A routing table establishment method and device based on interworking of public and private networks

Abstract

The application provides a routing table establishment method and device based on interworking of public and private networks, which comprises the following steps: obtaining a first SID and a second SID; determining a first VPN corresponding to the first SID and a second VPN corresponding to the second SID from a plurality of VPNs; sending a first routing message to a second network node through an interface corresponding to the first VPN, wherein the first routing message comprises the first SID, so that the second network node records a corresponding relationship between the first SID and a first outgoing interface in a public network routing table; and sending a second routing message to a third network node through an interface corresponding to the second VPN, wherein the second routing message comprises the second SID, so that the third network node records a corresponding relationship between the second SID and a second outgoing interface in the public network routing table. Through the technical scheme of the application, the interworking of public and private networks can be realized, and data packets of the public network can be forwarded to the private network based on the SID.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to a method and apparatus for establishing a routing table based on public-private network interconnection. Background Technology

[0002] Segment Routing (SR) is an extended source routing technology. SR uses a header node path selection mechanism, pre-encapsulating the SID (Segment Identifier) ​​of the path to be traversed in the header node. When a data packet passes through each network node along the path, each network node forwards the data packet based on the SID. Except for the header node, other network nodes do not need to maintain path state. SRv6 refers to using SR in IPv6 networks, forwarding data packets using IPv6 addresses as SIDs.

[0003] For example, when a head node receives a data packet, it encapsulates the data packet with a segmented routing tunnel header. The segmented routing tunnel header includes a segmented routing list, which includes the SIDs (such as the IPv6 addresses of network nodes) of each network node on a specific path. Each network node forwards the data packet based on the segmented routing list, thereby guiding the data packet to be forwarded along the specific path through the segmented routing list, thus achieving traffic engineering.

[0004] However, when using SRv6 to forward data packets, it is impossible to achieve interoperability between public and private networks, and it is impossible to forward public network data packets to private networks based on SID, which greatly limits the application scenarios of SRv6. Summary of the Invention

[0005] In view of this, this application provides a method and apparatus for establishing a routing table based on public-private network interconnection, which can realize the interconnection of public and private networks and forward data packets from the public network to the private network based on the SID.

[0006] This application provides a routing table establishment method based on public-private network interconnection, applied to a first network node, the first network node supporting multiple Virtual Private Networks (VPNs), the method comprising:

[0007] Obtain the first identifier (SID) and the second identifier (SID); determine the first VPN corresponding to the first SID from the plurality of VPNs, and determine the second VPN corresponding to the second SID;

[0008] The first routing message is sent to the second network node through the interface corresponding to the first VPN. The first routing message includes the first SID, so that the second network node records the correspondence between the first SID and the first outgoing interface in the public network routing table.

[0009] The second routing message, which includes the second SID, is sent to the third network node through the interface corresponding to the second VPN, so that the third network node records the correspondence between the second SID and the second outgoing interface in the public network routing table.

[0010] This application provides a routing table establishment device based on public-private network interconnection, applied to a first network node, the first network node supporting multiple Virtual Private Networks (VPNs), the device comprising:

[0011] The acquisition module is used to acquire the first identifier (SID) and the second SID.

[0012] The determining module is configured to determine, from the plurality of VPNs, a first VPN corresponding to the first SID, and to determine, from the plurality of VPNs, a second VPN corresponding to the second SID;

[0013] The sending module is configured to send a first routing message to a second network node through the interface corresponding to the first VPN, the first routing message including the first SID, so that the second network node records the correspondence between the first SID and the first outgoing interface in the public network routing table; and to send a second routing message to a third network node through the interface corresponding to the second VPN, the second routing message including the second SID, so that the third network node records the correspondence between the second SID and the second outgoing interface in the public network routing table.

[0014] This application provides an electronic device, including: a processor and a machine-readable storage medium, wherein the machine-readable storage medium stores machine-executable instructions that can be executed by the processor; the processor is used to execute the machine-executable instructions to implement the routing table establishment method based on public-private network interconnection described above.

[0015] This application provides a computer program product, including a computer program that, when executed by a processor, implements the routing table establishment method based on public-private network interconnection described above.

[0016] This application provides a machine-readable storage medium storing machine-executable instructions that can be executed by a processor; wherein the processor is used to execute the machine-executable instructions to implement the routing table establishment method based on public-private network interconnection described in the above example of this application.

[0017] As can be seen from the above technical solutions, in this embodiment, after obtaining the first SID, the first network node determines the first VPN corresponding to the first SID and imports the public network's first SID into the first VPN (i.e., imports the SID from the public network into the first VPN). In this way, the first network node can send a first routing message to the second network node through the interface corresponding to the first VPN, so that the second network node records the correspondence between the first SID and the outgoing interface in the public network routing table. The second network node can then send the data packets corresponding to the first SID to the first network node based on the public network routing table, and can forward public network data packets to the first VPN based on the first SID, thus enabling communication between public and private networks. After obtaining the second SID, the first network node determines the second VPN corresponding to the second SID and imports the public network's second SID into the second VPN. In this way, the first network node can send a second routing message to the third network node through the interface corresponding to the second VPN, so that the third network node records the correspondence between the second SID and the outgoing interface in the public network routing table. The third network node can send the data packet corresponding to the second SID to the first network node based on the public network routing table, and can forward the public network data packet to the second VPN based on the second SID, thus realizing the interconnection between public and private networks.

[0018] The first network node supports multiple VPNs, enabling isolation between different private networks (different VPNs). Specifically, the first network node isolates data packets from different VPNs. Based on this isolation, interoperability between public and private networks can be achieved by importing the public network's SID into the VPN. Attached Figure Description

[0019] Figure 1 This is a flowchart illustrating the routing table establishment method based on public-private network interconnection in this application;

[0020] Figures 2A-2D This is a schematic diagram of the SRv6 network structure in this application;

[0021] Figure 3 This is a flowchart illustrating the routing table establishment method based on public-private network interconnection in this application;

[0022] Figure 4 This is a flowchart illustrating the data packet transmission method based on public-private network interconnection in this application;

[0023] Figure 5 This is a schematic diagram of the structure of the data packet in this application;

[0024] Figure 6 This is a schematic diagram of the routing table establishment device based on public-private network interconnection in this application;

[0025] Figure 7This is a hardware structure diagram of an electronic device according to one embodiment of this application. Detailed Implementation

[0026] This application proposes a routing table establishment method based on public-private network interconnection. This method can be applied to a first network node, and the first network node supports multiple VPNs (Virtual Private Networks). See [link to relevant documentation]. Figure 1 The diagram shown is a flowchart of the method, which may include:

[0027] Step 101: Obtain the first SID and the second SID; determine the first VPN corresponding to the first SID from multiple VPNs, and determine the second VPN corresponding to the second SID from multiple VPNs.

[0028] Step 102: Send a first routing message to the second network node through the interface corresponding to the first VPN. The first routing message may include a first SID, so that the second network node records the correspondence between the first SID and the first outgoing interface in its public network routing table. For example, the second network node may be a node that has established a neighbor relationship with the interface under the first VPN of the first network node. For example, the public network interface of the second network node establishes a neighbor relationship with the interface under the first VPN of the first network node, such as a BGP neighbor relationship.

[0029] Step 103: Send a second routing message to the third network node through the interface corresponding to the second VPN. The second routing message may include the second SID, so that the third network node records the correspondence between the second SID and the second outgoing interface in its public network routing table. For example, the third network node may be a node that has established a neighbor relationship with the interface under the second VPN of the first network node. For example, the public network interface of the third network node establishes a neighbor relationship with the interface under the second VPN of the first network node, such as a BGP neighbor relationship.

