CN107959611B - A method, device and system for forwarding messages - Google Patents

Abstract

The present application provides a method, device and system for forwarding packets in an L3VPN. The method includes: configuring a policy route in the VPN instance of the operator edge PE device, so that the PE device forwards the received message according to the policy route. Therefore, the packet forwarding method provided by the present application can guide the packet to communicate through the spliced L3VPN tunnel, and meet the communication requirement across multiple L3VPN tunnels. This further enables tenants to control access to the network, making networking more flexible.

Description

A method, device and system for forwarding messages

technical field

The present application relates to the field of communication technologies, and in particular, to a method, device and system for forwarding a message.

Background technique

A VPN is a virtual private network (Virtual Private Network, VPN) provided by an operator to a user through its public network, that is, from the perspective of a user, a VPN is a private network of the user. For operators, the public network includes the public backbone network and public operator border equipment. The geographically separated VPN member sites are connected to corresponding provider edge (Provider Edge, PE) devices through a customer edge (Customer Edge, CE) device, and a customer's VPN network is formed through the operator's public network.

Layer 3 VPN (Layer 3Virtual Private Network, L3VPN) is applied to private network services that require L3. The L3VPN service forwards Internet Protocol (Internet Protocol, IP) packets in a manner similar to traditional routing. After the router receives the IP data packet, it looks up the destination address of the IP data packet in the forwarding table, and uses the pre-established channel to transmit the IP data packet.

The existing L3VPN technology is an implementation scheme of a virtual network. The signaling protocol of L3VPN is Border Gateway Protocol (BGP), and between PE devices is Internal Border Gateway Protocol (IBGP) peers ( PEER) relationship. To prevent route black hole, the BGP protocol stipulates that the route received by a PE device from one IBGP peer cannot be advertised to another IBGP peer. Therefore, the PE device only has the routes of its own IBGP peers, and does not have the routes of the PE devices beyond one hop.

For the user's service networking implemented by L3VPN, if the service nodes communicate through the L3VPN tunnel, the nodes that have not established the directly connected L3VPN tunnel cannot communicate with each other.

SUMMARY OF THE INVENTION

The present application provides a method, device and system for forwarding packets in an L3VPN, which can meet the communication requirements between nodes spanning multiple L3VPN tunnels.

In a first aspect, the present application provides a method for forwarding packets in an L3VPN. The L3VPN includes a first network device, a second network device and a third network device, a first L3VPN tunnel is established between the first network device and the second network device, the second network device and the third network device A second L3VPN tunnel is established between network devices. First, the first network device receives the packet, and then searches the VPN instance bound to the inbound interface for the first matching packet in the VPN instance bound to the inbound interface according to the inbound interface that received the packet and the destination address of the packet. A policy routing. The first policy route is used to indicate that the next hop to the destination address of the packet is the second network device. After finding the first policy route matching the packet, according to the indication of the first policy route, the first network device sends the packet to the second through the first L3VPN tunnel Network equipment. Wherein, the second network device stores a forwarding entry that reaches the destination address of the packet, and the forwarding entry is used to instruct the second network device to forward the packet to the third network device, The second L3VPN tunnel is used by the second network device to send the message to the third network device.

With reference to the first aspect, in a first possible implementation manner of the first aspect, the first network device is a PE device, and the PE device receives the packet sent by the CE device.

With reference to the first aspect, in a second possible implementation manner of the first aspect, the first network device receives the packet sent by the fourth network device. The fourth network device is configured with a second policy route, and the second policy route is used to indicate that the next hop to the destination address of the packet is the first network device. A third L3VPN tunnel is established between the fourth network device and the first network device. The fourth network device sends the packet to the first network device through the third L3VPN tunnel.

In combination with the first aspect and the above possible manners, in a third possible implementation manner of the first aspect, before the first network device receives the message, the first network device receives the message sent by the control and management device. Configuration messages. The configuration message carries the first policy route. The first network device obtains the first policy route according to the configuration message.

By configuring the first policy route in the VPN instance of the first network device, the guide message communicates through the spliced first L3VPN tunnel and the second L3VPN tunnel, thereby realizing the access control of the tenant to the network. Tenants can communicate with each other between sites in the VPN. The service networking within the VPN can be topologically based on user requirements, rather than being limited to the traditional full-site full mesh or hub-spoke hub-spoke networking. Therefore, the networking method is more flexible.

In a second aspect, the present application provides a method for forwarding packets in an L3VPN. The L3VPN includes a first network device, a second network device and a third network device, a first L3VPN tunnel is established between the first network device and the second network device, the second network device and the third network device A second L3VPN tunnel is established between the devices. First, the control management device generates a configuration message. The configuration message is used to configure a policy route in the VPN instance bound to the first interface of the first network device, and the policy route is used to indicate that the next hop to the destination address of the packet is the the second network device. Then, the control and management device sends the configuration message to the first network device. The first L3VPN tunnel is used for the first network device to send the message to the second network device. The second network device stores a forwarding entry that reaches the destination address of the packet, and the forwarding entry is used to instruct the second network device to forward the packet to the third network device. The second L3VPN tunnel is used by the second network device to send the message to the third network device.

