Network management configuration method and device, electronic equipment and storage medium

Abstract

The embodiment of the invention provides a network management configuration method and device, electronic equipment and a storage medium. The network management configuration method comprises the following steps: acquiring demand parameter information of a to-be-processed private line of a virtual private network; obtaining address pool configuration information of the to-be-processed private line according to the demand parameter information, and generating gateway network protocol IP address configuration information of the to-be-processed private line according to the address pool configuration information; when the to-be-processed special line is a non-center-point special line, based on the address pool configuration information and the gateway IP address configuration information, a packet filtering access control list in the sub-interface incoming direction of the to-be-processed special line is generated, and the packet filtering access control list is used for indicating to prohibit access between non-center-point special lines; and performing network management configuration on a to-be-processed private line according to the address pool configuration information, the gateway IP address configuration information and the packet filtering access control list. According to the embodiment of the invention, communication isolation among all non-center-point special lines can be realized.

Description

Technical Field

[0001] The present application relates to the field of network technology, and in particular to a network management configuration method, device, electronic device and storage medium. Background Art

[0002] The star network is a network or device connected to a central point dedicated line as the central node, and other non-central point dedicated lines are connected to the central node separately. The central node adopts a centralized communication control strategy, and non-central point dedicated lines cannot communicate directly, but need to communicate through the central node. Therefore, the network management configuration of the star network needs to meet the above characteristics of the star network.

[0003] In the current traditional MPLS (Multiprotocol Label Switching) VPN (Virtual Private Network) star network network management configuration method, by configuring paired Export RT (RouteTarget) values ​​and Import RT values ​​for the VPN instances of the central point dedicated line and the PE (Provider Edge) devices where the non-central point dedicated lines are located, the route learning isolation between the PEs where the non-central point dedicated lines are located is achieved, and the purpose of communication isolation between the non-central point dedicated lines is achieved, thereby realizing star networking.

[0004] However, in the above network management configuration method, communication isolation is achieved through routing learning isolation between PEs, so only communication isolation between non-central point dedicated lines under different PEs can be achieved, while communication isolation between non-central point dedicated lines under the same PE cannot be achieved. Therefore, communication isolation between all non-central point dedicated lines cannot be achieved, and the user's security isolation needs cannot be met. Summary of the invention

[0005] In view of the above problems, the embodiments of the present application propose a network management configuration method, device, electronic device and storage medium to solve the problem that communication isolation between all non-central point dedicated lines cannot be achieved.

[0006] According to one aspect of an embodiment of the present application, a network management configuration method is provided, the method comprising:

[0007] Obtaining demand parameter information of pending dedicated lines of a virtual private network;

[0008] Acquire the address pool configuration information of the dedicated line to be processed according to the demand parameter information, and generate the gateway network protocol IP address configuration information of the dedicated line to be processed according to the address pool configuration information;

[0009] When the dedicated line to be processed is a non-central point dedicated line, based on the address pool configuration information and the gateway IP address configuration information, a packet filtering access control list for the incoming direction of the sub-interface of the dedicated line to be processed is generated, wherein the packet filtering access control list is used to indicate that access between non-central point dedicated lines is prohibited;

[0010] The network management configuration of the dedicated line to be processed is performed according to the address pool configuration information, the gateway IP address configuration information and the packet filtering access control list.

[0011] Optionally, the demand parameter information includes a group access number; obtaining the address pool configuration information of the dedicated line to be processed based on the demand parameter information includes: judging whether the dedicated line to be processed is the first dedicated line in the virtual private network based on the group access number; when the dedicated line to be processed is the first dedicated line, configuring the address pool configuration information of the dedicated line to be processed; when the dedicated line to be processed is not the first dedicated line, retrieving the address pool configuration information configured for the virtual private network as the address pool configuration information of the dedicated line to be processed.

[0012] Optionally, the address pool includes a virtual private network address pool, a central point dedicated line address pool and a non-central point dedicated line address pool; the configuration of the address pool configuration information of the dedicated line to be processed includes: configuring the first segment of the virtual private network address pool to be the first segment of the designated public network address segment, and the second segment of the virtual private network address pool to be the last N bits of the routing identifier of the virtual private network, where N is a positive integer; configuring the first segment of the central point dedicated line address pool to be the first segment of the designated public network address segment, and the second segment of the central point dedicated line address pool to be the last N bits of the routing identifier of the virtual private network, where N is a positive integer. The third segment of the central point dedicated line address pool is the first value used at the end of the provider edge device network management IP address; the first segment of the non-central point dedicated line address pool is configured as the first segment of the designated public network address segment, the second segment of the non-central point dedicated line address pool is the last N bits of the routing identifier of the virtual private network, and the third segment of the non-central point dedicated line address pool is the second value used at the end of the provider edge device network management IP address; the frequency of use of the first value at the end of the provider edge device network management IP address is less than the frequency of use of the second value at the end of the provider edge device network management IP address.

[0013] Optionally, the demand parameter information includes the number of dedicated line IP addresses, and the address pool includes a center point dedicated line address pool and a non-center point dedicated line address pool; the gateway network protocol IP address configuration information of the dedicated line to be processed is generated according to the address pool configuration information, including: when the dedicated line to be processed is a center point dedicated line, obtaining a mask with a number of subnet IP addresses greater than or equal to the number of dedicated line IP addresses as the mask of the dedicated line to be processed, and obtaining the first available IP address in the center point dedicated line address pool as the gateway IP address of the dedicated line to be processed; when the dedicated line to be processed is a non-center point dedicated line, dividing the non-center point dedicated line address pool into multiple subnets according to the set number of IP addresses, calculating the mask of the dedicated line to be processed according to the set IP number, and using the first available IP address of the first subnet as the main gateway IP address of the dedicated line to be processed, and the first available IP addresses of the remaining subnets as the sub-gateway IP addresses of the dedicated line to be processed.

[0014] Optionally, the address pool includes a virtual private network address pool and a center point dedicated line address pool; based on the address pool configuration information and the gateway IP address configuration information, a packet filtering access control list for the incoming direction of the sub-interface of the dedicated line to be processed is generated, including: configuring the rules in the packet filtering access control list in the following order: allowing the IP address to access the center point dedicated line address pool, allowing the IP address to access the gateway IP address of the non-center point dedicated line of the virtual private network, denying the IP address to access the virtual private network address pool, and allowing the IP address to access.

