CN104734986A - Message forwarding method and device - Google Patents

Abstract

The embodiment of the invention discloses a message forwarding method and device. Enter the switch to obtain the packets imported through the ACL policy; obtain the VN domain corresponding to the ACL policy according to the corresponding relationship between the pre-configured ACL policy and the VN domain; perform VxLAN encapsulation on the obtained packet to obtain the encapsulated packet ; Forwarding the encapsulated message to the corresponding output switch according to the VxLAN standard. The present invention forwards the message introduced by the ACL policy to the For the outbound port, when it is necessary to add or delete the outbound port for the packets imported according to the ACL policy, it is only necessary to modify the outbound port information of the VN domain corresponding to the ACL policy, thus greatly improving the scalability of the traffic monitoring network.

Description

A message forwarding method and device

technical field

The invention relates to the Internet field, in particular to a message forwarding method and device.

Background technique

The network is a bridge for information transmission. Users can easily send or obtain information through the network. However, in addition to useful information on the network, there are also users or groups disseminating some illegal information through the network. Therefore, network information security must be included in legal management. Effective information monitoring is performed during normal message forwarding to retrieve bad information and purify the network.

The traffic refers to the amount of data composed of packets, that is to say, the business monitoring of the traffic is actually the business monitoring of the packets that make up the traffic. The existing business monitoring of the packets forwarded on the Internet generally adopts the method of access Control list (English: Access Control List, abbreviation: ACL) policy is carried out through redirection. For example, if the department needs to monitor whether the content of the message forwarded by a website is legal, first configure policy routing through ACL, and then The output message of the website is redirected to the output port specified by the department, that is, to copy the output message, and send the copied message to the output port specified by the department, and then a single device connected to the output port Perform service monitoring on received traffic.

However, with the continuous enrichment of monitoring items, a single device is difficult to meet the needs of business monitoring. When other devices need to be added or other departments need to monitor collaboratively, the ACL policy can only reconfigure policy routing for the newly added device. The scale is difficult to expand, and the cost of network construction is very high.

Contents of the invention

In order to solve the above technical problems, the present invention provides a message forwarding method and device, which can effectively expand the scale of the monitoring network and improve the scalability of the monitoring network by using the VxLAN protocol.

The invention discloses the following technical solutions:

In one aspect, the present invention provides a message forwarding method, the method comprising:

Enter the switch to obtain the packets imported through the access control list ACL policy;

The input switch obtains the VN domain corresponding to the ACL policy according to the corresponding relationship between the pre-configured ACL policy and the VN domain of the virtual scalable local area network;

The input switch performs virtual extensible local area network VxLAN encapsulation on the obtained message to obtain an encapsulated message, and the encapsulated outer header of the encapsulated message contains the address information of the VN domain;

The input switch forwards the encapsulated packet to a corresponding output switch according to the VxLAN standard.

In the first possible implementation of the first aspect, in the correspondence between the ACL policy and the VN domain:

An ACL policy corresponds to a VN domain, and a VN domain corresponds to at least one ACL policy.

In combination with the first aspect and the first possible implementation manner of the first aspect, in a second possible implementation manner, the address information of the VN domain includes an identifier VNI of the VN domain and an IP address of the VN domain .

In combination with the first aspect and the first or second possible implementation of the first aspect, in a third possible implementation, before the input switch obtains the packets imported through the ACL policy, the method further includes :

The input switch performs ACL matching on the received message according to the quintuple of the message, and determines that the message is a message that can be imported through the ACL policy, and the quintuple includes the source of the message IP address, destination IP address, source port number, destination port number, and protocol number.

In a second aspect, the present invention provides an input switch, including:

A packet acquisition unit, configured to acquire packets introduced through the ACL policy;

A determining unit, configured to obtain the VN domain corresponding to the ACL policy according to the correspondence between the pre-configured ACL policy and the VN domain of the virtual scalable local area network;

An encapsulation unit, configured to perform virtual extensible local area network (VxLAN) encapsulation on the acquired message to obtain an encapsulated message, the encapsulated outer header of the encapsulated message includes the address information of the VN domain;

A sending unit, configured to forward the encapsulated message to a corresponding output switch according to the VxLAN standard.

