CN100428737C - A Method to Simplify VPN Network Deployment - Google Patents

Abstract

The present invention provides a method for simplifying VPN network deployment, which runs on the basis of the existing MPLS-based Layer 2 VPN WAN. The network includes at least one source PE (office) device and a pair of PE ( Office side) equipment, mainly includes the following steps: (a) after receiving the layer 2 data frame with VLAN information, the source PE equipment obtains the ID of the VPN by means of the mapping relationship table between VLAN and VPN; (b) obtains the ID of the VPN through the VPN The ID of the destination MAC address is forwarded and searched to obtain the information of the destination CE and the information of the encapsulated MPLS layer 2 label; (c) after the peer PE device receives the encapsulated layer 2 data frame, it passes the set VPN ID to the VLAN's The mapping relationship table is used to change the encapsulated VLAN information and forward it. By adopting the method provided by the invention, the deployment of the VPN network can be simplified.

Description

A Method to Simplify VPN Network Deployment

technical field

The present invention relates to a method for simplifying VPN (Virtual Private Network, virtual user network) network deployment, in particular to a method for layer 2 VPN network deployment based on MPLS (Multi-Protocol Label Switch, multi-protocol label switching technology) .

Background technique

Currently, the mainstream technologies of MPLS-based Layer 2 VPN include point-to-point VPN (VLL, virtual leased line) technology and point-to-multipoint VPN (VPLS, virtual private LAN service) technology.

MPLS-based VLL (Virtual Leased Line) technology is implemented using MPLS labels. The data frames of user services are transmitted in ordinary Ethernet data frames inside the CE (Consumer Edge, user edge device). After entering the operator's PE (Provider Edge, provider edge) device, the PE Destination MAC information, get a double-layer MPLS label after searching the forwarding table, and then get a next-hop destination MAC and VLAN information according to this double-layer MPLS label, and send it from the corresponding sending port of the device after encapsulation, and send it to the peer's PE equipment. Table 1 shows the user's normal data frame, and Table 2 shows the MPLS data frame.

Destination MAC Source MAC VLAN Static lotus CRC

Table 1 User normal data frame

Destination MAC Source MAC VLAN Label1 Label2 Destination MAC Source MAC VLAN Static load CRC

Table 2 MPLS data frame

After the MPLS-encapsulated data packet arrives at the peer PE device, the PE device removes the two-layer MPLS label, and obtains the final egress port information of the VPN user service on the device from the inner label of the two-layer MPLS label. The Layer 2 Ethernet data frame of the user VPN is sent out from the corresponding physical port intact.

If a VPN user has more than two VPN access points, then the following MPLS-based VPLS VPN Layer 2 forwarding technology needs to be used.

In the case of MPLS-based VPLS (Virtual Private LAN Service, virtual private LAN service) VPN networking application, the user VPN service coming from a CE access point of a VPN user enters the physical Port and incoming VLAN information, there are multiple destination CEs to choose from, that is to say, each CE can communicate with multiple CE points, and can communicate with hosts under multiple VPN users under multiple CE points. Table 3 shows user normal data frames, and Table 4 shows MPLS data frames.

Destination MAC Source MAC VLAN Static load CRC

Table 3 User normal data frame

Destination MAC Source MAC VLAN Label1 Label2 Destination MAC Source MAC VLAN Static lotus CRC

Table 4 MPLS data frame

From the perspective of data frame encapsulation at the forwarding level, point-to-multipoint VPLS VPN and point-to-point VLL VPN encapsulation are the same process, that is, at the source PE device, the incoming Layer 2 Ethernet data frame is encapsulated in two layer MPLS label and send it to the destination PE device at the opposite end. After the destination PE device receives the user VPN data frame encapsulated with the MPLS double-layer label, it strips off the two-layer MPLS label, and obtains the destination physical port information according to the information carried by the MPLS label, and sends it out from the corresponding physical port.

