely, a hash value, is calculated, so that the data identifier of each data stream has a unique corresponding hash value, and each hash value has a corresponding equivalent export in the ECMP group. After obtaining the hash value, it can be determined that the data stream is transmitted through the equivalent export. In this embodiment, the device can be a network device, specifically a switch, a router, a bridge, a computer, etc. For example, referring to FIG3 , an ECMP group is set in the routing table of the switch, which is denoted as ECMP1. The switch routes 10.1.1.0, 20.1.1.0, and 30.1.1.0 all point to ECMP1. Assuming that ECMP1 contains four exits, namely nexthop1, nexthop2, nexthop3, and nexthop4, these four exits are all equivalent exits of ECMP1. In the initial routing table, nexthop1, nexthop2, nexthop3, and nexthop4 of ECMP1 all point to the physical port port3 connected to the firewall on the public network side. All traffic data is transmitted through the equivalent exit of ECMP1 to the physical port port3 pointed to by the equivalent exit. The physical port port3 sends the traffic data to the firewall to clean the traffic data, and the firewall sends a firewall overload notification to the network device through the physical port port4 on the private network side. Similarly, if port3 is a physical port on the private network side, then port4 is a physical port on the public network side.

In addition, in this embodiment, in addition to the need to shunt the traffic data to be transmitted after detecting that the firewall is overloaded, it is also possible to shunt the traffic data to be transmitted based on the shunt instruction received from the user or other device. It is also possible to shunt the traffic data to be transmitted when it is detected that the firewall is faulty, such as only being able to transmit traffic data of a certain size. In this embodiment, only firewall overload is used as an example, but it is not limited to this scenario. Any scenario in which the traffic data to be transmitted in the device needs to be shunt can be applied to this embodiment.

Step S20, selecting one or more target equivalent exits from the plurality of equivalent exits to change the exits from pointing to the firewall to pointing to a preset escape path;

In this embodiment, after determining that the flow data needs to be diverted and transmitted, one or more equivalent exports (i.e., target equivalent exports) of the ECMP group can be changed from pointing to the firewall to pointing to a preset escape path according to certain rules, so that the escape path is successfully added to the ECMP group. The preset escape path is used to share the flow data sent to the firewall and loop this flow data back to the network device. In one embodiment, the escape path can be a loopback bridge group, and the loopback bridge group can be composed of two physical ports or two link aggregation groups interconnected, wherein the interconnection method can be through an external direct line connection or can be directly interconnected internally through chip support.

In addition, one end of the loopback bridge group is configured with a public network VRF, and the other end is configured with a private network VRF. Users can configure the public network VRF and private network VRF of the loopback bridge group according to their specific needs. After the loopback bridge group is configured, when a firewall overload message is received, the network device will change the target equivalent export in the ECMP group from pointing to the firewall to pointing to the loopback bridge group. For example, referring to Figure 4, each route 10.1.1.0, 20.1.1.0 and 30.1.1.0 in the routing table of the switch all point to ECMP1, and the escape path of ECMP1 is a loopback bridge group composed of two physical ports port1 and port2 interconnected. After the network device receives the firewall overload message, the network device will point an export nexthop1 of ECMP1 to the physical port port1 on the public network side of the loopback bridge group. The traffic data from the physical port port1 is looped back to the physical port port2 on the private network side of the loopback bridge group through the loopback bridge group. The traffic data is transmitted to the physical port port1 and the physical port port3 through the equivalent export of ECMP1. The traffic data passing through the physical port port1 is looped back to the network device by the escape path, thereby reducing the traffic data pressure of the firewall. The nexthop2, nexthop3 and nexthop4 exports of ECMP1 still point to the physical port port3 connected to the firewall. The traffic data transmitted through the physical port port3 is transmitted to the firewall, and the firewall sends a firewall overload notification to the network device through the physical port port4. Similarly, if port1 is the physical port on the private network side, port2 is the physical port on the public network side.

Step S30: Divert and transmit the traffic data based on the escape path and the firewall.

