CN111277481A - Method, device, equipment and storage medium for establishing VPN tunnel - Google Patents

Abstract

The invention discloses a method, device, equipment and storage medium for establishing a VPN tunnel. The method includes: receiving a connection establishment request message sent by a CPE; wherein the CPE is located in a branch node of SD-WAN, and the The connection establishment request message includes: the identification information of the CPE; network configuration is performed to determine the identification information of the connection establishment object corresponding to the identification information of the CPE; wherein, the connection establishment object is located in SD The vCPE in the cloud service node of the WAN, and the cloud service node also includes a first NAT device, the vCPE is connected to the control platform through the first NAT device; The first external network IP address information corresponding to the identification information is sent to the CPE, so that the CPE can use the first external network IP address information and establish a virtual private network with the vCPE through the first NAT device Network VPN tunnel.

Description

A method, apparatus, device and storage medium for establishing a VPN tunnel

technical field

The present invention relates to the field of Internet technologies, and in particular, to a method, apparatus, device and storage medium for establishing a VPN tunnel.

Background technique

SD-WAN (Software-Defined WAN, Software Defined Wide Area Network) is a service formed by applying SDN (Software Defined Network, Software Defined Network) technology to WAN scenarios; SD-WAN can replace traditional WAN lines (MPLS-VPN, IPSec-VPN, etc.), connect enterprise networks, data centers, Internet applications and cloud services within a wide geographical range, which can help users reduce WAN expenses and improve network connection flexibility; SD-WAN can currently be divided into four technical architectures: Overlay architecture, cloud architecture, integrated architecture and native architecture. Among them, cloud architecture is the favorite architecture method of cloud providers and service providers, and it is also the recommended architecture for large-scale branch deployment of SD-WAN. In the cloud architecture, vCPE (virtual Customer Premise Equipment, virtual customer terminal equipment) is deployed in the cloud service node of SD-WAN, and the vCPE needs to access the Internet through NAT (Network Address Translation, network address translation). Since the vCPE is located behind the NAT device of the cloud service node, the CPE (Customer Premise Equipment) in the SD-WAN branch node cannot directly communicate with the vCPE, and the messages sent by the CPE to the vCPE will be discarded by the NAT device; therefore, How to solve the problem of directly establishing a VPN (Virtual Private Network, virtual private network) tunnel between the CPE and the vCPE has become a technical problem that those skilled in the art need to solve urgently.

SUMMARY OF THE INVENTION

The purpose of the present invention is to provide a method, apparatus, device and storage medium for establishing a VPN tunnel, which can realize the direct establishment of a VPN tunnel between a CPE and a vCPE.

According to one aspect of the present invention, a method for establishing a VPN tunnel is provided, which is applied to a control platform of SD-WAN, and the method includes:

Receive a connection establishment request message sent by the client terminal equipment CPE; wherein, the CPE is located in a branch node of SD-WAN, and the connection establishment request message includes: the identification information of the CPE;

Carry out networking configuration to determine the identification information of the connection establishment object corresponding to the identification information of the CPE; wherein, the connection establishment object is the virtual client device vCPE located in the cloud service node of SD-WAN, And the cloud service node further includes a first network address interaction NAT device, and the vCPE connects to the control platform through the first NAT device;

Sending the first external network IP address information corresponding to the identification information of the connection establishment object to the CPE, so that the CPE uses the first external network IP address information and establishes through the first NAT device A virtual private network VPN tunnel with the vCPE.

Optionally, before the step of receiving the connection establishment request message sent by the client terminal equipment CPE, the method further includes:

receiving a configuration parameter message forwarded by the first NAT device; wherein the configuration parameter message is sent by the vCPE to the first NAT device;

Parse out the identity information and external network IP address information of the vCPE from the configuration parameter message;

A corresponding relationship between the identity identification information and the external network IP address information is established.

Optionally, when a VPN tunnel is established between the CPE and the vCPE, the method further includes:

receiving a probe message forwarded by the first NAT device; wherein the probe message is a message sent by the vCPE to the first NAT device;

Parse out the second external network IP address information from the detection message;

Determine whether the first external network IP address information is consistent with the second external network IP address information;

If not, sending the second external network IP address information to the CPE, so that the CPE can use the second external network IP address information and re-establish a relationship with the vCPE through the first NAT device VPN tunnel between them.

