Method for optimizing IPSEC networking, electronic equipment, storage medium and program product

Abstract

The embodiment of the invention discloses a method for optimizing IPSEC (Internet Protocol Security) networking, electronic equipment, a storage medium and a program product. The method comprises the following steps: starting a pre-configured source protection subnet aggregation function at a headquarters, and starting a target protection subnet aggregation function at any branch; the first default route and the j protection subnets are used in the headquarters for cross mapping, and j route resources, j SA resources and j route resources are generated; and performing cross mapping on any branch by using j protection subnets and a second default route to generate k route resources, j SA resources and j route resources. According to the invention, when the IPSEC tunnel is established, an asymmetric resource allocation design mode is realized by adopting a mode of source protection subnet aggregation and target protection subnet aggregation, and the consumption of SA and route resources is reduced, so that the tunnel performance consumption caused by concurrency is remarkably reduced.

Description

Technical Field

[0001] This invention relates to the field of communication technology, and in particular to a method, electronic device, storage medium, and program product for optimizing IPSEC networking. Background Technology

[0002] In standard IPsec tunneling scenarios, the protected subnet typically corresponds to the peer's internal network address, while the source address is the local internal network address. When the original packet carrying the peer's internal network address arrives at the local public network device, it first enters the IPsec protocol stack by querying the routing table (route). The protocol stack further encrypts the packet according to the Security Association (SA) policy and the IPsec routing policy (eroute), transforming it into an encrypted packet with the source and destination addresses being the local and peer's public IP addresses. After these encrypted packets arrive at the peer's public network device, they enter the IPsec decryption protocol stack, decrypt them by looking up the corresponding SA, restore the original packet, and are finally forwarded to the peer's internal network device.

[0003] Among them, route resources, SA resources, and eroute resources are the three core resources in the IPSEC tunnel application scenario.

[0004] In a typical network architecture, internal networks are usually multiple and isolated from each other without tunnel connections. However, after tunnels are established, these internal networks often connect based on the roles of headquarters and branches. A headquarters typically needs to establish tunnel connections with multiple branches. In this architecture, each branch needs to establish a tunnel with headquarters. If the number of branches is n, and each branch establishes m tunnels, then the headquarters needs to establish n×m tunnels. Following conventional symmetrical design, the number of routing resources, SA resources, and eroute resources usually matches the number of tunnels. For the branch end, m tunnels do not cause significant performance pressure; however, for the headquarters end, the SA and eroute resources required for n×m tunnels will greatly consume performance, causing pressure. Therefore, a new IPsec networking method is urgently needed in existing technologies. Summary of the Invention

[0005] The purpose of this invention is to provide a method, electronic device, storage medium, and program product for optimizing IPSEC networking, so as to at least partially solve the above-mentioned problems of the prior art.

[0006] To achieve the above objectives, the present invention provides a method for optimizing IPsec networking, applied to a network comprising a headquarters and n branches, wherein the headquarters comprises k protection subnets, and any one of the n branches comprises j protection subnets; the method includes:

[0007] Step 1: Enable the pre-configured source protection subnet aggregation function at the headquarters and enable the destination protection subnet aggregation function at any branch; or enable the pre-configured destination protection subnet aggregation function at the headquarters and enable the source protection subnet aggregation function at any branch.

[0008] Step two, establish an IPsec tunnel between the headquarters and any of the branches according to the configuration in step one, including:

[0009] When the pre-configured source protection subnet aggregation function is enabled at the headquarters, and the destination protection subnet aggregation function is enabled at any branch: at the headquarters, the first default route and the j protection subnets are cross-mapped to generate j route resources, j SA resources, and j eroute resources; at any branch, the j protection subnets and the second default route are cross-mapped to generate k route resources, j SA resources, and j eroute resources.

[0010] When the pre-configured destination protection subnet aggregation function is enabled at the headquarters, and the source protection subnet aggregation function is enabled at any branch: at the headquarters, the k protection subnets and the third default route are cross-mapped to generate j route resources, k SA resources, and k eroute resources; at any branch, the fourth default route and the k protection subnets are cross-mapped to generate k route resources, k SA resources, and k eroute resources.

