CN100433691C - Routing method of virtual special network - Google Patents

Abstract

The invention discloses a routing method of a virtual private network, which is applied to a communication system based on an IPv6 backbone network and an IPv4 user network. The method includes: the destination VPN site in the IPv4 user network sends the routing information of the destination site through the IPv6 backbone network To the source VPN site in the IPv4 user network, and establish a tunnel between the egress provider edge device PE of the source VPN site and the ingress PE of the destination VPN site; the source VPN site uses the routing information of the destination VPN site and the tunnel to the destination VPN site Send traffic. The invention can effectively complete the problem that the SP based on the IPv6 backbone network provides VPN service to the users based on IPv4 in the transition process to IPv6. Moreover, the present invention does not need to upgrade the hardware, but only needs to improve the software of the PE equipment, the configuration mode is simple, easy to implement, and has good scalability.

Description

A routing method for a virtual private network

technical field

The invention relates to the technical field of a virtual private network (VPN), in particular to a VPN routing method based on an IPv6 backbone network and an IPv4 user network.

Background technique

Multiprotocol Label Switching (MPLS) is a technology that utilizes labels bound in IP packets to forward data over a network. IP packets are usually encapsulated into MPLS packets, and the MPLS packet headers carry labels assigned according to the equivalent forwarding class. Label operations are performed on the MPLS router, and the packets are forwarded from the corresponding interface according to the labels, and forwarded to the destination step by step. .

BGP/MPLS VPN refers to the establishment of different virtual routing forwarding tables for different VPN users on PE routers, forming MPLS forwarding tables, and using the multi-protocol extension of the BGP4+ protocol to advertise VPN routes, thereby realizing route isolation between VPN users and notifications, forwarding business flows, and implementing VPN services.

RFC2547bis proposes a BGP/MPLS VPN solution based on pure IPv4 domain, which is quite mature and widely used in actual networks. With the emergence of IPv6 networks, more and more manufacturers provide support for IPv6. BGP/MPLS VPN solutions based on pure IPv6 domains and BGP/MPLS VPN solutions based on IPv4 backbone networks and IPv6 users have been proposed. However, in the later stage of the transition from IPv4 to IPv6, IPv6 backbone networks and IPv4 user networks will appear, but BGP/MPLS VPN services under the structure of IPv4 user networks and IPv6 backbone networks cannot be realized at present.

Refer to Figure 1 below to illustrate the BGP/MPLS VPN solution based on IPv4 backbone network and IPv6 users.

As shown in Figure 1, Site 1 and Site 3 belong to VPN1, Site 2 and Site 4 belong to VPN2, user sites are based on IPv6, and the MPLS backbone network is based on IPv4. The following describes the communication method between two VPN sites in each VPN by taking the VPN route of site 4 advertised to site 2 in VPN2 and site 2 sending VPN traffic to site 4 as an example.

It should be noted that, in VPN2, if communication between VPN site 2 and VPN site 4 is to be established, they must learn each other's VPN route to reach the other site. Since VPN site 2 and VPN site 4 belong to IPv6 sites, and the backbone network is an IPv4-based MPLS network, IPv6 VPN routing information must be transmitted in the IPv4 MPLS backbone network. Currently, the BGP multi-protocol reachability attribute is used to publish IPv6 VPN routing information on the IPv4 MPLS backbone network platform.

Referring to Fig. 1, CE4, that is, VPN site 4 is the destination VPN site, CE2, that is, VPN site 2 is the source VPN site; PE2 is the egress PE, and PE1 is the ingress PE. The release of routing information belongs to control flow information, as follows:

(1) CE4 advertises the internal IPv6 route 3ffe:3210::/32 of site 4 to PE2. The specific way can be static routing, OSPF, RIP and other routing protocols.

(2) After receiving the route, PE2 adds it to the IPv6 virtual route forwarding table VRF corresponding to VPN2, and assigns a label to the route.

Here, the VRF records all VPN routing entries of VPN2. A VPN route refers to a BGP UPDATE packet, which includes a routing identifier RD, a routing target RT, a VPN destination address, and a next-hop address, etc., and assigns a label to the route.

(3) PE2 advertises the IPv6 label route to PE1 through IBGP, the destination field in the multi-protocol reachability attribute is the IPv6 VPN address corresponding to 3ffe:3210::/32, and the next relay field is the IPv6 VPN mapped to the IPv4 address of PE1 address.