After changing the target equivalent-cost exit in the ECMP group to point to the escape path, the network device will not directly transmit the traffic data to the firewall. Instead, the ECMP group determines based on the hash rule that each data stream of the traffic data to be transmitted in the network device is transmitted through an equivalent exit to the physical port of the network device pointed to by this equivalent exit, and the data stream is transmitted to the escape path or the firewall through the physical port of the network device. In this embodiment, if a data stream of the traffic data to be transmitted in the network device is determined to be transmitted through the target equivalent exit after being hashed by the ECMP group, it will be transmitted to the escape path, and the escape path will loop this data stream back to the network device; otherwise, it will be transmitted to the firewall. For example, In ECMP1, the data stream transmitted through the export nexthop1 will be transmitted to the loopback bridge group, and the data stream will be looped back to the network device through the loopback bridge group without being discarded. In addition, the data stream transmitted through the exports nexthop2, nexthop3 and nexthop4 will be transmitted to the firewall, which will complete the cleaning work.

In addition, to assist in understanding the process of executing the method for connecting a device to a firewall in this embodiment, an example is given below.

As shown in Figure 3, the switch is connected to the firewall device through physical port port3 and physical port port4. The public network switch routes 10.1.1.0/20.1.1.0/30.1.1.0 public network traffic that needs to be cleaned by the firewall before reaching the private network. When the firewall is not overloaded, the network device routes 10.1.1.0/20.1.1.0/30.1.1.0 to ECMP1, where all the exits nexthop1, nexthop2, nexthop3 and nexthop4 in ECMP1 point to the physical port port3 connected to the firewall on the public network side. The network device traffic data finds the exit as ECMP1 through the routing table, and ECMP1 sends all traffic data to the firewall based on the hash rule. When the firewall traffic data is overloaded, the network device receives the firewall overload message by directly sending a notification to the device or notifying the device through the network management console. As shown in Figure 4, the network device sets a loopback bridge group consisting of two physical ports port1 and port2 interconnected as an escape route, where port1 is located on the public network side and port2 is located on the private network side. The two physical ports port1 and port2 of the loopback bridge group are directly looped back through a connection. The network device points the exit of nexthop1, an exit of ECMP1, to port1 on the public network side of the loopback bridge group. The network device traffic data finds the exit as ECMP1 through the routing table. ECMP1 shares part of the traffic data to nexthop1 based on the hash rule, sends it from port1, and loops it back to the private network side of Port2, and finally returns to the network device, thereby reducing the traffic pressure of the firewall. If the network device continues to receive the firewall overload message, the network device continues to increase the proportion of the equivalent exit pointing to port1 on the public network side of the loopback bridge group in the ECMP group, and continues to reduce the proportion of traffic data sent to the firewall until the firewall overload disappears. After the network device receives the message that the firewall is not overloaded, the network device restores the equivalent export in ECMP1 pointing to the public network side of the loopback bridge interface group to point directly to the firewall, gradually increasing the proportion of firewall traffic data until the proportion of firewall traffic data is balanced and stable. The above completes the automatic traffic data adjustment of the entire network device and the firewall connection, as well as all operations that do not require configuration across VRF.

In this embodiment, after detecting that the traffic data to be transmitted in the device needs to be split and transmitted, one or more equal-cost exits corresponding to the equal-cost multipath routing group determined in the device are selected. The target equivalent export changes the target equivalent export from pointing to the firewall to pointing to the escape path, and then controls the flow data to be diverted and transmitted to the escape path and the firewall. The flow data leading to the firewall can be automatically adjusted by controlling the target equivalent export in the equal-cost multipath routing group, thereby reducing the load on the firewall and avoiding the phenomenon of discarding the flow data of the network device when the firewall is overloaded.

Based on the first embodiment of the present application, a second embodiment of the method for connecting a device to a firewall of the present application is proposed. In this embodiment, step S30 of the above embodiment, performing split transmission of the flow data based on the escape path and the firewall, includes:

Step a, after the number of the target equivalent outlets is less than the number of the equivalent outlets, determining first sub-flow data in the flow data flowing through the target equivalent outlet, and controlling the first sub-flow data to be transmitted through the escape path;

Step b: controlling the other sub-flow data in the flow data except the first sub-flow data to be transmitted through the firewall.

