Method, device, equipment and readable medium for protecting VPN network nodes in Anycast scenario

Abstract

The present disclosure provides a method, device, equipment and readable medium for protecting VPN network nodes in an Anycast scenario, wherein the method comprises: selecting one of the edge routers according to the Anycast address to determine it as a designated representative edge router; determining another router as a non-designated representative edge router; in response to the routing address sent by the user edge device, triggering the designated representative edge router to allocate a VPN identifier; controlling the designated representative edge router to notify the VPN route to the non-designated representative edge router through BGP, and the VPN route carries the VPN identifier; triggering the non-designated representative edge router to generate a local forwarding table according to the routing address received by the designated representative edge router and the user edge device IP route, and the outgoing information of the local forwarding table corresponds to the user edge device IP route. Through the embodiments of the present disclosure, the P node does not need to maintain or perceive the state table items, and the forwarding process is simplified.

Description

Background Art

[0002] Currently, Ti-LFA FRR (Topology-Independent Loop-free Alternate FRR) technology can provide link and node protection for Segment Routing tunnels. When a link or node fails, the traffic will quickly switch to the backup path and continue to be forwarded, thereby avoiding traffic loss to the greatest extent.

[0003] Since the SR TE / SRv6 Policy in the cloud-network integration scenario is a node segment specified by the node, it is impossible to perform local protection through Ti-LFA, resulting in the inability to protect VPN services in the network in the dual PE (Provider Edge, operator edge router) node access scenario.

[0004] In the related art, the protection scheme for PE nodes is to first use a mirror label to guide to the corresponding VPN label space, and then look up the table in the corresponding VPN (Virtual Private Network) label space for forwarding.

[0005] However, the PE node needs to maintain the VPN label space, and the upstream P (Provider, operator backbone router) node needs to maintain the state table entries. The whole process of forwarding is complicated, which is not conducive to the operation and maintenance management of large networks.

[0006] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0007] The purpose of the present disclosure is to provide a method, apparatus, device and readable medium for protecting VPN network nodes in an Anycast scenario, which are used to overcome the problem of complex maintenance status table entries caused by limitations and defects of related technologies at least to a certain extent.

[0008] According to a first aspect of an embodiment of the present disclosure, a method for protecting a VPN network node in an Anycast scenario is provided, comprising: selecting one of the edge routers according to the Anycast address to be determined as a designated representative edge router; determining another router among the edge routers as a non-designated representative edge router; in response to a routing address sent by a user edge device, triggering the designated representative edge router to allocate a VPN identifier; controlling the designated representative edge router to notify the non-designated representative edge router of a VPN route through BGP, wherein the VPN route carries the VPN identifier; triggering the non-designated representative edge router to generate a local forwarding table according to the routing address received by the designated representative edge router and the user edge device IP route, wherein the outbound information of the local forwarding table corresponds to the user edge device IP route.

[0009] In an exemplary embodiment of the present disclosure, selecting one of the edge routers according to the Anycast address to determine it as the designated representative edge router includes: determining a target operator edge router deployed with the same VPN and the same Anycast address; selecting an alternative designated representative edge router from the target operator edge router with VPN as the granularity or routing device as the granularity, constructing Anycast_DR_Route on the alternative designated representative edge router, and determining a keyword in the Anycast_DR_Route; sorting Anycast_DR_Route according to the keyword; and determining one of the alternative designated representative edge routers as the designated representative edge router according to the result of the sorting.

[0010] In an exemplary embodiment of the present disclosure, an alternative designated representative edge router is selected from the target operator edge router at a VPN granularity or a routing device granularity, an Anycast_DR_Route is constructed on the alternative designated representative edge router, and a keyword in the Anycast_DR_Route is determined, including: one of the operator edge routers is selected as the alternative designated representative edge router at a VPN granularity, a first Anycast_DR_Route is constructed on the operator edge router selected as the alternative designated representative edge router, and a routing identifier and an anycast address are used as keywords of the first Anycast_DR_Route; or one of the operator edge routers is selected as the alternative designated representative edge router at a routing device granularity, a second Anycast_DR_Route is constructed on the operator edge router selected as the alternative designated representative edge router, and the anycast address is used as a keyword of the second Anycast_DR_Route.