(4) PE1 receives the route, adds it to the IPv6 virtual routing forwarding table VRF corresponding to VPN2, the next relay is PE2, and advertises the route to CE2 through static routing, OSPF, RIP and other methods.

2. The VPN service sent by site 2 to site 4 belongs to data flow information, as follows:

(1) Site 2 sends the IPv6 data packet to PE1.

(2) PE1 queries the corresponding MPLS forwarding table and VRF, and pushes the secondary label for the IPv6 data packet. The bottom label of the stack is the label allocated by PE2 for the IPv6 VPN route in site 4, and the top label is the LSP label from PE1 to PE2.

(3) Through the LSP from PE1 to PE2, the MPLS message is forwarded to PE2 level by level.

(4) PE2 restores the MPLS message to an IPv6 data packet according to the bottom label of the stack, and forwards it to site 4.

In the prior art, the above solution solves the problem of communication between VPN sites where the backbone network is an IPv4 or IPv6 single autonomous system, and the VPN user site is an IPv6 network. When IPv6 replaces IPv4, there will be an IPv6 backbone network and an IPv4 user network, which cannot be realized at present BGP/MPLS VPN service under IPv4 user network and IPv6 backbone network structure.

Contents of the invention

In view of this, the object of the present invention is to provide a VPN routing method based on IPv6 backbone network and IPv4 user network, so that it can provide VPN service in the network structure composed of IPv6 backbone network and IPv4 user network.

A kind of routing method based on the VPN of IPv6 backbone network and IPv4 user network provided by the present invention is realized like this:

A routing method in a virtual private network, applied in a communication system based on an IPv6 backbone network and an IPv4 user network, each VPN corresponds to a compatible virtual routing and forwarding table VRF, the compatible VRF supports IPv4 compatible IPv6 addresses, and each compatible VRF corresponds to A route target attribute, the method includes the following steps:

a. The destination VPN site in the IPv4 user network sends the routing information of the destination VPN site in the IPv4 address format to the edge device PE of the egress provider; the egress PE converts the routing information into an IPv4 address according to the compatible VRF corresponding to the destination VPN The routing information in compatible IPv6 address format is sent to the ingress PE through the IPv6 backbone network; the ingress PE converts the received routing information in the IPv4-compatible IPv6 address format into the address in the IPv4 address format according to the compatible VRF corresponding to the destination VPN. Send the routing information to the source VPN site in the IPv4 user network;

And a tunnel is established between the ingress PE of the source VPN site and the egress PE of the destination VPN site;

b. The source VPN site uses the routing information and tunnel of the destination VPN site to send the service flow to the destination VPN site.

The tunnel is a label switching path LSP.

The tunnel is established before or after the destination VPN site sends the VPN routing information of the destination site to the source site in the IPv4 user network through the IPv6 backbone network.

The LSP is established using LDP or RSVP.

In step a, the steps for the egress PE to send the route information after the converted address format to the ingress PE through the IPv6 backbone network include:

a11. The egress PE sets the destination address in the compatible VRF of the VPN as the IPv4 address in the routing information, sets the next-hop address as the destination VPN site, and allocates an LSP for the routing information, and uses the LSP to modify its own saved MPLS label forwarding table;

a12. The egress PE sends the routing information including its own input interface and the VPN routing information of the destination address sent by the destination VPN, the LSP label assigned by the egress PE, and the set target routing attribute to the ingress PE;

In step a, the steps for the ingress PE to send the routing information in IPv4 address format to the source VPN site in the IPv4 user network include:

a21. The ingress PE judges that the received target route attribute value is the same as the target route attribute value in all compatible VRFs corresponding to itself. If it finds the same value as the received target route attribute value in all compatible VRFs corresponding to itself, then Update the routing information in the compatible VRF with the same routing target attribute value according to the routing information of the VPN from the egress PE;

After the device in the source VPN site receives the VPN routing information of the ingress PE, it installs relevant routing entries in its own routing table; the router in the source VPN site learns the routing information.