In this embodiment, when the number of target equivalent exports is consistent with the number of equivalent exports, it is determined that the firewall has a fault and the traffic data cannot flow through the firewall. At this time, a corresponding prompt message can be output to inform the user. After the number of target equivalent exports is less than the number of equivalent exports, it can be determined that the traffic data can be diverted at the next hop, that is, part of the traffic data flows through the firewall, and the other part of the traffic data flows through the escape path. Therefore, when performing diversion transmission, the ECMP group will determine all data flows (i.e., the first sub-traffic data) flowing through the target equivalent export based on the hash rule, so the first sub-traffic data will be transmitted through the escape path, and other traffic data in all traffic data that is not the first sub-traffic data will still be transmitted through the firewall. Among them, the traffic data includes the first sub-traffic data and other sub-traffic data.

In this embodiment, after the number of target equivalent outlets is less than the number of equivalent outlets, the first sub-flow data is controlled to be transmitted through the escape path, and other sub-flow data except the first sub-flow data is controlled to be transmitted through the firewall, thereby realizing the diversion transmission of flow data and avoiding the phenomenon of flow data being discarded when the firewall is overloaded.

In one embodiment, the escape path includes a loopback bridge group, and the controlling the first sub-flow data to be transmitted through the escape path includes:

Step a1, controlling the first sub-flow data to pass through the target equivalent The egress is transmitted to the input end of the loopback bridge group and looped back through the output end of the loopback bridge group.

In this embodiment, when the escape path includes a loopback bridge group, that is, after a loopback bridge group connected to the target equivalent exit is set in the network setting, the traffic data sent by the routing exit can be received in ECMP, and after determining that the first sub-traffic data is sent to the loopback bridge group, the first sub-traffic data is controlled to flow through the target equivalent exit, the input end of the loopback bridge group and the output end of the loopback bridge group in sequence, so as to achieve the effect of traffic data escape. Among them, the loopback bridge group is the effect of interconnection of two ports or two link aggregation groups (which can be connected by an external direct line, or by internal direct interconnection supported by the chip). The two ports or link aggregation groups are each configured as a VRF of the public network or private network. In this way, the route that needs to be converted from the public network to the private network VRF can point the exit to a port or a link aggregation group in this loopback bridge group, and the VRF crossing is completed through the effect of loopback bridging, and there is no need to configure any VRF routing mutual guidance. In one embodiment, assuming that the data flow direction of the first sub-traffic data is from the public network to the private network, the public network VRF side of the loopback bridge group is the input end, and the private network VRF side of the loopback bridge group is the output end. Similarly, if the data flow direction of the first sub-traffic data is from the private network to the public network, the private network VRF side of the loopback bridge group is the input end, and the public network VRF side of the loopback bridge group is the output end.

In this embodiment, the first sub-flow data transmitted through the target equivalent export of the ECMP group is transmitted to the input end of the loopback bridge group, and then looped back to the network device at the output end of the loopback bridge group. The loopback bridge group is used as an escape path, and VRF automatic isolation can be supported without VRF mutual guidance configuration, and VRF traversal can be completed. At the same time, no manual intervention is required during the entire loopback process, and all actions can be automatically executed. In addition, since there is no need to change the direction of the network device route, the network device route points to the ECMP group from beginning to end, and the export change of the ECMP group is used to adjust the traffic pressure of the firewall to avoid the phenomenon of discarding traffic data.

In one embodiment, controlling the first sub-flow data to be transmitted to the input end of the loopback bridge group through the target equivalent exit pointing to the loopback bridge group, and looping back through the output end of the loopback bridge group includes:

Step a11, after the loopback bridge group is a link aggregation group, determining a transmission protocol corresponding to the link aggregation group;

In this embodiment, if the escape path pointed to by the target equivalent exit in the ECMP group is selected by interconnecting two link aggregation groups to form a loopback bridge group, then since the link aggregation group needs to dynamically connect to the transmission protocol, such as the LACP protocol (Link Aggregation Control Protocol), during the loopback bridge, the device needs to connect to the LACP protocol itself to make the two link aggregations The groups are interconnected to form a loopback bridge group.