[0011] In an exemplary embodiment of the present disclosure, if the designated representative edge router is an ASBR device, the BGP carries attribute information of the Anycast_DR_Route, and the attribute information includes IPv6 specific extension group and type information.

[0012] In an exemplary embodiment of the present disclosure, it also includes: the non-designated representative edge router receives the VPN route, and determines that the priority of the next hop routing device of the non-designated representative edge router carrying the attribute information is lower than the priority of the next hop routing device not carrying the attribute information.

[0013] In an exemplary embodiment of the present disclosure, the Anycast_DR_Route includes a route identifier, an address length, an anycast address, and a local virtual tunnel port address.

[0014] In an exemplary embodiment of the present disclosure, the encapsulation format of the VPN route is one of VPNv4, VPNv6 and EVPNRT5.

[0015] According to a second aspect of an embodiment of the present disclosure, a protection device for a VPN network node in an Anycast scenario is provided, comprising: a determination module, configured to select one of the edge routers according to the Anycast address and determine it as a designated representative edge router; the determination module is further configured to determine another router in the edge router as a non-designated representative edge router; a trigger module, configured to trigger the designated representative edge router to allocate a VPN identifier in response to a routing address sent by a user edge device; a control module, configured to control the designated representative edge router to notify the non-designated representative edge router of a VPN route through BGP, wherein the VPN route carries the VPN identifier; the trigger module is further configured to trigger the non-designated representative edge router to generate a local forwarding table according to the routing address received by the designated representative edge router and the user edge device IP route, wherein the outbound information of the local forwarding table corresponds to the user edge device IP route.

[0016] According to a third aspect of the present disclosure, there is provided an electronic device, comprising: a memory; and a processor coupled to the memory, wherein the processor is configured to execute any one of the methods described above based on instructions stored in the memory.

[0017] According to a fourth aspect of the present disclosure, a computer-readable storage medium is provided, on which a program is stored. When the program is executed by a processor, the method for protecting a VPN network node in an Anycast scenario as described in any one of the above items is implemented.

[0018] In the disclosed embodiment, one of the edge routers is selected as a designated representative edge router according to the Anycast address, and another router is determined as a non-designated representative edge router, so as to trigger the designated representative edge router to allocate a VPN identifier, and notify the non-designated representative edge router of the VPN route through BGP, the non-designated representative edge router generates a local forwarding table according to the routing address received by the designated representative edge router and the user edge device IP route, the outgoing information of the local forwarding table corresponds to the user edge device IP route, the VPN route does not need to generate FRR (Fast Reroute, fast reroute) table items, and does not need to deploy end-to-end BFD (Bidirectional Forwarding Detection, a network protocol for detecting failures between two forwarding points) detection, the VPN route does not need to be switched when the PE node fails, as long as the SRv6 route Ti-LFA of the public network is quickly switched or converged, the traffic can be directed to the backup PE node and forwarded normally to the CE (user edge device) device, thereby simplifying the forwarding process.

[0019] Furthermore, the embodiments of the present disclosure can also be applied to ASBR (Autonomous System Border Router) device protection scenarios, and have strong applicability.

[0020] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The accompanying drawings herein are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the specification are used to explain the principles of the present disclosure. Obviously, the accompanying drawings described below are only some embodiments of the present disclosure, and for ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without creative work.

[0022] Figure 1 A flowchart of a method for protecting a VPN network node in an Anycast scenario in an exemplary embodiment of the present disclosure is shown;

[0023] Figure 2 A flowchart of a method for protecting a VPN network node in an Anycast scenario in another exemplary embodiment of the present disclosure is shown;

[0024] Figure 3 A flowchart of a method for protecting a VPN network node in an Anycast scenario in another exemplary embodiment of the present disclosure is shown;

[0025] Figure 4 A flowchart of a method for protecting a VPN network node in an Anycast scenario in another exemplary embodiment of the present disclosure is shown;

[0026] Figure 5 A schematic diagram of the architecture of a protection solution for a VPN network node in an Anycast scenario in an exemplary embodiment of the present disclosure is shown;