[0030] In one example, determining the first VPN corresponding to a first SID from multiple VPNs, and determining the second VPN corresponding to a second SID from multiple VPNs, may include: if the SID prefix of the first SID is the same as the first SID prefix included in the first configuration data, then the first SID is determined to correspond to the first VPN; if the SID prefix of the second SID is the same as the second SID prefix included in the second configuration data, then the second SID is determined to correspond to the second VPN. Here, the first network node includes first configuration data corresponding to the first VPN and second configuration data corresponding to the second VPN. The first configuration data is used to import the SID from the public network into the first VPN, and the second configuration data is used to import the SID from the public network into the second VPN. The first configuration data includes the first SID prefix, and the second configuration data includes the second SID prefix.

[0031] In one example, sending a first routing message to a second network node through the interface corresponding to the first VPN may include, but is not limited to: if the first configuration data includes a first BGP (Border Gateway Protocol) configuration, then based on the first BGP configuration, the first routing message can be sent to the second network node through the interface corresponding to the first VPN. Sending a second routing message to a third network node through the interface corresponding to the second VPN may include, but is not limited to: if the second configuration data also includes a second BGP configuration, then based on the second BGP configuration, the second routing message can be sent to the third network node through the interface corresponding to the second VPN.

[0032] In one example, a third routing message sent by a fourth network node can also be received through the interface corresponding to the first VPN. This third routing message may include the SID of the fourth network node. In this way, the correspondence between the SID of the fourth network node and the third outgoing interface can be recorded in the routing table corresponding to the first VPN.

[0033] It can also receive the fourth routing message sent by the fifth network node through the interface corresponding to the second VPN. The fourth routing message may include the SID of the fifth network node. In this way, the correspondence between the SID of the fifth network node and the fourth outgoing interface can be recorded in the routing table corresponding to the second VPN.

[0034] In one example, the first data packet can be received through the interface corresponding to the first VPN. The second network node can obtain the first SID of the first network node from the first data packet, and use the first SID to query the public network routing table to obtain the first outgoing interface. Then, it can send the first data packet to the first network node through this first outgoing interface. Furthermore, the SID of the fourth network node can be obtained from the first data packet. Using the fourth network node's SID, the routing table corresponding to the first VPN can be queried to obtain the third outgoing interface corresponding to the fourth network node's SID. Finally, the first data packet can be sent to the fourth network node through this third outgoing interface.

[0035] In one example, the second data packet can also be received through the interface corresponding to the second VPN. The third network node can obtain the second SID of the first network node from the second data packet, and then query the public routing table using the second SID to obtain the second outgoing interface. It can then send the second data packet to the first network node through this second outgoing interface. Furthermore, the SID of the fifth network node can be obtained from the second data packet. Using the fifth network node's SID, the routing table corresponding to the second VPN can be queried to obtain the fourth outgoing interface corresponding to the fifth network node's SID, and the second data packet can be sent to the fifth network node through this fourth outgoing interface.

[0036] As can be seen from the above technical solutions, in this embodiment, after obtaining the first SID, the first network node determines the first VPN corresponding to the first SID and imports the public network's first SID into the first VPN (i.e., imports the SID from the public network into the first VPN). In this way, the first network node can send a first routing message to the second network node through the interface corresponding to the first VPN, so that the second network node records the correspondence between the first SID and the outgoing interface in the public network routing table. The second network node can then send the data packets corresponding to the first SID to the first network node based on the public network routing table, and can forward public network data packets to the first VPN based on the first SID, thereby achieving interoperability between public and private networks. After obtaining the second SID, the first network node determines the second VPN corresponding to the second SID and imports the public network's second SID into the second VPN. In this way, the first network node can send a second routing message to the third network node through the interface corresponding to the second VPN, so that the third network node records the correspondence between the second SID and the outgoing interface in the public network routing table. The third network node can send the data packet corresponding to the second SID to the first network node based on the public network routing table, and can forward the public network data packet to the second VPN based on the second SID, thereby realizing the interconnection between the public and private networks.

[0037] The first network node supports multiple VPNs, enabling isolation between different private networks (different VPNs). Specifically, the first network node isolates data packets from different VPNs. Based on this isolation, interoperability between public and private networks can be achieved by importing the public network's SID into the VPN.

[0038] The technical solutions described above in the embodiments of this application will be explained below in conjunction with specific application scenarios.

[0039] This application proposes a routing table establishment method based on public-private network interconnection, which is applied to SRv6 (Segment routing IPv6) networks. That is, each network node in the network has SRv6 forwarding capability, supports the use of segment identifier (SID) to transmit data packets, and supports IPv6 forwarding capability.

[0040] An SRv6 network includes a first network node, which can be an intermediate node. The first network node supports multiple VPNs and can isolate different private networks (different VPNs), meaning it isolates data packets from different VPNs. Building upon this isolation, the first network node enables communication between public and private networks by importing the public network's SID into the VPN.

[0041] For ease of distinction, let's take the example of a first network node supporting two VPNs, and refer to these two VPNs as the first VPN (e.g., VPN1) and the second VPN (e.g., VPN2). Of course, in real-world scenarios, the number of VPNs can be greater, and the handling of multiple VPNs is similar to that of two VPNs.

[0042] An SRv6 network can include a second network node and a fourth network node. The second network node can be a neighbor node of the first VPN, and the fourth network node can also be a neighbor node of the first VPN. For example, the first network node can establish a neighbor relationship (such as a BGP neighbor) with the public network interface of the second network node through the interface of the first VPN. Therefore, the second network node can be referred to as a neighbor node of the first network node's first VPN, that is, a node that establishes a neighbor relationship with the interface of the first VPN. Similarly, the first network node can establish a neighbor relationship (such as a BGP neighbor) with the public network interface of the fourth network node through the interface of the first VPN. Therefore, the fourth network node can be referred to as a neighbor node of the first network node's first VPN.

[0043] An SRv6 network can include a third network node and a fifth network node. The third network node can be a neighbor node of the second VPN, and the fifth network node can also be a neighbor node of the second VPN. For example, the first network node can establish a neighbor relationship (such as a BGP neighbor) with the public network interface of the third network node through the interface of the second VPN. Therefore, the third network node can be referred to as a neighbor node of the first network node's second VPN, that is, a node that establishes a neighbor relationship with the interface of the second VPN. Similarly, the first network node can establish a neighbor relationship (such as a BGP neighbor) with the public network interface of the fifth network node through the interface of the second VPN. Therefore, the fifth network node can be referred to as a neighbor node of the first network node's second VPN.

[0044] The second network node can support multiple VPNs to achieve isolation between different private networks. The second network node can also be a public network device, which does not support isolation between different private networks. Taking the second network node as a public network device as an example, the second network node establishes a neighbor relationship with the private network interface of the first network node through the public network interface.

[0045] The third network node can support multiple VPNs to achieve isolation between different private networks. The third network node can also be a public network device, which does not support isolation between different private networks. Taking the third network node as a public network device as an example, the third network node establishes a neighbor relationship with the private network interface of the first network node through the public network interface.

[0046] The second network node can be an intermediate node or a head node in the SRv6 network. Similarly, the third network node can be an intermediate node or a head node in the SRv6 network. For example, the third and second network nodes can be the same node, or they can be different nodes.

[0047] The fourth network node can support multiple VPNs to achieve isolation between different private networks. The fourth network node can also be a public network device, which does not support isolation between different private networks. Taking the fourth network node as a public network device as an example, the fourth network node establishes a neighbor relationship with the private network interface of the first network node through the public network interface.

