Method for enhancing reliability of IPv6 gateway in dual-stack mode of cloud data center

Abstract

The invention particularly relates to a method for enhancing the reliability of an IPv6 gateway in a dual-stack mode of a cloud data center. According to the method for enhancing the reliability of the IPv6 gateway in the dual-stack mode of the cloud data center, a cooperative mechanism of dynamic monitoring-automatic recovery and static configuration-state verification is realized based on a dual guarantee scheme of real-time monitoring of a BFD detector and configuration file solidification. According to the method for enhancing the reliability of the IPv6 gateway in the dual-stack mode of the cloud data center, the failure recovery time of the IPv6 gateway can be shortened from the minute level to the second level, the stability and reliability of an IPv6 gateway server are greatly improved, the abnormal recovery time is shortened, the operation and maintenance complexity is reduced, and the popularization and application of an IPv6 dual-stack network are further promoted.

Description

Technical Field

[0001] This invention relates to the field of cloud data center network technology, and in particular to a method for enhancing the reliability of IPv6 gateways in a dual-stack mode of cloud data centers. Background Technology

[0002] With the rapid development of 5G and artificial intelligence (AI), the problem of IPv4 address exhaustion is becoming increasingly acute. Cloud data centers generally adopt an IPv4 / IPv6 dual-stack mode to achieve a smooth transition. In this mode, the IPv6 gateway undertakes key functions such as north-south traffic forwarding, east-west cross-subnet communication, ACL / QoS policy enforcement, and address translation. It is the core hub of the cloud data center, and an IPv6 gateway failure will directly lead to the interruption of tenant IPv6 services. The most common causes of IPv6 gateway failures are as follows:

[0003] Network layer dynamic configuration conflicts: In cloud data center systems, the IPv6 gateway address and routing configuration are typically dynamically distributed by the controller via the NETCONF or RESTCONF protocol. When the controller cluster undergoes a master / slave switch or the configuration versions are inconsistent, a "configuration overwrite" phenomenon may occur.

[0004] Link layer failure: If a momentary jitter occurs in the link between the IPv6 gateway and the core switch, it may trigger the "address reclamation" mechanism of the gateway protocol stack. In Linux systems, when the Neighbor Discovery Protocol (NDP) fails to receive NA (Neighbor Advertisement) messages from the peer for three consecutive times, it will mark the IPv6 address as "INVALID" and make it unusable for forwarding. This "semi-available" state is difficult to detect by traditional ping detection, but it will cause intermittent packet loss in IPv6 traffic.

[0005] Abnormal exits and memory leaks at the software level: IPv6 gateways typically run in a virtualized environment. If the gateway process crashes due to memory overflow, it may cause routing table entries to be flushed.

[0006] Hardware failures and configuration gaps during disaster recovery switching: When the gateway server experiences hardware failures such as bad sectors on its hard drive or RAID card failure, relying on traditional cold backups may result in the loss of the latest configuration before the failure. In cross-data center disaster recovery scenarios, if the configuration synchronization delay between the primary and backup gateways exceeds 30 seconds, incomplete routing entries may occur after the switchover.

[0007] The common harm of the above risks lies in:

[0008] (i) Business interruption time is long, and the recovery process that relies on manual intervention takes an average of 15-30 minutes;

[0009] (ii) Fault location is difficult. Address and route loss may manifest as "intermittent" phenomena, lacking clear alarm trigger points.

[0010] (iii) The impact is wide-ranging; a single gateway failure may affect hundreds of IPv6 service instances of dozens of tenants.

[0011] Therefore, building an automated and intelligent protection mechanism has become a key requirement for the stable operation of dual-stack data centers.

[0012] Based on the above, this invention proposes a method to enhance the reliability of IPv6 gateways in a dual-stack mode of cloud data centers. Summary of the Invention

[0013] To overcome the shortcomings of existing technologies, this invention provides a simple and efficient method for enhancing the reliability of IPv6 gateways in a dual-stack mode of cloud data centers.

[0014] This invention is achieved through the following technical solution:

[0015] A method to enhance the reliability of IPv6 gateways in a dual-stack mode of cloud data centers is proposed. This method is based on a dual guarantee scheme of real-time monitoring of BFD (Bidirectional Forwarding Detection) and configuration file hardening, which realizes a collaborative mechanism of dynamic monitoring-automatic recovery and static configuration-state verification.

