Data center Internet exit architecture

Abstract

The invention discloses a data center Internet exit architecture, which comprises a route switching device, a gateway resource pool and a resource pool server, and is characterized in that the gateway resource pool comprises two switches and a plurality of gateway devices, the upper links of the two switches are in cross interconnection with a firewall in the route switching device, and the gateway devices are in cross interconnection with the firewall in the route switching device; a plurality of gateway devices are accessed in a downlink cross-interconnection side hanging manner, and each resource pool server is accessed in a downlink cross-interconnection serial manner; the firewall points an intranet detail network segment to the link load balancing device through a two-layer network constructed by the switch, the link load balancing device points a default route to the firewall through the two-layer network, and the link load balancing device points the intranet detail network segment to an intranet virtual private cloud created by the switch. And two-layer and three-layer network services are provided for each downlink side-hung gateway device through the intranet virtual private cloud, and an open shortest path first network is constructed with each downlink serial access resource pool server to realize request distribution, so that the networking flexibility is improved.

Description

Technical Field

[0001] This application relates to the field of Internet architecture technology, and in particular to a data center Internet egress architecture. Background Technology

[0002] With the rapid development of internet applications, enterprises and institutions have placed higher demands on the performance, reliability, and security of internet egress points. Traditional internet egress architectures primarily enhance their security capabilities by deploying gateway devices such as SSL (Secure Sockets Layer) gateways, Web Application Firewalls (WAFs), and load balancers. However, faced with increasingly complex network attack threats and business needs, the security protection capabilities of traditional architectures are gradually proving insufficient.

[0003] In traditional internet egress architectures, gateway devices are typically deployed in a tightly coupled manner with routing and switching devices. However, this tight coupling leads to a rigid network architecture, preventing resource pools from sharing gateway resources, and further complicates expansion and scaling as services increase. Furthermore, network devices need to maintain complex policy-based routing rules and dynamically adjust routing learning models, increasing operational costs and reducing fault location efficiency. Summary of the Invention

[0004] In view of this, the present application provides a data center Internet egress architecture, the main purpose of which is to solve the technical problems of poor networking flexibility, difficulty in resource expansion and low fault location efficiency of existing Internet egress architectures.

[0005] According to one aspect of this application, a data center internet egress architecture is provided, comprising: a routing and switching device, a gateway resource pool, and at least one resource pool server. The gateway resource pool includes two switches and multiple gateway devices. The two switches are cross-connected uplink to a firewall in the routing and switching device, and cross-connected downlink to multiple gateway devices. They are also serially connected to various resource pool servers. A Layer 2 network is built on the two switches. The firewall directs the detailed internal network segments to a link load balancer in the gateway device through the Layer 2 network. The link load balancer directs the default route to the firewall through the Layer 2 network. An internal virtual private cloud is created on the two switches. The link load balancer directs the detailed internal network segments to the internal virtual private cloud. The two switches provide Layer 2 and Layer 3 network services to the downstream gateway devices through the internal virtual private cloud. The two switches and the serially connected resource pool servers construct an open shortest path first network to publish public network default routes to each resource pool server and learn the server network segment routes of each resource pool server.

[0006] By employing the above technical solutions, the data center internet egress architecture provided in this application embodiment, through the construction of a gateway resource pool to centrally house various gateway devices, can integrate multiple gateway resources from the internet egress and the intranet zone. This allows for the provision of various gateway functions to internet consumers through interface-based methods. Simultaneously, each resource pool server in the intranet zone can reuse gateway resources from the gateway resource pool, thereby improving the utilization rate of gateway resources and reducing the deployment cost of gateway devices. Furthermore, the gateway resource pool and routing switching devices are decoupled in the internet egress architecture, facilitating flexible allocation of gateway resources and enabling elastic expansion of gateway resources. In addition, by utilizing the gateway resource pool to construct a Layer 2 network, the switches in the gateway resource pool only need to maintain the regular network without adding complex policy routing, and there is no need to dynamically adjust the routing learning model. This effectively reduces operational complexity and costs, and improves fault location efficiency.

[0007] The above description is only an overview of the technical solution of this application. In order to better understand the technical means of this application and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of this application more obvious and understandable, the following are specific embodiments of this application. Attached Figure Description

[0008] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0009] Figure 1 This diagram illustrates a structural schematic of a data center internet egress architecture provided by existing technology;

[0010] Figure 2 This paper presents a schematic diagram of a data center internet egress architecture provided in an embodiment of this application.

