SD-WAN system and data forwarding method

Abstract

The present invention provides an SD-WAN system and a data forwarding method, the SD-WAN system includes a user branch network, a PON access network, a VPN gateway, an OTN network, a cloud data center access device and a user cloud VPC network; the PON access network is connected between the user branch network and the VPN gateway; the VPN gateway includes a VPN gateway connected between the PON access network and the OTN network and a VPN gateway connected between the cloud data center access device and the OTN network, which is used to maintain the global ID of the user branch network, the forwarding table between the user branch network and the user cloud VPC network, the forwarding table between the user branch networks and the mapping relationship with the user cloud VPC network ID, and send the user data packet to the target VPN gateway according to the forwarding table; the OTN network is used to provide matching connection pipeline resources for the user data packet. The present invention can provide end-to-end QoS guarantee.

Description

Technical Field

[0001] Embodiments of the present invention relate to the field of transmission technology, and in particular, to an SD-WAN system and a data forwarding method. Background Art

[0002] In the era of cloud computing, operators are facing network and business transformation. Cloud-network collaboration is not only the evolution goal and development trend of the next generation of telecommunications networks, but also one of the core capabilities of differentiated competition in mobile Internet information services. As the name suggests, cloud-network collaboration requires the construction of cloud computing and cloud network infrastructure at the same time, and the two complement each other. "Cloud" refers to cloud computing data centers and cloud services; "Network" refers to cloud network infrastructure, which includes not only cloud data center local area networks, but also networks between enterprises or enterprise data centers and cloud data centers, as well as networks between cloud data centers. In particular, the latter two are called "cloud connections". Providing a secure, reliable, and good experience access and interconnection network for cloud computing has become an important development strategy for Internet service providers' technologies and products oriented towards "cloud first". Based on SDN (Software Defined Network) technology, traffic planning, segment routing (SR) and other technologies, low-cost, high-performance, and flexible scheduling of east-west traffic between cloud data centers is achieved, and enterprise cloud backbone networks, wide area network (WAN) gateway technologies, products and services are deployed and provided to achieve seamless connection between enterprise customer networks and clouds, providing users with highly secure, reliable, and high-performance cloud connection pipelines.

[0003] In an existing SD-WAN (Software-Defined Wide Area Network) solution, the network is divided into two layers, the bottom layer is the operator network, and the upper layer is the user data network. In this solution, the bottom layer network cannot provide QoS (Quality of Service) guarantee for the upper layer user data.

[0004] In another existing SD-WAN solution, user data is carried on the operator's IP (Internet Protocol) network, and the underlying IP network can perceive the user. This solution provides QoS guarantees for upper-layer user data at the IP network layer, but the access network and underlying transmission network that actually carry user data cannot perceive different user data, so it cannot provide end-to-end service QoS guarantees for user cloud dedicated lines. Summary of the invention

[0005] The embodiments of the present invention provide an SD-WAN system and a data forwarding method, which are used to solve the problem that the existing SD-WAN solution cannot provide end-to-end service QoS guarantee.

[0006] In order to solve the above-mentioned technical problems, the present invention is achieved as follows:

[0007] In a first aspect, an embodiment of the present invention provides an SD-WAN system, including:

[0008] User branch network, PON access network, VPN gateway, OTN network and cloud data center network;

[0009] in:

[0010] The cloud data center network includes cloud data center access equipment and user cloud VPC network;

[0011] The PON access network is connected between the user branch network and the VPN gateway;

[0012] The VPN gateway includes a VPN gateway connected between the PON access network and the OTN network, and a VPN gateway connected between the cloud data center access device and the OTN network. The VPN gateway is used to maintain the global ID of the user branch network, the forwarding table between the user branch network and the user cloud VPC network, the forwarding table between the user branch networks and the mapping relationship with the user cloud VPC network ID, and send the user data packet of the user branch network or the user cloud VPC network to the target VPN gateway according to the maintained forwarding table;

[0013] The cloud data center access device is connected between the user cloud VPC network and the VPN gateway;

[0014] The OTN network is connected to the VPN gateway and is used to provide matching connection pipe resources for the user data packets.

[0015] In a second aspect, an embodiment of the present invention provides an SD-WAN system, including:

[0016] User branch network, PON access network, VPN gateway and OTN network;

[0017] in:

[0018] The PON access network is connected between the user branch network and the VPN gateway;

[0019] The VPN gateway is connected between the PON access network and the OTN network, and is used to maintain the global ID of the user branch network and the forwarding table between the user branch networks, and send the user data packet of the user branch network to the target VPN gateway according to the maintained forwarding table;

[0020] The OTN network is connected to the VPN gateway and is used to provide matching connection pipe resources for the user data packets.

[0021] In a third aspect, an embodiment of the present invention provides a data forwarding method, which is applied to a source VPN gateway, comprising:

[0022] The source VPN gateway receives a VxLAN data packet sent by a source PON access network, wherein the VxLAN data packet carries a user data packet and a VNI, wherein the user data packet is a data packet sent by a source user branch network to a target user branch network or a user cloud VPC network, and the VNI is used to identify a tenant ID;

[0023] The source VPN gateway extracts the VNI, the user data packet and the target address of the user data packet from the VxLAN data packet;

[0024] The source VPN gateway queries the global ID of the target user branch network or the user cloud VPC network and the OTN network resource association identifier in the forwarding table between the user branch networks or the forwarding table between the user branch network and the user cloud VPC network based on the VNI and the target address, wherein the forwarding table stores the corresponding relationship between the VNI, the global ID of the target user branch network or the user cloud VPC network, and the OTN network resource association identifier;

[0025] The source VPN gateway adds the OTN network resource association identifier to the user data packet and encapsulates the user data packet to obtain an encapsulated user data packet;

[0026] The source VPN gateway sends the encapsulated user data packet to the OTN network;

[0027] When the source VPN gateway sends the encapsulated user data packet to the OTN device port connected to the target VPN gateway, the OTN device replaces the VLAN ID of the user data packet with the VLAN ID of the target user branch network or user cloud VPC network.

[0028] Optionally, the global ID of the target user branch network or user cloud VPC network includes: a MAC address or port of a target VPN gateway, and a VLAN ID of the target user branch network or user cloud VPC network.

[0029] Optionally, the target address is a target MAC address or a target IP address of a user branch network or a user cloud VPC network.

[0030] In a fourth aspect, an embodiment of the present invention provides a data forwarding method, which is applied to a target VPN, comprising:

[0031] The target VPN gateway receives the user data packet sent by the OTN network;

[0032] The target VPN gateway queries the VNI in the forwarding table between user branch networks based on the VLAN ID of the target user branch network of the user data packet and the ingress port of the user data packet. The VNI is used to identify the tenant ID. The forwarding table between the user branch networks stores the corresponding relationship between the VNI, the global ID of the user branch network, and the OTN network resource association identifier; the global ID of the target user branch network includes: the MAC address or port of the target VPN gateway, and the VLAN ID of the target user branch network;

[0033] The target VPN gateway determines, according to the VNI, an ONU device in a target PON access network where the target user branch network is located;

[0034] The target VPN gateway encapsulates the user data packet into a VxLAN data packet;

[0035] The target VPN gateway sends the VxLAN data packet to the ONU device.

