SFC deployment method of symmetric flow firewall based on cloud platform

Abstract

The invention discloses an SFC deployment method of a symmetric flow firewall based on a cloud platform, and relates to the technical field of the cloud platform, and the method comprises the steps that a VPC1 and a VPC2 are created on the cloud platform, the VPC1 is used for bearing a virtual machine VM1 created by a user, and the VPC2 is a network environment needed for constructing SFC deployment of the symmetric flow firewall; a virtual machine is deployed on the cloud platform to serve as a network flow transfer virtual machine; four virtual network cards are created in the transfer virtual machine; the method comprises the following steps: deploying a plurality of virtual flow symmetric firewall virtual machines on a cloud platform, and creating two virtual network cards in each firewall virtual machine; closing security group protection mechanisms of all virtual network cards; oVS software is installed in the transfer virtual machine in advance, and a network bridge connected with the virtual network card is established through the OVS software; and the transfer virtual machine provides a source network address translation function through an OVS flow table, so that flow received by all firewall virtual machines is symmetrical, and translation between a floating IP address FIP1 and a local IP address is realized. According to the invention, north-south network traffic security guarantee service is provided for the virtual machine.

Description

Technical Field

[0001] The present invention relates to the technical field of cloud platforms, and specifically to an SFC deployment method for a symmetric traffic firewall based on a cloud platform. Background Art

[0002] With the rapid development of Internet application technologies, SFC (Service Function Chain) has become an important part of the security guarantee in cloud platform data centers. SFC itself is a network architecture that creates a series of consecutive network services by defining service chains. This architecture allows network traffic to pass through a series of service functions (abbreviated as SFs) in a specific order. The most common service is, for example, the symmetric traffic firewall service. The concept of SFC allows traffic to be bound to service chains (abbreviated as SCs), and traffic types can be identified by methods such as virtual local area networks or tunnels (MPLS tunnels). SFC supports dynamic creation and management, which benefits from emerging technologies such as software-defined networking (abbreviated as SDN) and network function virtualization (abbreviated as NFV). On the other hand, network security technologies are also constantly advancing, and the functions of firewalls are also constantly evolving. With the increasing complexity of network attacks and intrusion behaviors, traditional single security devices can no longer meet comprehensive security requirements. Therefore, the industry has proposed the concept of unified threat management (UTM, Unified Threat Management), which integrates functions such as traditional firewalls, intrusion detection, anti-virus, URL filtering, application control, and email filtering into one firewall to achieve comprehensive security protection; at the same time, this is also a traffic symmetric firewall. SFC technology meets the needs of user services such as security and stability by adding MPLS tags to the original packets as identification information to guide the packets to pass through each traffic symmetric firewall service in sequence according to the specified path.

[0003] However, in the current cloud platform environment based on openstack, the function component neutron responsible for network services does not support the SFC deployment of traffic symmetric firewalls well. This severely restricts the application scenarios and business ranges of cloud platforms and greatly reduces the usage experience of cloud platforms. Summary of the Invention

[0004] Aiming at the problem that the cloud platform based on openstack does not support the SFC deployment of traffic symmetric firewalls well, the present invention provides an SFC deployment method for a symmetric traffic firewall based on a cloud platform.

[0005] A method for deploying SFC of a symmetric traffic firewall based on a cloud platform to solve the above technical problems adopts the following technical solutions:

[0006] A method for deploying SFC of a symmetric traffic firewall based on a cloud platform includes the following steps:

[0007] S1. Create two virtual private networks on the cloud platform, namely VPC1 and VPC2. VPC1 is used to carry the virtual machine VM1 created by the user, and VPC2 is the network environment required for the SFC deployment of building a traffic symmetric firewall.

[0008] S2. Deploy a virtual machine on the cloud platform as a network traffic transfer virtual machine SW1.

[0009] S3. Create 4 virtual network cards inside the network traffic transfer virtual machine SW1.

[0010] S4. Deploy multiple virtual traffic symmetric firewall virtual machines on the cloud platform, and create 2 virtual network cards inside each traffic symmetric firewall virtual machine.