Optionally, the method further includes:

Parse out the third external network IP address information of the CPE from the connection establishment request message;

Send the third external network IP address information to the vCPE through the first NAT device, so that the vCPE uses the third external network IP address information and establishes a connection with the vCPE through the first NAT device. VPN tunnel between CPEs.

Optionally, the step of receiving the connection establishment request message sent by the client terminal equipment CPE specifically includes:

Receive a connection establishment request message forwarded by a second NAT device; wherein, the connection establishment request message is a message sent by the CPE to the second NAT device, and the second NAT device is located in the branch node .

Optionally, the step of sending the first external network IP address information to the CPE specifically includes:

Sending the first external network IP address information to the CPE through the second NAT device.

In order to achieve the above object, the present invention also provides a device for establishing a VPN tunnel, which is applied to a control platform of SD-WAN, and the device includes:

A receiving module, configured to receive a connection establishment request message sent by the client terminal equipment CPE; wherein, the CPE is located in a branch node of the SD-WAN, and the connection establishment request message includes: the identity information of the CPE;

A configuration module, configured to perform networking configuration to determine the identification information of the connection establishment object corresponding to the identification information of the CPE; wherein, the connection establishment object is a virtual device located in the cloud service node of SD-WAN a client device vCPE, and the cloud service node further includes a first network address interaction NAT device, the vCPE is connected to the control platform through the first NAT device;

A sending module, configured to send the first external network IP address information corresponding to the identification information of the connection establishment object to the CPE, so that the CPE can use the first external network IP address information and pass the The first NAT device establishes a virtual private network VPN tunnel with the vCPE.

Optionally, the receiving module is further configured to:

receiving a configuration parameter message forwarded by the first NAT device; wherein the configuration parameter message is a message sent by the vCPE to the first NAT device;

The configuration module is also used for:

Parse out the identity information and external network IP address information of the vCPE from the configuration parameter message;

The sending module is further configured to establish a corresponding relationship between the identification information and the external network IP address information.

In order to achieve the above object, the present invention also provides a computer device, the computer device specifically includes: a memory, a processor, and a computer program stored in the memory and running on the processor, and the processor executes the computer program. When the computer program is described, the steps of the method for establishing a VPN tunnel described above are realized.

In order to achieve the above object, the present invention also provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, implements the steps of the above-described method for establishing a VPN tunnel.

In the method, device, device and storage medium for establishing a VPN tunnel provided by the present invention, through the control platform as a transit server, both the CPE and the vCPE initiate a connection to the control platform, so that the control platform obtains the external network IP address information of the CPE and the vCPE, so that the The control platform performs networking configuration, and sends the tunnel configuration file containing the external network IP address information of the peer end to the CPE and vCPE, so that the CPE and vCPE have the external network IP address information of the peer end, and can send tunnel negotiation packets. Thereby, a VPN tunnel is established between the CPE and the vCPE.

Description of drawings

Various other advantages and benefits will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiments. The drawings are for the purpose of illustrating preferred embodiments only and are not to be considered limiting of the invention. Also, the same components are denoted by the same reference numerals throughout the drawings. In the attached image:

1 is a schematic diagram of the composition and structure of the SD-WAN framework provided by Embodiment 1;

2 is an optional schematic flowchart of the method for establishing a VPN tunnel provided by Embodiment 1;

3 is an optional schematic flowchart of the method for establishing a VPN tunnel provided by Embodiment 2;

4 is a schematic diagram of an optional composition structure of an apparatus for establishing a VPN tunnel provided by Embodiment 3;

FIG. 5 is a schematic diagram of an optional hardware architecture of the computer device provided in the fourth embodiment.

Detailed ways

In order to make the objectives, technical solutions and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention, but not to limit the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

The method, apparatus, device and storage medium for establishing a VPN tunnel provided by the present invention are described below with reference to the accompanying drawings.