[0015] Optionally, the demand parameter information includes networking mode, gateway configuration mode, network topology type, provider edge device port interconnection IP address / subnet mask, and user edge device port interconnection IP address / subnet mask; the address pool configuration information of the dedicated line to be processed is obtained according to the demand parameter information, and the gateway network protocol IP address configuration information of the dedicated line to be processed is generated according to the address pool configuration information, including: when the networking mode is a three-layer virtual private network, the gateway configuration mode is an independent gateway, the network topology type is a full star network, the provider edge device port interconnection IP address / subnet mask is left blank, and the user edge device port interconnection IP address / subnet mask is left blank, the address pool configuration information of the dedicated line to be processed is obtained according to the demand parameter information, and the gateway network protocol IP address configuration information of the dedicated line to be processed is generated according to the address pool configuration information.

[0016] Optionally, the demand parameter information includes a network topology type; before performing network management configuration on the dedicated line to be processed according to the address pool configuration information, the gateway IP address configuration information and the packet filtering access control list, it also includes: when the network topology type is a complete star network, configuring the import target of the virtual private network and the export target of the virtual private network are both target information, and the target information is the information obtained by adding a set mark after the routing identifier of the virtual private network; performing network management configuration on the dedicated line to be processed according to the address pool configuration information, the gateway IP address configuration information and the packet filtering access control list includes: performing network management configuration on the dedicated line to be processed according to the address pool configuration information, the gateway IP address configuration information, the packet filtering access control list, the import target of the virtual private network and the export target of the virtual private network.

[0017] Optionally, when the dedicated line to be processed is a non-central point dedicated line and the demand parameter information includes the intercommunication requirement between the dedicated line to be processed and the target non-central point dedicated line, the packet filtering access control list is also used to indicate that access is allowed between the dedicated line to be processed and the target non-central point dedicated line.

[0018] According to another aspect of an embodiment of the present application, a network management configuration device is provided, the device comprising:

[0019] An acquisition module, used to acquire demand parameter information of a dedicated line to be processed in a virtual private network;

[0020] A first generating module is used to obtain the address pool configuration information of the dedicated line to be processed according to the demand parameter information, and generate the gateway network protocol IP address configuration information of the dedicated line to be processed according to the address pool configuration information;

[0021] A second generating module is used to generate a packet filtering access control list for the incoming sub-interface of the dedicated line to be processed based on the address pool configuration information and the gateway IP address configuration information when the dedicated line to be processed is a non-central point dedicated line, wherein the packet filtering access control list is used to indicate that access between non-central point dedicated lines is prohibited;

[0022] A configuration module is used to perform network management configuration on the dedicated line to be processed according to the address pool configuration information, the gateway IP address configuration information and the packet filtering access control list.

[0023] Optionally, the demand parameter information includes a group access number; the first generation module includes: a judgment unit, used to judge whether the dedicated line to be processed is the first dedicated line in the virtual private network according to the group access number; an address configuration unit, used to configure the address pool configuration information of the dedicated line to be processed when the dedicated line to be processed is the first dedicated line; and a calling unit, used to call the address pool configuration information configured for the virtual private network as the address pool configuration information of the dedicated line to be processed when the dedicated line to be processed is not the first dedicated line.

[0024] Optionally, the address pool includes a virtual private network address pool, a central point dedicated line address pool and a non-central point dedicated line address pool; the address configuration unit is specifically used to: configure the first segment of the virtual private network address pool to be the first segment of the designated public network address segment, and the second segment of the virtual private network address pool to be the last N bits of the routing identifier of the virtual private network, where N is a positive integer; configure the first segment of the central point dedicated line address pool to be the first segment of the designated public network address segment, and the second segment of the central point dedicated line address pool to be the last N bits of the routing identifier of the virtual private network, where N is a positive integer. The third segment of the dedicated line address pool is the first value used at the end of the provider edge device network management IP address; the first segment of the non-central point dedicated line address pool is configured as the first segment of the designated public network address segment, the second segment of the non-central point dedicated line address pool is the last N bits of the routing identifier of the virtual private network, and the third segment of the non-central point dedicated line address pool is the second value used at the end of the provider edge device network management IP address; the frequency of use of the first value at the end of the provider edge device network management IP address is less than the frequency of use of the second value at the end of the provider edge device network management IP address.

[0025] Optionally, the demand parameter information includes the number of dedicated line IP addresses, and the address pool includes a center point dedicated line address pool and a non-center point dedicated line address pool; the first generation module includes: a first address generation unit, which is used to obtain a mask with a number of subnet IP addresses greater than or equal to the number of dedicated line IP addresses as the mask of the dedicated line to be processed when the dedicated line to be processed is a center point dedicated line, and obtain the first available IP address in the center point dedicated line address pool as the gateway IP address of the dedicated line to be processed; a second address generation unit, which is used to divide the non-center point dedicated line address pool into multiple subnets according to the set number of IP addresses when the dedicated line to be processed is a non-center point dedicated line, calculate the mask of the dedicated line to be processed according to the set IP number, use the first available IP address of the first subnet as the main gateway IP address of the dedicated line to be processed, and use the first available IP addresses of the remaining subnets as the sub-gateway IP addresses of the dedicated line to be processed.

[0026] Optionally, the address pool includes a virtual private network address pool and a center point dedicated line address pool; the second generation module is specifically used to configure the rules in the packet filtering access control list in the following order: allow the IP address to access the center point dedicated line address pool, allow the IP address to access the gateway IP address of the non-center point dedicated line of the virtual private network, deny the IP address to access the virtual private network address pool, and allow the IP address to access.

[0027] Optionally, the demand parameter information includes networking mode, gateway configuration mode, network topology type, provider edge device port interconnection IP address / subnet mask, and user edge device port interconnection IP address / subnet mask; the first generation module is specifically used to obtain the address pool configuration information of the dedicated line to be processed according to the demand parameter information, and generate the gateway network protocol IP address configuration information of the dedicated line to be processed according to the address pool configuration information when the networking mode is a three-layer virtual private network, the gateway configuration mode is an independent gateway, the network topology type is a full star network, the provider edge device port interconnection IP address / subnet mask is left blank, and the user edge device port interconnection IP address / subnet mask is left blank.

[0028] Optionally, the demand parameter information includes a network topology type; the device also includes: a third generation module, used to configure the import target of the virtual private network and the export target of the virtual private network as target information when the network topology type is a complete star network, and the target information is the information obtained by adding a set mark after the routing identifier of the virtual private network; the configuration module is specifically used to perform network management configuration on the dedicated line to be processed according to the address pool configuration information, the gateway IP address configuration information, the packet filtering access control list, the import target of the virtual private network and the export target of the virtual private network.

