CN100446503C - A method and device for enhancing VPN network optimization - Google Patents

Abstract

The present invention provides an enhanced VPN network optimization method, which is used to transparently transmit the VLAN of the private network from the public network to other private networks that need to be connected. The method includes the following steps: (1) at the ingress port of the network device, Map the VLAN label on the user data frame into a VPN ID according to the incoming physical port; (2) forward the above-mentioned processed user data frame inside the operator's network; (3) at the outgoing port of the network device, according to the outgoing The physical port maps the data frame carrying the VPN ID into a data frame carrying the user VLAN tag and forwards it. The present invention can realize 4K*4K VPNs; it can realize that the user service type mark inside a VPN can be represented by two layers of VLAN labels; moreover, it does not need to use a switch with MPLS function, and can only be centralized on one device configuration.

Description

A method and device for enhancing VPN network optimization

technical field

The present invention relates to the technical field of network communication, in particular to an enhanced VPN (Virtual Private Network, virtual leased line) network optimization method and equipment.

Background technique

The local area network in the same physical form can be divided into multiple VLANs (Virtual Local Area Network, Virtual Local Area Network), and each VLAN cannot be accessed directly, but can only be accessed through routing devices, which can improve the security and reliability of the network. VPN (Virtual Private Networks, virtual private network) technology is a technology that transmits private networks through public networks. Through this technology, private networks in different locations can be connected, which is a cheap and efficient method. Currently commonly used Layer 2 VPN technologies include V-switch technology (VLAN switching technology, a technology that uses VLAN label switching for forwarding), QinQ technology (two-layer IEEE802. Two-layer VLAN label, also known as 802.1Q tunnel technology) and VPN technology based on MPLS (Multi-Protocol LabelSwitch, multi-protocol label switching technology).

Among them, the V-switch technology is a simple VPN technology, and the basic principle of its realization is to directly switch one or two layers of VLAN tags of the Ethernet data frame of the ingress port into corresponding VLAN tags of the egress port. Specifically, the layer-2 switching device replaces the one or two-layer VLAN tag belonging to a specific VPN carried by the data frame coming in from the ingress port with a new one or two-layer VLAN tag belonging to another LAN belonging to the specific VPN. Layer VLAN tags, and then send out from the output port, and then realize the formation of a large VPN network of LANs with different VLAN tags in different regions.

However, the use of V-switch to implement VPN has the following disadvantages: (1) it can only realize point-to-point VPN; (2) it needs to rely on manual If it is a device, it needs to be configured on each device, and it cannot be self-routing and forwarding after configuration at the entrance of the operator's network; (3) The final exchange of VPN user services is not performed, that is to say, no VPN user services are performed. MAC address learning and MAC address forwarding

QinQ technology is another simple VPN technology. It adopts L2 layer technology, through two layers of IEEE802.1Q standard label encapsulation technology, that is, encapsulates a public network VLAN The VLAN of the network can be transparently transmitted from the public network to other private networks that need to be connected. Because it can realize a simple VPN function without additional signaling support, and can form a large VPLS (Virtual PrivateLAN Service, Virtual Private LAN Service) from scattered LANs (LocalArea Network, local area network), it is very easy and convenient.

However, this technology can only use one layer of VLAN tags to identify user VPNs, and it cannot support the situation when two layers of VLAN tags are required to determine a user VPN. However, in actual network applications, there are many places where two layers of VLAN tags are required. To mark a user; in addition, using the Layer 2 VLAN tag encapsulated by QinQ technology, the outer VLAN tag is provided by the operator to represent the identification of the VPN, and the inner VLNA tag is provided by the user to represent the type of each VPN internal service. In this way, the configuration of a VPN and its service types must be completed jointly by the operator and the enterprise network, rather than by one party. What's more, each VLAN label is defined globally by 12 bits of binary, so the problem brought is that each port can only realize 4096 VPNs.

MPLS-based VPN technology is implemented using MPLS labels. The data frames of user services are transmitted in ordinary Ethernet data frames inside the CE (Consumer Edge, user edge device). After entering the operator's PE (Provider Edge, provider edge) device, the PE Destination MAC information, get a double-layer MPLS label after searching the forwarding table, and then get a next-hop destination MAC and VLAN information according to this double-layer MPLS label, and send it from the corresponding sending port of the device after encapsulation, and send it to the peer's PE equipment. Table 1 below shows the user's normal data frame, and Table 2 shows the MPLS data frame.

