Server network isolation design method based on technology fusion

Abstract

The invention discloses a server network isolation design method based on technology fusion, and the method comprises the steps: 1, distributing different VLANs and the same address field IP for each server, and distributing the same VLAN and the same network field IP for the management of each server node; step 2, the server area is accessed to a switch and only the VLAN of the server area is released; step 3, the core switch starts the VXLAN function of the equipment, configures a VXLAN three-layer gateway IP of the VM, manages the VLAN three-layer gateway IP and the like; and step 4, the next generation firewall of the server area adopts a bridge mode deployment mode, and security policies are configured in a centralized and unified manner. By adopting the networking design method provided by the invention, the east-west access traffic among the servers and the south-north access traffic of the servers are forwarded to the next-generation firewall and the core switch in the server area, so that the behavior of accessing the servers is controlled by the next-generation firewall and the core switch in an isolated manner.

Description

Technical Field

[0001] The invention relates to a design method for server network isolation, in particular to a server network isolation design method based on technology fusion. Background Art

[0002] In the mid-20th century, large computer rooms were used to house large computer systems. These early data centers focused on centralized computing resources and data storage. With the development of technology, especially the emergence of personal computers and the Internet, data centers began to expand their service scope, gradually adding network infrastructure and application hosting services. Entering the 21st century, with the rise of virtualization technology, cloud computing, and big data, data centers began to transform from traditional local physical servers to more flexible and efficient cloud infrastructure. As a hub for storing and processing various critical information, the security of data centers must be ensured, and isolating and protecting the communication network of servers is an important aspect.

[0003] In order to cope with complex and ever-changing network security threats such as hacker attacks, virus intrusions, malicious users, and internal lateral penetration, it is increasingly important to isolate and protect the access of data center servers in the north-south and east-west directions. In foreign VMware product solutions, NSX components are used, which use a distributed architecture to provide network and security services such as switching, routing, and firewalls. Security implementation control measures are located in the virtual network interface of each workload, which can provide a refined mechanism to regulate traffic. In domestic SmartX product solutions, Everoute components are used. It is based on SmartX native virtualization ELF and combines virtual distributed switches to implement a micro-segmented network model that meets the "zero trust" requirements. It can provide virtual machines with three forms of distributed firewall policies: virtual machine isolation, custom security policies, and global security policies.

[0004] Comparing and studying the technical solutions at home and abroad, their common point is that data center server nodes all need to deploy additional security components to achieve VM isolation protection. Although the design of security components has its unique advantages, it also has the following disadvantages:

[0005] 1. The operation of security components increases the usage load of server node hardware resources.

[0006] 2. Security components require separate payment and authorization before use.

[0007] 3. Security components cannot be applied to traditional physical servers.

[0008] Based on this, in order to achieve isolation protection of server access in the north-south and east-west directions, the present invention proposes a design method that integrates technologies such as VLAN+VXLAN+access control. Summary of the invention

[0009] The technical problem to be solved by the present invention is to address the deficiencies of the above-mentioned prior art and to provide a server network isolation design method based on technology fusion. The server network isolation design method based on technology fusion is based on technology fusion such as VLAN+VXLAN+access control to achieve isolation protection of server access in the north-south and east-west directions.

[0010] In order to solve the above technical problems, the technical solution adopted by the present invention is:

[0011] A server network isolation design method based on technology integration includes the following steps.

[0012] Step 1: Allocate VLAN and IP: The server area of ​​the server network includes the virtualization platform and the physical server area;

[0013] The virtualization platform includes a server nodes and b VMs; the management of each server node is allocated the same VLAN and IP of the same network segment; each VM is allocated a different VLAN and IP of the same address segment.

[0014] The physical server area includes c physical servers; each physical server is assigned a different VLAN and an IP in the same address segment.

[0015] Step 2: Connect the server area to the switch: Connect the server area to the switch and allow the switch to only allow access to the VLAN assigned to the server area in step 1.

[0016] Step 3: Enable VXLAN: The core switch has a built-in VXLAN network. On the downlink port of the core switch, configure the Trunk type and allow the VLAN assigned to the server area in step 1 to pass.

[0017] Step 4: Deploy next-generation firewalls: Deploy next-generation firewalls in the server area using bridge mode, centrally configure security policies, and thus isolate and control the communication networks between servers and between servers and the outside world.

[0018] In step 2, each server node in the virtualization platform is connected to a switch, and its uplink and downlink ports are configured as Trunk type and only allow the VLAN assigned to the server area in step 1 to pass;

[0019] The uplink interface of the physical server access switch is configured as Trunk type and only allows the physical server area VLAN to pass, and the downlink interface is configured as Access type.

[0020] In step 3, the VXLAN network configures an access circuit AC for each VM. The Ethernet service instance of each access circuit AC matches the data frame of the VLAN to which each VM belongs and is associated with the same VSI. Based on the one-to-one correspondence between VSI and VXLAN, and the theory of Layer 2 interconnection between user terminals of the same VXLAN, VMs can access each other through the VXLAN network of the core switch.