The routing information of the input interface in the VPN routing information described in step a12 is an IPv6 address, or an IPv4 compatible IPv6 address using the input interface;

When the routing information of the input interface is an IPv6 address, the destination address in the routing information of the VPN described in step a21 is obtained by inverse mapping of the ingress PE according to the destination prefix in the multi-protocol reachability attribute;

When the routing information of the input interface is an IPv4-compatible IPv6 address, the destination address in the VPN routing information in step a21 is obtained by inverse mapping directly according to the IPv4-compatible IPv6 address in the multi-protocol reachability attribute.

The routing information of the destination VPN station is sent between the destination VPN station and the egress PE by running an interior gateway protocol, an EBGP method, or a statically configured routing method.

Step b includes:

b0. The device in the source VPN site sends the data packet containing the destination address to the corresponding gateway router. After receiving the data packet, the router judges that it saves the routing information corresponding to the destination address. If there is, it will follow the routing information The data packet is forwarded to the next-hop router, and finally reaches the egress device in the source VPN site after forwarding step by step;

b1. The egress device in the source VPN site queries the routing table saved by itself according to the destination address of the data packet to obtain the entry PE address, and forwards the data packet to the entry PE;

b2. After the ingress PE receives the data packet, it directly finds the route of the destination address in the compatible VRF corresponding to the input interface, and uses the two-layer label mechanism to encapsulate the MPLS data packet, and sends the data according to the found route The packet is forwarded;

b3. In the SP network, label switching is performed according to the LSP, forwarded from the corresponding interface to the downstream router, and passed on in sequence until the penultimate hop of the egress PE, where the label on the top of the stack is popped up at the penultimate hop of the egress PE, and from The corresponding interface is forwarded to the egress PE;

B4, the exit PE pops up the bottom layer label of the data packet, reverts to the IP packet whose destination address is the IPv4 format, and directly forwards the IP packet from the output interface to the destination VPN site according to its own MPLS label forwarding table;

b5. After the device in the destination VPN site receives the data packet, it performs the longest path matching search in the local routing table according to the destination address of the IP packet, finds the corresponding route, and sends the data packet to the next-hop router. Finally forwarded to the destination device.

In the present invention, the VPN-IPv4 compatible IPv6 address formally represents the IPv6 VPN route, and in fact represents the delivery of the IPv4 VPN route. The present invention utilizes the special structure of the IPv4 compatible IPv6 address, that is, the mutual mapping relationship between the IPv6 address and the IPv4 address and its The routable feature in the backbone network solves the legality of transmitting IPv4 VPN routes in the IPv6 backbone network.

The invention can effectively complete the problem that the SP based on the IPv6 backbone network provides VPN service to the users based on IPv4 in the transition process to IPv6. Moreover, the present invention does not need to upgrade the hardware, but only needs to improve the software of the PE equipment, and the configuration method is simple and easy. And the method of the present invention complies with the current popular RFC 2547bis system and has good scalability.

Description of drawings

Figure 1 is a VPN solution where the backbone network is an IPv4 single AS and the users are IPv6;

Figure 2 is a VPN solution in which the backbone network is an IPv6 single AS and the users are IPv4;

Fig. 3 is a schematic flowchart of the method of the present invention in which the tunnel is an LSP as an example.

Detailed ways

The core idea of the present invention is: the destination VPN site in the IPv4 user network sends the routing information of the destination site to the source VPN site in the IPv4 user network through the IPv6 backbone network, and the ingress provider edge equipment PE of the source VPN site and the destination VPN Tunnels are established between the egress PEs of the sites; the source VPN site uses the routing information and tunnels of the destination VPN site to send service flows to the destination VPN site. In the present invention, the tunnel may be a label switching path LSP. In addition, the destination VPN site can establish a tunnel before or after sending the VPN routing information of the destination site to the source site in the IPv4 user network through the IPv6 backbone network.

As shown in Figure 2, in the system applied by the present invention, the backbone network is based on IPv6 single AS, and the user sites are based on IPv4 BGP/MPLS VPN. Site 1 and Site 4 belong to VPN1, and Site 2 and Site 3 belong to VPN2. Different VPN sites in the same VPN can communicate with each other, but sites in different VPNs cannot communicate with each other. In Figure 2, interior gateway protocols such as OSPF, IS-IS, and RIP are running in each user site, PE routers are configured with IPv4/v6 dual protocol stacks, and interior gateway protocols such as OSPFv3, IS-ISv6, RIPng, etc. are running in the IPv6 MPLS backbone network. LDP protocol.

