A method, device and storage medium for automatically establishing a VXLAN VTEP

Abstract

The application provides a method for automatically establishing a VTEP of a VXLAN, wherein a three-layer network switching device exists between VXLAN devices; a sending end VXLAN device fills a destination address in an Ethernet message header of a VXLAN message as a MAC address of the three-layer network switching device when sending, and sends the message to the three-layer network switching device, which then sends the message to a receiving end VXLAN device; after receiving the VXLAN message, the receiving end VXLAN device binds a source IP in the Ethernet message, a source IP of the VXLAN message and a source MAC address of the VXLAN message as the VTEP; and the receiving end VXLAN device determines a MAC address of a VXLAN tunnel node according to the MAC address in the VTEP when encapsulating the VXLAN. The application enables the VXLAN technology to be applied to any scene, and provides network security communication services for communication messages.

Description

Technical Field

[0001] This invention relates to the field of communications, and in particular to a method, device, and storage medium for automatically establishing a VXLAN VTEP based on a MAC address, enabling VXLAN technology to be applied in environments where links are not reachable. Background Technology

[0002] In the current network environment, corporate headquarters and branch offices typically improve their work efficiency and competitiveness by building a three-layer network topology. However, multicast and broadcast information is limited in this topology, making it difficult to effectively send multicast and broadcast information to various office areas within the organization. Using VXLAN technology to build a large Layer 2 network can solve this problem. However, there is a critical factor when using VXLAN to build a large Layer 2 network: the VXLAN VTEP tunnel nodes must be reachable. If there are routing or gateway devices between the VXLAN VTEP tunnel nodes, the automatic learning function of the VTEP tunnel nodes will malfunction.

[0003] At the same time, in terms of security, information transmitted by users through public or private networks may be viewed, modified, or forged at any time during transmission, which reduces the security and reliability of the information. Summary of the Invention

[0004] To address the problems existing in the prior art, a method, device, and storage medium for automatically establishing a VXLAN VTEP based on MAC address are provided. Based on VXLAN technology, the MAC address of the tunnel node is determined by binding the MAC address, ensuring that the method can be applied to any VXLAN environment.

[0005] The technical solution adopted in this invention is as follows: A method for automatically establishing a VXLAN VTEP, applied between VXLAN devices that are VXLAN tunnel nodes, and where there is a Layer 3 network switch between the VXLAN devices; when sending, the sending VXLAN device fills the destination address in the Ethernet header of the VXLAN packet with the MAC address of the Layer 3 network switch, and sends the packet to the Layer 3 network switch, which then sends it to the receiving VXLAN device; after receiving the VXLAN packet, the receiving VXLAN device binds the source IP in the Ethernet packet, the source IP in the VXLAN packet, and the source MAC address in the VXLAN packet into a VTEP; when encapsulating the VXLAN, the receiving VXLAN device determines the MAC address of the VXLAN tunnel node based on the MAC address in the VTEP.

[0006] Furthermore, the VXLAN device at the sending end is configured with the default VXLAN MAC address as the MAC address of the connected Layer 3 network switching device. When the MAC address of the receiving end VXLAN device cannot be found, the default MAC address is directly filled into the VXLAN packet.

[0007] Furthermore, all VXLAN packets transmitted between VXLAN devices are encrypted and protected using overly secure IPSec VPN technology.

[0008] Furthermore, the Layer 3 network switching device includes a router, a NAT device, and a gateway.

[0009] The present invention also provides an electronic device, including a memory and a processor, wherein the memory stores a computer program that can be loaded by the processor and executed corresponding to the above-described method for automatically establishing a VXLAN VTEP.

[0010] The present invention also provides a computer-readable storage medium having stored thereon computer program instructions, which, when executed by a processor, are used to implement the process corresponding to the above-described method for automatically establishing a VXLAN VTEP.

[0011] Compared with existing technologies, the beneficial effects of adopting the above technical solution are as follows:

[0012] 1. This invention binds VXLAN packets based on MAC addresses to form a VTEP (Virtual Virtual Equipment Provider). This allows VXLAN devices to determine the MAC address of the VXLAN tunnel node based on the MAC address in the VTEP when encapsulating VXLAN packets, eliminating the need to query the VXLAN tunnel node's MAC address within the system. It also solves the problem of existing VXLAN technologies failing to function properly in scenarios where links are unreachable.

[0013] 2. It adopts IPSec VPN secure communication technology based on the "GM / T 0022 IPSec VPN Technical Specification" to provide network security communication services for communication messages between VXLAN tunnel nodes, ensuring the security, reliability and unrecognizableness of data during transmission. Attached Figure Description

[0014] Figure 1 This is a schematic diagram of the method for automatically establishing a VXLAN VTEP based on the MAC address proposed in this invention.

[0015] Figure 2 This is a schematic diagram of VXLAN technology in a direct connection scenario.

[0016] Figure 3 This is a schematic diagram of VXLAN technology in a scenario where a Layer 2 network packet forwarding device exists.

[0017] Figure 4 This is a schematic diagram of VXLAN in a non-direct connection scenario.

[0018] Figure 5 This is a schematic diagram of secure communication in one embodiment of the present invention. Detailed Implementation

[0019] The embodiments of this application are described in detail below, examples of which are illustrated in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar modules or modules having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain this application, and should not be construed as limiting this application. Rather, the embodiments of this application include all variations, modifications, and equivalents falling within the spirit and scope of the appended claims.

[0020] Example 1

[0021] The method for automatically establishing a VXLAN VTEP based on the MAC address proposed in this embodiment is implemented based on VXLAN technology. Before introducing this method, this embodiment will first give a brief explanation of VXLAN.