[0021] In step 3, the VXLAN network has a VXLAN Layer 3 gateway IP; when the server communicates with the outside world or other different address segments, the access traffic will also be forwarded by the core switch.

[0022] In step 4, based on the integration of VLAN and VXLAN technologies, the communication access traffic between VMs and between VMs and the outside world must pass through the core switch and the next-generation firewall. The next-generation firewall plays a role in isolating and controlling the communication network between VMs and between VMs and the outside world.

[0023] The core switch is a core switch that supports the VXLAN function.

[0024] The present invention has the following beneficial effects:

[0025] 1. The present invention is based on the integration of VLAN+VXLAN+access control and other technologies to achieve isolation protection of server access in the north-south and east-west directions.

[0026] 2. Not relying on server nodes to deploy security components reduces the hardware usage load of server nodes on the one hand; on the other hand, it can protect existing investments or save capital investment to the greatest extent.

[0027] 3. It is not only applicable to traditional physical servers, but also to virtual servers based on virtualization technology. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 A flow chart of a server network isolation design method based on technology fusion of the present invention is shown.

[0029] Figure 2 A design architecture diagram of a server network based on technology fusion according to the present invention is shown. DETAILED DESCRIPTION

[0030] The present invention will be further described in detail below in conjunction with the accompanying drawings and specific preferred embodiments.

[0031] like Figure 1 As shown, a server network isolation design method based on technology integration includes the following steps.

[0032] Step 1: Assign VLAN and IP

[0033] like Figure 2 As shown, the server area of ​​the server network includes a virtualization platform and a physical server area.

[0034] The virtualization platform includes a server nodes and b VMs, where VM is the abbreviation of virtual server.

[0035] exist Figure 2 In the embodiment, preferably a=2, b=4; the two server nodes are server node 1 and server node 2; the four VMs are VM1, VM2, VM3 and VM4.

[0036] The physical server area includes c physical servers; Figure 2 In the embodiment, c=2 is preferred, and the two physical servers are physical server 1 and physical server 2 respectively.

[0037] The management of each server node is assigned the same VLAN (Virtual Local Area Network) and IP in the same network segment; each VM is assigned a different VLAN and IP in the same address segment, so that a large amount of VM migration traffic between server nodes is only forwarded by the second layer of the server area access switch.

[0038] Each physical server is assigned a different VLAN and an IP in the same address segment.

[0039] In this embodiment, Figure 2 As shown, the VLANs and IPs allocated to VM1-VM4 and physical servers 1-2 are shown in the VLAN and IP resource planning in Table 1 below, resulting in that servers in different VLANs cannot communicate directly with each other.

[0040] Table 1 VLAN and IP resource planning example

[0041]

[0042] Step 2: Connect the server area to the switch

[0043] Each server node in the virtualization platform is connected to a switch. Its uplink and downlink ports are configured as Trunk type and only allow the VLAN assigned to the server area in step 1.

[0044] The uplink interface of the physical server access switch is configured as Trunk type and only allows the physical server area VLAN to pass, and the downlink interface is configured as Access type.

[0045] VLAN clipping is used to prevent the related messages of non-server area VLAN from being propagated to the related devices in the server area.

[0046] In this embodiment, the uplink and downlink ports of the server area access switch are configured as Trunk type and only allow VLANs 10, 1001, 1002, 1003, 1004, 2001 and 2002 in the server area to pass. VLAN clipping is used to prevent related messages of non-server area VLANs from propagating to related devices in the server area.

[0047] Step 3: Enable VXLAN

[0048] The core switch has a built-in VXLAN network, which also has a VXLAN Layer 3 gateway IP. Similar to the Layer 3 forwarding principle of a Layer 3 switch, when the server communicates with the outside world or other different address segments, the access traffic will inevitably be forwarded by the core switch.

[0049] On the downlink port of the core switch, configure the Trunk type and allow the VLAN assigned to the server area in step 1 to pass through. Configure an attachment circuit (AC) for each VM. The Ethernet service instance of each AC matches the data frame of the VLAN to which each VM belongs and is associated with the same VSI. Based on the one-to-one correspondence between VSI and VXLAN, and the theory of Layer 2 intercommunication between user terminals of the same VXLAN, VMs can access each other through the VXLAN network of the core switch.

[0050] The above VXLAN is the abbreviation of Virtual eXtensible LAN.

[0051] In this embodiment, the core switch enables the device VXLAN function, configures the VXLAN Layer 3 gateway IP of the VM and the management VLAN Layer 3 gateway IP, etc. The H3C core switch is used as a configuration example, as shown below.

[0052] #Configure the interface as Trunk type and allow access to the server area VLAN

[0053] interface GigabitEthernet1 / 0 / 1

[0054] port link-mode bridge

[0055] port link-type trunk

[0056] undo port trunk permit vlan 1

[0057] port trunkpermit vlan 101001to 10042001to 2002

[0058] #VM1 access circuit AC bind Ethernet instance 1001

[0059] service-instance 1001

[0060] #Match the data frame of VLAN 1001 to which VM1 belongs

[0061] encapsulation s-vid 1001

[0062] # Associated with the same VSI a100

[0063] xconnect vsi a100

[0064] service-instance 1002

[0065] encapsulation s-vid 1002

[0066] xconnect vsi a100

[0067] #

[0068] The above VSI is the abbreviation of Virtual Switch Instance.