[0011] Preferably, step one includes:

[0012] When j is less than k, enable the source protection subnet aggregation function for the headquarters and enable the destination protection subnet aggregation function for any branch.

[0013] When j is greater than k, enable the destination protection subnet aggregation function for the headquarters and enable the source protection subnet aggregation function for any branch.

[0014] Preferably, step two includes:

[0015] If the device enables the source protection subnet aggregation function, it selects one protection subnet from the source protection subnets to establish the first tunnel, and establishes virtual routes for the remaining source protection subnets to associate with the first tunnel.

[0016] If the device enables the destination protection subnet aggregation function, it selects one protection subnet from the destination protection subnets to establish a second tunnel, and establishes virtual routes for the remaining destination protection subnets to associate with the second tunnel.

[0017] Preferably, selecting a protection subnet from the source protection subnet to establish the first tunnel includes: during tunnel negotiation, setting the source protection subnet address in the negotiation message to an arbitrary address; and after successful negotiation, sending out eroute resources with the source protection subnet address as the arbitrary address, as well as route resources including destination protection subnet address information.

[0018] Preferably, selecting a protection subnet from the destination protection subnet to establish a second tunnel includes: setting the destination protection subnet address in the negotiation message to an arbitrary address, and after successful negotiation, sending eroute resources with the destination protection subnet address as the arbitrary address.

[0019] Preferably, the method further includes: generating route resources for packets through configured virtual routes.

[0020] Preferably, the process before step one also includes:

[0021] Automatically generate m×n network IPSEC configurations, where m is the number of tunnels to be established for each branch, and m = j×k.

[0022] Another aspect of the present invention provides an apparatus for optimizing IPsec networking, applied to a network comprising a headquarters and n branches, wherein the headquarters comprises k protection subnets and any one of the n branches comprises j protection subnets, the apparatus comprising:

[0023] The aggregation function activation module is used to: enable the pre-configured source protection subnet aggregation function at headquarters and enable the destination protection subnet aggregation function at any branch; or enable the pre-configured destination protection subnet aggregation function at headquarters and enable the source protection subnet aggregation function at any branch.

[0024] The tunnel configuration module is used to establish an IPSEC tunnel between headquarters and any branch based on the configuration of the aggregation function enabling module, including:

[0025] When the pre-configured source protection subnet aggregation function is enabled at the headquarters, and the destination protection subnet aggregation function is enabled at any branch: at the headquarters, the first default route and j protection subnets are cross-mapped to generate j route resources, j SA resources, and j eroute resources; at any branch, j protection subnets and the second default route are cross-mapped to generate k route resources, j SA resources, and j eroute resources.

[0026] When the pre-configured destination protection subnet aggregation function is enabled at headquarters, and the source protection subnet aggregation function is enabled at any branch: at headquarters, k protection subnets and the third default route are cross-mapped to generate j route resources, k SA resources, and k eroute resources; at any branch, the fourth default route and k protection subnets are cross-mapped to generate k route resources, k SA resources, and k eroute resources.

[0027] Preferably, the aggregation function enabling module can be used for:

[0028] When j is less than k, enable the source protection subnet aggregation function for the headquarters and enable the destination protection subnet aggregation function for any branch.

[0029] When j is greater than k, enable the destination protection subnet aggregation function for the headquarters and enable the source protection subnet aggregation function for any branch.

[0030] Preferably, the tunnel configuration module can be used for:

[0031] If the device enables the source protection subnet aggregation function, it selects one protection subnet from the source protection subnets to establish the first tunnel, and establishes virtual routes to associate the first tunnel with the remaining source protection subnets.

[0032] If the device enables the destination protection subnet aggregation function, it selects one protection subnet from the destination protection subnets to establish a second tunnel, and establishes virtual routing associations for the remaining destination protection subnets to establish second tunnels.

[0033] Preferably, the tunnel configuration module can be used to select a protection subnet from the source protection subnet to establish a first tunnel in the following way: during tunnel negotiation, the source protection subnet address in the negotiation message is set to an arbitrary address, and after successful negotiation, a route resource with an arbitrary source protection subnet address and a route resource including destination protection subnet address information are sent.