Table 1 User normal data frame

Table 2MPLS data frame

After the MPLS-encapsulated data packet arrives at the peer PE device, the PE device removes the two-layer MPLS label, and obtains the final egress port information of the VPN user service on the device from the inner label of the two-layer MPLS label. The Layer 2 Ethernet data frame of the user VPN is sent out from the corresponding physical port intact.

However, MPLS-based VPN technology requires devices to support MPLS labels, which puts forward higher requirements for devices; in addition, it requires users to mark the same service within the same VPN must be globally unified, which cannot be achieved in different The location (meaning the different exits of the equipment) and the VLAN values in the form of business signs are different, which brings difficulties to the realization of the VPN network; finally, because the VPN signs and the service signs inside the VPN are configured by the operator and the enterprise customer respectively, the same It cannot be done centrally by one party.

Contents of the invention

The purpose of the present invention is to overcome the defects and deficiencies in the above-mentioned various prior art, and provide a new enhanced VPN network optimization method and its equipment.

For this reason the present invention provides a kind of enhanced VPN network optimization method, is used to make the VLAN of private network pass through from public network to other private networks that need to be connected, wherein said public network includes at least one network device inlet port and one A network device output port, the method includes the following steps:

(1) at the inlet port of the network equipment, the user VLAN label on the user data frame is mapped into a VPN ID according to the mapping table configured at the physical port;

(2) forwarding the user data frame after the above processing within the public network;

(3) at the outgoing port of the network device, according to the mapping table configured at the outgoing physical port, the data frame carrying the VPN ID is mapped into a data frame carrying the user VLAN label and forwarded.

Wherein, the mapping method described in step (1) specifically includes:

(11) Configure a mapping table at the ingress port of the network device so that the VPN ID corresponds to the user VLAN label and ingress port number;

(12) network equipment enters the port, and after receiving the data frame that carries the user VLAN tag, the above-mentioned mapping table is queried;

(13) According to the result of query, replace the user VLAN tag carried in the data frame as the VPN ID.

Wherein, the mapping method described in step (3) specifically includes:

(31) Configure a mapping table at the outgoing port of the network device, so that the VPN ID and the outgoing port number correspond to the user VLAN label;

(32) Network equipment outlet port, after receiving the data frame that carries VPN ID, query above-mentioned mapping table;

(33) According to the result of inquiry, replace the VPN ID carried in the data frame as the user VLAN label.

Wherein, described VPN ID is a new one or two layers of VLAN label; Described network equipment can be switch or router.

The present invention also provides a network device made for implementing the above method, which is provided with a CPU and a commercial forwarding chip, and a conversion module is further provided before the commercial forwarding chip, wherein:

On each incoming physical port of the network device, the module replaces the user VLAN tag carried in the data frame with a new VPN ID according to the configured user VLAN tag and the mapping table between the incoming port number and the VPN ID, recalculates the CRC, and delivers Subsequent forwarding to the subsequent commercial ASIC;

After the module regenerates the data frame carrying the VPN ID into the data frame carrying the user VLAN tag on the corresponding physical port of the network device, according to the mapping table between the configured VPN ID and the outgoing port number and the user VLAN tag of the VPN user , to the commercial forwarding chip for forwarding.

Wherein, the VPN ID can be a new layer or two layers of VLAN tags; before the processed data frame is handed over to the commercial forwarding chip for forwarding, the conversion module also needs to recalculate the CRC; the network device can be a switch, or Can be a router. Compared with the existing technology, since the present invention supports the use of two layers of VLAN tags in the second-layer data frame to represent the VPN ID, the present invention can realize 4K*4K VPNs, which greatly expands the number of VPNs and provides The increase in the number of users is better supported. Simultaneously, the method for configuring the mapping table at the ingress port and the egress port respectively can change the numerical value of the user VLAN label, thereby can make the user service type mark in a VPN have different manifestations in different physical ports (corresponding to different physical locations), and Centralized configuration can be realized on only one device, thus simplifying network deployment. Finally, the point-to-multipoint VPN method provided by the present invention does not need to use a switch with MPLS function, and can be applied to many low-end and middle-end devices at present, thus greatly reducing the cost of network operators.