[0048] The fifth network node can support multiple VPNs to achieve isolation between different private networks. The fifth network node can also be a public network device and does not support isolation between different private networks. Taking the fifth network node as a public network device as an example, the fifth network node establishes a neighbor relationship with the private network interface of the first network node through the public network interface.

[0049] The fourth network node can be an intermediate node or a tail node in the SRv6 network. Similarly, the fifth network node can be an intermediate node or a tail node in the SRv6 network. For example, the fifth and fourth network nodes can be the same node, or they can be different nodes.

[0050] In one example, see Figure 2A The diagram shows the structure of an SRv6 network, which can include network node A, network node B, network node C, and network node D. Network node B serves as the first network node, network node A as the second and third network nodes, network node C as the fourth network node, and network node D as the fifth network node. In this scenario, network node A is the head node, network nodes C and D are the tail nodes, and network node B is the intermediate node.

[0051] In one example, see Figure 2B The diagram shows the structure of an SRv6 network. An SRv6 network can include network node E, network node A, network node B, network node C, and network node D. Network node B can be the first network node, network node A can be the second network node, network node E can be the third network node, network node C can be the fourth network node, and network node D can be the fifth network node. In this scenario, network node A and network node E are the head nodes, network nodes C and D are the tail nodes, and network node B is the intermediate node.

[0052] In one example, see Figure 2C The diagram shows the structure of an SRv6 network. An SRv6 network can include network node E, network node A, network node B, network node C, and network node D. Network node B can be the first network node, network node A can be the second and third network nodes, network node C can be the fourth network node, and network node D can be the fifth network node. In this scenario, network node E can be the head node, network node A can be an intermediate node, network nodes C and D can be tail nodes, and network node B can also be an intermediate node.

[0053] In one example, see Figure 2D The diagram shows the structure of an SRv6 network. An SRv6 network can include network nodes A, B, C, D, E, and F. Network node B can be the first network node, network node A can be the second and third network nodes, network node C can be the fourth network node, and network node D can be the fifth network node. In this scenario, network node A can be the head node, network node B can be the intermediate node, network node E can be the tail node, and network node F can be the tail node.

[0054] For ease of description, the following will be referred to as Figure 2A This example illustrates the concept; the implementation methods for other scenarios are similar.

[0055] In one example, network node B has an isolation requirement, specifically needing to isolate network nodes C and D. Therefore, network node B does not want to plan any path similar to network node B-network node C-network node D or similar to network node B-network node D-network node C. Based on this, different local VPNs are planned on network node B for the interfaces of network nodes C and D, denoted as VPN 1 (VPN1) and VPN 2 (VPN2).

[0056] See Figure 2A As shown, network node B includes interface IF3, and network node C includes interface IF1. In order to isolate network node C and network node D, interface IF3 of network node B is the interface of VPN1, and interface IF1 of network node C is the public network interface (PUB). In this way, network node B establishes a neighbor (such as a BGP neighbor) with the public network interface IF1 of network node C through interface IF3 of VPN1.

[0057] See Figure 2AAs shown, network node B includes interface IF4, and network node D includes interface IF1. In order to isolate network node C and network node D, interface IF4 of network node B is the interface of VPN2, and interface IF1 of network node D is the public network interface (PUB). In this way, network node B establishes a neighbor (such as a BGP neighbor) with the public network interface IF1 of network node D through interface IF4 of VPN2.

[0058] Network node B includes interface IF1, and network node A includes interface IF1. Interface IF1 of network node B is the interface of VPN1, while interface IF1 of network node A is a public network interface (PUB). Network node B establishes a neighbor relationship (e.g., BGP neighbor) with network node A's public network interface IF1 through VPN1's interface IF1. Network node B also includes interface IF2, and network node A includes interface IF2. Interface IF2 of network node B is the interface of VPN2, while interface IF2 of network node A is a public network interface (PUB). Network node B establishes a neighbor relationship (e.g., BGP neighbor) with network node A's public network interface IF2 through VPN2's interface IF2.

[0059] In summary, it can be seen that, Figure 2A In this context, network node B can be a device that requires private network isolation, while network nodes A, C, and D can be public network devices. Of course, network node A, network node C, and network node D can also be devices that require private network isolation; there are no restrictions on this.

[0060] In one example, see Figure 2A As shown, assume there are two SRv6 policy paths in the SRv6 network: SRv6 Policy Path 1 and SRv6 Policy Path 2. SRv6 Policy Path 1 is: Network Node A - Network Node B - Network Node C, and SRv6 Policy Path 2 is: Network Node A - Network Node B - Network Node D. Based on this, network nodes A, B, C, and D can exchange routing information, for example, through BGP routing messages. When exchanging routing information, network node A's corresponding interface is the public network, and network node A is network node B's public network BGP neighbor. Network node C's corresponding interface is the public network, and network node C is network node B's public network BGP neighbor. Network node D's corresponding interface is the public network, and network node D is network node B's public network BGP neighbor. Network node B's corresponding interface is the private network (VPN), and network node B is network node A, network node C, and network node D's private network BGP neighbor.

[0061] In the above application scenarios, this application proposes a routing table establishment method based on public-private network interconnection, see [link to relevant documentation]. Figure 3 The diagram shown is a flowchart of the method, which may include:

[0062] Step 301: Network node C sends a third routing message to network node B. The third routing message includes the SID of network node C. Network node B receives the third routing message through the interface corresponding to the first VPN and records the correspondence between the SID of network node C and the outgoing interface in the routing table corresponding to the first VPN.

[0063] In one example, network node C can obtain a SID (Segment Identifier). This SID can be statically configured or obtained in other ways; there are no restrictions on the method of acquisition, and it will be referred to as SID-C from now on. SID-C can be used as the SID within the SRv6 policy, that is, the SID that the SRv6 policy indicates the path traversed by.

[0064] Network node C publishes its SID-C to network node B through a third-party routing message. The third-party routing message can be a BGP routing message, an IS-IS routing message, or other routing messages. There are no restrictions on the type of the third-party routing message. The third-party routing message only needs to carry the SID-C of network node C.

[0065] When network node C sends a third-party routing message to network node B, it can do so through interface IF1. Network node B receives this message through interface IF3. Since interface IF3 is the interface corresponding to the first VPN (VPN1), network node B inserts network node C's SID-C into the routing table corresponding to the first VPN. In other words, the routing table corresponding to the first VPN records the mapping between network node C's SID-C and the outgoing interface (interface IF3).

[0066] For the SID-C of network node C, it can be an end type SID-C, an end-x type SID-C, an end.t type SID-C, or an end.dt4 type SID-C. That is, the SID-C of network node C can be any type of SRv6 end, and there is no restriction on the type of this SID-C.

[0067] Step 302: Network node D sends a fourth routing message to network node B. The fourth routing message includes the SID of network node D. Network node B receives the fourth routing message through the interface corresponding to the second VPN and records the correspondence between the SID of network node D and the outgoing interface in the routing table corresponding to the second VPN.

[0068] In one example, network node D can obtain a SID, which can be statically configured or obtained through other methods, hereinafter referred to as SID-D. SID-D can be used as the SID within an SRv6 policy, meaning the SRv6 policy indicates the SID traversed by the path. Network node D can publish its SID-D to network node B via a fourth routing message, which can be a BGP routing message.

[0069] When network node D sends a fourth routing message to network node B, it can do so through interface IF1 of network node D. Network node B receives the fourth routing message through interface IF4. Since interface IF4 is the interface corresponding to the second VPN (VPN2), network node B inserts the SID-D of network node D into the routing table corresponding to the second VPN. That is, the routing table corresponding to the second VPN records the correspondence between the SID-D of network node D and the outgoing interface (interface IF4).