[0034] Preferably, the tunnel configuration module can be used to: select a protection subnet from the destination protection subnet to establish a second tunnel in the following way: set the destination protection subnet address in the negotiation message to an arbitrary address, and after successful negotiation, send out eroute resources with the destination protection subnet address as an arbitrary address.

[0035] Preferably, the device further includes a virtual route configuration module, used to generate packet route resources through virtual routing if the device enables the destination protection subnet aggregation function.

[0036] Preferably, the device may further include:

[0037] The configuration module is used to automatically generate m×n network IPSEC configurations, where m is the number of tunnels to be established for each branch, and m = j×k.

[0038] Another aspect of the present invention provides an electronic device, the electronic device comprising:

[0039] processor;

[0040] Memory used to store processor-executable instructions;

[0041] Wherein, when the processor invokes the executable instructions, it implements the method described above and any preferred method thereof.

[0042] Another aspect of the present invention provides a computer-readable storage medium having computer instructions stored thereon, which, when executed by a processor, implement the steps of the methods described in the above aspects and any preferred embodiments.

[0043] Another aspect of the present invention provides a computer program product comprising a computer program that, when executed by a processor, implements the methods described in the above aspects and any preferred embodiments thereof.

[0044] Compared with the prior art, the present invention has at least the following advantages:

[0045] When establishing an IPSEC tunnel, a source protection subnet aggregation and a destination protection subnet aggregation method are adopted to achieve an asymmetric resource allocation design, reduce the consumption of SA and eroute resources, and thus significantly reduce the tunnel performance consumption caused by concurrency. Attached Figure Description

[0046] Figure 1 This is a flowchart illustrating a method for optimizing IPSEC networking, provided as an embodiment of the present invention.

[0047] Figure 2 This is a schematic diagram of a device for optimizing IPSEC networking, provided as an embodiment of the present invention.

[0048] Figure 3 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0049] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0050] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be used interchangeably where appropriate to understand the embodiments of the invention described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a product or device comprising a series of units is not necessarily limited to those explicitly listed, but may include other units not explicitly listed or inherent to such product or device.

[0051] It should be noted that, unless otherwise specified, the embodiments and features described in the present invention can be combined with each other. The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0052] Example 1

[0053] This invention provides a method for optimizing IPsec networking, applicable to a network comprising a headquarters and n branches, wherein the headquarters comprises k protection subnets and any one of the n branches comprises j protection subnets. Figure 1 A flowchart illustrating this method is shown, as follows: Figure 1 As shown, the method includes:

[0054] Step 101: Enable the pre-configured source protection subnet aggregation function at headquarters and enable the destination protection subnet aggregation function at any branch; or enable the pre-configured destination protection subnet aggregation function at headquarters and enable the source protection subnet aggregation function at any branch.

[0055] Step 102, establish an IPsec tunnel between headquarters and any branch according to the configuration in step 101, including:

[0056] When the pre-configured source protection subnet aggregation function is enabled at the headquarters, and the destination protection subnet aggregation function is enabled at any branch: at the headquarters, the first default route and j protection subnets are cross-mapped to generate j route resources, j SA resources, and j eroute resources; at any branch, j protection subnets and the second default route are cross-mapped to generate k route resources, j SA resources, and j eroute resources.

[0057] When the pre-configured destination protection subnet aggregation function is enabled at headquarters, and the source protection subnet aggregation function is enabled at any branch: at headquarters, k protection subnets and the third default route are cross-mapped to generate j route resources, k SA resources, and k eroute resources; at any branch, the fourth default route and k protection subnets are cross-mapped to generate k route resources, k SA resources, and k eroute resources.

[0058] The first to fourth default routes can be any route (represented by the element any), for example, using the all-zero address 0.0.0.0 / 0.

[0059] Prior to step 101, the method further includes: automatically generating m×n network IPSEC configurations, where m is the number of tunnels to be established for each branch, and m = j×k.