Step a12, constructing a transmission message according to the target physical address corresponding to the transmission protocol and the first sub-flow data;

After successfully completing the LACP protocol loopback bridging docking of the link aggregation group of the network device, since the first sub-flow data needs to be correctly transmitted to the loopback bridging group to complete the loopback, it is necessary to encapsulate the target physical address (such as a special MAC address) selected when the link aggregation group is docked with the LACP loopback bridging and the first sub-flow data into a transmission message and transmit it to the loopback bridge, so that the first sub-flow data completes the accurate loopback of the first sub-flow data through the loopback bridging group.

Step a13, transmitting the transmission message to the input end of the link aggregation group through the target equivalent export pointing to the link aggregation group, and looping back through the output end of the link aggregation group;

Step a14, after the target physical address in the looped-back transmission message matches the preset special source physical address, continue to complete the transmission of the looped-back transmission message.

When the network device is connected to the loopback bridge in the link aggregation group, it needs to select a special source MAC address (i.e., the preset special source physical address) for transmission, which is recorded as SMAC, so that the network device itself can connect to the LACP protocol of the link aggregation group with itself. The loopback bridge link aggregation group uses the SMAC address to send messages, while the LACP messages of other non-loopback bridge link aggregation groups continue to use the source MAC address of the device itself to send. Therefore, the message transmitted through the loopback bridge group needs to match the target physical address in the transmission message with the SMAC address. If the two address matching results are the same, it can be determined that this message is a transmission message on the loopback bridge link aggregation group, and the transmission of the transmission message continues to be looped back. If the two address matching results are not the same, it means that this message is not a transmission message on the loopback bridge link aggregation group, and the transmission message will not be looped back through the loopback bridge group, but the transmission of this transmission message is completed in the usual transmission mode in the network device, or it is directly considered that this transmission message is transmitted to the loopback bridge group by mistake and the transmission message is directly discarded.

In this embodiment, after determining that the escape path pointed to by the target equivalent export of the ECMP group is a loopback bridge group composed of two interconnected link aggregation groups, the transmission message is sent through the target physical to complete the docking of the LACP protocol loopback bridge of the link aggregation group, so that the loopback bridge group can accurately loop back the message, so that the traffic data transmitted to the loopback bridge group can be looped back to the network device.

In one implementation, after determining the transmission protocol corresponding to the link aggregation group, the method includes:

Step a15, determining the device physical address corresponding to the transmission protocol, and obtaining a preset offset address, and constructing a target physical address according to the offset address and the device physical address.

Since the LACP sending process of the network device uses the device's own MAC (Media Access Control) address as the source MAC address, the LACP message sent in this way becomes an LACP message with the network device receiving its own MAC address after looping back. This message will be discarded, and the two link aggregation groups cannot be successfully connected.

Therefore, in this embodiment, referring to FIG. 6 , the loopback bridge group is composed of the link aggregation group Trunk1 and the link aggregation group Trunk2 interconnected. When the link aggregation group is connected to the LACP loopback bridge, the network device CPU (central processing unit) selects a special source MAC address to send the LACP protocol message, wherein the LACP protocol message uses the special source MAC address. The network device itself can connect to the LACP protocol of the link aggregation group with itself, and adding this special source MAC address to the MAC table of the network device realizes that this special source MAC address is learned into the MAC address table. Specifically, the MAC+offset address of the network device can be used as the special source MAC address, wherein the offset address is also the MAC address assigned to this network device, which can be used legally and will not conflict with the MAC address of other network devices. In addition, other special MAC addresses that do not conflict with other network MAC addresses can also be selected as special source MAC addresses to send LACP protocol messages, so that the LACP protocol loopback bridge connection of the link aggregation group of the network device can be completed. Among them, the device physical address includes the MAC address. The offset address is the offset address.

