Data transmission method, flow table configuration method, device, equipment and storage medium

Abstract

The present invention discloses a data transmission method, a flow table configuration method, an apparatus, a device and a storage medium. The method comprises: receiving a multi-level flow table sent by a controller; matching the received message based on the multi-level flow table; based on the matching result, performing layer 2 forwarding of the message in the same network segment within a tenant or layer 3 forwarding across network segments within a tenant; the multi-level flow table at least comprises: a layer 2 forwarding flow table for matching the layer 2 network identifier of the message with the destination MAC and a layer 3 forwarding flow table for matching the tenant network identifier of the message with the destination IP.

Description

Technical Field

[0001] The present invention relates to the field of data transmission, and in particular to a data transmission method, a flow table configuration method, an apparatus, a device and a storage medium. Background Art

[0002] An OpenFlow switch refers to a switch that supports the OpenFlow protocol. The OpenFlow protocol belongs to the data link layer and can control the forwarding plane of the switch or router on the Internet, thereby changing the network path taken by the network data packet. Each OpenFlow switch has one or more OpenFlow flow tables inside for packet matching and forwarding. The switch can be connected to an external SDN controller (SDN controller) through the OpenFlow protocol to query and manage the flow table. The flow table includes header fields (header fields, matching multiple fields in the header), activity counters, and multiple execution actions. The flow table will search for each ingress data packet. If it matches, the relevant policy will be executed. Otherwise, the packet will be forwarded to the SDN controller through a protocol message, such as a packetin message, and the SDN controller will decide the relevant behavior.

[0003] OpenFlow switches are divided into software OpenFlow switches and hardware OpenFlow switches. Software OpenFlow switches are completely implemented by software and installed on X86 physical servers, such as openvswitch (OVS). Hardware OpenFlow switches have the same hardware configuration as traditional hardware switches, and are composed of CPU chips, ASIC (Application Specific Integrated Circuit) switching chips, power supplies, fans and other hardware devices. The difference is the data flow forwarding method. Traditional hardware switches guide data packet forwarding based on L2 / L3 routing forwarding protocols, such as VLAN (Virtual Local Area Network), OSPF (Open Shortest Path First), BGP (Border Gateway Protocol), etc., while hardware OpenFlow switches guide data packet forwarding based on the OpenFlow flow table issued by the SDN controller.

[0004] In data center applications, the two types of OpenFlow switches have different application scenarios and connect different types of server hosts. The software OpenFlow switch only receives traffic from virtual machines, while the hardware OpenFlow switch can connect to both physical servers and virtual machines inside physical servers.

[0005] like Figure 1 As shown, the hardware OpenFlow switch and the software OpenFlow switch are interconnected in the Underlay network, the physical servers in the hardware OpenFlow switch visit each other, the virtual machines in the software OpenFlow switch visit each other, or the physical servers and / or virtual machines visit each other between the hardware OpenFlow switches, between the software OpenFlow switches, and between the hardware OpenFlow switch and the software OpenFlow switch. The SDN controller sends the OpenFlow flow table to the hardware OpenFlow switch / software OpenFlow switch to realize the forwarding control of the mutual visit between the physical servers and / or virtual machines, resulting in a large number of OpenFlow flow tables that each OpenFlow switch needs to carry, which is not conducive to the maintenance of the flow table. Summary of the invention

[0006] In view of this, embodiments of the present invention provide a data transmission method, a flow table configuration method, an apparatus, a device, and a storage medium, which aim to reduce the maintenance amount of the OpenFlow flow table on the switch side.

[0007] The technical solution of the embodiment of the present invention is achieved as follows:

[0008] An embodiment of the present invention provides a data transmission method, which is applied to a first switch. The method includes:

[0009] Receive the multi-level flow table sent by the controller;

[0010] Matching the received message based on the multi-level flow table;

[0011] Based on the matching result, the message is forwarded at Layer 2 within the same network segment of the tenant or at Layer 3 across network segments within the tenant;

[0012] Among them, the multi-level flow table includes at least: a layer 2 forwarding flow table for matching the layer 2 network identifier and the destination physical access address (MAC) of the message and a layer 3 forwarding flow table for matching the tenant network identifier and the destination Internet Protocol (IP) of the message.

[0013] An embodiment of the present invention further provides a flow table configuration method, which is applied to a controller, and the method includes:

[0014] Sending a multi-level flow table to the switch, wherein the multi-level flow table is used by the switch to match the received message, and based on the matching result, performing Layer 2 forwarding of the message within the same network segment of the tenant or Layer 3 forwarding across network segments within the tenant;

[0015] The multi-level flow table at least includes: a layer 2 forwarding flow table for matching the layer 2 network identifier and the destination MAC of the message and a layer 3 forwarding flow table for matching the tenant network identifier and the destination IP of the message.

[0016] The embodiment of the present invention further provides a data transmission device, which is applied to a first switch, and the device includes:

[0017] A receiving module, used for receiving a multi-level flow table sent by a controller;

[0018] A flow table matching module, used for matching received messages based on the multi-level flow table;

[0019] A first sending module, configured to perform Layer 2 forwarding of the message within the same network segment of a tenant or Layer 3 forwarding of the message across network segments within a tenant based on a matching result;

[0020] The multi-level flow table at least includes: a layer 2 forwarding flow table for matching the layer 2 network identifier and the destination MAC of the message and a layer 3 forwarding flow table for matching the tenant network identifier and the destination IP of the message.

[0021] An embodiment of the present invention further provides a flow table configuration device, which is applied to a controller, and the device includes:

[0022] The second sending module sends a multi-level flow table to the switch, wherein the multi-level flow table is used by the switch to match the received message, and based on the matching result, the message is forwarded at the second layer in the same network segment within the tenant or at the third layer across network segments within the tenant;

[0023] The multi-level flow table at least includes: a layer 2 forwarding flow table for matching the layer 2 network identifier and the destination MAC of the message and a layer 3 forwarding flow table for matching the tenant network identifier and the destination IP of the message.

[0024] An embodiment of the present invention further provides a switch, comprising: a processor and a memory for storing a computer program that can be run on the processor, wherein the processor is used to execute the steps of the data transmission method on the switch side of the embodiment of the present invention when running the computer program.

[0025] An embodiment of the present invention further provides a controller, comprising: a processor and a memory for storing a computer program that can be run on the processor, wherein the processor is used to execute the steps of the flow table configuration method on the controller side of the embodiment of the present invention when running the computer program.

[0026] An embodiment of the present invention further provides a storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the method described in any embodiment of the present invention are implemented.