In the first possible implementation of the second aspect, in the correspondence between the ACL policy and the VN domain:

An ACL policy corresponds to a VN domain, and a VN domain corresponds to at least one ACL policy.

With reference to the second aspect and the first possible implementation of the second aspect, in the second possible implementation, the address information of the VN domain includes the identifier VNI of the VN domain and the IP address of the VN domain .

In combination with the second aspect and the first or second possible implementation manner of the second aspect, the third possible implementation manner further includes:

The ACL matching unit is configured to perform ACL matching on the received message according to the quintuple of the message, and determine that the message is a message that can be introduced through an ACL policy, and the quintuple includes the message source IP address, destination IP address, source port number, destination port number, and protocol number.

In a third aspect, the present invention provides a message forwarding method, the method comprising:

The output switch receives the encapsulated message sent by the input switch, and the encapsulated outer header of the encapsulated message contains the address information of the virtual scalable local area network network VN domain;

The output switch searches for the pre-configured correspondence between the VN domain and the outgoing port according to the address information of the VN domain in the outer header of the encapsulated message, and obtains the corresponding outgoing port of the VN domain;

The output switch decapsulates the encapsulated message to obtain a decapsulated message, the decapsulated message is a message introduced by the input switch through an ACL policy, and the decapsulated message is sent to the outgoing port.

In the first possible implementation of the third aspect, in the correspondence between the VN domain and the egress port:

A VN domain corresponds to at least one egress port.

Combining the third aspect with the first possible implementation of the third aspect, in the second possible implementation,

The address information of the VN domain includes the identifier VNI of the VN domain and the IP address of the VN domain.

With reference to the first possible implementation manner of the third aspect, in a third possible implementation manner, the output switch sends the encapsulated packet to the egress port, and sends the encapsulated packet to the egress port The encapsulated packet is decapsulated so that the egress port obtains the packet imported through the ACL policy, including:

When the output switch obtains N output ports, copy the encapsulated message to obtain N copies of the encapsulated message, where N is a natural number greater than or equal to 2;

The output switch respectively sends a copy of the encapsulated traffic to each of the egress ports, and decapsulates the encapsulated packets before being delivered to the egress port, so that the egress port obtains the packets imported through the ACL policy .

In a fourth aspect, the present invention provides an output switch, including:

The receiving unit is used to receive the encapsulated message sent by the input switch, the encapsulated outer header of the encapsulated message contains the address information of the virtual scalable local area network network VN domain;

an egress port acquisition unit, configured to search for a pre-configured correspondence between a VN domain and an egress port according to the address information of the VN domain in the outer header of the encapsulated message, and acquire the egress port corresponding to the VN domain;

A sending unit, configured to send the encapsulated packet to the egress port, and decapsulate the encapsulated packet before being delivered to the egress port, so that the egress port obtains the packet imported through the ACL policy.

In the first possible implementation manner of the fourth aspect, the corresponding relationship between the VN domain and the egress port is specifically:

A VN domain corresponds to at least one egress port.

Combining the fourth aspect with the first possible implementation of the fourth aspect, in the second possible implementation,

The address information of the VN domain includes the identifier VNI of the VN domain and the IP address of the VN domain.

With reference to the first possible implementation manner of the fourth aspect, in a third possible implementation manner, the sending unit is specifically configured to:

When the outlet port obtaining unit obtains N outlet ports, copy the encapsulated message to obtain N copies of the encapsulated message, N is a natural number greater than or equal to 2, and send a message to each of the outlet ports respectively An encapsulated packet is obtained, and the encapsulated packet is decapsulated before being delivered to the egress port, so that the egress port obtains the packet imported through the ACL policy.