[0036] Optionally, the target VPN gateway determines, according to the VNI, an ONU device in a target PON access network where the target user branch network is located, including:

[0037] The VPN gateway queries the user branch network space information table based on the VNI to determine the ONU device in the target PON access network where the target user branch network is located. The user branch network space information table stores the correspondence between the VNI, the VLAN ID of the user branch network, the target address and the IP address of the ONU device.

[0038] In a fifth aspect, an embodiment of the present invention provides a data forwarding method, which is applied to a target VPN gateway, comprising:

[0039] The target VPN gateway receives the user data packet sent by the OTN network;

[0040] The target VPN gateway queries the global ID of the target user cloud VPC network in the matching information table of the global ID of the user branch network and the global ID of the user cloud VPC network based on the VLAN ID of the user branch network of the user data packet, wherein the matching information table stores the corresponding relationship between the global ID of the user branch network, the VLAN ID of the user branch network and the global ID of the user cloud VPC network;

[0041] The target VPN gateway encapsulates the user data packet based on the global ID of the target user cloud VPC network;

[0042] The target VPN gateway sends the encapsulated user data packet to the cloud data center access device of the target user cloud VPC network.

[0043] Optionally, the global ID of the user cloud VPC network is a VNI or a VLAN ID.

[0044] In a sixth aspect, an embodiment of the present invention provides a data forwarding method, applied to a source VPN gateway, comprising:

[0045] The source VPN gateway receives a user data packet sent by a cloud data center device;

[0046] The source VPN gateway extracts the global ID of the source user cloud VPC network from the user data packet;

[0047] The source VPN gateway queries the VLAN ID of the target user branch network and the global ID of the target user branch network in the user branch network global ID and user cloud VPC network global ID matching information table based on the global ID of the source user cloud VPC network, wherein the matching information table stores the corresponding relationship between the global ID of the user branch network, the VLAN ID of the user branch network and the global ID of the user cloud VPC network;

[0048] The source VPN gateway encapsulates the user data packet based on the VLAN ID of the target user branch network;

[0049] The source VPN gateway queries the OTN network resource association identifier in the forwarding table of the user branch network and the user cloud VPC network according to the global ID of the target user branch network, and the forwarding table of the user branch network and the user cloud VPC network stores the corresponding relationship between the VNI, the global ID of the user branch network, and the OTN network resource association identifier;

[0050] The source VPN gateway adds the OTN network resource association identifier to the encapsulated user data packet, and encapsulates the user data packet to obtain the encapsulated user data packet;

[0051] The source VPN gateway sends the encapsulated user data packet to the OTN network.

[0052] In a seventh aspect, an embodiment of the present invention provides a VPN gateway, including:

[0053] A receiving module, used to receive a VxLAN data packet sent by a source PON access network, wherein the VxLAN data packet carries a user data packet and a VNI, wherein the user data packet is a data packet sent by a source user branch network to a target user branch network or a user cloud VPC network, and the VNI is used to identify a tenant ID;

[0054] An extraction module, used to extract the VNI, the user data packet and the target address of the user data packet from the VxLAN data packet;

[0055] A query module, used to query the global ID of the target user branch network or the user cloud VPC network and the OTN network resource association identifier in the forwarding table between the user branch networks or the forwarding table between the user branch network and the user cloud VPC network based on the VNI and the target address, wherein the forwarding table stores the corresponding relationship between the VNI, the global ID of the target user branch network or the user cloud VPC network, and the OTN network resource association identifier;

[0056] An encapsulation module, used for adding the OTN network resource association identifier to the user data packet and encapsulating the user data packet to obtain an encapsulated user data packet;

[0057] The sending module is used to send the encapsulated user data packet to the OTN network.

[0058] In an eighth aspect, an embodiment of the present invention provides a VPN gateway, including:

[0059] A receiving module is used to receive user data packets sent by the OTN network;

[0060] A query module, used to query VNI in the forwarding table between user branch networks based on the VLAN ID of the target user branch network of the user data packet and the ingress port of the user data packet, wherein the VNI is used to identify the tenant ID, and the forwarding table between the user branch networks stores the corresponding relationship between the VNI, the global ID of the user branch network, and the OTN network resource association identifier; the global ID of the target user branch network includes: the MAC address or port of the target VPN gateway, and the VLAN ID of the target user branch network;

[0061] A determination module, used to determine an ONU device in a target PON access network where the target user branch network is located according to the VNI;

[0062] An encapsulation module, used for encapsulating the user data packet into a VxLAN data packet;

[0063] A sending module is used to send the VxLAN data packet to the ONU device.

[0064] In a ninth aspect, an embodiment of the present invention provides a VPN gateway, including:

[0065] A receiving module is used to receive user data packets sent by the OTN network;

[0066] A query module, for querying the global ID of the target user cloud VPC network in a matching information table of the global ID of the user branch network and the global ID of the user cloud VPC network based on the VLAN ID of the user branch network of the user data packet, wherein the matching information table stores the corresponding relationship between the global ID of the user branch network, the VLAN ID of the user branch network and the global ID of the user cloud VPC network;

[0067] An encapsulation module, used for encapsulating the user data packet based on the global ID of the target user cloud VPC network;

[0068] The sending module is used to send the encapsulated user data packet to the cloud data center access device of the target user cloud VPC network.

[0069] In a tenth aspect, an embodiment of the present invention provides a VPN gateway, including:

[0070] A receiving module, used to receive user data packets sent by a cloud data center access device;

[0071] An extraction module, used to extract the global ID of the source user cloud VPC network from the user data packet;

[0072] A first query module is used to query the VLAN ID of the target user branch network and the global ID of the target user branch network in the user branch network global ID and user cloud VPC network global ID matching information table based on the global ID of the source user cloud VPC network, wherein the matching information table stores the corresponding relationship between the global ID of the user branch network, the VLAN ID of the user branch network and the global ID of the user cloud VPC network;

[0073] A first encapsulation module, used for encapsulating the user data packet based on the VLAN ID of the target user branch network;

[0074] A second query module is used to query the OTN network resource association identifier in the user branch network forwarding table according to the global ID of the target user branch network, wherein the user branch network forwarding table stores the corresponding relationship between the VNI, the global ID of the user branch network, and the OTN network resource association identifier;

[0075] A second encapsulation module is used to add the OTN network resource association identifier to the encapsulated user data packet and encapsulate the user data packet to obtain an encapsulated user data packet;

[0076] The sending module is used to send the encapsulated user data packets to the OTN network.

[0077] In the eleventh aspect, an embodiment of the present invention provides a VPN gateway, comprising: a processor, a memory, and a program stored in the memory and executable on the processor, wherein the program, when executed by the processor, implements the steps of the data forwarding method described in the third aspect above; or, when executed by the processor, the program implements the steps of the data forwarding method described in the fourth aspect above; or, when executed by the processor, the program implements the steps of the data forwarding method described in the fifth aspect above; or, when executed by the processor, the program implements the steps of the data forwarding method described in the sixth aspect above.

[0078] In the twelfth aspect, an embodiment of the present invention provides a readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the computer program implements the steps of the data forwarding method as described in the third aspect of claim 1; or, when the computer program is executed by a processor, the computer program implements the steps of the data forwarding method as described in the fourth aspect; or, when the computer program is executed by a processor, the computer program implements the steps of the data forwarding method as described in the fifth aspect; or, when the computer program is executed by a processor, the computer program implements the steps of the data forwarding method as described in the sixth aspect.

