Method and apparatus for configuration check of an overlay network

Abstract

The application discloses a kind of configuration checking method and device of overlapping network, it is related to computer network technical field, the method includes: obtaining the trouble shooting request of user on overlapping network;When determining that the IP address pair of trouble shooting is cloud load balancing device address, then execute the first checking operation of listener, domain name and URL path of cloud load balancing device;When determining that the IP address pair of trouble shooting is cloud server device address, then execute the second checking operation of security group configuration and port configuration of cloud server device;When determining that the IP address pair of trouble shooting is not cloud load balancing device address and is not cloud server device address, then according to the association between the trouble shooting position information and corresponding third checking operation, determine and execute the third checking operation corresponding to the trouble shooting position information;Generate the notification information with the check result of checking operation.This application is to improve the efficiency of configuration checking of overlapping network.

Description

Technical Field

[0001] This invention relates to the field of computer network technology, and in particular to a method and apparatus for checking the configuration of overlapping networks. Background Technology

[0002] This section is intended to provide background or context for the embodiments of the invention set forth in the claims. The description herein is not an admission that it is prior art simply because it is included in this section.

[0003] Overlay networks are virtual network environments superimposed on underlay networks, supporting multi-tenancy. Underlay products should use internal network address publishing services. If internet publishing is required, public network address publishing services can be applied for and approved. Overlay products can choose to use either public or internal network address publishing services as needed.

[0004] However, existing methods for troubleshooting overlay networks are not intuitive and can lead to access problems caused by network policy issues, which in turn affect normal business operations. This results in low efficiency in checking the configuration of overlay networks and makes it difficult to quickly resolve problems in emergency scenarios. Summary of the Invention

[0005] This invention provides a configuration checking method for overlapping networks to improve the efficiency of troubleshooting configuration checks in overlapping networks. The method includes:

[0006] Obtain user fault reporting requests on overlapping networks; the fault reporting request includes: fault reporting IP address pair, fault reporting port information, and fault reporting location information; the fault reporting IP address pair includes the fault reporting load balancer address and the fault reporting cloud server IP address.

[0007] When it is determined that the reported IP address pair is the address of the cloud load balancer, the first check operation on the listener, domain name and URL path of the cloud load balancer is performed according to the reported port information.

[0008] When it is determined that the reported IP address pair is the address of the cloud server device, a second check operation is performed on the security group configuration and port configuration of the cloud server device based on the reported IP address pair.

[0009] When it is determined that the reported IP address is neither the address of the cloud load balancer nor the address of the cloud server, the third check operation corresponding to the reported location information is determined and executed based on the correlation between the reported location information and the corresponding third check operation; the third check operation includes check operations on NAT gateway, peering connection and leased channel.

[0010] Generate a notification message carrying the inspection results of the inspection operation.

[0011] This invention also provides a configuration checking device for overlapping networks to improve the efficiency of troubleshooting configuration checks in overlapping networks. The device includes:

[0012] The fault reporting request acquisition module is used to acquire fault reporting requests from users on overlapping networks; the fault reporting request includes: fault reporting IP address pair, fault reporting port information, and fault reporting location information; the fault reporting IP address pair includes the fault reporting load balancer address and the fault reporting cloud server IP address.

[0013] The first inspection operation execution module is used to perform a first inspection operation on the listener, domain name and URL path of the cloud load balancer when it is determined that the faulty IP address pair is the address of the cloud load balancer device, based on the faulty port information.

[0014] The second inspection operation execution module is used to perform a second inspection operation on the security group configuration and port configuration of the cloud server device based on the reported IP address pair when it is determined that the faulty IP address pair is the address of the cloud server device.

[0015] The third inspection operation execution module is used to determine and execute the third inspection operation corresponding to the fault location information when it is determined that the fault-reporting IP address pair is neither the address of the cloud load balancer nor the address of the cloud server device, based on the association between the fault location information and the corresponding third inspection operation; the third inspection operation includes inspection operations on NAT gateway, peer-to-peer connection and leased channel;

[0016] The notification information generation module is used to generate notification information carrying the inspection results of the inspection operation.

[0017] This invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the above-described method for checking the configuration of overlapping networks.

[0018] This invention also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described configuration checking method for overlapping networks.

[0019] This invention also provides a computer program product, which includes a computer program that, when executed by a processor, implements the above-described configuration checking method for overlapping networks.

[0020] In this embodiment of the invention, a fault reporting request from a user on an overlapping network is obtained. The fault reporting request includes: a fault reporting IP address pair, fault reporting port information, and fault reporting location information. The fault reporting IP address pair includes a fault reporting load balancer address and a fault reporting cloud server IP address. When the fault reporting IP address pair is determined to be the address of a cloud load balancer device, a first check operation is performed on the listener, domain name, and URL path of the cloud load balancer device based on the fault reporting port information. When the fault reporting IP address pair is determined to be the address of a cloud server device, a second check operation is performed on the security group configuration and port configuration of the cloud server device based on the fault reporting IP address pair. When the fault reporting IP address pair is determined to be neither the address of a cloud load balancer device nor a cloud server device, a second check operation is performed on the security group configuration and port configuration of the cloud server device. When the device address is determined, the third check operation corresponding to the fault location information is determined and executed based on the correlation between the fault location information and the corresponding third check operation. The third check operation includes check operations on NAT gateways, peer connections, and leased channels. A notification message carrying the check results of the check operation is generated. Compared with the non-intuitive technical solutions for troubleshooting overlay networks in the prior art, this method can clearly identify the path of traffic data and check whether the configuration of related devices is correct according to the traffic data path. It can quickly locate the fault point and eliminate overlay network problems, which has a guiding role in troubleshooting overlay networks involving cloud computing and effectively improves the efficiency of troubleshooting in production. Attached Figure Description

[0021] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. In the drawings:

[0022] Figure 1 This is a flowchart illustrating a configuration checking method for an overlapping network according to an embodiment of the present invention.

[0023] Figure 2 This is a specific example diagram of a configuration checking method for an overlapping network in an embodiment of the present invention;

[0024] Figure 3 This is a schematic diagram of the structure of an overlapping network configuration checking device according to an embodiment of the present invention;

[0025] Figure 4 This is a specific example diagram of a configuration checking device for an overlapping network in an embodiment of the present invention;

[0026] Figure 5 This is a schematic diagram of a computer device used for configuration checking of an overlapping network in an embodiment of the present invention. Detailed Implementation

[0027] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the embodiments of the present invention will be further described in detail below with reference to the accompanying drawings. Here, the illustrative embodiments of the present invention and their descriptions are used to explain the present invention, but are not intended to limit the present invention.

[0028] In this document, the term "and / or" merely describes a relationship, indicating that three relationships can exist. For example, A and / or B can represent three cases: A alone, A and B simultaneously, and B alone. Furthermore, the term "at least one" in this document means any combination of at least two of any one or more elements. For example, including at least one of A, B, and C can mean including any one or more elements selected from the set consisting of A, B, and C.

[0029] In the description of this specification, the terms "comprising," "including," "having," and "containing" are open-ended terms, meaning that they include but are not limited to. The terms "an embodiment," "a specific embodiment," "some embodiments," and "for example," etc., refer to specific features, structures, or characteristics described in connection with that embodiment or example that are included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, or characteristics described can be combined in any suitable manner in one or more embodiments or examples. The order of steps involved in the various embodiments is used to illustrate the implementation of this application, and the order of steps is not limited and can be adjusted appropriately as needed.

[0030] The acquisition, storage, use, and processing of data in this application all comply with the relevant provisions of national laws and regulations.

[0031] The following terms are used in the embodiments of this invention and are explained below:

[0032] Cloud computing: Cloud computing refers to a system with extremely high computing power formed through computer networks (mostly the Internet). It can store and aggregate relevant resources and configure them on demand to provide personalized services to users. The cloud services it provides include distributed computing, efficient computing, load balancing, parallel computing, network storage, hot backup redundancy, virtualization technology, etc.

[0033] Underlay network: A physical network environment built and used by the cloud service provider itself.

[0034] Overlay Network: A virtual network environment overlaid on the underlay, supporting multi-tenancy. Underlay products should use internal network address publishing services. If internet publishing is required, public network address publishing services can be applied for and approved. Overlay products can choose to use either public or internal network address publishing services as needed.

[0035] Virtual Private Network (VPC): A Virtual Private Network (VPC) is an isolated network space in the cloud. VPCs can be created using overlay networks, and users can customize IP addresses, subnets, routes, network ACLs, etc., within the VPC. VPCs can also access the Internet through a NAT gateway, or connect to on-premises data centers via VPN or dedicated lines to build a hybrid cloud.

