CN106161225A - For processing method, the Apparatus and system of VXLAN message - Google Patents

Abstract

The present application provides a method, device and system for processing VXLAN packets, which are helpful for routers between different data centers to obtain VNI. In this method, the first router receives the VXLAN message sent by the VTEP, and the VXLAN message includes a VNI; the first router obtains an encapsulated message according to the VXLAN message, and the encapsulated message is A message obtained after performing IPsec-ESP encapsulation on the VXLAN message, the encapsulated message includes an IP header, the VNI, an ESP header, and the encrypted VXLAN message, and the VNI is encapsulated in the Between the IP header and the ESP header; the first router sends the encapsulated message to the second router.

Description

Method, device and system for processing VXLAN packets

technical field

The present invention relates to communication technology, in particular to a method, device and system for processing Virtual Extensible Local Area Network (English full name: Virtual Extensible Local Area Network, English abbreviation: VXLAN) messages.

Background technique

VXLAN can be applied inside the data center, so that virtual machines can migrate within the interconnected three-tier network without changing the Internet Protocol (English full name: Internet Protocol, English abbreviation: IP) address and media access control (English full name : Media Access Control, English abbreviation: MAC) address, to ensure business continuity. Internet Protocol Security (English full name: Internet Protocol Security, English abbreviation: IPSec) protocol can ensure confidential and secure communication on the IP network by using encrypted security services. Encapsulating Security Payload (English full name: Encapsulating Security Payload, English abbreviation: ESP) protocol is a main protocol in the IPsec protocol, and IPsec-ESP can be applied to different data centers (English full name: Data Center, English abbreviation: DC) communication scene.

In different communication scenarios between DCs, for example, in the communication scenario between DC1 and DC2, the first router belonging to DC1 can receive the information sent by the virtual tunnel end point (full English name: virtual tunnel end point, English abbreviation: VTEP) belonging to DC1. VXLAN packets. The first router performs IPsec-ESP encapsulation on the received VXLAN message to obtain the IPsec-ESP message. An IPsec-ESP packet includes an encrypted VXLAN packet, an ESP header encapsulated outside the encrypted VXLAN packet, and an IP header encapsulated outside the ESP header. The IP header includes a source IP address and a destination IP address, the source IP address is the IP address of the first router, and the destination IP address is the IP address of the second router. The second router belongs to DC2. The first router sends the IPsec-ESP packet to the second router.

The router between the first router and the second router can forward the IPsec-ESP packet, but the router on the transmission path between the first router and the second router cannot perceive the IPsec-ESP packet included in the VXLAN packet. VXLAN-related information, such as VXLAN network identifier (English full name: VXLAN Network Identifier, English abbreviation: VNI), and thus cannot perform load sharing and other service processing.

Contents of the invention

In view of this, embodiments of the present invention provide a method, device and system for processing VXLAN packets, which help routers between different data centers obtain VNIs.

The technical solutions provided by the embodiments of the present invention are as follows.

In the first aspect, a method for processing VXLAN packets is provided, including:

The first router receives the VXLAN packet sent by the VTEP, and the VXLAN packet includes a VNI;

The first router obtains an encapsulated message according to the VXLAN message, the encapsulated message is a message obtained after performing IPsec-ESP encapsulation on the VXLAN message, and the encapsulated message The text includes an IP header, the VNI, the ESP header and the encrypted VXLAN message, and the VNI is encapsulated between the IP header and the ESP header;

The first router sends the encapsulated packet to the second router.

In a first possible implementation manner of the first aspect, the IP header includes first identification information, where the first identification information is used to identify that the encapsulated packet carries the VNI.

In combination with the first aspect above, a second possible implementation of the first aspect is also provided, wherein the encapsulated message further includes a User Data Packet Protocol (English full name) encapsulated between the IP header and the VNI : User Datagram Protocol, English abbreviation: UDP) header, the UDP header is the UDP header included in the VXLAN message from the VTEP;

The IP header includes first identification information, the first identification information is used to identify that the encapsulated message carries the UDP header, and the UDP header encapsulated between the IP header and the VNI Include second identification information, where the second identification information is used to identify that the encapsulated packet carries the VNI.

In a second aspect, a method for processing VXLAN packets is provided, including:

The second router receives the encapsulated message sent by the first router, the encapsulated message is a message obtained after IPsec-ESP encapsulation of the VXLAN message from the VTEP, and the encapsulated message includes IP header, VNI, ESP header and the encrypted VXLAN message, the VNI is encapsulated between the IP header and the ESP header;

The second router obtains the VNI from the encapsulated packet.

In a first possible implementation manner of the second aspect, the IP header includes first identification information, and the first identification information is used to identify that the encapsulated packet carries the VNI, and the second Obtaining the VNI by the router from the encapsulated message includes:

The second router determines, according to the first identification information included in the IP header, that the encapsulated packet includes the VNI;

The second router obtains the VNI from between the IP header and the ESP header.

In combination with the second aspect above, a second possible implementation of the second aspect is also provided, the encapsulated message further includes a UDP header encapsulated between the IP header and the VNI, and the UDP header is the UDP header included in the VXLAN message from the VTEP, the IP header includes first identification information, and the first identification information is used to identify that the encapsulated message carries the UDP header, so The UDP header encapsulated between the IP header and the VNI includes second identification information, and the second identification information is used to identify that the encapsulated message carries the VNI;

Obtaining the VNI from the encapsulated packet by the second router includes:

The second router obtains the UDP header encapsulated between the IP header and the VNI according to the first identification information included in the IP header;

The second router determines that the encapsulated message includes the VNI according to the second identification information included in the UDP header encapsulated between the IP header and the VNI;

The second router obtains the VNI from between the IP header and the ESP header.