[0029] Optionally, when the dedicated line to be processed is a non-central point dedicated line and the demand parameter information includes the intercommunication requirement between the dedicated line to be processed and the target non-central point dedicated line, the packet filtering access control list is also used to indicate that access is allowed between the dedicated line to be processed and the target non-central point dedicated line.

[0030] According to another aspect of an embodiment of the present application, an electronic device is provided, comprising a processor and a computer-readable storage medium, wherein a computer program is stored on the computer-readable storage medium; when the computer program is executed by the processor, the processor executes the network management configuration method as described in any one of the above items.

[0031] According to another aspect of an embodiment of the present application, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the processor executes the network management configuration method as described in any one of the above items.

[0032] In the embodiment of the present application, the method of configuring paired ExportRT values ​​and Import RT values ​​for the VPN instances of the PE devices where the center point dedicated lines and non-center point dedicated lines are located is no longer adopted. Instead, a packet filtering access control list is configured in the inbound direction of the sub-interface of the non-center point dedicated line based on the address pool configuration information of the dedicated line to be processed and the gateway IP (Internet Protocol) address configuration information of the dedicated line to be processed. The packet filtering access control list is used to indicate that access between non-center point dedicated lines is prohibited. Therefore, it is no longer limited to the communication isolation between non-center point dedicated lines under different PEs, and communication isolation between all non-center point dedicated lines can be achieved. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] In order to more clearly illustrate the technical solution of the embodiment of the present application, the drawings required for use in the description of the embodiment of the present application will be briefly introduced below. Obviously, the drawings described below are only some drawings of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0034] Figure 1 It is a business processing flow chart of an embodiment of the present application;

[0035] Figure 2 It is a flowchart of the steps of a network management configuration method according to an embodiment of the present application;

[0036] Figure 3 It is a structural block diagram of a network management configuration device according to an embodiment of the present application;

[0037] Figure 4 is a structural block diagram of an electronic device according to an embodiment of the present application;

[0038] Figure 5 It is a structural block diagram of a computer-readable storage medium in an embodiment of the present application. DETAILED DESCRIPTION

[0039] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0040] In the current network management configuration method of the star network, this is achieved by configuring a pair of ExportRT values ​​and ImportRT values ​​for the VPN instances of the PE devices where the central point dedicated line and the non-central point dedicated line are located. However, this network management configuration method has the following problems:

[0041] (1) Some non-central point dedicated lines cannot be isolated: Traditional star networks achieve communication isolation through routing learning isolation between PEs. Therefore, they can only achieve communication isolation between non-central point dedicated lines under different PEs, but not between non-central point dedicated lines under the same PE. This cannot meet the demand for communication isolation between all non-central point dedicated lines, cannot adapt to VPN networking services within the metropolitan area network, and cannot meet user security isolation requirements.

[0042] (2) Difficulty in implementing automatic construction of interconnection between multiple central point dedicated lines: When VPN requires multiple central point dedicated lines, according to the existing specifications, a pair of ExportRT value and Import RT value is configured, and the central point dedicated lines on different PEs cannot be interconnected. To achieve interconnection between central point dedicated lines, when the second central point dedicated line is received, it is necessary to add RT configuration to the PEs where all existing central point dedicated lines are located. The automatic construction of network management is complicated. If the central point dedicated line is added in the later operation of VPN, it is complicated to implement, and all existing PEs need to add RT configuration, which is difficult to implement automatic construction of network management.

[0043] In the embodiment of the present application, the requirements for communication isolation between all non-central dedicated lines can be met, and the intercommunication between the central point dedicated lines can be realized, a complete star-shaped network can be realized, the customer's security networking requirements can be met, and the market competitiveness can be improved. It can be adapted to the automatic construction of IP network management configuration, reduce the workload of manual configuration, reduce manual mis-input, and improve the efficiency and accuracy of dedicated line construction. The following is a detailed introduction.

[0044] Reference Figure 1 , shows a business processing flow chart of an embodiment of the present application.

[0045] like Figure 1As shown, the overall process includes business acceptance, resource allocation, IP network management construction, and external line construction. After the business acceptance is completed, the resource allocation is entered. If the resource allocation is normal, after the resource allocation is completed, the IP network management construction is entered. If the resource allocation is abnormal, the business acceptance is returned to the business acceptance. If the IP network management construction is normal, after the IP network management construction is completed, the external line construction is entered. If the IP network management construction is abnormal, the business acceptance is returned to the business acceptance. If the IP network management construction is abnormal, the resources are abnormal. If the external line construction is normal, after the external line construction is completed, the receipt is returned normally. If the external line construction is abnormal, the business acceptance is returned to the business acceptance. If the resources are abnormal, the resource allocation is returned to the resource allocation.

[0046] In the service acceptance phase, the account manager initiates the MPLS VPN dedicated line service acceptance in the service management system according to the customer's networking needs, and fills in the necessary dedicated line networking parameters. After the network access resources are allocated in the resource allocation phase, the networking parameter information and access resource information are sent to the IP network management for construction. In the IP network management construction phase, the network management automatic construction system replaces manual login to the relevant network equipment to automatically implement the dedicated line service configuration, and finally sends it to the external line construction phase, where the installation and maintenance engineers complete the customer's on-site service installation and debugging. Resource anomalies or acceptance anomalies found in the IP network management construction phase and the external line construction phase can be returned to the relevant phase.

[0047] The network management configuration method in the embodiment of the present application is applied to the above-mentioned IP network management construction link.

[0048] Reference Figure 2 , showing a step flow chart of a network management configuration method according to an embodiment of the present application.

[0049] like Figure 2 As shown, the network management configuration method may include the following steps:

[0050] Step 201, obtaining the demand parameter information of the dedicated line to be processed of the virtual private network.

[0051] In the embodiment of the present application, the demand parameter information of the dedicated line to be processed may include: the networking parameter information configured for the dedicated line to be processed in the service acceptance stage, and the access resource information allocated to the dedicated line to be processed in the resource allocation stage.

[0052] The networking parameter information configured in the service acceptance link determines the network management configuration scheme in the IP network management construction link. Some networking parameter information needs to be conditionally judged and limited in selection or format. The networking parameter information in the embodiment of the present application can refer to the following networking parameter information table, but in actual applications, the networking parameter information is not limited to these parameters, and this embodiment does not limit this.