[0011] Figure 3 This illustration shows a schematic diagram of the structure of a service gateway in a gateway resource pool according to an embodiment of this application;

[0012] Figure 4 This illustration shows a schematic diagram of the structure of a service gateway in another gateway resource pool provided in an embodiment of this application;

[0013] Figure 5 This paper illustrates a schematic diagram of another data center internet egress architecture provided in an embodiment of this application. Detailed Implementation

[0014] The present application will be described in detail below with reference to the accompanying drawings and embodiments. It should be noted that, unless otherwise specified, the embodiments and features described in the embodiments of the present application can be combined with each other.

[0015] Currently, in the existing internet egress architecture, gateway devices and routing / switching devices are strongly coupled, resulting in poor network flexibility. For example... Figure 1 As shown, in the existing internet egress architecture, DDoS (Distributed Denial-of-Service) devices are deployed in a bridged manner, link load balancers and WAFs are accessed in a side-by-side manner. This forces switch groups to maintain complex policy routing configurations and requires changes to the dynamic routing learning model. Consequently, troubleshooting is often difficult. Furthermore, in the process of promoting data center cloud deployment, traditional network resource pools, SDN (Software Defined Networking) resource pools, and full-stack cloud resource pools will coexist. Each resource pool requires the construction of private gateway resources, which cannot effectively improve the utilization rate of data center gateway resources. This highly coupled deployment of gateway resources results in poor network flexibility for the entire data center, and the difficulty of expanding gateway resources further increases with business growth.

[0016] To address the above problems, in one embodiment, such as Figure 2 As shown, a data center internet egress architecture is proposed. This architecture includes: routing and switching equipment, a gateway resource pool, and at least one resource pool server. The routing and switching equipment can include various devices such as routers, switches, and firewalls. The resource pool server can include various resource pool servers such as traditional network resource pools, SDN resource pools, and full-stack cloud resource pools. The gateway resource pool can include two switches and multiple gateway devices. These gateway devices can include various types of gateway devices such as link load balancers, SSL certificate offloading devices, WAF protection devices, and load balancers. The two switches are cross-connected uplink to the firewall in the routing and switching equipment, and cross-connected downlink to connect to multiple gateway devices. They are also cross-connected downlink to connect serially to each resource pool server. It is understood that in this embodiment, the type, number, and connection method of the routing and switching equipment, the type and number of gateway devices in the gateway resource pool, and the type of resource pool server are not limited and can be configured according to actual conditions.

[0017] Furthermore, a Layer 2 network is built on the two switches. The firewall can use the Layer 2 network to point the detailed internal network segments to the link load balancer in the gateway device. The link load balancer can use the Layer 2 network to point the default route to the firewall. An internal Virtual Private Cloud (VPC) is created on the two switches. The link load balancer can point the detailed internal network segments to the internal VPC. Through the internal VPC, the two switches can provide Layer 2 and Layer 3 network services to the downstream gateway devices. The two switches also build an Open Shortest Path First (OSPF) network with the downstream serially connected resource pool servers to publish the public default route to each resource pool server and learn the server segment routes of each resource pool server.

[0018] In this embodiment, two switches can be configured as a pair of active-active devices using an M-lag (Multi-Chassis Link Aggregation Group) configuration to form a highly available gateway resource pool core. The two switches are cross-connected to the firewall of the routing and switching device uplink, and connected to various gateway devices downlink via cross-connection. They also connect to the resource pool server serially, thus constructing a physically decoupled architecture. Based on this, the switches create a Layer 2 network, allowing the firewall to direct internal network details to the link load balancer via this network. The link load balancer then directs the default route back to the firewall, forming an efficient forwarding path for internal network traffic. Simultaneously, the switches deploy an internal VPC, providing Layer 2 and Layer 3 network services to the connected gateway devices, ensuring that each gateway device can handle traffic within the same subnet and also achieve cross-subnet communication through the VPC. For each resource pool server, the switches can build an OSPF dynamic routing network with it and, as a boundary device, publish public network default routes to the servers and automatically learn server network segment routes, thereby achieving real-time synchronization of public and internal network routes.