[0070] For network node D, the SID-D can be of type end, type end-x, type end.t, or type end.dt4.

[0071] Step 303: Network node B obtains the first SID and the second SID.

[0072] In one example, network node B can obtain a first SID (Segment Identifier). This first SID can be statically configured or obtained through other methods; there are no restrictions on the method used, and it will be hereinafter referred to as SID-B1. Furthermore, network node B can obtain a second SID (Segment Identifier). This second SID can also be statically configured or obtained through other methods; there are no restrictions on the method used, and it will be hereinafter referred to as SID-B2. SID-B1 and SID-B2 can be used as SIDs within an SRv6 policy, that is, SIDs along the path indicated by the SRv6 policy.

[0073] Step 304: Network node B determines the first VPN corresponding to the first SID from among multiple VPNs. Network node B sends a first routing message to network node A through the interface corresponding to the first VPN. The first routing message may include the first SID. After receiving the first routing message, network node A records the correspondence between the first SID and the outgoing interface in its public routing table.

[0074] In one example, after network node B obtains the first SID (SID-B1), SID-B1 can be of type end, end-x, end.t, or end.dt4. Since network node A is a public network device, network node B can only publish SID-B1 to network node A through public BGP neighbors, not through private BGP neighbors. Therefore, because network node B does not have a corresponding public BGP neighbor for network node A, it cannot publish SID-B1 to network node A. Consequently, network node A cannot obtain SID-B1, and thus cannot send data packets to network node B, preventing communication between the public and private networks and hindering the forwarding of public network data packets to the private network based on the SID.

[0075] In response to the above findings, this embodiment requires special configuration of network node B to enable it to publish SID-B1 to network node A. For example, first configuration data corresponding to the first VPN can be configured on network node B. This first configuration data, used to import the SID from the public network into the first VPN, includes a first SID prefix that is identical to the prefix of SID-B1. This allows SID-B1 to be imported from the public network into the first VPN, and subsequently published to network node A through the BGP neighbor corresponding to the first VPN.

[0076] In summary, if network node B has a need for private network isolation, by making special configurations / implementations on network node B, the SRv6 SID (i.e., SID-B1) under the public network can be introduced into the first VPN. Then, through the neighbor of network node A under the first VPN, SID-B1 can be published to network node A. On the basis of publishing SID-B1 to network node A, the purpose of different private network isolation can also be achieved.

[0077] The first configuration data may include an instance identifier of the first VPN, indicating that this first configuration data is configuration data under the first VPN. This first configuration data is used to import a SID from the public network into the first VPN. For example, the first configuration data includes descriptive information, which includes a first SID prefix (such as the prefix of SID-B1), and the descriptive information indicates that the SID corresponding to the first SID prefix is ​​imported from the public network into the first VPN. For example, the descriptive information can be expressed as: route-replicate from public protocol srv6{end|end-x}[route-policy route-policy-name].

[0078] In the above description, route-policy refers to the function of implementing multi-tenant isolation and routing policy synchronization, importing routes into the VPN, and realizing route isolation and node access control between tenants.

[0079] In the above description, `public protocol srv6{end|end-x}` represents a public SRv6 route, which is either an SRv6 route of type `end` or `end-x`. Besides `end` and `end-x`, it can also be of type `end.t` or `end.dt4`, meaning it can be an SRv6 route of any type.

[0080] In the above description, `route-replicate from public protocol srv6{end|end-x}` means importing public network srv6 routes of type `end` or `end-x` into the VPN. Since this description corresponds to the first VPN, it indicates that public network srv6 routes of type `end` or `end-x` are imported into the first VPN. For example, an srv6 route of type `end` or `end-x` can be a SID route, i.e., an SID.

[0081] In the above description, route-policy represents the routing policy, route-policy-name represents the routing policy name, route-policy represents filtering the specified SID prefix, and route-policy-name represents the first SID prefix. That is, filtering SIDs that match the first SID prefix and importing this SID into the first VPN. This SID is a public network end-type srv6 route or an end-x type srv6 route.

[0082] In summary, the above description indicates that the SID corresponding to the first SID prefix is ​​introduced from the public network to the first VPN, and the SID corresponding to the first SID prefix is ​​an end type or end-x type srv6 route.

[0083] In one example, the first configuration data can be represented as follows:

[0084] [Sysname]ip VPN-instance VPN1

[0085] [Sysname-vpn-instance-vpn1]address-family ipv6

[0086] [Sysname-vpn-ipv6-vpn1]route-replicate from public protocol srv6 endroute-policy deviceB

[0087] route-policy deviceB: if-match ipv6-address prefix-length

[0088] In the first configuration data mentioned above, vpn-instance vpn1 indicates that the VPN instance is vpn1. That is, this first configuration data corresponds to the first VPN (VPN1), and vpn1 is the instance identifier of the first VPN.

[0089] The address-family ipv6 indicates that the first VPN corresponds to the IPv6 address family, and this is optional.

[0090] `route-replicate from public protocol srv6 end route-policy deviceB` means that public network srv6 routes of type `end` will be imported into the first VPN. `route-policy` indicates filtering, that is, filtering is performed based on the `route-policy`. `route-policy deviceB` indicates filtering by a specified SID prefix (the SID prefix corresponding to deviceB), that is, importing srv6 routes matching the specified SID prefix into the first VPN.

[0091] The `if-match ipv6-address prefix-length` directive corresponds to `deviceB`. `match ipv6-addressprefix` specifies the SID prefix, here the first SID prefix, which is the prefix of SID-B1. For example, if the first SID (SID-B1) sent by network node B to network node A is known beforehand, the prefix of SID-B1 can be determined and configured in the first configuration data. `length` indicates the length of the first SID prefix. For the SID-B1 prefix (i.e., the first SID prefix in the first configuration data), the format of SID-B1 can be Locator + Function + Args. The Function field is also called the Opcode field; configuring different Opcodes is equivalent to defining different Functions. Based on this, the SID-B1 prefix can be the Locator part of SID-B1. Alternatively, the SID-B1 prefix can be both the Locator and Function parts of SID-B1. Alternatively, the prefix of SID-B1 can be the Locator part, Function part, and Args part of SID-B1. In this case, the prefix of SID-B1 is the complete part of SID-B1, that is, the prefix of SID-B1 is SID-B1.

[0092] In one example, since the SID prefix of the first SID (SID-B1) is the same as the first SID prefix included in the first configuration data, network node B determines that SID-B1 corresponds to the first VPN. Because the first configuration data is used to introduce the public network SRv6 SID (i.e., SID-B1) into the first VPN, network node B sends a first routing message to network node A through the interface corresponding to the first VPN, that is, advertising SID-B1 to network node A through the neighbors of network node A under the first VPN.

[0093] The first routing message can be a BGP routing message, an IS-IS routing message, or other routing messages; there are no restrictions on the type of the first routing message. The first routing message only needs to carry the SID-B1 of network node B. When network node B sends the first routing message to network node A, it can do so through network node B's interface IF1 (i.e., the interface corresponding to the first VPN).

[0094] When network node A receives this first routing message through interface IF1, since interface IF1 is a public network interface and network node A has not divided into multiple VPNs or performed private network isolation, network node A records the correspondence between SID-B1 and the outgoing interface (interface IF1) in the public network routing table.