[0060] Under normal circumstances, the device will automatically generate an m×n network IPsec configuration (n branches, each branch establishing m tunnels), with j protection subnets at the branch end and k protection subnets at the headquarters. If the number of protection subnets differs among the branches, the number of network IPsec configurations will be m1+m2+m3+…+m n , where m n =j n ×k,j n This represents the number of protection subnets in the nth branch.

[0061] In a preferred embodiment, if the headquarters activates source protection subnet aggregation, the branch offices should correspondingly enable destination protection subnet aggregation; conversely, if the headquarters enables destination protection subnet aggregation, the branch offices must configure source protection subnet aggregation. Given that SA (Security Association) originates from the IKE (Internet Key Exchange) negotiation process, and tunnel asymmetry will hinder successful negotiation, the reversal principle must be followed when implementing aggregation between headquarters and branches. Specifically, if the headquarters enables source protection subnet aggregation, all branches can enable destination protection subnet aggregation; conversely, if the headquarters enables destination protection aggregation, all branches can enable source protection subnet aggregation.

[0062] The protection subnet aggregation function provided by this invention is particularly suitable for environments where headquarters and branches have numerous protection subnets. The more protection subnets there are, the more significant the optimization effect of this function becomes.

[0063] In a preferred embodiment, the activation of the protection subnet aggregation function in step 101 is determined according to the following conditions: when j is less than k, the source protection subnet aggregation function is activated for the headquarters, and the destination protection subnet aggregation function is activated for any branch; when j is greater than k, the destination protection subnet aggregation function is activated for the headquarters, and the source protection subnet aggregation function is activated for any branch.

[0064] Typically, the configuration for source protection subnet aggregation is determined by the end with more protected subnets. For example, if the headquarters has a majority of subnets, source protection subnet aggregation should be enabled at the headquarters end, and destination protection subnet aggregation should be enabled at the branch end for optimal results. Conversely, if the branch end has more protected subnets, source protection subnet aggregation should be configured at the branch end, while destination protection subnet aggregation should be enabled at the headquarters end to ensure optimal performance.

[0065] In a preferred embodiment, step 102 includes:

[0066] If the device enables the source protection subnet aggregation function, it selects one protection subnet from the source protection subnets to establish the first tunnel, and establishes virtual routes to associate the first tunnel with the remaining source protection subnets.

[0067] If the device enables the destination protection subnet aggregation function, it selects one protection subnet from the destination protection subnets to establish a second tunnel, and establishes virtual routing associations for the remaining destination protection subnets to establish second tunnels.

[0068] The process of selecting a protection subnet from the source protection subnet to establish the first tunnel may include: during tunnel negotiation, setting the source protection subnet address in the negotiation message to an arbitrary address; and after successful negotiation, sending out a route resource with an arbitrary source protection subnet address and a route resource including the destination protection subnet address information.

[0069] Selecting a protection subnet from the destination protection subnet to establish a second tunnel may include: setting the destination protection subnet address in the negotiation message to an arbitrary address, and issuing a route resource with an arbitrary destination protection subnet address after successful negotiation. The method may also include: generating route resources for the message through a configured virtual route.

[0070] For example, during tunnel negotiation, if the source protection subnet aggregation switch of the tunnel is turned on, the source protection subnet in the negotiation message becomes 0.0.0.0 / 0, while the destination protection subnet remains unchanged. After successful negotiation, an eroute of the all-zero source protection subnet and a route with details of the destination protection subnet are sent. Symmetrically, the other end should turn on the destination protection subnet aggregation switch and modify the destination protection subnet in the negotiation message to 0.0.0.0 / 0. At this time, an eroute of the all-zero destination protection subnet is generated, but no route is generated.

[0071] All the necessary eroute resources have already been generated during the tunnel negotiation process, so there is no need to add additional eroute resources using virtual routing.

[0072] For devices with source protection subnet aggregation enabled, route resources are automatically generated and do not need to be generated again using virtual routing. For devices with destination protection subnet enabled, since the default route is 0.0.0.0, route resources are not generated; instead, the virtual routing function is used to generate route resources.