By controlling the management device to configure policy routing in the VPN instance of the first network device, and guiding packets to communicate through the spliced first L3VPN tunnel and the second L3VPN tunnel, the tenant's access control to the network is implemented. Tenants can also optimize network bandwidth and set personalized service chains according to their needs. Tenants can communicate with each other between sites in the VPN. The service networking in the VPN can be topologically based on user needs, making the networking more flexible.

In a third aspect, the present application provides an apparatus for forwarding a message. The apparatus is applied in an L3VPN, and is used for executing the first aspect and the modules of the method in any possible implementation manner of the first aspect.

In a fourth aspect, the present application provides a communication system, which is applied in a Layer 3 virtual private network L3VPN, and the communication system includes a control and management device, a first network device, a second network device, and a third network device. A first L3VPN tunnel is established between the first network device and the second network device. A second L3VPN tunnel is established between the second network device and the third network device. in,

The control and management device is configured to send a first configuration message to the first network device. The first configuration message carries a first policy route, and the first configuration message is used to configure the first policy route in the first VPN instance bound to the first interface of the first network device. The first policy route is used to indicate that the next hop to the destination address of the packet is the second network device. The first network device is configured to receive the packet from the first interface, and search for the first VPN instance that matches the packet according to the destination address of the packet. A policy routing. The first network device is further configured to send the packet to the second network device through the first L3VPN tunnel according to the instruction of the first policy route. The second network device stores a forwarding entry that reaches the destination address of the packet. The forwarding table entry is used to instruct the second network device to forward the packet to the third network device. The second L3VPN tunnel is used by the second network device to send the message to the third network device. Optionally, the control management device may be a controller or a network management device.

According to the communication system provided by the present application, the policy routing is configured in the VPN instance of the first network device by the control and management device, and the guide message is communicated through the spliced first L3VPN tunnel and the second L3VPN tunnel, so that tenants can be connected to each other. Network access control. Tenants can communicate with each other between sites in the VPN, and the service networking in the VPN can be topologically based on user requirements, making the networking more flexible.

With reference to the fourth aspect, in a first possible implementation manner of the fourth aspect, the communication system further includes a fourth network device, and a third L3VPN is established between the fourth network device and the first network device tunnel. Wherein, the control and management device is further configured to send a second configuration message to the fourth network device. The second configuration message carries a second policy route, and the second configuration message is used to bind the second policy route in a second VPN instance bound to the second interface of the fourth network device. The second policy route is used to indicate that the next hop to the destination address of the packet is the first network device. The fourth network device is configured to receive the packet from the second interface, and according to the destination address of the packet, search for the second VPN instance that matches the packet in the second VPN instance. Two-policy routing. The fourth network device is further configured to forward the packet to the first network device through the third L3VPN tunnel according to the instruction of the second policy route. The first network device is specifically configured to receive the packet forwarded by the fourth network device.

In a fifth aspect, the present application provides an apparatus for forwarding a message, the apparatus is applied in an L3VPN, and the apparatus includes: an input interface, an output interface, a processor and a memory. Wherein, the input interface, the output interface, the processor and the memory can be connected through a bus system. The memory is used for storing programs, instructions or codes, and the processor is used for executing the programs, instructions or codes in the memory to complete the first aspect and the method of any possible implementation manner of the first aspect.

In a sixth aspect, the present application provides a control and management device, the control and management device is used in an L3VPN, and the control and management device includes: an input interface, an output interface, a processor and a memory. Wherein, the input interface, the output interface, the processor and the memory can be connected through a bus system. The memory is used to store programs, instructions or codes, and the processor is used to execute the programs, instructions or codes in the memory to complete the method of the second aspect.

In a seventh aspect, an embodiment of the present application provides a computer-readable storage medium for storing a computer program, and the computer program is used to execute the first aspect, any possible implementation manner of the first aspect, and the method of the second aspect. instruction.

Description of drawings

In order to illustrate the technical solutions of the embodiments of the present application more clearly, the following briefly introduces the accompanying drawings used in the embodiments. Obviously, the drawings in the following description are only some embodiments of the present application. For those of ordinary skill in the art, other drawings can also be obtained from these drawings without any creative effort.

1 is a schematic diagram of an application scenario according to an embodiment of the present application;

2(a) is a schematic flowchart of a method for forwarding a message according to an embodiment of the present application;

FIG. 2(b) is a schematic flowchart of a method for forwarding a message according to an embodiment of the present application;

FIG. 3 is a schematic flowchart of another method for forwarding a packet according to an embodiment of the present application

4 is a schematic diagram of an apparatus for forwarding a message according to an embodiment of the present application;

5 is a schematic diagram of an apparatus for forwarding a message according to an embodiment of the present application;

6 is a schematic diagram of a hardware structure of an apparatus for forwarding a message according to an embodiment of the present application;

FIG. 7 is a schematic diagram of a hardware structure of an apparatus for forwarding a packet according to an embodiment of the present application.

Detailed ways

The application scenarios described in the embodiments of the present application are for the purpose of illustrating the technical solutions of the embodiments of the present application more clearly, and do not constitute a limitation on the technical solutions provided by the embodiments of the present application. With the emergence of new business scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

Unless stated to the contrary, the ordinal numbers such as "first", "second", "third", "fourth", and "fifth" mentioned in the embodiments of the present application are used to distinguish multiple objects, and are not used for Restricts the order of multiple objects.