In a third aspect, a first router is provided, including:

A receiving unit, configured to receive a VXLAN packet sent by the VTEP, where the VXLAN packet includes a VNI;

A processing unit, configured to obtain an encapsulated message according to the VXLAN message, the encapsulated message is a message obtained after performing IPsec-ESP encapsulation on the VXLAN message, and the encapsulated message The text includes an IP header, the VNI, the ESP header and the encrypted VXLAN message, and the VNI is encapsulated between the IP header and the ESP header;

A sending unit, configured to send the encapsulated message to the second router.

In a first possible implementation manner of the third aspect, the IP header includes first identification information, where the first identification information is used to identify that the encapsulated packet carries the VNI.

In combination with the third aspect above, a second possible implementation of the third aspect is also provided, the encapsulated message further includes a UDP header encapsulated between the IP header and the VNI, and the UDP header A UDP header included in the VXLAN message from the VTEP;

The IP header includes first identification information, the first identification information is used to identify that the encapsulated message carries the UDP header, and the UDP header encapsulated between the IP header and the VNI Include second identification information, where the second identification information is used to identify that the encapsulated packet carries the VNI.

In a fourth aspect, a second router is provided, including:

The receiving unit is configured to receive the encapsulated message sent by the first router, the encapsulated message is a message obtained after IPsec-ESP encapsulation of the VXLAN message from the VTEP, the encapsulated The message includes an IP header, a VNI, an ESP header and the encrypted VXLAN message, and the VNI is encapsulated between the IP header and the ESP header;

A processing unit, configured to obtain the VNI from the encapsulated packet.

In a first possible implementation manner of the fourth aspect, the IP header includes first identification information, and the first identification information is used to identify that the encapsulated packet carries the VNI;

The processing unit is specifically configured to determine that the encapsulated packet includes the VNI according to the first identification information included in the IP header;

The processing unit is specifically configured to obtain the VNI from between the IP header and the ESP header.

In combination with the fourth aspect above, a second possible implementation of the fourth aspect is also provided, the encapsulated message further includes a UDP header encapsulated between the IP header and the VNI, and the UDP header is the UDP header included in the VXLAN message from the VTEP, the IP header includes first identification information, and the first identification information is used to identify that the encapsulated message carries the UDP header, so The UDP header encapsulated between the IP header and the VNI includes second identification information, and the second identification information is used to identify that the encapsulated message carries the VNI;

The processing unit is specifically configured to obtain a UDP header encapsulated between the IP header and the VNI according to the first identification information included in the IP header;

The processing unit is specifically configured to determine that the encapsulated message includes the VNI according to the second identification information included in the UDP header encapsulated between the IP header and the VNI;

The processing unit is specifically configured to obtain the VNI from between the IP header and the ESP header.

In the fifth aspect, a system for processing VXLAN packets is provided, including:

The first router provided in the third aspect or any possible implementation of the third aspect, and the second router provided in the fourth aspect or any possible implementation of the fourth aspect.

Through the above solutions, in the method, device and system for processing VXLAN packets provided by the embodiments of the present invention, the first router performs IPsec-ESP encapsulation on the VXLAN packets sent by the VTEP to obtain the encapsulated packets. The first router encapsulates the VNI included in the VXLAN packet sent by the VTEP between the IP header and the ESP header included in the encapsulated packet. The first router sends the encapsulated packet to the second router. The second router obtains the VNI encapsulated between the IP header and the ESP header from the encapsulated packet. In this way, routers located between different data centers, such as the second router, can obtain the VNI from the received encapsulated message.

Description of drawings

In order to more clearly illustrate the embodiments of the present invention or the solutions in the prior art, the following will briefly introduce the accompanying drawings used in the embodiments. Obviously, the accompanying drawings in the following description are some implementations of the present invention For example, those skilled in the art can also obtain other drawings based on these drawings without creative work.

FIG. 1 is a flowchart of a method for processing VXLAN packets provided in the first embodiment of the present invention;

FIG. 2 is a flowchart of a method for processing VXLAN packets provided by the second embodiment of the present invention;

FIG. 3a is a schematic diagram of an encapsulated message provided by an embodiment of the present invention;

FIG. 3b is a schematic diagram of another encapsulated message provided by an embodiment of the present invention;

FIG. 4a is a schematic diagram of an encapsulated message provided by an embodiment of the present invention;

FIG. 4b is a schematic diagram of another encapsulated message provided by an embodiment of the present invention;

FIG. 5 is a schematic diagram of an IP header included in an encapsulated message provided by an embodiment of the present invention;

FIG. 6 is a schematic diagram of a UDP header included in an encapsulated message provided by an embodiment of the present invention;

FIG. 7 is a schematic structural diagram of a first router provided by an embodiment of the present invention;

FIG. 8 is a schematic structural diagram of a first router provided by another embodiment of the present invention;

FIG. 9 is a schematic structural diagram of a second router provided by an embodiment of the present invention;

FIG. 10 is a schematic structural diagram of a second router provided by another embodiment of the present invention;

FIG. 11 is a schematic structural diagram of a system for processing VXLAN packets provided by an embodiment of the present invention.

detailed description

In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments It is a part of embodiments of the present invention, but not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the protection scope of the present invention.

Fig. 1 is a flowchart of a method for processing VXLAN packets provided by the first embodiment of the present invention. The first embodiment of the present invention describes the method for processing VXLAN packets from the perspective of the first router. The first router may be a provider edge (English full name: provider edge, English abbreviation: PE) device. The method for processing VXLAN packets provided by the first embodiment of the present invention will be described below with reference to FIG. 1 .

S102. The first router receives the VXLAN packet sent by the VTEP, where the VXLAN packet includes the VNI.