[0027] Figure 6 A schematic diagram of the architecture of a protection solution for a VPN network node in an Anycast scenario in another exemplary embodiment of the present disclosure is shown;

[0028] Figure 7 A schematic diagram of the architecture of a protection solution for a VPN network node in an Anycast scenario in another exemplary embodiment of the present disclosure is shown;

[0029] Figure 8 A schematic diagram of the architecture of a protection solution for a VPN network node in an Anycast scenario in another exemplary embodiment of the present disclosure is shown;

[0030] Fig. 9 A block diagram of a protection device for a VPN network node in an Anycast scenario in an exemplary embodiment of the present disclosure is shown;

[0031] Fig.10 A block diagram of an electronic device in an exemplary embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0032] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as being limited to the examples set forth herein; on the contrary, these embodiments are provided so that the present disclosure will be more comprehensive and complete, and the concepts of the example embodiments are fully conveyed to those skilled in the art. The described features, structures, or characteristics may be combined in one or more embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present disclosure. However, those skilled in the art will appreciate that the technical solutions of the present disclosure may be practiced while omitting one or more of the specific details, or other methods, components, devices, steps, etc. may be adopted. In other cases, known technical solutions are not shown or described in detail to avoid obscuring various aspects of the present disclosure.

[0033] In addition, the accompanying drawings are only schematic diagrams of the present disclosure, and the same reference numerals in the drawings represent the same or similar parts, so their repeated description will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities, which do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software form, or in one or hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0034] The technical solution disclosed in the present invention involves the following important concepts.

[0035] (1) SRV6: SR (Segment Routing) technology is used to plan and establish an end-to-end connection path at the first node in the network. Intermediate nodes only need to forward and do not need to maintain the connection status. SRV6 combines IPv6 (sixth-generation Internet) technology and SR technology. It is no longer necessary to use an independent signaling protocol to distribute labels to each node in the network. At the same time, SRv6 only needs to be expanded on the basis of the original IPv6. It can use the IPv6 tunnel to forward data without the need to use an additional MPLS (Multi-Protocol Label Switching) tunnel for data forwarding.

[0036] (2) In the VPN concept, routers in the entire network are divided into three categories: customer edge routers (CE), provider edge routers (PE), and provider backbone routers (P); among them, PE acts as an IP VPN access router.

[0037] (2.1) PE (Provider Edge): It is the edge device of Provide, the edge router of the service provider backbone network, which is equivalent to the label edge router (LER). The PE router connects the CE router and the P router and is the most important network node. The user's traffic flows into the user network through the PE router, or flows to the MPLS backbone network through the PE router.

[0038] (2.2) CE (Customer Edge): Customer Edge equipment, the user-side router connected to the service provider. The CE router provides service access to users by connecting to one or more PE routers. The CE router is usually an IP router that establishes an adjacency relationship with the connected PE router.

[0039] (3) EVPN: Ethernet VPN, which was originally defined by RFC7432. The full spelling of RFC is BGP MPLS-Based Ethernet VPN. EVPN is also used to transmit IP routing information, as the control layer of overlay networks such as VXLAN, and as the control layer of data center interconnection.

[0040] (4) BGP: Border Gateway Protocol, used to exchange routing information between different autonomous systems (AS). When two ASs need to exchange routing information, each AS must designate a node running BGP to represent the AS in exchanging routing information with other ASs. BGP uses TCP (Transmission Control Protocol) as the transport layer protocol.

[0041] (5) RD: route distinguisher, 64 bits, used to distinguish IPv4 prefixes using the same address space. An IPv4 address with an RD added is called a VPN-IPv4 address (i.e., VPNv4 address). After receiving an IPv4 route from a CE, a PE converts it into a globally unique VPN-IPv4 route and publishes it on the public network.

[0042] (6) RT: Route Target, used to distinguish VPN customers. It is an extended attribute of the BGP community and is configured in the VRF. It is transmitted after the VPNv4 prefix. A route can have multiple RT values ​​attached.

[0043] like Figure 5 As shown, the protection architecture of the VPN network node in the Anycast scenario includes: two user edge devices are respectively recorded as the first user edge device CE1 and the second user edge device CE2; four operator edge routers are respectively recorded as the first operator edge router PE1, the second operator edge router PE2, the third operator edge router PE3 and the fourth operator edge router PE4; two backbone operator backbone routers are respectively recorded as the first operator backbone router P1 and the second operator backbone router P2.