[0095] In one example, after introducing the public SRv6 SID (i.e., SID-B1) into the first VPN, in order for network node B to send a first routing message to network node A through the interface corresponding to the first VPN, assuming the first routing message is a BGP routing message, the first configuration data can include a first BGP configuration. This first BGP configuration is used to indicate the SID introduced into the first VPN. Based on this first BGP configuration, network node B will send a BGP routing message to network node A through the interface corresponding to the first VPN, and the BGP routing message can include SID-B1.

[0096] For example, the first BGP configuration may include a network configuration, which is used to send the SID of the private network to the BGP peer. Since network node B establishes a BGP neighbor relationship with network node A, the BGP peer is network node A. For example, this network configuration can be represented as:

[0097] bgp 100

[0098] IP VPN-Instance VPN1

[0099] address-family ipv6

[0100] network ipv6-address prefix-length

[0101] In the above network configuration, `bgp 100` indicates that the AS is 100, and AS represents the Autonomous System to which network node B and network node A belong. `ip vpn-instance vpn1` indicates that the VPN instance is VPN1, corresponding to the first VPN (VPN1). `network ipv6-address prefix` indicates the network configuration for the `ipv6-address prefix`, where `ipv6-addressprefix` represents the first SID prefix (i.e., the prefix of SID-B1). This means that network configuration is performed for the first SID prefix, requiring the publication of BGP routing messages for that prefix. The content of this network configuration is not restricted. `length` indicates the length of the first SID prefix.

[0102] Clearly, since the prefix of SID-B1 matches the prefix of the first SID, based on the network configuration, network node B sends a BGP routing message to network node A through the interface corresponding to the first VPN.

[0103] For example, the first BGP configuration may include an import configuration, which is used to send the SID of the imported private network to the BGP peer. For example, this import configuration can be represented as:

[0104] bgp 100

[0105] IP VPN-Instance VPN1

[0106] address-family ipv6

[0107] import-route protocol srv6 route-policy

[0108] In the above import configuration, `route protocol srv6 route-policy` indicates that an SRv6 routing policy is published via routing messages. This SRv6 routing policy is used to indicate the route for SID-B1. Therefore, it is necessary to publish BGP routing messages for SID-B1. There are no restrictions on the content of this import configuration.

[0109] Step 305: Network node B determines the second VPN corresponding to the second SID from among multiple VPNs. Network node B sends a second routing message to network node A through the interface corresponding to the second VPN. The second routing message may include the second SID. After receiving the second routing message, network node A records the correspondence between the second SID and the outgoing interface in its public routing table.

[0110] In one example, the second SID (i.e., SID-B2) can be of type end, type end-x, type end.t, or type end.dt4.

[0111] In one example, network node B needs special configuration to enable it to advertise SID-B2 to network node A. For instance, a second configuration data corresponding to the second VPN can be configured on network node B. This second configuration data is used to import the SID from the public network into the second VPN, and it includes a second SID prefix that is identical to the prefix of SID-B2. This allows SID-B2 to be imported from the public network into the second VPN, and subsequently advertised to network node A through the BGP neighbor of the second VPN.

[0112] In summary, if network node B has a need for private network isolation, by making special configurations / implementations on network node B, the SRv6 SID (i.e., SID-B2) under the public network can be introduced into the second VPN. Then, through the neighbor of network node A under the second VPN, SID-B2 can be published to network node A. On the basis of publishing SID-B2 to network node A, the purpose of different private network isolation can also be achieved.

[0113] The second configuration data includes an instance identifier for the second VPN, indicating that it is configuration data under the second VPN. This second configuration data is used to import a SID from the public network into the second VPN. For example, the second configuration data includes descriptive information, which includes a second SID prefix (such as the prefix of SID-B2), and the descriptive information indicates that the SID corresponding to the second SID prefix is ​​imported from the public network into the second VPN. The second configuration data is similar to the first configuration data and will not be repeated here.

[0114] In one example, since the SID prefix of the second SID (SID-B2) is the same as the second SID prefix included in the second configuration data, network node B determines that SID-B2 corresponds to the second VPN. Because the second configuration data is used to introduce the public network SRv6 SID (i.e., SID-B2) into the second VPN, network node B sends a second routing message to network node A through the interface corresponding to the second VPN.

[0115] When network node B sends a second routing message to network node A, it can do so through network node B's interface IF2 (i.e., the interface corresponding to the second VPN).

[0116] When network node A receives this second routing message through interface IF2, since interface IF2 is a public network interface and network node A has not divided into multiple VPNs or performed private network isolation, network node A records the correspondence between SID-B2 and the outgoing interface (interface IF2) in the public network routing table.

[0117] In one example, to enable network node B to send a second routing message to network node A through the interface corresponding to the second VPN, the second configuration data includes a second BGP configuration. This second BGP configuration indicates the SID to be advertised and introduced into the second VPN. Based on this second BGP configuration, network node B sends a BGP routing message to network node A through the interface corresponding to the second VPN, and the BGP routing message may include SID-B2. The second BGP configuration is similar to the first BGP configuration and will not be repeated here.

[0118] This application proposes a data packet transmission method based on public-private network interconnection. See [link to relevant documentation]. Figure 4 The diagram shown is a flowchart of the data packet transmission method, which may include:

[0119] Step 401: Configure the first SRv6 policy and the second SRv6 policy for network node A.

[0120] For example, if network node A is the head node, an SRv6 policy needs to be configured on network node A. An SRv6 policy can also be called an SRv6 TE Policy, which stands for Traffic Engineering Policy based on IPv6 segment routing. An SRv6 policy consists of multiple candidate paths with different priorities. Each candidate path includes one or more forwarding paths identified by a list of SIDs. The SID list indicates the end-to-end path between the head node and the tail node, and instructs each node to follow the specified path for data packet forwarding. If a data packet is imported into an SRv6 policy, the SID list is added to the data packet by the head node.

[0121] For SRv6 policies, the following triples can be used to globally and uniquely identify an SRv6 policy: HeadEnd: The node generated by the SRv6 policy. Color Attribute: An extended community attribute carried by the SRv6 policy; BGP routes carrying the same color attribute can use this SRv6 policy. Endpoint: The destination address of the SRv6 policy. Color attributes and endpoint information are added to the SRv6 policy through configuration. The headend matches the corresponding SRv6 policy using the color attribute and next hop carried by the route.

[0122] Color attributes define application-level network SLA (Service Level Agreement) policies, which can plan network paths based on specific business SLAs and realize the segmentation of business value.

[0123] An SRv6 policy consists of multiple candidate paths with different priorities. Each candidate path includes one or more forwarding paths identified by a Segment List (SID list). For each candidate path, an SRv6 policy includes one or more candidate paths. When forwarding data packets using an SRv6 policy, the optimal path is selected from these candidate paths based on their priorities.

[0124] The SID list contains forwarding path information for data packets and consists of segment identifiers of each node along the forwarding path. A candidate path can consist of a single SID list or multiple weighted SID lists. The SID list instructs network nodes to forward data packets. After selecting a candidate path, load balancing can be performed among multiple SID lists along the candidate path based on their weights.

[0125] The segment identifier in the SID list is in IPv6 address format, totaling 128 bits. The segment identifier format can be Locator:Function:Args (parameters). The Function field is also called the Opcode field; configuring different Opcodes is equivalent to defining different Functions. After statically configuring various types of Opcodes using the Opcode command, Locator + Opcode + Args form a unique IPv6 address format segment identifier, i.e., the SRv6 SID. After the SRv6 SID is generated, it is added to the local SID table of this node, and can also be advertised externally via routing messages.

[0126] During data packet forwarding, the Locator portion within the SRv6 SID assists nodes in route addressing, locates the SRv6 SID's generating node, and forwards the data packet to that generating node. The Opcode portion instructs the generating node of the SRv6 SID to perform the corresponding functional operation.