[0019] Through the above architecture, the gateway resource pool can centrally integrate previously scattered gateway functions such as link load balancing, SSL certificate offloading devices, and WAF protection devices. Internet consumers can call gateway services on demand through standardized interfaces, while the internal network resource pool server does not need to deploy gateway devices independently and can directly reuse the gateway resource pool capabilities, effectively improving the utilization rate of gateway resources and reducing hardware costs. At the same time, the decoupling design of the gateway resource pool and routing and switching devices means that expansion only requires adding gateway devices and updating switch configurations within the resource pool, without modifying the core routing and switching device policies. Furthermore, the switches only need to maintain basic Layer 2 networks and OSPF routes, avoiding the difficulty in fault location caused by complex policy routing configurations in traditional architectures, reducing operational complexity, and shortening the mean time to repair faults.

[0020] By applying the technical solution of this embodiment, a gateway resource pool can be constructed to centrally house various gateway devices, integrating multiple gateway resources from the internet egress and the intranet. This allows for the provision of various gateway functions to internet consumers through a standardized interface. Simultaneously, each resource pool server within the intranet can reuse gateway resources from the pool, thereby improving resource utilization and reducing deployment costs. Furthermore, the gateway resource pool and routing / switching devices are decoupled at the internet egress architecture, facilitating flexible allocation of gateway resources and enabling elastic expansion. Moreover, by utilizing the gateway resource pool to construct a Layer 2 network, the switches within the pool only need to maintain the regular network without adding complex policy routing or dynamically adjusting the routing learning model. This effectively reduces operational complexity and costs while improving fault location efficiency.

[0021] In one embodiment, the gateway devices in the gateway resource pool include a link load balancer, an SSL certificate offloading device, a WAF protection device, and a load balancer. The link load balancer operates as a side-mounted connection. Its external network channel establishes a Layer 2 network with the firewall to receive public network traffic, while its internal network channel establishes a Layer 2 network with the internal virtual private cloud on the two switches to form an internal traffic distribution channel. The SSL certificate offloading device, WAF protection device, and load balancer all operate as dual-arm connections. They establish external network channels for uplink requests and internal network channels for downlink distribution.

[0022] In this embodiment, the two switches and the various gateway devices connected downstream can constitute a gateway resource pool, such as... Figure 2As shown in the dashed box. The aforementioned gateway resource pool integrates internet link load balancing, SSL certificate offloading, WAF protection, and server load balancing functions. It only needs to provide the virtual service address and port for Layer 1 load balancing via an interface to the uplink firewall to package and provide the aforementioned gateway functions to the internet. In this embodiment, the link load balancing device adopts a side-mounted access method. Its external network channel establishes a Layer 2 network connection with the firewall to receive public network traffic, while its internal network channel constructs a Layer 2 network with the internal virtual private cloud (VPC) created on the two switches to form an internal distribution channel, thereby achieving physical isolation between public network traffic and internal network traffic.

[0023] Furthermore, the SSL certificate offloading device, WAF protection device, and load balancer all adopt a dual-arm access mode. They establish an external network channel for uplink requests and an internal network channel for downlink distribution, ensuring that external access requests undergo security protection and protocol optimization before being forwarded to the internal network. Through this configuration, the gateway resource pool can provide standardized Layer 1 load balancing virtual service addresses and ports to internet consumers, and output SSL offloading, WAF protection, and server load balancing functions in a unified interface format. Internal network resource pool servers can reuse the gateway resource pool's security protection capabilities without independently deploying security devices. Simultaneously, the Layer 2 direct connection design between the link load balancer and the firewall constructs a Layer 2 network environment for link session persistence. Combined with the deep traffic inspection and optimization processing of the dual-arm access device, this improves overall network throughput and increases attack interception success rate. The decoupled architecture of the gateway resource pool and routing / switching devices supports on-demand horizontal expansion of gateway devices. For example, when adding a WAF protection node, only device access and VPC network configuration need to be completed within the resource pool; no additional policy routing configuration is required for the core routing / switching device, significantly reducing operational complexity and expansion costs.

[0024] In one embodiment, the link load balancer can enable the link session persistence function so that public network inbound traffic can travel back and forth through the same public network link. In addition, the link load balancer can also enable the load balancing policy so that public network outbound traffic is distributed to multiple public network outbounds according to the load balancing policy. For example, the public network outbound traffic can be evenly distributed across two public network leased lines.