[0036] Subnet: A subnet is a block of IP addresses within a VPC. All cloud resources within a private network must be deployed within a subnet. Subnets have availability zone attributes; after creating a VPC, subnets can be added to each availability zone within the region where the private network resides. Subnets have availability zone attributes and do not support cross-availability zone deployment.

[0037] Cloud servers: Cloud Virtual Machines (CVMs) provide scalable computing services in the cloud, avoiding the need to estimate resource usage and make upfront investments required when using traditional servers. By using CVMs, any number of cloud servers can be quickly launched and applications deployed instantly. CVMs allow users to customize all resources: CPU, memory, hard drive, network, security, etc., and easily adjust them as access volume and load demands change.

[0038] Peer-to-peer (P2P) connectivity is a cross-VPC network interconnection service used for office data synchronization. It allows private network IPs to route traffic between peering VPCs as if they belong to the same network. It enables interconnection between private networks of the same or different users, and by configuring routing policies at both ends, traffic can be shared between different private networks. Peer-to-peer connectivity does not rely on any single piece of hardware, thus eliminating single points of failure or bandwidth bottlenecks.

[0039] NAT Gateway: A NAT gateway is connected between the tenant's VPC network boundary router and the Internet. Cloud hosts within the VPC send data packets to the Internet through the NAT gateway. The data packets first pass through the virtual router, and then the NAT gateway sends the data packets to the Internet using the bound elastic IP address as the source IP address.

[0040] Physical leased line: The physical line connecting the cloud network and the local data center. It can be a carrier leased line or an internal line within the local data center, with a leased access switch (PLA) at one end and the peer boundary device at the other. The physical leased line uses dual-line hot standby access, dual-line access point power supply, and completely isolated network pipelines.

[0041] Leased Line Channels: Leased line channels are network link divisions within a physical leased line. Based on different VLANs, multiple logical sub-interfaces can be created on a single physical leased line, thereby creating multiple leased line channels, with traffic isolated between each channel. Tenants can create leased line channels connecting to different VPCs, enabling interconnection between the local network and multiple VPCs in the cloud. Leased line channels also employ a dual-line redundancy design, supporting both primary / standby mode and load balancing redundancy modes, and supporting automatic failover.

[0042] Leased Line Gateway: The entry and exit point for leased traffic to a private network. Implemented in a clustered manner, leased line gateways eliminate single points of failure risk and meet financial-grade network interconnection requirements. A leased line gateway acts as a bridge between a private network and physical leased lines. It can connect leased channels from multiple physical leased lines, thereby enabling communication with multiple on-premises data centers. Users can create a leased line gateway for each private network in the leased line gateway console; only one leased line gateway of the same type can be created per private network.

[0043] Cloud Load Balancing: Cloud Load Balancer (CLB) products provide users with efficient and secure traffic distribution services. By using CLB products, users can evenly forward high-concurrency application requests to the backend application server according to the corresponding load balancing strategies and forwarding rules, so as to achieve stable operation of business.

[0044] Cloud load balancer listener: The load balancing service listener mainly includes the listening port, load balancing policy, and health check, and is used to monitor the corresponding background application services.

[0045] Security Groups: Security groups are stateful virtual firewalls with packet filtering capabilities, used to configure network access control for single or multiple cloud servers. They are a crucial network security isolation mechanism provided by cloud platforms. A security group is a logical grouping that allows basic network cloud servers or elastic network interface instances within the same region with similar network security isolation requirements to be added to the same security group. Security group policies can be used to filter inbound and outbound traffic to instances, which can be basic network cloud servers or elastic network interface instances. Security group rules can be modified at any time, and new rules take effect immediately.

[0046] Specifically, security groups support both custom creation and template creation. For ease of explanation, three templates are listed here:

[0047] Linux opens port 22: Only the TCP port 22 for SSH login is exposed to the public network, while all internal network ports are open.

[0048] Windows opens port 3389: Only the TCP port 3389 for MSTSC login is exposed to the public network, while all internal network ports are open.

[0049] Opening all ports: Exposing all ports to the public and private networks poses certain security risks.

[0050] Security group rules control the inbound traffic allowed to reach the instance associated with the security group, as well as the outbound traffic allowed to leave the instance (the rules are filtered from top to bottom). By default, a newly created security group will AllDrop (deny) all traffic, and a cloud server bound to a security group with no rules will deny all traffic.

[0051] For each rule in a security group, the following items can be specified:

[0052] Type: You can choose a system rule template or a custom rule.

[0053] Source or destination: The source (inbound rule) or destination (outbound rule) of the traffic. Please specify one of the following options:

[0054] A single IP address is specified using CIDR notation.

[0055] The CIDR notation specifies a range of IP addresses (e.g., 203.0.113.0 / 24).

[0056] Reference a security group ID, where the current security group indicates whether the CVMs associated with the security group are accessible to each other, or reference another security group ID in the same zone.

[0057] Refer to the IP address object or IP address group object in the parameter template.

[0058] CLB products: CLB products can provide TCP / UDP layer 4 load balancing and HTTP / HTTPS layer 7 load balancing.

[0059] Layer 4 CLB: Layer 4 CLB mainly implements business traffic forwarding for VIP+ ports. When a user applies for a CLB instance, the instance will be assigned a Virtual IP (VIP). The user can use this VIP and configure different forwarding ports to achieve request forwarding at the TCP / UDP layer.

[0060] Layer 7 CLB: Layer 7 CLB mainly implements application layer traffic forwarding for VIP + port + URL. After a user applies for a CLB instance, they can use the VIP address of the instance and configure the corresponding forwarding port and URL to achieve HTTP / HTTPS application layer traffic forwarding.

[0061] Overlay network CLBs have two instance types: internal network CLBs and public network CLBs.

[0062] Internal Network CLB: When applying for a CLB instance, users can choose the internal network load balancing type. The internal network load balancing type is mainly used for forwarding user application traffic within the internal network. The Virtual IP (hereinafter referred to as VIP) of the internal network load balancing instance is an internal network IP address, which can only be used within the VPC and cannot be used or accessed on the Internet.

[0063] Public CLB: When applying for a CLB instance, users can choose either the internal network load balancing type or the public network load balancing type. The VIP for the public network load balancing type is an internet IP address, which users can use to access applications deployed in the cloud via the internet. Currently, mainstream cloud networks support both IPv4 and IPv6 IP versions.

[0064] Overlay networks are virtual network environments superimposed on underlay networks, supporting multi-tenancy. Underlay products should use internal network address publishing services. If internet publishing is required, public network address publishing services can be applied for and approved. Overlay products can choose to use either public or internal network address publishing services as needed.

[0065] Overlay networks not only support multi-tenancy but also feature flexible address allocation and routing policies, allowing for customized configurations to meet diverse business needs. Underlay products utilize internal network address publishing services, ensuring server stability and security while enabling public network access through technologies like NAT. If internet publishing is required, public network address publishing services can be used after approval, enabling broader network access. Overlay products can choose to use either public or internal network address publishing services based on actual needs, satisfying different business scenarios and security requirements. This flexible architecture makes network deployment more convenient and efficient, while also reducing the complexity and cost of network operation and maintenance.

[0066] However, existing methods for troubleshooting overlay networks are not intuitive and can lead to access problems caused by network policy issues, which in turn affect normal business operations. This results in low efficiency in checking the configuration of overlay networks and makes it difficult to quickly resolve problems in emergency scenarios.

[0067] To address the aforementioned problems, embodiments of the present invention provide a configuration checking method for overlapping networks, thereby improving the efficiency of troubleshooting configuration checks in overlapping networks. See [link to relevant documentation]. Figure 1 The method may include:

[0068] Step 101: Obtain the user's fault reporting request on the overlapping network; the fault reporting request includes: fault reporting IP address pair, fault reporting port information, and fault reporting location information; the fault reporting IP address pair includes the fault reporting load balancer address and the fault reporting cloud server IP address;

[0069] Step 102: When it is determined that the reported IP address pair is the address of the cloud load balancer, the first check operation on the listener, domain name and URL path of the cloud load balancer is performed according to the reported port information.

[0070] Step 103: When it is determined that the reported IP address pair is the address of the cloud server device, the second check operation on the security group configuration and port configuration of the cloud server device is performed according to the reported IP address pair.