As can be seen from the above technical solution, when the technical solution of the present invention detects network traffic, the corresponding relationship between the ACL policy and the VN domain and the corresponding relationship between the VN domain and the outgoing port are pre-configured, and the report introduced by the ACL policy The text is forwarded to the egress port using the VxLAN protocol. When it is necessary to add or delete the egress port for the packet imported according to the ACL policy, it is only necessary to modify the egress port information of the VN domain corresponding to the ACL policy, which greatly improves the It improves the scalability of the traffic monitoring network.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings that need to be used in the description of the embodiments will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present invention. For those skilled in the art, other drawings can also be obtained based on these drawings without any creative effort.

Fig. 1 is a schematic diagram of the combination of ACL policy and VxLAN protocol in the present invention;

Fig. 2 is one of the method flowcharts of a message forwarding method of the present invention;

Fig. 3 is the second method flow chart of a message forwarding method in the present invention;

FIG. 4 is a schematic diagram of message forwarding in the present invention;

Fig. 5 is one of the device structure diagrams of an input switch of the present invention;

Fig. 6 is the second structure diagram of the device of an input switch in the present invention;

Fig. 7 is a schematic diagram of the hardware configuration of a switch of the present invention;

Fig. 8 is a device structure diagram of an output switch of the present invention;

FIG. 9 is a schematic diagram of a hardware configuration of a switch according to the present invention.

Detailed ways

The embodiment of the present invention provides a message forwarding method and device. Combining the ACL policy with the Virtual Extensible LAN (English: Virtual eXtensible LAN, abbreviation: VxLAN) protocol requires at least corresponding expansion of the packet input port on the network and the packet output port pointing to the detection server that detects the traffic. Please refer to Figure 1, which is a schematic diagram of the combination of the ACL policy and the VxLAN protocol of the present invention. It is necessary to pre-configure the correspondence between the ACL policy used by the incoming message and the virtual extensible local area network (English: VxLAN Network, abbreviation: VN) domain and The corresponding relationship between the VN domain and the outgoing port. Here, the outgoing port corresponding to the VN domain is the port connected to the detection server that detects the packets imported through the ACL policy corresponding to the VN domain. In this way, the outgoing port that can be flexibly set in advance in the VN domain is organically combined with the outgoing port of the message. When targeting a message to be monitored, other message monitoring equipment or needs to be added due to the needs of business monitoring or other circumstances When other departments coordinate monitoring, it is only necessary to adjust the information of the egress port of the VN domain corresponding to the ACL policy used to import the message.

In order to make the above objects, features and advantages of the present invention more comprehensible, the embodiments of the present invention will be described in detail below in conjunction with the accompanying drawings.

Embodiment one

This embodiment takes the input switch of the message import port as the execution subject, and describes the technical solution of the present invention. Please refer to FIG. 2, which is one of the method flow charts of a message forwarding method in the present invention. The method includes the following steps :

S201: Input the switch to obtain the packets imported through the ACL policy;

What needs to be explained here is that the traffic received by the input switch includes not only the packets imported by the ACL policy, but also other network packets. In this case, the input switch needs to effectively match the received packets. Determining therefrom which are the messages introduced by the ACL policy, a preferred method for matching messages is provided in the technical solution of the present invention, and screening is carried out by matching the message quintuples of the received messages to meet the matching requirements. A rule is determined to be a packet imported through an ACL policy, and the packet quintuple here includes the source IP, destination IP, source port number, destination port number, and protocol number of the packet. This matching method is only a preferred example. The message quintuple is the information on the L2-L3 layer of the message, and can also match other information that can be used to match the ACL policy in the L2-L7 layer of the message. The present invention There is no limitation on how to match the packets imported by the ACL policy.

S202: The input switch obtains the corresponding VN domain for sending the ACL policy according to the corresponding relationship between the pre-configured ACL policy and the VN domain of the virtual scalable local area network;

What needs to be explained here is that the corresponding relationship between different ACL policies and different VN domains is defined in advance, and one or more ACL policies can be set to correspond to the same VN domain according to the actual situation, so that forwarding through these ACL policies All traffic can be mapped to a VN domain according to the corresponding relationship, that is, an ACL policy corresponds to a VN domain, and a VN domain corresponds to at least one ACL policy. In an actual networking environment, the step of presetting the corresponding relationship does not need to be performed every time in the process of forwarding the message.