[0027] The technical solution provided by the embodiment of the present invention, since the multi-level flow table includes a layer 2 forwarding flow table and a layer 3 forwarding flow table, enables the switch to match the received message based on the multi-level flow table, and send the message based on the matching result, and can support layer 2 forwarding in the same network segment within the tenant and layer 3 forwarding across network segments within the tenant, thereby meeting the needs of layer 2 forwarding and layer 3 forwarding within the tenant on the basis of reducing the maintenance amount of the OpenFlow flow table. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 It is a schematic diagram of OpenFlow switch networking in related technologies;

[0029] Figure 2 This is a simplified diagram of a data center network in an application example;

[0030] Figure 3 It is a schematic diagram of Layer 2 forwarding inside a switch in the related art;

[0031] Figure 4 It is a schematic diagram of Layer 2 forwarding across switches in the related art;

[0032] Figure 5 Another schematic diagram of Layer 2 forwarding inside a switch in the related art;

[0033] Figure 6 Another schematic diagram of Layer 2 forwarding across switches in the related art;

[0034] Figure 7 A schematic diagram of a data transmission method according to an embodiment of the present invention;

[0035] Figure 8 A schematic diagram of a message matching process based on a multi-level flow table of a local switch in an application example of the present invention;

[0036] Fig. 9 A schematic diagram of a message matching process based on a multi-level flow table of a remote switch in an application example of the present invention;

[0037] Fig.10A schematic diagram of a process for implementing intra-tenant layer 3 forwarding across switches in an application example of the present invention;

[0038] Fig.11 This is a schematic diagram of the structure of a data transmission device according to an embodiment of the present invention;

[0039] Fig.12 A schematic diagram of the structure of a switch according to an embodiment of the present invention;

[0040] Fig.13 Schematic diagram of the structure of the controller according to the embodiment of the present invention. DETAILED DESCRIPTION

[0041] The present invention will be described in further detail below in conjunction with the accompanying drawings and embodiments.

[0042] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art of the present invention. The terms used in the specification of the present invention herein are only for the purpose of describing specific embodiments and are not intended to limit the present invention.

[0043] In the related art, forwarding control based on OpenFlow generally includes the following operations:

[0044] 1) The source OpenFlow switch sends packetin messages to the SDN controller;

[0045] 2) The SDN controller sends a packetout message to the source OpenFlow switch;

[0046] 3) The SDN controller sends the OpenFlow flow table to the source OpenFlow switch;

[0047] 4) The destination OpenFlow switch sends packetin messages to the SDN controller;

[0048] 5) The SDN controller sends a packetout message to the destination OpenFlow switch;

[0049] 6) The SDN controller sends the OpenFlow flow table to the destination OpenFlow switch;

[0050] 7) OpenFlow switches perform tunnel encapsulation and forwarding of mutual access messages between physical servers and / or virtual machines.

[0051] Among them, each OpenFlow switch can be a hardware OpenFlow switch or a software OpenFlow switch.

[0052] Figure 2The figure shows a simplified schematic diagram of the OpenFlow controller and OpenFlow switch networking in a data center network. Figure 2 , the process of virtual machines (VMs) completing mutual access based on the OpenFlow flow table is illustrated. Among them, the same tenant simultaneously launches virtual machines in two subnets, namely: virtual machines in subnet subnet1: VM11, VM12 and VM13; virtual machines in subnet subnet2: VM21, VM22 and VM23; among them, VM11 and VM12 are launched on host machine 1 and connected to OpenFlow switch Switch1, VM13, VM21, VM22, VM23 are launched on host machine 2 and connected to OpenFlow switch Switch2. Assume that the OpenFlow controller allocates VNI (VXLAN Network Identifier) ​​11 for subnet subnet1 and VNI 22 for subnet subnet2; Switch1 and Switch2 exchange packets through VXLAN tunnels, Switch1 tunnel interface IP is: TIP1, interface MAC is: TMAC1; Switch2 tunnel interface IP is: TIP2, interface MAC is: TMAC2.

[0053] It can be understood that VM11, VM12 and VM13 belong to the same Layer 2 forwarding domain, and VM21, VM22 and VM23 belong to another different Layer 2 forwarding domain, that is, the same Layer 2 forwarding domain corresponds to the same subnet.

[0054] like Figure 3 As shown, taking VM11 accessing VM12 as an example, the mutual access between devices (such as physical servers or virtual machines) in OpenFlow switch 1 (SWITCH1) is described, that is, the Layer 2 forwarding inside the switch, specifically including:

[0055] (1) VM11 accesses the first message of VM12;

[0056] (2) OpenFlow switch 1 sends packetin to the controller;

[0057] (3) The controller sends packetout to OpenFlow switch 1;

[0058] (4) OpenFlow switch 1 forwards the message to VM12 according to the action specified by packetout;

[0059] (5) The controller sends the OpenFlow flow table to OpenFlow switch 1;

[0060] (6) VM11 accesses the subsequent message of VM12;

[0061] (7) The message matches the OpenFlow flow table in OpenFlow switch 1, and OpenFlow switch 1 performs corresponding actions to forward it to VM12.

[0062] like Figure 4 As shown, taking VM11 accessing VM13 as an example, the device mutual access between OpenFlow switch 1 and OpenFlow switch 2 (SWITCH2) is explained, that is, the two-layer forwarding across switches, specifically including:

[0063] (1) VM11 accesses the first message of VM13;

[0064] (2) OpenFlow switch 1 sends packetin to the controller;

[0065] (3) The controller sends packetout to OpenFlow switch 1;

[0066] (4) The controller sends the OpenFlow flow table to OpenFlow switch 1;

[0067] (5) OpenFlow switch 1 encapsulates the message according to the action specified by packetout and forwards it to OpenFlow switch 2;

[0068] (6) OpenFlow switch 2 receives the tunnel message and sends packetin to the controller;

[0069] (7) The controller sends packetout to OpenFlow switch 2;

[0070] (8) OpenFlow switch 2 decapsulates the message and forwards it to VM13 according to the action specified by packetout;

[0071] (9) VM11 accesses the subsequent message of VM13;

[0072] (10) The message matches the OpenFlow flow table in OpenFlow switch 1, and the switch performs the corresponding action to encapsulate the message and forward it to OpenFlow switch 2;

[0073] (11) The message matches the OpenFlow flow table in OpenFlow switch 2, and the switch performs corresponding actions to decapsulate the message and forward it to VM13.

[0074] exist Figure 3 and Figure 4In the forwarding diagram shown, the control plane sends OpenFlow flow tables to both the local and remote ends of the physical OpenFlow switch / software OpenFlow switch based on the message matching items. In this way, the mutual access between devices of the physical OpenFlow switch and / or software OpenFlow switch requires a large number of OpenFlow table entries: the total number of flow tables that the OpenFlow switch needs to carry is greater than the number of source IPs * the number of destination IPs accessed by the source IP * the number of IP protocols * the number of source ports * the number of destination ports, and the number of flow tables required for bidirectional service access is doubled.

[0075] In order to reduce the occupancy of flow table entries, in the related technology, the OpenFlow flow table is sent in advance according to the destination IP for the online physical server / virtual machine. As long as the controller sends the four-level flow table in advance when the physical server / virtual machine goes online, the number of flow tables that the OpenFlow switch needs to consume can be reduced. Among them, the four-level flow table is as follows:

[0076] Table0: Matches the physical interface in_port;

[0077] Table 10: Matching VLAN (Virtual Local Area Network) | Layer 2 Network Identifier (Layer 2 VNI)

[0078] Table 20: Matching destination MAC (Media Access Control Address, physical access address)

[0079] Table 30: Matching ACL (Access Control Lists) quintuple

[0080] OpenFlow table entries required by the OpenFlow switch: Total number of flow tables = number of switch ports + number of VLANs + number of online virtual machines + number of ACL rules.

[0081] The interaction process between the OpenFlow switch and the controller is simplified as follows: the controller sends a four-level flow table to the OpenFlow switch; the message is matched and executed in turn by the four-level flow table on the OpenFlow switch.

[0082] like Figure 5 As shown, the inter-device communication in OpenFlow switch 1 includes:

[0083] (1) The controller sends Table 0, Table 10, Table 20, and Table 30 to OpenFlow switch 1;

[0084] (2) VM11 accesses the first / subsequent message of VM12;

[0085] (3) OpenFlow switch 1 forwards the message to VM12 according to the matching result of the four-level flow table. Specifically, OpenFlow switch 1 matches the incoming physical interface, VLAN, destination MAC, and quintuple of the message with table0, table10, table20, and table30 in turn and performs corresponding actions to forward the message to VM12.