[0071] Step 104: When it is determined that the reported IP address is neither the address of the cloud load balancer nor the address of the cloud server, the third check operation corresponding to the reported location information is determined and executed according to the correlation between the reported location information and the corresponding third check operation; the third check operation includes the check operation of NAT gateway, peer connection and leased channel.

[0072] Step 105: Generate a notification message carrying the inspection results of the inspection operation.

[0073] In step 101, the fault reporting request further includes fault reporting time information and fault reporting type information. The fault reporting time information includes the time of the fault occurrence and the time the fault reporting request was submitted, and the fault reporting type information includes network fault, server fault, and other faults.

[0074] In step 102, the first inspection operation includes listener configuration inspection, domain name configuration inspection, and URL path configuration inspection. Specifically, the listener configuration inspection checks whether the listener of the cloud load balancer is correctly configured based on the fault reporting port information; the domain name configuration inspection checks whether the domain name of the cloud load balancer is correctly configured based on the fault reporting port information; and the URL path configuration inspection checks whether the URL path of the cloud load balancer is correctly configured based on the fault reporting port information.

[0075] In step 103, the second inspection operation includes a security group configuration check and a port configuration check. Specifically, the security group configuration check checks whether the security group configuration of the cloud server device has been correctly configured based on the reported faulty IP address pair; the port configuration check checks whether the port configuration of the cloud server device has been correctly configured based on the reported faulty IP address pair.

[0076] In step 104, the third inspection operation includes an inspection of the NAT gateway, an inspection of peering connections, and an inspection of the leased line channel. Specifically, the inspection of the NAT gateway is determined and performed based on the correlation between the fault location information and the corresponding third inspection operation; the inspection of the peering connection is determined and performed based on the correlation between the fault location information and the corresponding third inspection operation; and the inspection of the leased line channel is determined and performed based on the correlation between the fault location information and the corresponding third inspection operation.

[0077] In step 105, the notification information includes fault location information, troubleshooting suggestion information, and fault handling progress information. Fault location information refers to the fault location result obtained based on the above steps; troubleshooting suggestion information refers to the troubleshooting suggestions obtained based on the above steps; and fault handling progress information refers to the fault handling progress obtained based on the above steps.

[0078] In this embodiment of the invention, a fault reporting request from a user on an overlapping network is obtained. The fault reporting request includes: a fault reporting IP address pair, fault reporting port information, and fault reporting location information. The fault reporting IP address pair includes a fault reporting load balancer address and a fault reporting cloud server IP address. When the fault reporting IP address pair is determined to be the address of a cloud load balancer device, a first check operation is performed on the listener, domain name, and URL path of the cloud load balancer device based on the fault reporting port information. When the fault reporting IP address pair is determined to be the address of a cloud server device, a second check operation is performed on the security group configuration and port configuration of the cloud server device based on the fault reporting IP address pair. When the fault reporting IP address pair is determined to be neither the address of a cloud load balancer device nor the address of a cloud server device, a third check operation corresponding to the fault reporting location information is determined and executed based on the association between the fault reporting location information and the corresponding third check operation. The third check operation includes checks on NAT gateways, peering connections, and leased channels. A notification message carrying the check results of the check operations is generated.

[0079] Compared with existing technologies that are not intuitive for troubleshooting overlay networks, the embodiments of the present invention can clearly identify the path of traffic data and check whether the configuration of related devices is correct according to the path of traffic data. This allows for quick location of the fault point and elimination of overlay network problems, providing guidance for troubleshooting cloud computing overlay networks and effectively improving the efficiency of troubleshooting in production.

[0080] In the above embodiments, a fault reporting request from a user on an overlapping network is obtained. This fault reporting request includes a fault reporting IP address pair, fault reporting port information, and fault reporting location information. The fault reporting IP address pair includes the fault reporting load balancer address and the fault reporting cloud server IP address.

[0081] When the reported IP address pair is determined to be the address of a cloud load balancer, a first check is performed on the listener, domain name, and URL path of the cloud load balancer based on the reported port information. Specifically, this checks whether the listener of the load balancer is running normally and whether the domain name and URL path are configured correctly.

[0082] When the reported IP address pair is determined to be a cloud server device address, a second check is performed on the security group configuration and port configuration of the cloud server device based on the reported IP address pair. This checks whether the security group rules of the cloud server are configured correctly and ensures that the port opening status meets the requirements.

[0083] When it is determined that the reported IP address is neither the address of a cloud load balancer nor a cloud server, the third check operation corresponding to the reported location information is determined and executed based on the correlation between the reported location information and the corresponding third check operation. This third check operation may include checks on the NAT gateway, peering connections, and dedicated line channels. For example, it may check whether the NAT gateway configuration is correct, whether the peering connection is normal, and whether the dedicated line channel is unobstructed.

[0084] Finally, a notification message carrying the inspection results is generated. Compared with existing technologies that lack intuitive troubleshooting methods for overlay networks, this embodiment clearly identifies the path of traffic data and checks the configuration of relevant devices sequentially according to the traffic data path, quickly locating the fault point and eliminating overlay network problems. This will provide guidance for troubleshooting cloud computing overlay networks, effectively improving the efficiency of troubleshooting in production.

[0085] In practice, the first step is to obtain the user's fault reporting request on the overlapping network. The fault reporting request includes: fault reporting IP address pair, fault reporting port information, and fault reporting location information. The fault reporting IP address pair includes the fault reporting load balancer address and the fault reporting cloud server IP address.

[0086] In one embodiment, after obtaining a fault reporting request from a user on an overlapping network, the method may further include:

[0087] The fault reporting request is parsed to obtain the parsing result; the parsing result includes: the network latency between the fault reporting load balancer address and the fault reporting cloud server IP address, and the port status corresponding to the fault reporting port information;

[0088] If the network latency is less than a preset threshold and the port is in an open state, then output that the fault reporting request does not meet the fault reporting conditions.

[0089] Otherwise, generate a work order for the reported fault and send it to the maintenance personnel;

[0090] The parsing results are included in the work order sent to the operations and maintenance personnel.

[0091] Through the above methods, the present invention can accurately and quickly locate and resolve fault reports generated by users on overlapping networks without affecting the user's business experience, thereby improving the efficiency of network fault resolution and enhancing user satisfaction.

[0092] In practice, when it is determined that the reported IP address pair is the address of the cloud load balancer, a first check operation is performed on the listener, domain name and URL path of the cloud load balancer based on the reported port information; then, a notification message carrying the check results of the check operation is generated.

[0093] During implementation, once the reported IP address pair is identified as the address of a cloud-based load balancer, the first check of the cloud-based load balancer's listener, domain name, and URL path is immediately performed based on the reported port information. This step is crucial because it accurately identifies the status of the load balancer, thereby ensuring accurate diagnosis of network faults.

[0094] After performing the initial check, the system generates a notification message containing the check results. This notification message details the status of the load balancer, including the status of listeners, domain names, and URL paths. This allows network administrators to quickly and accurately understand the specifics of the network failure, enabling them to identify the cause and take corrective action more effectively.

[0095] In addition, the notification can provide suggestions and guidance on how to troubleshoot the problem. These suggestions and guidance are based on a deep understanding and comprehensive analysis of the load balancer's status, helping network administrators find solutions more quickly.

[0096] In this way, the system greatly simplifies the network troubleshooting process, improves the efficiency of network administrators, and enhances the stability and reliability of the entire network. This is precisely what is desired: to solve real-world problems and improve people's quality of life and work efficiency through technological means.

[0097] In one embodiment, performing a first check on the listener, domain name, and URL path of the cloud load balancer includes:

[0098] Use the reported faulty IP address pair as the load balancer address to be checked;

[0099] Determine if the listener for the corresponding load balancing address to be checked exists; if it exists, determine whether the domain name and URL path of the Layer 7 load balancing listener in the listener are accurate based on the fault reporting port information; if accurate, determine whether the virtual machine IP address under the domain name of the Layer 7 load balancing listener is accurate.

[0100] Generate a notification message carrying the inspection results of the inspection operation, including:

[0101] If it is determined that the listener for the corresponding load balancer address to be checked does not exist, the domain name and URL path of the Layer 7 load balancer are inaccurate, and / or the virtual machine IP address is inaccurate, a notification message carrying the check operation indicates that the cloud load balancer device has malfunctioned.

[0102] In another embodiment, performing the first check operation on the listener, domain name, and URL path of the cloud load balancer may further include:

[0103] 1. Use the reported faulty IP address pair as the load balancer address to be checked;

[0104] 2. Determine if the listener for the corresponding load balancing address to be checked exists; if it exists, determine whether the domain name and URL path of the Layer 7 load balancing listener in the listener are accurate based on the fault reporting port information.

