CN103229489A - Virtual-machine control strategy configuration method and switch - Google Patents

Abstract

The invention relates to a virtual machine control policy configuration method and a switch. The method includes: receiving a first control policy for a virtual machine; acquiring a MAC address of the virtual machine according to a virtual machine identifier in the first control policy; replacing the first control policy with the MAC address of the virtual machine The virtual machine identifier in the policy is used to obtain a second control policy. Thus, the embodiment of the present invention realizes the configuration and management of the MAC address level control policy, making the MAC address level policy control easier to implement.

Description

Virtual machine control policy configuration method and switch

technical field

The invention relates to the communication field, in particular to a method for configuring a virtual machine control policy and a switch.

Background technique

Virtualization is the most important technical basis for realizing cloud computing. Virtualization technology can improve the utilization rate of resources, and can quickly and flexibly deploy resources according to changes in user business needs. Server virtualization enables well-segregated workloads to share hardware again, dramatically reduces physical server footprint and power and cooling consumption, ends server sprawl, and dramatically speeds up server setup.

Due to different server application scenarios and different server types, it is necessary to use a comprehensive virtualization software platform to realize server virtualization, and it also needs to have multi-core, high-density, reliable memory, and scalable input/ Output (Input/Output, I/O) throughput hardware platform. However, common server virtualization technologies cannot protect and enforce policies at the virtual machine level, nor can the policies move with the virtual machines.

Under the existing technology, the virtual switch that supports the virtual network card mark VN-Tag (used to identify the virtual network card of the virtual machine) establishes many ports to correspond to the virtual network card of the virtual machine. When the virtual network card of the virtual machine has data entering the virtual machine When switching, the virtual switch will add VN-Tag to the data and then forward it, realizing policy control at the virtual machine level. However, the disadvantage of the existing technology is that the implementation of this solution requires virtual switches, access switches, and even core network switches to support this technology at the same time, so it is necessary to upgrade devices that do not support VNTag technology, which limits the application of this technical solution Sex, and the cost of upgrading equipment is also high.

Contents of the invention

In view of the problems of high equipment requirements and high cost in the prior art method for configuring virtual machine control policies using VN-tag technology, embodiments of the present invention provide a method for configuring virtual machine control policies and a switch.

In a first aspect, an embodiment of the present invention provides a method for configuring a virtual machine control policy, the method including:

receiving a first control policy for the virtual machine;

Obtain the MAC address of the virtual machine according to the virtual machine identifier in the first control policy;

Using the MAC address of the virtual machine to replace the virtual machine identifier in the first control policy to obtain a second control policy.

In a first possible implementation manner, after obtaining the second control policy, it further includes: receiving an address change message for the virtual machine, where the address change message carries an updated MAC address; using the updated MAC address to replace The MAC address in the second control policy obtains a third control policy.

With reference to the first aspect, in a second possible implementation manner, after obtaining the second control policy, further include: receiving a first update control policy for the virtual machine, the first update control policy including the The virtual machine identifier of the virtual machine; obtain the MAC address corresponding to the virtual machine identifier, use the MAC address to replace the virtual machine identifier in the first update control strategy, and obtain a second update control strategy ; replacing the second control strategy with the second update control strategy.

With reference to the first aspect, in a third possible implementation manner, before acquiring the MAC address of the virtual machine according to the virtual machine identifier in the first control policy, the method further includes: receiving the virtual machine identifier, and N MAC addresses corresponding to the virtual machine identifier, where N is greater than or equal to 1.

With reference to the third possible implementation manner of the first aspect, in a fourth possible implementation manner, the virtual machine identifier in the first control policy is replaced by using the MAC address of the virtual machine to obtain the first The second control strategy is specifically: use the N MAC addresses to replace the virtual machine identifiers in the first control strategy one by one to obtain N second control strategies, and the N second control strategies are respectively related to the N There is a one-to-one correspondence between each MAC address.

With reference to the first aspect, in a fifth possible implementation manner, after obtaining the second control policy, further include: according to the second control policy, for the received MAC address as the destination address or source address Addressed packets are processed.