[0025] In this embodiment, by enabling the link session persistence function on the link load balancer, it can be ensured that traffic from the same public network ingress always travels through the same physical link during round trips, maintaining the source-in, source-out function for public network inbound access. Simultaneously, deploying a load balancing policy (LB-Policy) on the link load balancer, such as configuring algorithms based on weighted round-robin or least connections, allows public network egress traffic to be distributed to the two public network leased lines according to a preset ratio or dynamic load status. Through the above configuration, the link load balancer can simultaneously achieve consistent routing of inbound traffic and balanced distribution of outbound traffic. For example, in a financial business scenario, after inbound traffic for a user login session enters through leased line A, all associated subsequent transaction traffic returns through leased line A, thus avoiding transaction failures due to session interruption. Simultaneously, outbound traffic is distributed to leased lines A and B in a 7:3 ratio, ensuring balanced bandwidth utilization between the two leased lines and effectively preventing congestion on a single link.

[0026] In one embodiment, an SSL certificate offloading device, a WAF protection device, and a load balancer (LB) can constitute a multi-layer service gateway. Each layer of the service gateway has its external and internal network channels assigned independent IP address ranges and Virtual Local Area Network (VLAN) identifiers. The interface interconnection method for the multi-layer service gateways includes: The external network channel of the first-layer service gateway is added with a default route pointing to an external VLAN interface gateway created by two switches. Except for the first-layer service gateway, the external network channel of each layer of the service gateway is interconnected at Layer 2 with the internal network channel of the layer above it, using the IP address range of the current layer's external network channel as the interconnection segment. The internal network channel of the last-layer service gateway is added with a default route pointing to an internal source network address translation (NSA) VLAN interface gateway created by two switches. Except for the last-layer service gateway, the internal network channel of each layer of the service gateway is interconnected at Layer 2 with the external network channel of the layer below it, using the IP address range of the layer below it as the interconnection segment. The interfaces connecting the two switches to the service gateways at each layer are configured as Layer 2 aggregation ports, and the virtual LAN identifiers of the external network channels and internal network channels corresponding to the service gateways at each layer are allowed.

[0027] In this embodiment, as Figure 2As shown, SSL certificate offloading devices, WAF protection devices, and load balancers can form a multi-layered service gateway architecture. Each layer of service gateways allocates independent IP address ranges and VLAN IDs to its external and internal network channels to avoid network conflicts and ensure communication isolation. The virtual service address of each layer of service gateways uses the external network segment of the device at that layer, facilitating the construction of a Layer 2 network between adjacent layers. The basic principle of address interface interconnection is that the upper layer interconnects with the lower layer, using the external address range of the lower layer as the interconnection segment. The constructed Layer 2 network enables requests to flow layer by layer through each service gateway to each resource pool server. Figure 2 and Figure 3 Taking the business gateway architecture shown as an example, its gateway interface interconnection method is as follows:

[0028] 1. Layer 1 Load Balancer: The external default route points to the external VLANIF gateway of the switch, and the internal route is interconnected with the Layer 2 SSL external route (using the Layer 2 external address range);

[0029] 2. Second-layer SSL: external and internal layers 2 are interconnected (using the second-layer external address range), internal and third-layer LB external layers 2 are interconnected (using the third-layer external address range);

[0030] 3. The third layer LB: external is interconnected with the second layer internal (using the third layer external address range), and internal is interconnected with the fourth layer WAF external (using the fourth layer external address range);

[0031] 4. The fourth layer WAF: external is interconnected with the third layer internal (using the fourth layer external address range), and internal is interconnected with the fifth layer LB external (using the fifth layer external address range);

[0032] 5. Layer 5 LB: external and internal Layer 4 interconnected (using the Layer 5 external address range), the default internal route points to the switch's SNAT VLANIF gateway.

[0033] Based on the above service gateway interface planning method, the interfaces connecting the two switches in the gateway resource pool to each service gateway can be configured as Layer 2 aggregation ports, allowing VLAN IDs of the corresponding service gateway's external / internal network segments. Furthermore, the Layer 1 load balancer's external VLAN gateway created by the two switches can be used to handle public network requests, while the created Layer 5 internal SNAT address segment VLAN gateway can be used for network access with the downstream resource pool server. Specifically, a default route is added to the Layer 1 load balancer pointing to its external VLAN gateway, and a default route is added to the Layer 5 load balancer pointing to its SNAT VLAN gateway. Layer 2, 3, and 4 gateway devices communicate with upstream and downstream devices via Layer 2 networks, requiring no additional routing configuration.