The "VPN Instance" described in the embodiments of this application is an entity established and maintained by the PE device for the directly connected VPN sites. Each VPN site has its own independent VPN instance on the PE device, that is, the PE The device maintains VPN instances for different VPN sites. Usually, a VPN instance is also called a VPN Routing and Forwarding table (VRF), and each VRF corresponds to a VPN and has an independent routing table, a forwarding table, corresponding interfaces, and management information. The management information includes but is not limited to the member interface list and routing filtering policy. By deploying VRFs on PE devices, routes of different VPNs are stored in different VRFs, which can achieve the purpose of VPN route or traffic isolation.

The "control management device" described in the embodiments of this application is used to control and/or manage the resources of the forwarding device in the network, including but not limited to a software-defined network (Software-Defined network, SDN) controller, network management equipment (hereinafter referred to as "network management"). The forwarding device is used to forward and process the message, and may specifically be a traditional router, switch or other routing forwarding device in a traditional Path Computation Element (English: Path Computation Element, PCE) network, or an SDN based on control and forwarding separation Routers, switches, and other routing and forwarding devices, which are not limited in this embodiment of the present application.

The following describes an exemplary application scenario of the embodiment of the present application with reference to FIG. 1 .

FIG. 1 shows an L3VPN network 100 applied by an embodiment of the present application, where the network 100 includes a backbone network provided by a service provider and multiple VPN sites. The backbone network includes a first network device PE1 , a second network device PE2 , a third network device PE3 , a fourth network device PE4 , a fifth network device PE5 and a plurality of P (Provider) devices 110 . The plurality of VPN sites include site1-site6. Among them, site1, site2, site3, and site4 belong to VPN1, and site5 and site6 belong to VPN2. PE1 is a provider edge (Provider Edge, PE) device directly connected to CE1; PE2 is a PE device directly connected to CE2 and CE5 respectively; PE3 is a PE device directly connected to CE3; PE4 is a PE device directly connected to CE4 ; PE5 is a PE device directly connected to CE6. Host A whose IP address is 1.1.1.1 in site1 communicates with PE1 through CE1. Host B whose IP address is 1.1.1.2 in Site3 communicates with PE3 through CE3. PE1 and PE2 are IBGP peers, and PE1 and PE2 communicate through the L3VPN tunnel. PE1 and PE4 are IBGP peers, and PE1 and PE4 communicate through the L3VPN tunnel. PE2 and PE3 are IBGP peers, and PE2 and PE3 communicate through the L3VPN tunnel. PE2 and PE4 are IBGP peers, and PE2 and PE4 communicate through the L3VPN tunnel. There is no directly connected L3VPN tunnel between PE1 and PE3, nor is there any directly connected L3VPN tunnel between PE4 and PE3. According to the provisions of the BGP protocol, after PE2 receives the route advertised by the IBGP peer PE3, it cannot advertise the route to another IBGP peer PE1. Similarly, it cannot advertise the route to the IBGP peer PE4. Therefore, PE1 and PE4 only have routes to PE2, but no routes to PE3. If there is no direct L3VPN tunnel between PE1 and PE3, even if there are bandwidth resources between PE2 and PE3, host A cannot access host B. Arbitrary access control cannot be implemented between sites within VPN1.

The "L3VPN tunnel" described in this application refers to a tunnel between PE devices for carrying L3VPN services, such as a static Label Switched Path (LSP) tunnel based on the Generic Routing Encapsulation Protocol (Generic Routing Encapsulation Protocol). , GRE) tunnels, MPLS Label Distribution Protocol (Lable Distribution Protocol, LDP) LSP tunnels, and MPLS resource reservation protocol (Resource Reservation Protocol-Traffic Engineering, RSVP-TE) tunnels extended for traffic engineering, etc. This is not specifically limited.

The plurality of P devices 110 shown in FIG. 1 , such as P routers, are backbone routers in the backbone network, and are not directly connected to the CE device of the user. The P device has basic MPLS forwarding capabilities, maintains the route to the PE, and does not need to know any VPN routing information.

The CE device is the edge device of the user network and has an interface directly connected to the PE device. The CE device can be a router or switch, or a host. The CE device does not "perceive" the existence of the VPN, and does not need to support Multiprotocol Label Switching (MPLS).

The PE device is the edge device of the service provider's network, usually a router. It is directly connected to the user's CE device, and all processing of the VPN takes place on the PE. After the CE establishes an adjacency relationship with the directly connected PE, the CE advertises the VPN route of this node to the PE, and learns the route of the remote VPN from the PE. BGP or Interior Gateway Protocol (Interior Gateway Protocol, IGP) is used to exchange routing information between CE and PE, and static routes can also be used. After the PE learns the CE's VPN routing information from the CE, it exchanges VPN routing information with other PEs through BGP. The PE router maintains the VPN routing information directly connected to it and the VPN routing information advertised by the remote PE, but does not maintain service provision. All VPN routing information in the commercial network.