[0011] S5. Turn off the security group protection mechanism of the 4 virtual network cards created by the network traffic transfer virtual machine SW1. At the same time, turn off the security group protection mechanism of the 2 virtual network cards created by the traffic symmetric firewall virtual machine.

[0012] S6. Pre-install the OVS software inside the network traffic transfer virtual machine SW1, and create a bridge connecting the virtual network cards through the OVS software.

[0013] S7. The network traffic transfer virtual machine SW1 provides source network address conversion function through the OVS flow table to ensure that the traffic received by all traffic symmetric firewall virtual machines is symmetric, and realizes the conversion between the floating IP address FIP1 and the local IP address.

[0014] Optionally, when executing step S3, the 4 virtual network cards created inside the network traffic transfer virtual machine SW1 are respectively called virtual network card 1, virtual network card 2, virtual network card 3 and virtual network card 4, where:

[0015] Virtual network card 1 and virtual network card 3 belong to the virtual private network VPC1. Virtual network card 1 is called the north 1 port, and virtual network card 3 is called the south 2 port.

[0016] Virtual network card 2 and virtual network card 4 belong to the virtual private network VPC2. Virtual network card 2 is called the south 1 port, and virtual network card 4 is called the north 2 port.

[0017] Through the above configuration, the network traffic transfer virtual machine SW1 can perform traffic interaction between two different virtual private networks VPC1 and VPC2.

[0018] Further optionally, step S4 is executed. The number of virtual machines of the traffic symmetric firewall is linearly related to the north-south traffic bandwidth. Among the two virtual network cards created inside each virtual machine of the traffic symmetric firewall, one virtual network card belongs to the virtual private network VPC1 and is called eth1, and the other virtual network card belongs to the virtual private network VPC2 and is called eth2.

[0019] Further optionally, step S6 is executed. The north port 1 and the south port 1 are connected using a bridge, and it is required that if the traffic enters from the north port 1, it exits from the south port 1, or if the traffic enters from the south port 1, it exits from the north port 1;

[0020] The north port 2 and the south port 2 are connected using a bridge, and it is required that if the traffic enters from the north port 2, it exits from the south port 2, or if the traffic enters from the south port 2, it exits from the north port 2;

[0021] In the above way, the orderly forwarding of traffic inside the network traffic transit virtual machine SW1 is achieved.

[0022] Further optionally, for the virtual machine VM1 created by the user, the traffic forwarding process in the incoming direction of the virtual machine VM1 is as follows:

[0023] (1.1) Precondition configuration:

[0024] Create a traffic filter sfc_flow_classifier to classify and filter traffic according to the characteristics of the network traffic. Among them, the source port is specified as the south port 1 and the destination port is specified as the south port 2, so as to direct the traffic that meets this characteristic to the subsequent service chain for processing;

[0025] Specify the eth1 and eth2 of the virtual machine of the traffic symmetric firewall to create an sfc_port_pair. The sfc_port_pair is an interface pair that defines the traffic entering and leaving the virtual machine of the traffic symmetric firewall. Each virtual machine of the traffic symmetric firewall has an sfc_port_pair for traffic in and out processing;

[0026] Put the sfc_port_pairs with the same function or belonging to the same category into the same sfc_port_group;

[0027] Specify the sfc_port_group and the sfc_flow_classifier to create an sfc_port_chain. The sfc_port_chain is used to associate the traffic filter and the interface pair group to form a complete service chain configuration, so that the traffic in the incoming direction of the virtual machine VM1 is forwarded according to the configured service chain;

[0028] (1.2) Traffic forwarding process:

[0029] The external network accesses virtual machine VM1 through the floating IP address FIP1 of virtual machine VM1. The traffic first enters the fip-namespace of the computing node where virtual machine VM1 is located, and then enters the qrouter-namespace. At this time, the traffic is remote ip -> FIP1;

[0030] Inside the qrouter-namespace, according to the iptables rules and policy routing, the packet is first SNATed to become remote ip -> Local ip, and then imported into the north port 1 of the network traffic transfer virtual machine SW1;