[0034] With the above configuration, public network traffic can sequentially pass through load balancing distribution, SSL offloading and decryption, and WAF protection detection before reaching the resource pool. Each gateway only needs to handle Layer 2 traffic from adjacent layers, eliminating the need for dynamic routing protocol configuration, thus simplifying the network architecture and isolating fault domains to single-layer devices. Furthermore, VLAN isolation prevents east-west traffic leakage across layers, and combined with link redundancy achieved through switch aggregation ports, it improves service continuity. At the same time, gateway devices do not need to maintain complex routing tables, effectively reducing maintenance workload.

[0035] In one embodiment, such as Figure 3 As shown, the business gateway can be configured using the following five-layer architecture. Specifically, the first-layer business gateway is a load balancer deployed with primary and backup configurations; the second-layer business gateway is an SSL certificate offloading device deployed using pooling; the third-layer business gateway is a load balancer deployed with primary and backup configurations; the fourth-layer business gateway is a WAF protection device deployed using pooling configurations and configured in reverse proxy mode; and the fifth-layer business gateway is a load balancer deployed with primary and backup configurations. Figure 3 Taking the business gateway architecture shown as an example, when a request enters the above five-layer business gateway through the external network channel of the first-layer load balancer, the business configuration methods of each layer business gateway are as follows:

[0036] 1. Layer 1 LB: A load balancing device deployed in a primary and backup configuration can be used to receive client requests and configure load balancing policies to evenly distribute traffic to the Layer 2 SSL security gateway.

[0037] 2. Second-layer SSL: A pooled deployment of the SSL security gateway handles SSL certificate offloading and supports encryption algorithms such as RSA (Rivest-Shamir-Adleman) and Chinese national cryptographic protocols to ensure data transmission security. Furthermore, a custom field can be added to the HTTP Header to insert the client's real source address for subsequent device identification and processing.

[0038] 3. Layer 3 Load Balancing (LB): A primary / backup load balancing device is used to receive plaintext traffic from the SSL security gateway, perform SNAT and source address session persistence, and then distribute the traffic to the Layer 4 WAF device. Simultaneously, HTTP health checks can be used to ensure the availability of the WAF device.

[0039] 4. Layer 4 WAF: This WAF protection device is deployed in a pooled manner and set to reverse proxy mode. It is responsible for providing Layer 7 security protection, including defense against threats such as SQL injection (Structured Query Language Injection) and XSS attacks (Cross-Site Scripting). It is also used to process traffic from Layer 3 load balancers and forward the processed traffic to Layer 5 load balancers.

[0040] 5. Layer 5 LB: Employs a primary and backup load balancing device to directly load balance the backend web server and handle traffic from the WAF device. It also processes Layer 7 protocols such as HTTP according to business needs, including personalized requirements such as HTTP URL-based load balancing and cookie session persistence.

[0041] In one embodiment, in the interface design of a multi-layer service gateway, each service gateway uses different Layer 2 network communication with the service gateways above and below it. Therefore, packet flows pass through each layer sequentially, but do not cross layers. Meanwhile, considering scenarios where non-HTTP traffic does not need to pass through the WAF protection device, this embodiment designs the following interface interconnection method: the internal network channel of the service gateway above the WAF protection device layer is interconnected with the external network channel of the gateway device below the WAF protection device layer using Layer 2, and the IP address range of the external network channel of the gateway device below the WAF protection device layer is used as the interconnection segment. Specifically, a Virtual LAN identifier is added to the interfaces of the two switches that connect to the service gateway above the WAF protection device layer, allowing the external network channel of the gateway device below the WAF protection device layer to pass through.