It should be understood that FIG. 1 only exemplarily shows 5 PE devices, 2 VPNs, 5 P devices, 6 CE devices and 6 VPN sites, and the network may include any other number of PE devices, VPNs, The P device, the CE device, and the VPN site are not limited in this embodiment of the present application.

A method 200 for forwarding a packet in an L3VPN provided by an embodiment of the present application will be described in detail below with reference to FIG. 2( a ). The method 200 can be applied to the network 100 shown in FIG. 1 . However, the embodiments of the present application are not limited thereto. As shown in Figure 2(a), the method 200 includes:

S201. The control and management device generates a first configuration message.

Specifically, the L3VPN includes a first network device, a second network device, and a third network device, and a first L3VPN tunnel is established between the first network device and the second network device, and the second network device and the second network device establish a first L3VPN tunnel. A second L3VPN tunnel is established between the third network devices. The control and management device generates a first configuration message, where the first configuration message carries the first policy route. The first configuration message is used to configure the first policy route in the first VPN instance bound to the first interface of the first network device. When the first network device receives the packet from the first interface, it forwards the packet according to the instruction of the first policy route. Hereinafter, the first VPN instance will be referred to as VRF1. The first policy route is used to instruct the first network device to send a packet received from the first interface that matches the first policy route to the second network device. The first network device sends the packet to the second network device through the first L3VPN tunnel. The second network device stores a forwarding entry that reaches the destination address of the packet, and the second network device forwards the packet to the third network device according to an indication of the forwarding entry. The second network device forwards the packet to the third network device through the second L3VPN tunnel.

In a specific implementation manner, with reference to FIG. 1 , the first network device may be, for example, PE1 shown in FIG. 1 . In another specific implementation manner, with reference to FIG. 1 , the first network device may be, for example, PE4 shown in FIG. 1 . A first interface of the first network device, such as interface 1, is bound to a VRF1, and the network device configures the first policy route in the VRF1. For example, the first policy route may be: for a packet whose destination address is 1.1.1.2, it is sent from the second interface, for example, interface 2, to the second network device. The second network device may be, for example, PE2 shown in FIG. 1 . Optionally, the bandwidth that can be occupied during communication between the first network device and the second network device may also be configured in the first policy route. Those skilled in the art can understand that the first policy routing can be specifically configured according to the actual needs of the user, which is not specifically limited in this application.

In a specific implementation manner, the control and management device may be a software-defined networking (Software-Defined Networking, SDN) controller. The controller may also be referred to as a control device, a control system, a control node, and the like. Optionally, the controller may specifically be a Smart Network Controller (Smart Network Controller, SNC). In another specific embodiment, the control and management device may be a network management device. However, the embodiments of the present application are not limited thereto. With reference to Figure 1, for the requirement of a tenant to communicate across multiple L3VPN tunnels, for example, if host A wants to access host B, multiple L3VPN tunnels need to be spliced to achieve its access requirement. The first policy route is configured on the first network device through the controller or the network management device, and the first network device is instructed to forward the packet to the second network device.

It should be understood that, in this embodiment of the present application, the controller and the first network device may use a southbound interface protocol, for example, an OpenFlow protocol, a BGP protocol, or a Path Computation Element Communication Protocol (PCEP). ) to send the configuration message to configure the first policy route, but the application is not limited to this.

Further, in this embodiment of the present application, the network management and the first network device may send the information based on a Simple Network Management Protocol (Simple Network Management Protocol, SNMP) or a Network Configuration Protocol (Network Configuration Protocol, NETCONF). configuration message to configure the first policy route, but the application is not limited to this.

S202. The control and management device sends the first configuration message to the first network device.

S203. The first network device receives the first configuration message.

S204. The first network device acquires the first policy route according to the first configuration message.

The first network device acquires the first policy route according to the first configuration message, saves the first policy route in the policy routing table of VRF1, and instructs packet forwarding. The format of the policy routing table may be as shown in Table 1, for example.

routing prefix protocol Outgoing interface Next hop 192.168.2.0/24 Direct GE0/0/3 192.168.2.254 1.1.1.2/24 Direct GE0/0/4 192.168.200.1

It should be understood that, with reference to FIG. 1, when host A wants to access host B, the controller or network management can configure the first policy route only on PE1. At this time, PE1 corresponds to the above-mentioned first network device. A policy route directs the packet to be forwarded to PE2 via PE1. PE2 has a route to reach host B. Therefore, after receiving the packet sent by PE1, PE2 determines to forward the packet to PE3 by querying the pre-stored forwarding entry in the VPN instance, so as to complete the connection between host A and host B. B's visit. Optionally, the controller or network management can also configure the first policy route on the PE4, and configure the second policy route on the PE1, and the second policy route is used to indicate the destination of the arriving packet. The next hop of the destination address is PE4. At this time, PE4 corresponds to the above-mentioned first network device. When PE1 receives the packet sent by CE1, it forwards the packet to PE4 according to the second policy route. After receiving the packet sent by PE1, PE4 forwards the packet to PE2 according to the instruction of the first policy route, and finally forwards the packet to PE3 via PE2, so as to complete the access of host A to host B.