For example, in a communication scenario between different DCs, the first router may belong to DC1. The VTEP in DC1 can perform VXLAN encapsulation on service packets sent by a virtual machine (English full name: virtual machine, English abbreviation: VM) to obtain VXLAN packets. The VXLAN packet obtained by the VTEP in DC1 includes the VNI. The VXLAN packet obtained by the VTEP in DC1 needs to be sent to a VM in another DC, such as a VM in DC2. The first router can receive the VXLAN packet sent by the VTEP in DC1. Among them, VNI can be used to distinguish different VXLANs. For example: a VNI can be used to identify a tenant.

S104. According to the VXLAN message, the first router obtains an encapsulated message, where the encapsulated message is a message obtained after performing IPsec-ESP encapsulation on the VXLAN message, and the encapsulated The packet includes an IP header, the VNI, an ESP header, and the encrypted VXLAN packet, and the VNI is encapsulated between the IP header and the ESP header.

For example, the first router may insert the VNI included in the VXLAN packet between the IP header and the ESP header included in the encapsulated packet.

For example, the first router obtaining the encapsulated message according to the VXLAN message includes: the first router obtaining the VNI from the VXLAN message; Carry out IPsec-ESP encapsulation, obtain IPsec-ESP encapsulation message, described IPsec-ESP encapsulation message comprises the VXLAN message of encryption, the ESP header encapsulated outside the VXLAN message of encryption and the IP header encapsulated outside the ESP header; The first router inserts the VNI between the IP header included in the IPsec-ESP encapsulated message and the ESP header, to obtain the encapsulated message. The encapsulated message may be the message shown in Fig. 3a or Fig. 3b. The message shown in FIG. 3a is an encapsulated message sent in a transport (English name is transport) mode. The IP header included in the packet shown in FIG. 3a may adopt the structure shown in FIG. 5 . The message shown in FIG. 3b is an encapsulated message sent in a tunnel (English name is tunnel) mode. The intranet IP header included in the message shown in FIG. 3b is the IP header included in the VXLAN message sent by the VTEP to the first router. The IP header included in the packet shown in FIG. 3b may adopt the structure shown in FIG. 5 . The encrypted VXLAN message in Figure 3a and Figure 3b is a message obtained by encrypting the VXLAN sent by the VTEP, and the content included in the encrypted VXLAN message will not be repeated here.

For example, the first router obtaining the encapsulated message according to the VXLAN message includes: the first router obtaining the VNI from the VXLAN message; Encrypt to obtain an encrypted VXLAN message; the first router encapsulates the ESP header, the VNI, and the IP header layer by layer outside the encrypted VXLAN message. The encapsulated message may be the message shown in Fig. 3a or Fig. 3b.

Optionally, the IP header included in the encapsulated packet may further include first identification information, where the first identification information is used to identify that the encapsulated packet carries the VNI.

For example, if the IP header included in the encapsulated message in FIG. 3a or FIG. 3b adopts the IP header shown in FIG. 5 . The shown first identification information may be carried in the protocol number field in the IP header shown in FIG. 5 . In this embodiment, the protocol number field in the IP header shown in Figure 5 can be used to indicate the packet type after the IP header, for example, the protocol number field is defined as "ESP/VXLAN" to indicate the IP header. The packet type is an ESP packet encapsulated with a VXLAN header. Wherein, the ESP message encapsulating the VXLAN header may encapsulate the VXLAN header including the VNI outside the ESP message, or encapsulate the VNI outside the ESP message. The first router may update the information contained in the IP header after adding the VNI between the ESP header and the IP header. IP header shown in Figure 5, after the first router can add the VNI between the ESP header and the IP header, the IP header includes the protocol number field, the total length field, and the header checksum. The checksum field is updated so that the encapsulated message with the added VNI meets the format requirements.

Optionally, the first router may obtain a VXLAN header from a VXLAN packet from the VTEP, where the VXLAN header includes the VNI. The first router encapsulates the VXLAN header included in the VXLAN packet between the IP header and the ESP header to obtain the encapsulated packet. In this way, the first router does not need to identify and obtain the VNI from the VXLAN message from the VTEP, which helps to simplify operations. The method for the first router to obtain the encapsulated message including the VXLAN header is the same as the above method for obtaining the encapsulated message including the VNI, and will not be repeated here.

S106. The first router sends the encapsulated packet to the second router.

For example, the second router is a router between different DCs. For example, the first router belongs to DC1, and the third router belongs to DC2. The encapsulated message is a message that needs to be sent by the first router of DC1 to the third router of DC2. The second router is a router in the transmission network between DC1 and DC2.

For example, if the encapsulated packet is a packet sent in transport mode, the destination IP address in the IP header included in the encapsulated packet is the IP address of the third router. If the encapsulated message is a message sent in tunnel mode, the destination IP address in the IP header included in the encapsulated message is the destination address of the tunnel, and the destination address of the tunnel is the third router's IP address.

For example, a first correspondence may be pre-configured on the first router, and the first correspondence includes the VNI and the IP address of the third router. The first router may obtain the IP address of the third router according to the first correspondence and the VNI. The first router may use the IP address of the third router as the destination IP address included in the IP header in the encapsulated packet.

For example, the first router may be pre-configured with a second correspondence, and the second correspondence includes address information and the IP address of the third router. The address information may be any one or any combination of the source IP address, destination IP address, source MAC address and destination MAC address included in the VXLAN packet sent by the VTEP.

Taking the scenario where communication between DC1 and DC2 is required as an example, after obtaining the encapsulated message, the first router in DC1 sends the encapsulated message to the third router in DC2 according to the destination IP address included in the IP header. subsequent message. The destination IP address included in the IP header in the encapsulated message is the IP address of the third router in DC2. The second router is included between the first router in DC1 and the third router in DC2, that is, the path between the first router in DC1 and the third router in DC2 includes the second router. The second router may be a router capable of obtaining the VNI carried in the encapsulated packet. The first router in DC1 sends the encapsulated message to the third router in DC2, and the encapsulated message will be forwarded to the third router along the path between the first router and the third router. Two routers.