[0079] The embodiments of the present invention have the following advantages:

[0080] 1. “End-to-end” QoS guarantee:

[0081] Starting from the network egress, user data can be perceived by the access network, and user data can also be perceived by the underlying OTN network, providing end-to-end QoS guarantees.

[0082] 2. Reduce the O&M complexity of SD-WAN

[0083] Different from the traditional technical solution that uses port and VLAN ID bundling and transmits and maintains the user global identity association between different devices in different network devices, the embodiment of the present invention uses VNI and global MAC+VLAN ID technical solutions to globally identify user identities. It only needs to configure and maintain the user branch network global ID or the user cloud VPC network global ID on the VPN gateway, and there is no need to configure a large amount of port + VLAN ID data on a wider number of access devices and OTN network access ring devices. It is also independent of the device hardware port. It avoids the huge maintenance workload caused by the port change of the access device during network operation and maintenance and upgrade in the original technical solution, and is prone to errors.

[0084] 3. Higher cost-effectiveness of user data forwarding

[0085] Compared with the IP-based underlay SD-WAN technical solution, the solution of the embodiment of the present invention reduces the IP header and UDP / TCP overhead and improves the forwarding efficiency of user data. BRIEF DESCRIPTION OF THE DRAWINGS

[0086] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiment below. The accompanying drawings are only used to illustrate the objects of the preferred embodiment and are not to be considered as limiting the present invention. Moreover, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0087] Figure 1 This is an architecture diagram of an SD-WAN system according to an embodiment of the present invention;

[0088] Figure 2 This is an architecture diagram of an SD-WAN system according to another embodiment of the present invention;

[0089] Figure 3 A schematic diagram of a flow chart of a method for forwarding uplink data between user branch networks according to an embodiment of the present invention;

[0090] Figure 4 This is a schematic diagram of the structure of a VxLAN encapsulation packet according to an embodiment of the present invention;

[0091] Figure 5 A schematic diagram of the data structure of a user branch network forwarding table according to an embodiment of the present invention;

[0092] Figure 6 A schematic diagram of the data structure of a user data packet encapsulated by a VPN gateway according to an embodiment of the present invention;

[0093] Figure 7 A schematic diagram of a flow chart of a method for forwarding downlink data between user branch networks according to an embodiment of the present invention;

[0094] Figure 8 It is the ONU local user branch network space information table under L2VPN networking mode;

[0095] Fig. 9 It is the ONU local user branch network space information table under L3VPN networking mode;

[0096] Fig.10 A schematic diagram of a flow chart of a method for forwarding uplink data between a user branch network and a user cloud VPC network according to an embodiment of the present invention;

[0097] Fig.11 A schematic diagram of a flow chart of a method for forwarding downlink data between a user branch network and a user cloud VPC network according to an embodiment of the present invention;

[0098] Fig.12 A matching information table of the global ID of the user branch network and the global ID of the user cloud VPC network in an embodiment of the present invention;

[0099] Fig.13 A schematic diagram of a flow chart of a method for forwarding uplink data between a user cloud VPC network and a user branch network according to an embodiment of the present invention;

[0100] Fig.14 A schematic diagram of a flow chart of a method for forwarding downlink data between a user cloud VPC network and a user branch network according to an embodiment of the present invention;

[0101] Fig.15 A general solution for IP-based underlay SD-WAN technology and user data encapsulation under this solution;

[0102] Fig.16 It is a general solution for the underlay SD-WAN technical solution of the embodiment of the present invention and the user data encapsulation under the solution;

[0103] Fig.17 A schematic diagram of the structure of a VPN gateway according to an embodiment of the present invention;

[0104] Fig.18 A schematic diagram of the structure of a VPN gateway according to another embodiment of the present invention;

[0105] Fig.19 A schematic diagram of the structure of a VPN gateway according to another embodiment of the present invention;

[0106] Fig. 20 A schematic diagram of the structure of a VPN gateway according to another embodiment of the present invention;

[0107] Fig.21The figure is a schematic diagram of the structure of a VPN gateway according to another embodiment of the present invention. DETAILED DESCRIPTION

[0108] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0109] Please refer to Figure 1 , Figure 1 The SD-WAN system of the embodiment of the present invention is an architecture diagram, and the SD-WAN system includes: a user branch network, a PON (Passive Optical Network) access network, a VPN gateway, an OTN (Optical Transport Network) network and a cloud data center network;

[0110] in:

[0111] The cloud data center network includes cloud data center access equipment and user cloud VPC (Virtual Private Cloud) network;

[0112] The PON access network is connected between the user branch network and the VPN gateway;

[0113] The VPN gateway includes a VPN gateway connected between the PON access network and the OTN network, and a VPN gateway connected between the cloud data center access device and the OTN network. The VPN gateway is used to maintain the global ID of the user branch network, the forwarding table between the user branch network and the user cloud VPC network, the forwarding table between the user branch networks and the mapping relationship with the user cloud VPC network ID, and send the user data packet of the user branch network or the user cloud VPC network to the target VPN gateway according to the maintained forwarding table;

[0114] The cloud data center access device is connected between the user cloud VPC network and the VPN gateway;

[0115] The OTN network is connected to the VPN gateway and is used to provide matching connection pipeline resources for user data packets between the user branch network and the user cloud VPC network, or for user data packets between the user branch networks.

[0116] In the embodiment of the present invention, an underlay SD-WAN system of "pure layer 2" network technology is implemented based on the PON access network and the OTN network. User data can be perceived by the access network and the underlying OTN network, thereby providing end-to-end QoS guarantee for user data. Users do not need to know any details of any cloud data center network. It is just like accessing a local Ethernet network device. There is no need to propose any technical transformation requirements for user branch networks, which greatly reduces the cost and complexity of users using cloud dedicated lines.

[0117] Please refer to Figure 2 , an embodiment of the present invention may also provide an SD-WAN system, including:

[0118] User branch network, PON access network, VPN gateway and OTN network;

[0119] in:

[0120] The PON access network is connected between the user branch network and the VPN gateway;

[0121] The VPN gateway is connected between the PON access network and the OTN network, and is used to maintain the global ID of the user branch network and the forwarding table between the user branch networks, and send the user data packet of the user branch network to the target VPN gateway according to the maintained forwarding table;

[0122] The OTN network is connected to the VPN gateway and is used to provide matching connection pipe resources for the user data packets.

[0123] In the embodiment of the present invention, an underlay SD-WAN system of a "pure two-layer" network technology is implemented based on the PON access network and the OTN network. User data can be perceived by the access network and also by the underlying OTN network, thereby providing end-to-end QoS guarantee for user data.

[0124] In the above embodiment, optionally, the user branch network includes an enterprise headquarters network and an enterprise branch network, etc., which are connected to the OTN network through a PON access network.

[0125] In the above embodiment, optionally, the PON access network includes an ONU (Optical Network Unit) device and an OLT (Optical Line Terminal) device.

[0126] In the above embodiment, optionally, the VPN gateway connected between the PON access network and the OTN network can be deployed in the operator network, and the VPN gateway connected between the cloud data center network and the OTN network can be deployed in the operator network or in the cloud data center network.