In this embodiment of the present application, the first network device and the second network device communicate through the first L3VPN tunnel, the second network device and the third network device communicate through the second L3VPN tunnel, and the In the case where there is no directly connected L3VPN tunnel between the first network device and the third network device. By controlling the management device to configure policy routing in the VPN instance of the first network device, and guiding packets to communicate through the spliced first L3VPN tunnel and the second L3VPN tunnel, the tenant's access control to the network is implemented. Tenants can also optimize network bandwidth and set personalized service chains according to their needs. Tenants can communicate with each other between sites in the VPN. The service networking in the VPN can be topologically based on user needs, making the networking more flexible.

Optionally, the L3VPN may further include a fourth network device. A third L3VPN tunnel is established between the fourth network device and the first network device. In a specific implementation manner, referring to FIG. 1 , the first network device is PE4, the second network device is PE2, the third network device is PE3, and the fourth network device is PE1. As shown in FIG. 2(b), the method 200 may further include S205-S208.

S205. The control and management device generates a second configuration message.

Specifically, the control and management device generates the second configuration message, and the first configuration message carries the second policy route. The first configuration message is used to configure the second policy route in the second VPN instance bound to the second interface of the fourth network device. When receiving the packet from the second interface, the fourth network device forwards the packet according to the instruction of the second policy route. The second policy route is used to instruct the fourth network device to send the packet received from the second interface that matches the second policy route to the first network device. The fourth network device sends the packet to the first network device through the third L3VPN tunnel.

S206. The control and management device sends the second configuration message to the fourth network device.

S207. The fourth network device receives the second configuration message.

S208. The fourth network device acquires the second policy route according to the second configuration message.

The specific implementation manner of S205-S208 is similar to that of S201-S204, and details are not repeated here. This application does not specifically limit the execution order of S205-S208 and S201-S204, that is, S205-S208 may be executed before S201-S204, or may be executed after S201-S204.

A method 300 for forwarding packets in an L3VPN provided by an embodiment of the present application will be described in detail below with reference to FIG. 3 . The L3VPN includes a first network device, a second network device, and a third network device, and the first network device is connected to the A first L3VPN tunnel is established between the second network devices, and a second L3VPN tunnel is established between the second network device and the third network device. This method can be used in the network 100 shown in FIG. 1 , but the embodiment is not limited thereto. As shown in FIG. 3 , the method includes: S301-S303.

S301. A first network device receives a packet.

In a specific implementation manner, the first network device is a PE device, and receives the packet sent by the first CE device. The first CE device is directly connected to the first network device. With reference to FIG. 1 , the first PE device may specifically be PE1, and the first CE device may specifically be CE1.

In another specific implementation manner, the first network device receives the packet sent by the fourth network device. The fourth network device is configured with a second policy route, and the second policy route is used to indicate that the next hop to the destination address of the packet is the first network device. A third L3VPN tunnel is established between the fourth network device and the first network device, and the third L3VPN tunnel is used for the fourth network device to send the message to the first network device. With reference to FIG. 1 , the fourth network device may specifically be PE1, and the first network device may specifically be PE4.

S302. The first network device searches for a first policy route matching the packet according to the ingress interface that receives the packet and the destination address of the packet.

Specifically, the ingress interface on which the first network device receives the packet, such as interface 1, is bound to a first VPN instance, VRF1 for short, and the first policy route is configured in VRF1. For example, the first policy route may be: for a packet whose destination address is 1.1.1.2, it is sent from the second interface, for example, interface 2, to the second network device. After receiving the packet, the first network device searches the VRF1 for a first policy route matching the packet according to the destination address of the packet.

S303. The first network device forwards the packet to the second network device.

Specifically, the first network device determines the outbound interface for sending the packet according to the first policy route, and determines that the next hop device is the second network device. The first network device sends the packet to the second network device through the first L3VPN tunnel. For example, when using the MPLS network to transmit the message, the first network device encapsulates the outer MPLS label and the inner VPN label for the message, and the MPLS network uses the outer label of the message to pass the first L3VPN tunnel, and send the packet to the second network device. When receiving the packet sent by the first network device, the second network device searches for a forwarding entry according to the destination IP address of the packet, and forwards the packet to the third network device. The second network device sends the packet to the third network device through the second L3VPN tunnel. After receiving the packet sent by the second network device, the third network device sends the packet to the second CE device directly connected to the third network device. After receiving the packet, the second CE device sends the packet to the destination according to a normal IP packet forwarding process. With reference to FIG. 1 , the second network device may specifically be PE2 shown in FIG. 1 , the third network device may specifically be PE3 shown in FIG. 1 , and the second CE device may specifically be the PE2 shown in FIG. 1 . CE3.

According to the above-mentioned method provided by the embodiment of the present application, by configuring the first policy route in the VRF of the first network device, and guiding the packet to communicate through the spliced first L3VPN tunnel and second L3VPN tunnel, the implementation of Tenant access control to the network. Tenants can communicate with each other between sites in the VPN. The service networking within the VPN can be topologically based on user needs, rather than being limited to the traditional full mesh or hub-spoke hub-spoke networking. Therefore, the networking method is more flexible.