[0044] In an exemplary embodiment of the present disclosure, Anycast1 interaction is implemented between the first operator edge router PE1 and the second operator edge router PE2.

[0045] In an exemplary embodiment of the present disclosure, Anycast3 interaction is implemented between the third operator edge router PE3 and the fourth operator edge router PE4.

[0046] In an exemplary embodiment of the present disclosure, Anycast2 interaction is implemented between the first operator backbone router P1 and the second operator backbone router P2.

[0047] like Figure 5 In the illustrated embodiment, the PE node needs to maintain multiple VPN label spaces, and the upstream P node needs to maintain state table entries. The entire forwarding process is complex and is not conducive to large-scale network operation and maintenance management.

[0048] The following is combined with Figures 1 to 10 Exemplary embodiments of the present disclosure are described in detail.

[0049] Figure 1 The flowchart of the method for protecting a VPN network node in an Anycast scenario in an exemplary embodiment of the present disclosure is shown.

[0050] refer to Figure 1 , the protection methods of VPN network nodes in the Anycast scenario may include:

[0051] Step S102: selecting one of the edge routers as a designated representative edge router according to the Anycast address.

[0052] Step S104: determine another router among the edge routers as a non-designated representative edge router.

[0053] Step S106: In response to the routing address sent by the user edge device, trigger the designated representative edge router to allocate a VPN identifier.

[0054] Step S108: Control the designated representative edge router to notify the non-designated representative edge router of a VPN route through BGP, wherein the VPN route carries the VPN identifier.

[0055] Step S110 , triggering the non-designated representative edge router to generate a local forwarding table according to the routing address received by the designated representative edge router and the user edge device IP route, wherein the outgoing information of the local forwarding table corresponds to the user edge device IP route.

[0056] In the disclosed embodiment, one of the edge routers is selected as a designated representative edge router according to the Anycast address, and another router is determined as a non-designated representative edge router, so as to trigger the designated representative edge router to allocate a VPN identifier, and notify the non-designated representative edge router of the VPN route through BGP, the non-designated representative edge router generates a local forwarding table according to the routing address received by the designated representative edge router and the user edge device IP route, the outgoing information of the local forwarding table corresponds to the user edge device IP route, the VPN route does not need to generate FRR (Fast Reroute, fast reroute) table items, and does not need to deploy end-to-end BFD (Bidirectional Forwarding Detection, a network protocol for detecting failures between two forwarding points) detection, the VPN route does not need to be switched when the PE node fails, as long as the SRv6 route Ti-LFA of the public network is quickly switched or converged, the traffic can be directed to the backup PE node and forwarded normally to the CE (user edge device) device, thereby simplifying the forwarding process.

[0057] Next, combine Figures 2 to 4 The steps of the method for protecting VPN network nodes in the Anycast scenario are described in detail.

[0058] In an exemplary embodiment of the present disclosure, Figure 2 As shown, selecting one of the edge routers according to the Anycast address to be determined as the designated representative edge router includes:

[0059] Step S202: determine a target operator edge router deployed with the same VPN and the same Anycast address.

[0060] Step S204, selecting a candidate designated representative edge router from the target operator edge router at a VPN granularity or a routing device granularity, constructing Anycast_DR_Route on the candidate designated representative edge router, and determining a keyword in the Anycast_DR_Route.

[0061] Step S206, sorting the Anycast_DR_Routes according to the keyword.

[0062] Step S208: Determine one of the candidate designated representative edge routers as the designated representative edge router according to the sorting result.

[0063] In an exemplary embodiment of the present disclosure, Anycast_DR_Route includes the following contents as shown in Table 1:

[0064] Table 1 Anycast_DR_Route

[0065]

[0066] In an exemplary embodiment of the present disclosure, a DR device is selected from a group of devices deployed with the same VPN and Anycast address, and Anycast_DR_Route is constructed on the PE device. "RD" is filled with RD1 of VPN, "Anycast IPv6Address" is the public network Anycast IPv6 address configured for the device, and "Originating Router's IP Address" is an address that can uniquely identify the PE device, which can be the device Router-ID and carry the RT attribute of VPN.