[0042] In this embodiment, with Figure 4Taking the illustrated service gateway architecture as an example, considering scenarios where non-HTTP traffic does not need to pass through the WAF, a Layer 2 interconnection (using the Layer 5 external address range) can be added between the internal channel of the Layer 3 load balancer and the external channel of the Layer 5 load balancer. The two switches in the gateway resource pool are adapted to add Layer 5 external VLAN IDs to the interfaces connecting to the Layer 3 load balancer. This embodiment, by constructing a Layer 2 network, allows switches to maintain only the regular network without adding complex policy routing, thus enabling only HTTP traffic to pass through the WAF, thereby reducing operational complexity. For example, for non-HTTP services, the pool members of the Layer 3 virtual service no longer configure Layer 4 virtual services, but instead configure Layer 5 virtual services. Through the newly built Layer 2 network, the Layer 3 load balancer can directly access the Layer 5 load balancer, bypassing the Layer 4 WAF device and reducing operational complexity.

[0043] The design method for bypassing the fourth-layer WAF device mentioned in the above embodiments provides a basic solution for WAF Bypass schemes. For example... Figure 4 As shown, the default pool member of the Layer 3 load balancing virtual service is the Layer 4 WAF gateway virtual service. By configuring WAF Bypass logic on the Layer 3 load balancer, a backup pool can be created, with members including the Layer 5 load balancing virtual service. When the WAF device fails, the Layer 3 load balancer can automatically detect this through health checks and directly redirect request flows to the backup pool, bypassing the failed WAF device. Once the WAF recovers, the request flows automatically switch back to the default pool. This ensures continuous service operation during WAF device failures, improving system reliability without manual intervention.

[0044] The above embodiments propose a WAF Bypass access method, which enables the WAF cluster to automatically enter the Bypass forwarding mode when it fails, thereby bypassing the WAF protection device to continue forwarding to the backend server. After the fault is recovered, it will automatically exit the Bypass forwarding mode. The forwarding mode switching in the whole process does not require manual intervention, which can effectively reduce the complexity of operation and maintenance.

[0045] In one embodiment, such as Figure 3 and Figure 4As shown, both the link load balancer and the load balancer are deployed with two units each, and the two devices are connected via a single line, which can be used to detect the primary and backup status with heartbeats. The SSL certificate offloading device and the WAF protection device are deployed in a cluster, with no cable connection between the devices. Furthermore, considering the expansion of local gateway resources, the number of gateway devices can be appropriately increased. For example, if WAF performance is a bottleneck, the number of pooled WAF protection devices can be increased.

[0046] In this embodiment, by deploying the link load balancer and the load balancer in a primary / backup mode, and connecting the two devices via a single heartbeat line, the primary / backup status can be monitored in real time. When the primary device fails, the backup device can quickly take over the service, thus ensuring business continuity. Simultaneously, by deploying the SSL certificate offloading device and the WAF protection device in a cluster mode, with no cables connecting the devices, a protection system without single points of failure can be formed. For example, when the WAF cluster detects that the CPU utilization of a node exceeds a certain threshold, it can automatically trigger a capacity expansion process. New devices can be added to the cluster via dynamic VLAN allocation technology to handle overflow traffic. Through this architecture, the hybrid deployment mode of primary / backup devices and cluster devices enables the overall architecture to have elastic scalability, and the cableless cluster design limits the fault domain of a single device to a certain range, thereby shortening the fault recovery time.

[0047] In one embodiment, such as Figure 2 and Figure 5 As shown in the screenshot, the routing and switching equipment includes two routers, two Layer 2 switches, and two firewalls. Each of the two routers is connected to a public network leased line and to a Layer 2 switch. The routers and Layer 2 switches are connected via a single line, and the two routers are deployed independently. Each of the two Layer 2 switches is connected to a firewall. The Layer 2 switches and firewalls are connected via a single line, and the two firewalls are deployed independently. The two firewalls are connected to two switches in the gateway resource pool and are cross-connected.

[0048] In this embodiment, by deploying two routers in the routing and switching equipment, with each router connected to a dedicated public network line, dual-link redundancy can be achieved. Furthermore, the routers are connected to a Layer 2 switch via a single Ethernet cable, ensuring a simple physical link and fault domain isolation. Secondly, by deploying two Layer 2 switches, each connected to an independent router uplink and a firewall downlink via a single line, a dual-active path for north-south traffic can be formed. Additionally, by deploying two firewalls and using a cross-connection method to connect them to the two core switches of the gateway resource pool, redundant connections between the firewalls and the gateway resource pool can be achieved. Through this architecture, independent router deployment allows for horizontal expansion of public network access bandwidth, the single-line connection design shortens link fault diagnosis time, and the firewall cross-connection mode enables the gateway resource pool to have dual uplink capabilities. When one firewall fails, traffic can automatically switch to the other firewall. Combined with the fast MAC address table convergence mechanism of the Layer 2 switches, service interruption time can be reduced.