In the method for processing a VXLAN message provided by the embodiment of the present invention, the first router obtains the encapsulated message according to the VXLAN message and the VNI in the VXLAN message, and the IP header included in the encapsulated message The VNI is encapsulated between the ESP header and the ESP header. The first router sends the encapsulated message to the second router, which helps the second router perform further service processing according to the VNI carried in the encapsulated message, such as load sharing and other service processing , which helps to improve network operation efficiency.

Based on the method for processing VXLAN packets provided in the first embodiment of the present invention, another embodiment of the present invention provides a method for processing VXLAN packets. The method provided by another embodiment of the present invention is different from the method provided by the first embodiment of the present invention in that: the first router can also insert the UDP header included in the VXLAN message into the UDP header included in the encapsulated message between the IP header and the VNI. That is, S104 included in the method provided by another embodiment of the present invention is different from S104 in the method provided by the first embodiment of the present invention, and the difference will be described here. For other content, please refer to the method provided by the first embodiment of the present invention corresponding content in .

For example, in S104, obtaining the encapsulated message by the first router according to the VXLAN message includes: the first router obtains the VNI and the UDP header from the VXLAN message; A router performs IPsec-ESP encapsulation on the VXLAN message to obtain an IPsec-ESP encapsulated message. The IPsec-ESP encapsulated message includes an encrypted VXLAN message, an ESP header encapsulated outside the encrypted VXLAN message, and an encapsulation An IP header outside the ESP header; the first router inserts the VNI and UDP headers between the IP header included in the IPsec-ESP encapsulated message and the ESP header, to obtain the encapsulated message. The encapsulated message may be the message shown in Fig. 4a or Fig. 4b. The message shown in FIG. 4a is an encapsulated message sent in transport mode. The IP header included in the packet shown in FIG. 4a may adopt the structure shown in FIG. 5 , and the UDP header included in the packet shown in FIG. 4a may adopt the structure shown in FIG. 6 . The message shown in FIG. 4b is an encapsulated message sent in tunnel mode. The intranet IP header included in the message shown in FIG. 4b is the IP header included in the VXLAN message sent by the VTEP to the first router. The IP header included in the packet shown in FIG. 4b may adopt the structure shown in FIG. 5 , and the UDP header included in the packet shown in FIG. 4b may adopt the structure shown in FIG. 6 . The encrypted VXLAN message in Figure 4a and Figure 4b is a message obtained by encrypting the VXLAN message sent by the VTEP, and the content included in the encrypted VXLAN message will not be repeated here.

For example, in S104, obtaining the encapsulated message by the first router according to the VXLAN message includes: the first router obtains the VNI and the UDP header from the VXLAN message; A router encrypts the VXLAN message to obtain the encrypted VXLAN message; the first router encapsulates the ESP header, the VNI, and the UDP header layer by layer outside the encrypted VXLAN message and the IP header. The encapsulated message may be the message shown in Fig. 4a or Fig. 4b.

For example, the IP header included in the encapsulated message may also include first identification information, the first identification information is used to identify that the encapsulated message carries the UDP header, and the encapsulated The UDP header between the IP header and the VNI includes second identification information, and the second identification information is used to identify that the encapsulated packet carries the VNI.

For example, if the IP header included in the encapsulated message in FIG. 4a or FIG. 4b adopts the IP header shown in FIG. 5 . The shown first identification information may be carried in the protocol number field in the IP header shown in FIG. 5 . In this embodiment, the protocol number field in the IP header shown in FIG. 5 can be defined as UDP, which is used to indicate that the UDP header is carried after the IP header. The first router may update the information contained in the IP header after adding the VNI and the UDP header between the ESP header and the IP header. The IP header shown in Figure 5, after the first router can add the VNI and the UDP header between the ESP header and the IP header, the IP header includes the protocol number field, the total length field and the header checksum field are updated, so that the encapsulated message carrying the VNI and the UDP header meets the format requirements. The destination port number in the UDP header shown in FIG. 6 may be used to carry the second identification information. The destination port number in the UDP header shown in Figure 6 is the ESP/VXLAN port number, that is, the ESP/VXLAN port number is used to identify the VNI carried behind the UDP header. If the UDP header carries a VXLAN header that includes VNI, the destination port number in the UDP header shown in Figure 6 is the ESP/VXLAN port number, that is, the ESP/VXLAN port number is used to identify the UDP header that carries the VXLAN header. header of the ESP packet. The UDP header included in the message shown in FIG. 6 includes a "UDP checksum" field. If the IP header included in the message shown in FIG. 5 has been set with a “header checksum”, then the “UDP checksum” in the UDP header included in the message shown in FIG. 6 can be set to 0.

For example, multiple paths may be included between the first router of DC1 and the third router of DC2. Each path on the plurality of paths may include one or more routers. The source port number in the UDP header included in the encapsulated message and the quintuple information included in the encapsulated message can be used to determine one of the multiple paths for forwarding the encapsulated message. path of the text.

Fig. 2 is a flowchart of a method for processing VXLAN packets according to a second embodiment of the present invention. The second embodiment of the present invention describes the method for processing VXLAN packets provided by the embodiment of the present invention from the perspective of the second router. The second router may be an operator (English full name: provider, English abbreviation: P) device. The method for processing VXLAN packets according to the second embodiment of the present invention will be described in detail below with reference to FIG. 2 .

S202. The second router receives the encapsulated message sent by the first router, the encapsulated message is a message obtained after IPsec-ESP encapsulation of the VXLAN message from the VTEP, and the encapsulated message It includes an IP header, a VNI, an ESP header and the encrypted VXLAN message, and the VNI is encapsulated between the IP header and the ESP header.