In this embodiment, the target physical address is constructed according to the offset address and the device physical address to ensure that the subsequent escape path can operate normally when using the target physical address to loop back the first sub-flow data.

In one embodiment, controlling the first sub-flow data to be transmitted to the input end of the loopback bridge group through the target equivalent exit pointing to the loopback bridge group, before being looped back through the output end of the loopback bridge group, includes:

Step a01, obtaining the public network virtual routing forwarding VRF and the private network VRF corresponding to the device, and configuring the loopback bridge group according to the public network VRF and the private network VRF.

In this embodiment, before the traffic is diverted and transmitted, if the escape path is a loopback bridge group, the loopback bridge group can be set according to the public network VRF and private network VRF corresponding to the device. For example, as shown in FIG5, each route 10.1.1.0, 20.1.1.0 and 30.1.1.0 in the routing table of the switch points to ECMP1, and the escape path pointed to by the target equivalent export of ECMP1 is a loopback bridge group composed of two link aggregation groups Trunk1 and Trunk2 interconnected. After obtaining the public network VRF and private network VRF corresponding to the network device, Trunk1 is configured with the public network VRF, and Trunk2 is configured with the private network VRF. One of ECMP1 The exit nexthop1 points to Trunk1, and the traffic data is transmitted to Trunk1 and physical port port3 through the equivalent exit of ECMP1. The traffic data passing through Trunk1 is looped back to the network device through the escape path. The exits nexthop2, nexthop3, and nexthop4 of ECMP1 still point to the physical port port3 connected to the firewall. The traffic data transmitted through the physical port port3 is transmitted to the firewall, and the firewall sends a firewall overload notification to the network device through the physical port port4. Similarly, if Trunk1 is configured with a private network VRF, then Trunk2 is configured with a public network VRF.

In addition, the escape path can also be a loopback bridge group composed of two interconnected physical ports. The configuration method of its public network VRF and private network VRF is the same as the configuration method of the loopback bridge group composed of two interconnected link aggregation groups, which will not be described in detail here.

In this embodiment, the loopback bridge group is configured according to the public network VRF and the private network VRF corresponding to the device to ensure the normal operation of the subsequent loopback bridge group as an escape link.

In one embodiment, after the flow data is split and transmitted based on the escape path and the firewall, the following steps are included:

Step c, after completing the one-hop transmission of the flow data, if there is remaining flow data that has not been transmitted in the device, detecting whether it is necessary to continue to divert and transmit the remaining target flow data in the remaining flow data that flows to the firewall;

In this embodiment, after completing one-hop transmission of the flow data, when it is detected that there is still remaining flow data that has not been transmitted in the device, the firewall can be continuously detected to determine whether to continue to divert the remaining flow data in the next hop. If it is detected again that the firewall is still overloaded, the remaining target flow data flowing to the firewall in the remaining flow data can be continuously diverted for transmission.

Step d, after the remaining target traffic data needs to be further diverted and transmitted, continue to execute the step of selecting one or more target equivalent exits from the plurality of equivalent exits to change the exits from pointing to the firewall to pointing to a preset escape path;

After determining that the remaining target traffic data needs to be diverted and transmitted again, the equivalent exports in the ECMP group can continue to be directed. In one embodiment, one or more equivalent exports are selected as the newly added target equivalent exports, that is, the proportion of the target equivalent exports is increased, and the newly added target equivalent exports are changed from pointing to the firewall to pointing to the escape path, and the adjustment of the ECMP group is not completed until the firewall is received. In addition, the number of target equivalent exports added in each adjustment can be set by the user.

In addition, because the number of ECMP group exports is fixed, and general chips can support 8/16/32 groups of exports, the ECMP group export direction can be continuously adjusted, gradually increasing the number of exports pointing to the escape path and reducing the number of exports pointing to the firewall.

Step e: after the remaining traffic data needs to be transmitted in a combined manner, the target equivalent exit pointing to the escape path is restored to point to the firewall, and the remaining traffic data is transmitted in a combined manner through the firewall.