With reference to the fifth possible implementation manner of the first aspect, in a sixth possible implementation manner, according to the second control policy, the received MAC address as the destination address or source address Processing the data packet specifically includes: receiving the data packet with the MAC address as the destination address or the source address; forwarding the data packet or refusing to forward the data packet according to the second control policy.

In combination with the first aspect or the first, second, third, fourth, fifth, and sixth possible implementations of the first aspect, in a seventh possible implementation, the first A control policy includes at least one of the following control policies: access control policy, resource reservation policy, traffic priority policy, maximum traffic delay policy, maximum traffic packet loss rate policy, and maximum traffic jitter policy.

In the second aspect, the embodiment of the present invention provides a switch, including a control module, the control module includes a receiving submodule, an acquisition submodule, and a conversion submodule; the receiving submodule is used to receive the first Control strategy; the obtaining submodule is configured to obtain the MAC address of the virtual machine according to the virtual machine identifier in the first control strategy; the conversion submodule is configured to replace the virtual machine with the MAC address of the virtual machine The virtual machine identifier in the first control policy is used to obtain a second control policy.

In a first possible implementation manner, the receiving submodule is further configured to receive an address change message for the virtual machine, where the address change message carries an updated MAC address; the conversion submodule is further configured to use The updated MAC address replaces the MAC address in the second control strategy to obtain a third control strategy.

With reference to the second aspect, in a second possible implementation manner, the switch further includes a replacement submodule; the receiving submodule is further configured to receive a first update control policy for the virtual machine, the first The update control policy includes the virtual machine identifier of the virtual machine; the conversion submodule is further configured to obtain the MAC address corresponding to the virtual machine identifier, and use the MAC address to replace the first update control The virtual machine identifier in the policy obtains a second update control policy; the replacement submodule is configured to use the second update control policy to replace the second control policy.

With reference to the second aspect, in a third possible implementation manner, the receiving submodule is further configured to receive the virtual machine identifier and N MAC addresses corresponding to the virtual machine identifier, where N is greater than or equal to 1.

With reference to the third possible implementation manner of the second aspect, in a fourth possible implementation manner, the converting submodule is specifically configured to use the N MAC addresses to replace all the MAC addresses in the first control strategy one by one. The virtual machine identifier is used to obtain N second control strategies, and the N second control strategies correspond to the N MAC addresses respectively.

With reference to the second aspect, in a fifth possible implementation manner, the switch further includes a switching module connected to the control module; the switching module is configured to receive the first Two control strategies, and according to the second control strategy, forward or refuse to forward the received data packets with the MAC address as the destination address or source address.

In combination with the second aspect or the first, second, third, fourth, and fifth possible implementations of the second aspect, in a sixth possible implementation, the control strategy includes but not Limited to one or any combination of the following: access control policy, resource reservation policy, traffic priority policy, maximum traffic delay policy, maximum traffic packet loss rate policy, and maximum traffic jitter policy.

In the embodiment of the present invention, the switch obtains the first control strategy for the virtual machine from the network management center; obtains the MAC address of the virtual machine according to the virtual machine identifier in the first control strategy; uses the MAC address of the virtual machine The address replaces the virtual machine identifier in the first control policy to obtain a second control policy. Thus, the embodiment of the present invention realizes the configuration and management of the control policy at the MAC address level, and solves the problem of high equipment requirements and high cost in the method of using the VN-tag technology to configure the virtual machine control policy in the prior art. It saves a lot of economic costs and makes it easier to implement policy control at the virtual machine level.

Description of drawings

FIG. 1 is a schematic diagram of an application architecture of a method for configuring a virtual machine control strategy provided by an embodiment of the present invention;

FIG. 2 is a flow chart of a method for configuring a virtual machine control strategy provided by an embodiment of the present invention;

FIG. 3 is a schematic diagram of a switch provided by an embodiment of the present invention;

FIG. 4 is a schematic diagram of another switch provided by an embodiment of the present invention.

Detailed ways

In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments It is a part of embodiments of the present invention, but not all embodiments. With respect to the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without creative efforts fall within the protection scope of the present invention.