[0127] For example, the End command is an SRv6 command, and the SID bound to the End command is called the End SID. The End SID indicates a node. The End SID can instruct network nodes to forward data packets to the node that published that SID. When the data packet arrives at the node, the node executes the End command to process the data packet.

[0128] The execution actions of the End command may include: decrementing the value of SL by 1, retrieving the next SID from the SRH based on SL and updating the destination address field of the IPv6 header, and then forwarding the packet based on a table lookup of the destination address field.

[0129] See Figure 2A As shown, a first SRv6 policy and a second SRv6 policy need to be pre-configured on network node A. The first SRv6 policy corresponds to the path "network node A-network node B-network node C", and the second SRv6 policy corresponds to the path "network node A-network node B-network node D".

[0130] For example, the first SRv6 policy may include the SID-C of network node C and the SID-B1 of network node B. The SID-C of network node C is used to instruct network node B to send data packets to network node C, and the SID-B1 of network node B is used to instruct network node A to send data packets to network node B. This embodiment does not restrict how network node A configures the first SRv6 policy, as long as the first SRv6 policy includes the SID-C of network node C and the SID-B1 of network node B.

[0131] For example, the second SRv6 policy may include the SID-D of network node D and the SID-B2 of network node B. The SID-D of network node D is used to instruct network node B to send data packets to network node D, and the SID-B2 of network node B is used to instruct network node A to send data packets to network node B. This embodiment does not restrict how network node A configures the second SRv6 policy, as long as the second SRv6 policy includes the SID-D of network node D and the SID-B2 of network node B.

[0132] Step 402: Network node A receives the first data packet, determines the first SRv6 policy corresponding to the first data packet, and encapsulates the first data packet with an SRH header and an IPv6 header based on the first SRv6 policy.

[0133] In one example, network node A receives a first data packet 1 (i.e., the original packet). The destination IP address of the first data packet 1 is the IP address of a device (such as a server or host) connected to network node C, and the first SRv6 policy also includes this IP address, indicating that the first SRv6 policy is configured for this IP address. Based on this, the first data packet 1 corresponds to the first SRv6 policy.

[0134] Network node A encapsulates an SRH header and an IPv6 header into data packet 1 using the first SRv6 policy, resulting in data packet 2. (See also...) Figure 5 The diagram shown is a structural schematic of the first data packet 2. The original packet (i.e., the first data packet 1) includes an IPv6 header or an IPv4 header, and the original packet includes a payload.

[0135] The SRH header (Segment Routing Header, also known as the segmented routing header) can include the following in sequence: Next Header: used to indicate the type of the message header that follows the SRH header, such as IPv4 encapsulation, IPv6 encapsulation, IPv6-Route, ICMPv6, etc.

[0136] Hdr Ext Len (Header Extension Length): Used to indicate the length of the segmented routing tunnel header. Hdr Ext Len can refer to the length of the segmented routing tunnel header excluding the first 8 bytes (the first 8 bytes are of fixed length).

[0137] Routing Type: Used to indicate the type of the route header.

[0138] SL (Segments Left): This represents the number of intermediate nodes that should still be visited before reaching the destination node (tail node), i.e., the number of intermediate nodes between the current node and the destination node.

[0139] Last Entry: The index of the last element in the segment route list.

[0140] Flags: These are identifiers used to represent data packets. Flags consist of 8 bits.

[0141] Tag: Used to identify data packets in the same group.

[0142] Segment List[0]~Segment List[n-1]: Segment routing list (also called segment list), the segment routing list is used to carry the SID of each node, Figure 5 In this embodiment, Segment List[0], Segment List[1], and Segment List[2] are used as examples. In this embodiment, the segment routing list includes the SID-C of network node C and the SID-B1 of network node B. For example, Segment List[0] is SID-B1 and Segment List[1] is SID-C.

[0143] Option TLVs (Option Type Length Value): Used to extend the segmented route tunnel header.

[0144] The IPv6 header can include the following contents in sequence: Version, Traffic Class, Flow Label, Payload Length, Next=43 (indicating that the IPv6 header is followed by a segmented routing tunnel header), Hop Limit, Source Address, and Destination Address.

[0145] The contents of the above fields in the IPv6 header are not restricted in this embodiment.

[0146] Step 403: Network node A sends the first data packet to network node B.

[0147] After receiving the first data packet 2, network node A queries the public network routing table through Segment List[0] of the first data packet 2 to obtain the outgoing interface corresponding to Segment List[0]. For example, if Segment List[0] is SID-B1, querying the public network routing table through SID-B1 reveals that the outgoing interface corresponding to SID-B1 is interface IF1. Therefore, network node A sends the first data packet to network node B through interface IF1.

[0148] When network node A sends the first data packet to network node B through interface IF1, it needs to modify the Destination Address field of the IPv6 packet header to SID-B1 (i.e. Segment List[0]) to obtain the first data packet 3, and network node A sends the first data packet 3 to network node B.

[0149] In summary, network node A can obtain the first SID (SID-B1) of network node B from the first data packet, and then query the public network routing table using the first SID to obtain the outgoing interface (interface IF1). Network node A then sends the first data packet to network node B through this outgoing interface (interface IF1).

[0150] Step 404: Network node B receives the first data packet through the interface corresponding to the first VPN, obtains the SID-C of network node C from the first data packet, queries the routing table corresponding to the first VPN through the SID-C of network node C, and obtains the outgoing interface corresponding to the SID-C of network node C.

[0151] For example, when network node B receives the first data packet 3 through interface IF1, since the Destination Address field of the first data packet 3 is SID-B1, and SID-B1 is the SID of network node B, network node B needs to process the first data packet 3, that is, to perform subsequent forwarding processing.

[0152] Network node B needs to obtain the value of the SL field from the SRH header of the first data packet 3. If the value of the SL field is not 0, then network node B needs to obtain the next segment routing identifier of the current segment routing identifier from the SRH header of the first data packet 3. The current segment routing identifier is Segment List[0], and the next segment routing identifier is Segment List[1]. Segment List[1] is SID-C. Therefore, network node B needs to query the routing table through SID-C.

[0153] Since network node B receives the first data packet 3 through interface IF1, and interface IF1 is the interface corresponding to the first VPN, network node B queries the routing table corresponding to the first VPN through SID-C. Because the routing table corresponding to the first VPN includes the correspondence between network node C's SID-C and the outgoing interface (interface IF3), it is determined that the outgoing interface corresponding to SID-C is interface IF3.

[0154] Step 405: Network node B sends the first data packet to network node C through the outgoing interface.

[0155] When network node B sends the first data packet to network node C through interface IF3, it needs to modify the Destination Address field of the IPv6 packet header to SID-C (i.e. Segment List[1]) to obtain the first data packet 4, and network node B sends the first data packet 4 to network node C.

[0156] When network node C receives the first data packet 4 through interface IF1, since the Destination Address field of the first data packet 4 is SID-C, and SID-C is the SID of network node C, network node C needs to process the first data packet 4, that is, to perform subsequent forwarding processing.

[0157] Network node C needs to obtain the value of the SL field from the SRH header of the first data packet 4. If the value of the SL field is 0, network node C removes the IPv6 header and SRH header to obtain the first data packet 1. Network node C forwards the first data packet 1 based on its destination IP address; this process will not be described in detail.

[0158] Step 406: Network node A receives the second data packet, determines the second SRv6 policy corresponding to the second data packet, and encapsulates the second data packet with an SRH header and an IPv6 header based on the second SRv6 policy.