In this embodiment, when it is detected that the firewall is not overloaded and has sufficient resources, the diversion processing of the remaining traffic data can be stopped, and the remaining traffic data can be combined and transmitted to the firewall. At this time, the direction of the target equivalent exit can be restored, that is, the direction is changed from the escape path to the firewall, so that the remaining traffic data can be transmitted through the firewall later. Among them, when restoring the direction of the target equivalent exit, it can be restored according to certain rules (such as equal proportion, equal quantity), such as restoring the direction of one target equivalent exit at a time.

In this embodiment, after completing one-hop transmission of traffic data and there is remaining traffic data, after the remaining target traffic data flowing to the firewall in the remaining traffic data needs to be diverted and transmitted again, the direction of the equivalent export is continued to be changed, and after the remaining traffic data needs to be merged and transmitted, the direction of the target equivalent export is restored, thereby realizing dynamic adjustment, while ensuring the normal transmission of traffic data, avoiding the phenomenon of traffic data being discarded due to firewall overload.

In one embodiment, after detecting that traffic data to be transmitted in a device needs to be split for transmission, before determining a plurality of equal-cost exits corresponding to an equal-cost multipath routing group in the device, the method includes:

Step f, setting the routing exit in the device to point to a preset equal-cost multi-path routing group, and setting the equal-cost exit in the equal-cost multi-path routing group to point to the firewall.

In this embodiment, the routing export of the network device is set not to point directly to the firewall, but to point directly to the ECMP group, and the equivalent export of the ECMP group is pointed to the firewall. Generally, the ECMP group contains multiple equivalent exports. When the firewall is not overloaded, all equivalent exports point to the firewall, thereby ensuring that all traffic data can be sent to the firewall to complete the cleaning work. After the firewall is detected to have traffic overload, the direction of the route in the network device will not be changed. The route points to the ECMP group from beginning to end, and the change of the export of the ECMP group is used to adjust the traffic pressure of the firewall. Therefore, the network device will never have obvious interruption, and the switching method is very simple and convenient. There will be no phenomenon of traffic data being discarded due to firewall overload, which ensures the integrity of the traffic data.

In this embodiment, you only need to use the ECMP group to adjust the connection between the device and the firewall, and use a group of loopback bridge interfaces to access different VRFs to automatically control the traffic sent from the device to the firewall, and no manual intervention is required during the process, and there will be no interruption or long-term packet loss. In the scenario where the device is connected to the firewall, automatically responding to the firewall overload can improve the network flexibility of switch and router products, improve the maintainability of network equipment, and improve users' network usage perception.

In addition, an embodiment of the present application also proposes a device docking firewall system, which includes a memory, a processor, and a device docking firewall program stored in the memory and executable on the processor. When the device docking firewall program is executed by the processor, the steps of the device docking firewall method as described above are implemented.

In addition, to achieve the above-mentioned purpose, the present application also provides a computer-readable storage medium, on which a device docking firewall program is stored. When the device docking firewall program is executed by a processor, the steps of the device docking firewall method as described above are implemented.

The specific implementation of the computer-readable storage medium of the present application is basically the same as the embodiments of the above-mentioned device docking firewall method, and will not be repeated here.

It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or system including the element.

The serial numbers of the embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as ROM/RAM, magnetic disk, optical disk) as described above, including a number of instructions for a terminal device (which can be a mobile phone, computer, server, or network device, etc.) to execute the methods described in each embodiment of the present application.

The above are only optional embodiments of the present application, and do not limit the patent scope of the present application. Equivalent structures or equivalent process changes made using the contents of the description and drawings of this application, or directly or indirectly applied in other related technical fields, are also included in the scope of patent protection of this application.