[0053] Table 1 Network parameter information table

[0054]

[0055]

[0056]

[0057] A full star network is one in which each node is directly connected to the central node via a separate line. A normal star network is similar to a full star network, in which the nodes are still directly connected to the central node, but there may be some shared connections or less redundant paths.

[0058] According to the access resources allocated in the resource allocation link, the PE related information of the construction can be determined. For example, the access resource information may include but is not limited to: PE device type, PE network management IP address, PE port number, PVLAN (Private Virtual Local Area Network), CVLAN (Customer Virtual Local Area Network), etc.

[0059] Step 202: Acquire the address pool configuration information of the dedicated line to be processed according to the demand parameter information, and generate the gateway IP address configuration information of the dedicated line to be processed according to the address pool configuration information.

[0060] According to the demand parameter information of the dedicated line to be processed, including the networking parameter information configured for the dedicated line to be processed in the business acceptance stage and the access resource information allocated for the dedicated line to be processed in the resource allocation stage, the network management configuration plan for the dedicated line to be processed can be determined.

[0061] In the embodiment of the present application, when the networking mode is a three-layer virtual private network, the gateway configuration mode is an independent gateway, the network topology type is a complete star network, the provider edge device port interconnection IP address / subnet mask is left blank, and the user edge device port interconnection IP address / subnet mask is left blank, the network management configuration scheme of the embodiment of the present application is configured. In this case, the address pool configuration information of the dedicated line to be processed is obtained according to the demand parameter information, and the gateway network protocol IP address configuration information of the dedicated line to be processed is generated according to the address pool configuration information.

[0062] In the embodiment of the present application, the address pool configuration information of the dedicated line to be processed can be obtained first according to the demand parameter information of the dedicated line to be processed.

[0063] In an optional implementation, the process of obtaining the address pool configuration information of the dedicated line to be processed according to the demand parameter information may include: judging whether the dedicated line to be processed is the first dedicated line in the VPN according to the group access number; when the dedicated line to be processed is the first dedicated line, configuring the address pool configuration information of the dedicated line to be processed; when the dedicated line to be processed is not the first dedicated line, retrieving the address pool configuration information configured for the VPN as the address pool configuration information of the dedicated line to be processed. In this method, when the dedicated line to be processed is not the first dedicated line, it indicates that the address pool configuration information has been configured for the VPN, so there is no need to repeatedly configure the address pool, thereby avoiding unnecessary processing and saving processing resources.

[0064] Since one VPN corresponds to one group access number, the process of judging whether the dedicated line to be processed is the first dedicated line in the VPN according to the group access number includes: if the group access number of the dedicated line to be processed exists in the group access number of the configured VPN, determining that the dedicated line to be processed is the first dedicated line in the VPN; otherwise, determining that the dedicated line to be processed is not the first dedicated line in the VPN.

[0065] Exemplarily, the address pool includes a VPN address pool, a central point dedicated line address pool, and a non-central point dedicated line address pool, wherein the central point dedicated line and the non-central point dedicated line are located in the VPN.

[0066] Exemplarily, the process of configuring the address pool configuration information of the dedicated line to be processed may include:

[0067] The first segment of the VPN address pool is configured to be the first segment of the designated public network address segment, and the second segment of the VPN address pool is the last N bits of the routing identifier of the virtual private network, where N is a positive integer;

[0068] The first segment of the central point dedicated line address pool is configured as the first segment of the designated public network address segment, the second segment of the central point dedicated line address pool is the last N bits of the route distinguisher of the VPN, and the third segment of the central point dedicated line address pool is the first value used for the last segment of the PE network management IP address;

[0069] The first segment of the non-central point dedicated line address pool is configured as the first segment of the designated public network address segment, the second segment of the non-central point dedicated line address pool is configured as the last N bits of the routing identifier of the VPN, and the third segment of the non-central point dedicated line address pool is configured as the second value used at the end of the PE network management IP address.

[0070] In the embodiment of the present application, in order to avoid the conflict between the dedicated line IP address and the customer's intranet and potential future network connection conflicts, the VPN address pool is not allocated with common private network IP address segments, such as 10.0.0.0 / 8, 172.16.0.0 / 20, 192.168.0.0 / 16, etc., but with a designated public network address segment, which is an uncommon public network address segment. Therefore, the first segment of the VPN address pool can be the first segment of the above-mentioned designated public network address segment. This embodiment does not limit the specific information of the designated public network address segment.

[0071] In the embodiment of the present application, the second segment of the VPN address pool is the last N digits of the route distinguisher of the VPN. The specific value of N can be set according to actual needs, and this embodiment does not limit this. For example, N can be 2, 3, and so on. According to this rule, the address pool planning scale is a 7-digit number assigned to the route distinguisher, but the first few digits of each branch are fixed values. Therefore, configuring a VPN address pool that is regularly associated with the route distinguisher and the access device can reduce the amount of memory required for manual maintenance, which is beneficial to network maintenance and troubleshooting by network management personnel.

[0072] In the embodiment of the present application, the first segment and the second segment of the center point dedicated line address pool are the same as the first segment and the second segment of the VPN address pool, and the third segment of the center point dedicated line address pool is the first value used at the end of the PE network management IP address. The first segment and the second segment of the non-center point dedicated line address pool are the same as the first segment and the second segment of the VPN address pool, and the third segment of the non-center point dedicated line address pool is the second value used at the end of the PE network management IP address. Among them, the frequency of use of the first value at the end of the PE network management IP address is less than the frequency of use of the second value at the end of the PE network management IP address. Therefore, the first value that is not frequently used in the end of the PE network management IP address can be used as the third segment of the center point dedicated line address pool, so that the network segment of the center point dedicated line address pool can be released in the subsequently generated packet filtering access control list.

[0073] For example, the first segment of the VPN address pool is assigned to the first segment of a Class B network segment starting with 100, the second segment of the VPN address pool is taken from the last N bits of the VPN route distinguisher, and the third segment of each dedicated line is assigned to the third segment of a Class C network segment in the Class B network segment, and the third segment of the Class C network segment is taken from the last segment of the PE network management IP address. For example, the VPN address pool is generated as 100.X.0.0 / 16, and the address pool of each dedicated line is 100.XY0 / 24, where X is the last N bits of the VPN route distinguisher and Y is the last segment of the PE network management IP address. Plan the first segment of the Class B network segment starting with 101 as the backup address pool segment, and the allocation rules are the same as above.

[0074] For example, since PE network management IP addresses generally do not use 0 and 1 as the last segment, the two Class C network segments Y=0 and Y=1 are fixed as the address pool network segments of each central point dedicated line. The address segments at the end of the remaining PE network management IP addresses are used as the non-central point dedicated line address pool network segments.