[0159] In one example, network node A receives a second data packet 1 (i.e., the original packet). The destination IP address of the second data packet 1 is the IP address of a device (such as a server or host) connected to network node D, and the second SRv6 policy also includes this IP address, indicating that the second SRv6 policy is configured for this IP address. Based on this, the second data packet 1 corresponds to the second SRv6 policy.

[0160] Network node A encapsulates an SRH header and an IPv6 header into the second data packet 1 based on the second SRv6 policy to obtain the second data packet 2. The SRH header includes the SID-D of network node D and the SID-B2 of network node B.

[0161] Step 407: Network node A sends a second data packet to network node B.

[0162] For example, network node A queries the public network routing table through SID-B2 and finds that the outgoing interface corresponding to SID-B2 is interface IF2. It then modifies the Destination Address field in the IPv6 header to SID-B2, and obtains the second data packet 3. Network node A then sends the second data packet 3 to network node B through interface IF2.

[0163] Step 408: Network node B receives the second data packet through the interface corresponding to the second VPN, obtains the SID-D of network node D from the second data packet, queries the routing table corresponding to the second VPN through the SID-D of network node D, and obtains the outgoing interface corresponding to the SID-D of network node D.

[0164] For example, network node B obtains SID-D from the second data packet 3. Since network node B receives the second data packet 3 through interface IF2, and interface IF2 is the interface corresponding to the second VPN, network node B queries the routing table corresponding to the second VPN through SID-D and finds that the outgoing interface is interface IF4.

[0165] Step 409: Network node B sends a second data packet to network node D through its outgoing interface.

[0166] When network node B sends the second data packet to network node D through interface IF4, it needs to modify the Destination Address field of the IPv6 packet header to SID-D (i.e., Segment List[1]) to obtain the second data packet 4. When network node D receives the second data packet 4 through interface IF1, since the Destination Address field of the second data packet 4 is SID-D, network node D needs to process the second data packet 4. Network node D strips off the IPv6 packet header and SRH header to obtain the second data packet 1, and forwards the second data packet 1 based on the destination IP address of the second data packet 1.

[0167] As can be seen from the above technical solutions, in this embodiment, public network data packets can be forwarded to the first VPN based on the first SID, thereby enabling public-private network interoperability. Public network data packets can also be forwarded to the second VPN based on the second SID, thus enabling public-private network interoperability. Network node B supports multiple VPNs, enabling isolation between different private networks (different VPNs), i.e., isolating data packets from different VPNs. Based on the isolation of different private networks, by introducing the public network SID into the VPN, public-private network interoperability can be achieved. This provides a flexible isolation method for SRv6-based VPN planning, used for combined public / private network planning, and for multiple private network isolation planning. It improves the isolation flexibility of SRv6 policy SIDs, solves the public-private network path switching problem of SRv6 policy, expands support for the requirement of public-private network interoperability using SRv6 policy, and supports forwarding between public and private networks.

[0168] Based on the same application concept as the above method, this application proposes a routing table establishment device based on public-private network interconnection, applied to a first network node. The first network node supports multiple Virtual Private Networks (VPNs). See [link to relevant documentation]. Figure 6 The diagram shown is a structural schematic of the device, which includes:

[0169] Module 61 is used to obtain the first identifier SID and the second SID;

[0170] The determining module 62 is configured to determine, from the plurality of VPNs, a first VPN corresponding to the first SID, and to determine, from the plurality of VPNs, a second VPN corresponding to the second SID;

[0171] The sending module 63 is configured to send a first routing message to a second network node through the interface corresponding to the first VPN, the first routing message including the first SID, so that the second network node records the correspondence between the first SID and the first outgoing interface in the public network routing table; and to send a second routing message to a third network node through the interface corresponding to the second VPN, the second routing message including the second SID, so that the third network node records the correspondence between the second SID and the second outgoing interface in the public network routing table.

[0172] In one example, the determining module 62 determines the first VPN corresponding to the first SID from the plurality of VPNs, and determines the second VPN corresponding to the second SID from the plurality of VPNs specifically by: if the SID prefix of the first SID is the same as the first SID prefix included in the first configuration data, then the first SID is determined to correspond to the first VPN; if the SID prefix of the second SID is the same as the second SID prefix included in the second configuration data, then the second SID is determined to correspond to the second VPN.

[0173] The first network node includes first configuration data corresponding to the first VPN and second configuration data corresponding to the second VPN. The first configuration data is used to import the SID from the public network into the first VPN, and the second configuration data is used to import the SID from the public network into the second VPN.

[0174] In one example, when the sending module 63 sends a first routing message to a second network node through the interface corresponding to the first VPN, it is specifically used to: if the first configuration data includes a first BGP configuration, then based on the first BGP configuration, send a first routing message to the second network node through the interface corresponding to the first VPN; when the sending module 63 sends a second routing message to a third network node through the interface corresponding to the second VPN, it is specifically used to: if the second configuration data also includes a second BGP configuration, then based on the second BGP configuration, send a second routing message to the third network node through the interface corresponding to the second VPN.

[0175] In one example, the apparatus further includes: a processing module, configured to receive a third routing message sent by a fourth network node through an interface corresponding to the first VPN, the third routing message including the SID of the fourth network node; record the correspondence between the SID of the fourth network node and a third outgoing interface in a routing table corresponding to the first VPN; receive a fourth routing message sent by a fifth network node through an interface corresponding to the second VPN, the fourth routing message including the SID of the fifth network node; and record the correspondence between the SID of the fifth network node and a fourth outgoing interface in a routing table corresponding to the second VPN.

[0176] In one example, the apparatus further includes: a receiving module, configured to receive a first data packet through the interface corresponding to the first VPN; wherein the second network node obtains the first SID of the first network node from the first data packet, queries the public network routing table through the first SID to obtain the first outgoing interface, and sends the first data packet through the first outgoing interface;

[0177] Alternatively, the second data packet is received through the interface corresponding to the second VPN; wherein, the third network node obtains the second SID of the first network node from the second data packet, queries the public network routing table through the second SID to obtain the second outgoing interface, and sends the second data packet through the second outgoing interface;

[0178] The processing module is further configured to, if the receiving module receives the first data packet, obtain the SID of the fourth network node from the first data packet, query the routing table corresponding to the first VPN through the SID of the fourth network node, obtain the third outgoing interface corresponding to the SID of the fourth network node, and send the first data packet to the fourth network node through the third outgoing interface.

[0179] Alternatively, if the receiving module receives the second data packet, it obtains the SID of the fifth network node from the second data packet, queries the routing table corresponding to the second VPN through the SID of the fifth network node, obtains the fourth outgoing interface corresponding to the SID of the fifth network node, and sends the second data packet to the fifth network node through the fourth outgoing interface.

[0180] Based on the same application concept as the method described above, this application proposes an electronic device (such as a first network node), see [link to relevant documentation]. Figure 7 As shown, it includes: a processor 71 and a machine-readable storage medium 72, the machine-readable storage medium 72 storing machine-executable instructions that can be executed by the processor 71; the processor 71 is used to execute the machine-executable instructions to implement the routing table establishment method based on public-private network interconnection in the above example.

[0181] Based on the same application concept as the above method, this application embodiment also provides a machine-readable storage medium storing a plurality of computer instructions, which, when executed by a processor, can implement the routing table establishment method based on public-private network interconnection disclosed in the above example.

[0182] The aforementioned machine-readable storage medium can be any electronic, magnetic, optical, or other physical storage device that can contain or store information, such as executable instructions, data, etc. For example, machine-readable storage media can be: RAM (Random Access Memory), volatile memory, non-volatile memory, flash memory, storage drives (such as hard disk drives), solid-state drives, any type of storage disk (such as optical discs, DVDs, etc.), or similar storage media, or combinations thereof.