[0127] In the above embodiment, optionally, the OTN network is used to connect user branch networks and user branch networks or to connect user branch networks and cloud data center networks, and to provide matching connection pipeline resources between user branch networks and user branch networks, or between user branch networks and user cloud VPC networks, so as to provide connection services with QoS guarantees.

[0128] In the above embodiment, the cloud data center network is used to provide cloud "VPC" services for users, and the user branch network needs to use a connection service with QoS guarantee to ensure the interconnection of user branch networks or user cloud VPC networks in different locations, thereby providing a user experience with LAN interconnection.

[0129] The following is an example of a data forwarding method applied to the above SD-WAN system.

[0130] The following first describes a method for forwarding uplink data between user branch networks and user branch networks in the above-mentioned SD-WAN system, such as forwarding uplink data between different user branch networks belonging to the same tenant.

[0131] Please refer to Figure 3 The embodiment of the present invention provides a method for forwarding data between user branch networks, which is used to send user data from one user branch network to another user branch network. The method includes the following steps:

[0132] Step 21: The source user branch network sends the user data packet to the source PON access network;

[0133] In the embodiment of the present invention, the user branch network that sends user data is called a source user branch network, the PON access network to which the source user branch network belongs is called a source PON access network, and the VPN gateway between the source PON access network and the OTN network is called a source VPN gateway.

[0134] The user branch network that receives user data is called a target user branch network, the PON access network to which the target user branch network belongs is called a target PON access network, and the VPN gateway between the target PON access network and the OTN network is called a target VPN gateway.

[0135] In the embodiment of the present invention, the source user branch network and the target user branch network belong to the same tenant (or referred to as user).

[0136] Step 22: The source PON access network uses VxLAN (Virtual eXtensible LAN) to encapsulate the user data packet to obtain a VxLAN data packet. The VxLAN data packet carries the user data packet and VNI (VxLAN Network Identifier). VNI is used to identify a globally unique tenant ID. The tenant is the tenant to which the source user branch network and the target user branch network belong.

[0137] Optionally, the ONU device belonging to the source user branch network in the source PON access network uses VxLAN to encapsulate the user data packet to obtain a VxLAN data packet.

[0138] In the embodiment of the present invention, please refer to Figure 4 , the VxLAN data packet includes: a VxLAN encapsulation part and a user data packet part, wherein the VxLAN encapsulation part includes an external MAC (Medium Access Control) header, an external IP header, a VxLAN port and a VxLAN header (8B), and the user data packet part includes: a user MAC header, a user IP header and a data payload. The MAC address in the external MAC header includes the MAC address of the ONU device and the MAC address of the source VPN gateway. The IP address in the external IP header includes the IP address of the ONU device and the IP address of the source VPN gateway. The VxLAN header carries the VNI, and when the number of tenants increases to a certain scale, the reserved bit can be expanded. The user data packet is encapsulated in a UDP (User Datagram Protocol) data packet. The user MAC header in the user data packet includes the MAC addresses of the source user branch network and the target user branch network. The user IP header of the user data packet includes the IP addresses of the source user branch network and the target user branch network.

[0139] Step 23: The source PON access network sends the VxLAN data packet to the source VPN gateway;

[0140] The following steps 24 and 25 are all data forwarding methods performed by the source VPN gateway:

[0141] Step 24:

[0142] 24a: The source VPN gateway receives the VxLAN data packet sent by the source PON access network, and extracts the VNI, the user data packet and the target address of the user data packet from the VxLAN data packet, where the target address is the target MAC address or the target IP address of the target user branch network;

[0143] 24b: Based on the extracted VNI and target address, the source VPN gateway queries the global ID and OTN network resource association identifier of the target user branch network in the forwarding table between the user branch networks. The global ID of the target user branch network includes: the MAC address or port of the target VPN gateway, and the VLAN (Virtual Local Area Network) ID of the target user branch network; the VLAN ID of the user branch network is a unique identifier assigned to the user branch network.

[0144] The network resource association identifier is a network resource association identifier allocated by the underlying OTN network for interconnection between user branch networks, which can be a VLAN ID to achieve association or mapping of user data flows to underlying network resources.

[0145] Please refer to Figure 5 , Figure 5 This is a schematic diagram of the data structure of the forwarding table between user branch networks of an embodiment of the present invention, the data structure includes: user branch network space information, the global ID of the user branch network and the network resource association identifier, the user branch network space information includes: VNI, user VLAN, IP address space and MAC address space, the global ID of the user branch network includes: VPN gateway MAC address or port, and, the VLAN ID of the target user branch network.

[0146] 24c: The source VPN gateway adds the OTN network resource association identifier to the user data packet, and encapsulates the user data packet in an Ethernet encapsulation format to obtain an encapsulated user data packet; please refer to Figure 6 , Figure 6 This is a schematic diagram of the data structure of the user data packet encapsulated by the source VPN gateway.

[0147] Step 25: The source VPN gateway sends the encapsulated user data packet to the OTN network.

[0148] The following describes a method for forwarding downlink data between user branch networks.

[0149] Please refer to Figure 7 The embodiment of the present invention provides a method for forwarding data between user branch networks, which is used to send user data from one user branch network to another user branch network. The method includes the following steps:

[0150] The following steps 26-27 are a data forwarding method performed by the OTN network:

[0151] Step 26:

[0152] Step 26a: The source OTN device of the OTN network connected to the source VPN gateway receives the encapsulated user data packet sent by the source VPN gateway, searches for the corresponding connection pipe resource according to the OTN network resource association identifier of the encapsulated user data packet, and uses the connection pipe resource to transmit the user data packet between the OTN devices;

[0153] Step 26b: After receiving the user data packet, the target OTN device connected to the target VPN in the OTN network replaces the OTN network resource association identifier of the user data packet with the VLAN ID of the target user branch network;

[0154] Step 27: The target OTN device of the OTN network sends the user data packet to the target VPN gateway.

[0155] Step 28:

[0156] Step 28a: The target VPN gateway receives the user data packet sent by the OTN network, and based on the VLAN ID of the target user branch network of the user data packet and the ingress port of the user data packet, obtains the user data packet from the forwarding table between the user branch networks (see Figure 5 ) to query the VNI;

[0157] Step 28b: The target VPN gateway determines the ONU device in the PON access network where the target user branch network is located according to the VNI, and uses VxLAN to encapsulate the user data packet to obtain a VxLAN data packet;

[0158] In the embodiment of the present invention, it is possible to use Figure 8 or Fig. 9 The ONU local user branch network space information shown determines the ONU device. Figure 8 It is the ONU local user branch network space information table under L2VPN networking mode. Fig. 9 It is the ONU local user branch network space information table in L3VPN networking mode.

[0159] Step 29: The target VPN gateway sends the encapsulated VxLAN data packet to the determined ONU device;

[0160] Step 210: The ONU device decapsulates the VxLAN data packet, obtains the user data packet, and forwards it to the target user branch network.

[0161] The following describes a method for forwarding uplink data between a user branch network and a user cloud VPC network.

[0162] Please refer to Fig.10The embodiment of the present invention provides a method for forwarding data between a user branch network and a user cloud VPC network, for sending user data from a user branch network to a user cloud VPC network, the method comprising the following steps:

[0163] Step 31: The source user branch network sends the user data packet to the source PON access network;

[0164] In the embodiment of the present invention, the user branch network that sends user data is called a source user branch network, the PON access network to which the source user branch network belongs is called a source PON access network, and the VPN gateway between the source PON access network and the OTN network is called a source VPN gateway.