[0075] The address pool configuration information in this embodiment can refer to the following address pool configuration information table.

[0076] Table 2 Address pool configuration information table

[0077]

[0078] In the embodiment of the present application, the gateway IP address configuration information of the dedicated line to be processed is generated according to the address pool configuration information.

[0079] In an optional implementation, the process of generating the gateway network protocol IP address configuration information of the dedicated line to be processed according to the address pool configuration information may include:

[0080] When the dedicated line to be processed is a central point dedicated line, a mask whose number of subnet IP addresses is greater than or equal to the number of dedicated line IP addresses is obtained as the mask of the dedicated line to be processed, and the first available IP address in the central point dedicated line address pool is obtained as the gateway IP address of the dedicated line to be processed;

[0081] When the dedicated line to be processed is a non-central point dedicated line, the address pool of the non-central point dedicated line is divided into multiple subnets according to the set number of IP addresses, the mask of the dedicated line to be processed is calculated according to the set number of IP addresses, and the first available IP address of the first subnet is used as the main gateway IP address of the dedicated line to be processed, and the first available IP addresses of the remaining subnets are used as the sub-gateway (sub gateway) IP addresses of the dedicated line to be processed.

[0082] The number of dedicated IP addresses is configured in the networking parameter information. There is a corresponding relationship between the number of subnet IP addresses and the mask. Specifically, the number of subnet IP addresses = 2 m, m = 32-the number of "1" bits in the mask, so the mask in which the number of subnet IP addresses is greater than or equal to the number of dedicated line IP addresses can be calculated. The number of subnet IP addresses can be equal to the number of dedicated line IP addresses or greater than the number of dedicated line IP addresses.

[0083] The set number of IP addresses can be determined according to the number of dedicated line IP addresses. For example, when the number of dedicated line IP addresses is a multiple of 8, the set number of IP addresses can be 8, and so on, which can be set according to actual needs. Similarly, based on the corresponding relationship between the number of subnet IP addresses and the mask, the mask of the dedicated line to be processed can be calculated according to the set number of IP addresses.

[0084] Step 203, when the dedicated line to be processed is a non-central point dedicated line, a packet filtering access control list for the incoming direction of the sub-interface of the dedicated line to be processed is generated based on the address pool configuration information and the gateway IP address configuration information, and the packet filtering access control list is used to indicate that access between non-central point dedicated lines is prohibited.

[0085] According to the "Is it a center point dedicated line" parameter in the demand parameters, it can be determined whether the dedicated line to be processed is a center point dedicated line.

[0086] In order to achieve communication isolation between all non-central point dedicated lines and intercommunication between dedicated lines at different central points, when the dedicated line to be processed is a non-central point dedicated line, a packet filter (PacketFilter) access control list (AccessControl List, ACL) in the inbound direction of the sub-interface of the dedicated line to be processed can be generated based on the address pool configuration information and the gateway IP address configuration information. The packet filter access control list is used to indicate that access between non-central point dedicated lines is prohibited, thereby achieving communication isolation between all non-central point dedicated lines, and the packet filter access control list is not configured for the central point dedicated line, so that the communication between the central point dedicated lines will not be isolated, thereby achieving intercommunication between dedicated lines at different central points.

[0087] Packet filtering access control lists can be used on network devices or firewalls to filter and control the flow and access rights of data packets. It consists of a series of rules that define which network traffic is allowed or denied to pass through a specific network device. When a data packet passes through a network device configured with an ACL, the device will check the data packet according to the rules defined in the ACL. If the data packet matches a rule in the ACL, the device will perform the action specified by the rule, that is, allow or deny the transmission of the data packet. The execution order of ACL rules is usually based on the rule number from small to large. Once a data packet matches a rule, subsequent rules will no longer be checked.

[0088] Exemplarily, the process of generating a packet filtering access control list for the incoming direction of the sub-interface of the dedicated line to be processed based on the address pool configuration information and the gateway IP address configuration information includes: configuring the rules in the packet filtering access control list in the following order: allowing the IP address to access the central point dedicated line address pool, allowing the IP address to access the gateway IP address of the non-central point dedicated line of the virtual private network, denying the IP address to access the virtual private network address pool, and allowing the IP address to access.

[0089] For example, a packet filtering access control list can be named using the "ACL-group access number" method and can be configured as an advanced access control list. The rules in a packet filtering access control list can be as shown in the following table.

[0090] Table 3 Rules table

[0091]

[0092] In the embodiment of the present application, according to the VPN address pool planning rules described above, the IP addresses of the center point dedicated line are 100.X.0.0 / 23 and 101.X.0.0 / 23, so the wildcard 1.0.1.255 can match the IP address of the center point dedicated line; the gateway IP addresses of all non-center point dedicated lines are multiples of 8 plus 1, so the wildcard 1.0.255.248 can match the gateway IP address of the VPN non-center point dedicated line. Each non-center point dedicated line needs to configure this policy in the inbound (in) direction of the sub-interface to achieve mutual communication isolation between all non-center point dedicated lines; the center point dedicated line does not configure this policy.

[0093] When a non-central point dedicated line accesses a central point dedicated line, the message generated will match rule number 1 and be allowed to be forwarded; when a non-central point dedicated line needs to test gateway connectivity, the message sent will match rule number 2 and be allowed to be forwarded; when non-central point dedicated lines access each other, the message sent will match rule number 100 and be discarded; when a non-central point dedicated line accesses a network segment outside the VPN address pool, the message sent will match rule number 101 and be allowed to be forwarded.

[0094] Exemplarily, considering that there may be a need for intercommunication between individual non-central point dedicated lines, when the dedicated line to be processed is a non-central point dedicated line, and the demand parameter information includes the need for intercommunication between the dedicated line to be processed and the target non-central point dedicated line, the packet filtering access control list is also used to indicate that access is allowed between the dedicated line to be processed and the target non-central point dedicated line. For example, a corresponding rule can be inserted between the sequence numbers 2 and 100 of the packet filtering access control list of the PE where the relevant non-central point dedicated line is located to allow the IP address of the relevant non-central point dedicated line to be allowed. As for the specific process, it can be processed according to actual needs, and this embodiment will not be discussed in detail here. In this way, the complex problem of needing to modify all access PEs of the existing non-central point dedicated lines that exist in the traditional configuration can be solved.