[0073] In one implementation, the device enables the virtual route synchronization function: if the destination protection subnet aggregation function is enabled, when using the virtual route synchronization function to synchronize virtual routes, if the tunnel status is successfully negotiated, route resources are generated according to the virtual route configuration; if the tunnel status is not successfully negotiated, the generated route resources are deleted; if the source protection subnet aggregation function is enabled, when using the virtual route synchronization function to synchronize virtual routes, no route resources or eroute resources are generated.

[0074] A virtual route typically contains a triplet of information: [source protection subnet, destination protection subnet, associated tunnel SA]. A virtual route generates one `eroute` resource containing [source protection subnet, destination protection subnet, associated tunnel SA] information, and one `route` resource containing only destination protection subnet information. If the device has source protection subnet aggregation enabled, it can select the first tunnel configuration (corresponding to the first protection subnet) from tunnel configurations with the same source protection subnet to establish a tunnel, and create virtual routes for the remaining tunnel configurations and associate them with this tunnel. Similarly, if the device has destination protection subnet aggregation enabled, it selects the first tunnel configuration with the same destination protection subnet to establish a tunnel, and creates virtual routes for the rest. It is crucial to ensure that the tunnels selected by both ends are symmetrical to guarantee successful negotiation.

[0075] Taking the activation of source protection subnet aggregation at the headquarters end and the activation of destination protection subnet aggregation at the branch end as examples, the resource consumption when using the method provided by this invention is summarized in Tables 1 and 2 below. Table 1 shows the resource consumption for the branch to activate the destination protection subnet aggregation function, and Table 2 shows the resource consumption for the headquarters to activate the source protection subnet aggregation function.

[0076]

[0077] Table 1

[0078]

[0079]

[0080] Table 2

[0081] To facilitate understanding of the protection subnet aggregation function provided by this invention, the source protection subnet aggregation function and the destination protection subnet aggregation function will be further described below.

[0082] Source protection subnetwork aggregation function

[0083] The headquarters has k protected subnets, namely H1, H2...H k Let A2 be the set; each branch has j protection subnets, namely B1, B2...B j Represented by set A2, as follows:

[0084] A1 = {B1, B2, ..., B} j};

[0085] A2 = {H1, H2, ..., H} k}

[0086] Each branch and headquarters are connected by m tunnels, where m = j × k.

[0087] If source protection subnet aggregation is not enabled at the branch end, sets A1 and A2 are cross-mapped to symmetrically generate route and SA resources, as shown in set A3 below, i.e., route = A3, SA = A3. The route only contains headquarters protection subnet information, i.e., route = A2.

[0088] A3={B1→H1,B1→H2,…B1→H k ,

[0089] B2→H1,…B2→H k

[0090] …

[0091] B j →H1,…B j →H k}

[0092] If the headquarters has not enabled the source protection subnet set, the A2 and A1 sets are cross-mapped to symmetrically generate eroute and SA resources, as shown in the set A4 below, i.e., eroute = A4, SA = A4. The route only contains branch protection subnet information, i.e., route = A1.

[0093] A4={H1→B1,H1→B2,…H1→B j ,

[0094] H2→B1,…H2→B j

[0095] …

[0096] H k →B1,…H k →B j}

[0097] When the source protection subnet aggregation function is enabled at the branch end, the cross-mapping between the default route (represented by the element any) and A2 will be used to asymmetrically generate route and SA resources, such as the set A5 below, i.e., route = A5, SA = A5. However, the route still only contains the headquarters protection subnet information, i.e., route = A2.

[0098] A5={any→H1,any→H2,…any→H k}

[0099] When the source protection subnet aggregation function is enabled at the headquarters, the cross-mapping between the default route (represented by the element any) and A1 will be used to asymmetrically generate route and SA resources, such as the set A6 below, i.e., route = A6, SA = A6. However, the route still only contains branch protection subnet information, i.e., route = A1.

[0100] A6={any→B1,any→B2,…any→B j}

[0101] The resource consumption is summarized in Table 3 below:

[0102]

[0103] Table 3

[0104] When source protection subnet aggregation is enabled, the number of source protection subnets in the current device configuration will be reduced for SA and eroute resources. This feature is suitable for devices with a large number of source protection subnets.