[0086] like Figure 6 As shown in the figure, the device communication between OpenFlow switch 1 and OpenFlow switch 2 includes:

[0087] (1) The controller sends Table 0, Table 10, Table 20, and Table 30 to OpenFlow switch 1;

[0088] (2) The controller sends Table 0, Table 10, Table 20, and Table 30 to OpenFlow switch 2;

[0089] (3) VM11 accesses the first / subsequent messages of VM13;

[0090] (4) OpenFlow switch 1 matches the incoming physical interface, VLAN, destination MAC, and quintuple of the message with the table entries of table 0, table 10, table 20, and table 30 in sequence and performs corresponding actions. It then tunnels and encapsulates the message and forwards it to OpenFlow switch 2, carrying the Layer 2 forwarding domain VNI.

[0091] (5) OpenFlow switch 2 matches the incoming physical interface, VLAN, destination MAC, and quintuple of the message with the table entries of table 0, table 10, table 20, and table 30 in turn and performs corresponding actions, decapsulating the message through the tunnel and forwarding it to VM 13.

[0092] The above forwarding method based on four-level flow table matching can reduce the number of packetin and the number of OpenFlow flow tables, but the MAC matching and forwarding isolation domain in the message only support Layer 2 forwarding, that is, data forwarding within the same Layer 2 forwarding domain. In data center networking, due to the large scale of virtual machines, it is often not enough to have only a Layer 2 forwarding domain within a single tenant. At the same time, the virtual machines within a single tenant require support for on-demand capacity expansion. In data center networking, virtual machine mutual access requires support for both intra-tenant Layer 2 forwarding (MAC-based data forwarding) and intra-tenant Layer 3 forwarding (IP-based data forwarding).

[0093] Based on this, in various embodiments of the present invention, on the basis of the Layer 2 forwarding domain, a tenant network identifier (i.e., tenant VNI) is assigned to each tenant, and the multi-level flow table includes a Layer 2 forwarding flow table and a Layer 3 forwarding flow table, so that the switch can match the received message based on the multi-level flow table, and send the message based on the matching result, which can support Layer 2 forwarding in the same network segment within the tenant and Layer 3 forwarding across network segments within the tenant, thereby meeting the needs of Layer 2 forwarding and Layer 3 forwarding within the tenant while reducing the maintenance amount of the OpenFlow flow table.

[0094] like Figure 7 As shown, an embodiment of the present invention provides a data transmission method, which is applied to a first switch, including:

[0095] Step 701, receiving a multi-level flow table sent by a controller;

[0096] Step 702, matching the received message based on the multi-level flow table;

[0097] Step 703: Based on the matching result, the message is forwarded at Layer 2 within the same network segment of the tenant or at Layer 3 across network segments of the tenant.

[0098] It is understandable that after the controller determines that the tenant device is online, it sends multi-level flow tables to the local switch and the remote switch in advance, which can effectively reduce the number of packetins of the switch and the number of OpenFlow flow tables.

[0099] Here, the multi-level flow table includes at least: a layer 2 forwarding flow table for matching the layer 2 network identifier (i.e., layer 2 VNI) of the message with the destination MAC and a layer 3 forwarding flow table for matching the tenant network identifier (i.e., tenant VNI) of the message with the destination IP. In this way, the switch can support layer 2 forwarding within the same network segment within the tenant and layer 3 forwarding across network segments within the tenant, thereby meeting the needs of layer 2 forwarding and layer 3 forwarding within the tenant on the basis of reducing the maintenance of the OpenFlow flow table.

[0100] Here, the switch can be a hardware OpenFlow switch or a software OpenFlow switch, and the tenant device can be a physical server or virtual machine corresponding to the tenant. If the tenant device goes online on a physical interface of the switch, the switch is called the local switch, and other switches that communicate with the switch are called remote switches, that is, other switches where non-tenant devices go online.

[0101] In actual applications, the Layer 2 forwarding flow table includes: the Layer 2 forwarding flow table of the tenant device and the Layer 2 forwarding flow table of the gateway MAC; the Layer 3 forwarding flow table includes: the Layer 3 forwarding flow table of the IP address of the tenant online on the local switch and the Layer 3 forwarding flow table of the IP network segment of the tenant online on the remote switch. After the tenant device is online, the controller can send the Layer 2 forwarding flow table of the tenant device, the Layer 2 forwarding flow table of the gateway MAC, and the Layer 3 forwarding flow table of the IP address of the tenant online on the local switch to the local switch of the tenant device; and send the Layer 2 forwarding flow table of the tenant device, the Layer 2 forwarding flow table of the gateway MAC, and the Layer 3 forwarding flow table of the IP network segment of the tenant online on the remote switch to the remote switch.

[0102] In some embodiments, matching the received message based on the multi-level flow table includes:

[0103] Based on the inbound interface of the message, the inbound flow table in the multi-level flow table is matched; if the message is the first message matching the physical interface, the virtual local area network (VLAN) identifier of the inbound interface and the first message is matched with the VLAN mapping flow table in the multi-level flow table to determine the layer 2 network identifier of the first message;

[0104] Based on the Layer 2 network identifier and the destination MAC of the first message, the Layer 2 forwarding flow table is matched; if the destination MAC is a matching gateway MAC, the Layer 2 network identifier of the first message is updated to the tenant network identifier, and based on the tenant network identifier and the destination IP of the first message, the Layer 3 forwarding flow table is matched to determine the outbound interface of the first message.

[0105] It can be understood that the first message is a message sent by a tenant device online on the first switch, that is, the first switch is the local switch of the source device. Since the first message is a message sent by a tenant device on the local switch, the input interface of the first message is the physical interface of the first switch. If the first message is a message in the same network segment within the switch or across switches in the same network segment (i.e., Layer 2 forwarding), the destination MAC of the first message is the MAC of the destination device. If the first message is a message across network segments (i.e., Layer 3 forwarding), the destination MAC of the first message is the gateway MAC.

[0106] In this way, when the first switch determines that the destination MAC of the first message is the gateway MAC, it indicates that the first message requires three-layer forwarding, and the second-layer network identifier of the first message is replaced with the tenant network identifier, and the tenant network identifier and the destination IP of the first message are matched with the three-layer forwarding flow table to perform three-layer forwarding.

[0107] In some embodiments, the matching the tenant network identifier and the destination IP address of the first message with the layer-3 forwarding flow table to determine the outbound interface of the first message includes:

[0108] If the tenant network identifier and the destination IP address of the first message match the IP network segment on the second switch in the layer-3 forwarding flow table, determine that the outbound interface of the first message is the tunnel port connecting the first switch and the second switch;

[0109] If the tenant network identifier and the destination IP of the first message match the terminal IP on the first switch in the three-layer forwarding flow table, the outbound interface of the first message is determined to be the physical interface corresponding to the terminal IP on the first switch.

[0110] Here, if the tenant network identifier and the destination IP of the first message match the IP network segment on the second switch in the three-layer forwarding flow table, it indicates that the first message is a message across switches and network segments, and the first switch needs to forward the first message to the second switch based on the determined tunnel port, and the second switch sends it to the destination device; if the tenant network identifier and the destination IP of the first message match the terminal IP on the first switch in the three-layer forwarding flow table, it indicates that the first message is a message across network segments within the switch, and the first switch can forward the message to the destination device based on the determined physical interface.