[0016] The implementation of a collaborative mechanism between dynamic monitoring / automatic recovery and static configuration / status verification includes the following steps:

[0017] Step S1, BFD detection

[0018] By extending the bidirectional forwarding detection of the BFD detector, an IPv6 routing detection label is added to detect network segment routing and gateway routing information on the IPv6 gateway in real time.

[0019] Step S2: Consolidate the IPv6 gateway information and restore the IPv6 gateway configuration after the server restarts.

[0020] By solidifying key IPv6 gateway configurations, including addresses, default routes, ACLs, and QoS, an immutable configuration file is generated and stored on the IPv6 gateway server.

[0021] When the gateway server starts, the configuration recovery program is launched to read IPv6 gateway information from the configuration file and restore the gateway data.

[0022] Step S3: The coordinator processes BFD anomaly detection information.

[0023] The coordinator collects abnormal information returned by the BFD detectors and sends an abnormal recovery command to the IPv6 gateway server, thus forming a closed loop for detection recovery.

[0024] In step S1, Route-detect authentication is added to the BFD detection message to establish a direct connection between the data center controller and the IPv6 gateway server. Based on the RIP protocol, the gateway information and network segment routing information on the IPv6 gateway server are detected through the BFD detection message to determine whether they are complete.

[0025] Each IPv6 gateway has its own BFD detection message.

[0026] In step S1, the BFD detection message sending interval is 300 milliseconds, and the detection multiplier is 3, that is, the fault detection is completed within 900 milliseconds. The FIB (Forwarding Information Base) based on eBPF (Extended Berkeley Packet Filter) technology is used to find the kprobe (Kernel Probe) mechanism. The kernel mode completes the process with CPU usage of less than one percent, which combines performance and speed.

[0027] In step S3, based on the abnormal gateway data detected by the BFD detection message, the coordinator collects relevant data and provides solutions for the causes of the problems. The solutions are then sent to the IPv6 gateway server via the NETCONF command, and the gateway configurator operates the corresponding IPv6 gateway and its routing information.

[0028] In step S3, if the mask configured for the gateway address is incorrect, the IPv6 gateway is configured according to the gateway address in NETCONF, and the network segment route for the corresponding subnet is reissued.

[0029] If no network segment route is detected, the route for that network segment is issued based on the network segment information in NETCONF. A system for enhancing the reliability of IPv6 gateways in a dual-stack mode of a cloud data center, used to implement the above method, includes:

[0030] The data center controller is the brain of the cloud network center, including BFD detectors and coordinators, and is responsible for sending messages to the IPv6 gateway server to initialize the IPv6 gateway.

[0031] BFD detectors are responsible for encapsulating IPv6 network routing probe messages and probing the accuracy of network routing between the data center controller and the IPv6 gateway server.

[0032] The coordinator is responsible for collecting abnormal messages detected by the BFD detector, determining the repair configuration instructions based on the anomaly classification, and sending the repair configuration instructions to the gateway configurator; the gateway configurator then restores the IPv6 gateway configuration according to the repair instructions.

[0033] The IPv6 gateway server, independent of the data center controller, includes a gateway configurator and a fixed configuration storage unit. It is responsible for receiving and sending IPv6 gateway initialization information, configuring IPv6 gateway ports and sending network segment routes, as well as storing IPv6 gateway information.

[0034] The gateway configurator is responsible for reading the IPv6 gateway information from the persistent configuration storage unit after the IPv6 gateway server restarts, and restoring the IPv6 gateway interface, IPv6 network segment routing, and gateway information.

[0035] A device for enhancing the reliability of an IPv6 gateway in a dual-stack mode of a cloud data center includes a memory and a processor; the memory is used to store a computer program, and the processor is used to execute the computer program to implement the above-described method steps.

[0036] A readable storage medium storing a computer program that, when executed by a processor, implements the above-described method steps.

[0037] The beneficial effects of this invention are: the method for enhancing the reliability of IPv6 gateways in the dual-stack mode of cloud data centers can shorten the IPv6 gateway fault recovery time from minutes to seconds, greatly improve the stability and reliability of IPv6 gateway servers, reduce anomaly recovery time, reduce operation and maintenance complexity, and further promote the promotion and application of IPv6 dual-stack networks. Attached Figure Description

[0038] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0039] Figure 1 This is a schematic diagram illustrating the collaboration between the data center controller and the IPv6 gateway server of the present invention.

[0040] Figure 2 This is a schematic diagram of the IPv6 gateway configuration hardening and recovery process of the present invention. Detailed Implementation

[0041] To enable those skilled in the art to better understand the technical solutions of this invention, the technical solutions in the embodiments of this invention will be clearly and completely described below in conjunction with the embodiments of this invention. Obviously, the described embodiments are merely some embodiments of this invention, and not all embodiments. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this invention.