[0105] Destination protection subnetwork aggregation function

[0106] Referring to the above description of the source protection subnet aggregation function, if the destination protection subnet aggregation is not enabled at the branch end, the A1 and A2 sets are cross-mapped to generate eroute and SA resources symmetrically, just like when the source protection subnet is not enabled, i.e., eroute = A3, SA = A3, route = A2.

[0107] If the destination protection subnet set is not enabled at headquarters, the A2 and A1 sets are cross-mapped to symmetrically generate eroute and SA resources, just like when the source protection subnet is not enabled, i.e., eroute = A4, SA = A4, route = A1.

[0108] When the destination protection subnet aggregation function is enabled at the branch end, cross-mapping between A1 and the default route (represented by the element any) will be used to asymmetrically generate route and SA resources, such as the set A7 below, i.e., route = A7, SA = A7. However, the route still only contains headquarters protection subnet information, i.e., route = A2.

[0109] A7 = {B1→any, B2→any, …B} j →any}.

[0110] When the destination protection subnet aggregation function is enabled at the headquarters, a cross-mapping between A2 and the default route (represented by the element any) will be used to asymmetrically generate route and SA resources, such as the set A8 below, i.e., route = A8, SA = A8. However, the route still only contains branch protection subnet information, i.e., route = A1.

[0111] A8 = {H1→any,H2→any,…H} k →any}.

[0112] The resource consumption is summarized in Table 4 below:

[0113]

[0114] Table 4

[0115] When destination protection subnet aggregation is enabled, the number of destination protection subnets in the current device configuration will be reduced for SA and eroute resources. This feature is suitable for devices with a large number of source protection subnets.

[0116] The following example further illustrates the function of the method provided in the embodiments of the present invention in reducing resource consumption.

[0117] The method provided in this invention can be applied to network scenarios where tunnels are established between headquarters and branches, and where there are many protected subnets at the headquarters or branch level, thereby improving tunnel performance. It is particularly suitable for application scenarios where the headquarters has many protected subnets, the branches have few protected subnets, and the number of branches is large.

[0118] Assuming the headquarters has 30 protection subnets and tunnels to 1000 branches, with each branch having only one protection subnet, in this case, according to the method provided by this invention, the headquarters enables source protection subnet aggregation, and the branch enables destination protection subnet aggregation. The headquarters' 30,000 tunnels are under pressure, and the corresponding headquarters-side resource consumption is shown in Table 5 below:

[0119]

[0120]

[0121] Table 5

[0122] In this scenario, SA and eroute resources will be saved by 30 times, which will greatly reduce performance consumption for headquarters.

[0123] By employing the method provided in this embodiment of the invention, when establishing an IPSEC tunnel, a source protection subnet aggregation and a destination protection subnet aggregation approach is adopted to achieve an asymmetric resource allocation design, reducing the consumption of SA and eroute resources, thereby significantly reducing the tunnel performance consumption caused by concurrency.

[0124] In this embodiment of the invention, an asymmetric resource allocation design is adopted, where resources no longer need to be consistent with the number of tunnels. Eroute and SA resources are aggregated. Aggregated eroute resources are generated during the tunnel negotiation phase by modifying the source or destination protection subnet address in the packet to any address (0.0.0.0). For devices with destination protection subnet aggregation enabled, route resources are generated on these devices by using virtual routing instead of generating routes during the negotiation phase, reducing overhead. For devices with source protection subnet enabled, the virtual route synchronization function does not need to generate route and eroute resources, eliminating the maintenance performance overhead of the virtual route synchronization function and indirectly reducing performance overhead.