[0111] In some embodiments, the data transmission method further includes:

[0112] If the destination MAC is a matching terminal MAC connected to the first switch, determining that the outbound interface of the first message is a physical outbound interface corresponding to the terminal MAC on the first switch;

[0113] If the destination MAC is a matching terminal MAC connected to the second switch, it is determined that the outbound interface of the first message is a tunnel port connecting the first switch and the second switch.

[0114] Here, if the destination MAC is a matching terminal MAC connected to the first switch, it indicates that the first message is a message in the same network segment within the switch, and the first switch forwards the message to the destination device based on the determined physical interface; if the destination MAC is a matching terminal MAC connected to the second switch, it indicates that the first message is a message in the same network segment across switches, and the first switch forwards the first message to the second switch based on the determined tunnel port, and the second switch sends it to the destination device.

[0115] In some embodiments, matching the received message based on the multi-level flow table includes:

[0116] Based on the inbound interface of the message, the inbound flow table in the multi-level flow table is matched, and if the message is a second message matching the tunnel port, the layer 2 network identifier of the second message is determined based on the tunnel identifier;

[0117] Based on the Layer 2 network identifier and the destination MAC of the second message, the Layer 2 forwarding flow table is matched; if the destination MAC is a matching gateway MAC, the Layer 2 network identifier of the second message is updated to the tenant network identifier, and based on the tenant network identifier and the destination IP of the second message, the Layer 3 forwarding flow table is matched to determine the outbound interface of the second message.

[0118] It can be understood that the second message is a message sent by a tenant device on other switches other than the first switch, that is, the first switch is a remote switch of the source device. Since the second message is a message sent by a tenant device on other switches, the input interface of the second message is the tunnel port of the tunnel between the switches. If the second message is a message on the same network segment across switches (i.e., Layer 2 forwarding), the destination MAC of the second message is the MAC of the destination device. If the second message is a message across network segments (i.e., Layer 3 forwarding), the destination MAC of the second message is the gateway MAC.

[0119] In this way, when the first switch determines that the destination MAC of the second message is the gateway MAC, it indicates that the second message requires three-layer forwarding, and the second-layer network identifier of the second message is replaced with the tenant network identifier, and the tenant network identifier and the destination IP of the second message are matched with the three-layer forwarding flow table to perform three-layer forwarding.

[0120] In some embodiments, the matching of the tenant network identifier and the destination IP address of the second message with the layer-3 forwarding flow table to determine the outbound interface of the second message includes:

[0121] If the tenant network identifier and the destination IP of the second message match the terminal IP on the first switch in the three-layer forwarding flow table, the outbound interface of the second message is determined to be the physical interface corresponding to the terminal IP on the first switch.

[0122] Here, the first switch decapsulates the received tunnel message, and sends the second message to the destination device based on the determined physical interface, thereby realizing IP-based layer 3 forwarding.

[0123] In some embodiments, the data transmission method further includes:

[0124] If the destination MAC is a matching terminal MAC connected to the first switch, the outbound interface of the second message is determined to be a physical outbound interface corresponding to the terminal MAC on the first switch.

[0125] Here, if the destination MAC is a matching terminal MAC connected to the first switch, it indicates that the second message is a message of the same network segment across switches. The first switch decapsulates the received tunnel message and sends the second message to the destination device based on the determined physical interface, thereby realizing Layer 2 forwarding of the same network segment based on MAC.

[0126] In some embodiments, matching the received message based on the multi-level flow table further includes:

[0127] The message is matched based on an access control list (ACL) flow table in the multi-level flow table to determine a forwarding action for the message.

[0128] Here, the forwarding action may be a pre-configured action, for example, may be release, discard, mirror, etc.

[0129] Thus, in the data transmission method of the embodiment of the present invention, the multi-level flow table on the switch side can support Layer 2 forwarding within the same network segment within the tenant and Layer 3 forwarding across network segments within the tenant, thereby meeting the needs of Layer 2 forwarding and Layer 3 forwarding within the tenant on the basis of reducing the maintenance amount of the OpenFlow flow table. In addition, when the controller fails and disconnects, the switch can still maintain the existing session or new session message processing between the online tenant devices.

[0130] An embodiment of the present invention further provides a flow table configuration method, which is applied to a controller, and the method includes:

[0131] Sending a multi-level flow table to the switch, wherein the multi-level flow table is used by the switch to match the received message, and based on the matching result, performing Layer 2 forwarding of the message within the same network segment of the tenant or Layer 3 forwarding across network segments within the tenant;

[0132] The multi-level flow table at least includes: a layer 2 forwarding flow table for matching the layer 2 network identifier and the destination MAC of the message and a layer 3 forwarding flow table for matching the tenant network identifier and the destination IP of the message.

[0133] Here, the controller is an OpenFlow controller, and the switch is an OpenFlow switch.

[0134] Exemplarily, sending the multi-level flow table to the switch includes:

[0135] Determine that the tenant device is online, and send the Layer 2 forwarding flow table of the tenant device, the Layer 2 forwarding flow table of the gateway MAC, and the Layer 3 forwarding flow table of the IP address of the tenant online on the local switch to the local switch; send the Layer 2 forwarding flow table of the tenant device, the Layer 2 forwarding flow table of the gateway MAC, and the Layer 3 forwarding flow table of the IP network segment of the tenant online on the remote switch to the remote switch.

[0136] In actual applications, the OpenFlow controller can also send ingress flow tables, VLAN mapping flow tables, and ACL flow tables to the OpenFlow switch, that is, the multi-level flow tables include: ingress flow table, VLAN mapping flow table, layer 2 forwarding flow table, layer 3 forwarding flow table, and ACL flow table, forming a five-level flow table. By sending multi-level flow tables to the OpenFlow switch, the OpenFlow controller makes the number of flow tables on the OpenFlow switch side controllable and reduces the number of packetin times. Based on multi-level flow tables, the OpenFlow switch can support layer 2 forwarding within the same network segment within a tenant and layer 3 forwarding across network segments within a tenant, thereby reducing the maintenance of the OpenFlow flow table and meeting the needs of layer 2 and layer 3 forwarding within the tenant.

[0137] The embodiments of the present invention are further described in detail below with reference to application examples.

[0138] This application example is used for Figure 2 In the data center network shown, the OpenFlow controller allocates VNI: 11 to subnet 1, VNI: 22 to subnet 2, and VNI: 33 to the tenant. Switch 1 and Switch 2 exchange packets through the VXLAN tunnel.

[0139] Before explaining how the OpenFlow switch forwards packets based on multi-level flow tables, we first introduce how the OpenFlow controller sends multi-level flow tables.

[0140] In this application example, the multi-level flow tables sent by the OpenFlow switch include: Table0, Table10, Table20, Table30, Table40 and Table50; among them, Table0 corresponds to the aforementioned ingress flow table, Table10 corresponds to the aforementioned VLAN mapping flow table, Table20 corresponds to the aforementioned Layer 2 forwarding flow table, Table30 corresponds to the aforementioned ACL flow table, Table40 corresponds to the aforementioned Layer 3 forwarding flow table of the IP network segment of the tenant online on the remote switch, and Table50 corresponds to the aforementioned Layer 3 forwarding flow table of the IP address of the tenant online on the local switch, that is, Table40 and Table50 constitute the aforementioned Layer 3 forwarding flow table.