[0031] The traffic comes out of the south port 1 of the network traffic transfer virtual machine SW1, enters the SFC flow table, and is imported into the eth1 of any traffic symmetric firewall virtual machine. Then it comes out of the eth2 of the traffic symmetric firewall virtual machine, enters the SFC flow table again, and is imported into the south port 2 of the network traffic transfer virtual machine SW1;

[0032] It comes out of the north port 2 of the network traffic transfer virtual machine SW1, then enters the qrouter-namespace of the computing node where the network traffic transfer virtual machine SW1 is located, and finally the qrouter-namespace forwards the data packet to the virtual machine VM1 according to the forwarding logic.

[0033] Preferably, when performing step (1.1), the number of sfc_port_pairs is determined according to the number of traffic symmetric firewall virtual machines;

[0034] All virtual network cards of the network traffic transfer virtual machine SW1 turn off the TSO mechanism to ensure the stable bandwidth of TCP traffic.

[0035] Further optionally, for the virtual machine VM1 created by the user, the forwarding process of the traffic in the outbound direction of the virtual machine VM1 is as follows:

[0036] (2.1) Precondition configuration:

[0037] Create a traffic filter sfc_flow_classifier to classify and filter traffic according to the characteristics of network traffic. Among them, the source port is specified as the south port 1, and the destination port is specified as the south port 2, which is used to filter out the outbound traffic and guide it into the service chain;

[0038] Specify the eth1 and eth2 of the traffic symmetric firewall virtual machine to create sfc_port_pair. sfc_port_pair is an interface pair that defines the traffic entering and leaving the traffic symmetric firewall virtual machine. Each traffic symmetric firewall virtual machine has an sfc_port_pair for traffic in and out processing;

[0039] Put sfc_port_pair with the same function or belonging to the same category into the same sfc_port_group;

[0040] Specify an sfc_port_group and an sfc_flow_classifier to create an sfc_port_chain, which is used to associate a traffic filter and an interface pair group to form a complete service chain configuration, so that the outbound traffic of virtual machine VM1 is forwarded according to this configured service chain;

[0041] (2.2) Traffic forwarding process: The outbound traffic is sent from virtual machine VM1 to the qrouter-namespace. At this time, the traffic direction is Local ip -> remote ip;

[0042] The qrouter-namespace performs SNAT processing on the packet according to the iptables rules and policy routing, and then forwards it to the north port 2 of the network traffic transit virtual machine SW1. At this time, the traffic direction becomes FIP1 -> remote ip;

[0043] Inside the network traffic transit virtual machine SW1, the traffic is SNAT again, comes out from the south port 2 and enters the SFC flow table, and then enters the eth2 of any traffic symmetric firewall virtual machine. At this time, the traffic direction is Local ip -> remote ip;

[0044] Coming out from the eth1 of the traffic symmetric firewall virtual machine and entering the SFC flow table again, it is sent to the south port 1 of the network traffic transit virtual machine SW1. Inside the network traffic transit virtual machine SW1, SNAT is performed first, and then it comes out from the north port 1 and enters the qrouter-namespace. At this time, the traffic direction is FIP1 -> remote ip;

[0045] The qrouter-namespace sends the outbound traffic to the snat-namespace of the network node, and finally the snat-namespace sends the outbound traffic to the core switch in the cloud and routes it outside the cloud platform.

[0046] Preferably, when performing step (2.1), all virtual network cards of the network traffic transit virtual machine SW1 turn off the TSO mechanism to ensure the stable bandwidth of TCP traffic.