S203: The input switch performs VxLAN encapsulation on the obtained message to obtain an encapsulated message, and the encapsulated outer header of the encapsulated message includes the address information of the VN domain;

What needs to be explained here is that this encapsulation method is different from the existing VxLAN standard encapsulation method. First, the packet introduced by the ACL policy is encapsulated, and then encapsulated, and the outer header of the encapsulated packet is added to include The address information of the VN domain, so that the output switch receiving the encapsulated message can determine the egress port according to the address information of the VN domain. The address information of the VN domain must at least include the identification VNI of the VN domain and the IP address of the VN domain. The identification of the VN domain is a value within a certain range of values, such as 20, 30 or 40. The output switch can be based on this ID, through the pre-configured correspondence between the VN domain and the egress port to determine the information of the egress port corresponding to the VN domain. The IP address of the VN domain is generally in the form of a multicast IP address in the prior art, such as 239.0.0.2, etc., which belong to the destination IP of the encapsulated message, and the input switch maps the encapsulated message to the VN domain. middle.

S204: The input switch forwards the encapsulated packet to a corresponding output switch according to the VxLAN standard.

The forwarding of this step is carried out using the VxLAN standard, and will not be repeated here. As for the specific processing steps of forwarding to the output switch, it will be described in Embodiment 2.

It can be seen from this embodiment that when the technical solution of the present invention detects network traffic, the corresponding relationship between the ACL and the VN domain is pre-configured, and the message introduced by the ACL policy is forwarded using the VxLAN protocol. When adding or deleting outbound ports for packets imported by an ACL policy, you only need to modify the outbound port information of the VN domain corresponding to the ACL policy, thus greatly improving the scalability of the traffic monitoring network.

Embodiment two

This embodiment will take the output switch as the output switch pointing to the traffic output port of the detection server that detects the traffic as the execution subject, and describe the technical solution of the present invention. Please refer to FIG. 3, which is a method flow of a message forwarding method of the present invention Figure 2, the method includes the following steps:

S301: The output switch receives the encapsulated message sent by the input switch, and the encapsulated outer header of the encapsulated message includes the address information of the VN domain;

The encapsulated message received here is forwarded according to the VxLAN standard in step S204 in the first embodiment, and the forwarding and receiving are all carried out according to the VxLAN standard, which will not be repeated here.

S302: The output switch searches for a pre-configured correspondence between a VN domain and an egress port according to the address information of the VN domain in the outer header of the encapsulated message, and obtains an egress port corresponding to the VN domain;

As mentioned in step S203 of Embodiment 1, the address information of the VN domain must at least include the identifier VNI of the VN domain and the IP address of the VN domain, and the identifier of the VN domain is a value within a certain range of values. For example, 20, 30 or 40, the output switch can determine the information of the egress port corresponding to the VN domain through the pre-configured correspondence between the VN domain and the egress port according to the identifier. It should be noted that the predefined correspondence mentioned here means that one or more outbound ports corresponding to a VN domain can be set according to the actual situation. The actual situation here mainly refers to one or more outbound ports corresponding to the VN domain. The packets imported by multiple ACL policies need to pass through which inspection services, or which inspection servers need to be inspected. The specific location and information of the outgoing port of the VN domain will be set according to these inspection servers. That is to say, if the packets imported by the ACL policy corresponding to the VN domain need only one detection server to detect, then only one output port connected to the detection server needs to be set. If multiple detection servers are required for detection, the outgoing ports connected to the multiple detection servers need to be set respectively. The correspondence between VN domains and outgoing ports can be in the form of a list of outgoing ports, as shown in the following table:

VNI Outgoing port list 20 Port1, Port2 40 Port3, Port4

There can be one or more egress ports corresponding to a VNI.

S303: The output switch sends the encapsulated packet to the egress port, and decapsulates the encapsulated packet before being delivered to the egress port, so that the egress port obtains the packet imported through the ACL policy .