In the above two MPLS-based Layer 2 VPN implementation schemes, the user's Layer 2 Ethernet information and VLAN information cannot be changed during the entire forwarding process, because these information are all VPN user information, as the VPN For service providers or operators, they should only be responsible for providing communication channels for Layer 2 connectivity, and cannot change any information of users. This is the original intention and purpose of the MPLS Layer 2 VPN solution.

However, in actual networking applications, the Layer 2 VLAN information in some environments is added by the Layer 2 VPN service provider or the operator itself. A layer of VLAN information is added on top of the information. In short, there are more and more applications where operators can control one or two layers of VLAN information permissions. In this case, all VLAN information is still Treating and processing it as VPN user information will bring a lot of unreasonable and inconvenient VPN deployment in the application.

Contents of the invention

The purpose of the present invention is to solve the existing problems in the deployment of the existing VPN network. By considering the MPLS label and the VLAN information together, the deployment of the MPLS-based Layer 2 VPN network can be simplified, thereby bringing new benefits to the application and deployment of the VPN network. More convenience and flexibility.

To this end, the present invention provides a method for simplifying VPN network deployment, which operates on the basis of the existing MPLS-based Layer 2 VPN WAN, and the network includes at least one source-end provider edge PE device and a pair of end-PE devices , the method includes the following steps:

(a) After receiving the Layer 2 data frame with VLAN information, the PE device at the source end obtains the ID of the VPN by means of the mapping relationship table between VLAN and VPN;

(b) carry out the forwarding search of destination MAC address by the ID of VPN, obtain the information of destination user edge CE equipment and the information of encapsulating MPLS two-layer label;

(c) After receiving the encapsulated Layer 2 data frame, the peer PE device changes the encapsulated VLAN information through the set VPN ID to VLAN mapping table and forwards it.

Wherein, in the step (b), it is necessary to further carry out MPLS two-layer label encapsulation to the two-layer data frame; when the two-layer data frame is encapsulated, different identification information can be carried according to the specific transmission environment; Different according to the specific transmission environment, the identification information carried by the two-layer data frame can be the original VLAN information, or the information of the VPN ID, and can also be without any VLAN information.

Wherein, in step (c), before changing the encapsulated VLAN information, the opposite end PE equipment also needs to obtain the VPN ID information of the two-layer data from the MPLS label.

In addition, in step (c), before changing the encapsulated VLAN information, the peer PE device also needs to use the VPN ID plus destination MAC address information to find the forwarding destination physical port on the peer PE device.

In addition, in step (c), the peer PE device searches the mapping table from the VPN ID to the VLAN under the physical port according to the physical port information, obtains the VLAN information that needs to be encapsulated when outputting the port, and after encapsulation Sent from the corresponding physical port.

In addition, the VLAN information carried by the encapsulated layer-2 data frame may be one layer or two layers.

In addition, in step (a), the source PE device also needs to use the VPN ID to learn the source MAC address, and learn the corresponding MAC address to the corresponding port belonging to the VPN user under the source PE device; After the step (c), the peer PE device further learns the corresponding source MAC address under the corresponding remote CE according to the source information of the VPN ID information and the MPLS label switching path.

Compared with the existing technical solutions, the present invention adds the mapping relationship between VLAN and VPN ID in the source-end PE equipment, and correspondingly analyzes and changes the mapping relationship in the opposite-end PE equipment, which increases the operators' awareness of The control of VLAN information in the Layer 2 Ethernet data frame enables the bureau to configure the required VPN service types independently without the cooperation of the other party (user), thus making VPN deployment easier and more flexible.

Description of drawings

FIG. 1 is a schematic diagram of a typical environment where the method for simplifying VPN network deployment provided by the present invention is applied.

Fig. 2 is a flow chart of the method for simplifying VPN network deployment in the present invention.

Detailed ways

The core idea of the present invention is that by configuring the mapping relationship table between VLAN and VPN ID in the source-end PE equipment and the opposite-end PE equipment, by using the VPN ID as an intermediary, when transmitting data frames, the VLAN ID of the source end and the opposite end The information can be different, so that the operator can deploy the VPN network more flexibly and conveniently. The present invention will be further described below in conjunction with the accompanying drawings.