FIG. 1 is a schematic diagram of an application architecture of a method for configuring a virtual machine control policy provided by an embodiment of the present invention. As shown in Figure 1, the network management center can obtain the virtual MAC address corresponding to each network port of the virtual machine, and can associate the MAC address of the virtual network port of the virtual machine with the virtual machine (the correspondence can be obtained through the virtual machine The virtual machine identification (the virtual machine identification in this application document refers to the virtual machine ID) and the corresponding relationship between the virtual machine's MAC address is reflected), and the control strategy for the virtual machine is sent to the control module of the data center access switch , wherein the switch can be an OpenFlow switch; after the control module receives the corresponding relationship between the MAC address of the virtual network port and the virtual machine, and the control strategy for the virtual machine, it can convert the control strategy for the virtual machine into MAC address control policy; when the switch receives a data packet from a certain MAC address of a virtual machine or is sent to a certain MAC address of a virtual machine, it can process the data packet accordingly according to the control policy for the MAC address, thereby Implemented policy control for the virtual machine.

FIG. 2 is a flow chart of a method for configuring a virtual machine control policy provided by an embodiment of the present invention. The implementation subject of this embodiment is a switch, which describes in detail the method for the switch to convert the control policy for the virtual machine into the control policy for the MAC address after obtaining the control policy for the virtual machine from the network management center. As shown in Figure 2, this embodiment includes the following steps:

Step 201, receiving a first control policy for a virtual machine.

In order to realize the technical solution of the present invention, the switch includes a control module and a switch module, and the switch module and the control module perform information exchange through an interface. The switch and the network management center can communicate through the management interface, and the network management center can actively send the virtual MAC address corresponding to each network port of the virtual machine and the control strategy for the virtual machine to the controller component.

Wherein, the first control strategy acquired by the switch from the network management center is a control strategy for virtual machines, and the control strategy package may include at least one of the following control strategies: access control strategy, resource reservation strategy, traffic priority strategy, Maximum traffic delay policy, maximum traffic packet loss rate policy, maximum traffic jitter policy.

For example, an access control policy for a virtual machine can be defined to deny forwarding of packets destined for a particular virtual machine.

Of course, the user can update the control policy of the virtual machine through the network management center. At this time, the network management center can send the updated control policy to the switch; after the virtual machine is migrated, the MAC address of the virtual machine will also change accordingly, and the network After obtaining the migration information, the management center may also actively send the updated updated MAC address to the switch.

Step 202: Obtain the MAC address of the virtual machine according to the virtual machine identifier in the first control policy.

After the network management center sends the virtual machine ID of the virtual machine and the MAC address corresponding to the virtual machine ID to the switch, the switch can save the virtual machine ID and the virtual machine MAC address in a local database.

Among them, a virtual machine can have one or more network ports, and each network port corresponds to a virtual MAC address, so a virtual machine can have one or more virtual MAC addresses, and the switch can obtain the one or more virtual MAC addresses from the network management center. MAC address.

After the network management center receives the first control policy of the virtual machine, the switch extracts the virtual machine ID of the virtual machine from the first control policy, and can query the corresponding MAC address in the local database according to the virtual machine ID.

Step 203, using the MAC address of the virtual machine to replace the virtual machine identifier in the first control policy to obtain a second control policy.

If the virtual machine has only one network port, that is, only one MAC address, the virtual machine identifier in the first control strategy for the virtual machine is directly replaced with the MAC address, and the second control strategy for the MAC address can be obtained. If the virtual machine has multiple network ports, that is, multiple MAC addresses MAC1, MAC2, MAC3...MACn, after replacing the virtual machine ID in the first control strategy with MAC1, you can get the MAC1 address The second control strategy; after the virtual machine identifier in the first control strategy is replaced by MAC2, the second control strategy for the MAC2 address can be obtained; each MAC address in the n MAC addresses is used to replace the first control strategy After the virtual machine is identified, n second control strategies can be obtained.

For example, virtual machine 1 has only one network port, that is, only one MAC address MAC1, if the first control policy is to refuse to forward all data packets sent to virtual machine 1, then the second control policy is to refuse to forward all data packets sent to MAC1 . If the virtual machine has multiple network ports, that is, there are multiple MAC addresses MAC1, MAC2, MAC3...MACn, then if the first control strategy is to refuse to forward all data packets sent to virtual machine 1, the second control The policy is to refuse to forward all data packets sent to MAC1, MAC2, MAC3...MACn.