[0042] This method for enhancing the reliability of IPv6 gateways in the dual-stack mode of cloud data centers is based on a dual guarantee scheme of real-time monitoring of BFD (Bidirectional Forwarding Detection) and fixed configuration files. It realizes a collaborative mechanism of dynamic monitoring-automatic recovery and static configuration-state verification, which reduces the IPv6 gateway fault recovery time from minutes to seconds, greatly improving the stability and reliability of IPv6 gateway servers.

[0043] The implementation of a collaborative mechanism between dynamic monitoring / automatic recovery and static configuration / status verification includes the following steps:

[0044] Step S1, BFD detection

[0045] By extending the bidirectional forwarding detection of the BFD detector, an IPv6 routing detection label is added to detect network segment routing and gateway routing information on the IPv6 gateway in real time.

[0046] Step S2: Consolidate the IPv6 gateway information and restore the IPv6 gateway configuration after the server restarts.

[0047] By solidifying key IPv6 gateway configurations, including addresses, default routes, ACLs, and QoS, an immutable configuration file is generated and stored on the IPv6 gateway server.

[0048] When the gateway server starts, the configuration recovery program is launched to read IPv6 gateway information from the configuration file and restore the gateway data.

[0049] Step S3: The coordinator processes BFD anomaly detection information.

[0050] The coordinator collects abnormal information returned by the BFD detectors and sends an abnormal recovery command to the IPv6 gateway server, thus forming a closed loop for detection recovery.

[0051] Firstly, the BFD protocol provides a lightweight and fast method for detecting the connectivity of a forwarding path between two network devices. It is a simple Hello protocol where a pair of systems periodically send detection packets on the channel of the session they have established. If a system does not receive a detection packet from the other end for a sufficiently long time, it is considered that a fault has occurred in some part of the bidirectional channel to the neighboring system. The neighbor can quickly detect the connectivity failure of the forwarding path in this way, speed up the activation of the backup forwarding path, and improve network performance.

[0052] In step S1, the BFD bidirectional forwarding detection message is extended by adding Route-detect authentication to the BFD detection message. A direct connection is established between the data center controller and the IPv6 gateway server. Based on the RIP protocol, the gateway information and network segment routing information on the IPv6 gateway server are detected through the BFD detection message between the two to check whether the gateway information and network segment routing information are complete.

[0053] Each IPv6 gateway has its own BFD detection message.

[0054] In step S1, the BFD detection message sending interval is 300 milliseconds, and the detection multiplier is 3, that is, the fault detection is completed within 900 milliseconds. The FIB (Forwarding Information Base) based on eBPF (Extended Berkeley Packet Filter) technology is used to find the kprobe (Kernel Probe) mechanism. The kernel mode completes the process with CPU usage of less than one percent, which combines performance and speed.

[0055] In step S3, based on the abnormal gateway data detected by the BFD detection message, the coordinator collects relevant data and provides solutions for the causes of the problems. The solutions are then sent to the IPv6 gateway server via the NETCONF command, and the gateway configurator operates the corresponding IPv6 gateway and its routing information.

[0056] In step S3, if the mask configured for the gateway address is incorrect, the IPv6 gateway is configured according to the gateway address in NETCONF, and the network segment route for the corresponding subnet is reissued.

[0057] If no network segment route is detected, the route for that network segment is issued based on the network segment information in NETCONF. This system for enhancing IPv6 gateway reliability in a dual-stack cloud data center implements the above method, including:

[0058] The data center controller is the brain of the cloud network center, including BFD detectors and coordinators, and is responsible for sending messages to the IPv6 gateway server to initialize the IPv6 gateway.

[0059] BFD detectors are responsible for encapsulating IPv6 network routing probe messages and probing the accuracy of network routing between the data center controller and the IPv6 gateway server.

[0060] The coordinator is responsible for collecting abnormal messages detected by the BFD detector, determining the repair configuration instructions based on the anomaly classification, and sending the repair configuration instructions to the gateway configurator; the gateway configurator then restores the IPv6 gateway configuration according to the repair instructions.

[0061] The IPv6 gateway server, independent of the data center controller, includes a gateway configurator and a fixed configuration storage unit. It is responsible for receiving and sending IPv6 gateway initialization information, configuring IPv6 gateway ports and sending network segment routes, as well as storing IPv6 gateway information.