[0165] The user cloud VPC network that receives user data is called the target user cloud VPC network. The cloud data center access device to which the target user cloud VPC network belongs is called the target cloud data center access device. The VPN gateway between the target cloud data center access device and the OTN network is called the target VPN gateway.

[0166] The source user branch network may be an enterprise branch network or an enterprise headquarters network.

[0167] Step 32: The source PON access network uses VxLAN to encapsulate the user data packet to obtain a VxLAN data packet, which carries the user data packet and VNI. VNI is a globally unique tenant (or user) ID used to identify the tenant. The tenant is the tenant to which the source user branch network belongs.

[0168] Optionally, the ONU device belonging to the source user branch network in the source PON access network uses VxLAN to encapsulate the user data packet to obtain a VxLAN data packet.

[0169] Step 33: The source PON access network sends the VxLAN data packet to the source VPN gateway;

[0170] The structure of the VxLAN data packet can be found in Figure 4 , which is different from sending user data between user branch networks, in this case, the user MAC header of the user data packet includes the MAC address of the source user branch network and the target user cloud VPC network. The user IP header in the user data packet includes the IP address of the source user branch network and the target user cloud VPC network.

[0171] The following steps 34 to 35 are all data forwarding methods performed by the source VPN gateway:

[0172] Step 34:

[0173] 34a: The source VPN gateway receives the VxLAN data packet sent by the source PON access network, and extracts the VNI, the user data packet and the destination address of the user data packet from the VxLAN data packet. The destination address is the destination MAC address or destination IP address of the destination user cloud VPC network.

[0174] 34b: The source VPN gateway queries the global ID and OTN network resource association identifier of the target user cloud VPC network in the forwarding table of the user branch network and the user cloud VPC network based on the extracted VNI and the target address. The global ID of the target user cloud VPC network includes: the MAC address or port of the target VPN gateway, and the VLAN ID of the target user cloud VPC network;

[0175] The OTN network resource association identifier is a network resource association identifier allocated by the underlying OTN network for interconnection between the user branch network and the user cloud VPC network. It can be a VLAN identifier to achieve association or mapping of user data flows to underlying network resources.

[0176] 34c: The source VPN gateway adds the OTN network resource association identifier to the user data packet, and encapsulates the user data packet in an Ethernet encapsulation format to obtain an encapsulated user data packet.

[0177] Step 35: The source VPN gateway sends the encapsulated user data packet to the OTN network.

[0178] The following describes a method for forwarding downlink data between a user branch network and a user cloud VPC network.

[0179] Please refer to Fig.11 The embodiment of the present invention provides a method for forwarding data between a user branch network and a user cloud VPC network, for sending user data from a user branch network to a user cloud VPC network, the method comprising the following steps:

[0180] Step 36:

[0181] Step 36a: The source OTN device of the OTN network connected to the source VPN gateway receives the encapsulated user data packet sent by the source VPN gateway, searches for the corresponding connection pipe resource according to the OTN network resource association identifier of the encapsulated user data packet, and uses the connection pipe resource to transmit the user data packet between the OTN devices;

[0182] Step 36b: After receiving the user data packet, the target OTN device connected to the target VPN gateway of the OTN network replaces the network resource association identifier of the user data packet with the VLAN ID of the target user cloud VPC network;

[0183] Step 37: The target OTN device of the OTN network sends the user data packet to the target VPN gateway.

[0184] Step 38:

[0185] Step 38a: The target VPN gateway receives the user data packet sent by the OTN network, and queries the matching information table of the global ID of the user branch network and the global ID of the user cloud VPC network according to the global ID of the source user branch network of the user data packet (please refer to Fig.12 ), determine the global ID of the target user cloud VPC network corresponding to the global ID of the source user branch network, where the global ID of the user cloud VPC network is VNI or VLAN;

[0186] The VNI or VLAN of the user cloud VPC network is the ID of the user cloud VPC network in the cloud data center network to which it belongs. The tenant VNI is the global ID assigned by the operator to the user branch network.

[0187] Step 38b: For the VxLAN intercommunication scenario, the target VPN gateway acts as a VTEP (VXLAN Tunnel End Point) point to encapsulate the user data packet into a VxLAN data packet, and its VNI uses the queried VNI;

[0188] Step 38c: For the VLAN intercommunication scenario, modify the VLAN ID of the user data packet to the VLAN ID corresponding to the matching target user cloud VPC network;

[0189] Step 39: The target VPN gateway sends the user data packet to the target cloud data center access device;

[0190] Step 310: The target cloud data center access device forwards the user data packet to the target user cloud VPC network.

[0191] The following describes a method for forwarding uplink data between a user cloud VPC network and a user branch network for sending user data packets.

[0192] Please refer to Fig.13 The embodiment of the present invention provides a method for forwarding data between a user branch network and a user cloud VPC network, which is used to send a user data packet from the user cloud VPC network to the user branch network. The method includes the following steps:

[0193] Step 41: The source user cloud VPC network sends the user data packet to the source cloud data center access device;

[0194] Step 42: The source cloud data center access device sends the user data packet to the source VPN gateway;

[0195] Step 43:

[0196] Step 43a: The source VPN gateway extracts the global ID of the source user cloud VPC network from the user data packet. The global ID is the VNI or VLAN ID.

[0197] Step 43b: The source VPN gateway queries the global ID of the target user branch network and the VLAN ID of the target user branch network corresponding to the global ID of the source user cloud VPC network from the user branch network global ID and cloud VPC global ID matching information table according to the global ID of the source user cloud VPC network;

[0198] Step 43c: The source VPN gateway adds the VLAN ID of the target user branch network to the user data packet; based on the queried global ID of the target user branch network, the source VPN gateway queries the OTN network resource association identifier from the user branch network and the user cloud VPC network forwarding table, and adds the OTN network resource association identifier to the user data packet;

[0199] Step 44: The source VPN gateway sends the user data packet to the OTN network.

[0200] The following describes a method for forwarding downlink data between a user cloud VPC network and a user branch network for sending user data packets.

[0201] Please refer to Fig.14 The embodiment of the present invention provides a method for forwarding data between a user branch network and a user cloud VPC network, which is used to send user data from the user cloud VPC network to the user branch network. The method includes the following steps:

[0202] The following steps 46-47 are a data forwarding method performed by the OTN network:

[0203] Step 46:

[0204] Step 46a: The source OTN device of the OTN network connected to the source VPN gateway receives the user data packet sent by the source VPN gateway, searches for the corresponding connection pipe resource according to the OTN network resource association identifier of the user data packet, and uses the connection pipe resource to transmit the user data packet between the OTN devices;

[0205] Step 46b: After receiving the user data packet, the target OTN device connected to the target VPN gateway of the OTN network replaces the network resource association identifier of the user data packet with the VLAN ID of the target user branch network;

[0206] Step 47: The target OTN device of the OTN network sends the user data packet to the target VPN gateway.