Description of drawings

Accompanying drawing is the schematic diagram of internal hardware structure of the device adopting the present invention.

Detailed ways

In order to better understand the present invention, the present invention will be further described below in conjunction with specific embodiments. Of course, this specific embodiment is only a demonstration and typical example of the present invention, and cannot limit the scope of protection claimed by the present invention.

The typical implementation steps of the enhanced VPN network optimization method provided by the present invention include three main steps of operator network ingress port processing, operator network internal forwarding and operator network egress port processing. Here, the carrier is taken as an example to better demonstrate in combination with the actual situation, and the carrier network here may be any network with a Layer 2 VPN function. At the same time, the ingress port and egress port of the network operator here can be physical ports on different network devices in the same network, or different physical ports on the same network device in the same network, or even the same network device in the same network The same physical port on the network, where the network device is generally a switch or router.

Firstly, the method for processing an ingress port of an operator network in the present invention will be described in detail.

In the direction of the inbound physical port of the switch connected to the user network at the edge of the carrier network, a table is added to complete the identification of VPN users and the replacement of VLAN tags. The input of this table is the ingress port of the user VPN data frame and one or two layers of VLAN tags carried by it, and the output after the table lookup is another layer or two layers of VLAN tags used by the operator representing the VPN mark. It should be noted that the table can be manually configured or realized by other methods, as long as the above logical mapping function can be realized. At the same time, if the VLAN tag of the replaced Layer 2 data frame is one layer, then 4096 VPNs are supported; if the replaced VLAN tag is two layers, then 4K*4K VPNs are supported.

Table 3 is an example of the carrier inbound port mapping table.

The replaced one or two layers of VLAN tags represent that the VPN ID of the VPN must be unified in the operator's internal network. The VPN ID referred to here is a logical concept. For example, in Table 3, the incoming physical port 1 The double VLAN tag of the user is mapped to 301 and 302 representing the VPN logo, and 301+302 together form a VPN ID. Assuming it is VPN1, it can be known that the double VLAN tag entering physical port 3 is also mapped to VPN1 of 301+302 , so in Table 3, the users represented by ingress physical ports 1 and 3 belong to the same VPN user.

Since the VLAN tag before replacement is based on the configuration of the specific ingress port, there are cases where multiple VLAN tags of different ports are mapped to the same VPN ID.

Then, the forwarding within the operator's network is performed. During the internal forwarding process of the carrier network, self-learning forwarding is performed according to the converted VLAN flag until it is forwarded to the egress of the carrier network. This process is no different from the forwarding process inside the Layer 2 VPN provided by ordinary carriers. Here No longer.

Next, the method for processing the egress port of the operator will be described in detail.

In the egress direction of the operator's double-VLAN label VPN switch, add a table to complete the conversion between the VPN label used by the operator and the VLAN label used by the user. The input of this table is to represent one or two layers of VLAN labels of the VPN ID mark, and the output is the VLAN label (one or two layers) of the user's representation of the VPN at the output port.

Table 4 is an example of an operator's outbound port mapping table.

This table in the output direction is also configured according to the specific output port, that is to say, for the same VPNID, on different physical output ports, the translated user VLAN tags of the two layers can be different.

It should be noted that the technical solution provided by the present invention can support data frames with one or two layers of VLAN tags, if there is only one layer of tags replaced in the above-mentioned operator network ingress port table, and then only according to the tags of this layer. MAC address learning and forwarding, then only 4096 VPNs can be supported, which is supported by all chips currently on the market. However, if the replaced label in the ingress port table has two layers, and then MAC address learning and forwarding are performed according to the two layers of labels, then 4096*4096 VPNs can be supported, which affects the equipment connected to the carrier network and the user network. The forwarding chip function puts forward higher requirements. This is not supported by ordinary network data exchange equipment, especially switches with commercial L2/L3 forwarding chips.

To this end, the present invention provides a device dedicated to implementing the method provided by the present invention. The following describes in detail the internal composition principle of the device implementing the method for providing point-to-multipoint Layer 2 VPN using double VLAN tags in the present invention in conjunction with the accompanying drawings.