[0047] The beneficial effects of a method for SFC deployment of a symmetric traffic firewall based on a cloud platform according to the present invention compared with the prior art are:

[0048] The present invention realizes the SFC deployment of a traffic symmetric firewall, provides north-south network traffic security guarantee services for virtual machines, and does not require modification and secondary development of the existing network architecture of OpenStack. Only the traffic transfer virtual machine and the traffic symmetric firewall virtual machine need to be deployed and configured. Description of the Drawings

[0049] Fig. Figure 1 is the SFC deployment network architecture diagram of Embodiment 1 of the present invention;

[0050] Fig. Figure 2 is the incoming traffic schematic diagram of the virtual machine in Embodiment 1 of the present invention;

[0051] Fig. Figure 3 is the outgoing traffic schematic diagram of the virtual machine in Embodiment 1 of the present invention. Detailed Embodiments

[0052] To make the technical solutions, technical problems solved, and technical effects of the present invention clearer and more understandable, the following describes the technical solutions of the present invention clearly and completely in combination with specific embodiments.

[0053] The following explains the English words involved in the embodiments:

[0054] OVS (Open vSwitch) is an open-source virtual switch software developed by Nicira Networks, which supports multiple standard management interfaces and protocols and is widely used in virtualization and cloud computing environments. Among them: ① OVS adopts an architecture that combines user space and kernel space; the module in the kernel space is responsible for processing high-speed data forwarding, while the daemon process (ovs-vswitchd) in the user space is responsible for configuration management and interaction with external systems. ② OVS realizes packet forwarding decisions based on the flow table (FlowTable); the flow table contains a series of flow entries (Flow Entry), and each flow entry defines the matching rules and corresponding actions; when a packet arrives at OVS, it will search for a matching flow entry in the flow table according to the characteristics of the packet (such as source IP address, destination IP address, port number, etc.) and execute the corresponding actions (such as forwarding to a specified port, discarding, modifying the packet, etc.). ③ When OVS is used as a node in the SDN network, it will establish a connection with the SDN controller and receive the flow table rules issued by the controller; the controller can dynamically update these rules according to the real-time state of the network and business requirements, so as to realize flexible control of network traffic.

[0055] TSO (TCP Segmentation Offload) is a feature of network interface cards (NICs) or the operating system kernel. Its core idea is to transfer the task of TCP segmentation from the CPU to the network interface card for processing. In traditional network data transmission, the CPU needs to segment large TCP packets to meet the MTU (Maximum Transmission Unit) limit of network transmission. The TSO mechanism is a technology used to improve network performance. It allows the operating system to directly pass large TCP packets to the network interface card, which then segments the packets according to the MTU requirements.

[0056] fip - namespace (Floating IP Namespace) is a key concept in OpenStack Networking (Neutron). It belongs to a type of network namespace and plays an important role in the management and use of floating IPs.

[0057] qrouter - namespace is an important concept in OpenStack Networking (Neutron). It is a type of network namespace and plays a key role in network routing and forwarding in the OpenStack cloud environment.

[0058] Embodiment:

[0059] Reference appendix Figure 1 , this embodiment proposes an SFC deployment method for a symmetric traffic firewall based on a cloud platform, which includes the following steps:

[0060] S1. Create two virtual private networks on the cloud platform, namely VPC1 and VPC2. VPC1 is used to host the virtual machine VM1 created by the user, and VPC2 is the network environment required for the SFC deployment of the traffic - symmetric firewall.

[0061] S2. Deploy a virtual machine as a network traffic transfer virtual machine SW1 on the cloud platform.

[0062] S3. Create 4 virtual network cards inside the network traffic transfer virtual machine SW1. The 4 virtual network cards are respectively called virtual network card 1, virtual network card 2, virtual network card 3, and virtual network card 4, where:

[0063] Virtual network card 1 and virtual network card 3 belong to the virtual private network VPC1. Virtual network card 1 is called the north 1 port, and virtual network card 3 is called the south 2 port;

[0064] The virtual network card 2 and the virtual network card 4 belong to the virtual private network VPC2. The virtual network card 2 is called the south 1 port, and the virtual network card 4 is called the north 2 port;

[0065] Through the above configuration, the network traffic transfer virtual machine SW1 can perform traffic interaction between two different virtual private networks VPC1 and VPC2.

[0066] S4. Deploy multiple virtual traffic symmetric firewall virtual machines on the cloud platform. The number of traffic symmetric firewall virtual machines is linearly related to the north-south traffic bandwidth. Two virtual network cards are created inside each traffic symmetric firewall virtual machine; among the two created virtual network cards, one virtual network card belongs to the virtual private network VPC1 and is called eth1, and the other virtual network card belongs to the virtual private network VPC2 and is called eth2.