[0105] 3. If accurate, then determine whether the virtual machine IP address under the domain name of the Layer 7 load balancer listener is accurate;

[0106] 4. Once it is confirmed that the domain name and URL path of the Layer 7 load balancer listener and the virtual machine IP address are accurate, a notification message is sent indicating that the cloud load balancer is operating normally.

[0107] The above embodiments effectively enable fault detection and notification of cloud load balancing devices, improving system reliability and stability. Furthermore, by checking the accuracy of the domain name and URL path of the Layer 7 load balancer listener and the virtual machine IP address, the correctness and security of the load balancing device can be ensured.

[0108] In one embodiment, it also includes:

[0109] After performing the first check on the listener, domain name, and URL path of the cloud load balancer, check whether the certificate of the cloud load balancer is valid; if invalid, issue an alarm message with the invalid certificate of the cloud load balancer.

[0110] In one embodiment, the following steps may also be included:

[0111] After performing the first check on the listener, domain name, and URL path of the cloud load balancer, a second check on the cloud load balancer can be performed, including:

[0112] Obtain the configuration information of the cloud load balancer; based on the configuration information, determine whether the cloud load balancer is configured with security group rules; if security group rules are configured, determine whether the security group rules are configured correctly; if the security group rules are determined to be incorrectly configured, issue an alarm message carrying the message that the security group rules are incorrectly configured.

[0113] By following the steps above, you can more comprehensively check the status of cloud load balancing equipment, promptly detect and alert on faults or configuration problems, and help ensure the stability and security of the system.

[0114] In practice, when the reported IP address pair is determined to be the address of a cloud server device, a second check operation is performed on the security group configuration and port configuration of the cloud server device based on the reported IP address pair; then, a notification message carrying the check results of the check operation is generated.

[0115] In practice, if the reported IP address pair is identified as the address of a cloud server device, a second check will be performed on the security group configuration and port configuration of the cloud server device based on the reported IP address pair. This operation aims to re-verify the security and operational status of the cloud server device to ensure that its configuration is correct and compliant with standards.

[0116] After performing the second check, a notification message containing the check results will be generated. This notification will be sent to relevant personnel so they can be promptly informed of the cloud server's status and configuration. In this way, relevant personnel can more quickly identify and resolve issues with the cloud server, ensuring its normal operation and improving system stability and reliability.

[0117] In addition, the second check of the security group configuration and port configuration of the cloud server device can be further processed or handled as needed. For example, if problems are found in the security group configuration or port configuration, they can be adjusted and repaired in a timely manner to ensure the normal operation of the cloud server device.

[0118] In summary, the above methods can be used to perform a second check on the security group configuration and port configuration of cloud server devices, and generate timely notification information so that relevant personnel can understand and resolve problems with cloud server devices in a timely manner, thereby improving the stability and reliability of the system.

[0119] In one embodiment, performing a second check on the security group configuration and port configuration of the cloud server device includes:

[0120] Use the reported fault IP address pair as the cloud server device address;

[0121] Determine if the inbound and outbound policies and port protocols of the security group corresponding to the cloud server device address are accurate;

[0122] Generate a notification message carrying the inspection results of the inspection operation, including:

[0123] When the inbound / outbound policies and port protocols of the security group are inaccurate, a notification message is generated carrying the inspection result that the cloud server device has failed.

[0124] In one embodiment, the reported faulty IP address pair is used as the cloud server device address for subsequent troubleshooting and processing. Then, the accuracy of the inbound and outbound policies and port protocols of the security group corresponding to the cloud server device address is determined to ensure the network security and normal operation of the cloud server. Inaccuracies indicate potential security risks that require immediate attention. Additionally, a notification message containing the inspection results is generated to quickly notify relevant personnel in the event of a fault, enabling timely repair and handling.

[0125] In one embodiment, the fault-reporting IP address pair is used as the load balancer address to be checked;

[0126] Determine if the listener for the corresponding load balancing address to be checked exists; if it exists, determine whether the domain name and URL path of the Layer 7 load balancing listener in the listener are accurate based on the fault reporting port information; if accurate, determine whether the virtual machine IP address under the domain name of the Layer 7 load balancing listener is accurate.

[0127] Generate a notification message carrying the inspection results of the inspection operation, including: if it is determined that the listener for the corresponding load balancer address to be inspected does not exist, the domain name and URL path of the Layer 7 load balancer are inaccurate, and / or the virtual machine IP address is inaccurate, then issue a notification message carrying the inspection operation indicating that the cloud load balancer device has failed.

[0128] If all the above steps are normal, a notification message will be generated indicating that the cloud load balancer is operating normally.

[0129] In practice, when the reported IP address pair is determined to be the address of a cloud server device, a second check operation is performed on the security group configuration and port configuration of the cloud server device based on the reported IP address pair; then, a notification message carrying the check results of the check operation is generated.

[0130] In one embodiment, performing a second check on the security group configuration and port configuration of the cloud server device includes:

[0131] 1. Use the reported fault IP address pair as the cloud server device address;

[0132] 2. Determine if the inbound and outbound policies and port protocols of the security group for the corresponding cloud server device address are accurate;

[0133] 3. Generate a notification message carrying the inspection results of the inspection operation, including:

[0134] a. When the inbound / outbound policies and port protocols of the security group are inaccurate, generate a notification message carrying the check result that the cloud server device has failed.

[0135] Additionally, further operations can be performed on the cloud server equipment as needed, such as:

[0136] 1. When the inbound and outbound policies and port protocols of the security group are accurate, generate a notification message carrying the check result that the cloud server device is normal;

[0137] 2. When the inbound / outbound policies and port protocols of the security group are inaccurate, generate a notification message with suggested actions, including: suggesting that the security group configuration and port configuration of the cloud server device be modified;

[0138] 3. Send the generated notification information to relevant personnel as needed.

[0139] In specific implementation, when it is determined that the reported IP address is neither the address of the cloud load balancer nor the address of the cloud server, the third check operation corresponding to the reported location information is determined and executed based on the correlation between the reported location information and the corresponding third check operation. The third check operation includes checks on the NAT gateway, peering connection and leased channel. After that, a notification message carrying the check results of the check operation is generated.

[0140] In the specific implementation process, it is first necessary to determine whether the IP address reporting the fault is the address of a load balancer or a cloud server. If it is not one of these two addresses, then based on the correlation between the fault location information and the corresponding third-party check operation, the third-party check operation for that fault location information can be determined and executed.

[0141] This third inspection process includes a series of checks, such as checks on the NAT gateway, peering connections, and leased lines. These checks aim to determine the specific cause of the network failure so that appropriate remedial measures can be taken.

[0142] After completing these checks, the system generates a notification message detailing the results. This message lists all issues discovered during the check and their solutions. This notification is then sent to the network administrator so they can promptly understand and resolve network problems.

[0143] In one embodiment, it also includes:

[0144] Establish the association between fault location information and corresponding third-party inspection operations as follows:

[0145] For fault location information involving interconnected outbound network paths that characterize faults, establish the association between the third inspection operation that checks the NAT gateway;

[0146] For fault location information that characterizes access between different tenants under the same cloud server / or between virtual private networks of the same tenant under the same cloud server, establish the association between the third inspection operation that checks the peering connection.

[0147] For fault location information that represents access from different tenants under different cloud servers or access between public cloud, private cloud and external units, establish a correlation between the third inspection operation that checks the dedicated line channel.

[0148] In practice, when the reported IP address is determined to be neither the address of a cloud load balancer nor a cloud server, the system will accurately determine and execute the third-party check operation for that reported location based on the correlation between the reported location information and the corresponding third-party check operation. This correlation is established based on an understanding of the network paths involved in the fault, as well as in-depth research and experience with different types of faults.

[0149] For fault location information involving outbound network paths representing faults, the system establishes a correlation between this information and a third-party inspection operation that checks the NAT gateway. The NAT gateway is a crucial component of network communication, responsible for address translation and data forwarding. Checking the NAT gateway effectively detects and locates network faults, ensuring smooth network communication.

[0150] For fault location information indicating that the fault involves access between different tenants under the same cloud server or between virtual private networks (VPNs) of the same tenant under the same cloud server, the system will establish a correlation between the third-party inspection operation that checks peering connections. Peering connections are a direct communication method between different tenants or VPNs of the same tenant within a cloud server. By checking peering connections, network communication faults within the cloud server can be effectively detected and located.