Example 1

An embodiment of the present invention provides a method for establishing a VPN tunnel, and the method is specifically applied to a control platform in an SD-WAN framework as shown in FIG. 1 , wherein the SD-WAN framework includes: a control platform, a multi- a cloud service node and a plurality of branch nodes, each cloud service node is provided with a NAT device and a vCPE, and each branch node is provided with a CPE; An optional schematic flow chart of the method, as shown in Figure 2, the method specifically includes the following steps:

Step S201: Receive a connection establishment request message sent by the client terminal equipment CPE; wherein the CPE is located in a branch node of the SD-WAN, and the connection establishment request message includes: the identity information of the CPE.

Specifically, if the second NAT device is not set in the branch node, that is, the CPE is in an external network environment, the CPE directly sends a connection establishment request message to the control platform;

If a second NAT device is set in the branch node, that is, the CPE is in an intranet environment, and the CPE needs to connect to the Internet through the second NAT device, step S201 specifically includes:

Receive a connection establishment request message forwarded by a second NAT device; wherein, the connection establishment request message is a message sent by the CPE to the second NAT device, and the second NAT device is located in the branch node , the CPE is connected to the control platform through the second NAT device.

The connection establishment request message is used for requesting establishment of a VPN tunnel with the vCPE.

In this embodiment, regardless of whether the CPE is in an internal network environment or an external network environment, a VPN tunnel can be established with the vCPE located behind the NAT device in the cloud service node through the management and control platform.

Step S202: Perform networking configuration to determine the identity identification information of the connection establishment object corresponding to the identity identification information of the CPE; wherein the connection establishment object is a virtual client located in a cloud service node of SD-WAN A device vCPE, and the cloud service node further includes a first network address interaction NAT device, and the vCPE is connected to the control platform through the first NAT device.

Specifically, before step S202, the method further includes:

Step A1: Receive a configuration parameter message forwarded by the first NAT device; wherein, the configuration parameter message is a message sent by the vCPE to the first NAT device;

In this embodiment, since a first NAT device is set in the cloud service node, the vCPE is in an intranet environment. When the vCPE needs to connect to the Internet, it needs to pass through the first NAT device according to the settings. The session table entry in the first NAT device converts the internal network IP address information and the internal network port information of the vCPE into external network IP address information and external network port information.

Step A2: parse out the identity information and external network IP address information of the vCPE from the configuration parameter message;

Further, step A2 includes:

Obtain the identity information of the vCPE contained in the configuration parameter message, and obtain the external network IP address information of the vCPE by obtaining the source IP address information of the configuration parameter message.

Step A3: Establish a corresponding relationship between the identity identification information and the external network IP address information.

In this embodiment, the identity information and external network IP address information of vCPEs in each cloud service node in the SD-WAN framework can be obtained in advance through the management and control platform, and the identity information and external network IP address information of each vCPE can be stored separately. information, so that when the CPE needs to establish a connection with any vCPE in the later stage, the management and control platform feeds back the external network IP address information of the corresponding vCPE to the CPE. It should also be noted that, when implementing the step of performing networking configuration to determine the identity identification information of the connection establishment object corresponding to the identity identification information of the CPE, it is possible to determine the connection with the CPE through a preset configuration table. The identification information of the connection establishment object corresponding to the identification information, or the identification information of the connection establishment object is added to the connection establishment request message, or the network configuration is manually performed by the administrator on the control platform.

It should also be noted that this embodiment is applied to an asymmetric NAT (also referred to as ConeNAT) scenario, wherein ConeNAT is further subdivided into three types, namely, Full Cone type, Restricted Cone type, and Restricted Port Cone. Preferably, the NAT in this embodiment is specifically FullConeNAT (full cone NAT).

Step S203: Send the first external network IP address information corresponding to the identification information of the connection establishment object to the CPE, so that the CPE can use the first external network IP address information and pass the first external network IP address information. The NAT device establishes a virtual private network VPN tunnel with the vCPE.

Since there are multiple cloud service nodes in the SD-WAN framework, the vCPE in each cloud service node will send a configuration parameter message to the control platform, so the control platform stores the identification information of multiple vCPEs and the corresponding external Therefore, in step S203, it is necessary to determine the first external network IP address information corresponding to the identification information of the connection establishment object, and send the first external network IP address information to the described CPE.