FIG. 4 is a schematic diagram of a control and management device for forwarding packets in an L3VPN according to an embodiment of the present application. The L3VPN includes a first network device, a second network device and a third network device, a first L3VPN tunnel is established between the first network device and the second network device, the second network device and the third network device A second L3VPN tunnel is established between them. The apparatus may be used to perform the method 200 shown in FIG. 2 . As shown in FIG. 4 , the device includes: a processing module 401 and a sending module 402 .

The processing module 401 is configured to generate a first configuration message, where the first configuration message is used to configure the first policy route in the VPN instance bound to the first interface of the first network device, the first configuration message The policy route is used to indicate that the next hop to the destination address of the packet is the second network device.

The sending module 402 is configured to send the first configuration message to the first network device.

The first L3VPN tunnel is used by the first network device to send the message to the second network device, and the second network device stores a forwarding entry that reaches the destination address of the message, and the second network device stores a forwarding entry to the destination address of the message. The forwarding table entry is used to instruct the second network device to forward the packet to the third network device, and the second L3VPN tunnel is used for the second network device to send the packet to the third network device arts.

According to the above-mentioned control and management device provided by the embodiment of the present application, by configuring the first policy route in the VRF of the first network device, the guide packet is communicated through the spliced first L3VPN tunnel and the second L3VPN tunnel, Implemented tenant access control to the network. Tenants can communicate with each other between sites in the VPN. The service networking within the VPN can be topologically based on user requirements, rather than being limited to traditional full mesh or hub-spoke networking. Therefore, the networking method is more flexible.

In this embodiment of the present application, the first network device and the second network device communicate through the first L3VPN tunnel, the second network device and the third network device communicate through the second L3VPN tunnel, and the In the case where there is no directly connected L3VPN tunnel between the first network device and the third network device. By controlling the management device to configure policy routing in the VPN instance of the first network device, and guiding packets to communicate through the spliced first L3VPN tunnel and the second L3VPN tunnel, the tenant's access control to the network is implemented. Tenants can also optimize network bandwidth and set personalized service chains according to their needs. Tenants can communicate with each other between sites in the VPN. The service networking in the VPN can be topologically based on user needs, making the networking more flexible.

Optionally, the L3VPN further includes a fourth network device, and a third L3VPN tunnel is established between the fourth network device and the first network device. The processing module 401 is further configured to generate a second configuration message, where the second configuration message is used to configure a second policy route in the second VPN instance bound to the second interface of the fourth network device. The second policy route is used to indicate that the next hop to the destination address of the packet is the first network device. The fourth network device receives the packet through the second interface, and searches for the second policy route matching the packet in the second VPN instance according to the destination address of the packet. According to the indication of the second policy route, the fourth network device sends the packet to the first network device through the third L3VPN tunnel.

FIG. 5 is a schematic diagram of an apparatus 500 for forwarding a packet according to another embodiment of the present application. The apparatus 500 is applied in an L3VPN, where the L3VPN includes a first network device, a second network device and a third network device. A first L3VPN tunnel is established between the first network device and the second network device, and a second L3VPN tunnel is established between the second network device and the third network device. The apparatus 500 is located in the first network device. The first network device may be, for example, the device PE1 or PE4 shown in FIG. 1 , and the apparatus 500 may be used to execute the method 300 shown in FIG. 3 . The apparatus 500 includes: a receiving module 501 , a processing module 502 and a sending module 503 .

The receiving module 501 is used for receiving messages. The processing module 502 is configured to search for a first policy route that matches the message in the VPN instance bound to the inbound interface according to the inbound interface that receives the message and the destination address of the message . The first policy route is used to indicate that the next hop to the destination address of the packet is the second network device. The sending module 503 is configured to send the packet to the second network device through the first L3VPN tunnel. In a specific implementation manner, the receiving module 501 is specifically configured to receive the message sent by the first CE device. That is, the first network device is the first PE device directly connected to the CE device. In another specific implementation manner, the L3VPN further includes a fourth network device, and the receiving module is configured to receive the message sent by the fourth network device, wherein the fourth network device is configured with a second policy route, where the second policy route is used to indicate that the next hop to the destination address of the packet is the first network device, and the fourth network device and the first network device establish a relationship There is a third L3VPN tunnel, and the third L3VPN tunnel is used by the fourth network device to send the packet to the first network device. Specifically, in this embodiment of the present application, the first network device may be a first PE device directly connected to the first CE device, and the second network device may be a second PE device directly connected to the second CE device device, the third network device may be a third PE device directly connected to the third CE device, and the fourth network device may be a fourth PE device directly connected to the fourth CE device. The first to fourth CE devices are respectively located in 4 different VPN sites, but belong to the same VPN.

FIG. 6 is a schematic diagram of an apparatus 600 for forwarding a packet according to an embodiment of the present application. The device 600 is used in L3VPN. The apparatus 600 can be used to perform the method 200 shown in FIG. 2 . As shown in FIG. 6 , the apparatus 600 includes: an input interface 601 , an output interface 602 , a processor 603 and a memory 604 . The input interface 601 , the output interface 602 , the processor 603 and the memory 604 can be connected through a bus system 605 .

The memory 604 is used to store programs, instructions or codes. The processor 603 is configured to execute programs, instructions or codes in the memory 604 to control the input interface 601 to receive signals, and control the output interface 602 to send signals to complete the relevant operations in the method 200 .