Current commercial L2/L3 layer switch forwarding chips all support VLAN-based forwarding, so as shown in Figure 1, the present invention adds a conversion module in front of the forwarding chip to realize the forwarding of user data frames with double VLAN tags Yes, the conversion module here can be realized by hardware or software.

The specific functions realized by this module are described as follows: In the direction of the entrance of each physical port of the switch, according to the mapping table of two layers of VLAN tags configured by the CPU to one (or two layers) of VLAN tags, it is mapped to a new VLAN representing a Layer 2 VPN ID , and then recalculate the CRC and hand it over to the subsequent commercial ASIC for subsequent forwarding; at the egress of each GE (Gigabit Ethernet), according to the new VLAN tag representing the second-layer VPN ID, according to the mapping table configured on each port by the CPU , regenerate two layers of tags, and then recalculate the CRC and send it out.

The FPGA (Field program gate array, field programmable gate array) in the conversion module does simple work (mapping and CRC), and its cost is low. And the table is configured on each physical port, so the FPGA can only complete the in/out conversion of the VPN port that supports double VLAN tags as required, rather than all ports must be implemented.

In summary, the method and equipment provided by the present invention can enhance the functions provided by the existing Layer 2 VPN network at a relatively low cost, especially the Layer 2 Ethernet data frames with double VLAN tags can be processed , can realize 4K*4K VPNs, and the network configuration method is more flexible and convenient.

Claims (9)

1. A method for enhancing VPN network optimization, used to make the VLAN of the private network pass through from the public network to other private networks that need to be connected, wherein the public network includes at least one network device inlet port and one network device outlet port Port, it is characterized in that, the method comprises the steps: (1) at the inlet port of the network equipment, the user VLAN label on the user data frame is mapped into a VPN ID according to the mapping table configured at the physical port; (2) forwarding the user data frame after the above processing within the public network; (3) at the outgoing port of the network device, according to the mapping table configured at the outgoing physical port, the data frame carrying the VPN ID is mapped into a data frame carrying the user VLAN label and forwarded. 2. method according to claim 1, is characterized in that, the mapping method described in step (1) specifically comprises: (11) Configure a mapping table at the ingress port of the network device so that the VPN ID corresponds to the user VLAN label and ingress port number; (12) network equipment enters the port, and after receiving the data frame that carries the user VLAN tag, the above-mentioned mapping table is queried; (13) According to the result of query, replace the user VLAN tag carried in the data frame as the VPN ID. 3. method according to claim 1, is characterized in that, the mapping method described in step (3) specifically comprises: (31) Configure a mapping table at the outgoing port of the network device, so that the VPN ID and the outgoing port number correspond to the user VLAN label; (32) Network equipment outlet port, after receiving the data frame that carries VPN ID, query above-mentioned mapping table; (33) According to the result of inquiry, replace the VPN ID carried in the data frame as the user VLAN label. 4. The method according to claim 2 or 3, characterized in that the VPN ID is a new layer or two layers of VLAN tags. 5. The method according to any one of claims 1-3, wherein the network device is a switch or a router. 6. A network device made for implementing the method of claim 1, equipped with a CPU and a commercial forwarding chip, characterized in that: a conversion module is further provided before the commercial forwarding chip, wherein: On each incoming physical port of the network device, the module replaces the user VLAN tag carried in the data frame with a new VPN ID according to the configured user VLAN tag and the mapping table between the incoming port number and the VPN ID, recalculates the CRC, and delivers Subsequent forwarding to the subsequent commercial ASIC; On the corresponding physical port of the network device, the module regenerates the data frame carrying the VPN ID into a data frame carrying the user VLAN tag according to the configured mapping table between the VPN ID and the outgoing port number and the user VLAN tag, and then delivers it to the commercial Forwarding chip forwarding. 7. The network device according to claim 6, characterized in that, the VPN ID is a new one-layer or two-layer VLAN tag. 8. The network device according to claim 6 or 7, wherein the conversion module needs to recalculate the CRC before the data frame processed through the outgoing physical port is handed over to the commercial forwarding chip for forwarding. 9. The network device according to claim 6 or 7, wherein the network device is a switch or a router.

Images