After the control module in the switch converts the first control strategy for the virtual machine into the second control strategy for the MAC address, the second control strategy can be sent to the switch module, so that the switch module can Process packets originating from or destined for this MAC address.

Specifically, when the switch module receives a data packet with the MAC address as the destination address or source address, it can locally query the corresponding second control strategy according to the source MAC address or the destination MAC address of the data packet, so as to The package is processed accordingly.

Of course, if the switch module receives the data packet with the MAC address as the destination address or source address, and determines locally that there is no corresponding second control strategy configured locally, the control module can issue the second control strategy. to the switch assembly. If there is no corresponding second control strategy in the control module, the first control strategy for the virtual machine corresponding to the second control strategy and the corresponding virtual machine MAC address can be obtained from the network management center, and the first control strategy can be converted After the second control policy is issued to the switch module.

In an optional implementation manner of the embodiment of the present invention, after obtaining the second control strategy, it further includes: receiving an address change message for the virtual machine, where the address change message carries an updated MAC address; using the Updating the MAC address to replace the MAC address in the second control strategy to obtain a third control strategy. Specifically, after the virtual machine is migrated, the MAC address of the virtual machine will also change accordingly. After the network management center obtains the migration information, it can also actively send the updated MAC address to the switch through an address change message, and the switch can use The updated MAC address is used to replace the saved MAC address in the second control strategy to obtain the third control strategy. Wherein, if there are m updated MAC addresses, each of the m MAC addresses is used to replace the original MAC address in the second control strategy to obtain m third control strategies.

Optionally, after the updated MAC address is obtained, the first control strategy for the virtual machine can also be obtained from the network management center according to the virtual machine identifier corresponding to the MAC address, and each of the m MAC addresses is used to replace The virtual machine identifier in the first control strategy can obtain m pieces of second control strategies.

What needs to be explained here is that since the second control strategy for the original MAC address is also transformed from the first control strategy for the corresponding virtual machine identifier, after the MAC address of the virtual machine is changed, the The deletion of the second control strategy for the original MAC address can save space on the one hand, and on the other hand can prevent the corresponding other virtual machines from generating wrong messages after the MAC addresses of other virtual machines change to the original MAC addresses. policy control.

Correspondingly, after obtaining the second control policy, it also includes: receiving a first updated control policy for the virtual machine, the first updated control policy including the virtual machine identifier of the virtual machine; acquiring the The MAC address corresponding to the virtual machine identifier, using the MAC address to replace the virtual machine identifier in the first update control strategy to obtain a second update control strategy; using the second update control strategy to replace the first update control strategy 2. Control strategy. Specifically, if the user updates the control policy for the virtual machine through the network management center, the network management center can send the updated control policy to the switch, and the switch can use the updated control policy after receiving the updated control policy The policy is converted into a control policy for the corresponding MAC address, and the updated control policy for the MAC address is used to replace the previously saved second control policy, thereby implementing dynamic control policy configuration.

In the embodiment of the present invention, the switch obtains the first control strategy for the virtual machine from the network management center; obtains the MAC address of the virtual machine according to the virtual machine identifier in the first control strategy; uses the MAC address of the virtual machine The address replaces the virtual machine identifier in the first control policy to obtain a second control policy. Thus, the embodiment of the present invention realizes the configuration and management of the control policy at the MAC address level, and solves the problem of high equipment requirements and high cost in the method of using the VN-tag technology to configure the virtual machine control policy in the prior art. It saves a lot of economic costs and makes it easier to implement policy control at the virtual machine level.

It should be noted that if the network interface adaptation module (physical network card) of the physical host where the virtual machine is located supports the promiscuous mode (Promiscuous Mode), the working state of the physical network card needs to be set to the promiscuous mode. In mixed mode, the physical network card will not modify the source MAC address of the data packets sent out, so as to ensure that the source MAC address of the data packets sent by the virtual network port of the virtual machine will not be changed; The destination MAC address will not be filtered for the data packets of this network card. If the physical network card of the switch does not support hybrid mode, the function of the physical network card needs to be upgraded so that the physical network card does not modify the source MAC address when it forwards the data packets from the virtual machine. , the target MAC address will not be filtered.