[0067] In an exemplary embodiment of the present disclosure, Figure 3 As shown, a candidate designated representative edge router is selected in the target operator edge router with VPN as the granularity or routing device as the granularity, Anycast_DR_Route is constructed on the candidate designated representative edge router, and the keywords in the Anycast_DR_Route are determined to include:

[0068] Step S302, select one of the operator edge routers as a candidate designated representative edge router based on VPN granularity, build a first Anycast_DR_Route on the operator edge router selected as the candidate designated representative edge router, and use the route identifier and anycast address as keywords of the first Anycast_DR_Route.

[0069] Step S304, or selecting one of the operator edge routers as the candidate designated representative edge router based on the granularity of the routing device, constructing a second Anycast_DR_Route on the operator edge router selected as the candidate designated representative edge router, and using the anycast address as the keyword of the second Anycast_DR_Route.

[0070] In an exemplary embodiment of the present disclosure, Figure 5 Based on the architecture shown, Figure 6 As shown, the DR device election includes the following implementations:

[0071] (1) A DR device 602 is elected between PE3 and PE4. The DR device 602 is responsible for automatically allocating VPN SIDs. The non-DR device 604 is used as a mirror device and uses VPN SIDs (Security Identifiers), referred to as VPN identifiers.

[0072] (2) After receiving the CE-side route IP1, the DR device 602PE4 notifies the L3VPN route through BGP (transmitting only the optimal routing path). The L3VPN route can be encapsulated in one of VPNv4, VPNv6 and EVPN RT5, and carries the automatically assigned VPN SID.

[0073] (3) After receiving the CE-side route IP1, the non-DR device 604PE3 does not need to announce it externally. It generates a local forwarding table based on the route IP1 received by PE4 and the CE-side IP1 route. The VPN SID of IP1 on PE3 is the same as the VPNSID of the IP1 route announced by PE4, for example, "Anycast Locator3", but the outbound information (outbound interface, next hop, etc.) of the forwarding table uses the information of the CE-side IP1 route.

[0074] like Figure 7 As shown in the figure, the loopback1 address of PE3 is 11::1::1, the Anycast IP is 10::1:1, and VPN1 is RD1 / RT1. The loopback1 address of PE4 is 11::2::2, the Anycast IP is 10::1:1, and VPN1 is RD1 / RT1.

[0075] In an exemplary embodiment of the present disclosure, if the designated representative edge router is an ASBR device, the BGP carries attribute information of the Anycast_DR_Route, and the attribute information includes IPv6 specific extension group and type information.

[0076] In an exemplary embodiment of the present disclosure, the Anycast VPN protection mechanism is applied to an ASBR device, and the DR role can be elected based on the device, that is, the RD field of the Anycast_DR_Route route does not need to be filled.

[0077] In an exemplary embodiment of the present disclosure, Figure 4 As shown, the protection method of the VPN network node in the Anycast scenario also includes:

[0078] Step S402: The non-designated representative edge router receives the VPN route and determines that the priority of the next-hop routing device carrying the attribute information of the non-designated representative edge router is lower than the priority of the next-hop routing device not carrying the attribute information.

[0079] In an exemplary embodiment of the present disclosure, Figure 8 As shown, after the non-DR device 804 receives the VPN route from the DR device 802, the priority of the next hop carrying the Anycast_DR attribute is lower than the next hop without this attribute, so as to ensure that the route announced from the PE takes precedence instead of the DR device 02, that is, on the ASBR2 (autonomous system boundary router) device, a forwarding table entry with "Locator2: Fun1" as the VPN SID is also generated like ASBR1 (autonomous system boundary router).

[0080] In an exemplary embodiment of the present disclosure, the Anycast_DR_Route includes a route identifier, an address length, an anycast address, and a local virtual tunnel port address.

[0081] In an exemplary embodiment of the present disclosure, the encapsulation format of the VPN route is one of VPNv4, VPNv6 and EVPNRT5.