[0067] S5. Turn off the security group protection mechanism of the 4 virtual network cards created by the network traffic transfer virtual machine SW1. At the same time, turn off the security group protection mechanism of the 2 virtual network cards created by the traffic symmetric firewall virtual machine.

[0068] S6. Pre-install the OVS software inside the network traffic transfer virtual machine SW1, and create a bridge connecting the virtual network cards through the OVS software. Specifically:

[0069] Connect the north 1 port and the south 1 port with a bridge, and require that if the traffic enters from the north 1 port, it exits from the south 1 port or if it enters from the south 1 port, it exits from the north 1 port;

[0070] Connect the north 2 port and the south 2 port with a bridge, and require that if the traffic enters from the north 2 port, it exits from the south 2 port or if it enters from the south 2 port, it exits from the north 2 port;

[0071] Through the above method, the orderly forwarding of traffic inside the network traffic transfer virtual machine SW1 is realized.

[0072] S7. The network traffic transfer virtual machine SW1 provides the source network address conversion function through the OVS flow table to ensure that the traffic received by all traffic symmetric firewall virtual machines is symmetric, and realizes the conversion between the floating IP address FIP1 and the local IP address.

[0073] Based on the above steps S1 - S7, the following details the specific forwarding process of the north-south traffic (inbound and outbound directions) of the virtual machine VM1 under this method, including the configuration of preconditions, the flow path of traffic between each network node and component (such as computing nodes, qrouter-namespace, network traffic transfer virtual machine SW1, traffic symmetric firewall virtual machines, etc.), and operations such as network address translation (SNAT) involved in the transfer process.

[0074] (I) Refer to the appendix Figure 2, for the virtual machine VM1 created by the user, the traffic forwarding process for the incoming traffic of the virtual machine VM1 is as follows:

[0075] (1.1) Pre - configuration:

[0076] Create a traffic filter sfc_flow_classifier to classify and filter traffic according to the characteristics of network traffic. Among them, specify the source port as the south port 1 and the destination port as the south port 2, so as to direct the traffic that meets this characteristic to the subsequent service chain for processing;

[0077] Specify the eth1 and eth2 of the traffic - symmetric firewall virtual machine to create sfc_port_pair. sfc_port_pair can be understood as defining the interface pair for traffic to enter and leave the firewall virtual machine. Each traffic - symmetric firewall virtual machine has an sfc_port_pair for traffic in - and - out processing;

[0078] Put the sfc_port_pair with the same function or belonging to the same category into the same sfc_port_group. sfc_port_group is a logical set;

[0079] Specify the sfc_port_group and sfc_flow_classifier to create sfc_port_chain. sfc_port_chain is used to associate the traffic filter and the interface pair group to form a complete service chain configuration, so that the incoming traffic of the virtual machine VM1 is forwarded according to this configured service chain;

[0080] Turn off the TSO (TCP segmentation offload) mechanism for all virtual network cards of the network traffic transit virtual machine SW1. This mechanism is usually used to split large TCP packets at the network card level for sending. Turning it off can ensure the stable bandwidth of TCP traffic and avoid some network problems that may be caused by packet splitting.

[0081] (1.2) Traffic forwarding process:

[0082] The external network accesses the virtual machine VM1 through the floating IP address FIP1 of the virtual machine VM1. The traffic first enters the fip - namespace of the computing node where the virtual machine VM1 is located, and then enters the qrouter - namespace. At this time, the traffic is remote ip -> FIP1; fip - namespace is mainly used to manage the network configuration related to the floating IP address, and qrouter - namespace is responsible for network routing and forwarding functions;

[0083] Inside the qrouter-namespace, according to the iptables rules and policy routing, the packets are first SNATted to change the source IP from the remote IP to the local IP, and then imported into the north port 1 of the network traffic transfer virtual machine SW1.