In the present invention, the business information in the BGP/MPLS VPN is divided into two categories: control information and data information. The former includes general routing information, VPN routing information, and LDP messages needed to establish an LSP, etc., and the latter mainly refers to the user's VPN service flow. Common routing information such as tunnel ID, LSP, etc.

Referring to shown in Figure 3, the following takes the tunnel as an example of an LSP to describe the method for realizing the present invention, specifically as follows:

Step 301: The destination VPN site sends VPN routing information whose address is in IPv4 format to the egress PE.

Step 302: After receiving the routing information, the egress PE allocates an LSP for the VPN route, and uses the VPN routing information, the LSP, and the input interface through which the egress PE receives the routing information to update the compatible VRF and MPLS label forwarding table corresponding to the VPN , and set the route target property.

It should be noted that compatible VRF has the following features: it supports the automatic conversion function of input and output of IPv4 addresses and IPv4-compatible IPv6 addresses; routing table entries support the coexistence of IPv4 destination prefixes and IPv6 next-hop heterogeneous addresses; it has all the functions of ordinary VRFs.

The VPN-IPv4 compatible IPv6 address is a special type of address used in this solution. Among them, the IPv4 compatible IPv6 address can be expressed as 0:0:0:0:0:0:w.x.y.z or ::w.x.y.z (w.x.y.z is an IPv4 address expressed in dotted decimal), which is used for nodes with both IPv4 and IPv6 protocols Use IPv6 for communication. The VPN-IPv4 compatible IPv6 address uses RD (Route Distinguishing Identity) and IPv4 compatible IPv6 address to represent the particularity of VPN routes in BGP, so as to cleverly realize the transmission of VPN routes of different address families in the backbone network.

Compatible VRF includes output routing target attribute, routing ID, destination address, next hop ID, output interface and other information. The MPLS label forwarding table includes parameters such as input interface, input label, processing mode, and output interface.

The updating of the compatible VRF corresponding to the VPN refers to: setting the destination address corresponding to the routing identifier of the VPN as the IPv4 address in the routing information, and setting the next hop as the egress address of the source VPN site.

Modifying the MPLS label forwarding table refers to: setting the corresponding relationship between input interface, input label, processing mode and output interface. Here, the input interface is the interface through which the egress PE receives the data flow.

Step 303: The egress PE binds and encapsulates the VPN route including its own routing information and the routing information of the destination site into the multi-protocol reachable attribute of BGP according to the VPN route and the LSP allocated by itself for the VPN route, and sets the VPN route for the VPN route. The routing target attribute (based on the extended community attribute of the routing target), the VPN routing information encapsulated into the BGP multi-protocol reachable attribute, and the LSP allocated for the VPN route are sent to the ingress PE through an UPDATE message.

The routing information of the input interface in the VPN routing information is an IPv6 address, or an IPv4 compatible IPv6 address using the input interface.

Step 304: The ingress PE compares the output destination attribute value of the route carried in the UPDATE message with the input destination attribute value of each compatible VRF in the PE. If an input destination compatible with VRF is found to contain the output destination attribute value of this route, Store the VPN route and LSP information in the compatible VRF corresponding to the VPN in the ingress PE; otherwise, discard the route.

When the routing information of the input interface is an IPv6 address, the ingress PE performs inverse mapping according to the destination prefix in the multi-protocol reachability attribute to obtain the destination address;

When the routing information of the input interface is an IPv4-compatible IPv6 address, the destination address is obtained through inverse mapping directly according to the IPv4-compatible IPv6 address in the multi-protocol reachability attribute.

Step 305: After the source VPN site obtains the VPN route from the ingress PE, it installs relevant route entries in its own routing table. Other routers in the source VPN site learn these routes through the interior gateway protocol and install them in their own routing tables, and the next hops of these routes are the addresses of the routers next to the source CE.

Step 306: The source VPN site uses the routing information of the target VPN site and the tunnel between the egress PE and the ingress PE to send the service flow to the target VPN site.

Taking the VPN route notification of site 4 to site 1 and site 1 sending VPN service flow to site 4 as an example, the transfer process of control information and data information in the present invention will be described respectively.