Specifically, if the second NAT device is not set in the branch node, that is, the CPE is in an external network environment, the control platform directly sends the first external network IP address information to the CPE;

If a second NAT device is set in the branch node, that is, the CPE is in an intranet environment, and the CPE needs to connect to the Internet through the second NAT device, step S203 specifically includes:

Sending the first external network IP address information to the CPE through the second NAT device.

It should also be noted that, while sending the first external network IP address information to the CPE, the control platform also sends other tunnel configuration information for establishing a VPN tunnel to the CPE.

In this embodiment, since a NAT device is set in the cloud service node, the vCPE needs to connect to the Internet through the NAT device, so the vCPE is in the internal network environment, and the external network IP address and external network port information of the vCPE are all provided by the NAT device. It is dynamically configured; therefore, the CPE in the branch node cannot obtain the real-time external network IP address of the vCPE, that is, the CPE cannot directly communicate with the vCPE. In order to solve the problem that the CPE cannot directly communicate with the vCPE, in this embodiment, the control platform is used as a transit server, and both the CPE and the vCPE initiate a connection to the control platform, so that the control platform can obtain the external network IP address information of the CPE and the vCPE and the external network. port information, so as to perform networking configuration on the control platform, and send the tunnel configuration file containing the external network IP address information of the vCPE to the CPE, so that the CPE has the external network IP address information of the vCPE and can send tunnel negotiation packets. , thereby establishing a VPN tunnel between the CPE and the vCPE

Further, when a VPN tunnel is established between the CPE and the vCPE, the method further includes:

Step B1: Receive a probe message forwarded by the first NAT device; wherein, the probe message is a message sent by the vCPE to the first NAT device;

In this embodiment, when a VPN tunnel is established between the CPE and the vCPE, the vCPE periodically sends a probe message to the control platform at a set time interval; wherein the probe message includes the Identity information of the vCPE.

Step B2: parse out the second external network IP address information from the detection message;

Specifically, step B2 includes:

Obtain the identification information contained in the detection message, and search for the corresponding first external network IP address information according to the identification information in the detection message;

The second external network IP address information is determined according to the source external network IP address information of the probe message; wherein, the second external network IP address information is the external network IP address currently allocated by the first NAT device for the vCPE network IP address.

In practical applications, because the address pool of the first NAT device will change, the external network address and external network port allocated by the first NAT device to the vCPE will change, thereby causing the VPN tunnel to be interrupted; therefore, in this embodiment, The vCPE periodically sends detection packets to the control platform through the first NAT device, so as to report the real-time external network IP address information of the vCPE to the control platform.

Step B3: judging whether the first external network IP address information is consistent with the second external network IP address information;

Step B4: If they are inconsistent, send the second external network IP address information to the CPE, so that the CPE can use the second external network IP address information and re-establish a connection with the CPE through the first NAT device. VPN tunnel between vCPEs.

In this embodiment, after a VPN tunnel is established between the CPE and the vCPE, the real-time external network IP address information of the vCPE is also periodically obtained through detection messages. The external network IP address information of the vCPE is sent to the CPE, so that the CPE can re-establish a VPN tunnel with the vCPE according to the changed external network IP address information of the vCPE. In the prior art, after the CPE and the vCPE establish a VPN tunnel, the first NAT device will re-allocate the external network IP address information to the vCPE, thereby causing the disconnection of the VPN tunnel. The document reports the current external network IP address information of the vCPE to the management and control platform in real time. When the management and control platform finds that the external network IP address information of the vCPE has changed, it sends the changed external network IP address information of the vCPE to the CPE, so that the CPE can reconnect with it. The vCPE establishes a tunnel connection to prevent the disconnection of the VPN tunnel.

Further, the method also includes:

Step C1: parse out the third external network IP address information of the CPE from the connection establishment request message;

Step C2: Sending the third external network IP address information to the vCPE through the first NAT device, so that the vCPE can use the third external network IP address information and establish through the first NAT device VPN tunnel with the CPE.