What needs to be explained here is that, if the situation mentioned in step S302 is determined to have a plurality of outgoing ports, the multiple copies of encapsulated messages that will be copied will be sent to each outgoing port respectively. Before being sent to the outgoing port, the encapsulated message is decapsulated and restored to the original message, so that each detection server can obtain the complete message imported through the ACL policy for related detection services. There is also an implementation method that can realize sending packets for multiple egress ports, which is to first decapsulate the encapsulated packets, restore them to the original packets introduced by the ACL policy, and then copy the packets into multiple copies. The copied message is sent to corresponding multiple output ports, so that each detection server can obtain a complete message for related detection. That is to say, in the technical solution of the present invention, the encapsulated message can be copied first and then sent to the determined multiple outgoing ports respectively, and then unpacked before the outgoing port, or the encapsulated message can also be sent first The document is unpacked, restored to the original message introduced by the ACL policy, and then copied into multiple copies and sent to the multiple outgoing ports respectively. Whether to use the method of first unpacking and then copying or first copying and then unpacking, It can be set in advance or determined according to the actual application scenario.

As can be seen from this embodiment, when the technical solution of the present invention detects network traffic, the corresponding relationship between the VN domain and the outgoing port is pre-configured, and the message introduced by the ACL policy is forwarded using the VxLAN protocol. When adding or deleting outbound ports according to the packets imported by the ACL policy, you only need to modify the outbound port information of the VN domain corresponding to the ACL policy, thus greatly improving the scalability of the traffic monitoring network.

Embodiment three

Combining the parts of the input switch and the output switch in Embodiment 1 and Embodiment 2, the entire process from receiving a packet introduced by an ACL policy to sending the packet to the detection server is described as an example. Please refer to Fig. 4, which is a schematic diagram of message forwarding of the present invention:

Assume that the configured input switch 401 matches two packets A and B imported by the ACL policy from the received packets, where the source IP address of packet A is: 2.2.2.2, and the source IP address of packet B is 2.2.2.2. The address is: 3.3.3.3.

The device IP address of the input switch 401 is: 1.1.1.3; the input switch determines the identity of the VN domain corresponding to the message A with the source IP address 2.2.2.2 through the pre-configured ACL policy and the VN domain as 20 , the multicast IP address is 239.0.0.1; it is determined that the identifier of the VN domain corresponding to packet B whose source IP address is 3.3.3.3 is 40, and the multicast IP address is 239.0.0.2.

After determining the VN domains corresponding to the two packets imported by the ACL policy, the input switch 401 performs VxLAN encapsulation of packet A and packet B, and encapsulates the corresponding VN domain in the outer header of the encapsulated packet A. The identifier 20 of the VN domain, the multicast IP address 239.0.0.1 and the device IP address 1.1.1.3 of the input switch, the corresponding VN domain identifier 40 and the multicast IP address are encapsulated in the outer header of the encapsulated message B 239.0.0.2 and 1.1.1.3, the device IP address of the input switch.

Then the input switch 401 maps the encapsulated packets A and B to corresponding VN domains for multicast forwarding according to the standard VxLAN protocol.

After the encapsulated message A arrives at the corresponding output switch 402, the output switch 402 obtains the identifier 20 of the VN domain by analyzing the outer header of the encapsulated message A, and then determines the VN domain according to the pre-configured correspondence between the VN domain and the output port. There are two egress ports corresponding to the VN domain, namely Port1 and Port2. These two egress ports are respectively connected to two detection servers that need to detect packet A.

After the encapsulated message B arrives at the corresponding output switch 403, the output switch 403 obtains the identifier 40 of the VN domain by analyzing the outer layer header of the encapsulated message B, and then determines the VN domain according to the pre-configured correspondence between the VN domain and the output port. There are two egress ports corresponding to the VN domain, namely Port3 and Port4. These two egress ports are respectively connected to two detection servers that need to detect message B.

The output switch 402 copies the encapsulated message A into two copies, sends them to Port1 and Port2 respectively, and decapsulates the encapsulated message A before reaching Port1 and Port2, and restores the original message A. Of course, the original message A can also be obtained by decapsulating first, and then copy the message A, and then directly send the message A to the two outgoing ports Port1 and Port2 respectively, which is not limited in the present invention.