[0095] Step 204: Perform network management configuration on the dedicated line to be processed according to the address pool configuration information, the gateway IP address configuration information and the packet filtering access control list.

[0096] After the address pool configuration information, the gateway IP address configuration information and the packet filtering access control list are determined, the network management configuration of the dedicated line to be processed can be automatically performed according to the address pool configuration information, the gateway IP address configuration information and the packet filtering access control list.

[0097] In the implementation, first, a PE configuration script can be generated according to the above configuration rules. This script contains commands for configuring the PE to the desired state. Then, the SSH (Secure Shell) protocol can be used to log in to the PE and establish a secure connection with the PE. SSH is an encrypted network protocol used to securely transmit data in an insecure network. Next, the device line command can be used for interactive configuration. Once the SSH connection is established, the system sends the commands in the previously generated configuration script through the command line interface of the PE. These commands are executed in sequence to configure the PE to the desired state. After the configuration is completed, the system can also perform configuration verification to ensure that the PE has been configured as expected, which may include checking the syntax of the configuration file, testing the network connection, verifying the routing policy, etc. If the configuration is successful, the system may generate a confirmation report or status update to notify the requester or service provider that the configuration has been completed. If the configuration fails, the system may generate an error report indicating the problem and providing possible solutions. The entire process realizes the automation of network configuration, reduces the errors and delays caused by manual configuration, and improves the efficiency of network deployment and management.

[0098] In the embodiment of the present application, in addition to the above-mentioned address pool configuration information, the gateway IP address configuration information and the packet filtering access control list, some other parameters can also be configured.

[0099] For example, before the network management configuration of the dedicated line to be processed is performed according to the address pool configuration information, the gateway IP address configuration information and the packet filtering access control list, it also includes: when the network topology type is a complete star network, the import target of the virtual private network and the export target of the virtual private network are configured as target information, and the target information is the information obtained by adding a set mark after the routing identifier of the virtual private network. In this way, there is no need to configure the import target and the export target to achieve communication isolation between non-central point dedicated lines, which simplifies the configuration process of the import target and the export target.

[0100] Correspondingly, according to the address pool configuration information, the gateway IP address configuration information and the packet filtering access control list, the network management configuration of the dedicated line to be processed is performed, including: according to the address pool configuration information, the gateway IP address configuration information, the packet filtering access control list, the import target of the virtual private network and the export target of the virtual private network, the network management configuration of the dedicated line to be processed is performed.

[0101] In some possible scenarios, the configuration information may be as shown in the following configuration information table.

[0102] Table 4 Configuration information table

[0103]

[0104]

[0105]

[0106]

[0107] Let's take a specific example to illustrate. The VPN group access number is GVPN123456, with a total of 1 central point dedicated line and 10 non-central point dedicated lines. After the dedicated lines are accepted one by one on the business acceptance system, the network management automatic construction system will allocate the address pool segment 100.23.0.0 / 16 and the backup address pool segment 101.23.0.0 / 16 for the VPN after receiving the first order. The gateway automatic construction system allocates the corresponding idle IP addresses in the VPN address pool one by one according to the order sequence of the dedicated lines, and logs in to the corresponding PE for configuration and construction.

[0108] The configured dedicated line IP addresses are shown in the following dedicated line IP address table:

[0109] Table 5 Dedicated line IP address table

[0110]

[0111] The configured isolation policy is shown in the following packet filtering access control list:

[0112] Table 6 Packet filtering access control list

[0113]

[0114]

[0115] In the embodiment of the present application, based on the planning of the VPN central point dedicated line and the non-central point dedicated line address pool, and configuring the packet filtering access control list in the inbound direction of the non-central point dedicated line sub-interface, the problem of the non-central point dedicated lines under the same PE cannot be isolated in the traditional configuration method. Different from the traditional star network, the star network configuration scheme proposed in the embodiment of the present application is based on the full mesh interconnection VPN. Therefore, VPN can add other central point dedicated lines at any time to realize the interconnection of dual central point dedicated lines and the interconnection with non-central point dedicated lines, without changing the configuration of the PE where the existing dedicated lines are located.

[0116] Reference Figure 3 , shows a structural block diagram of a network management configuration device according to an embodiment of the present application.

[0117] like Figure 3 As shown, the network management configuration device may include the following modules:

[0118] An acquisition module 301 is used to acquire demand parameter information of a dedicated line to be processed in a virtual private network;

[0119] The first generating module 302 is used to obtain the address pool configuration information of the dedicated line to be processed according to the demand parameter information, and generate the gateway network protocol IP address configuration information of the dedicated line to be processed according to the address pool configuration information;

[0120] The second generation module 303 is used to generate a packet filtering access control list for the incoming sub-interface of the dedicated line to be processed based on the address pool configuration information and the gateway IP address configuration information when the dedicated line to be processed is a non-central point dedicated line, wherein the packet filtering access control list is used to indicate that access between non-central point dedicated lines is prohibited;

[0121] The configuration module 304 is used to perform network management configuration on the dedicated line to be processed according to the address pool configuration information, the gateway IP address configuration information and the packet filtering access control list.

[0122] Optionally, the demand parameter information includes a group access number; the first generation module 302 includes: a judgment unit, used to judge whether the dedicated line to be processed is the first dedicated line in the virtual private network according to the group access number; an address configuration unit, used to configure the address pool configuration information of the dedicated line to be processed when the dedicated line to be processed is the first dedicated line; and a calling unit, used to call the address pool configuration information configured for the virtual private network as the address pool configuration information of the dedicated line to be processed when the dedicated line to be processed is not the first dedicated line.

[0123] Optionally, the address pool includes a virtual private network address pool, a central point dedicated line address pool and a non-central point dedicated line address pool; the address configuration unit is specifically used to: configure the first segment of the virtual private network address pool to be the first segment of the designated public network address segment, and the second segment of the virtual private network address pool to be the last N bits of the routing identifier of the virtual private network, where N is a positive integer; configure the first segment of the central point dedicated line address pool to be the first segment of the designated public network address segment, and the second segment of the central point dedicated line address pool to be the last N bits of the routing identifier of the virtual private network, where N is a positive integer; configure the first segment of the central point dedicated line address pool to be the first segment of the designated public network address segment, and the second segment of the central point dedicated line address pool to be the last N bits of the routing identifier of the virtual private network, and the central point dedicated line address pool to be The third segment of the address pool is the first value used at the end of the provider edge device network management IP address; the first segment of the non-central point dedicated line address pool is configured as the first segment of the designated public network address segment, the second segment of the non-central point dedicated line address pool is the last N bits of the routing identifier of the virtual private network, and the third segment of the non-central point dedicated line address pool is the second value used at the end of the provider edge device network management IP address; the frequency of use of the first value at the end of the provider edge device network management IP address is less than the frequency of use of the second value at the end of the provider edge device network management IP address.