FIG. 7 is a schematic diagram of an apparatus 700 for forwarding a packet according to an embodiment of the present application. The device 700 is used in L3VPN. The L3VPN includes a first network device, a second network device and a third network device. A first L3VPN tunnel is established between the first network device and the second network device, and a second L3VPN tunnel is established between the second network device and the third network device. The apparatus 700 is located in the first network device. The first network device may be, for example, PE1 or PE4 shown in FIG. 1 , and the apparatus 700 may be used to execute the method 200 shown in FIG. 2 and the method 300 shown in FIG. 3 . The apparatus 700 includes: an input interface 701 , an output interface 702 , a processor 703 and a memory 704 . The input interface 701 , the output interface 702 , the processor 703 and the memory 704 can be connected through a bus system 705 .

The memory 704 is used to store programs, instructions or codes. The processor 703 is configured to execute programs, instructions or codes in the memory 704 to control the input interface 701 to receive signals, control the output interface 702 to send signals, and complete the related operations in the method 200 and the method 300 .

It should be understood that, in this embodiment of the present application, the above-mentioned processor 603 and processor 703 may be a central processing unit (Central Processing Unit, referred to as “CPU” for short), and may also be other general-purpose processors, digital signal processors (DSPs) , Application Specific Integrated Circuits (ASICs), Off-the-Shelf Programmable Gate Arrays (FPGAs) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general purpose processor may be a microprocessor or the processor may be any conventional processor or the like.

Memory 604 and memory 704 may include read-only memory and random access memory, and provide instructions and data, respectively, to their respective processors. A portion of the memory may also include non-volatile random access memory. For example, the memory may also store device type information.

In addition to the data bus, the bus system 605 and the bus system 705 may also include a power bus, a control bus, a status signal bus, and the like. However, for the sake of clarity, the various buses are labeled as bus systems in the figure.

In the implementation process, each step of the methods 200 and 300 can be completed by the hardware integrated logic circuit in the processor 603 and the processor 703 or the instructions in the form of software. The steps of the positioning method disclosed in conjunction with the embodiments of the present application may be directly embodied as executed by a hardware processor, or executed by a combination of hardware and software modules in the processor. The software modules may be located in random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory, registers and other storage media mature in the art. The storage medium is located in each of the above-mentioned memories, and each of the above-mentioned processors reads the information in the corresponding memories, and completes the steps of the above-mentioned methods 200 and 300 in combination with its hardware. To avoid repetition, detailed description is omitted here.

It should be noted that the apparatuses provided in FIGS. 4-7 are applied to the network 100 shown in FIG. 1 to implement a method for forwarding packets. In a specific implementation manner, the processing module 401 in FIG. 4 may be implemented by the processor 603 in FIG. 6 , and the sending module 402 may be implemented by the output interface 602 in FIG. 6 . The processing module 502 in FIG. 5 can be implemented by the processor 703 in FIG. 7 , the sending module 503 can be implemented by the output interface 702 in FIG. 7 , and the receiving module 501 can be implemented by the input interface 701 in FIG. 7 .

The present application also provides a communication system, including a control and management device for configuring a policy route to a PE device, and a PE device. The control management device may be the device provided by the embodiments corresponding to FIG. 4 and FIG. 6 . The PE device may be the apparatus provided by the embodiments corresponding to FIG. 5 and FIG. 7 . The communication system is used to execute the method 200 and the method 300 of the embodiments corresponding to FIGS. 2-3 .

It should be understood that, in various embodiments of the present application, the size of the sequence numbers of each process does not imply the sequence of execution, and the execution sequence of each process should be determined by its function and internal logic, and should not be used in the embodiments of the present application. Implementation constitutes any limitation.

Those of ordinary skill in the art can realize that the modules and method steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Skilled artisans may implement the described functionality using different methods for each particular application, but such implementations should not be considered beyond the scope of this application.

Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the system, device and module described above can refer to the corresponding process in the foregoing method embodiments, which is not repeated here.

Those skilled in the art should appreciate that, in one or more of the above examples, the functions described in this application may be implemented in hardware, software, or any combination thereof. If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be embodied in the form of a software product in essence, or the part that contributes to the prior art or the part of the technical solution, and the computer software product is stored in a storage medium, including Several instructions are used to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, Read-Only Memory (ROM, Read-Only Memory), Random Access Memory (RAM, Random Access Memory), magnetic disk or optical disk and other media that can store program codes .

Each part of this specification is described in a progressive manner, and the same and similar parts between the various embodiments may be referred to each other, and each embodiment focuses on the points that are different from other embodiments. In particular, as for the apparatus and system embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and for related parts, please refer to the descriptions in the method embodiments.

Finally, it should be noted that the above descriptions are only preferred embodiments of the technical solutions of the present application, and are not intended to limit the protection scope of the present application. Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the scope of the present application. If these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalent technologies, any modifications, equivalent replacements, improvements, etc. made should be included within the protection scope of the present application.