[0062] The gateway configurator is responsible for reading the IPv6 gateway information from the persistent configuration storage unit after the IPv6 gateway server restarts, restoring the IPv6 gateway interface, IPv6 network segment routes, and gateway information. It ensures that the configuration can be recovered regardless of any abnormal startup, guaranteeing the stability and reliability of the IPv6 gateway server and improving the user experience.

[0063] Example

[0064] Combined with appendix Figure 1 and attached Figure 2 This paper details the methods for enhancing the reliability of IPv6 gateways in the dual-stack mode of the cloud data center.

[0065] 1) The data center controller receives the user's request to create a virtual network, allocates the corresponding IPv6 network according to the network segment address requested by the user, generates a gateway, and sends the IPv6 network interface information, IPv6 network segment, and IPv6 gateway initialization information to the IPv6 gateway server.

[0066] The message communication method is NETCONF. A secure long connection based on SSH is established between the data center controller and the IPv6 gateway server, and communication is carried out through XML format data to ensure the security and reliability of information.

[0067] 2) The IPv6 gateway server receives the IPv6 gateway configuration information sent by the data center controller, creates a gateway on the server, locates the corresponding interface based on the MAC address of the IPv6 network interface, and configures the IPv6 gateway on that interface:

[0068] A single interface corresponds to a virtual network. The subnet IPv6 gateway under the virtual machine network corresponds to the network address on the interface. Multiple subnets correspond to multiple IPv6 gateway addresses.

[0069] After the gateway interface is configured, network segment routes are issued based on the interface, and the interface is enabled to send RA announcements to ensure that virtual machines in this network can correctly receive network segment routes and gateway information, and ensure that virtual machines can communicate normally.

[0070] 3) After configuring the gateway interface, save the IPv6 gateway information to the persistent configuration storage file. The storage format is as follows:<key,value> .

[0071] The key is the MAC address of the IPv6 gateway interface, used to uniquely identify the IPv6 gateway, while the value is a set of relevant information such as the gateway address, subnet mask, ACL, and QoS. Any addition, deletion, or modification of subnets within the virtual network will synchronously update this fixed configuration.

[0072] 4) Once an IPv6 gateway exists, BFD bidirectional forwarding detection messages are enabled. By extending the BFD detection message and adding Route-detect authentication, a direct connection is established between the data center controller and the IPv6 gateway server. Based on the RIP protocol, BFD detection messages are used to probe whether the gateway information and network segment routing information on the IPv6 gateway server are complete. Each IPv6 gateway will have a separate BFD detection message.

[0073] The BFD detection message sending interval is 300ms, with a detection multiplier of 3, meaning fault detection is completed within 900ms. Using eBPFFIB lookup kprobe, the kernel-mode CPU usage is less than one percent, achieving both performance and speed.

[0074] 5) After the IPv6 gateway server restarts, the gateway configurator will read the IPv6 gateway data from the hardened configuration storage and compare and modify it with the existing configuration to ensure that the IPv6 gateway server gateway interface is configured correctly.

[0075] During the restart and recovery process, the IPv6 gateway server will not receive IPv6 gateway information sent by the data center controller to avoid conflicts between configuration recovery and gateway interface initialization data.

[0076] Table 1 BFD Detection Message Format

[0077]

[0078] Table 1 shows the BFD probe extended message format. An IPv6 route probe identifier is added to the optional part of the message, with a type code of 0x0101. The authentication data area is the IPv6 gateway address to be probed + mask, with a length of 132+.

[0079] The device for enhancing the reliability of the IPv6 gateway in the dual-stack mode of the cloud data center includes a memory and a processor; the memory is used to store computer programs, and the processor is used to implement the above-described method steps when executing the computer programs.

[0080] The readable storage medium stores a computer program that, when executed by a processor, implements the above-described method steps.

[0081] This method for enhancing IPv6 gateway reliability in the dual-stack mode of cloud data centers not only promotes the large-scale deployment of IPv6 and addresses the concerns of various organizations and departments that "dare not use IPv6" by improving gateway reliability, but also sets a benchmark for dual-stack network protection. Its collaborative mechanism of dynamic monitoring-automatic recovery and static configuration-state verification can be extended to other cloud physical hosts or load balancing modules.

[0082] At the same time, it can meet compliance requirements, comply with the "Improving the reliability of network facilities" requirement in the "Action Plan for Large-Scale Deployment of IPv6", and meet the requirements of the Information Security Protection Standard 2.0 for critical equipment fault recovery.