The networking application environment provided by the present invention is the same as the existing MPLS-based traditional VPN network, but the deployment of the VPN network is more flexible and convenient. As shown in Figure 1, in Figure 1, enterprise users A and B are connected to their respective three branch LANs through VPLS services.

In such an MPLS-based Layer 2 VPN network deployment, it is sometimes necessary to use localized VLANs to judge VPN users. A certain VLAN (the values of these two VLANs are different) under a certain port of a certain device in a computer room belong to the same VPN user, and their Layer 2 services need to be communicated. Communication between computer rooms needs to pass through the operator's MPLS network, and this kind of networking application supports multipoint-to-multipoint application mode, that is to say, a VPN user may have multiple service access points, from each The service data frames coming in from the service access point may communicate with more than two destination access points.

In the above situation, the format of the Layer 2 data frame of the VPN user coming in from the source PE device is shown in Table 5; the format of the Layer 2 data frame of the VPN user at the egress of the peer PE device is shown in Table 6; or it is shown in Table 7, Two types of Layer 2 data frame formats with two layers of VLAN tags shown in Table 8. Table 7 is the format of the Layer 2 data frame of the VPN user incoming from the PE device; Table 8 is the format of the Layer 2 data frame of the VPN user at the egress of the destination PE device.

Destination MAC Source MAC VLAN1 Static load

Table 5 Format of VPN user Layer 2 data frames incoming from the source PE device

Destination MAC sourceMAAC VLAN2 Static lotus CRC

Table 6 Format of the Layer 2 data frame of the VPN user at the egress of the destination PE device

Destination MAC Source MAC VLAN1 VLAN2 Static load CRC

Table 7 Format of VPN user Layer 2 data frames incoming from the source PE device Destination MAC Source MAC VLAN3 VLAN4 Static lotus CRC

Table 8 Format of the Layer 2 data frame of the VPN user at the egress of the destination PE device

The original Layer 2 data frame entering the MPLS-based Layer 2 VPN network service provider may be with one layer of VLAN tags, or with two layers of VLAN tags, or without VLAN tags. In the case of no VLAN tag, the Ethernet switch will automatically add a default VLAN information to the incoming layer 2 data frame according to the incoming physical port information, so the original layer 2 data frame without VLAN information will be described later All are considered according to a layer of VLAN tags.

The complete technical solution of the present invention includes the situation of one layer of VLAN tags and two (multiple) layers of VLAN tags. The following uses the case of one layer of VLAN tags as an example for illustration.

It can be seen from the format of the Layer 2 data frame received by the source PE device and the Layer 2 data frame sent by the peer PE device shown in the above table, if it is an original Layer 2 data frame with a VLAN tag, then pass The value of the VLAN tag coming out of the MPLS Layer 2 VPN service provider network in the future is different from the original one, although the two VLAN tags before and after both mark the services under the same VPN user, and should have the same meaning and be treated the same. However, they are different in the specific form of VLAN numerical representation.

Taking Figure 1 as an example, logically speaking, the VLAN1 of the source PE1, that is, the branch LAN 1 of user A (or VLAN1 under a certain physical port) corresponds to VPN user A, and the VLAN2 under the destination PE2 is the branch LAN 2 of user A ( Or the VLAN2 below a certain physical port also corresponds to VPN user A, and the VLAN3 below the destination PE4, that is, the branch LAN 3 of user A (or VLAN3 below a certain physical port) also corresponds to VPN user A. Inside the network, different VLANs from three different PE points form User A’s VPN ID1. All nodes in the VPN can communicate based on Layer 2 Ethernet data frames, and Layer 2 MAC addresses can be automatically learned and aged. , just like ordinary Layer 2 data forwarding. That is to say, the MAC address of each node is learned under the corresponding physical port in the form of VPN ID1 joining the port. When the Layer 2 data frame service is sent to a specific physical port, the VPN ID1 is replaced by The corresponding VLAN representation of VPN ID1.