[0069] Step 4: Deploy a next-generation firewall

[0070] In the server area, the next-generation firewall is deployed in bridge mode, and security policies are configured centrally and uniformly to isolate and control the communication networks between servers and between servers and the outside world.

[0071] In step 4, based on the integration of VLAN and VXLAN technologies, the communication access traffic between VMs and between VMs and the outside world must pass through the core switch and the next-generation firewall. The next-generation firewall plays a role in isolating and controlling the communication network between VMs and between VMs and the outside world.

[0072] Traditional firewalls control packets based on the five-tuple information of packets (source / destination IP, source / destination port, protocol). Next-generation firewalls are designed based on traditional firewall technology to cope with more complex environments. Next-generation firewalls can identify thousands of applications through signatures and features, and can protect against network intrusions, worms, viruses, Trojans, and attacks transmitted at the application layer; the security policy function it provides can complete the security protection function of all content on a flow in one policy.

[0073] The present invention is based on the fusion of VLAN and VXLAN technology. The communication access traffic between VMs and between VMs and the outside world must pass through the core switch and the next-generation firewall in the server area. Based on the technical basis of the fusion of VLAN+VXLAN technology, the firewall connected in series can isolate and control the traffic between VMs accessing each other. Therefore, the next-generation firewall in the server area can centrally and uniformly configure security policies, thereby isolating and controlling the communication network between VMs and between VMs and the outside world.

[0074] Unlike virtual server scenarios based on virtualization technology, traditional server scenarios have no management network and no virtual switches. However, the basic implementation logic and principles are the same.

[0075] In this embodiment, please refer to the isolation control security policy example in Table 2 for details.

[0076] Table 2 Isolation control security policy example

[0077]

[0078] In the present invention, the east-west access traffic between servers and the north-south access traffic between servers will be forwarded to the next-generation firewall and core switch in the server area. Therefore, the behavior of accessing the server will be isolated and controlled by the next-generation firewall and the core switch. The present invention has the advantages and characteristics of low application cost, high reliability and strong promotion applicability.

[0079] The preferred embodiments of the present invention are described in detail above; however, the present invention is not limited to the specific details in the above embodiments. Within the technical concept of the present invention, various equivalent transformations can be made to the technical solutions of the present invention, and these equivalent transformations all belong to the protection scope of the present invention.

Claims

1. A server network isolation design method based on technology integration, characterized by: The steps include: Step 1: Allocate VLAN and IP: The server area of ​​the server network includes the virtualization platform and the physical server area; The virtualization platform includes a server nodes and b VMs; each server node is assigned the same VLAN and IP in the same network segment; each VM is assigned a different VLAN and IP in the same address segment; The physical server area includes c physical servers; each physical server is assigned a different VLAN and an IP in the same address segment; Step 2: Connect the server area to the switch: Connect the server area to the switch and allow the switch to only allow access to the VLAN assigned to the server area in step 1. Step 3: Enable VXLAN: The core switch has a built-in VXLAN network. On the downlink port of the core switch, configure the Trunk type and allow the VLAN assigned to the server area in step 1 to pass. Step 4: Deploy next-generation firewalls: Deploy next-generation firewalls in the server area using bridge mode, centrally configure security policies, and thus isolate and control the communication networks between servers and between servers and the outside world.

2. The server network isolation design method based on technology fusion according to claim 1 is characterized in that: In step 2, each server node in the virtualization platform is connected to a switch, and its uplink and downlink ports are configured as Trunk type and only allow the VLAN assigned to the server area in step 1 to pass; The uplink interface of the physical server access switch is configured as Trunk type and only allows the physical server area VLAN to pass, and the downlink interface is configured as Access type.

3. The server network isolation design method based on technology fusion according to claim 1 is characterized in that: In step 3, the VXLAN network configures an access circuit AC for each VM. The Ethernet service instance of each access circuit AC matches the data frame of the VLAN to which each VM belongs and is associated with the same VSI. Based on the one-to-one correspondence between VSI and VXLAN, and the theory of Layer 2 interconnection between user terminals of the same VXLAN, VMs can access each other through the VXLAN network of the core switch.

4. The server network isolation design method based on technology fusion according to claim 1 is characterized in that: In step 3, the VXLAN network has a VXLAN Layer 3 gateway IP; when the server communicates with the outside world or other different address segments, the access traffic will also be forwarded by the core switch.

5. The server network isolation design method based on technology fusion according to claim 4 is characterized in that: In step 4, based on the integration of VLAN and VXLAN technologies, the communication access traffic between VMs and between VMs and the outside world must pass through the core switch and the next-generation firewall. The next-generation firewall plays a role in isolating and controlling the communication network between VMs and between VMs and the outside world.

6. The server network isolation design method based on technology fusion according to claim 1 is characterized in that: In step 3, the core switch is a core switch that supports the VXLAN function.

Images