Correspondingly, an embodiment of the present invention also provides a switch, which may be an OpenFlow switch. FIG. 3 is a schematic diagram of a switch provided by an embodiment of the present invention. As shown in FIG. 3 , the switch includes a control module 310, and the control module 310 includes a receiving submodule 311, an obtaining submodule 312, and a converting submodule 313; the switch also includes Switch module 320. Wherein, the switching module 320 and the control module 310 may be connected through an interface. For example, for an OpenFlow switch, the control module 310 and the switching module 320 may be connected through an OpenFlow interface. in,

The receiving submodule 311 is configured to receive the first control strategy for the virtual machine.

The receiving submodule 312 is further configured to receive the virtual machine ID and N MAC addresses corresponding to the virtual machine ID, where N is greater than or equal to 1.

Wherein, the first control strategy acquired by the switch from the network management center is a control strategy for virtual machines, and the control strategy package may include at least one of the following control strategies: access control strategy, resource reservation strategy, traffic priority strategy, Maximum traffic delay policy, maximum traffic packet loss rate policy, maximum traffic jitter policy.

For example, an access control policy for a virtual machine can be defined to deny forwarding of packets destined for a particular virtual machine.

The acquiring submodule 312 is configured to acquire the MAC address of the virtual machine according to the virtual machine identifier in the first control policy.

After the network management center sends the virtual machine ID of the virtual machine and the MAC address corresponding to the virtual machine ID to the switch, the switch can save the virtual machine ID and the virtual machine MAC address in a local database.

Among them, a virtual machine can have one or more network ports, and each network port corresponds to a virtual MAC address, so a virtual machine can have one or more virtual MAC addresses, and the switch can obtain the one or more virtual MAC addresses from the network management center. MAC address.

After the network management center receives the first control policy of the virtual machine, the switch extracts the virtual machine ID of the virtual machine from the first control policy, and can query the corresponding MAC address in the local database according to the virtual machine ID.

The conversion submodule 313 is configured to use the MAC address of the virtual machine to replace the virtual machine identifier in the first control policy to obtain a second control policy.

The conversion submodule 313 is specifically configured to replace the virtual machine identifiers in the first control strategy with the N MAC addresses one by one to obtain N second control strategies, and the N second control strategies are respectively related to the The N MAC addresses are in one-to-one correspondence.

If the virtual machine has only one network port, that is, only one MAC address, the virtual machine identifier in the first control strategy for the virtual machine is directly replaced with the MAC address, and the second control strategy for the MAC address can be obtained. If the virtual machine has multiple network ports, that is, multiple MAC addresses MAC1, MAC2, MAC3...MACn, after replacing the virtual machine ID in the first control strategy with MAC1, you can get the MAC1 address The second control strategy; after the virtual machine identifier in the first control strategy is replaced by MAC2, the second control strategy for the MAC2 address can be obtained; each MAC address in the n MAC addresses is used to replace the first control strategy After the virtual machine is identified, n second control strategies can be obtained.

After the control module 310 in the switch converts the first control strategy for the virtual machine into the second control strategy for the MAC address, the second control strategy can be sent to the switch module for the switch module 320 to The control policy acts on packets originating from or destined for that MAC address.

The switching module 320 is configured to receive the second control strategy from the control module, and forward or reject the received data packet with the MAC address as the destination address or the source address according to the second control strategy Forward processing.

Of course, if the switch module 320 receives the data packet with the MAC address as the destination address or source address, and determines locally that there is no corresponding second control strategy configured locally, the control module 310 can set the second control strategy Send it to the switching module 320. If there is no corresponding second control strategy in the control module 310, the first control strategy for the virtual machine corresponding to the second control strategy and the corresponding virtual machine MAC address can be obtained from the network management center, and the first control strategy After being transformed into the second control strategy, it is sent to the switching module 320 .

Preferably, when the address of the virtual machine is changed, the receiving submodule 311 is also used to receive an address change message for the virtual machine, and the address change message carries an updated MAC address; the conversion submodule 313 is also used to use The updated MAC address replaces the MAC address in the second control strategy to obtain a third control strategy. Specifically, after the virtual machine is migrated, the MAC address of the virtual machine will also change accordingly. After the network management center obtains the migration information, it can also actively send the updated MAC address to the switch through an address change message, and the switch can use The updated MAC address is used to replace the saved MAC address in the second control strategy to obtain the third control strategy. Wherein, if there are m updated MAC addresses, each of the m MAC addresses is used to replace the original MAC address in the second control strategy to obtain m third control strategies.