[0207] Step 48:

[0208] Step 48a: The target VPN gateway queries the VNI in the user branch network forwarding table based on the VLAN ID of the target user branch network of the user data packet and the ingress port of the user data packet, wherein the VNI is used to identify the tenant ID, and the user branch network forwarding table stores the corresponding relationship between the VNI, the global ID of the user branch network, and the OTN network resource association identifier; the global ID of the target user branch network includes: the MAC address or port of the target VPN gateway, and the VLAN ID of the target user branch network; the VPN gateway determines the ONU device in the target PON access network where the target user branch network is located according to the VNI;

[0209] Step 48b: The target VPN gateway encapsulates the user data packet into a VxLAN data packet;

[0210] Step 49: The target VPN gateway sends the encapsulated VxLAN data packet to the ONU device in the target PON access network;

[0211] Step 410: The ONU device decapsulates the VxLAN data packet and sends the decapsulated user data packet to the target user branch network.

[0212] The above SD-WAN system has the following advantages:

[0213] 1. “End-to-end” QoS guarantee:

[0214] Starting from the network egress, user data can be sensed by the access network, and user data can also be sensed by the underlying OTN network, which can identify different user branch networks within the same tenant and provide different QoS guarantees.

[0215] 2. Reduce the O&M complexity of SD-WAN

[0216] Different from the traditional technical solution that uses port and VLAN ID bundling and transmits and maintains the user global identity association between different devices in different network devices, the embodiment of the present invention uses VNI and global MAC+VLAN ID technical solutions to globally identify user identities. It only needs to configure and maintain the user branch network global ID on the VPN gateway, and there is no need to configure a large amount of port+VLAN ID data on a wider number of access devices and OTN network access ring devices. It is also independent of the device hardware port. It avoids the huge maintenance workload caused by the port change of the access device during network operation and maintenance and upgrade in the original technical solution, and is prone to errors.

[0217] 3. Higher cost-effectiveness of user data forwarding

[0218] Fig.15 It is a general solution based on IP-based underlay SD-WAN technology and user data encapsulation under this solution. Fig.16 It is a general solution for the underlay SD-WAN technical solution of the embodiment of the present invention and the user data encapsulation under the solution. By comparison, it can be seen that the user data of the IP-based underlay SD-WAN technical solution introduces 56 to 100 bytes more overhead than the solution of the embodiment of the present invention. According to the statistics of the data packets in the existing network, 70% of the traffic in the existing network is short data packets below 100B, so the forwarding efficiency of the solution of the embodiment of the present invention is at least 56% higher than that of the IP-based underlay SD-WAN technical solution.

[0219] Please refer to Fig.17 The embodiment of the present invention further provides a VPN gateway 170, including:

[0220] A receiving module 171 is used to receive a VxLAN data packet sent by a source PON access network, wherein the VxLAN data packet carries a user data packet and a VNI, wherein the user data packet is a data packet sent by the source user branch network to a target user branch network or a user cloud VPC network, and the VNI is used to identify a tenant ID;

[0221] An extraction module 172 is used to extract the VNI, the user data packet and the target address of the user data packet from the VxLAN data packet;

[0222] A query module 173 is used to query the global ID of the target user branch network or user cloud VPC network and the OTN network resource association identifier in the user branch network forwarding table based on the VNI and the target address, wherein the user branch network forwarding table stores the corresponding relationship between the VNI, the global ID of the target user branch network or user cloud VPC network, and the OTN network resource association identifier;

[0223] The encapsulation module 174 is used to add the OTN network resource association identifier to the user data packet and encapsulate the user data packet to obtain an encapsulated user data packet;

[0224] The sending module 175 is used to send the encapsulated user data packet to the OTN network.

[0225] Optionally, the global ID of the target user branch network or user cloud VPC network includes: a MAC address or port of a target VPN gateway, and a VLAN ID of the target user branch network or user cloud VPC network.

[0226] Optionally, the target address is a target MAC address or a target IP address of a user branch network or a user cloud VPC network.

[0227] Please refer to Fig.18 The embodiment of the present invention further provides a VPN gateway 180, including:

[0228] The receiving module 181 is used to receive user data packets sent by the OTN network;

[0229] The query module 182 is used to query the VNI in the user branch network forwarding table based on the VLAN ID of the target user branch network of the user data packet and the ingress port of the user data packet, wherein the VNI is used to identify the tenant ID, and the user branch network forwarding table stores the corresponding relationship between the VNI, the global ID of the user branch network, and the OTN network resource association identifier; the global ID of the target user branch network includes: the MAC address or port of the target VPN gateway, and the VLAN ID of the target user branch network;

[0230] A determination module 183 is used to determine an ONU device in a target PON access network where the target user branch network is located according to the VNI;

[0231] The encapsulation module 184 is used to encapsulate the user data packet into a VxLAN data packet;

[0232] The sending module 185 is used to send the VxLAN data packet to the ONU device.

[0233] Optionally, determination module 183 is used to query the user branch network space information table according to the VNI, and determine the ONU device in the target PON access network where the target user branch network is located. The user branch network space information table stores the correspondence between the VNI, the VLAN ID of the user branch network, the target address and the IP address of the ONU device.

[0234] Please refer to Fig.19 The embodiment of the present invention further provides a VPN gateway 190, including:

[0235] The receiving module 191 is used to receive user data packets sent by the OTN network;

[0236] A query module 192 is used to query the global ID of the target user cloud VPC network in a matching information table of the global ID of the user branch network and the global ID of the user cloud VPC network based on the VLAN ID of the source user branch network of the user data packet, wherein the matching information table stores the corresponding relationship between the global ID of the user branch network, the VLAN ID of the user branch network and the global ID of the user cloud VPC network;

[0237] The encapsulation module 193 is used to encapsulate the user data packet based on the global ID of the target user cloud VPC network;

[0238] The sending module 194 is used to send the encapsulated user data packet to the cloud data center access device of the target user cloud VPC network.

[0239] Optionally, the global ID of the user cloud VPC network is a VNI or a VLAN ID.

[0240] Please refer to Fig. 20 The embodiment of the present invention further provides a VPN gateway 200, including:

[0241] Receiving module 201, used to receive user data packets sent by cloud data center access equipment;

[0242] An extraction module 202 is used to extract the global ID of the source user cloud VPC network from the user data packet;

[0243] The first query module 203 is used to query the VLAN ID of the target user branch network and the global ID of the target user branch network in the user branch network global ID and user cloud VPC network global ID matching information table based on the global ID of the source user cloud VPC network, wherein the matching information table stores the corresponding relationship between the global ID of the user branch network, the VLAN ID of the user branch network and the global ID of the user cloud VPC network;

[0244] A first encapsulation module 204, configured to encapsulate the user data packet based on the VLAN ID of the target user branch network;

[0245] The second query module 205 is used to query the OTN network resource association identifier in the user branch network forwarding table according to the global ID of the target user branch network, and the user branch network forwarding table stores the corresponding relationship between the VNI, the global ID of the user branch network, and the OTN network resource association identifier;

[0246] The second encapsulation module 206 is used to add the OTN network resource association identifier to the encapsulated user data packet and encapsulate the user data packet to obtain the encapsulated user data packet;

[0247] The sending module 207 is used to send the encapsulated user data packet to the OTN network.

[0248] Please refer to Fig.21The embodiment of the present invention further provides a VPN gateway 210, including a processor 211, a memory 212, and a computer program stored in the memory 212 and executable on the processor 211. When the computer program is executed by the processor 211, each process of the above-mentioned data forwarding method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it will not be described here.