[0124] Optionally, the demand parameter information includes the number of dedicated line IP addresses, and the address pool includes a center point dedicated line address pool and a non-center point dedicated line address pool; the first generation module 302 includes: a first address generation unit, which is used to obtain a mask with a number of subnet IP addresses greater than or equal to the number of dedicated line IP addresses as the mask of the dedicated line to be processed when the dedicated line to be processed is a center point dedicated line, and obtain the first available IP address in the center point dedicated line address pool as the gateway IP address of the dedicated line to be processed; a second address generation unit, which is used to divide the non-center point dedicated line address pool into multiple subnets according to the set number of IP addresses when the dedicated line to be processed is a non-center point dedicated line, calculate the mask of the dedicated line to be processed according to the set IP number, use the first available IP address of the first subnet as the main gateway IP address of the dedicated line to be processed, and use the first available IP addresses of the remaining subnets as the sub-gateway IP addresses of the dedicated line to be processed.

[0125] Optionally, the address pool includes a virtual private network address pool and a center point dedicated line address pool; the second generation module 303 is specifically used to configure the rules in the packet filtering access control list in the following order: allow the IP address to access the center point dedicated line address pool, allow the IP address to access the gateway IP address of the non-center point dedicated line of the virtual private network, deny the IP address to access the virtual private network address pool, and allow the IP address to access.

[0126] Optionally, the demand parameter information includes networking mode, gateway configuration mode, network topology type, provider edge device port interconnection IP address / subnet mask, and user edge device port interconnection IP address / subnet mask; the first generation module 302 is specifically used to obtain the address pool configuration information of the dedicated line to be processed according to the demand parameter information, and generate the gateway network protocol IP address configuration information of the dedicated line to be processed according to the address pool configuration information when the networking mode is a three-layer virtual private network, the gateway configuration mode is an independent gateway, the network topology type is a full star network, the provider edge device port interconnection IP address / subnet mask is left blank, and the user edge device port interconnection IP address / subnet mask is left blank.

[0127] Optionally, the demand parameter information includes a network topology type; the device also includes: a third generation module, used to configure the import target of the virtual private network and the export target of the virtual private network as target information when the network topology type is a complete star network, and the target information is the information obtained by adding a set mark after the routing identifier of the virtual private network; the configuration module 304 is specifically used to perform network management configuration on the dedicated line to be processed according to the address pool configuration information, the gateway IP address configuration information, the packet filtering access control list, the import target of the virtual private network and the export target of the virtual private network.

[0128] Optionally, when the dedicated line to be processed is a non-central point dedicated line and the demand parameter information includes the intercommunication requirement between the dedicated line to be processed and the target non-central point dedicated line, the packet filtering access control list is also used to indicate that access is allowed between the dedicated line to be processed and the target non-central point dedicated line.

[0129] In the embodiment of the present application, the method of configuring paired ExportRT values ​​and Import RT values ​​for the VPN instances of the PE devices where the center point dedicated lines and non-center point dedicated lines are located is no longer adopted. Instead, a packet filtering access control list is configured in the inbound direction of the sub-interface of the non-center point dedicated line based on the address pool configuration information of the dedicated line to be processed and the gateway IP address configuration information of the dedicated line to be processed. The packet filtering access control list is used to indicate that access between non-center point dedicated lines is prohibited. Therefore, it is no longer limited to the communication isolation between non-center point dedicated lines under different PEs, and communication isolation between all non-center point dedicated lines can be achieved.

[0130] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0131] In an embodiment of the present application, an electronic device is further provided. The electronic device may include a processor and a computer-readable storage medium, wherein a computer program is stored on the computer-readable storage medium; when the computer program is executed by the processor, the processor executes the network management configuration method of any of the above embodiments.

[0132] Reference Figure 4 , shows a structural block diagram of an electronic device according to an embodiment of the present application. Figure 4 As shown, the electronic device 40 includes a processor 401 and a computer-readable storage medium 402 , on which a computer program 4021 is stored.

[0133] The processor 401 is used to execute the computer program 4021 stored on the computer-readable storage medium 402. When executing the computer program 4021, the processor 401 implements the network management configuration method of any of the above embodiments and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0134] The processor 401 mentioned above may include but is not limited to: a central processing unit (CPU), a network processor (NP), a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.

[0135] The computer-readable storage medium 402 mentioned above may include but is not limited to: Read Only Memory (ROM), Random Access Memory (RAM), Compact Disc Read Only Memory (CD-ROM), Electronic Erasable Programmable Read Only Memory (EEPROM), hard disk, floppy disk, flash memory, and the like.

[0136] In an embodiment of the present application, a computer-readable storage medium is also provided, on which a computer program is stored. The computer program can be executed by a processor of an electronic device. When the computer program is executed by the processor, the processor executes the network management configuration method described in any of the above embodiments.

[0137] Reference Figure 5 , shows a block diagram of a computer-readable storage medium according to an embodiment of the present application. Figure 5 As shown, a computer program 501 is stored on a computer-readable storage medium 50. When the computer program 501 is executed by a processor, the processor executes the network management configuration method described in any of the above embodiments and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0138] The various embodiments in this specification are interrelated, and each embodiment is described in a progressive manner. Each embodiment focuses on the differences from other embodiments, and the same or similar parts between the various embodiments can be referenced to each other.

[0139] It should be noted that all actions to obtain signals, information or data in this application are carried out in compliance with the relevant data protection laws and policies of the location and with the authorization given by the owner of the corresponding device.

[0140] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "comprise one..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0141] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application.

[0142] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present application, ordinary technicians in this field can also make many forms without departing from the purpose of the present application and the scope of protection of the claims, all of which are within the protection of the present application.

[0143] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed in the present application can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0144] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0145] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0146] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0147] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. In summary, the content of this specification should not be understood as limiting the present application.

Claims

1. A network management configuration method, characterized in that: The method comprises: Obtaining demand parameter information of pending dedicated lines of a virtual private network; Acquire the address pool configuration information of the dedicated line to be processed according to the demand parameter information, and generate the gateway network protocol IP address configuration information of the dedicated line to be processed according to the address pool configuration information; When the dedicated line to be processed is a non-central point dedicated line, based on the address pool configuration information and the gateway IP address configuration information, a packet filtering access control list for the incoming direction of the sub-interface of the dedicated line to be processed is generated, wherein the packet filtering access control list is used to indicate that access between non-central point dedicated lines is prohibited; The network management configuration of the dedicated line to be processed is performed according to the address pool configuration information, the gateway IP address configuration information and the packet filtering access control list.