[0082] In an exemplary embodiment of the present disclosure, BGP VPNv4, VPNv6 and EVPN RT5 routes determine whether to automatically allocate local VPN SIDs according to the DR role of the device. Only DR devices automatically allocate VPN SIDs and announce routes to BGP neighbors. The announcement carries the newly added transferable Anycast_DR_Route attribute, which is a BGPIPv6-Address-Specific Extended Community attribute.

[0083] In an exemplary embodiment of the present disclosure, the Anycast_DR_Route attribute is defined as shown in Table 2 below:

[0084] Table 2

[0085] Type = 0x0012 (new type) IPv6 address (fill in IPV6 Anycast address)

[0086] Corresponding to the above method embodiment, the present disclosure also provides a protection device for a VPN network node in an Anycast scenario, which can be used to execute the above method embodiment.

[0087] Fig. 9 It is a block diagram of a protection device for a VPN network node in an Anycast scenario in an exemplary embodiment of the present disclosure.

[0088] refer to Fig. 9 , the protection device 900 of the VPN network node in the Anycast scenario may include:

[0089] The determination module 902 is configured to select one of the edge routers according to the Anycast address and determine it as the designated representative edge router.

[0090] The determining module 902 is configured to determine another router among the edge routers as a non-designated representative edge router.

[0091] The trigger module 904 is configured to trigger the designated representative edge router to allocate a VPN identifier in response to the routing address sent by the user edge device.

[0092] The control module 906 is configured to control the designated representative edge router to notify the non-designated representative edge router of a VPN route through BGP, wherein the VPN route carries the VPN identifier.

[0093] The trigger module 904 is configured to trigger the non-designated representative edge router to generate a local forwarding table according to the routing address received by the designated representative edge router and the user edge device IP route, wherein the outgoing information of the local forwarding table corresponds to the user edge device IP route.

[0094] In an exemplary embodiment of the present disclosure, the determination module 902 is also used to: determine a target operator edge router deployed with the same VPN and the same Anycast address; select an alternative designated representative edge router from the target operator edge router with VPN as the granularity or with routing device as the granularity, construct Anycast_DR_Route on the alternative designated representative edge router, and determine the keywords in the Anycast_DR_Route; sort the Anycast_DR_Route according to the keywords; and determine one of the alternative designated representative edge routers as the designated representative edge router according to the result of the sorting.

[0095] In an exemplary embodiment of the present disclosure, the determination module 902 is also used to: select one of the operator edge routers as the alternative designated representative edge router based on VPN granularity, construct a first Anycast_DR_Route on the operator edge router selected as the alternative designated representative edge router, and use the routing identifier and anycast address as keywords of the first Anycast_DR_Route; or select one of the operator edge routers as the alternative designated representative edge router based on routing device granularity, construct a second Anycast_DR_Route on the operator edge router selected as the alternative designated representative edge router, and use the anycast address as the keyword of the second Anycast_DR_Route.

[0096] In an exemplary embodiment of the present disclosure, if the designated representative edge router is an ASBR device, the BGP carries attribute information of the Anycast_DR_Route, and the attribute information includes IPv6 specific extension group and type information.

[0097] In an exemplary embodiment of the present disclosure, the determination module 902 is also used for: the non-designated representative edge router receives the VPN route, and determines that the priority of the next-hop routing device of the non-designated representative edge router carrying the attribute information is lower than the priority of the next-hop routing device not carrying the attribute information.

[0098] In an exemplary embodiment of the present disclosure, the Anycast_DR_Route includes a route identifier, an address length, an anycast address, and a local virtual tunnel port address.

[0099] In an exemplary embodiment of the present disclosure, the encapsulation format of the VPN route is one of VPNv4, VPNv6 and EVPNRT5.

[0100] Since the functions of the protection device 900 for a VPN network node in the Anycast scenario have been described in detail in the corresponding method embodiments, the present disclosure will not elaborate on them here.

[0101] In summary, the protection scheme for VPN network nodes in the Anycast scenario disclosed in the embodiments of the present disclosure has at least the following advantages:

[0102] (1) Define the negotiation mechanism: For L3VPN or L3EVPN services, PE3 and PE4 advertise routes with the same SRV6 VPN SID. VPN routes use the iterative public anycast address to forward VPN traffic to any outgoing PE device for correct processing.