[0125] Example 2

[0126] Based on the same technical concept as in Embodiment 1 above, this embodiment of the invention provides an apparatus for optimizing IPSEC networking, applied to a network including a headquarters and n branches, wherein the headquarters includes k protection subnets and any one of the n branches includes j protection subnets. Figure 2 A schematic diagram of the device is shown, as follows: Figure 2 As shown, the device includes:

[0127] The aggregation function activation module 10 is used to: activate the pre-configured source protection subnet aggregation function at the headquarters and activate the destination protection subnet aggregation function at any branch; or activate the pre-configured destination protection subnet aggregation function at the headquarters and activate the source protection subnet aggregation function at any branch.

[0128] Tunnel configuration module 20, used to establish an IPSEC tunnel between headquarters and any branch according to the configuration of aggregation function enabling module 10, includes:

[0129] When the pre-configured source protection subnet aggregation function is enabled at the headquarters, and the destination protection subnet aggregation function is enabled at any branch: at the headquarters, the first default route and j protection subnets are cross-mapped to generate j route resources, j SA resources, and j eroute resources; at any branch, j protection subnets and the second default route are cross-mapped to generate k route resources, j SA resources, and j eroute resources.

[0130] When the pre-configured destination protection subnet aggregation function is enabled at headquarters, and the source protection subnet aggregation function is enabled at any branch: at headquarters, k protection subnets and the third default route are cross-mapped to generate j route resources, k SA resources, and k eroute resources; at any branch, the fourth default route and k protection subnets are cross-mapped to generate k route resources, k SA resources, and k eroute resources.

[0131] The aggregation function enabling module 10 can be used for:

[0132] When j is less than k, enable the source protection subnet aggregation function for the headquarters and enable the destination protection subnet aggregation function for any branch.

[0133] When j is greater than k, enable the destination protection subnet aggregation function for the headquarters and enable the source protection subnet aggregation function for any branch.

[0134] The tunnel configuration module 20 can be used for:

[0135] If the device enables the source protection subnet aggregation function, it selects one protection subnet from the source protection subnets to establish the first tunnel, and establishes virtual routes to associate the first tunnel with the remaining source protection subnets.

[0136] If the device enables the destination protection subnet aggregation function, it selects one protection subnet from the destination protection subnets to establish a second tunnel, and establishes virtual routing associations for the remaining destination protection subnets to establish second tunnels.

[0137] The tunnel configuration module 20 can be used to select a protection subnet from the source protection subnet to establish a first tunnel in the following way: during tunnel negotiation, the source protection subnet address in the negotiation message is set to an arbitrary address, and after successful negotiation, a route resource with an arbitrary source protection subnet address and a route resource including destination protection subnet address information are sent.

[0138] The tunnel configuration module 20 can be used to select a protection subnet from the destination protection subnet to establish a second tunnel in the following way: set the destination protection subnet address in the negotiation message to an arbitrary address, and after successful negotiation, send out eroute resources with an arbitrary destination protection subnet address.

[0139] The device also includes a virtual route configuration module, which is used to generate route resources for packets through virtual routing if the device enables the destination protection subnet aggregation function.

[0140] The device may further include:

[0141] The configuration module is used to automatically generate m×n network IPSEC configurations, where m is the number of tunnels to be established for each branch, and m = j×k.

[0142] The technical concept of this embodiment is the same as that of Embodiment 1. The implementation details of this embodiment can be referred to the description in Embodiment 1, and will not be repeated here.

[0143] Example 3

[0144] Embodiment 3 of the present invention provides an electronic device, Figure 3 A schematic diagram of the electronic device is shown. (Example) Figure 3 As shown, the electronic device includes:

[0145] Processor 31;

[0146] Memory 32 is used to store processor-executable instructions;

[0147] When the processor 31 invokes executable instructions, it implements the method described in Embodiment 1 and any of its embodiments.

[0148] The electronic device may also include input interfaces, output interfaces, buses, and other components. The input and output interfaces are used for communication between the electronic device and external devices. The bus is used for communication between internal components such as processors and memory.

[0149] Example 4

[0150] Embodiment 4 of the present invention provides a computer-readable storage medium storing computer instructions thereon, which, when executed by a processor, implement the steps of the method described in Embodiment 1 and any of its embodiments. Preferably, the computer-readable storage medium is a non-volatile computer-readable storage medium.