In this embodiment, by using the control platform as a transit server, both the CPE and the vCPE initiate a connection to the control platform, so that the control platform obtains the external network IP address information of the CPE and the vCPE, so as to perform networking configuration on the control platform, and will include The tunnel configuration file of the external network IP address information of the end is sent to the CPE and vCPE, so that the CPE and vCPE have the external network IP address information of the opposite end, and can send tunnel negotiation packets, so that a VPN tunnel can be established between the CPE and the vCPE. .

Embodiment 2

An embodiment of the present invention provides a method for establishing a VPN tunnel. The method is specifically applied to the SD-WAN framework as shown in FIG. 1 , wherein the SD-WAN framework includes: a control platform, multiple cloud services A node and a plurality of branch nodes, each cloud service node is provided with a NAT device and a vCPE, and each branch node is provided with a CPE; FIG. 3 is a method for establishing a VPN tunnel provided by Embodiment 1 of the present invention. An optional schematic flowchart, as shown in Figure 3, the method specifically includes the following steps:

Step S301: the vCPE sends a configuration parameter message to the control platform through the NAT device; wherein, the configuration parameter message includes: the identity information of the vCPE, and the vCPE and the NAT device are located in the same cloud service node of SD-WAN , the vCPE is connected to the Internet through the NAT device.

Specifically, step S301 includes:

The vCPE obtains its own intranet IP address information and intranet port information, and converts the intranet IP address information and the intranet port information into the first extranet IP address information through the session entry in the NAT device and first external network port information, so as to send the configuration parameter message to the control platform based on the first external network IP address information and the first external network port information.

Step S302: The control platform parses out the identity information of the vCPE and the first external network IP address information according to the configuration parameter message, and locally establishes the identity information of the vCPE and the first external network IP address. Correspondence of address information.

Specifically, the control platform parses out the identity information of the vCPE and the first external network IP address information according to the configuration parameter message, including:

obtain the identification information contained in the configuration parameter message;

The first external network IP address information is determined according to the source address information of the configuration parameter message.

Step S303: The CPE sends a connection establishment request message to the control platform, wherein the connection establishment request message includes: the identity information of the CPE.

Step S304: The controller parses out the second external network IP address information of the CPE according to the connection establishment request message.

Specifically, step S304 includes:

The IP address information of the second external network is determined according to the source address information of the connection establishment request message.

Step S305: The control platform performs networking configuration to determine the identity identification information of the connection establishment object corresponding to the identity identification information of the CPE.

Wherein, the connection establishment object is the vCPE located in the cloud service node of SD-WAN.

Step S306: The controller platform searches locally for the corresponding first external network IP address information according to the identification information of the connection establishment object.

Step S307: The control platform sends the first external network IP address information to the CPE, and sends the second external network IP address information to the vCPE through the NAT device.

Specifically, step S307 includes:

The control platform performs networking configuration after acquiring the external network IP address information of the CPE and the vCPE to obtain a tunnel configuration file; wherein the tunnel configuration file includes: the external network IP address information of the CPE and the external network IP of the vCPE. address information, and tunnel configuration information;

The control platform sends the tunnel configuration file to the CPE and vCPE, respectively.

Step S308: The CPE establishes a VPN tunnel with the vCPE through the NAT device according to the first external network IP address information.

Specifically, step S308 includes:

After acquiring the tunnel configuration file, the CPE acquires the first external network IP address information in the tunnel configuration file, and sends a tunnel negotiation packet including the first external network IP address information to the NAT device;

The NAT device receives the tunnel negotiation message, converts the first external network IP address information into corresponding internal network IP address information through a session table entry, and forwards it to the vCPE based on the internal network IP address information the tunnel negotiation message.

Further, the method also includes:

Step S309: After the CPE and the vCPE establish a VPN tunnel, the vCPE periodically sends a detection packet to the control platform through the NAT device according to a set time interval; wherein the detection packet includes: the identification information of the vCPE;

Step S310: the control platform parses the third external network IP address information of the vCPE according to the detection message;

The third external network IP address information is currently allocated by the NAT device for the vCPE.

Step S311: The control platform finds the corresponding first external network IP address locally according to the identification information in the detection packet, and compares the first external network IP address information with the third external network IP address. address information for comparison;

Step S312: if inconsistent, the control platform sends the third external network IP address information to the CPE;

Specifically, step S312 includes:

If not, the management and control platform locally updates the external network IP address information corresponding to the identity information of the vCPE, updates the corresponding tunnel negotiation message, and sends the updated tunnel negotiation message to the CPEs and vCPEs.