[0141] The multi-level flow table is described as follows:

[0142] Table0: Match the inbound interface in_port;

[0143] When a virtual machine goes online on a physical interface of the switch, the controller sends Table0 to the local switch, and the table field is the physical interface index of the online virtual machine. When processing the message, the switch compares the physical interface index in the message with the physical interface index in Table0. If a match is found, it continues to match Table10, otherwise it discards the message.

[0144] In addition, the controller will also send the Table0 table corresponding to the tunnel port to the remote switch. The table field is the tunnel interface index established by the local switch where the online virtual machine is located and the remote switch. When processing the message, the switch compares the tunnel port index in the message with the tunnel interface index in the Table0 table. If a match is found, the VNI in the tunnel message is filled in as the message VNI and Table20 is continued to be matched. Otherwise, the message is discarded.

[0145] An example of Table0 is shown in Table 1:

[0146] Table 1

[0147]

[0148] Table 10: Matching VLAN ID and mapping VNI (Layer 2 VNI)

[0149] When a virtual machine goes online on a physical interface of the switch, the controller sends Table 10 to the local switch. The table fields are the physical interface index and VLANID of the online virtual machine. When processing the message, the switch compares the inbound interface index and VLANID in the message with the interface index and VLANID in Table 10. If they match, the switch fills in the Layer 2 VNI according to the action in Table 10 and continues to match Table 20. Otherwise, the message is discarded.

[0150] An example of Table 10 is shown in Table 2:

[0151] Table 2

[0152]

[0153] Table 20: Matching destination MAC and Layer 2 VNI, mapping physical outbound interface

[0154] When a virtual machine goes online on a switch, the controller sends Table 20 to the local switch and the remote switch. The table fields are the MAC address and Layer 2 VNI of the online virtual machine. When processing a message, if the destination MAC of the message is the MAC of the virtual machine, the switch compares the message with the destination MAC and Layer 2 VNI in Table 20. If they match, it continues to match Table 30 based on the physical outbound interface and VLAN ID filled in the message. Otherwise, the message is discarded.

[0155] In addition, the controller will also send Table 20 corresponding to the gateway MAC to the local switch and the remote switch. The table fields are the global gateway MAC address and the Layer 2 VNI. When processing a message, if the destination MAC of the message is the gateway MAC, the switch compares the message with the gateway MAC and Layer 2 VNI in Table 20. If they match, the message VNI is rewritten to the tenant VNI and continues to match Table 40 and Table 50. Otherwise, the message is discarded.

[0156] An example of Table 20 is shown in Table 3:

[0157] Table 3

[0158]

[0159]

[0160] Table 30: Matching ACL (Access Control Lists) quintuple

[0161] When the administrator configures an access control policy for an online virtual machine, the controller sends Table 30 to the local switch, matching the source IP, destination IP, source port number, destination port number, and protocol type of the message. The action is the action specified by the administrator, which can be release, discard, or mirror.

[0162] When processing a message, the switch compares the message with the source IP, destination IP, source port number, destination port number, and protocol type in Table 30. If a match is found, the switch performs processing according to the action in Table 30.

[0163] An example of Table 30 is shown in Table 4:

[0164] Table 4

[0165]

[0166] Table 40: Matching destination subnet segment

[0167] When the virtual machine goes online on the switch, the controller sends Table 40 to the remote switch. The fields are the destination subnet of the virtual machine and the tenant VNI. The action is to specify the tunnel outbound interface, rewrite the destination MAC and VLAN ID, and continue to match Table 30.

[0168] When processing a message, the switch compares the message's IP address with the destination subnet segment and tenant VNI in Table 40. If a match is found, the switch rewrites the message's destination MAC address based on the information in Table 40, fills in the message tunnel outbound interface, and continues to match Table 30.

[0169] An example of Table 40 is shown in Table 5:

[0170] Table 5

[0171]

[0172] Table 50: Matching the destination IP and tenant VNI, mapping the physical outbound interface, VLAN ID, and destination MAC

[0173] When the virtual machine goes online on the switch, the controller sends Table 50 to the local switch. The matching items are the destination IP and VNI of the message, the action is to specify the physical interface, rewrite the destination MAC and VLANID, and continue to match Table 30.

[0174] When processing a message, the switch compares the message with the destination IP and VNI in Table 50. If a match is found, the switch rewrites the message's destination MAC, VLAN ID, and fills in the message's physical outbound interface based on the information in Table 50, and continues to match Table 30.

[0175] An example of Table50 is shown in Table 6:

[0176] Table 6

[0177]

[0178] For example, the local switch matches the message based on the multi-level flow table as follows: Figure 8 As shown, including:

[0179] Step 801, matching Table0;

[0180] Here, the local switch receives the message sent by the online virtual machine and matches Table 0 based on the incoming physical interface of the message. If a match is found, step 802 is executed; otherwise, step 806 is executed.

[0181] Step 802, matching Table 10;

[0182] Here, Table 10 is matched based on the physical interface index and VLAN ID of the online virtual machine. If a match is found, the action in Table 10 is filled with the Layer 2 VNI of the message, and step 803 is continued to be executed. Otherwise, step 806 is executed.

[0183] Step 803, matching Table 20;

[0184] Here, if the destination MAC of the message is the MAC of the virtual machine, the switch compares the message with the destination MAC and Layer 2 VNI in Table 20, and if they match, fills in the message's physical outbound interface and VLAN ID according to Table 20, and continues to execute step 805; if the destination MAC of the message is the gateway MAC, the switch compares the message with the gateway MAC and Layer 2 VNI in Table 20, and if they match, rewrites the message's Layer 2 VNI to the tenant VNI, and continues to execute step 804;

[0185] Step 804, matching Table 40;

[0186] The switch matches Table 40 based on the destination IP and tenant VNI of the message. If a match is found, the outbound interface of the message is filled in as the tunnel port connecting the local switch and the switch where the destination IP is located, and step 805 is executed.

[0187] Step 805, matching Table 30;

[0188] The switch compares the message with the source IP, destination IP, source port number, destination port number, and protocol type in Table 30. If they match, it executes step 806; otherwise, it executes step 807.

[0189] Step 806, executing forwarding action;

[0190] The switch forwards the packet according to the action matched in Table 30. If the outbound interface of the packet is the tunnel port determined based on Table 40, the packet needs to be encapsulated into a tunnel packet before forwarding the packet. For example, the packet needs to be encapsulated into a VXLAN tunnel packet.

[0191] Step 807, discard.

[0192] For example, the remote switch matches the message based on the multi-level flow table as follows: Fig. 9 As shown, including:

[0193] Step 901, matching Table0;

[0194] Here, the remote switch receives the tunnel message, matches Table 0 based on the tunnel interface of the tunnel message, and if there is a match, decapsulates the tunnel message, determines the Layer 2 VNI of the message based on the tunnel VNI, and executes step 902, otherwise, executes step 906;

[0195] Step 902, matching Table 20;

[0196] Here, if the destination MAC of the message is the MAC of the virtual machine, the switch compares the message with the destination MAC and Layer 2 VNI in Table 20, and if they match, fills in the message's physical outbound interface and VLAN ID according to Table 20, and continues to execute step 904; if the destination MAC of the message is the gateway MAC, the switch compares the message with the gateway MAC and Layer 2 VNI in Table 20, and if they match, rewrites the message's Layer 2 VNI to the tenant VNI, and continues to execute step 903;

[0197] Step 903, matching Table 50;

[0198] The switch matches Table 50 based on the destination IP and tenant VNI of the message. If there is a match, the switch rewrites the destination MAC and VLAN ID of the message and fills in the physical outbound interface of the message according to the information in Table 50, and executes step 904.