[0151] For fault location information indicating that the fault involves access from different tenants on different cloud servers or involves access between public clouds, private clouds, and external units, the system will establish a correlation between this fault location information and a third-party inspection operation that checks the dedicated line channel. The dedicated line channel is a private communication channel between different cloud servers or between public clouds, private clouds, and external units, offering high data transmission speed and security. Checking the dedicated line channel can effectively detect and locate network communication faults across cloud servers, ensuring the stability and security of data transmission.

[0152] After completing the third check operation, the system generates a notification message containing the check results. This notification message details the location and type of the fault, along with corresponding solutions, enabling maintenance personnel to quickly locate and resolve the fault. Simultaneously, the system performs statistical analysis of the fault data, providing strong data support for further fault prevention and optimization.

[0153] The above examples demonstrate that this system can accurately and quickly locate different types of network faults and provide corresponding solutions. This not only greatly improves the efficiency and quality of network maintenance but also reduces the impact of network faults on business operations, providing customers with higher quality and more stable services.

[0154] In one embodiment, performing the third check operation corresponding to the fault location information includes:

[0155] When the third check operation is to check the NAT gateway, the NAT gateway of the virtual private network to which the faulty IP address pair belongs is determined based on the faulty IP address pair.

[0156] The system determines the operating status of the NAT gateway and the status of the elastic IP address of the virtual private network to which it belongs. If the operating status of the NAT gateway or the status of the elastic IP address is inaccurate, a notification message carrying the check operation indicates that the NAT gateway has failed is sent.

[0157] When the third check operation is to check the peering connection, the peering connection of the virtual private network to which the faulty IP address pair belongs is determined based on the faulty IP address pair.

[0158] The system determines the operational status of the peering connection of the virtual private network to which it belongs. If the operational status is inaccurate, it sends a notification message carrying the check operation indicating that the peering connection has failed.

[0159] When the third inspection operation is to inspect the dedicated line channel, the dedicated line channel corresponding to the fault location information is determined based on the fault location information and the routing information of the dedicated line channel.

[0160] The operating status of the dedicated line channel is determined. If the operating status is inaccurate, a notification message is sent indicating that the dedicated line channel has malfunctioned.

[0161] In one embodiment, it may further include:

[0162] The results of the third inspection operation corresponding to the fault location information are stored in the database for subsequent troubleshooting and recording.

[0163] In addition, the notification information can also include detailed information about the fault, such as the time of occurrence, type of fault, scope of impact, and solutions, so that the recipient can quickly understand the fault situation and take timely measures.

[0164] In addition, the above process can be implemented as a computer program according to actual needs and deployed to the corresponding computer system to achieve automated detection and handling of faults.

[0165] In this embodiment of the invention, a fault reporting request from a user on an overlapping network is obtained. The fault reporting request includes: a fault reporting IP address pair, fault reporting port information, and fault reporting location information. The fault reporting IP address pair includes a fault reporting load balancer address and a fault reporting cloud server IP address. When the fault reporting IP address pair is determined to be the address of a cloud load balancer device, a first check operation is performed on the listener, domain name, and URL path of the cloud load balancer device based on the fault reporting port information. When the fault reporting IP address pair is determined to be the address of a cloud server device, a second check operation is performed on the security group configuration and port configuration of the cloud server device based on the fault reporting IP address pair. When the fault reporting IP address pair is determined to be neither the address of a cloud load balancer device nor a cloud server device, a second check operation is performed on the security group configuration and port configuration of the cloud server device. When the device address is determined, the third check operation corresponding to the fault location information is determined and executed based on the correlation between the fault location information and the corresponding third check operation. The third check operation includes check operations on NAT gateways, peer connections, and leased channels. A notification message carrying the check results of the check operation is generated. Compared with the non-intuitive technical solutions for troubleshooting overlay networks in the prior art, this method can clearly identify the path of traffic data and check whether the configuration of related devices is correct according to the traffic data path. It can quickly locate the fault point and eliminate overlay network problems, which has a guiding role in troubleshooting overlay networks involving cloud computing and effectively improves the efficiency of troubleshooting in production.

[0166] The following is a specific embodiment to illustrate the specific application of the method of the present invention, such as... Figure 2 As shown, the configuration check for the overlay network in this embodiment may include the following steps:

[0167] 1. First, obtain the IP address pair and port information of the user reporting the fault;

[0168] 2. When the IP address pair is determined to be a CLB address, query the corresponding load balancer and port based on the CLB's VIP; query the address and port of the backend CVM based on the Layer 4 / Layer 7 listener port; jump to step 3;

[0169] If the IP address pair is determined not to be a CLB address, then determine whether the IP address pair is a CVM address; if the IP address pair is determined to be a CVM address, then proceed to step 3.

[0170] If it is determined that the IP address pair is not a CVM address, proceed to step 4;

[0171] 3. Check if the relevant configurations exist based on the security group bound to CVM;

[0172] If the relevant configuration exists according to the security group bound to CVM, proceed to step 4;

[0173] If the relevant configuration is not found according to the security group bound to CVM, proceed to step 5;

[0174] 4. Determine if the VPC route exists;

[0175] If the VPC route exists, then the overlay network configuration is confirmed to be correct.

[0176] If the VPC route is found to exist, proceed to step 5;

[0177] 5. Add relevant routes based on the reported fault information.

[0178] The steps in this embodiment can be further refined into the following operations:

[0179] 1. Obtain the IP address pairs and port information reported by users. This can be done through network monitoring systems, user complaints, or automatic detection tools.

[0180] 2. When the IP address pair is determined to be the CLB address, the VIP of the CLB and the corresponding load balancer port can be determined by querying the load balancer configuration or the Layer 4 / Layer 7 listener configuration. At the same time, the address and port of the backend CVM can be queried based on the load balancer port.

[0181] 3. Check if the relevant configuration exists based on the security group bound to CVM. This can be done by querying the security group configuration or performing a security group rule check.

[0182] 4. To determine if a VPC route exists, you can query the VPC routing table or perform routing protocol operations.

[0183] 5. Add relevant routes based on the reported fault conditions. This can be done manually or by executing routing protocol operations.

[0184] It should be noted that the above embodiments are only a specific application example of the present invention, and the implementation method may be different for different scenarios and needs.

[0185] like Figure 2 As shown, the specific application of the above embodiments is explained from the software operation perspective as follows:

[0186] 1. First, determine if the address is a CLB. If it is a CLB address, the check is divided into two parts: "HTTP / HTTPS listener check" and "TCP / UDP listener check".

[0187] First, we need to determine if the address is a CLB address. If the address is a CLB address, then we need to perform two checks: "HTTP / HTTPS listener check" and "TCP / UDP listener check".

[0188] When performing an HTTP / HTTPS listener check, we need to confirm the following:

[0189] 1. Verify that the HTTP / HTTPS service is running. If the service is not running, then we need to start the service.

[0190] 2. Check if the listening address of the HTTP / HTTPS service is correct. If the address is incorrect, we need to correct it.

[0191] 3. Check if the listening port for the HTTP / HTTPS service is correct. If the port is incorrect, then we need to correct it.

[0192] 4. Check if the SSL certificate for the HTTP / HTTPS service is valid. If the certificate is invalid, then we need to replace it.

[0193] When performing a TCP / UDP listener check, we need to confirm the following:

[0194] 1. Verify that the TCP / UDP service is running. If the service is not running, then we need to start the service.

[0195] 2. Check if the listening address of the TCP / UDP service is correct. If the address is incorrect, then we need to correct it.

[0196] 3. Check if the listening port of the TCP / UDP service is correct. If the port is incorrect, then we need to correct the port.

[0197] 4. Check if the network connection of the TCP / UDP service is normal. If the connection is abnormal, we need to check the network settings and fix the connection problem.

[0198] Click on "LB Instance List" under the "Load Balancing" directory on the left, then search for the load balancer address to be checked in the search bar on the right. Once found, click on the corresponding load balancer's ID number to enter.

[0199] After accessing the load balancer involved in the fault, click "Listener Management" at the top. Under "HTTP / HTTPS Listener" or "TCP / UDP Listener", check if there is a corresponding listener based on the port number where the fault occurred, and whether the domain name and URL path are correct (only applicable to Layer 7 CLB).

[0200] If the listener has been established and the domain name and URL path are correct, click the corresponding domain name according to the fault information, and then click the corresponding URL path. At this time, the domain name and several virtual machines mounted under the path will appear in the lower right corner.

[0201] Check if the virtual machine address bound to the load balancer backend is correct, if the port is correct, and if the port status is "healthy".