Referring to Fig. 2, the process of implementing the control information in Embodiment 1 is as follows:

(1) The routers inside the user site 4 run a unified interior gateway protocol. After protocol diffusion, the user site equipment CE4 obtains an internal route 10.0.0.0/8 in IPv4 address format.

(2) CE4 advertises the routing information of site 4 to PE2, and the routing information is the internal route 10.0.0.0/8 of site 4.

The specific publishing method is not limited to a certain method. For example, the interior gateway protocol notification can be run between CE4 and PE2, EBGP notification can also be run, and statically configured routing can also be used to notify.

(3) When PE2 receives the route 10.0.0.0/8 from CE4, it determines the route ID through the interface if1 that receives the routing information. For example, the if1 interface of PE2 corresponds to VPN1, and if2 corresponds to VPN2, and is the corresponding VPN1 in CE4 The VPN site route in the compatible VRF is assigned an LSP, such as 100, which corresponds to the interface if1 of PE2, and PE2 also assigns an input interface, such as if2, to the route. PE2 uses the LSP, input interface if2, and output interface if1 to set an MPLS label forwarding table. At the same time, the routing target attribute is set for the compatible VRF, that is, the corresponding relationship between the VPN site route and the set output routing target attribute is set.

As shown in Table 1, in the compatible VRF corresponding to VPN1 in PE2, the destination address is 10.0.0.0/8, the next-hop address is CE4, the output interface is if1, and the bottom label is 100.

Destination Address Next Hop Route ID Interface Bottom Label Top Label

10.0.0.0/8 CE4 RED if1 100 ------

Table 1

As shown in Table 2, the input interface in the modified MPLS label forwarding table is if2, the incoming label is set to 100, the processing mode is "popup label", and the output interface is if1.

Input Interface Input Label Processing Output Interface

if2 100 popup label if1

Table 2

(4) PE2 binds and encapsulates the IPv6 VPN routing information and the label LSP allocated by PE2 in the BGP multi-protocol reachability attribute in the UPDATE message, and sends it to PE1. VPN routing information includes routing identifier RD and routing target RT, VPN destination address and next hop address.

Here, since the input interface of PE2 directly faces the IPv6 backbone network, the IPv6 address of the input interface of PE2 can be directly used as the next hop to notify PE1. Table 3 shows the encapsulation format of PE2's multi-protocol reachability attribute for the route 10.0.0.0/8.

AFI is 2 SAFI is 129 (indicating that the routing information carried in the NLRI field is an IPv6VPN route with an MPLS label) Next hop length (24)

Next hop (the IPv6 address of the input interface RD:3FFE:3210:FFFF::1, RD is usually set to zero) SNPA information Length(27) MPLS labels (assumed to be 100) VPN destination prefix RD:::10.0.0.0

table 3

In addition, PE2 also encapsulates the extended community attribute in the UPDATE message and sends it out. The encapsulation of extended community attributes is shown in Table 4.

Allocation type Manager AS User AS

Table 4

(5) After receiving the UPDATE message, PE1 selectively receives the IPv6 VPN route from PE2 according to the extended community attribute based on the route target.

Specifically: according to the output target attribute value of the route carried in the UPDATE message, compare it with the input target attribute value of each compatible VRF in PE1, if a compatible VRF (that is, the compatible VRF corresponding to VPN1) input target attribute value is found If the output destination attribute value of the route is included, the route::10.0.0.0/104 will be stored in the compatible VRF; if all the input destinations of the compatible VRF do not contain this value, the route will be discarded.

The process of storing the route::10.0.0.0/104 into this compatible VRF is:

PE1 extracts the destination prefix::10.0.0.0/104 from the BGP multi-protocol reachability attribute and maps back to 10.0.0.0/8, extracts the next hop PE2 (3FFE:3210:FFFF::1) and label 100, and The VPN route is stored in VRF RED, as shown in Table 5.

Store the following routing information in the compatible VRF corresponding to VPN1 saved in PE1:

Purpose Next hop route target Route ID interface bottom label top tab 10.0.0.0/8 PE2 RD-RED RED if2 100 66

table 5

Here, because the next hop PE2 of 10.0.0.0/8 is a non-adjacent router, the MPLS backbone network must be used to reach PE2. By querying the FEC whose purpose is PE2, the entry label 66 of the LSP arriving at PE2 is obtained, and written into the VRF table. This LSP is pre-established according to the interior gateway protocol and LDP, and has nothing to do with VPN routing.