For example, the second router is on a path between the first router of DC1 and the third router of DC2, and the second router receives the encapsulated message sent by the first router to the third router. arts. The encapsulated message is the same as the encapsulated message in the first embodiment of the present invention, and will not be repeated here.

Optionally, the IP header included in the encapsulated message further carries first identification information, and the first identification information is used to identify that the encapsulated message carries the VNI. If the encapsulated message includes a VXLAN header encapsulated in the IP header and the ESP header, and the VXLAN header includes the VNI, the first identification information may be used to identify the encapsulated message The text carries the VXLAN header.

For example, the encapsulated packet received by the second router may be the packet shown in FIG. 3a or FIG. 3b , and the specific structure will not be repeated here.

S204. The second router obtains the VNI from the encapsulated packet.

For example, obtaining the VNI from the encapsulated message by the second router includes: the second router may determine the VNI according to the first identification information carried in the IP header of the encapsulated message. The encapsulated message carries the VNI; the second router obtains the VNI carried in the encapsulated message from the IP header of the encapsulated message.

For example, the second router may use the obtained VNI to perform service processing on the encapsulated message, such as Qos, load sharing and other service processing. VNI is used to distinguish different VXLANs. The second router may determine, through the VNI, the tenant to which the VXLAN packet included in the encapsulated packet belongs. The second router may store a mapping relationship table between VNIs and tenants. The second router may perform a load sharing operation on the encapsulated message according to the VNI carried in the encapsulated message and the mapping relationship table, and the specific operation process will not be repeated here.

In the method for processing the VXLAN message provided by the embodiment of the present invention, the VNI included in the encapsulated message is encapsulated between the IP header and the ESP header, and the second router may, after receiving the encapsulated message, Identify the VNI carried in the encapsulated packet. The second router may obtain the VNI from the encapsulated packet. In this way, the second router can use the obtained VNI to perform further service processing, which helps to improve network operation efficiency.

On the basis of the method for processing VXLAN packets provided in the second embodiment of the present invention, another embodiment of the present invention provides a method for processing VXLAN packets. In the method provided by another embodiment of the present invention, the encapsulated packet received by the second router includes a VNI and UDP header encapsulated between the IP header and the ESP header, or the packet received by the second router The encapsulated message includes a VXLAN header and a UDP header encapsulated between the IP header and the ESP header, and the VXLAN header includes the VNI. The difference between the method provided by another embodiment of the present invention and the method provided by the second embodiment of the present invention lies in S204, and only the differences will be described below. For the same content, please refer to the method provided by the second embodiment of the present invention corresponding content.

In S202, the encapsulated packet received by the second router includes an IP header, a UDP header, a VNI, an ESP header, and an encrypted VXLAN packet. The encapsulated message received by the second router may be the message shown in Figure 4a or Figure 4b, and the specific structure will not be repeated here. In this embodiment, the IP header of the encapsulated message may carry first identification information, and the first identification information is used to identify that the encapsulated message carries the UDP header, and the UDP header Indicates the UDP header carried in the VXLAN packet sent by the VTEP to the first router. The UDP header encapsulated between the IP header and the VNI includes second identification information, and the second identification information is used to identify that the encapsulated message carries the VNI. Since the VNI is usually carried in the VXLAN packet sent by the VTEP to the first router, if the encapsulated packet includes a VXLAN header and a UDP header encapsulated in the IP header and the ESP header, Then the second identification information may be used to identify that the encapsulated packet carries a VXLAN header.

For example, in S204, the second router obtaining the VNI from the encapsulated message includes: the second router obtaining the first VNI carried by the IP header from the IP header of the encapsulated message. One identification information; the second router obtains the UDP header included in the encapsulated message according to the first identification information; the second router obtains the UDP header included in the IP header according to the purpose The port number is used to determine that the encapsulated message carries the VNI; the second router obtains the VNI from the UDP header of the encapsulated message. If the VNI of the encapsulated message is carried in the VXLAN header, and the VXLAN header is encapsulated between the UDP header and the ESP header of the encapsulated message, then the second router can obtain from the encapsulated The VXLAN header is obtained after the UDP header of the packet, and the VNI is obtained from the VXLAN header.

The third router in DC2 receives the encapsulated message from the first router, that is, the encapsulated message forwarded by the second router, and the third router can process the encapsulated message to obtain VXLAN packets.

For example, if the encapsulated message includes a VNI encapsulated in an IP header and an ESP header, then the third router may process the encapsulated message to obtain a VXLAN message including: the third The router can remove the VNI encapsulated in the IP header and the ESP header included in the encapsulated message; the third router will update the IP header in the message obtained after removing the VNI to obtain the VXLAN message . The VXLAN packet is a packet that can be identified by the VTEP in DC2. Wherein, the third router updating the IP header in the message obtained after removing the VNI may include: the third router updating the total length field and the protocol number of the IP header in the message obtained after removing the VNI field and header checksum field, so that the VXLAN packet can be identified and/or processed by the VTEP in DC2.

For example, if the encapsulated message includes a VNI and a UEP header encapsulated in an IP header and an ESP header, then the third router may process the encapsulated message to obtain a VXLAN message including: The third router can remove the VNI and UDP header encapsulated in the IP header and the ESP header included in the encapsulated message; the third router will remove the IP header in the message obtained after the VNI and UDP header Perform an update to obtain the VXLAN message. The VXLAN packet is a packet that can be identified by the VTEP in DC2. Wherein, the third router updating the IP header in the message obtained after removing the VNI and UDP header may include: the third router updating the IP header in the message obtained after removing the VNI and UDP header The total length field, the protocol number field and the header checksum field are updated, so that the VXLAN packet can be identified and/or processed by the VTEP in DC2.