[0249] The embodiment of the present invention further provides a readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, each process of the above-mentioned data forwarding method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it is not repeated here. The readable storage medium is, for example, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0250] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0251] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for enabling a terminal (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0252] The embodiments of the present invention are described above in conjunction with the accompanying drawings, but the present invention is not limited to the above-mentioned specific implementation modes, which are merely illustrative rather than restrictive. Under the guidance of the present invention, ordinary technicians in this field can also make many forms without departing from the scope of protection of the present invention and the claims, all of which are within the protection of the present invention.

Claims

1. An SD-WAN system, characterized in that: include: User branch network, PON access network, VPN gateway, OTN network and cloud data center network; in: The cloud data center network includes cloud data center access equipment and user cloud VPC network; The PON access network is connected between the user branch network and the VPN gateway; The VPN gateway includes a VPN gateway connected between the PON access network and the OTN network, and a VPN gateway connected between the cloud data center access device and the OTN network. The VPN gateway is used to maintain the global ID of the user branch network, the forwarding table between the user branch network and the user cloud VPC network, the forwarding table between the user branch networks, and the matching information table of the global ID of the user branch network and the global ID of the user cloud VPC network. According to the maintained forwarding table, the user data packet of the user branch network or the user cloud VPC network is sent to the target VPN gateway; Among them, the source VPN gateway receives a VxLAN data packet sent by the source PON access network, the VxLAN data packet carries a user data packet and a VNI, the user data packet is a data packet sent by the source user branch network to the target user branch network or the user cloud VPC network, and the VNI is used to identify the tenant ID; the VNI, the user data packet and the target address of the user data packet are extracted from the VxLAN data packet; based on the VNI and the target address, the global ID of the target user branch network or the user cloud VPC network and the OTN network resource association identifier are queried in the forwarding table between the user branch networks or the forwarding table between the user branch network and the user cloud VPC network, and the corresponding relationship between the VNI, the global ID of the target user branch network or the user cloud VPC network, and the OTN network resource association identifier is stored in the forwarding table; the OTN network resource association identifier is added to the user data packet, and the user data packet is encapsulated to obtain an encapsulated user data packet; the encapsulated user data packet is sent to the OTN network; Alternatively, the source VPN gateway receives a user data packet sent by a cloud data center device; extracts the global ID of the source user cloud VPC network from the user data packet; based on the global ID of the source user cloud VPC network, queries the VLAN ID of the target user branch network and the global ID of the target user branch network in a matching information table of the global ID of the user branch network and the global ID of the user cloud VPC network, wherein the matching information table stores a correspondence between the global ID of the user branch network, the VLAN ID of the user branch network and the global ID of the user cloud VPC network; encapsulates the user data packet based on the VLAN ID of the target user branch network; queries the OTN network resource association identifier in a forwarding table of the user branch network and the user cloud VPC network according to the global ID of the target user branch network, wherein the forwarding table of the user branch network and the user cloud VPC network stores a correspondence between the VNI, the global ID of the user branch network and the OTN network resource association identifier; adds the OTN network resource association identifier to the encapsulated user data packet, and encapsulates the user data packet to obtain an encapsulated user data packet; and sends the encapsulated user data packet to the OTN network; The cloud data center access device is connected between the user cloud VPC network and the VPN gateway; The OTN network is connected to the VPN gateway and is used to provide matching connection pipe resources for the user data packet; wherein the source OTN device of the OTN network connected to the source VPN gateway receives the encapsulated user data packet sent by the source VPN gateway, searches for the corresponding connection pipe resource according to the OTN network resource association identifier of the encapsulated user data packet, and uses the connection pipe resource to transmit the user data packet between the OTN devices; after receiving the user data packet, the target OTN device of the OTN network connected to the target VPN gateway replaces the OTN network resource association identifier of the user data packet with the VLAN ID of the target user branch network or the user cloud VPC network; the target OTN device of the OTN network sends the user data packet to the target VPN gateway; The global ID of the user branch network includes: the MAC address or port of the target VPN gateway, and the VLAN ID of the user branch network; In the forwarding table between the user branch network and the user cloud VPC network, the global ID of the user cloud VPC network includes: the MAC address or port of the target VPN gateway, and the VLAN ID of the user cloud VPC network; In the matching information table of the global ID of the user branch network and the global ID of the user cloud VPC network, the global ID of the user cloud VPC network is a VNI or a VLAN ID.

2. An SD-WAN system, characterized in that: include: User branch network, PON access network, VPN gateway and OTN network; in: The PON access network is connected between the user branch network and the VPN gateway; The VPN gateway is connected between the PON access network and the OTN network, and is used to maintain the global ID of the user branch network and the forwarding table between the user branch networks, and according to the maintained forwarding table, the user data packet of the user branch network is sent to the target VPN gateway; wherein the source VPN gateway receives the VxLAN data packet sent by the source PON access network, the VxLAN data packet carries the user data packet and the VNI, the user data packet is a data packet sent by the source user branch network to the target user branch network, and the VNI is used to identify the tenant ID; the VNI, the user data packet and the target address of the user data packet are extracted from the VxLAN data packet; based on the VNI and the target address, the global ID of the target user branch network and the OTN network resource association identifier are queried in the forwarding table between the user branch networks, and the corresponding relationship between the VNI, the global ID of the target user branch network and the OTN network resource association identifier is stored in the forwarding table; the OTN network resource association identifier is added to the user data packet, and the user data packet is encapsulated to obtain the encapsulated user data packet; the encapsulated user data packet is sent to the OTN network; The OTN network is connected to the VPN gateway and is used to provide matching connection pipe resources for the user data packet; wherein the source OTN device of the OTN network connected to the source VPN gateway receives the encapsulated user data packet sent by the source VPN gateway, searches for the corresponding connection pipe resource according to the OTN network resource association identifier of the encapsulated user data packet, and uses the connection pipe resource to transmit the user data packet between the OTN devices; after receiving the user data packet, the target OTN device of the OTN network connected to the target VPN gateway replaces the OTN network resource association identifier of the user data packet with the VLAN ID of the target user branch network; the target OTN device of the OTN network sends the user data packet to the target VPN gateway; The global ID of the user branch network includes: a MAC address or port of a target VPN gateway, and a VLAN ID of the user branch network.

3. A data forwarding method, applied to a source VPN gateway, characterized in that: include: The source VPN gateway receives a VxLAN data packet sent by a source PON access network, wherein the VxLAN data packet carries a user data packet and a VNI, wherein the user data packet is a data packet sent by a source user branch network to a target user branch network or a user cloud VPC network, and the VNI is used to identify a tenant ID; The source VPN gateway extracts the VNI, the user data packet and the target address of the user data packet from the VxLAN data packet; The source VPN gateway queries the global ID of the target user branch network or the user cloud VPC network and the OTN network resource association identifier in the forwarding table between the user branch networks or the forwarding table between the user branch network and the user cloud VPC network based on the VNI and the target address, wherein the forwarding table stores the corresponding relationship between the VNI, the global ID of the target user branch network or the user cloud VPC network, and the OTN network resource association identifier; The source VPN gateway adds the OTN network resource association identifier to the user data packet and encapsulates the user data packet to obtain an encapsulated user data packet; The source VPN gateway sends the encapsulated user data packet to the OTN network; When the source VPN gateway sends the encapsulated user data packet to the OTN device port connected to the target VPN gateway, the OTN device replaces the OTN network resource association identifier of the user data packet with the VLAN ID of the target user branch network or user cloud VPC network; The global ID of the target user branch network or user cloud VPC network includes: a MAC address or port of a target VPN gateway, and a VLAN ID of the target user branch network or user cloud VPC network.