(6) After CE1 obtains the VPN route 10.0.0.0/8 of PE1 through the interior gateway protocol or EBGP or static routing, it will install the relevant routing entries in the routing table of CE1.

Here, the interior gateway protocol, EBGP, or even a static route can be configured between CE1 and the remote PE1. Except that one site belongs to multiple VPNs, generally one interface corresponds to one VRF. In this way, after a route is installed in a compatible VRF of PE1, it can directly decide which interface to advertise the route to.

(7) After the CE1 site installs the VPN route 10.0.0.0/8 into its own routing table, other routers in the site learn these routes through the interior gateway protocol, install them in their own routing table, and the next hop of these routes Both are to the immediate router address of CE1.

(8) Establish LSPs. There are many different methods, such as using LDP or RSVP. As expected, the establishment of LSPs can be independent of the upper layer IP-VPN routes, or the LSPs can be established after the VPN routes are advertised. Alternatively, pre-establishing LSPs before advertising VPN routes is also acceptable.

The forwarding process of business data information is as follows:

(1) Now there is a data packet with the destination address 10.0.0.0/8 sent from a host at site 1, and it is first sent to the router as its default gateway. If there is already this route in the router, find the route through the longest prefix match, and forward it to the next-hop router; through level-by-level forwarding, it finally reaches CE1.

(2) For the data packet of the existing route in the routing table of CE1, the next hop is PE1, the route is found through the longest path matching, and the data packet is forwarded to PE1.

(3) Since the data packet is received from the interface if2 connecting PE1 and CE1, after receiving the packet, PE1 directly searches for the route of the destination address in the compatible VRF corresponding to the input interface if2. Find the corresponding route in RED VRF, use the two-layer label mechanism to encapsulate the MPLS data packet, and forward the data packet according to the outbound interface if2.

(4) In the SP network, label switching is performed according to the LSP, and forwarded to the following P (P2, P3...) from the corresponding interface. It is transmitted in sequence until the penultimate hop Pn of PE2 (here n=2), so the top label 77 of the stack is popped at Pn and forwarded to PE2 from the corresponding interface.

(5) When the data packet arrives at PE2, the underlying label is popped up, and it is restored to an IPv4 data packet. Because there is already an output interface corresponding to the label in the forwarding table, there is no need to search for VRF, and the data packet is directly forwarded from the output interface to CE4.

(6) After CE4 receives the data packet, according to the destination address of the IP packet, it performs the longest path matching search in the local routing table, finds the corresponding route, sends the data packet to the next-hop router, and finally forwards it to the destination .

The technical solution of the present invention will be described in detail below with specific example 2.

In this embodiment, the PE routers are all configured with dual protocol stacks, and internal gateway protocols such as OSPF, IS-IS, RIP, etc. are run in each user site, and the PE routers are all configured with IPv4/v6 dual protocol stacks, and the internal gateway protocols run in the IPv6MPLS backbone network protocol and LDP protocol, interior gateway protocols such as OSPFv3, IS-ISv6, RIPng, etc. In particular, it should be pointed out that the interfaces of PE facing the IPv6 backbone network, such as if2 and if4 of PE2, must be configured with IPv4-compatible IPv6 addresses.

Embodiment 2 The processing procedure of the control information is as follows:

(1) The internal routers at user site 4 run a unified interior gateway protocol. After protocol diffusion, user site equipment CE4 will obtain an internal route 10.0.0.0/8.

(2) The interior gateway protocol, EBGP, or even static routing can be configured between CE4 and PE2. CE4 advertises the internal IPv4 route 10.0.0.0/8 of Site 4 to PE2 through the above methods.

(3) When PE2 receives the route 10.0.0.0/8 from CE4, it stores the route in the compatible VRF corresponding to VPN1, and sets the next hop as the egress address (IPv4 address) of CE4. Set route target properties. PE2 allocates an LSP for the VPN site route in the compatible VRF, the LSP corresponds to the input interface of PE2, and modifies the MPLS label forwarding table.