[0183] Based on the same application concept as the method described above, this application also provides a computer program product, which may include a computer program. When executed by a processor, the computer program implements the routing table establishment method based on public-private network interconnection disclosed in the above examples.

[0184] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, embodiments of this application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0185] The above description is merely an embodiment of this application and is not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A method for establishing a routing table based on public-private network interconnection, characterized in that, Applied to a first network node, which supports multiple Virtual Private Networks (VPNs), the method includes: Obtain the first identifier (SID) and the second identifier (SID); determine the first VPN corresponding to the first SID from the plurality of VPNs, and determine the second VPN corresponding to the second SID; The first routing message is sent to the second network node through the interface corresponding to the first VPN. The first routing message includes the first SID, so that the second network node records the correspondence between the first SID and the first outgoing interface in the public network routing table. The second routing message, which includes the second SID, is sent to the third network node through the interface corresponding to the second VPN, so that the third network node records the correspondence between the second SID and the second outgoing interface in the public network routing table.

2. The method according to claim 1, characterized in that, Determining a first VPN corresponding to the first SID from the plurality of VPNs, and determining a second VPN corresponding to the second SID, includes: If the SID prefix of the first SID is the same as the first SID prefix included in the first configuration data, then the first SID is determined to correspond to the first VPN; if the SID prefix of the second SID is the same as the second SID prefix included in the second configuration data, then the second SID is determined to correspond to the second VPN. The first network node includes first configuration data corresponding to the first VPN and second configuration data corresponding to the second VPN. The first configuration data is used to import the SID from the public network into the first VPN, and the second configuration data is used to import the SID from the public network into the second VPN.

3. The method according to claim 2, characterized in that, Sending the first routing message to the second network node through the interface corresponding to the first VPN includes: If the first configuration data includes the first border gateway protocol (BGP) configuration, then based on the first BGP configuration, a first routing message is sent to the second network node through the interface corresponding to the first VPN; Sending the second routing message to the third network node through the interface corresponding to the second VPN includes: If the second configuration data also includes a second BGP configuration, then based on the second BGP configuration, a second routing message is sent to the third network node through the interface corresponding to the second VPN.

4. The method according to any one of claims 1-3, characterized in that, The method further includes: The third routing message sent by the fourth network node is received through the interface corresponding to the first VPN. The third routing message includes the SID of the fourth network node. The correspondence between the SID of the fourth network node and the third outgoing interface is recorded in the routing table corresponding to the first VPN. The system receives a fourth routing message sent by the fifth network node through the interface corresponding to the second VPN. The fourth routing message includes the SID of the fifth network node. The system records the correspondence between the SID of the fifth network node and the fourth outgoing interface in the routing table corresponding to the second VPN.

5. The method according to claim 4, characterized in that, The method further includes: The first data packet is received through the interface corresponding to the first VPN; wherein, the second network node obtains the first SID of the first network node from the first data packet, queries the public network routing table through the first SID to obtain the first outgoing interface, and sends the first data packet through the first outgoing interface. Obtain the SID of the fourth network node from the first data packet, query the routing table corresponding to the first VPN through the SID of the fourth network node, obtain the third outgoing interface corresponding to the SID of the fourth network node, and send the first data packet to the fourth network node through the third outgoing interface. or, The second data packet is received through the interface corresponding to the second VPN; wherein, the third network node obtains the second SID of the first network node from the second data packet, queries the public network routing table through the second SID to obtain the second outgoing interface, and sends the second data packet through the second outgoing interface; The SID of the fifth network node is obtained from the second data packet. The routing table corresponding to the second VPN is queried through the SID of the fifth network node to obtain the fourth outgoing interface corresponding to the SID of the fifth network node. The second data packet is sent to the fifth network node through the fourth outgoing interface.

6. A routing table establishment device based on public-private network interconnection, characterized in that, Applied to a first network node, the first network node supporting multiple Virtual Private Networks (VPNs), the device includes: The acquisition module is used to acquire the first identifier (SID) and the second SID. The determining module is configured to determine, from the plurality of VPNs, a first VPN corresponding to the first SID, and to determine, from the plurality of VPNs, a second VPN corresponding to the second SID; The sending module is configured to send a first routing message to a second network node through the interface corresponding to the first VPN, the first routing message including the first SID, so that the second network node records the correspondence between the first SID and the first outgoing interface in the public network routing table; and to send a second routing message to a third network node through the interface corresponding to the second VPN, the second routing message including the second SID, so that the third network node records the correspondence between the second SID and the second outgoing interface in the public network routing table.

7. The apparatus according to claim 6, characterized in that, When the determining module determines the first VPN corresponding to the first SID from the plurality of VPNs, and determines the second VPN corresponding to the second SID from the plurality of VPNs, it is specifically used for: If the SID prefix of the first SID is the same as the first SID prefix included in the first configuration data, then the first SID is determined to correspond to the first VPN; if the SID prefix of the second SID is the same as the second SID prefix included in the second configuration data, then the second SID is determined to correspond to the second VPN. The first network node includes first configuration data corresponding to the first VPN and second configuration data corresponding to the second VPN. The first configuration data is used to import the SID from the public network into the first VPN, and the second configuration data is used to import the SID from the public network into the second VPN.

8. The apparatus according to claim 7, characterized in that, When the sending module sends the first routing message to the second network node through the interface corresponding to the first VPN, it is specifically used to: if the first configuration data includes the first border gateway protocol (BGP) configuration, then based on the first BGP configuration, send the first routing message to the second network node through the interface corresponding to the first VPN; When the sending module sends the second routing message to the third network node through the interface corresponding to the second VPN, it is specifically used to: if the second configuration data also includes the second BGP configuration, then based on the second BGP configuration, send the second routing message to the third network node through the interface corresponding to the second VPN.

9. The apparatus according to any one of claims 6-8, characterized in that, The device further includes: The processing module is configured to receive a third routing message sent by a fourth network node through the interface corresponding to the first VPN, the third routing message including the SID of the fourth network node; and record the correspondence between the SID of the fourth network node and the third outgoing interface in the routing table corresponding to the first VPN. The system receives a fourth routing message sent by the fifth network node through the interface corresponding to the second VPN. The fourth routing message includes the SID of the fifth network node. The system records the correspondence between the SID of the fifth network node and the fourth outgoing interface in the routing table corresponding to the second VPN.

10. The apparatus according to claim 9, characterized in that, The device further includes: The receiving module is used to receive a first data packet through the interface corresponding to the first VPN; wherein, the second network node obtains the first SID of the first network node from the first data packet, queries the public network routing table through the first SID to obtain the first outgoing interface, and sends the first data packet through the first outgoing interface. Alternatively, the second data packet is received through the interface corresponding to the second VPN; wherein, the third network node obtains the second SID of the first network node from the second data packet, queries the public network routing table through the second SID to obtain the second outgoing interface, and sends the second data packet through the second outgoing interface; The processing module is further configured to, if the receiving module receives the first data packet, obtain the SID of the fourth network node from the first data packet, query the routing table corresponding to the first VPN through the SID of the fourth network node, obtain the third outgoing interface corresponding to the SID of the fourth network node, and send the first data packet to the fourth network node through the third outgoing interface. Alternatively, if the receiving module receives the second data packet, it obtains the SID of the fifth network node from the second data packet, queries the routing table corresponding to the second VPN through the SID of the fifth network node, obtains the fourth outgoing interface corresponding to the SID of the fifth network node, and sends the second data packet to the fifth network node through the fourth outgoing interface.

Images