Claims

A method for connecting a device to a firewall, comprising:

After detecting that traffic data to be transmitted in a device needs to be split for transmission, determining a plurality of equal-cost exits corresponding to an equal-cost multipath routing group in the device;

Selecting one or more target equivalent exits from the plurality of equivalent exits to change the exits from pointing to the firewall to pointing to a preset escape path;

The flow data is transmitted in a split manner based on the escape path and the firewall.
The method for connecting a device to a firewall according to claim 1, wherein the split transmission of the traffic data based on the escape path and the firewall comprises:

After the number of the target equivalent exits is less than the number of the equivalent exits, determining first sub-flow data in the flow data that flows through the target equivalent exit, and controlling the first sub-flow data to be transmitted through the escape path;

Control the other sub-flow data in the flow data except the first sub-flow data to be transmitted through the firewall.
The method for connecting a device to a firewall as claimed in claim 2, wherein the escape path includes a loopback bridge group, and the controlling the first sub-flow data to be transmitted through the escape path includes:

The first sub-flow data is controlled to be transmitted to the input end of the loopback bridge group through a target equivalent exit pointing to the loopback bridge group, and is looped back through the output end of the loopback bridge group.
The method for connecting a device to a firewall as claimed in claim 3, wherein the controlling the first sub-flow data to be transmitted to the input end of the loopback bridge group through the target equivalent exit pointing to the loopback bridge group, and looping back through the output end of the loopback bridge group, comprises:

After the loopback bridge group is a link aggregation group, determining a transmission protocol corresponding to the link aggregation group;

Constructing a transmission message according to the target physical address corresponding to the transmission protocol and the first sub-flow data;

Transmitting the transmission message to the input end of the link aggregation group through a target equivalent export pointing to the link aggregation group, and looping back through the output end of the link aggregation group;

After the target physical address in the looped-back transmission message matches the preset special source physical address, the transmission of the looped-back transmission message continues to be completed.
The method for connecting a device to a firewall according to claim 4, wherein after determining the transmission protocol corresponding to the link aggregation group, the method further comprises:

Determine the device physical address corresponding to the transmission protocol, obtain a preset offset address, and construct a target physical address according to the offset address and the device physical address.
The method for interconnecting a device to a firewall according to claim 3, wherein the controlling the first sub-flow data to be transmitted to the input end of the loopback bridge group through the target equivalent exit pointing to the loopback bridge group, before being looped back through the output end of the loopback bridge group, comprises:

Obtain a public network virtual routing forwarding VRF and a private network VRF corresponding to the device, and configure the loopback bridge group according to the public network VRF and the private network VRF.
The method for connecting a device to a firewall according to claim 1, wherein after the flow data is diverted and transmitted based on the escape path and the firewall, the method further comprises:

After completing one-hop transmission of the flow data, if there is remaining flow data that has not been transmitted in the device, detecting whether it is necessary to continue to divert and transmit the remaining target flow data in the remaining flow data that flows to the firewall;

After the remaining target traffic data needs to continue to be diverted and transmitted, continue to perform the step of selecting one or more target equivalent exits from the multiple equivalent exits to change the exits from pointing to the firewall to pointing to a preset escape path;

After the remaining traffic data needs to be transmitted in a combined manner, the target equivalent exit pointing to the escape path is restored to point to the firewall, and the remaining traffic data is transmitted in a combined manner through the firewall.
The method for connecting a device to a firewall as claimed in claim 1, wherein after detecting that the traffic data to be transmitted in the device needs to be split for transmission, determining the equivalent multipath in the device The multiple equal-cost egresses corresponding to the routing group include:

The routing exit in the device is set to point to a preset equal-cost multi-path routing group, and the equal-cost exit in the equal-cost multi-path routing group is set to point to the firewall.
A device docking firewall system, wherein the device docking firewall system includes a memory, a processor, and a device docking firewall program stored in the memory and executable on the processor, and when the device docking firewall program is executed by the processor, the steps of the device docking firewall method as described in any one of claims 1 to 8 are implemented.
A computer-readable storage medium, wherein a program for connecting a device to a firewall is stored on the computer-readable storage medium, and when the program for connecting a device to a firewall is executed by a processor, the steps of the method for connecting a device to a firewall as described in any one of claims 1 to 8 are implemented.