Step S313: The CPE re-establishes a VPN tunnel with the vCPE through the NAT device according to the third external network IP address information.

Embodiment 3

An embodiment of the present invention provides a device for establishing a VPN tunnel, and the device is specifically applied to a control platform in the SD-WAN framework as shown in FIG. 1; A schematic diagram of an optional composition structure of the device, as shown in Figure 4, the device specifically includes the following components:

The receiving module 401 is configured to receive a connection establishment request message sent by the client terminal equipment CPE; wherein, the CPE is located in a branch node of the SD-WAN, and the connection establishment request message includes: the identity information of the CPE;

The configuration module 402 is configured to perform networking configuration to determine the identification information of the connection establishment object corresponding to the identification information of the CPE; wherein, the connection establishment object is located in the cloud service node of SD-WAN. a virtual client device vCPE, and the cloud service node further includes a first network address interaction NAT device, the vCPE is connected to the control platform through the first NAT device;

The sending module 403 is configured to send the first external network IP address information corresponding to the identification information of the connection establishment object to the CPE, so that the CPE can use the first external network IP address information and pass the The first NAT device establishes a virtual private network VPN tunnel with the vCPE.

Specifically, the receiving module 401 is further configured to:

Before the step of receiving the connection establishment request message sent by the client terminal equipment CPE, the configuration parameter message forwarded by the first NAT device is received; wherein, the configuration parameter message is sent by the vCPE to the first NAT device. A message from a NAT device;

The configuration module 402 is also used to:

Parse out the identity information and external network IP address information of the vCPE from the configuration parameter message;

The sending module 403 is further configured to establish a corresponding relationship between the identity information and the external network IP address information.

Further, the receiving module 401 is also used for:

When a VPN tunnel is established between the CPE and the vCPE, a probe message forwarded by the first NAT device is received; wherein the probe message is a message sent by the vCPE to the first NAT device .

The configuration module 402 is also used to:

The second external network IP address information is parsed from the detection message.

The device also includes:

A judging module for judging and judging whether the first external network IP address information is consistent with the second external network IP address information; if not, sending the second external network IP address information to the CPE for for the CPE to use the second external network IP address information and re-establish a VPN tunnel with the vCPE through the first NAT device.

Further, the configuration module 402 is also used for:

The third external network IP address information of the CPE is parsed from the connection establishment request message.

The sending module 403 is also used for:

Send the third external network IP address information to the vCPE through the first NAT device, so that the vCPE uses the third external network IP address information and establishes a connection with the vCPE through the first NAT device. VPN tunnel between CPEs.

Further, when implementing the step of receiving the connection establishment request message sent by the client terminal equipment CPE, the receiving module 401 has the following functions:

Receive a connection establishment request message forwarded by a second NAT device; wherein, the connection establishment request message is a message sent by the CPE to the second NAT device, and the second NAT device is located in the branch node .

When implementing the step of sending the first external network IP address information and the first external network port information to the CPE, the sending module 403 is specifically configured to:

Sending the first external network IP address information to the CPE through the second NAT device.

Embodiment 4

This embodiment also provides a computer device, such as a smart phone, a tablet computer, a notebook computer, a desktop computer, a rack server, a blade server, a tower server, or a cabinet server (including independent servers, or A server cluster composed of multiple servers), etc. As shown in FIG. 5 , the computer device 50 in this embodiment at least includes, but is not limited to, a memory 501 and a processor 502 that can be communicatively connected to each other through a system bus. It should be noted that FIG. 5 only shows the computer device 50 having components 501-502, but it should be understood that implementation of all of the illustrated components is not required, and more or fewer components may be implemented instead.