Optionally, after the updated MAC address is obtained, the first control strategy for the virtual machine can also be obtained from the network management center according to the virtual machine identifier corresponding to the MAC address, and each of the m MAC addresses is used to replace The virtual machine identifier in the first control strategy can obtain m pieces of second control strategies.

What needs to be explained here is that since the second control strategy for the original MAC address is also transformed from the first control strategy for the corresponding virtual machine identifier, after the MAC address of the virtual machine is changed, the The deletion of the second control strategy for the original MAC address can save space on the one hand, and on the other hand can prevent the corresponding other virtual machines from generating wrong messages after the MAC addresses of other virtual machines change to the original MAC addresses. policy control.

Preferably, the switch further includes a replacement sub-module 314, after the control policy for the virtual machine is changed, the receiving sub-module 311 is also used for receiving the first update control policy for the virtual machine, the first update control policy The virtual machine identifier of the virtual machine is included in the virtual machine; the conversion submodule 313 is further configured to obtain the MAC address corresponding to the virtual machine identifier, and use the MAC address to replace all the The virtual machine identifier is used to obtain a second update control policy; the replacement submodule 314 is configured to use the second update control policy to replace the second control policy. Specifically, if the user updates the control policy for the virtual machine through the network management center, the network management center can send the updated control policy to the switch, and the switch can use the updated control policy after receiving the updated control policy The policy is converted into a control policy for the corresponding MAC address, and the updated control policy for the MAC address is used to replace the previously saved second control policy, thereby implementing dynamic control policy configuration.

Thus, the embodiment of the present invention realizes the configuration and management of the control policy at the MAC address level, and solves the problem of high equipment requirements and high cost in the method of using the VN-tag technology to configure the virtual machine control policy in the prior art. It saves a lot of economic costs and makes it easier to implement policy control at the virtual machine level.

Correspondingly, the embodiment of the present invention also provides a switch, and FIG. 4 is a schematic diagram of another switch provided by the embodiment of the present invention. As shown in FIG. 4 , the switch provided in this embodiment includes a network interface 401 , a processor 402 and a memory 403 . The system bus 404 is used to connect the network interface 401 , the processor 402 and the memory 403 .

The network interface 401 can be used to communicate with the network management center and the physical host where the virtual machine is located respectively.

The memory 403 can be a permanent memory, such as a hard disk drive and a flash memory, and the memory 403 has software modules and device drivers, and can also store a database for storing control strategies. The software modules can execute various functional modules of the above method of the present invention; the device driver can be a network and interface driver.

At startup, these software components are loaded into memory 403, then accessed by processor 402 and execute the following instructions:

receiving a first control policy for the virtual machine;

Obtain the MAC address of the virtual machine according to the virtual machine identifier in the first control policy;

Using the MAC address of the virtual machine to replace the virtual machine identifier in the first control policy to obtain a second control policy.

Wherein, the first control policy includes at least one of the following control policies: access control policy, resource reservation policy, traffic priority policy, maximum traffic delay policy, maximum traffic packet loss rate policy, and maximum traffic jitter policy.

After the network management center sends the virtual machine ID of the virtual machine and the MAC address corresponding to the virtual machine ID to the switch, the switch can save the virtual machine ID and the virtual machine MAC address in a local database.

Among them, a virtual machine can have one or more network ports, and each network port corresponds to a virtual MAC address, so a virtual machine can have one or more virtual MAC addresses, and the switch can obtain the one or more virtual MAC addresses from the network management center. MAC address.

After the network management center receives the first control policy of the virtual machine, the switch extracts the virtual machine ID of the virtual machine from the first control policy, and can query the corresponding MAC address in the local database according to the virtual machine ID.

Further, after obtaining the second control strategy, the processor 402 accesses the software components of the memory 403, and executes the instructions of the following process:

receiving an address change message for the virtual machine, where the address change message carries an updated MAC address;

Using the updated MAC address to replace the MAC address in the second control strategy to obtain a third control strategy.