As shown in Table 6, the content in the compatible VRF corresponding to VPN1 saved by PE2 is:

Purpose: Next hop Route ID interface bottom label top tab 10.0.0.0/8 CE4 RED if1 100

Table 6

Referring to Table 7, the modified MPLS label forwarding table is as follows:

input interface Into the label deal with Output Interface if2 100 popup tab if1

Table 7

(4) PE2 binds and encapsulates the VPN routing information and the label LSP allocated by PE2 in the BGP multi-protocol reachability attribute in the UPDATE message, and sends it to PE1. VPN routing information includes routing identifier RD and routing target RT, VPN destination address and next hop address.

Here, since the input interface if4 of PE2 directly faces the IPv6 backbone network and has been configured with an IPv4-compatible IPv6 address (::202.112.146.2), the reverse mapping IPv4 address (202.112.146.2) of the IPv4-compatible IPv6 address of the input interface can be used Notify PE1 as the next hop. Table 8 shows the encapsulation format of PE2's multi-protocol reachability attribute for the route 10.0.0.0/8.

AFI is 2 SAFI is 129 (indicating that the routing information carried in the NLRI field is an IPv6VPN route with an MPLS label) Next hop length (12) Next hop (the IPv4 address RD of the input interface: 202.112.146.2, RD should be set to zero) SNPA information Length(13) MPLS label VPN destination prefix RD: 10.0.0.0

Table 8

(5) PE1 can selectively receive the IPv6 VPN route from PE2 according to the extended community attribute based on the route target. According to the comparison between the output destination attribute value of the route carried in the UPDATE message and the input destination attribute values compatible with each VRF in the PE, it will be found that a VRF-compatible input destination contains the output destination attribute value of this route. Then store the route 10.0.0.0/8 into this compatible VRF. If all VRF-compatible input destinations do not contain this value, the route is discarded. The process of storing the compatible VRF here is that PE1 extracts the destination prefix 10.0.0.0, next hop 202.112.146.2, and label 100 from the BGP multi-protocol reachability attribute, and stores the VPN route in the compatible VRF, as shown below .

Store the following routing information in the RED VRF of PE1:

Purpose Next hop route target Route ID interface bottom label top tab 10.0.0.0/8 PE2 RD-RED RED if2 100 66

Table 9

The determination of the next hop and the addition of the top label are worth noting here. Since the next hop address of 10.0.0.0/8 is an IPv4 address, the route to this IPv4 address cannot be obtained directly. Compatible VRF maps the next-hop IPv4 address to an IPv4-compatible IPv6 address, and the compatible address has been diffused in the backbone network as an IGP route, so PE2 is determined as the next-hop router. However, PE2 is a non-adjacent router, and the MPLS backbone network must be used to reach PE2. By querying the FEC whose purpose is PE2, the ingress label 66 of the LSP arriving at PE2 is obtained, and written into the compatible VRF corresponding to VPN1 in PE1.

(6) After CE1 obtains the VPN route 10.0.0.0/8 of PE1 through the interior gateway protocol or EBGP or static routing, it will install the relevant routing entries in the routing table of CE1.

The interior gateway protocol, EBGP, or even static routing can be configured between CE1 and remote PE1. And except for the case where a site belongs to multiple VPNs, generally one interface corresponds to one compatible VRF, so that when a route is installed in a compatible VRF of PE1, it can directly decide which interface to advertise the route to. .

(7) Other routers in the CE1 site learn these routes through the interior gateway protocol and install them in their own routing tables, and the next hops of these routes are all the addresses of the routers next to CE1.

(8) Establish LSPs. Same as step (8) in Example 1.

After the forwarding control signaling based on the second embodiment above, the subsequent data forwarding process is the same as the forwarding steps of the service data information in the first embodiment, which will not be repeated here.