In this embodiment, the memory 501 (that is, a readable storage medium) includes a flash memory, a hard disk, a multimedia card, a card-type memory (eg, SD or DX memory, etc.), random access memory (RAM), static random access memory (SRAM), Read Only Memory (ROM), Electrically Erasable Programmable Read Only Memory (EEPROM), Programmable Read Only Memory (PROM), Magnetic Memory, Magnetic Disk, Optical Disk, etc. In some embodiments, the memory 501 may be an internal storage unit of the computer device 50 , such as a hard disk or a memory of the computer device 50 . In other embodiments, the memory 501 may also be an external storage device of the computer device 50, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, flash memory card (Flash Card), etc. Of course, the memory 501 may also include both the internal storage unit of the computer device 50 and its external storage device. In this embodiment, the memory 501 is generally used to store the operating system and various application software installed on the computer device 50 . In addition, the memory 501 can also be used to temporarily store various types of data that have been output or will be output.

In some embodiments, the processor 502 may be a central processing unit (Central Processing Unit, CPU), a controller, a microcontroller, a microprocessor, or other data processing chips. The processor 502 is typically used to control the overall operation of the computer device 50 .

Specifically, in this embodiment, the processor 502 is configured to execute the program of the method for establishing a VPN tunnel stored in the processor 502. When the program of the method for establishing a VPN tunnel is executed, the following steps may be implemented:

Receive a connection establishment request message sent by the client terminal equipment CPE; wherein, the CPE is located in a branch node of SD-WAN, and the connection establishment request message includes: the identification information of the CPE;

Carry out networking configuration to determine the identification information of the connection establishment object corresponding to the identification information of the CPE; wherein, the connection establishment object is the virtual client device vCPE located in the cloud service node of SD-WAN, And the cloud service node further includes a first network address interaction NAT device, and the vCPE connects to the control platform through the first NAT device;

Sending the first external network IP address information corresponding to the identification information of the connection establishment object to the CPE, so that the CPE uses the first external network IP address information and establishes through the first NAT device A virtual private network VPN tunnel with the vCPE.

For the specific embodiment process of the above method steps, reference may be made to the first embodiment, which will not be repeated in this embodiment.

Embodiment 5

This embodiment also provides a computer-readable storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory (for example, SD or DX memory, etc.), random access memory (RAM), static random access memory (SRAM), only Read-only memory (ROM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Programmable Read-Only Memory (PROM), magnetic memory, magnetic disk, optical disk, server, App application mall, etc., on which computer programs are stored, When the computer program is executed by the processor, the following method steps can be implemented:

Receive a connection establishment request message sent by the client terminal equipment CPE; wherein, the CPE is located in a branch node of SD-WAN, and the connection establishment request message includes: the identification information of the CPE;

Carry out networking configuration to determine the identification information of the connection establishment object corresponding to the identification information of the CPE; wherein, the connection establishment object is the virtual client device vCPE located in the cloud service node of SD-WAN, And the cloud service node further includes a first network address interaction NAT device, and the vCPE connects to the control platform through the first NAT device;

Sending the first external network IP address information corresponding to the identification information of the connection establishment object to the CPE, so that the CPE uses the first external network IP address information and establishes through the first NAT device A virtual private network VPN tunnel with the vCPE.

For the specific embodiment process of the above method steps, reference may be made to the first embodiment, which will not be repeated in this embodiment.

It should be noted that, herein, the terms "comprising", "comprising" or any other variation thereof are intended to encompass non-exclusive inclusion, such that a process, method, article or device comprising a series of elements includes not only those elements, It also includes other elements not expressly listed or inherent to such a process, method, article or apparatus. Without further limitation, an element qualified by the phrase "comprising a..." does not preclude the presence of additional identical elements in a process, method, article or apparatus that includes the element.

The above-mentioned serial numbers of the embodiments of the present invention are only for description, and do not represent the advantages or disadvantages of the embodiments.

From the description of the above embodiments, those skilled in the art can clearly understand that the method of the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is better implementation.

The above are only preferred embodiments of the present invention, and are not intended to limit the scope of the present invention. Any equivalent structure or equivalent process transformation made by using the contents of the description and drawings of the present invention, or directly or indirectly applied in other related technical fields , are similarly included in the scope of patent protection of the present invention.