The output switch 403 copies the encapsulated message B into two copies, sends them to Port3 and Port4 respectively, and decapsulates the encapsulated message B before reaching Port3 and Port4 to restore the original message B. Of course, the original message B can also be obtained by decapsulating first, and then copy the message B, and then directly send the message B to the two outgoing ports Port3 and Port4 respectively, which is not limited in the present invention.

Embodiment three

This embodiment is a device embodiment corresponding to Embodiment 1. Please refer to FIG. 5, which is one of the device structure diagrams of an input switch according to the present invention. The input switch includes:

A message obtaining unit 501, configured to obtain a message imported through an ACL policy;

The determining unit 502 is configured to obtain the VN domain corresponding to the ACL policy according to the correspondence between the pre-configured ACL policy and the VN domain of the virtual scalable local area network;

The encapsulating unit 503 is configured to perform virtual extensible local area network (VxLAN) encapsulation on the obtained message to obtain an encapsulated message, and the encapsulated outer header of the encapsulated message contains the address information of the VN domain;

The sending unit 504 is configured to forward the encapsulated message to a corresponding output switch according to the VxLAN standard.

Wherein, preferably, in the corresponding relationship between the ACL policy and the VN domain:

An ACL policy corresponds to a VN domain, and a VN domain corresponds to at least one ACL policy.

preferred,

The address information of the VN domain includes the identifier VNI of the VN domain and the IP address of the VN domain.

Preferably, the input switch protected in the foregoing embodiments may further include an ACL matching unit, as shown in FIG. 6, the input switch shown in FIG. 5 also includes:

The ACL matching unit 601 is configured to perform ACL matching on the received message according to the quintuple of the message, and determine that the message is a message that can be imported through an ACL policy, and the quintuple includes the message source IP address, destination IP address, source port number, destination port number, and protocol number of the file.

Further, the embodiment of the present invention also provides a switch, which is used to implement the method shown in FIG. 2 . Please refer to FIG. 7, which is a schematic diagram of the hardware configuration of a switch of the present invention, the switch includes a memory 701, a receiver 702, and a transmitter 704, and a processor 703 connected to the memory 701, the receiver 702, and the transmitter 704 respectively:

The memory 701 is used to store the corresponding relationship between the pre-configured ACL policy and the VN domain of the virtual scalable local area network;

The receiver 702 is configured to obtain the message imported through the access control list ACL policy;

The processor 703 is configured to obtain the VN domain corresponding to the ACL policy according to the corresponding relationship between the ACL policy and the VN domain pre-configured in the memory 701; perform virtual extensible local area network VxLAN encapsulation on the obtained message to obtain An encapsulated message, the encapsulated outer header of the encapsulated message includes the address information of the VN domain;

The sender 704 is configured to forward the encapsulated message to a corresponding output switch according to the VxLAN standard.

Embodiment four

This embodiment is a device embodiment corresponding to Embodiment 2. Please refer to FIG. 8, which is a device structure diagram of an output switch according to the present invention. The output switch includes:

The receiving unit 801 is configured to receive the encapsulated message sent by the input switch, the encapsulated outer header of the encapsulated message includes the address information of the VN domain of the virtual scalable local area network;

An outbound port obtaining unit 802, configured to search for a pre-configured correspondence between a VN domain and an outbound port according to the address information of the VN domain in the outer header of the encapsulated message, and obtain the outbound port corresponding to the VN domain ;

The sending unit 803 is configured to send the encapsulated packet to the egress port, and decapsulate the encapsulated packet before being delivered to the egress port, so that the egress port obtains the packet imported through the ACL policy.

Wherein, preferably, the corresponding relationship between the VN domain and the outgoing port is specifically:

A VN domain corresponds to at least one egress port.

Preferably, the address information of the VN domain includes an identifier VNI of the VN domain and an IP address of the VN domain.