As shown in Figure 1 and Figure 2, taking VPN user A's service interworking process between VLAN1 under PE1 and VLAN3 under PE4 as an example, the specific forwarding principle process is described as follows:

(1) After PE1 receives the Layer 2 data frame with VLAN1, it uses the mapping relationship table from VLAN1 to VPN ID1 to obtain VPN ID1.

(2) Use VPN ID1 to perform forwarding lookup of the destination MAC address, obtain destination CE information, and encapsulate MPLS two-layer label information.

(3) Encapsulate the user's Layer 2 data frame in the MPLS label and send it to the destination PE4. When encapsulating Layer 2 data frames, due to the different specific hardware environments in the network, the VLAN information data bits in Layer 2 Ethernet data frames can be Layer 1, Layer 2 or none, so the corresponding encapsulation process may have The following package variations are available:

a. The encapsulated Layer 2 data frame carries the original VLAN1 information.

b. The encapsulated Layer 2 data frame carries VPN ID1 information.

c. The encapsulated Layer 2 data frame does not have VLAN1 or VPN ID1 information, that is, the original VLAN position is either an empty VLAN value (all zeros), or there is no VLAN information at all, that is, it is encapsulated in a format without VLAN information.

(4) Use VPN ID1 to learn the source MAC address, and learn the MAC address to the corresponding PE

Under the corresponding port belonging to the VPN user.

(5) After the MPLS-encapsulated Layer 2 data frame arrives at the peer PE4 device, the user's Layer 2 data frame is obtained from the MPLS label.

(6) When obtaining VPN user two-layer data frame from the data frame of MPLS encapsulation, the most important thing is to obtain the information of VPN ID1, and this VPN ID1 information needs to obtain from MPLS label.

(7) Use the VPN ID1 plus the destination MAC address information to search to obtain the forwarding destination physical port of the PE4.

(8) According to the physical port information, go to search the mapping table of VPN ID1 and VLAN under the physical port, obtain the VLAN information that needs to be encapsulated when outputting the port, and send out from the corresponding physical port after encapsulation.

(9) According to the source information of the VPN ID 1 information and the MPLS virtual switching path, the MAC address of the destination port is learned under the corresponding far-end CE, that is, the CE corresponding to the sending Ethernet data frame connected to the source PE1 device.

In addition, in the above forwarding process, in the forwarding from source PE1 to destination PE4, since the MPLS label of the VPN user's Layer 2 data frame encapsulated with two MPLS labels passing through the carrier network already carries the VLAN and VPN ID information, so the information carried by the corresponding VLAN information data bits inside the Layer 2 data frame can be very flexible, for example, it can carry the original VLAN information, or it can not carry it, or it can carry the VPN ID information, so the specific processing situation and means are There are many kinds, and several situations are considered below.

(1) With VPN ID information or without VLAN information

Because the VPN ID information has been carried in the MPLS label, this information may not be carried in the VLAN information. Whether it is carried or not is sometimes related to the specific implementation of the hardware forwarding ASIC. Because some hardware forwarding ASIC chips handle the situation without VLAN information more smoothly. If the Layer 2 data frame does not carry VLAN information inside, at this time, the processing action of the opposite chip is relatively simple, and only a new layer of VLAN tags needs to be inserted. That's it.

(2) With original VLAN information

If the original VLAN information is carried over the operator's network, more information can be carried. Because at this time, the user VPN ID information is carried in the MPLS label, so other information can be carried in the VLAN. For example, if there are multiple VLANs under a CE, then MPLS carries VPN ID information, and the position of the VLAN label can carry different VLAN information under the CE.

That is to say, the carrier network with VLAN information can provide the application requirements of multiple VLANs under one VPN user, and these multiple VLANs have different manifestations at different CE points.

Therefore, although in the specific embodiment described in the present invention, the peer PE obtains the VPN ID information from the MPLS label and then further obtains the local VLAN information, its specific implementation methods can be various, such as the peer PE device Instead of using the VPN ID information or VLAN information carried in the MPLS label of the Layer 2 Ethernet data frame, other parts of the Layer 2 Ethernet data frame carry VPN ID information or VLAN information, and use these information to realize the localization of the VLAN information. Therefore, it goes without saying that these transformations and applications are all included within the scope of the claims of the present invention.