[0202] If all the above checks are correct, and the required port is HTTPS, you also need to check if the certificate is correct or expired. If the CLB is fine, then perform a routing check.

[0203] If the address is not a CLB, other types of address checks are required. In the "Listener Management" section under the "Load Balancing" directory, check if the corresponding listener exists based on the different listener types (HTTP / HTTPS or TCP / UDP), and confirm that the domain name and URL path are correct. If the listener has been established and the domain name and URL path are correct, you can view the list of virtual machines mounted under that path by clicking on the corresponding domain name and URL path.

[0204] After confirming that the virtual machine address bound to the load balancer backend is correct, the port is correct, and the port status is "healthy," if the required port is HTTPS, you also need to check whether the certificate is correct or expired. If the CLB is fine, you can perform a route check.

[0205] If the above checks are all correct but the problem persists, try restarting the load balancer or related services to troubleshoot. If the problem still exists, further checks of network configuration, server configuration, or other related factors may be necessary.

[0206] 2. If the address is determined to be CVM, click "Cloud Host" in the left-hand menu of the cloud server interface, enter the IP address of the cloud server to be checked in the right-hand search bar, or you can flexibly select search items according to the fault information and click search.

[0207] After finding the IP address to be checked, click the ID number under the ID / hostname column.

[0208] Click "Security Groups" in the host information interface to see the security group information for that host. Check the inbound and outbound policies of the security group, and check the IP address, port protocol, and policies.

[0209] If the information differs from the requirements and there is no inclusion relationship (generally meaning the mask matches the detailed address), then a new policy needs to be added. If the policies on both the source and destination servers are already configured or there is an inclusion relationship,

[0210] If the security group check finds no problems, then proceed with the routing check.

[0211] If the security group check is correct, proceed with the routing check. In the cloud server interface, click "Route Table" in the left-hand menu. Enter the IP address of the cloud server to be checked in the right-hand search bar, or select search terms based on the fault information, and click search. After finding the IP address to be checked, click "Details" under the "Route Information" section. In the route information interface, check the outbound policy of the routing table, verifying the correctness of routing information such as IP address, port protocol, and next-hop gateway. If the routing policies for both the source and destination servers are configured and there is no inclusion relationship (generally meaning the mask matches the detailed address), the routing check is successful; otherwise, a new routing policy needs to be added.

[0212] 3. If the address is determined to be neither CLB nor CVM, proceed directly to the route check step.

[0213] Routing checks are mainly divided into three categories: "NAT gateway check," "peer connection check," and "leased line channel check." The specific fault scenarios and check items are related as follows:

[0214] If the fault involves outbound network paths, a NAT gateway check should be performed.

[0215] If the fault involves access between different tenants under the same cloud, or between different VPCs under the same tenant, a peering connection check should be performed.

[0216] If the fault involves different tenants under different clouds, or involves access between public clouds and private clouds, or between external units, a dedicated line channel check should be performed.

[0217] To check the NAT gateway, click "NAT Gateway" under the "Private Network" directory on the left. Find the NAT gateway of the VPC to which the faulty IP address belongs (there is a one-to-many relationship between VPCs and NAT gateways), and check if the status is "Running". Click the corresponding NAT gateway ID number to enter and check if the elastic IP address under "Associated Elastic IP" is associated.

[0218] To check the peering connection, click the "Peering Connections" option under the "Private Network" directory on the left to check if the peering connection has been created. There are three ways to check; method 1 is recommended, and methods 2 and 3 are used as supplementary verification methods:

[0219] Click on the ID number of each peering connection to check if the VPC address range of the local IP address has established a peering connection with the VPC address range of the peer IP address. If not, it means that no peering connection has been established.

[0220] Search for the peer's private network ID in the search bar in the upper right corner. If no result is found, it means that no peer connection has been established.

[0221] Search according to the naming conventions for peer connections and the peer network type in the requirements. If no results are found, it means that no peer connection has been established.

[0222] If a corresponding peering strategy is found, check if the connection status is "connected". Then, in the "Private Network" directory on the left, click "Route Table". Next, according to the VPC type of the local network, click the corresponding route table ID number to enter and check if the "Destination" in the route is the peer network address required, if the "Next Hop Type" is "Peering", and if the "Next Hop" is the same as the peering connection ID found earlier.

[0223] To check the leased line gateway, click "Cloud Products" at the top, then click "Leased Line Access" in the drop-down menu. Click "Leased Line Channel" on the left, and find the corresponding leased line channel based on "ID / Name" and "Private Network". Click "Channel Change" on the right and check if the required URL has been added in "User IDC Network Segment". Click "Route Table" under the "Private Network" directory on the left, and find the corresponding route table on the right based on the required network type. Click the ID number to enter the route table. Click "Basic Information" and check in "Route Policy" whether the required URL has been added to the route table, whether the "Next Hop Type" is a leased line channel, and whether the "Next Hop" is the same as the destination network type.

[0224] If the address is determined to be neither CLB nor CVM, then proceed directly to the route check step.

[0225] In the routing check phase, different checks are required for different fault scenarios.

[0226] If the fault involves outbound network paths, a NAT gateway check is required. A NAT gateway is a network address translation device used to translate private IP addresses into public IP addresses. During a NAT gateway check, it's necessary to confirm whether the NAT gateway status of the VPC to which the faulty IP address belongs is "Running," and to check if there are associated Elastic IP addresses under "Associated Elastic IPs." An abnormal NAT gateway status or a missing associated Elastic IP address may cause outbound network failures.

[0227] If the fault involves access between different tenants within the same cloud, or between different VPCs within the same tenant, a peering connection check is required. A peering connection refers to two networks communicating with each other via the internet. Peering connections can be verified in three ways: 1) Check the ID number of each peering connection to see if the VPC address range of the local IP address has established a peering connection with the VPC address range of the peer IP address; 2) Search in the search bar in the upper right corner according to the peer's private network ID specified in the requirements to see if a peering connection has been established; 3) Search according to the peering connection naming conventions and the peer network type specified in the requirements to see if a peering connection has been established. Failure to establish a peering connection or an abnormal connection status may lead to a fault.

[0228] If the fault involves different tenants on different clouds, or involves access between public and private clouds, or between external units, a leased line check is required. A leased line refers to a channel connecting two networks via a dedicated line. When checking the leased line, locate the corresponding leased line and check if the required URL has been added to the "User IDC Network Segment". Simultaneously, check if the routing policy in the routing table is correct, including whether the next-hop type is a leased line and whether the next hop is the same as the destination network type. Incorrect leased line or routing table settings may lead to access failures.

[0229] In summary, when checking the routing, different checking methods should be selected based on different fault scenarios, and all settings should be carefully verified to be correct. By checking and troubleshooting through the above steps, the cause of the fault should be found and repaired.

[0230] Furthermore, the above specific embodiments can be implemented as follows:

[0231] 1. When performing a NAT gateway check, if the NAT gateway's status is not "Running," then you need to check whether the association between the NAT gateway and the VPC is correct. If the associated Elastic IP address does not exist or is not associated, then you need to re-associate or recreate the Elastic IP address.

[0232] 2. During peering connection checks, if no peering connection is established, it needs to be created. When creating a peering connection, ensure that the VPC address range of the local IP address matches the VPC address range of the peer IP address, and that the naming convention of the peering connection matches the peer network type specified in the requirements. When checking the routing table, verify that the "Destination" is the peer network address specified in the requirements, that the "Next Hop Type" is "Peering Connection," and that the "Next Hop" ID matches the previously found peering connection ID.

[0233] 3. When checking the leased line channel, if the required URL is not added, it needs to be added. When adding it, ensure the required URL is already added to the user's IDC network segment. Simultaneously, check the routing table to see if the required URL has been added, if the "next hop type" is "leased line channel," and if the "next hop" matches the destination network type.

[0234] By operating the software in detail, network faults can be accurately located and quickly resolved, thereby effectively ensuring network stability and availability.

[0235] Of course, it is understood that there may be other variations of the above detailed process, and all such variations should fall within the protection scope of this invention.

[0236] This invention also provides a configuration checking device for overlapping networks, as described in the following embodiments. Since the principle by which this device solves the problem is similar to the configuration checking method for overlapping networks, the implementation of this device can refer to the implementation of the configuration checking method for overlapping networks; repeated details will not be repeated.

[0237] This invention also provides a configuration checking device for overlapping networks to improve the efficiency of troubleshooting configuration checks in overlapping networks, such as... Figure 3 As shown, the device includes:

[0238] The fault reporting request acquisition module 301 is used to acquire fault reporting requests from users on overlapping networks; the fault reporting request includes: fault reporting IP address pair, fault reporting port information, and fault reporting location information; the fault reporting IP address pair includes the fault reporting load balancer address and the fault reporting cloud server IP address.