[0103] (2) The VPN routes of the corresponding devices do not need to generate and maintain FRR entries, nor do they need to deploy end-to-end BFD detection.

[0104] (3) When a PE node fails, the VPN route does not need to be switched. As long as the public network's SRV6 route Ti-LFA is quickly switched or converged, the traffic can be directed to the backup PE node and forwarded to the CE device normally.

[0105] It should be noted that, although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided into being embodied by a module or unit.

[0106] In an exemplary embodiment of the present disclosure, an electronic device capable of implementing the above method is also provided.

[0107] It will be appreciated by those skilled in the art that various aspects of the present invention may be implemented as a system, method or program product. Therefore, various aspects of the present invention may be specifically implemented in the following forms, namely: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software, which may be collectively referred to herein as a "circuit", "module" or "system".

[0108] Refer to the following Fig.10 The electronic device 1000 according to this embodiment of the present invention will be described. Fig.10 The electronic device 1000 shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0109] like Fig.10 As shown, the electronic device 1000 is in the form of a general computing device. The components of the electronic device 1000 may include but are not limited to: the at least one processing unit 1010, the at least one storage unit 1020, and a bus 1030 connecting different system components (including the storage unit 1020 and the processing unit 1010).

[0110] The storage unit stores program codes, which can be executed by the processing unit 1010, so that the processing unit 1010 performs the steps according to various exemplary embodiments of the present invention described in the above “Exemplary Method” section of this specification. For example, the processing unit 1010 can perform the method shown in the embodiment of the present disclosure.

[0111] The storage unit 1020 may include a readable medium in the form of a volatile storage unit, such as a random access storage unit (RAM) 10201 and / or a cache storage unit 10202 , and may further include a read-only storage unit (ROM) 10203 .

[0112] The storage unit 1020 may also include a program / utility 10204 having a set (at least one) of program modules 10205, such program modules 10205 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0113] Bus 1030 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0114] The electronic device 1000 may also communicate with one or external devices 1040 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), may also communicate with one or devices that enable a user to interact with the electronic device 1000, and / or communicate with any device that enables the electronic device 1000 to communicate with one or other computing devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 1050. Furthermore, the electronic device 1000 may also communicate with one or networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via a network adapter 1060. As shown, the network adapter 1060 communicates with other modules of the electronic device 1000 via a bus 1030. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 1000, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0115] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0116] In an exemplary embodiment of the present disclosure, a computer-readable storage medium is also provided, on which a program product capable of implementing the above method of the present specification is stored. In some possible implementations, various aspects of the present invention can also be implemented in the form of a program product, which includes a program code, and when the program product is run on a terminal device, the program code is used to enable the terminal device to execute the steps according to various exemplary embodiments of the present invention described in the above "Exemplary Method" section of the present specification.

[0117] The program product for implementing the above method according to an embodiment of the present invention can adopt a portable compact disk read-only memory (CD-ROM) and include program code, and can be run on a terminal device, such as a personal computer. However, the program product of the present invention is not limited thereto, and in this document, a readable storage medium can be any tangible medium containing or storing a program, which can be used by or in combination with an instruction execution system, an apparatus or a device.

[0118] The program product may use any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0119] Computer readable signal media may include data signals propagated in baseband or as part of a carrier wave, in which readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Readable signal media may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0120] The program code embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

[0121] Program code for performing the operations of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., through the Internet using an Internet service provider).

[0122] In addition, the above-mentioned figures are only schematic illustrations of the processes included in the method according to an exemplary embodiment of the present invention, and are not intended to be limiting. It is easy to understand that the processes shown in the above-mentioned figures do not indicate or limit the time sequence of these processes. In addition, it is also easy to understand that these processes can be performed synchronously or asynchronously, for example, in modules.

[0123] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The specification and examples are to be considered exemplary only, and the true scope and concept of the present disclosure are indicated by the claims.