[0049] In one embodiment, in the aforementioned routing and switching device, each router's default route points to the public network, and the public network details are pointed to the firewall through the downstream Layer 2 switch. Each firewall can translate the public network address into the internal network address through destination address translation, and each firewall points its default route to the router through the upstream Layer 2 switch. At the same time, the firewall can point the internal network details to the link load balancer in the gateway device through the Layer 2 network constructed by the two switches in the gateway resource pool.

[0050] In this embodiment, by configuring static default routes on two routers, public network outbound traffic can be directed to the Internet Service Provider link, while traffic from specific public IP network segments can be redirected to the downstream Layer 2 switch. Secondly, through the Layer 2 switch, detailed public network traffic from the router can be forwarded to the firewall device. Each firewall device is equipped with a Destination Address Translation (DNAT) rule set, which maps public addresses to the private addresses of internal servers. The default route is then pointed back to the router via the Layer 2 switch through the firewall's uplink port, forming a complete routing loop. With this configuration, public network access requests, after being routed by the routers, can be addressed and controlled by the firewall, allowing internal servers to provide services without exposing public IP addresses. Furthermore, the default route design of the routers and firewalls forms a dual-active network path, ensuring service continuity when one firewall fails, allowing sessions to be quickly switched to the other firewall, combined with a session synchronization mechanism.

[0051] In one embodiment, the data center internet egress architecture also includes a DDoS cluster, which can be used to monitor and filter public network traffic to block DDoS attacks, such as... Figure 2As shown, a DDoS cluster can include two independently deployed DDoS devices, each connected to a router via a single line, and interconnected via a single line. Alternatively, as... Figure 5 As shown, a DDoS cluster can also be connected to two switches and set up in the gateway resource pool.

[0052] In this embodiment, deploying a DDoS cluster enhances network attack protection capabilities, and two deployment methods are proposed. One method involves connecting two independent DDoS devices to two routers in a single-line side-by-side configuration. The devices are connected via a single heartbeat line to synchronize attack signature databases and session states. When public network traffic enters the data center via the routers, the DDoS devices can perform mirrored traffic inspection. Upon detecting attack traffic, malicious traffic is redirected to a filtering center for filtering, while normal traffic is forwarded to the firewall along its original path. The other deployment method involves side-by-side connecting the DDoS cluster to two switches in the gateway resource pool. In this case, the DDoS devices can perform full traffic inspection of eastbound and westbound traffic through the switch port mirroring function, thereby improving the accuracy of identifying slow attacks targeting web applications. Furthermore, by sharing threat intelligence with WAF devices in the gateway resource pool, cross-device collaborative defense of the attack chain can be achieved.

[0053] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0054] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A data center internet egress architecture, characterized in that, include: Routing and switching equipment, gateway resource pool, and at least one resource pool server, wherein, The gateway resource pool includes two switches and multiple gateway devices. The two switches are cross-connected to the firewall in the routing switching device uplink, and cross-connected to multiple gateway devices downlink. They are also cross-connected to each resource pool server downlink. A Layer 2 network is built on the two switches. The firewall points the detailed internal network segment to the link load balancer in the gateway device through the Layer 2 network. The link load balancer points the default route to the firewall through the Layer 2 network. An internal virtual private cloud is created on the two switches. The link load balancer points the detailed internal network segment to the internal virtual private cloud. The two switches provide Layer 2 and Layer 3 network services to the downstream gateway devices through the intranet virtual private cloud. The two switches and the downstream serially connected resource pool servers construct an open shortest path first network to publish public network default routes to the resource pool servers, and at the same time learn the server network segment routes of the resource pool servers.

2. The data center internet egress architecture according to claim 1, characterized in that, The gateway devices in the gateway resource pool include: link load balancers, SSL certificate offloading devices, WAF protection devices, and load balancers, wherein... The link load balancing device is a side-mounted access device. The external network channel of the link load balancing device establishes a Layer 2 network with the firewall to receive public network traffic, and the internal network channel establishes a Layer 2 network with the internal virtual private cloud on the two switches to form an internal traffic sharing channel. The SSL certificate offloading device, the WAF protection device, and the load balancer all have dual-arm access. The SSL certificate offloading device, the WAF protection device, and the load balancer establish an external network channel for uplink requests and an internal network channel for downlink distribution.