[0239] The first inspection operation execution module 302 is used to perform a first inspection operation on the listener, domain name and URL path of the cloud load balancing device based on the fault reporting port information when it is determined that the fault reporting IP address pair is the address of the cloud load balancing device.

[0240] The second inspection operation execution module 303 is used to perform a second inspection operation on the security group configuration and port configuration of the cloud server device based on the reported IP address pair when it is determined that the faulty IP address pair is the address of the cloud server device.

[0241] The third inspection operation execution module 304 is used to determine and execute the third inspection operation corresponding to the fault location information based on the association between the fault location information and the corresponding third inspection operation when it is determined that the fault-reporting IP address pair is neither the address of the cloud load balancer nor the address of the cloud server. The third inspection operation includes inspection operations on NAT gateways, peering connections and leased channels.

[0242] The notification information generation module 305 is used to generate notification information carrying the inspection results of the inspection operation.

[0243] In one embodiment, performing a first check on the listener, domain name, and URL path of the cloud load balancer includes:

[0244] Use the reported faulty IP address pair as the load balancer address to be checked;

[0245] Determine if the listener for the corresponding load balancing address to be checked exists; if it exists, determine whether the domain name and URL path of the Layer 7 load balancing listener in the listener are accurate based on the fault reporting port information; if accurate, determine whether the virtual machine IP address under the domain name of the Layer 7 load balancing listener is accurate.

[0246] Generate a notification message carrying the inspection results of the inspection operation, including:

[0247] If it is determined that the listener for the corresponding load balancer address to be checked does not exist, the domain name and URL path of the Layer 7 load balancer are inaccurate, and / or the virtual machine IP address is inaccurate, a notification message carrying the check operation indicates that the cloud load balancer device has malfunctioned.

[0248] In one embodiment, such as Figure 4 As shown, it also includes:

[0249] Alarm module 401 is used for:

[0250] After performing the first check on the listener, domain name, and URL path of the cloud load balancer, check whether the certificate of the cloud load balancer is valid; if invalid, issue an alarm message with the invalid certificate of the cloud load balancer.

[0251] In one embodiment, performing a second check on the security group configuration and port configuration of the cloud server device includes:

[0252] Use the reported fault IP address pair as the cloud server device address;

[0253] Determine if the inbound and outbound policies and port protocols of the security group corresponding to the cloud server device address are accurate;

[0254] Generate a notification message carrying the inspection results of the inspection operation, including:

[0255] When the inbound / outbound policies and port protocols of the security group are inaccurate, a notification message is generated carrying the inspection result that the cloud server device has failed.

[0256] In one embodiment, it also includes:

[0257] Establish the association between fault location information and corresponding third-party inspection operations as follows:

[0258] For fault location information involving interconnected outbound network paths that characterize faults, establish the association between the third inspection operation that checks the NAT gateway;

[0259] For fault location information that characterizes access between different tenants under the same cloud server / or between virtual private networks of the same tenant under the same cloud server, establish the association between the third inspection operation that checks the peering connection.

[0260] For fault location information that represents access from different tenants under different cloud servers or access between public cloud, private cloud and external units, establish a correlation between the third inspection operation that checks the dedicated line channel.

[0261] In one embodiment, performing the third check operation corresponding to the fault location information includes:

[0262] When the third check operation is to check the NAT gateway, the NAT gateway of the virtual private network to which the faulty IP address pair belongs is determined based on the faulty IP address pair.

[0263] The system determines the operating status of the NAT gateway and the status of the elastic IP address of the virtual private network to which it belongs. If the operating status of the NAT gateway or the status of the elastic IP address is inaccurate, a notification message carrying the check operation indicates that the NAT gateway has failed is sent.

[0264] When the third check operation is to check the peering connection, the peering connection of the virtual private network to which the faulty IP address pair belongs is determined based on the faulty IP address pair.

[0265] The system determines the operational status of the peering connection of the virtual private network to which it belongs. If the operational status is inaccurate, it sends a notification message carrying the check operation indicating that the peering connection has failed.

[0266] When the third inspection operation is to inspect the dedicated line channel, the dedicated line channel corresponding to the fault location information is determined based on the fault location information and the routing information of the dedicated line channel.

[0267] The operating status of the dedicated line channel is determined. If the operating status is inaccurate, a notification message is sent indicating that the dedicated line channel has malfunctioned.

[0268] This invention provides an embodiment of a computer device for implementing all or part of the configuration checking method for the above-described overlapping network. The computer device specifically includes the following components:

[0269] The computer device comprises a processor, memory, a communications interface, and a bus; wherein the processor, memory, and communications interface communicate with each other via the bus; the communications interface is used to realize information transmission between related devices; the computer device can be a desktop computer, tablet computer, or mobile terminal, etc., and this embodiment is not limited to these. In this embodiment, the computer device can be implemented with reference to the embodiments of the configuration checking method for overlapping networks and the embodiments of the configuration checking device for overlapping networks, the contents of which are incorporated herein by reference, and repeated details will not be described again.

[0270] Figure 5 This is a schematic block diagram illustrating the system configuration of the computer device 1000 according to an embodiment of this application. Figure 5 As shown, the computer device 1000 may include a central processing unit 1001 and a memory 1002; the memory 1002 is coupled to the central processing unit 1001. It is worth noting that... Figure 5 This is an example; other types of structures can also be used to supplement or replace this structure to achieve telecommunications functions or other functions.

[0271] In one embodiment, the configuration checking function of the overlapping network can be integrated into the central processing unit 1001. The central processing unit 1001 can be configured to perform the following control:

[0272] Obtain user fault reporting requests on overlapping networks; the fault reporting request includes: fault reporting IP address pair, fault reporting port information, and fault reporting location information; the fault reporting IP address pair includes the fault reporting load balancer address and the fault reporting cloud server IP address.

[0273] When it is determined that the reported IP address pair is the address of the cloud load balancer, the first check operation on the listener, domain name and URL path of the cloud load balancer is performed according to the reported port information.

[0274] When it is determined that the reported IP address pair is the address of the cloud server device, a second check operation is performed on the security group configuration and port configuration of the cloud server device based on the reported IP address pair.

[0275] When it is determined that the reported IP address is neither the address of the cloud load balancer nor the address of the cloud server, the third check operation corresponding to the reported location information is determined and executed based on the correlation between the reported location information and the corresponding third check operation; the third check operation includes check operations on NAT gateway, peering connection and leased channel.

[0276] Generate a notification message carrying the inspection results of the inspection operation.

[0277] In another embodiment, the configuration checking device for the overlapping network can be configured separately from the central processing unit 1001. For example, the configuration checking device for the overlapping network can be configured as a chip connected to the central processing unit 1001, and the configuration checking function of the overlapping network can be implemented through the control of the central processing unit.

[0278] like Figure 5 As shown, the computer device 1000 may further include: a communication module 1003, an input unit 1004, an audio processor 1005, a display 1006, and a power supply 1007. It is worth noting that the computer device 1000 does not necessarily need to include... Figure 5 All components shown; in addition, the computer device 1000 may also include Figure 5 For components not shown, please refer to existing technologies.

[0279] like Figure 5 As shown, the central processing unit 1001, sometimes also referred to as a controller or operation control, may include a microprocessor or other processor device and / or logic device. The central processing unit 1001 receives input and controls the operation of various components of the computer device 1000.

[0280] The memory 1002 may be, for example, one or more of a cache, flash memory, hard drive, removable medium, volatile memory, non-volatile memory, or other suitable device. It may store the aforementioned failure-related information, and also store a program for executing that information. The central processing unit 1001 may execute the program stored in the memory 1002 to perform information storage or processing, etc.

[0281] Input unit 1004 provides input to central processing unit 1001. This input unit 1004 may be, for example, a keypad or touch input device. Power supply 1007 provides power to computer device 1000. Display 1006 displays images, text, and other display objects. This display may be, for example, an LCD display, but is not limited to this.

[0282] The memory 1002 can be a solid-state memory, such as a read-only memory (ROM), random access memory (RAM), a SIM card, etc. It can also be a memory that retains information even when power is off, can be selectively erased, and contains more data; examples of this type of memory are sometimes referred to as EPROMs, etc. The memory 1002 can also be some other type of device. The memory 1002 includes a buffer memory 1021 (sometimes referred to as a buffer). The memory 1002 may include an application / function storage unit 1022 for storing application programs and function programs or processes for executing operations of the computer device 1000 via the central processing unit 1001.