2. The method according to claim 1, characterized in that The demand parameter information includes a group access number; and obtaining the address pool configuration information of the dedicated line to be processed according to the demand parameter information includes: Determining whether the dedicated line to be processed is the first dedicated line in the virtual private network according to the group access number; When the dedicated line to be processed is the first dedicated line, configuring address pool configuration information of the dedicated line to be processed; When the dedicated line to be processed is not the first dedicated line, the address pool configuration information configured for the virtual private network is retrieved as the address pool configuration information of the dedicated line to be processed.

3. The method according to claim 2, characterized in that The address pool includes a virtual private network address pool, a central point dedicated line address pool and a non-central point dedicated line address pool; the address pool configuration information for configuring the dedicated line to be processed includes: The first segment of the virtual private network address pool is configured to be the first segment of the designated public network address segment, and the second segment of the virtual private network address pool is the last N bits of the routing identifier of the virtual private network, where N is a positive integer; The first segment of the central point dedicated line address pool is configured to be the first segment of the designated public network address segment, the second segment of the central point dedicated line address pool is the last N bits of the routing identifier of the virtual private network, and the third segment of the central point dedicated line address pool is the first value used for the last segment of the provider edge device network management IP address; The first segment of the non-central point dedicated line address pool is configured to be the first segment of the designated public network address segment, the second segment of the non-central point dedicated line address pool is configured to be the last N bits of the routing identifier of the virtual private network, and the third segment of the non-central point dedicated line address pool is configured to be the second value used at the end of the provider edge device network management IP address; The usage frequency of the first value at the end of the provider edge device network management IP address is less than the usage frequency of the second value at the end of the provider edge device network management IP address.

4. The method according to claim 1, characterized in that: The demand parameter information includes the number of dedicated line IP addresses, and the address pool includes a central point dedicated line address pool and a non-central point dedicated line address pool; the gateway network protocol IP address configuration information of the dedicated line to be processed is generated according to the address pool configuration information, including: When the dedicated line to be processed is a central point dedicated line, a mask whose number of subnet IP addresses is greater than or equal to the number of dedicated line IP addresses is obtained as the mask of the dedicated line to be processed, and the first available IP address in the central point dedicated line address pool is obtained as the gateway IP address of the dedicated line to be processed; When the dedicated line to be processed is a non-central point dedicated line, the address pool of the non-central point dedicated line is divided into multiple subnets according to the set number of IP addresses, the mask of the dedicated line to be processed is calculated according to the set number of IP addresses, and the first available IP address of the first subnet is used as the main gateway IP address of the dedicated line to be processed, and the first available IP addresses of the remaining subnets are used as the sub-gateway IP addresses of the dedicated line to be processed.

5. The method according to claim 1, characterized in that The address pool includes a virtual private network address pool and a central point dedicated line address pool; the packet filtering access control list for the incoming direction of the sub-interface of the dedicated line to be processed is generated based on the address pool configuration information and the gateway IP address configuration information, including: Configure the rules in the packet filtering access control list in the following order: allow IP addresses to access the central point dedicated line address pool, allow IP addresses to access the gateway IP address of the non-central point dedicated line of the virtual private network, deny IP addresses from accessing the virtual private network address pool, and allow IP addresses to access.

6. The method according to claim 1, characterized in that The demand parameter information includes a networking mode, a gateway configuration mode, a network topology type, a provider edge device port interconnection IP address / subnet mask, and a user edge device port interconnection IP address / subnet mask; the step of acquiring the address pool configuration information of the dedicated line to be processed according to the demand parameter information, and generating the gateway network protocol IP address configuration information of the dedicated line to be processed according to the address pool configuration information includes: When the networking mode is a three-layer virtual private network, the gateway configuration mode is an independent gateway, the network topology type is a full star network, the provider edge device port interconnection IP address / subnet mask is left blank, and the user edge device port interconnection IP address / subnet mask is left blank, the address pool configuration information of the dedicated line to be processed is obtained according to the demand parameter information, and the gateway network protocol IP address configuration information of the dedicated line to be processed is generated according to the address pool configuration information.

7. The method according to claim 1, characterized in that The demand parameter information includes a network topology type; Before performing network management configuration on the dedicated line to be processed according to the address pool configuration information, the gateway IP address configuration information and the packet filtering access control list, the method further includes: when the network topology type is a complete star network, configuring the import target of the virtual private network and the export target of the virtual private network to be target information, wherein the target information is information obtained by adding a setting mark after the routing identifier of the virtual private network; The network management configuration of the dedicated line to be processed is performed according to the address pool configuration information, the gateway IP address configuration information and the packet filtering access control list, including: performing network management configuration of the dedicated line to be processed according to the address pool configuration information, the gateway IP address configuration information, the packet filtering access control list, the import target of the virtual private network and the export target of the virtual private network.

8. The method according to claim 1, characterized in that When the dedicated line to be processed is a non-central point dedicated line and the demand parameter information includes the intercommunication requirement between the dedicated line to be processed and the target non-central point dedicated line, the packet filtering access control list is also used to indicate that access between the dedicated line to be processed and the target non-central point dedicated line is allowed.

9. A network management configuration device, characterized in that: The device comprises: An acquisition module, used to acquire demand parameter information of a dedicated line to be processed in a virtual private network; A first generating module is used to obtain the address pool configuration information of the dedicated line to be processed according to the demand parameter information, and generate the gateway network protocol IP address configuration information of the dedicated line to be processed according to the address pool configuration information; A second generating module is used to generate a packet filtering access control list for the incoming sub-interface of the dedicated line to be processed based on the address pool configuration information and the gateway IP address configuration information when the dedicated line to be processed is a non-central point dedicated line, wherein the packet filtering access control list is used to indicate that access between non-central point dedicated lines is prohibited; A configuration module is used to perform network management configuration on the dedicated line to be processed according to the address pool configuration information, the gateway IP address configuration information and the packet filtering access control list.

10. An electronic device, characterized in that: The electronic device comprises a processor and a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program; When the computer program is executed by the processor, the processor executes the network management configuration method according to any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the processor executes the network management configuration method according to any one of claims 1 to 8.

Images