3. The data center internet egress architecture according to claim 2, characterized in that, The link load balancing device enables the link session persistence function so that public network inbound traffic travels back and forth through the same public network link; the link load balancing device also enables a load balancing policy so that public network outbound traffic is distributed to multiple public network outbounds according to the load balancing policy.

4. The data center internet egress architecture according to claim 2, characterized in that, The SSL certificate offloading device, the WAF protection device, and the load balancing device constitute a multi-layer service gateway. Each layer of the service gateway has its external network channel and internal network channel allocated independent IP address ranges and virtual LAN identifiers. The interconnection methods of the multi-layer service gateways include: Add a default route to the external network channel of the first-layer service gateway, pointing to the external virtual LAN interface gateway created by the two switches. In addition to the first-layer service gateway, the external network channel of each layer service gateway is interconnected with the internal network channel of the layer above at Layer 2, and uses the IP address range of the external network channel of the current layer as the interconnection segment; Add a default route to the internal network channel of the last-layer service gateway, pointing to the internal source network address translation virtual LAN interface gateway created by the two switches. Except for the last layer of service gateways, the internal network channels of each layer of service gateways are interconnected with the external network channels of the next layer at Layer 2, and the IP address range of the external network channels of the next layer is used as the interconnection segment. The interfaces of the two switches that connect to the service gateways at each layer are configured as Layer 2 aggregation ports, and the virtual LAN identifiers of the external network channels and internal network channels corresponding to the service gateways at each layer are allowed.

5. The data center internet egress architecture according to claim 4, characterized in that, The service configuration methods of the multi-layer service gateway include: The first-layer service gateway is a load balancing device deployed with primary and backup configurations; The second-layer service gateway is an SSL certificate offloading device deployed using a pooling approach; The third-layer service gateway is a load balancing device deployed with primary and backup configurations; The fourth-layer service gateway is a WAF protection device deployed in a pooled manner and configured as a reverse proxy. The fifth-layer service gateway is a load balancing device deployed with primary and backup configurations.

6. The data center internet egress architecture according to claim 4, characterized in that, In the multi-layer service gateway: The internal network channel of the service gateway at the upper layer of the WAF protection device is interconnected with the external network channel of the gateway device at the lower layer of the WAF protection device at Layer 2, and the IP address range of the external network channel of the gateway device at the lower layer of the WAF protection device is used as the interconnection segment. Specifically, a Virtual LAN identifier is added to the interface between the two switches and the service gateway at the layer above the WAF protection device, allowing external network channels of the gateway device at the layer below the WAF protection device.

7. The data center internet egress architecture according to any one of claims 2 to 6, characterized in that, The link load balancer and the load balancer are deployed as two primary and backup units, connected by a single line for heartbeat detection of primary and backup status; the SSL certificate offloading device and the WAF protection device are deployed in a cluster, with no cable connection between the devices.

8. The data center internet egress architecture according to claim 1, characterized in that, The routing and switching equipment includes two routers, two Layer 2 switches, and two firewalls, wherein... Each of the two routers is connected to a public network leased line and to a Layer 2 switch. The routers and the Layer 2 switches are connected by a single line, and the two routers are deployed independently. Each of the two Layer 2 switches is connected to one of the firewalls. The Layer 2 switches and the firewalls are connected via a single line, and the two firewalls are deployed independently.

9. The data center internet egress architecture according to claim 8, characterized in that, In the routing and switching equipment: Each router's default route points to the public network, and the public network details are directed to the firewall via the downstream Layer 2 switch. Each firewall translates public network addresses into internal network addresses through destination address translation, and each firewall directs the default route to the router through the connected Layer 2 switch.

10. The data center internet egress architecture according to claim 1, characterized in that, The data center internet egress architecture also includes a DDoS cluster, which is used to monitor and filter public network traffic to block DDoS attacks. The DDoS cluster comprises two independently deployed DDoS devices, each connected in a single-line configuration to one of the routers, and the two DDoS devices are interconnected via a single-line connection; or, The DDoS cluster is connected to two of the switches and is set up in the gateway resource pool.

Images