Specifically, after the virtual machine is migrated, the MAC address of the virtual machine will also change accordingly. After the network management center obtains the migration information, it can also actively send the updated MAC address to the switch through an address change message, and the switch can use The updated MAC address is used to replace the saved MAC address in the second control strategy to obtain the third control strategy. Wherein, if there are m updated MAC addresses, each of the m MAC addresses is used to replace the original MAC address in the second control strategy to obtain m third control strategies.

Optionally, after the updated MAC address is obtained, the first control strategy for the virtual machine can also be obtained from the network management center according to the virtual machine identifier corresponding to the MAC address, and each of the m MAC addresses is used to replace The virtual machine identifier in the first control strategy can obtain m pieces of second control strategies.

What needs to be explained here is that since the second control strategy for the original MAC address is also transformed from the first control strategy for the corresponding virtual machine identifier, after the MAC address of the virtual machine is changed, the The deletion of the second control strategy for the original MAC address can save space on the one hand, and on the other hand can prevent the corresponding other virtual machines from generating wrong messages after the MAC addresses of other virtual machines change to the original MAC addresses. policy control.

Further, after obtaining the second control strategy, the processor 402 accesses the software components of the memory 403, and executes the instructions of the following process:

Receive a first update control policy for the virtual machine, where the first update control policy includes the virtual machine identifier of the virtual machine;

Obtain the MAC address corresponding to the virtual machine identifier, and use the MAC address to replace the virtual machine identifier in the first update control strategy to obtain a second update control strategy;

The second control strategy is replaced with the second update control strategy.

Specifically, if the user updates the control policy for the virtual machine through the network management center, the network management center can send the updated control policy to the switch, and the switch can use the updated control policy after receiving the updated control policy The policy is converted into a control policy for the corresponding MAC address, and the updated control policy for the MAC address is used to replace the previously saved second control policy, thereby implementing dynamic control policy configuration.

Further, before the MAC address of the virtual machine is queried according to the virtual machine identifier in the first control policy, after the processor 402 accesses the software components of the memory 403, the following process is executed: receiving the The virtual machine identifier, and N MAC addresses corresponding to the virtual machine identifier, where N is greater than or equal to 1.

Wherein, the processor 402 executes using the MAC address of the virtual machine to replace the virtual machine identifier in the first control policy, and the process of obtaining the second control policy is specifically: using the N MAC addresses one by one to replace the The virtual machine identifier in the first control policy obtains N second control policies, and the N second control policies correspond to the N MAC addresses respectively.

Further, after the switch receives the data packet through the network interface 401, the processor 402 accesses the software components of the memory 403, and executes the instructions of the following process: Process packets for destination or source addresses. Specifically, receiving a data packet with the MAC address as a destination address or a source address; forwarding the data packet or refusing to forward the data packet according to the second control strategy.

Thus, the embodiment of the present invention realizes the configuration and management of the control policy at the MAC address level, and solves the problem of high equipment requirements and high cost in the method of using the VN-tag technology to configure the virtual machine control policy in the prior art. It saves a lot of economic costs and makes it easier to implement policy control at the virtual machine level.

Professionals should further realize that the units and algorithm steps described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the relationship between hardware and software Interchangeability. In the above description, the composition and steps of each example have been generally described according to their functions. Whether these functions are executed by hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art may use different methods to implement the described functions for each specific application, but such implementation should not be regarded as exceeding the scope of the present invention.

The steps of the methods or algorithms described in connection with the embodiments disclosed herein may be implemented by hardware, software modules executed by a processor, or a combination of both. Software modules can be placed in random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other Any other known storage medium.

The specific embodiments described above have further described the purpose, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above descriptions are only specific embodiments of the present invention and are not intended to limit the scope of the present invention. Protection scope, within the spirit and principles of the present invention, any modification, equivalent replacement, improvement, etc., shall be included in the protection scope of the present invention.