[0199] Step 904, matching Table 30;

[0200] The switch compares the message with the source IP, destination IP, source port number, destination port number, and protocol type in Table 30. If they match, it executes step 905; otherwise, it executes step 906.

[0201] Step 905, executing forwarding action;

[0202] The switch forwards the packet according to the action matched in Table 30 and sends the packet to the destination virtual machine.

[0203] Step 906, discard.

[0204] like Fig.10 As shown in the figure, take the implementation of Layer 3 forwarding within a tenant across switches as an example. Figure 2 The message matching process of VM11 accessing VM23 is illustrated as an example, which specifically includes:

[0205] (1) VM11 goes online on OpenFlow switch 1.

[0206] (2) The controller sends Table 0, Table 10, Table 20, Table 30, Table 50 corresponding to VM 11 and Table 20 corresponding to the gateway MAC to OpenFlow switch 1;

[0207] (3) The controller sends Table 20 and Table 40 corresponding to VM11, Table 0 corresponding to the tunnel, and Table 20 corresponding to the gateway MAC to OpenFlow switch 2;

[0208] (4) VM23 goes online on OpenFlow switch 2;

[0209] (5) The controller sends Table 0, Table 10, Table 20, Table 30, Table 50 corresponding to VM 23 and Table 20 corresponding to the gateway MAC to OpenFlow switch 2;

[0210] (6) The controller sends Table 20 and Table 40 corresponding to VM 23, Table 0 corresponding to the tunnel, and Table 20 corresponding to the gateway MAC to OpenFlow switch 1;

[0211] (7) VM11 accesses the first / subsequent message of VM23

[0212] (8) OpenFlow switch 1 matches the message's inbound interface, VLAN, destination MAC, destination IP, and five-tuple with table 0, table 10, table 20, table 40, table 50, and table 30 in turn, and hits VM11's Table 0, Table 10, gateway MAC's Table 20, VM23's Table 40, and VM11's Table 30 in turn, and performs corresponding actions, tunneling and encapsulating the message and forwarding it to OpenFlow switch 2, carrying the tenant VNI;

[0213] (9) OpenFlow switch 2 matches the message's inbound interface, VNI, destination MAC, destination IP, and five-tuple with table 0, table 10, table 20, table 40, table 50, and table 30 in turn, and hits the tunnel's Table 0, Table 20, VM23's Table 50, and Table 30 in turn, and performs corresponding actions, decapsulating the message in the tunnel and forwarding it to V23.

[0214] In order to implement the data transmission method of the embodiment of the present invention, the embodiment of the present invention also provides a data transmission device, which corresponds to the above-mentioned data transmission method, and each step in the above-mentioned data transmission method embodiment is also fully applicable to the present data transmission device embodiment.

[0215] like Fig.11As shown, the data transmission device includes: a receiving module 1101, a flow table matching module 1102 and a first sending module 1103, wherein the receiving module 1101 is used to receive a multi-level flow table sent by a controller; the flow table matching module 1102 is used to match the received message based on the multi-level flow table; the first sending module 1103 is used to perform a layer-2 forwarding of the message within the same network segment within the tenant or a layer-3 forwarding across network segments within the tenant based on the matching result; the multi-level flow table at least includes: a layer-2 forwarding flow table for matching the layer-2 network identifier and destination MAC of the message and a layer-3 forwarding flow table for matching the tenant network identifier and destination IP of the message.

[0216] In some embodiments, the flow table matching module 1102 is specifically used to:

[0217] Based on the inbound interface of the message, the inbound flow table in the multi-level flow table is matched; if the message is the first message that matches the physical interface, the virtual local area network VLAN identifier of the inbound interface and the first message is matched with the VLAN mapping flow table in the multi-level flow table to determine the layer 2 network identifier of the first message;

[0218] Based on the Layer 2 network identifier and the destination MAC of the first message, the Layer 2 forwarding flow table is matched; if the destination MAC is a matching gateway MAC, the Layer 2 network identifier of the first message is updated to the tenant network identifier, and based on the tenant network identifier and the destination IP of the first message, the Layer 3 forwarding flow table is matched to determine the outbound interface of the first message.

[0219] In some embodiments, the flow table matching module 1102 matches the layer-3 forwarding flow table based on the tenant network identifier and the destination IP address of the first message to determine the outbound interface of the first message, including:

[0220] If the tenant network identifier and the destination IP address of the first message match the IP network segment on the second switch in the layer-3 forwarding flow table, determine that the outbound interface of the first message is the tunnel port connecting the first switch and the second switch;

[0221] If the tenant network identifier and the destination IP of the first message match the terminal IP on the first switch in the three-layer forwarding flow table, the outbound interface of the first message is determined to be the physical interface corresponding to the terminal IP on the first switch.

[0222] In some embodiments, the flow table matching module 1102 is further configured to:

[0223] If the destination MAC is a matching terminal MAC connected to the first switch, determining that the outbound interface of the first message is a physical outbound interface corresponding to the terminal MAC on the first switch;

[0224] If the destination MAC is a matching terminal MAC connected to the second switch, it is determined that the outbound interface of the first message is a tunnel port connecting the first switch and the second switch.

[0225] In some embodiments, the flow table matching module 1102 is specifically used to:

[0226] Based on the inbound interface of the message, the inbound flow table in the multi-level flow table is matched, and if the message is a second message matching the tunnel port, the layer 2 network identifier of the second message is determined based on the tunnel identifier;

[0227] Based on the Layer 2 network identifier and the destination MAC of the second message, the Layer 2 forwarding flow table is matched; if the destination MAC is a matching gateway MAC, the Layer 2 network identifier of the second message is updated to the tenant network identifier, and based on the tenant network identifier and the destination IP of the second message, the Layer 3 forwarding flow table is matched to determine the outbound interface of the second message.

[0228] In some embodiments, the flow table matching module 1102 matches the layer-3 forwarding flow table based on the tenant network identifier and the destination IP address of the second message to determine the outbound interface of the second message, including:

[0229] If the tenant network identifier and the destination IP of the second message match the terminal IP on the first switch in the three-layer forwarding flow table, the outbound interface of the second message is determined to be the physical interface corresponding to the terminal IP on the first switch.

[0230] In some embodiments, the flow table matching module 1102 is further configured to:

[0231] If the destination MAC is a matching terminal MAC connected to the first switch, the outbound interface of the second message is determined to be a physical outbound interface corresponding to the terminal MAC on the first switch.

[0232] In some embodiments, in some embodiments, the flow table matching module 1102 is further used to:

[0233] The message is matched based on an access control list (ACL) flow table in the multi-level flow table to determine a forwarding action for the message.

[0234] In actual application, the receiving module 1101, the flow table matching module 1102 and the first sending module 1103 can be implemented by a processor in the data transmission device. Of course, the processor needs to run the computer program in the memory to realize its function.

[0235] It should be noted that: the data transmission device provided in the above embodiment only uses the division of the above program modules as an example when performing data transmission. In actual applications, the above processing can be assigned to different program modules as needed, that is, the internal structure of the device is divided into different program modules to complete all or part of the processing described above. In addition, the data transmission device provided in the above embodiment and the data transmission method embodiment belong to the same concept, and the specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0236] In order to implement the flow table configuration method of the embodiment of the present invention, the embodiment of the present invention also provides a flow table configuration device, which corresponds to the above-mentioned flow table configuration method, and each step in the above-mentioned flow table configuration method embodiment is also fully applicable to the present flow table configuration device embodiment.