[0084] The traffic comes out from the south port 1 of the network traffic transfer virtual machine SW1, enters the SFC flow table (essentially an MPLS tunnel), and is imported into the eth1 of any traffic symmetric firewall virtual machine. Then it comes out from the eth2 of the traffic symmetric firewall virtual machine, enters the SFC flow table again, and is imported into the south port 2 of the network traffic transfer virtual machine SW1.

[0085] It comes out from the north port 2 of the network traffic transfer virtual machine SW1, then enters the qrouter-namespace of the computing node where the network traffic transfer virtual machine SW1 is located. Finally, the qrouter-namespace forwards the data packets to the virtual machine VM1 according to the forwarding logic.

[0086] (2) Refer to the appendix Figure 3 For the virtual machine VM1 created by the user, the forwarding process of the outbound traffic of the virtual machine VM1 is as follows:

[0087] (2.1) Pre-configuration:

[0088] Create a traffic filter sfc_flow_classifier to classify and filter traffic according to the characteristics of the network traffic. Among them, the source port is specified as the south port 1, and the destination port is specified as the south port 2, which is used to filter out the outbound traffic and guide it into the service chain.

[0089] Specify the eth1 and eth2 of the traffic symmetric firewall virtual machine to create sfc_port_pair. sfc_port_pair can be understood as defining the interface pair for traffic to enter and leave the firewall virtual machine. Each traffic symmetric firewall virtual machine has an sfc_port_pair for handling traffic in and out.

[0090] Put the sfc_port_pair with the same function or belonging to the same category into the same sfc_port_group. sfc_port_group is a logical set.

[0091] Specify the sfc_port_group and sfc_flow_classifier to create sfc_port_chain. sfc_port_chain is used to associate the traffic filter and the interface pair group to form a complete service chain configuration, so that the outbound traffic of the virtual machine VM1 is forwarded according to this configured service chain.

[0092] All virtual network cards of the network traffic transfer virtual machine SW1 turn off the TSO mechanism to ensure the stable bandwidth of TCP traffic.

[0093] (2.2) Traffic forwarding process: The outbound traffic is sent from the virtual machine VM1 to the qrouter-namespace. At this time, the traffic direction is Local ip -> remote ip;

[0094] The qrouter-namespace performs SNAT processing on the packet according to the iptables rules and policy routing, and then forwards it to the north port 2 of the network traffic transfer virtual machine SW1. At this time, the traffic direction becomes FIP1 -> remote ip;

[0095] Inside the network traffic transfer virtual machine SW1, SNAT is performed on the traffic again. It comes out from the south port 2 and enters the SFC flow table, and then enters the eth2 of any traffic symmetric firewall virtual machine. At this time, the traffic direction is Local ip -> remote ip;

[0096] It comes out from the eth1 of the traffic symmetric firewall virtual machine and enters the SFC flow table again, and is sent to the south port 1 of the network traffic transfer virtual machine SW1. Inside the network traffic transfer virtual machine SW1, SNAT is performed first, and then it comes out from the north port 1 and enters the qrouter-namespace. At this time, the traffic direction is FIP1 -> remote ip;

[0097] The qrouter-namespace sends the outbound traffic to the snat-namespace of the network node, and finally the snat-namespace sends the outbound traffic to the core switch in the cloud and routes it outside the cloud platform.

[0098] In summary, by using the SFC deployment method of a symmetric traffic firewall based on the cloud platform of the present invention, the deployment is simple. There is no need to modify and re-develop the existing network architecture of openstack. It only needs to deploy and configure the traffic transfer virtual machine and the traffic symmetric firewall virtual machine.

[0099] The above application of specific examples has elaborated in detail the principle and implementation manner of the present invention. These embodiments are only used to help understand the core technical content of the present invention. Based on the above specific embodiments of the present invention, those skilled in the art of the present technology, without departing from the principle of the present invention, any improvements and modifications made to the present invention shall fall within the scope of patent protection of the present invention.