Claims (10)

1. A method for establishing a VPN tunnel, which is applied to a control platform of an SD-WAN, and comprises the following steps:

receiving a connection establishment request message sent by Customer Premises Equipment (CPE); wherein the CPE is located in a branch node of the SD-WAN, and the connection request message comprises: identification information of the CPE;

networking configuration is carried out to determine the identity identification information of the connection object corresponding to the identity identification information of the CPE; the connection object is virtual client equipment vCPE located in a cloud service node of the SD-WAN, the cloud service node further comprises first network address interaction NAT equipment, and the vCPE is connected with the control platform through the first NAT equipment;

and sending first external network IP address information corresponding to the identification information of the connection object to the CPE so that the CPE utilizes the first external network IP address information and establishes a virtual private network VPN tunnel between the CPE and the VPN through the first NAT equipment.

2. Method for establishing a VPN tunnel according to claim 1, characterised in that before said step of receiving a connection request message sent by a customer premises equipment, CPE, the method further comprises:

receiving a configuration parameter message forwarded by the first NAT device; wherein the configuration parameter message is a message sent by the vcCPE to the first NAT device;

analyzing the identity identification information and the external network IP address information of the vCPE from the configuration parameter message;

and establishing a corresponding relation between the identity identification information and the external network IP address information.

3. Method for establishing a VPN tunnel according to claim 1, characterised in that when a VPN tunnel is established between the CPE and the vCPE, the method further comprises:

receiving a probe message forwarded by the first NAT device; wherein the probe message is a message sent by the vcCPE to the first NAT device;

analyzing second external network IP address information from the detection message;

judging whether the first external network IP address information is consistent with the second external network IP address information;

and if the two pieces of external network IP address information are not consistent, the second external network IP address information is sent to the CPE so that the CPE can reestablish a VPN tunnel between the CPE and the second external network IP address information through the first NAT equipment.

4. The method of establishing a VPN tunnel according to claim 1, further comprising:

analyzing third external network IP address information of the CPE from the connection establishing request message;

and sending the third external network IP address information to the vCPE through the first NAT equipment so that the vCPE utilizes the third external network IP address information and establishes a VPN tunnel between the vCPE and the first NAT equipment.

5. The method according to claim 1, wherein the step of receiving the connection establishment request message sent by the customer premises equipment CPE specifically comprises:

receiving a connection establishment request message forwarded by the second NAT equipment; wherein the connection establishment request message is a message sent by the CPE to the second NAT device, and the second NAT device is located in the branch node.

6. The method according to claim 5, wherein the step of sending the first extranet IP address information to the CPE specifically includes:

and sending the first external network IP address information to the CPE through the second NAT equipment.

7. An apparatus for establishing a VPN tunnel, applied to a control platform of an SD-WAN, the apparatus comprising:

the receiving module is used for receiving a connection establishment request message sent by Customer Premises Equipment (CPE); wherein the CPE is located in a branch node of the SD-WAN, and the connection request message comprises: identification information of the CPE;

the configuration module is used for carrying out networking configuration so as to determine the identity identification information of the connection object corresponding to the identity identification information of the CPE; the connection object is virtual client equipment vCPE located in a cloud service node of the SD-WAN, the cloud service node further comprises first network address interaction NAT equipment, and the vCPE is connected with the control platform through the first NAT equipment;

and the sending module is used for sending the first external network IP address information corresponding to the identity identification information of the connection object to the CPE so that the CPE utilizes the first external network IP address information and establishes a virtual private network VPN tunnel between the CPE and the VPN through the first NAT equipment.

8. The apparatus for establishing a VPN tunnel according to claim 7, wherein said receiving module is further configured to:

receiving a configuration parameter message forwarded by the first NAT device; wherein the configuration parameter message is a message sent by the vcCPE to the first NAT device;

the configuration module is further configured to:

analyzing the identity identification information and the external network IP address information of the vCPE from the configuration parameter message;

the sending module is further configured to establish a corresponding relationship between the identification information and the external network IP address information.

9. A computer device, the computer device comprising: memory, processor and computer program stored on the memory and executable on the processor, characterized in that the processor implements the steps of the method of any of claims 1 to 6 when executing the computer program.

10. A computer-readable storage medium, on which a computer program is stored, which, when being executed by a processor, carries out the steps of the method of any one of claims 1 to 6.

Images