FIG. 7 is a schematic structural diagram of a first router provided by an embodiment of the present invention. The first router corresponding to FIG. 7 may execute the method provided in the embodiment corresponding to FIG. 1 . The first router corresponding to FIG. 7 may be the first router in the embodiment corresponding to FIG. 2 . The first router provided in this embodiment of the present invention includes a receiving unit 702 , a processing unit 704 and a sending unit 706 .

The receiving unit 702 is configured to receive a VXLAN packet sent by a VTEP, and the VXLAN packet includes a VNI.

The processing unit 704 is configured to obtain an encapsulated message according to the VXLAN message, the encapsulated message is a message obtained after performing IPsec-ESP encapsulation on the VXLAN message, and the encapsulated message The packet includes an IP header, the VNI, an ESP header, and the encrypted VXLAN packet, and the VNI is encapsulated between the IP header and the ESP header.

The sending unit 706 is configured to send the encapsulated packet to the second router.

Optionally, the IP header includes first identification information, where the first identification information is used to identify that the encapsulated packet carries the VNI.

Optionally, the encapsulated message further includes a UDP header encapsulated between the IP header and the VNI, where the UDP header is the UDP header included in the VXLAN message from the VTEP, The IP header includes first identification information, the first identification information is used to identify that the encapsulated message carries the UDP header, and the UDP header encapsulated between the IP header and the VNI Include second identification information, where the second identification information is used to identify that the encapsulated packet carries the VNI.

In the first router provided by the embodiment of the present invention, the processing unit obtains the encapsulated message according to the VXLAN message and the VNI in the VXLAN message, and the IP header included in the encapsulated message and the ESP header are encapsulated There is said VNI. The sending unit sends the encapsulated message to the second router, which helps the second router perform further service processing according to the VNI carried in the encapsulated message, such as load sharing and other service processing, It helps to improve network operation efficiency.

Fig. 8 is a schematic structural diagram of a first router provided by another embodiment of the present invention. The first router may execute the method provided in the embodiment corresponding to FIG. 1 . The first router may be the first router in the embodiment corresponding to FIG. 2 . The first router provided in this embodiment of the present invention includes a processor 801 , a memory 802 , an interface 803 and a bus 804 . Wherein, the interface 803 may be implemented in a wireless or wired manner, for example, the interface 803 may be a network interface card (English full name: Network Interface Card, English abbreviation: NIC) or other components for realizing communication. The processor 801 , the memory 802 , and the interface 803 may be connected through the bus 804 .

The memory 802 is used to store program codes. Optionally, the program code may include operating system programs and application programs.

The processor 801 performs the following operations according to the executable instructions included in the program read from the memory 802 .

The processor 801 receives the VXLAN message sent by the VTEP through the interface 803, the VXLAN message includes a VXLAN network identifier VNI; the processor 801 obtains the encapsulated message according to the VXLAN message, The encapsulated message is a message obtained after IPsec-ESP encapsulation of the VXLAN message, and the encapsulated message includes an IP header, the VNI, an ESP header, and the encrypted VXLAN message , the VNI is encapsulated between the IP header and the ESP header; the processor 801 sends the encapsulated packet to the second router through the interface 803 .

Optionally, the IP header includes first identification information, where the first identification information is used to identify that the encapsulated packet carries the VNI.

Optionally, the encapsulated message further includes a UDP header encapsulated between the IP header and the VNI, where the UDP header is the UDP header included in the VXLAN message from the VTEP, The IP header includes first identification information, the first identification information is used to identify that the encapsulated message carries the UDP header, and the UDP header encapsulated between the IP header and the VNI Include second identification information, where the second identification information is used to identify that the encapsulated packet carries the VNI.

In the first router provided in the embodiment of the present invention, the processor 801 obtains the encapsulated message according to the VXLAN message and the VNI in the VXLAN message, and the encapsulated message includes the IP header and the ESP header. Packaged with the VNI. The processor 801 sends the encapsulated message to the second router through the interface 803, which helps the second router perform further service processing according to the VNI carried in the encapsulated message, such as load Sharing and other business processing helps to improve network operation efficiency.

FIG. 9 is a schematic structural diagram of a second router provided by an embodiment of the present invention. The second router shown in FIG. 9 may execute the method provided in the embodiment corresponding to FIG. 2 . The second router shown in FIG. 9 may be the second router in the embodiment corresponding to FIG. 1 . The second router provided in this embodiment of the present invention includes a receiving unit 902 and a processing unit 904 .

The receiving unit 902 is configured to receive the encapsulated message sent by the first router. The encapsulated message is a message obtained after IPsec-ESP encapsulation of the VXLAN message from the VTEP, and the encapsulated message includes an IP header, VNI, ESP header and encrypted VXLAN message In the text, the VNI is encapsulated between the IP header and the ESP header.

The processing unit 904 is configured to obtain the VNI from the encapsulated packet.

For example, if the IP header includes first identification information, and the first identification information is used to identify that the encapsulated packet carries the VNI, the processing unit 904 is specifically configured to The included first identification information determines that the encapsulated packet includes the VNI; the processing unit 904 is specifically configured to obtain the VNI from between the IP header and the ESP header.

For example, if the encapsulated message also includes a UDP header encapsulated between the IP header and the VNI, and the UDP header is the UDP header included in the VXLAN message from the VTEP, the The IP header includes first identification information, the first identification information is used to identify that the encapsulated message carries the UDP header, and the UDP header encapsulated between the IP header and the VNI includes second identification information, where the second identification information is used to identify that the encapsulated packet carries the VNI, and the processing unit 904 is specifically configured to, according to the first identification information included in the IP header, Obtaining the UDP header encapsulated between the IP header and the VNI; the processing unit 904 is specifically configured to, according to the second identification information included in the UDP header encapsulated between the IP header and the VNI, It is determined that the encapsulated packet includes the VNI; the processing unit 904 is specifically configured to obtain the VNI from between the IP header and the ESP header.