Claims

1. A SFC deployment method for a symmetric traffic firewall based on a cloud platform, characterized in that: The steps include: S1. Create two virtual private networks on the cloud platform, namely VPC1 and VPC2. VPC1 is used to carry the virtual machine VM1 created by the user, and VPC2 is the network environment required for SFC deployment to build a traffic symmetric firewall. S2, deploy a virtual machine on the cloud platform as the network traffic transfer virtual machine SW1; S3. Create four virtual network cards inside the network traffic transfer virtual machine SW1; S4. Deploy multiple virtual traffic symmetric firewall VMs on the cloud platform, and create two virtual network cards inside each traffic symmetric firewall VM. S5. Disable the security group protection mechanism of the four virtual network cards created by the network traffic transfer virtual machine SW1. At the same time, disable the security group protection mechanism of the two virtual network cards created by the traffic symmetric firewall virtual machine. S6. Pre-install the OVS software in the network traffic transfer virtual machine SW1, and create a bridge connecting the virtual network card through the OVS software; S7. The network traffic transfer virtual machine SW1 provides the source network address translation function through the OVS flow table to ensure the symmetry of the traffic received by all traffic symmetric firewall virtual machines and realize the conversion of the floating IP address FIP1 and the local IP address.

2. According to claim 1, a SFC deployment method of a symmetric traffic firewall based on a cloud platform is characterized in that: Execute step S3, and the four virtual network cards created inside the network traffic transfer virtual machine SW1 are respectively called virtual network card 1, virtual network card 2, virtual network card 3 and virtual network card 4, where: Virtual NIC 1 and virtual NIC 3 belong to virtual private network VPC1. Virtual NIC 1 is called North Port 1, and virtual NIC 3 is called South Port 2. Virtual NIC 2 and virtual NIC 4 belong to virtual private network VPC2. Virtual NIC 2 is called South Port 1, and virtual NIC 4 is called North Port 2. With the above configuration, the network traffic transit virtual machine SW1 can exchange traffic between two different virtual private networks VPC1 and VPC2.

3. The SFC deployment method of a symmetric traffic firewall based on a cloud platform according to claim 2, characterized in that: Execute step S4. The number of traffic-symmetric firewall virtual machines is linearly related to the north-south traffic bandwidth. Of the two virtual network cards created inside each traffic-symmetric firewall virtual machine, one virtual network card belongs to the virtual private network VPC1, called eth1, and the other virtual network card belongs to the virtual private network VPC2, called eth2.

4. The SFC deployment method of a symmetric traffic firewall based on a cloud platform according to claim 3, characterized in that: Execute step S6 to connect the north port 1 and the south port 1 using a bridge, and require that traffic enters from the north port 1 and exits from the south port 1 or enters from the south port 1 and exits from the north port 1; Connect North Port 2 and South Port 2 with a bridge, and require that traffic enters from North Port 2 and exits from South Port 2, or enters from South Port 2 and exits from North Port 2; Through the above method, the orderly forwarding of traffic is achieved within the network traffic transfer virtual machine SW1.