Of course, in multipoint-to-multipoint applications, because the VLAN information of multiple points may be different, the principle of Layer 2 forwarding is that multiple MAC addresses need to be in one VLAN to communicate. Therefore, the VLAN information carried over the MPLS network is best to represent the VPN ID, rather than the localized VLAN information of each point, because this will cause the MAC address learning problem of the destination point. If localized information is brought over, the device itself needs to be able to handle this situation, for example, after processing the localized VLAN information, learn and forward Layer 2 VPN.

As mentioned above, the case of two layers of VLAN tags is handled like the case of one layer of VLAN tags, both of which have only localized meanings. That is to say, there is only a special fixed value on a certain access point, but at another access point, the two layers of tags that mark VPN users or user services need to be replaced with the values of the other two layers of VLAN tags.

In summary, the present invention adds the mapping relationship between VLAN and VPN ID in the source-end PE equipment, and correspondingly resolves this mapping relationship in the opposite-end PE equipment. The control of VLAN information realizes that one side (office side) can independently configure the required VPN service types without the cooperation of the other side (users), thus making VPN deployment easier and more flexible.

Claims (10)

1. A method for simplifying VPN network deployment, running on the basis of existing MPLS-based Layer 2 VPN wide area network, said network comprising at least one source provider edge PE device and a pair of end PE devices, characterized in In this method, the method includes the steps of: (a) After receiving the Layer 2 data frame with VLAN information, the PE device at the source end obtains the ID of the VPN by means of the mapping relationship table between VLAN and VPN; (b) carry out the forwarding search of destination MAC address by the ID of VPN, obtain the information of destination user edge CE equipment and the information of encapsulating MPLS two-layer label; (c) After receiving the encapsulated Layer 2 data frame, the peer PE device changes the encapsulated VLAN information through the set VPN ID to VLAN mapping table and forwards it. 2. The method for simplifying VPN network deployment according to claim 1, characterized in that, in the step (b), it is necessary to further encapsulate the layer-2 data frames with MPLS layer-2 labels. 3. The method for simplifying VPN network deployment as claimed in claim 2, characterized in that, when the layer 2 data frame is encapsulated, it can carry different identification information according to different specific transmission environments. 4. The method for simplifying VPN network deployment as claimed in claim 3, characterized in that, according to different specific transmission environments, the identification information carried by the two-layer data frame can be original VLAN information or VPN ID information , or without any VLAN information. 5. The method for simplifying VPN network deployment according to claim 1, characterized in that: in step (c), before changing the encapsulated VLAN information, the peer PE device also needs to obtain two Layer data VPN ID information. 6. The method for simplifying VPN network deployment as claimed in claim 5, characterized in that: in step (c), before changing the encapsulated VLAN information, the peer PE device also needs to use the VPN ID to add the destination MAC The address information is searched to obtain the forwarding destination physical port on the peer PE device. 7. The method for simplifying VPN network deployment as claimed in claim 6, characterized in that: in step (c), the peer PE device searches for the VPNID to VLAN under the physical port according to the physical port information Mapping table, obtain the VLAN information that needs to be encapsulated when outputting the port, and send it out from the corresponding physical port after encapsulation. 8. The method for simplifying VPN network deployment according to claim 1, wherein the VLAN information carried by the encapsulated layer-2 data frame can be one layer or two layers. 9. The method for simplifying VPN network deployment as claimed in claim 1, wherein in step (a), the source PE device also needs to use the VPN ID to learn the source MAC address, and the corresponding The MAC address is learned to the corresponding port belonging to the VPN user under the source PE device. 10. The method for simplifying VPN network deployment according to claim 1, characterized in that, after step (c), the opposite end PE device further converts the corresponding VPN ID information and the source information of the MPLS label switching path The source MAC address of the corresponding remote CE is learned.

Images