In the second router provided by the embodiment of the present invention, the VNI included in the encapsulated message is encapsulated between the IP header and the ESP header, and the processing unit 904 may process the encapsulated message after receiving the encapsulated message. The VNI carried in the file is identified. The processing unit 904 may obtain the VNI from the encapsulated packet. In this way, the second router can use the obtained VNI to perform further service processing, which helps to improve network operation efficiency.

FIG. 10 is a schematic structural diagram of a second router provided by another embodiment of the present invention. The second router may execute the method provided in the embodiment corresponding to FIG. 2 . The second router may be the second router in the embodiment corresponding to 1. The second router provided in this embodiment of the present invention includes: a processor 1001 , a memory 1002 , an interface 1003 and a bus 1004 . Wherein, the interface 1003 may be implemented in a wireless or wired manner, such as a NIC or other components for implementing communication. The processor 1001 , the memory 1002 , and the interface 1003 are connected through the bus 1004 .

The memory 1002 is used to store program codes. Optionally, the program code may include operating system programs and application programs.

The processor 1001 performs the following operations according to the executable instructions included in the program read from the memory 1002 .

The processor 1001 receives the encapsulated packet sent by the first router through the interface 1003 . The encapsulated message is a message obtained after IPsec-ESP encapsulation of the VXLAN message from the VTEP, and the encapsulated message includes an IP header, VNI, ESP header and encrypted VXLAN message In the packet, the VNI is encapsulated between the IP header and the ESP header; the processor 1001 obtains the VNI from the encapsulated packet.

For example, if the IP header includes first identification information, and the first identification information is used to identify that the encapsulated packet carries the VNI, then the processor 1001 The first identification information is used to determine that the encapsulated packet includes the VNI; the processor 1001 obtains the VNI from between the IP header and the ESP header.

For example, if the encapsulated message also includes a UDP header encapsulated between the IP header and the VNI, and the UDP header is the UDP header included in the VXLAN message from the VTEP, the The IP header includes first identification information, the first identification information is used to identify that the encapsulated message carries the UDP header, and the UDP header encapsulated between the IP header and the VNI includes The second identification information, where the second identification information is used to identify that the encapsulated message carries the VNI, then the processor 1001 obtains the packaged packet according to the first identification information included in the IP header. the UDP header between the IP header and the VNI; the processor 1001 determines the encapsulated UDP header according to the second identification information included in the UDP header encapsulated between the IP header and the VNI The packet includes the VNI; the processor 1001 obtains the VNI from between the IP header and the ESP header.

In the second router provided in the embodiment of the present invention, the VNI included in the encapsulated message is encapsulated between the IP header and the ESP header, and the processor 1001 may, after receiving the encapsulated message, process the encapsulated message The VNI carried in the file is identified. The processor 1001 may obtain the VNI from the encapsulated packet. In this way, the second router can use the obtained VNI to perform further service processing, which helps to improve network operation efficiency.

FIG. 11 is a system for processing VXLAN packets provided by an embodiment of the present invention. The system provided in this embodiment of the present invention may include the first router provided in the embodiment corresponding to FIG. 7 or FIG. 8 and the second router provided in the embodiment corresponding to FIG. 9 or FIG. 10 . The second router will be described in detail.

Those of ordinary skill in the art will understand that various aspects of the present invention, or possible implementations of various aspects, may be embodied as systems, methods or computer program products. Thus, aspects of the present invention, or possible implementations of various aspects, may take the form of an entirely hardware embodiment, an entirely software embodiment (including firmware, resident software, etc.), or an embodiment combining software and hardware aspects, described in These are collectively referred to herein as "circuits," "modules," or "systems." In addition, aspects of the present invention, or possible implementations of various aspects, may take the form of computer program products, and computer program products refer to computer-readable program codes stored in computer-readable media.

The computer readable medium may be a computer readable signal medium or a computer readable storage medium. Computer-readable storage media include but are not limited to electronic, magnetic, optical, electromagnetic, infrared or semiconductor systems, equipment or devices, or any appropriate combination of the foregoing, such as random access memory (English full name: random access memory, English abbreviation: RAM ), read-only memory (English full name: read-only memory, English abbreviation: ROM), erasable programmable read-only memory ((English full name: erasable programmable read only memory, English abbreviation: EPROM) or flash memory), Optical fiber, portable read-only memory (English full name: compact disc read-only memory, English abbreviation: CD-ROM).

The processor in the computer reads the computer-readable program code stored in the computer-readable medium, so that the processor can execute the functional actions specified in each step in the flow chart, or a combination of steps; A device that performs functional actions specified in each block or a combination of blocks.

The computer readable program code may execute entirely on the user's local computer, partly on the user's local computer, as a separate software package, partly on the user's local computer and partly on a remote computer, or entirely on the remote computer or Execute on the server. It should also be noted that, in some alternative implementations, the functions noted at the steps in the flowcharts or blocks in the block diagrams may occur out of the order noted in the figures. For example, two steps, or two blocks shown in succession, may in fact be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved.

Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and equivalent technologies thereof, the present invention also intends to include these modifications and variations.