[0237] The flow table configuration device includes: a second sending module, used to send a multi-level flow table to the switch, the multi-level flow table is used for the switch to match the received message, and based on the matching result, the message is forwarded at the second layer in the same network segment within the tenant or forwarded at the third layer across network segments within the tenant; wherein the multi-level flow table includes at least: a second layer forwarding flow table for matching the second layer network identifier and the destination MAC of the message and a third layer forwarding flow table for matching the tenant network identifier and the destination IP of the message.

[0238] Exemplarily, the second sending module is specifically used for:

[0239] Determine that the tenant device is online, and send the Layer 2 forwarding flow table of the tenant device, the Layer 2 forwarding flow table of the gateway MAC, and the Layer 3 forwarding flow table of the IP address of the tenant online on the local switch to the local switch; send the Layer 2 forwarding flow table of the tenant device, the Layer 2 forwarding flow table of the gateway MAC, and the Layer 3 forwarding flow table of the IP network segment of the tenant online on the remote switch to the remote switch.

[0240] Based on the hardware implementation of the above program modules and in order to implement the data transmission method of the embodiment of the present invention, the embodiment of the present invention further provides a switch. Fig.12 Only an exemplary structure of the switch is shown, not all structures, and can be implemented as needed. Fig.12 Partial or complete structure shown.

[0241] like Fig.12As shown in FIG. 1 , the switch 1200 provided in the embodiment of the present invention includes: at least one processor 1201, a memory 1202, a user interface 1203, and at least one network interface 1204. The various components in the switch 1200 are coupled together through a bus system 1205. It can be understood that the bus system 1205 is used to realize the connection and communication between these components. In addition to the data bus, the bus system 1205 also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, the bus system 1205 is not described in detail. Fig.12 Various buses are labeled as bus system 1205.

[0242] The user interface 1203 may include a display, a keyboard, a mouse, a trackball, a click wheel, keys, buttons, a touch pad or a touch screen.

[0243] The memory 1202 in the embodiment of the present invention is used to store various types of data to support the operation of the switch. Examples of such data include: any computer program used to operate on the switch.

[0244] The data transmission method disclosed in the embodiment of the present invention can be applied to the processor 1201, or implemented by the processor 1201. The processor 1201 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the data transmission method can be completed by the hardware integrated logic circuit or software instructions in the processor 1201. The above-mentioned processor 1201 can be a general-purpose processor, a digital signal processor (DSP, Digital Signal Processor), or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The processor 1201 can implement or execute the various methods, steps and logic block diagrams disclosed in the embodiment of the present invention. The general-purpose processor can be a microprocessor or any conventional processor, etc. In combination with the steps of the method disclosed in the embodiment of the present invention, it can be directly embodied as a hardware decoding processor to execute, or it can be executed by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium, which is located in the memory 1202. The processor 1201 reads the information in the memory 1202 and completes the steps of the data transmission method provided in the embodiment of the present invention in combination with its hardware.

[0245] In an exemplary embodiment, the switch may be implemented by one or more application specific integrated circuits (ASIC), DSP, programmable logic device (PLD), complex programmable logic device (CPLD), FPGA, general purpose processor, controller, microcontroller (MCU), microprocessor, or other electronic components to execute the aforementioned method.

[0246] Based on the hardware implementation of the above program modules and in order to implement the flow table configuration method of the embodiment of the present invention, the embodiment of the present invention further provides a controller. Fig.13 Only an exemplary structure of the controller is shown, not all structures, and it can be implemented as needed. Fig.13 Partial or complete structure shown.

[0247] like Fig.13 As shown in FIG. 1 , the controller 1300 provided in the embodiment of the present invention includes: at least one processor 1301, a memory 1302, a user interface 1303, and at least one network interface 1304. The various components in the controller 1300 are coupled together via a bus system 1305. It can be understood that the bus system 1305 is used to realize the connection and communication between these components. In addition to the data bus, the bus system 1305 also includes a power bus, a control bus, and a status signal bus. However, for the sake of clarity, the bus system 1305 is not described in detail. Fig.13 Various buses are labeled as bus system 1305 .

[0248] The user interface 1303 may include a display, a keyboard, a mouse, a trackball, a click wheel, keys, buttons, a touch pad or a touch screen.

[0249] The memory 1302 in the embodiment of the present invention is used to store various types of data to support the operation of the controller. Examples of such data include: any computer program used to operate on the controller.

[0250] The flow table configuration method disclosed in the embodiment of the present invention can be applied to the processor 1301, or implemented by the processor 1301. The processor 1301 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the flow table configuration method can be completed by the hardware integrated logic circuit or software instructions in the processor 1301. The above-mentioned processor 1301 can be a general-purpose processor, a digital signal processor (DSP, Digital Signal Processor), or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The processor 1301 can implement or execute the various methods, steps and logic block diagrams disclosed in the embodiment of the present invention. The general-purpose processor can be a microprocessor or any conventional processor, etc. In combination with the steps of the method disclosed in the embodiment of the present invention, it can be directly embodied as a hardware decoding processor to execute, or it can be executed by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium, which is located in the memory 1302. The processor 1301 reads the information in the memory 1302 and completes the steps of the flow table configuration method provided in the embodiment of the present invention in combination with its hardware.

[0251] In an exemplary embodiment, the controller 1300 may be implemented by one or more ASICs, DSPs, PLDs, CPLDs, FPGAs, general purpose processors, controllers, MCUs, Microprocessors, or other electronic components to perform the aforementioned methods.

[0252] It can be understood that the memory 1202, 1302 can be a volatile memory or a non-volatile memory, and can also include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic random access memory (FRAM), a flash memory, a magnetic surface memory, an optical disk, or a compact disc read-only memory (CD-ROM); the magnetic surface memory can be a disk memory or a tape memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), synchronous static random access memory (SSRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM, SyncLink Dynamic Random Access Memory), and direct RAM bus random access memory (DRRAM, Direct Rambus Random Access Memory).The memories described in the embodiments of the present invention are intended to include, but are not limited to, these and any other suitable types of memories.

[0253] In an exemplary embodiment, the embodiment of the present invention further provides a storage medium, namely a computer storage medium, which can be a computer-readable storage medium, for example, including a memory 1202 storing a computer program, which can be executed by a processor 1201 of a switch to complete the steps described in the data transmission method of the embodiment of the present invention; for another example, including a memory 1302 storing a computer program, which can be executed by a processor 1301 of a controller to complete the steps described in the flow table configuration method of the embodiment of the present invention. The computer-readable storage medium can be a memory such as a ROM, a PROM, an EPROM, an EEPROM, a Flash Memory, a magnetic surface memory, an optical disk, or a CD-ROM.

[0254] It should be noted that: "first", "second", etc. are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0255] In addition, the technical solutions described in the embodiments of the present invention can be arbitrarily combined without conflict.