Claims

1. A method for protecting VPN network nodes in an Anycast scenario, characterized in that: include: Select one of the edge routers according to the Anycast address to be the designated representative edge router, including: Determine the target carrier edge router that has the same VPN and the same Anycast address deployed; Selecting a candidate designated representative edge router from the target operator edge router based on VPN granularity or routing device granularity, constructing Anycast_DR_Route on the candidate designated representative edge router, and determining a keyword in the Anycast_DR_Route; Sort Anycast_DR_Route according to the keyword; Determine one of the candidate designated representative edge routers as the designated representative edge router according to the sorting result; Determine another router among the edge routers as a non-designated representative edge router; In response to the routing address sent by the user edge device, triggering the designated representative edge router to allocate a VPN identifier; Control the designated representative edge router to notify the non-designated representative edge router of a VPN route through BGP, wherein the VPN route carries the VPN identifier; The non-designated representative edge router is triggered to generate a local forwarding table according to the routing address received by the designated representative edge router and the user edge device IP route, wherein the outgoing information of the local forwarding table corresponds to the user edge device IP route.

2. The method for protecting a VPN network node in an Anycast scenario according to claim 1, wherein: Selecting a candidate designated representative edge router from the target operator edge router based on VPN or routing device granularity, constructing Anycast_DR_Route on the candidate designated representative edge router, and determining that the keywords in the Anycast_DR_Route include: Select one of the operator edge routers as a candidate designated representative edge router based on VPN granularity, construct a first Anycast_DR_Route on the operator edge router selected as the candidate designated representative edge router, and use the route identifier and anycast address as keywords of the first Anycast_DR_Route; Or one of the operator edge routers is selected as the candidate designated representative edge router based on the granularity of the routing device, a second Anycast_DR_Route is constructed on the operator edge router selected as the candidate designated representative edge router, and the anycast address is used as the keyword of the second Anycast_DR_Route.

3. The method for protecting a VPN network node in an Anycast scenario according to claim 1 or 2, characterized in that: If the designated representative edge router is an ASBR device, the BGP carries the attribute information of the Anycast_DR_Route, and the attribute information includes IPv6 specific extension group and type information.

4. The method for protecting a VPN network node in an Anycast scenario as claimed in claim 3, characterized in that: Also includes: The non-designated representative edge router receives the VPN route and determines that the priority of the next-hop routing device carrying the attribute information of the non-designated representative edge router is lower than the priority of the next-hop routing device not carrying the attribute information.

5. The method for protecting a VPN network node in an Anycast scenario according to claim 1 or 2, characterized in that: The Anycast_DR_Route includes a routing identifier, an address length, an anycast address and a local virtual tunnel port address.

6. The method for protecting a VPN network node in an Anycast scenario according to claim 1 or 2, characterized in that: The encapsulation format of the VPN route is one of VPNv4, VPNv6 and EVPN RT5.

7. A protection device for VPN network nodes in an Anycast scenario, characterized in that: include: The determination module is configured to select one of the edge routers according to the Anycast address to be determined as the designated representative edge router, including: Determine the target carrier edge router that has the same VPN and the same Anycast address deployed; Selecting a candidate designated representative edge router from the target operator edge router based on VPN granularity or routing device granularity, constructing Anycast_DR_Route on the candidate designated representative edge router, and determining a keyword in the Anycast_DR_Route; Sort Anycast_DR_Route according to the keyword; Determine one of the candidate designated representative edge routers as the designated representative edge router according to the sorting result; The determination module is further configured to determine another router among the edge routers as a non-designated representative edge router; A trigger module, configured to trigger the designated representative edge router to allocate a VPN identifier in response to a routing address sent by a user edge device; A control module, configured to control the designated representative edge router to notify the non-designated representative edge router of a VPN route through BGP, wherein the VPN route carries the VPN identifier; The trigger module is further configured to trigger the non-designated representative edge router to generate a local forwarding table according to the routing address received by the designated representative edge router and the user edge device IP route, wherein the outgoing information of the local forwarding table corresponds to the user edge device IP route.

8. An electronic device, characterized in that: include: Memory; as well as A processor coupled to the memory, the processor being configured to execute the method for protecting a VPN network node in an Anycast scenario according to any one of claims 1 to 6 based on instructions stored in the memory.

9. A computer-readable storage medium having a program stored thereon, wherein when the program is executed by a processor, the method for protecting a VPN network node in an Anycast scenario according to any one of claims 1 to 6 is implemented.

Images