5. The SFC deployment method of a symmetric traffic firewall based on a cloud platform according to claim 4, characterized in that: For the virtual machine VM1 created by the user, the traffic forwarding process in the inbound direction of the virtual machine VM1 is as follows: (1.1) Pre-condition configuration: Create a flow filter sfc_flow_classifier to classify and filter traffic according to the characteristics of network traffic. The source port is specified as South 1 and the destination port is specified as South 2, so that traffic that meets the characteristics can be directed to the subsequent service chain for processing. Specify eth1 and eth2 of the traffic symmetric firewall virtual machine to create sfc_port_pair. sfc_port_pair is the interface pair that defines the traffic entering and leaving the traffic symmetric firewall virtual machine. Each traffic symmetric firewall virtual machine has an sfc_port_pair for inbound and outbound traffic processing; Put sfc_port_pairs with the same function or belonging to the same category into the same sfc_port_group; Specify sfc_port_group and sfc_flow_classifier to create sfc_port_chain. Sfc_port_chain is used to associate the traffic filter and the interface pair group to form a complete service chain configuration, so that the inbound traffic of virtual machine VM1 is forwarded according to the configured service chain. (1.2) Traffic forwarding process: The external network accesses virtual machine VM1 through the floating IP address FIP1 of virtual machine VM1. The traffic first enters the fip-namespace of the computing node where virtual machine VM1 is located, and then enters the qrouter-namespace. At this time, the traffic is remote ip->FIP1; Inside qrouter-namespace, according to iptables rules and policy routing, the message is first SNATed to remote ip->local ip, and then imported to the north port 1 of the network traffic transfer virtual machine SW1; The traffic comes out from the South 1 port of the network traffic transfer virtual machine SW1, enters the SFC flow table, and is imported to the eth1 of any traffic symmetric firewall virtual machine. Then, it comes out from the eth2 of the traffic symmetric firewall virtual machine, enters the SFC flow table again, and is imported to the South 2 port of the network traffic transfer virtual machine SW1. It comes out from the north port 2 of the network traffic transfer virtual machine SW1, and then enters the qrouter-namespace of the computing node where the network traffic transfer virtual machine SW1 is located. Finally, qrouter-namespace forwards the data packet to the virtual machine VM1 according to the forwarding logic.

6. The SFC deployment method of a symmetric traffic firewall based on a cloud platform according to claim 5, characterized in that: When executing step (1.1), the number of sfc_port_pairs is determined according to the number of traffic symmetric firewall virtual machines; All virtual network cards of the network traffic transfer virtual machine SW1 turn off the TSO mechanism to ensure stable bandwidth of TCP traffic.

7. The SFC deployment method of a symmetric traffic firewall based on a cloud platform according to claim 5, characterized in that: For the virtual machine VM1 created by the user, the outbound traffic forwarding process of the virtual machine VM1 is as follows: (2.1) Pre-condition configuration: Create a flow filter sfc_flow_classifier to classify and filter traffic according to the characteristics of network traffic. The source port is specified as South 1 and the destination port is South 2 to filter outbound traffic and guide it into the service chain. Specify eth1 and eth2 of the traffic symmetric firewall virtual machine to create sfc_port_pair. sfc_port_pair is the interface pair that defines the traffic entering and leaving the traffic symmetric firewall virtual machine. Each traffic symmetric firewall virtual machine has an sfc_port_pair for inbound and outbound traffic processing; Put sfc_port_pairs with the same function or belonging to the same category into the same sfc_port_group; Specify sfc_port_group and sfc_flow_classifier to create sfc_port_chain. Sfc_port_chain is used to associate the traffic filter and the interface pair group to form a complete service chain configuration, so that the outbound traffic of virtual machine VM1 is forwarded according to this configured service chain. (2.2) Traffic forwarding process: outbound traffic is sent from VM1 to qrouter-namespace. At this time, the traffic direction is Local ip->remote ip; According to iptables rules and policy routing, qrouter-namespace first performs SNAT processing on the message, and then forwards it to the north port 2 of the network traffic transfer virtual machine SW1. At this time, the traffic direction changes to FIP1->remote ip; The network traffic transfer virtual machine SW1 performs SNAT on the traffic again, and enters the SFC flow table from the south port 2, and then enters eth2 of any traffic symmetric firewall virtual machine. At this time, the traffic direction is local ip->remote ip; It comes out from eth1 of the traffic symmetric firewall virtual machine and enters the SFC flow table again, and is sent to the south port 1 of the network traffic transfer virtual machine SW1. SNAT is first performed inside the network traffic transfer virtual machine SW1, and then it comes out from the north port 1 and enters the qrouter-namespace. At this time, the traffic direction is FIP1->remote ip; qrouter-namespace sends outbound traffic to the snat-namespace of the network node, and finally snat-namespace sends the outbound traffic to the core switch in the cloud and routes it outside the cloud platform.

8. The SFC deployment method of a symmetric traffic firewall based on a cloud platform according to claim 7, characterized in that: When executing step (2.1), all virtual network cards of the network traffic transfer virtual machine SW1 turn off the TSO mechanism to ensure the stability of the bandwidth of TCP traffic.

Images