Claims (13)

1. A method for processing virtual extensible local area network VXLAN message, is characterized in that, described method comprises: The first router receives the VXLAN packet sent by the virtual tunnel endpoint VTEP, and the VXLAN packet includes a VXLAN network identifier VNI; The first router obtains an encapsulated message according to the VXLAN message, and the encapsulated message is a message obtained after Internet Protocol Security-Encapsulation Security Payload IPsec-ESP encapsulation is performed on the VXLAN message The encapsulated message includes an Internet Protocol IP header, the VNI, an Encapsulating Security Payload Protocol ESP header, and the encrypted VXLAN message, and the VNI is encapsulated between the IP header and the ESP header ; The first router sends the encapsulated packet to the second router. 2. The method according to claim 1, wherein the IP header includes first identification information, and the first identification information is used to identify that the encapsulated packet carries the VNI. 3. The method according to claim 1, wherein the encapsulated message also includes a User Data Packet Protocol (UDP) header encapsulated between the IP header and the VNI, and the UDP header is from The UDP header included in the VXLAN packet of the VTEP; The IP header includes first identification information, the first identification information is used to identify that the encapsulated message carries the UDP header, and the UDP header encapsulated between the IP header and the VNI Include second identification information, where the second identification information is used to identify that the encapsulated packet carries the VNI. 4. A method for processing a Virtual Extensible Local Area Network VXLAN message, characterized in that the method comprises: The second router receives the encapsulated message sent by the first router, and the encapsulated message is a message obtained after Internet protocol security-encapsulation security load IPsec-ESP encapsulation of the VXLAN message from the virtual tunnel endpoint VTEP The encapsulated message includes an Internet Protocol IP header, a VXLAN network identifier VNI, an Encapsulating Security Payload Protocol ESP header, and the encrypted VXLAN message, and the VNI is encapsulated in the IP header and the ESP header between; The second router obtains the VNI from the encapsulated packet. 5. The method according to claim 4, wherein the IP header includes first identification information, the first identification information is used to identify that the encapsulated message carries the VNI, and the second Obtaining the VNI from the encapsulated message by the second router includes: The second router determines, according to the first identification information included in the IP header, that the encapsulated packet includes the VNI; The second router obtains the VNI from between the IP header and the ESP header. 6. The method according to claim 4, wherein the encapsulated message also includes a User Data Packet Protocol (UDP) header encapsulated between the IP header and the VNI, and the UDP header is from The UDP header included in the VXLAN message of the VTEP, the IP header includes first identification information, the first identification information is used to identify that the encapsulated message carries the UDP header, and the encapsulated The UDP header between the IP header and the VNI includes second identification information, and the second identification information is used to identify that the encapsulated message carries the VNI; Obtaining the VNI from the encapsulated packet by the second router includes: The second router obtains the UDP header encapsulated between the IP header and the VNI according to the first identification information included in the IP header; The second router determines that the encapsulated message includes the VNI according to the second identification information included in the UDP header encapsulated between the IP header and the VNI; The second router obtains the VNI from between the IP header and the ESP header. 7. A first router, characterized in that, the first router comprises: A receiving unit, configured to receive a virtual extensible local area network VXLAN message sent by a virtual tunnel endpoint VTEP, where the VXLAN message includes a VXLAN network identifier VNI; A processing unit, configured to obtain an encapsulated message according to the VXLAN message, and the encapsulated message is a message obtained after performing Internet Protocol security-encapsulation security payload IPsec-ESP encapsulation on the VXLAN message The encapsulated message includes an Internet Protocol IP header, the VNI, an Encapsulating Security Payload Protocol ESP header, and the encrypted VXLAN message, and the VNI is encapsulated between the IP header and the ESP header ; A sending unit, configured to send the encapsulated message to the second router. 8. The first router according to claim 7, wherein the IP header includes first identification information, and the first identification information is used to identify that the encapsulated packet carries the VNI. 9. The first router according to claim 7, wherein the encapsulated message further comprises a User Data Packet Protocol UDP header encapsulated between the IP header and the VNI, and the UDP header A UDP header included in the VXLAN message from the VTEP; The IP header includes first identification information, the first identification information is used to identify that the encapsulated message carries the UDP header, and the UDP header encapsulated between the IP header and the VNI Include second identification information, where the second identification information is used to identify that the encapsulated packet carries the VNI. 10. A second router, characterized in that, the second router comprises: The receiving unit is used to receive the encapsulated message sent by the first router, and the encapsulated message is to perform Internet protocol security-encapsulation security load IPsec-ESP encapsulation on the VXLAN message from the virtual tunnel endpoint VTEP After the message obtained, the encapsulated message includes an Internet Protocol IP header, a VXLAN network identifier VNI, an encapsulation security payload protocol ESP header and the encrypted VXLAN message, and the VNI is encapsulated in the IP header and between the ESP headers; A processing unit, configured to obtain the VNI from the encapsulated packet. 11. The second router according to claim 10, wherein the IP header includes first identification information, and the first identification information is used to identify that the encapsulated message carries the VNI; The processing unit is specifically configured to determine that the encapsulated packet includes the VNI according to the first identification information included in the IP header; The processing unit is specifically configured to obtain the VNI from between the IP header and the ESP header. 12. The second router according to claim 10, wherein the encapsulated message further comprises a User Datagram Protocol (UDP) header encapsulated between the IP header and the VNI, and the UDP header is the UDP header included in the VXLAN message from the VTEP, the IP header includes first identification information, and the first identification information is used to identify that the encapsulated message carries the UDP header, so The UDP header encapsulated between the IP header and the VNI includes second identification information, and the second identification information is used to identify that the encapsulated message carries the VNI; The processing unit is specifically configured to obtain a UDP header encapsulated between the IP header and the VNI according to the first identification information included in the IP header; The processing unit is specifically configured to determine that the encapsulated message includes the VNI according to the second identification information included in the UDP header encapsulated between the IP header and the VNI; The processing unit is specifically configured to obtain the VNI from between the IP header and the ESP header. 13. A system for processing virtual extensible local area network (VXLAN) packets, characterized in that the system comprises the first router according to any one of claims 7 to 9 and the router according to any one of claims 10 to 12 the second router.