[0283] The memory 1002 may also include a data storage unit 1023 for storing data, such as contacts, digital data, pictures, sounds, and / or any other data used by the computer device. The driver storage unit 1024 of the memory 1002 may include various drivers for the computer device for communication functions and / or for performing other functions of the computer device (such as messaging applications, address book applications, etc.).

[0284] The communication module 1003 is a transmitter / receiver 1003 that transmits and receives signals via the antenna 1008. The communication module (transmitter / receiver) 1003 is coupled to the central processing unit 1001 to provide input signals and receive output signals, which can be the same as in a conventional mobile communication terminal.

[0285] Based on different communication technologies, multiple communication modules 1003 can be configured in the same computer device, such as cellular network modules, Bluetooth modules, and / or wireless LAN modules. The communication module (transmitter / receiver) 1003 is also coupled to a speaker 1009 and a microphone 1010 via an audio processor 1005 to provide audio output via the speaker 1009 and receive audio input from the microphone 1010, thereby realizing typical telecommunications functions. The audio processor 1005 may include any suitable buffer, decoder, amplifier, etc. Furthermore, the audio processor 1005 is also coupled to a central processing unit 1001, enabling on-device recording via the microphone 1010 and on-device playback of stored sound via the speaker 1009.

[0286] This invention also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described configuration checking method for overlapping networks.

[0287] This invention also provides a computer program product, which includes a computer program that, when executed by a processor, implements the above-described configuration checking method for overlapping networks.

[0288] In this embodiment of the invention, a fault reporting request from a user on an overlapping network is obtained. The fault reporting request includes: a fault reporting IP address pair, fault reporting port information, and fault reporting location information. The fault reporting IP address pair includes a fault reporting load balancer address and a fault reporting cloud server IP address. When the fault reporting IP address pair is determined to be the address of a cloud load balancer device, a first check operation is performed on the listener, domain name, and URL path of the cloud load balancer device based on the fault reporting port information. When the fault reporting IP address pair is determined to be the address of a cloud server device, a second check operation is performed on the security group configuration and port configuration of the cloud server device based on the fault reporting IP address pair. When the fault reporting IP address pair is determined to be neither the address of a cloud load balancer device nor a cloud server device, a second check operation is performed on the security group configuration and port configuration of the cloud server device. When the device address is determined, the third check operation corresponding to the fault location information is determined and executed based on the correlation between the fault location information and the corresponding third check operation. The third check operation includes check operations on NAT gateways, peer connections, and leased channels. A notification message carrying the check results of the check operation is generated. Compared with the non-intuitive technical solutions for troubleshooting overlay networks in the prior art, this method can clearly identify the path of traffic data and check whether the configuration of related devices is correct according to the traffic data path. It can quickly locate the fault point and eliminate overlay network problems, which has a guiding role in troubleshooting overlay networks involving cloud computing and effectively improves the efficiency of troubleshooting in production.

[0289] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0290] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0291] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0292] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0293] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above descriptions are merely specific embodiments of the present invention and are not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A configuration checking method for overlapping networks, characterized in that, include: Obtain user fault reporting requests on overlapping networks; The fault reporting request includes: fault reporting IP address pair, fault reporting port information, and fault reporting location information; the fault reporting IP address pair includes the fault reporting load balancer address and the fault reporting cloud server IP address. When it is determined that the reported IP address pair is the address of the cloud load balancer, the first check operation on the listener, domain name and URL path of the cloud load balancer is performed according to the reported port information. When it is determined that the reported IP address pair is the address of the cloud server device, a second check operation is performed on the security group configuration and port configuration of the cloud server device based on the reported IP address pair. When it is determined that the reported IP address is neither the address of the cloud load balancer nor the address of the cloud server, the third check operation corresponding to the reported location information is determined and executed based on the correlation between the reported location information and the corresponding third check operation; the third check operation includes check operations on NAT gateway, peering connection and leased channel. Generate a notification message carrying the inspection results of the inspection operation.

2. The method as described in claim 1, characterized in that, Perform the first check on the listeners, domain names, and URL paths of the cloud load balancer, including: Use the reported faulty IP address pair as the load balancer address to be checked; Determine if the listener for the corresponding load balancing address to be checked exists; if it exists, determine whether the domain name and URL path of the Layer 7 load balancing listener in the listener are accurate based on the fault reporting port information; if accurate, determine whether the virtual machine IP address under the domain name of the Layer 7 load balancing listener is accurate. Generate a notification message carrying the inspection results of the inspection operation, including: If it is determined that the listener for the corresponding load balancer address to be checked does not exist, the domain name and URL path of the Layer 7 load balancer are inaccurate, and / or the virtual machine IP address is inaccurate, a notification message carrying the check operation indicates that the cloud load balancer device has malfunctioned.

3. The method as described in claim 2, characterized in that, Also includes: After performing the first check on the listener, domain name, and URL path of the cloud load balancer, check whether the certificate of the cloud load balancer is valid; if invalid, issue an alarm message with the invalid certificate of the cloud load balancer.

4. The method as described in claim 1, characterized in that, Perform a second check on the security group configuration and port configuration of the cloud server device, including: Use the reported fault IP address pair as the cloud server device address; Determine if the inbound and outbound policies and port protocols of the security group corresponding to the cloud server device address are accurate; Generate a notification message carrying the inspection results of the inspection operation, including: When the inbound / outbound policies and port protocols of the security group are inaccurate, a notification message is generated carrying the inspection result that the cloud server device has failed.

5. The method as described in claim 1, characterized in that, Also includes: Establish the association between fault location information and corresponding third-party inspection operations as follows: For fault location information involving interconnected outbound network paths that characterize faults, establish the association between the third inspection operation that checks the NAT gateway; For fault location information that characterizes access between different tenants under the same cloud server / or between virtual private networks of the same tenant under the same cloud server, establish the association between the third inspection operation that checks the peering connection. For fault location information that represents access from different tenants under different cloud servers or access between public cloud, private cloud and external units, establish a correlation between the third inspection operation that checks the dedicated line channel.

6. The method as described in claim 1, characterized in that, Perform the third check operation corresponding to the reported fault location information, including: When the third check operation is to check the NAT gateway, the NAT gateway of the virtual private network to which the faulty IP address pair belongs is determined based on the faulty IP address pair. The system determines the operating status of the NAT gateway and the status of the elastic IP address of the virtual private network to which it belongs. If the operating status of the NAT gateway or the status of the elastic IP address is inaccurate, a notification message carrying the check operation indicates that the NAT gateway has failed is sent. When the third check operation is to check the peering connection, the peering connection of the virtual private network to which the faulty IP address pair belongs is determined based on the faulty IP address pair. The system determines the operational status of the peering connection of the virtual private network to which it belongs. If the operational status is inaccurate, it sends a notification message carrying the check operation indicating that the peering connection has failed. When the third inspection operation is to inspect the dedicated line channel, the dedicated line channel corresponding to the fault location information is determined based on the fault location information and the routing information of the dedicated line channel. The operating status of the dedicated line channel is determined. If the operating status is inaccurate, a notification message is sent indicating that the dedicated line channel has malfunctioned.

7. A configuration checking device for an overlapping network, characterized in that, include: The fault reporting request acquisition module is used to acquire fault reporting requests from users on overlapping networks; The fault reporting request includes: fault reporting IP address pair, fault reporting port information, and fault reporting location information; the fault reporting IP address pair includes the fault reporting load balancer address and the fault reporting cloud server IP address. The first inspection operation execution module is used to perform a first inspection operation on the listener, domain name and URL path of the cloud load balancer when it is determined that the faulty IP address pair is the address of the cloud load balancer device, based on the faulty port information. The second inspection operation execution module is used to perform a second inspection operation on the security group configuration and port configuration of the cloud server device based on the reported IP address pair when it is determined that the faulty IP address pair is the address of the cloud server device. The third inspection operation execution module is used to determine and execute the third inspection operation corresponding to the fault location information when it is determined that the fault-reporting IP address pair is neither the address of the cloud load balancer nor the address of the cloud server device, based on the association between the fault location information and the corresponding third inspection operation; the third inspection operation includes inspection operations on NAT gateway, peer-to-peer connection and leased channel; The notification information generation module is used to generate notification information carrying the inspection results of the inspection operation.

8. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the method of any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the method of any one of claims 1 to 6.

10. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the method of any one of claims 1 to 6.

Images