Claims (8)

1. A routing method for a virtual private network, applied in a communication system based on an IPv6 backbone network and an IPv4 user network, characterized in that each VPN corresponds to a compatible virtual routing forwarding table VRF, and the compatible VRF supports IPv4 compatible IPv6 address, each compatible VRF corresponds to a routing target attribute, and the method includes the following steps: a. The destination VPN site in the IPv4 user network sends the routing information of the destination VPN site in the IPv4 address format to the edge device PE of the egress provider; the egress PE converts the routing information into an IPv4 address according to the compatible VRF corresponding to the destination VPN The routing information in compatible IPv6 address format is sent to the ingress PE through the IPv6 backbone network; the ingress PE converts the received routing information in the IPv4-compatible IPv6 address format into the address in the IPv4 address format according to the compatible VRF corresponding to the destination VPN. Send the routing information to the source VPN site in the IPv4 user network; And a tunnel is established between the ingress PE of the source VPN site and the egress PE of the destination VPN site; b. The source VPN site uses the routing information and tunnel of the destination VPN site to send the service flow to the destination VPN site. 2. The method according to claim 1, wherein the tunnel is a Label Switching Path (LSP). 3. The method according to claim 1 or 2, wherein the tunnel is established before or after the destination VPN site sends the VPN routing information of the destination site to the source site in the IPv4 user network through the IPv6 backbone network . 4. The method according to claim 2, wherein the LSP is established using LDP or RSVP. 5. The method of claim 2, wherein: In step a, the steps for the egress PE to send the route information after the converted address format to the ingress PE through the IPv6 backbone network include: a11. The egress PE sets the destination address in the compatible VRF of the VPN as the IPv4 address in the routing information, sets the next-hop address as the destination VPN site, and allocates an LSP for the routing information, and uses the LSP to modify its own saved MPLS label forwarding table; a12. The egress PE sends the routing information including its own input interface and the VPN routing information of the destination address sent by the destination VPN, the LSP label assigned by the egress PE, and the set target routing attribute to the ingress PE; In step a, the steps for the ingress PE to send the routing information in IPv4 address format to the source VPN site in the IPv4 user network include: a21. The ingress PE judges that the received target route attribute value is the same as the target route attribute value in all compatible VRFs corresponding to itself. If it finds the same value as the received target route attribute value in all compatible VRFs corresponding to itself, then Update the routing information in the compatible VRF with the same routing target attribute value according to the routing information of the VPN from the egress PE; After the device in the source VPN site receives the VPN routing information of the ingress PE, it installs relevant routing entries in its own routing table; the router in the source VPN site learns the routing information. 6. The method according to claim 5, wherein the routing information of the input interface in the VPN routing information in step a12 is an IPv6 address, or an IPv4-compatible IPv6 address using the input interface; When the routing information of the input interface is an IPv6 address, the destination address in the routing information of the VPN described in step a21 is obtained by inverse mapping of the ingress PE according to the destination prefix in the multi-protocol reachability attribute; When the routing information of the input interface is an IPv4-compatible IPv6 address, the destination address in the VPN routing information in step a21 is obtained by inverse mapping directly according to the IPv4-compatible IPv6 address in the multi-protocol reachability attribute. 7. The method according to claim 5, wherein the routing information of the destination VPN station is sent between the destination VPN station and the egress PE by running an interior gateway protocol, EBGP, or a statically configured routing method. 8. The method according to claim 2, wherein step b comprises: b0. The device in the source VPN site sends the data packet containing the destination address to the corresponding gateway router. After receiving the data packet, the router judges that it saves the routing information corresponding to the destination address. If there is, it will follow the routing information The data packet is forwarded to the next-hop router, and finally reaches the egress device in the source VPN site after forwarding step by step; b1. The egress device in the source VPN site queries the routing table saved by itself according to the destination address of the data packet to obtain the address of the ingress PE, and forwards the data packet to the ingress PE; b2. After the ingress PE receives the data packet, it directly finds the route of the destination address in the compatible VRF corresponding to the input interface, and uses the two-layer label mechanism to encapsulate the MPLS data packet, and sends the data according to the found route The packet is forwarded; b3. In the SP network, label switching is performed according to the LSP, forwarded from the corresponding interface to the downstream router, and passed on in sequence until the penultimate hop of the egress PE, where the label on the top of the stack is popped up at the penultimate hop of the egress PE, and sent from The corresponding interface is forwarded to the egress PE; B4, the exit PE pops up the bottom layer label of the data packet, reverts to the IP packet whose destination address is the IPv4 format, and directly forwards the IP packet from the output interface to the destination VPN site according to its own MPLS label forwarding table; b5. After the device in the destination VPN site receives the data packet, it performs the longest path matching search in the local routing table according to the destination address of the IP packet, finds the corresponding route, and sends the data packet to the next-hop router. Finally forwarded to the destination device.

Images