Claims (15)

1. A method for configuring a virtual machine control strategy, characterized in that the method comprises: receiving a first control policy for the virtual machine; Obtain the MAC address of the virtual machine according to the virtual machine identifier in the first control policy; Using the MAC address of the virtual machine to replace the virtual machine identifier in the first control policy to obtain a second control policy. 2. The method for configuring a virtual machine control strategy according to claim 1, further comprising: after said obtaining the second control strategy: receiving an address change message for the virtual machine, where the address change message carries an updated MAC address; Using the updated MAC address to replace the MAC address in the second control strategy to obtain a third control strategy. 3. The method for configuring a virtual machine control strategy according to claim 1, further comprising: after said obtaining the second control strategy: Receive a first update control policy for the virtual machine, where the first update control policy includes the virtual machine identifier of the virtual machine; Obtain the MAC address corresponding to the virtual machine identifier, and use the MAC address to replace the virtual machine identifier in the first update control strategy to obtain a second update control strategy; The second control strategy is replaced with the second update control strategy. 4. The method for configuring a virtual machine control strategy according to claim 1, wherein, before obtaining the MAC address of the virtual machine according to the virtual machine identifier in the first control strategy, further comprising: receiving The virtual machine identifier and N MAC addresses corresponding to the virtual machine identifier, where N is greater than or equal to 1. 5. The method for configuring a virtual machine control policy according to claim 4, wherein the virtual machine identifier in the first control policy is replaced by the MAC address of the virtual machine to obtain a second control policy. The strategy is specifically: Using the N MAC addresses to replace the virtual machine identifiers in the first control policy one by one to obtain N second control policies, the N second control policies corresponding to the N MAC addresses respectively. . 6. The method for configuring a virtual machine control policy according to claim 1, further comprising: after the second control policy is obtained, according to the second control policy, the received MAC The packets whose address is the destination address or the source address are processed. 7. The method for configuring a virtual machine control policy according to claim 6, characterized in that, according to the second control policy, for the received data packet with the MAC address as the destination address or source address The processing specifically includes: receiving a data packet with the MAC address as the destination address or source address; According to the second control strategy, forward the data packet or refuse to forward the data packet. 8. The method for configuring a virtual machine control policy according to any one of claims 1-7, wherein the first control policy includes at least one of the following control policies: access control policy, resource reservation policy , traffic priority policy, maximum traffic delay policy, maximum traffic packet loss rate policy, maximum traffic jitter policy. 9. A switch, characterized in that the switch includes a control module, and the control module includes a receiving submodule, an obtaining submodule, and a converting submodule; The receiving submodule is configured to receive the first control strategy for the virtual machine; The acquiring submodule is configured to acquire the MAC address of the virtual machine according to the virtual machine identifier in the first control policy; The converting submodule is configured to use the MAC address of the virtual machine to replace the virtual machine identifier in the first control policy to obtain a second control policy. 10. The switch according to claim 9, wherein the receiving submodule is further configured to receive an address change message for the virtual machine, the address change message carrying an updated MAC address; The converting submodule is further configured to use the updated MAC address to replace the MAC address in the second control strategy to obtain a third control strategy. 11. The switch according to claim 9, further comprising a replacement submodule; The receiving submodule is further configured to receive a first update control policy for the virtual machine, where the first update control policy includes the virtual machine identifier of the virtual machine; The converting submodule is further configured to obtain the MAC address corresponding to the virtual machine identifier, and use the MAC address to replace the virtual machine identifier in the first update control strategy to obtain a second update control strategy; The replacement submodule is configured to use the second update control strategy to replace the second control strategy. 12. The switch according to claim 9, wherein the receiving submodule is further configured to receive the virtual machine identifier and N MAC addresses corresponding to the virtual machine identifier, wherein N is greater than or equal to 1. 13. The switch according to claim 12, wherein the conversion sub-module is specifically configured to use the N MAC addresses to replace the virtual machine identifiers in the first control strategy one by one to obtain N The second control strategy, the N pieces of second control strategies are in one-to-one correspondence with the N MAC addresses respectively. 14. The switch according to claim 9, wherein the switch further comprises a switch module, and the switch module is connected to the control module; The switching module is configured to receive the second control strategy from the control module, and forward the received data packet with the MAC address as the destination address or source address according to the second control strategy Or refuse forwarding processing. 15. The switch according to any one of claims 9-14, wherein the control policy includes but not limited to one or any combination of the following: access control policy, resource reservation policy, traffic priority policy , maximum traffic delay policy, maximum traffic packet loss rate policy, maximum traffic jitter policy.

Images