[0151] Example 5

[0152] Embodiment 5 of the present invention provides a computer program product, the computer program product including a computer program, which, when executed by a processor, implements the method described in Embodiment 1 and any of its embodiments.

[0153] By employing the apparatus provided in this embodiment of the invention, when establishing an IPSEC tunnel, a source protection subnet aggregation and a destination protection subnet aggregation method is adopted to realize an asymmetric resource allocation design, reduce the consumption of SA and eroute resources, and thus significantly reduce the tunnel performance consumption caused by concurrency.

[0154] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them. Those skilled in the art should understand that modifications can be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for optimizing IPsec networking, applied to a network comprising a headquarters and n branches, wherein the headquarters comprises k protection subnets, and any one of the n branches comprises j protection subnets; characterized in that, The method includes: Step 1: Enable the pre-configured source protection subnet aggregation function at the headquarters and enable the destination protection subnet aggregation function at any branch; or enable the pre-configured destination protection subnet aggregation function at the headquarters and enable the source protection subnet aggregation function at any branch. Step two, establish an IPsec tunnel between the headquarters and any of the branches according to the configuration in step one, including: When the pre-configured source protection subnet aggregation function is enabled at the headquarters, and the destination protection subnet aggregation function is enabled at any branch: at the headquarters, the first default route and the j protection subnets are cross-mapped to generate j route resources, j SA resources, and j eroute resources; at any branch, the j protection subnets and the second default route are cross-mapped to generate k route resources, j SA resources, and j eroute resources. When the pre-configured destination protection subnet aggregation function is enabled at the headquarters, and the source protection subnet aggregation function is enabled at any branch: at the headquarters, the k protection subnets and the third default route are cross-mapped to generate j route resources, k SA resources, and k eroute resources; at any branch, the fourth default route and the k protection subnets are cross-mapped to generate k route resources, k SA resources, and k eroute resources.

2. The method for optimizing IPsec networking according to claim 1, characterized in that, Step one includes: When j is less than k, enable the source protection subnet aggregation function for the headquarters and enable the destination protection subnet aggregation function for any branch. When j is greater than k, enable the destination protection subnet aggregation function for the headquarters and enable the source protection subnet aggregation function for any branch.

3. The method for optimizing IPSEC networking according to claim 1 or 2, characterized in that, Step two includes: If the device enables the source protection subnet aggregation function, it selects one protection subnet from the source protection subnets to establish the first tunnel, and establishes virtual routes for the remaining source protection subnets to associate with the first tunnel. If the device enables the destination protection subnet aggregation function, it selects one protection subnet from the destination protection subnets to establish a second tunnel, and establishes virtual routes for the remaining destination protection subnets to associate with the second tunnel.

4. The method for optimizing IPSEC networking according to claim 3, characterized in that, Selecting a protection subnet from the source protection subnet to establish a first tunnel includes: during tunnel negotiation, setting the source protection subnet address in the negotiation message to an arbitrary address; and after successful negotiation, sending out a route resource with the source protection subnet address set to the arbitrary address, as well as a route resource including the destination protection subnet address information.

5. The method for optimizing IPSEC networking according to claim 3, characterized in that, Selecting a protection subnet from the destination protection subnet to establish a second tunnel includes: setting the destination protection subnet address in the negotiation message to an arbitrary address, and after successful negotiation, sending out eroute resources with the destination protection subnet address as the arbitrary address.

6. The method for optimizing IPSEC networking according to claim 5, characterized in that, Also includes: The route resource generates packets using the configured virtual route.

7. The method for optimizing IPSEC networking according to claim 1 or 3, characterized in that, Step one includes the following: Automatically generate m×n network IPSEC configurations, where m is the number of tunnels to be established for each branch, and m = j×k.

8. An electronic device, characterized in that, The electronic device includes: processor; Memory used to store processor-executable instructions; Wherein, when the processor invokes the executable instructions, it implements the method of any one of claims 1-7.

9. A computer-readable storage medium, characterized in that, It stores computer instructions that, when executed by a processor, implement the steps of the method according to any one of claims 1-7.

10. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the method of any one of claims 1-7.

Images