Preferably, the sending unit 803 is specifically configured to:

When the outlet port obtaining unit obtains N outlet ports, copy the encapsulated message to obtain N copies of the encapsulated message, N is a natural number greater than or equal to 2, and send a message to each of the outlet ports respectively An encapsulated packet is obtained, and the encapsulated packet is decapsulated before being delivered to the egress port, so that the egress port obtains the packet imported through the ACL policy.

Further, the embodiment of the present invention also provides a switch, which is used to implement the method shown in FIG. 3 . Please refer to FIG. 9, which is a schematic diagram of the hardware configuration of a switch of the present invention, the switch includes a memory 901, a receiver 902, and a transmitter 904, and a processor 903 connected to the memory 901, the receiver 902, and the transmitter 904 respectively:

The memory 901 is used to store the pre-configured correspondence between VN domains and outgoing ports;

The receiver 902 is configured to receive the encapsulated message sent by the input switch, and the encapsulated outer header of the encapsulated message includes the address information of the VN domain of the virtual scalable local area network;

The processor 903 is configured to search for the correspondence between the pre-configured VN domain and the outgoing port in the memory 901 according to the address information of the VN domain in the outer header of the encapsulated message, and obtain the VN domain The output port corresponding to the domain;

The sender 904 is configured to send the encapsulated packet to the egress port, and decapsulate the encapsulated packet before being delivered to the egress port, so that the egress port obtains the packet imported through the ACL policy .

As can be seen from the above-mentioned embodiments, when the technical solution of the present invention detects network traffic, the corresponding relationship between the ACL policy and the VN domain and the corresponding relationship between the VN domain and the outgoing port are pre-configured, and the report introduced by the ACL policy The text is forwarded to the egress port using the VxLAN protocol. When it is necessary to add or delete the egress port for the packet imported according to the ACL policy, it is only necessary to modify the egress port information of the VN domain corresponding to the ACL policy, which greatly improves the It improves the scalability of the traffic monitoring network.

It should be noted that those of ordinary skill in the art can understand that all or part of the processes in the methods of the above embodiments can be implemented by instructing related hardware through computer programs, and the programs can be stored in a computer-readable memory In the medium, when the program is executed, it may include the processes of the embodiments of the above-mentioned methods. Wherein, the storage medium may be a magnetic disk, an optical disk, a read-only memory (Read-Only Memory, ROM) or a random access memory (Random Access Memory, RAM), etc.

The message forwarding method and device provided by the present invention have been introduced in detail above, and the principles and implementation modes of the present invention have been explained by using specific embodiments in this paper. The descriptions of the above embodiments are only used to help understand the present invention method and its core idea; at the same time, for those of ordinary skill in the art, according to the idea of the present invention, there will be changes in the specific implementation and application scope. Invention Limitations.

Claims (16)

1. a message forwarding method, is characterized in that, described method comprises:

Input switch obtains the message introduced by access control list ACL strategy;

Described input switch, according to pre-configured ACL strategy and the corresponding relation in virtual easily extensible local net network VN territory, obtains the VN territory corresponding to described ACL strategy;

Described input switch carries out virtual easily extensible local area network (LAN) VxLAN encapsulation to the described message obtained and obtains encapsulated message, comprises the address information in described VN territory in the outer head of encapsulation of described encapsulated message;

Described encapsulated message is forwarded to corresponding output switch according to VxLAN standard by described input switch.

2. method according to claim 1, is characterized in that, described ACL strategy is with the corresponding relation in VN territory:

A corresponding VN territory of ACL strategy, VN territory at least one ACL strategy corresponding.

3. method according to claim 1 and 2, is characterized in that,

The address information in described VN territory comprises the mark VNI in described VN territory and the IP address in described VN territory.

4. method as claimed in any of claims 1 to 3, is characterized in that, before described input switch obtains the message introduced by ACL strategy, described method also comprises:

Described input switch carries out ACL coupling to the message received according to the five-tuple of described message, determine that described message is the message can introduced by ACL strategy, described five-tuple comprises the source IP address of described message, object IP address, source port number, destination slogan and protocol number.