Claims (10)

1. A method for forwarding a packet in a three-layer virtual private network (L3 VPN), wherein the L3VPN comprises a first network device, a second network device and a third network device, a first L3VPN tunnel is established between the first network device and the second network device, and a second L3VPN tunnel is established between the second network device and the third network device, the method comprising:

the first network equipment acquires a first policy route from control management equipment;

the first network device configures the first policy route in a first VPN instance bound to a first interface, where the first policy route is used to instruct the first network device to send a message, which is received from the first interface and matches the first policy route, to the second network device;

the first network device receives a message from the first interface, and searches the first policy route matched with the message in the first VPN instance according to the destination address of the message, wherein the first policy route is used for indicating that the next hop reaching the destination address of the message is the second network device;

the first network equipment sends the message to the second network equipment through the first L3VPN tunnel; wherein,

the second network device stores a forwarding table entry reaching a destination address of the packet, where the forwarding table entry is used to instruct the second network device to forward the packet to the third network device, and the second L3VPN tunnel is used for the second network device to send the packet to the third network device.

2. The method according to claim 1, wherein the first network device is an operator edge PE device, and the receiving, by the first network device, the packet specifically includes:

and the PE equipment receives the message sent by the CE equipment at the edge of the user.

3. The method according to claim 1, wherein the receiving, by the first network device, the packet specifically includes:

the first network device receives the message sent by a fourth network device, the fourth network device is configured with a second policy route, the second policy route is used for indicating that a next hop reaching a destination address of the message is the first network device, a third L3VPN tunnel is established between the fourth network device and the first network device, and the third L3VPN tunnel is used for the fourth network device to send the message to the first network device.

4. An apparatus for forwarding a packet, the apparatus being applied to a L3VPN, the L3VPN comprising a first network device, a second network device and a third network device, a first L3VPN tunnel being established between the first network device and the second network device, a second L3VPN tunnel being established between the second network device and the third network device, the apparatus being located in the first network device, the apparatus comprising a receiving module, a processing module and a sending module, wherein,

the processing module is configured to obtain a first policy route from a control management device, and configure the first policy route in a first VPN instance bound to a first interface, where the first policy route is used to instruct the first network device to send a message, which is received from the first interface and matches the first policy route, to the second network device;

the receiving module is used for receiving a message from the first interface;

the processing module is further configured to search, in a first VPN instance, the first policy route matched with the packet according to the destination address of the packet, where the first policy route is used to indicate that a next hop reaching the destination address of the packet is the second network device;

the sending module is configured to send the packet to the second network device through the first L3VPN tunnel; wherein,

the second network device stores a forwarding table entry reaching a destination address of the packet, where the forwarding table entry is used to instruct the second network device to forward the packet to the third network device, and the second L3VPN tunnel is used for the second network device to send the packet to the third network device.

5. The apparatus of claim 4, wherein: the first network device is an operator edge PE device, and the receiving module is specifically configured to receive the packet sent by the user edge CE device.

6. The apparatus according to claim 4, wherein the L3VPN further comprises a fourth network device, and the receiving module is configured to receive the packet sent by the fourth network device, wherein the fourth network device is configured with a second policy route, the second policy route is used to indicate that a next hop to reach a destination address of the packet is the first network device, a third L3VPN tunnel is established between the fourth network device and the first network device, and the third L3VPN tunnel is used for the fourth network device to send the packet to the first network device.

7. A communication system for forwarding message, which is applied in a three-layer virtual private network (L3 VPN), comprises a control management device, a first network device, a second network device and a third network device, wherein a first L3VPN tunnel is established between the first network device and the second network device, a second L3VPN tunnel is established between the second network device and the third network device, wherein,

the control management device is configured to send a first configuration message to the first network device, where the first configuration message carries a first policy route, and the first configuration message is used to configure the first policy route in a first VPN instance bound to a first interface of the first network device;

the first network device is configured to receive a packet from the first interface, and search, in the first VPN instance, the first policy route matched with the packet according to a destination address of the packet, where the first policy route is used to indicate that a next hop reaching the destination address of the packet is the second network device;

the first network device is further configured to send the packet to the second network device through the first L3VPN tunnel according to the indication of the first policy routing; wherein,

the second network device stores a forwarding table entry reaching a destination address of the packet, where the forwarding table entry is used to instruct the second network device to forward the packet to the third network device, and the second L3VPN tunnel is used for the second network device to send the packet to the third network device.

8. The communication system according to claim 7, wherein the first network device is an operator edge PE device, and the first network device is specifically configured to receive the packet sent by a customer edge CE device.

9. The communication system of claim 7, further comprising a fourth network device that establishes a third L3VPN tunnel with the first network device, wherein,

the control management device is further configured to send a second configuration message to the fourth network device, where the second configuration message carries a second policy route, and the second configuration message is used to bind the second policy route in a second VPN instance bound to a second interface of the fourth network device;

the fourth network device is configured to receive the packet from the second interface, and search, in the second VPN instance, the second policy route matched with the packet according to a destination address of the packet, where the second policy route is used to indicate that a next hop reaching the destination address of the packet is the first network device;

the fourth network device is further configured to forward the packet to the first network device through the third L3VPN tunnel according to the indication of the second policy routing;

the first network device is specifically configured to receive the packet forwarded by the fourth network device.

10. A computer-readable storage medium comprising a computer program which, when run in a computer, causes the computer to perform the method of any one of claims 1-3.

Images