4. The data forwarding method according to claim 3, characterized in that: The target address is a target MAC address or a target IP address of a user branch network or a user cloud VPC network.

5. A data forwarding method, applied to a target VPN gateway, characterized in that: include: The target VPN gateway receives the user data packet sent by the OTN network; The target VPN gateway queries the VNI in the forwarding table between user branch networks based on the VLAN ID of the target user branch network of the user data packet and the ingress port of the user data packet, wherein the VNI is used to identify the tenant ID, and the forwarding table between the user branch networks stores the corresponding relationship between the VNI, the global ID of the user branch network, and the OTN network resource association identifier; The global ID of the user branch network includes: the MAC address or port of the target VPN gateway, and the VLAN ID of the user branch network; The target VPN gateway determines, according to the VNI, an ONU device in a target PON access network where the target user branch network is located; The target VPN gateway encapsulates the user data packet into a VxLAN data packet; The target VPN gateway sends the VxLAN data packet to the ONU device; The target VPN gateway determines, according to the VNI, an ONU device in the target PON access network where the target user branch network is located, including: The VPN gateway queries the user branch network space information table based on the VNI to determine the ONU device in the target PON access network where the target user branch network is located. The user branch network space information table stores the correspondence between the VNI, the VLAN ID of the user branch network, the target address and the IP address of the ONU device.

6. A data forwarding method, applied to a source VPN gateway, characterized in that: include: The source VPN gateway receives a user data packet sent by a cloud data center device; The source VPN gateway extracts the global ID of the source user cloud VPC network from the user data packet; The source VPN gateway queries the VLAN ID of the target user branch network and the global ID of the target user branch network in a matching information table of the global ID of the user branch network and the global ID of the user cloud VPC network based on the global ID of the source user cloud VPC network, wherein the matching information table stores the corresponding relationship between the global ID of the user branch network, the VLAN ID of the user branch network and the global ID of the user cloud VPC network; The source VPN gateway encapsulates the user data packet based on the VLAN ID of the target user branch network; The source VPN gateway queries the OTN network resource association identifier in the forwarding table of the user branch network and the user cloud VPC network according to the global ID of the target user branch network, and the forwarding table of the user branch network and the user cloud VPC network stores the corresponding relationship between the VNI, the global ID of the user branch network, and the OTN network resource association identifier; The source VPN gateway adds the OTN network resource association identifier to the encapsulated user data packet, and encapsulates the user data packet to obtain the encapsulated user data packet; The source VPN gateway sends the encapsulated user data packet to the OTN network; The global ID of the user branch network includes: the MAC address or port of the target VPN gateway, and the VLAN ID of the user branch network; In the matching information table of the global ID of the user branch network and the global ID of the user cloud VPC network, the global ID of the user cloud VPC network is a VNI or a VLAN ID.

7. A source VPN gateway, characterized in that: include: A receiving module, used to receive a VxLAN data packet sent by a source PON access network, wherein the VxLAN data packet carries a user data packet and a VNI, wherein the user data packet is a data packet sent by a source user branch network to a target user branch network or a user cloud VPC network, and the VNI is used to identify a tenant ID; An extraction module, used to extract the VNI, the user data packet and the target address of the user data packet from the VxLAN data packet; A query module, used to query the global ID of the target user branch network or the user cloud VPC network and the OTN network resource association identifier in the forwarding table between the user branch networks or the forwarding table between the user branch network and the user cloud VPC network based on the VNI and the target address, wherein the forwarding table stores the corresponding relationship between the VNI, the global ID of the target user branch network or the user cloud VPC network, and the OTN network resource association identifier; An encapsulation module, used for adding the OTN network resource association identifier to the user data packet and encapsulating the user data packet to obtain an encapsulated user data packet; A sending module, used to send the encapsulated user data packet to the OTN network; The global ID of the target user branch network or user cloud VPC network includes: a MAC address or port of a target VPN gateway, and a VLAN ID of the target user branch network or user cloud VPC network.

8. A target VPN gateway, characterized in that: include: A receiving module is used to receive user data packets sent by the OTN network; A query module, used to query the VNI in the forwarding table between user branch networks based on the VLAN ID of the target user branch network of the user data packet and the ingress port of the user data packet, wherein the VNI is used to identify the tenant ID, and the forwarding table between the user branch networks stores the corresponding relationship between the VNI, the global ID of the user branch network, and the OTN network resource association identifier; The global ID of the user branch network includes: the MAC address or port of the target VPN gateway, and the VLAN ID of the user branch network; A determination module is used to query the user branch network space information table according to the VNI to determine the ONU device in the target PON access network where the target user branch network is located, wherein the user branch network space information table stores the correspondence between the VNI, the VLAN ID of the user branch network, the target address and the IP address of the ONU device; An encapsulation module, used for encapsulating the user data packet into a VxLAN data packet; A sending module is used to send the VxLAN data packet to the ONU device.

9. A VPN gateway, characterized in that: include: A receiving module, used to receive user data packets sent by a cloud data center access device; An extraction module, used to extract the global ID of the source user cloud VPC network from the user data packet; A first query module is used to query the VLAN ID of the target user branch network and the global ID of the target user branch network in a matching information table of the global ID of the user branch network and the global ID of the user cloud VPC network based on the global ID of the source user cloud VPC network, wherein the matching information table stores the corresponding relationship between the global ID of the user branch network, the VLAN ID of the user branch network and the global ID of the user cloud VPC network; A first encapsulation module, used for encapsulating the user data packet based on the VLAN ID of the target user branch network; A second query module is used to query the OTN network resource association identifier in the user branch network forwarding table according to the global ID of the target user branch network, wherein the user branch network forwarding table stores the corresponding relationship between the VNI, the global ID of the user branch network, and the OTN network resource association identifier; A second encapsulation module is used to add the OTN network resource association identifier to the encapsulated user data packet and encapsulate the user data packet to obtain an encapsulated user data packet; A sending module, used to send the encapsulated user data packets to the OTN network; The global ID of the user branch network includes: the MAC address or port of the target VPN gateway, and the VLAN ID of the user branch network; In the matching information table of the global ID of the user branch network and the global ID of the user cloud VPC network, the global ID of the user cloud VPC network is a VNI or a VLAN ID.

10. A VPN gateway, characterized in that: include: A processor, a memory, and a program stored in the memory and executable on the processor, wherein the program, when executed by the processor, implements the steps of the data forwarding method as described in claim 3 or 4; or, when executed by the processor, the program, when executed by the processor, implements the steps of the data forwarding method as described in claim 5; or, when executed by the processor, the program, when executed by the processor, implements the steps of the data forwarding method as described in claim 6.

11. A readable storage medium, characterized in that: The readable storage medium stores a computer program, and when the computer program is executed by the processor, it implements the steps of the data forwarding method as described in claim 3 or 4; or, when the computer program is executed by the processor, it implements the steps of the data forwarding method as described in claim 5; or, when the computer program is executed by the processor, it implements the steps of the data forwarding method as described in claim 6.

Images