[0256] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A data transmission method, characterized in that: Applied to a first switch, the method includes: Receive the multi-level flow table sent by the controller; Matching the received message based on the multi-level flow table; Based on the matching result, the message is forwarded at Layer 2 within the same network segment of the tenant or at Layer 3 across network segments within the tenant; The multi-level flow table includes at least: a layer 2 forwarding flow table for matching the layer 2 network identifier of the message with the destination physical access address MAC and a layer 3 forwarding flow table for matching the tenant network identifier of the message with the destination Internet Protocol IP; The matching of the received message based on the multi-level flow table includes: Based on the inbound interface of the message, the inbound flow table in the multi-level flow table is matched; if the message is the first message that matches the physical interface, the virtual local area network VLAN identifier of the inbound interface and the first message is matched with the VLAN mapping flow table in the multi-level flow table to determine the layer 2 network identifier of the first message; Based on the Layer 2 network identifier and the destination MAC of the first message, the Layer 2 forwarding flow table is matched; if the destination MAC is a matching gateway MAC, the Layer 2 network identifier of the first message is updated to the tenant network identifier, and based on the tenant network identifier and the destination IP of the first message, the Layer 3 forwarding flow table is matched to determine the outbound interface of the first message.

2. The method according to claim 1, characterized in that The matching of the tenant network identifier and the destination IP address of the first message with the layer-3 forwarding flow table to determine the outbound interface of the first message includes: If the tenant network identifier and the destination IP address of the first message match the IP network segment on the second switch in the layer-3 forwarding flow table, determine that the outbound interface of the first message is the tunnel port connecting the first switch and the second switch; If the tenant network identifier and the destination IP of the first message match the terminal IP on the first switch in the three-layer forwarding flow table, the outbound interface of the first message is determined to be the physical interface corresponding to the terminal IP on the first switch.

3. The method according to claim 1, characterized in that The method further comprises: If the destination MAC is a matching terminal MAC connected to the first switch, determining that the outbound interface of the first message is a physical outbound interface corresponding to the terminal MAC on the first switch; If the destination MAC is a matching terminal MAC connected to the second switch, it is determined that the outbound interface of the first message is a tunnel port connecting the first switch and the second switch.

4. The method according to claim 1, characterized in that The matching of the received message based on the multi-level flow table includes: Based on the inbound interface of the message, the inbound flow table in the multi-level flow table is matched, and if the message is a second message matching the tunnel port, the layer 2 network identifier of the second message is determined based on the tunnel identifier; Based on the Layer 2 network identifier and the destination MAC of the second message, the Layer 2 forwarding flow table is matched; if the destination MAC is a matching gateway MAC, the Layer 2 network identifier of the second message is updated to the tenant network identifier, and based on the tenant network identifier and the destination IP of the second message, the Layer 3 forwarding flow table is matched to determine the outbound interface of the second message.

5. The method according to claim 4, characterized in that The matching of the tenant network identifier and the destination IP address of the second message with the layer-3 forwarding flow table to determine the outbound interface of the second message includes: If the tenant network identifier and the destination IP of the second message match the terminal IP on the first switch in the three-layer forwarding flow table, the outbound interface of the second message is determined to be the physical interface corresponding to the terminal IP on the first switch.

6. The method according to claim 4, characterized in that The method further comprises: If the destination MAC is a matching terminal MAC connected to the first switch, the outbound interface of the second message is determined to be a physical outbound interface corresponding to the terminal MAC on the first switch.

7. The method according to claim 1 or 4, characterized in that: The matching of the received message based on the multi-level flow table further includes: The message is matched based on an access control list (ACL) flow table in the multi-level flow table to determine a forwarding action for the message.

8. A flow table configuration method, characterized in that: Applied to a controller, the method comprises: Sending a multi-level flow table to the switch, wherein the multi-level flow table is used by the switch to match the received message, and based on the matching result, performing Layer 2 forwarding of the message within the same network segment of the tenant or Layer 3 forwarding across network segments within the tenant; The multi-level flow table at least includes: a layer 2 forwarding flow table for matching the layer 2 network identifier and the destination MAC of the message and a layer 3 forwarding flow table for matching the tenant network identifier and the destination IP of the message; The message includes a first message, where the first message is a message sent by a tenant device that is online on the first switch; The tenant network identifier is obtained by replacing the layer 2 network identifier of the first message when the matching result of matching the layer 2 network identifier of the first message based on the layer 2 forwarding flow table is the gateway MAC; the layer 2 network identifier of the first message is determined after matching the VLAN mapping flow table in the multi-level flow table based on the input interface of the first message and the virtual local area network VLAN identifier of the first message; the layer 3 forwarding flow table is used to match the tenant network identifier and the destination IP of the first message to determine the output interface of the first message.

9. The method according to claim 8, characterized in that The sending of the multi-level flow table to the switch includes: Determine that the tenant device is online, and send the Layer 2 forwarding flow table of the tenant device, the Layer 2 forwarding flow table of the gateway MAC, and the Layer 3 forwarding flow table of the IP address of the tenant online on the local switch to the local switch; send the Layer 2 forwarding flow table of the tenant device, the Layer 2 forwarding flow table of the gateway MAC, and the Layer 3 forwarding flow table of the IP network segment of the tenant online on the remote switch to the remote switch.

10. A data transmission device, characterized in that: Applied to a first switch, the device comprises: A receiving module, used for receiving a multi-level flow table sent by a controller; A flow table matching module, used for matching received messages based on the multi-level flow table; A first sending module, configured to perform Layer 2 forwarding of the message within the same network segment of a tenant or Layer 3 forwarding of the message across network segments within a tenant based on a matching result; The multi-level flow table at least includes: a layer 2 forwarding flow table for matching the layer 2 network identifier and the destination MAC of the message and a layer 3 forwarding flow table for matching the tenant network identifier and the destination IP of the message; The matching of the received message based on the multi-level flow table includes: Based on the inbound interface of the message, the inbound flow table in the multi-level flow table is matched; if the message is the first message that matches the physical interface, the virtual local area network VLAN identifier of the inbound interface and the first message is matched with the VLAN mapping flow table in the multi-level flow table to determine the layer 2 network identifier of the first message; Based on the Layer 2 network identifier and the destination MAC of the first message, the Layer 2 forwarding flow table is matched; if the destination MAC is a matching gateway MAC, the Layer 2 network identifier of the first message is updated to the tenant network identifier, and based on the tenant network identifier and the destination IP of the first message, the Layer 3 forwarding flow table is matched to determine the outbound interface of the first message.

11. A flow table configuration device, characterized in that: Applied to a controller, the device comprises: The second sending module sends a multi-level flow table to the switch, wherein the multi-level flow table is used by the switch to match the received message, and based on the matching result, the message is forwarded at the second layer in the same network segment within the tenant or at the third layer across network segments within the tenant; The multi-level flow table at least includes: a layer 2 forwarding flow table for matching the layer 2 network identifier and the destination MAC of the message and a layer 3 forwarding flow table for matching the tenant network identifier and the destination IP of the message; The message includes a first message, where the first message is a message sent by a tenant device that is online on the first switch; The tenant network identifier is obtained by replacing the layer 2 network identifier of the first message when the matching result of matching the layer 2 network identifier of the first message based on the layer 2 forwarding flow table is the gateway MAC; the layer 2 network identifier of the first message is determined after matching the VLAN mapping flow table in the multi-level flow table based on the input interface of the first message and the virtual local area network VLAN identifier of the first message; the layer 3 forwarding flow table is used to match the tenant network identifier and the destination IP of the first message to determine the output interface of the first message.

12. A switch, characterized in that: include: A processor and a memory for storing a computer program that can be executed on the processor, wherein: The processor is used to execute the steps of the method according to any one of claims 1 to 7 when running a computer program.

13. A controller, characterized in that: include: A processor and a memory for storing a computer program that can be executed on the processor, wherein: The processor is used to execute the steps of the method according to any one of claims 8 to 9 when running a computer program.

14. A storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 9 are implemented.

Images