5. input a switch, it is characterized in that, comprising:

Receive message unit, for obtaining the message introduced by ACL strategy;

Determining unit, for according to pre-configured ACL strategy and the corresponding relation in virtual easily extensible local net network VN territory, obtains the VN territory corresponding to described ACL strategy;

Encapsulation unit, obtains encapsulated message for carrying out virtual easily extensible local area network (LAN) VxLAN encapsulation to the described message obtained, and comprises the address information in described VN territory in the outer head of encapsulation of described encapsulated message;

Transmitting element, for being forwarded to corresponding output switch by described encapsulated message according to VxLAN standard.

6. input switch according to claim 5, is characterized in that, described ACL strategy is with the corresponding relation in VN territory:

A corresponding VN territory of ACL strategy, VN territory at least one ACL strategy corresponding.

7. the input switch according to claim 5 or 6, is characterized in that,

The address information in described VN territory comprises the mark VNI in described VN territory and the IP address in described VN territory.

8., according to the input switch in claim 5 to 7 described in any one, it is characterized in that, also comprise:

ACL matching unit, for carrying out ACL coupling to the message received according to the five-tuple of described message, determine that described message is the message can introduced by ACL strategy, described five-tuple comprises the source IP address of described message, object IP address, source port number, destination slogan and protocol number.

9. a message forwarding method, is characterized in that, described method comprises:

Export the encapsulated message that switch receives the transmission of input switch, in the outer head of encapsulation of described encapsulated message, comprise the address information in virtual easily extensible local net network VN territory;

Described output switch searches pre-configured VN territory and the corresponding relation of outbound port according to the address information in the described VN territory in the outer head of described encapsulated message, obtains the outbound port that described VN territory is corresponding;

Encapsulated message described in described output switch sends to described outbound port, and by the decapsulation of described encapsulated message before sending to outbound port, obtains message by the introducing of ACL strategy to make outbound port.

10. want the method described in 9 according to right, it is characterized in that, in the corresponding relation of described VN territory and outbound port:

A VN territory is corresponding with at least one outbound port.

11. methods according to claim 9 or 10, is characterized in that,

The address information in described VN territory comprises the mark VNI in VN territory and the IP address in VN territory.

12. methods according to claim 10, it is characterized in that, encapsulated message described in described output switch sends to described outbound port, and by the decapsulation of described encapsulated message before sending to outbound port, obtain to make described outbound port and comprised by the message of ACL strategy introducing:

Described output switch is when getting N number of outbound port, and described in copying, encapsulated message to obtain described in N part encapsulated message, N be more than or equal to 2 natural number;

Described output switch sends portion respectively to each described outbound port and encapsulates flow, and by the decapsulation of described encapsulated message before sending to outbound port, obtains to make described outbound port the message introduced by ACL strategy.

13. 1 kinds export switch, it is characterized in that, comprising:

Receiving element, for receiving the encapsulated message that input switch sends, comprises the address information in virtual easily extensible local net network VN territory in the outer head of encapsulation of described encapsulated message;

Outbound port acquiring unit, for searching pre-configured VN territory and the corresponding relation of outbound port according to the address information in the described VN territory in the outer head of described encapsulated message, obtains the outbound port that described VN territory is corresponding;

Transmitting element, for encapsulated message described in sending to described outbound port, and by the decapsulation of described encapsulated message before sending to outbound port, obtains message by the introducing of ACL strategy to make outbound port.

14. output switches according to claim 13, is characterized in that, the corresponding relation of described VN territory and outbound port is specially:

A VN territory is corresponding with at least one outbound port.

15. output switches according to claim 13 or 14, is characterized in that,

The address information in described VN territory comprises the mark VNI in VN territory and the IP address in VN territory.

16. output switches according to claim 13, is characterized in that, described transmitting element specifically for:

When described outbound port acquiring unit gets N number of outbound port, described in copying, encapsulated message to obtain described in N part encapsulated message, N be more than or equal to 2 natural number, portion encapsulated message is sent respectively to each described outbound port, and by the decapsulation of described encapsulated message before sending to outbound port, obtain to make described outbound port the message introduced by ACL strategy.