[0083] The embodiments described above are merely one specific implementation of the present invention. Ordinary changes and substitutions made by those skilled in the art within the scope of the technical solution of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for enhancing reliability of an IPv6 gateway in a cloud data center dual stack mode, characterized in that: The dual protection scheme based on BFD probe machine real-time monitoring and configuration file solidification realizes the cooperative mechanism of dynamic monitoring-automatic recovery and static configuration-state checking. The cooperative mechanism of dynamic monitoring-automatic recovery and static configuration-state checking is realized, including the following steps: Step S1, BFD probe By extending the BFD probe bidirectional forwarding detection to add an IPv6 route detection label, the segment route and gateway route information on the IPv6 gateway are probed in real time; Step S2, solidify the IPv6 gateway information, and restore the IPv6 gateway configuration after server restart By solidifying the key configurations of the IPv6 gateway, including address, default route, ACL and Qos, an immutable configuration file is generated, and the file is saved in the IPv6 gateway server; When the gateway server starts, the configuration recovery program is started to read the IPv6 gateway information from the configuration file and restore the gateway data; Step S3, coordinator processing BFD abnormal detection information Through the coordinator, the abnormal information returned by the BFD probe is collected, and the abnormal recovery instruction is sent to the IPv6 gateway server to form a closed loop for detection recovery.

2. The method for enhancing the reliability of IPv6 gateway in cloud data center dual stack mode according to claim 1, characterized in that: In the step S1, Route-detect authentication is added in the BFD detection message, and a direct connection relationship is established between the data center controller and the IPv6 gateway server; Based on the RIP protocol, the gateway information and segment route information on the IPv6 gateway server are detected through the BFD detection message between the data center controller and the IPv6 gateway server; Each IPv6 gateway has a separate BFD detection message.

3. The method for enhancing the reliability of IPv6 gateway in cloud data center dual stack mode according to claim 2, characterized in that: In the step S1, the BFD detection message sending interval is 300 milliseconds, and the detection multiple is 3, that is, the fault sensing is completed within 900 milliseconds, the FIB lookup kprobe mechanism based on eBPF technology is used, the CPU occupation in the kernel state is less than one percent, and the performance and rate are combined.

4. The method for enhancing the reliability of IPv6 gateway in cloud data center dual stack mode according to claim 1, characterized in that: In the step S3, based on the abnormal gateway data detected by the BFD detection message, the coordinator collects related data and gives a solution according to the problem reason, and sends the solution to the IPv6 gateway server through the NETCONF command, and the corresponding IPv6 gateway and gateway route information are operated by the gateway configurator.

5. The method for enhancing the reliability of IPv6 gateway in cloud data center dual stack mode according to claim 4, characterized in that: In the step S3, if the mask of the gateway address configuration is incorrect, the IPv6 gateway is configured according to the gateway address in the NETCONF, and the segment route of the corresponding subnet is reissued; If the segment route of a certain network is not detected, the segment route is issued according to the segment information in the NETCONF.

6. A system for enhancing reliability of an IPv6 gateway in a cloud data center dual stack mode, the system comprising: The method for realizing any one of claims 1-5 comprises: The data center controller includes a BFD probe and a coordinator, and is responsible for sending the initialization IPv6 gateway message to the IPv6 gateway server; The BFD probe is responsible for encapsulating the IPv6 network route detection message and detecting the network route accuracy between the data center controller and the IPv6 gateway server. The coordinator is responsible for collecting the abnormal messages detected by the BFD detector, determining the repair configuration instruction according to the abnormal classification, and sending the repair configuration instruction to the gateway configurator; the gateway configurator recovers the IPv6 gateway configuration according to the repair instruction; The IPv6 gateway server includes a gateway configurator and a solidified configuration storage unit, is responsible for receiving and issuing IPv6 gateway initialization information, implements the configuration of an IPv6 gateway port and the issuance of a network segment route, and stores IPv6 gateway information; The gateway configurator is responsible for reading the IPv6 gateway information in the solidified configuration storage unit after the IPv6 gateway server is restarted, and recovering the IPv6 gateway port, the IPv6 network segment route and the gateway information.

7. A device for enhancing the reliability of IPv6 gateways in a dual-stack mode of a cloud data center, characterized in that: The memory is used for storing a computer program, and the processor is used for executing the computer program to realize the method in any one of claims 1-5.

8. A readable storage medium characterized by: The computer program is stored on the readable storage medium, and the computer program is executed by the processor to realize the method in any one of claims 1-5.

Images