[0022] Figure 2 As shown, VXLAN is a tunneling technology that establishes a Layer 2 Ethernet network tunnel on top of a Layer 3 network, thereby enabling Layer 2 interconnection across geographical regions. VXLAN uses an encapsulation format that encapsulates the original Ethernet packets within UDP packets. The original Layer 2 data frame is encapsulated together with a VXLAN header within a single UDP packet.

[0023] In the diagram, VXLAN1 and VXLAN2 are configured as VXLAN tunnel nodes for each other. When the working machine 20.1.1.1 in area A sends a message, it will be encapsulated into a VXLAN message by VXLAN1 and sent to VXLAN2. After receiving the VXLAN message, VXLAN2 will decrypt it, bind the source IP of the device in the original Ethernet message to the source IP of the VXLAN message to form a VTEP, and then send the parsed original Ethernet message to the service network.

[0024] When a VXLAN device encapsulates a VXLAN packet, it first needs to obtain the MAC address corresponding to the configured VXLAN tunnel node's IP address. If the VXLAN device only has the configured VXLAN tunnel node's IP address but the system cannot obtain the corresponding MAC address, the VXLAN device will not be able to find the VXLAN packet and will send it to the next-hop device address. The VXLAN device will not encapsulate the VXLAN packet.

[0025] like Figure 2 As shown, the VXLAN1 device and the VXLAN2 device are directly connected. The VXLAN1 device and the VXLAN2 device can obtain each other's MAC addresses, so VXLAN packets can communicate normally in this environment.

[0026] It should be noted that, as Figure 3 As shown, the VXLAN1 device and the VXLAN2 device are connected through a Layer 2 network packet forwarding device. In this scenario, the standard VTEP automatic learning function of VXLAN can also be completed normally. That is, the VXLAN1 device and the VXLAN2 device can automatically establish a VTEP. The VXLAN1 device can query the MAC address of the VXLAN2 device through the system, and the VXLAN2 device can query the MAC address of the VXLAN1 device through the system, thus completing the encapsulation of VXLAN packets.

[0027] However, as Figure 4 As shown, the VXLAN1 device and the VXLAN2 device are not directly connected. There is a NAT device or a routing device in the link between the VXLAN1 device and the VXLAN2 device. Therefore, the VXLAN1 device and the VXLAN2 device cannot obtain each other's MAC addresses, and VXLAN packets cannot communicate normally in this environment.

[0028] Based on this, this embodiment is Figure 4 The proposed method for automatically establishing VXLAN VTEPs based on MAC addresses enables VXLAN technology in non-link reachable scenarios. The specific solution is as follows:

[0029] like Figure 1 As shown, an automatic VXLAN VTEP establishment method is applied between VXLAN devices that are VXLAN tunnel nodes, and a Layer 3 network switch exists between the VXLAN devices. When sending, the sending VXLAN device fills the destination address in the Ethernet header of the VXLAN packet with the MAC address of the Layer 3 network switch and sends the packet to the Layer 3 network switch, which then sends it to the receiving VXLAN device. After receiving the VXLAN packet, the receiving VXLAN device binds the source IP address in the Ethernet packet, the source IP address in the VXLAN packet, and the source MAC address in the VXLAN packet into a VTEP. When encapsulating the VXLAN, the receiving VXLAN device determines the MAC address of the VXLAN tunnel node based on the MAC address in the VTEP.

[0030] In this embodiment, based on the VTEP established between the VXLAN tunnel node source IP and the device source IP in the original Ethernet packet, a new MAC address binding is added. Simultaneously, a default VXLAN tunnel node MAC address configuration function is added. That is, the sending VXLAN device is configured with the default VXLAN MAC address as the MAC address of the connected Layer 3 network switch. If the MAC address of the receiving VXLAN device cannot be found, the default MAC address is directly filled into the VXLAN packet. This ensures that the method is applicable to any VXLAN environment.

[0031] like Figure 5 As shown, in this embodiment, the communication between VXLAN devices adopts the national cryptographic IPSec VPN technology based on the "GM / T 0022 IPSec VPN Technical Specification" to provide network layer security protection, ensuring the security, reliability and unrecognizableness of data during transmission.

[0032] This embodiment is based on, as follows Figure 1 The scenario shown illustrates the method for automatically establishing a VXLAN VTEP based on the MAC address:

[0033] In this scenario, there are Layer 3 network switching devices between VXLAN gateways, so the VXLAN VTEP auto-learning function will not work properly. That is, VXLAN1 and VXLAN2 devices cannot automatically establish a VTEP; VXLAN1 cannot find the MAC address of VXLAN2 through the system, and VXLAN2 cannot find the MAC address of VXLAN1 through the system, thus failing to complete VXLAN packet encapsulation.

[0034] If the method proposed in this embodiment is used, VXLAN packet encapsulation and communication can be completed normally in the environment. Specifically:

[0035] VXLAN1 and VXLAN2 are configured as VXLAN tunnel nodes for each other. VXLAN1 is configured with the default VXLAN MAC address as the MAC address of the Layer 3 network switch. When VXLAN1 cannot find the MAC address of VXLAN2 during transmission, it fills the destination MAC address in the Ethernet header of the VXLAN packet with the MAC address of the Layer 3 network switch and sends the VXLAN packet to the Layer 3 network switch. The Layer 3 network switch then forwards the packet to VXLAN2 via the network. Upon receiving the VXLAN packet from VXLAN1, VXLAN2 binds the source IP address of the original Ethernet packet with the source IP address and source MAC address of the VXLAN packet to form a VTEP. Subsequently, when encapsulating VXLAN packets, VXLAN2 determines the MAC address of the VXLAN tunnel node based on the MAC address in the VTEP, without needing to query the MAC address of the VXLAN tunnel node in the system.

[0036] Meanwhile, communication between VXLAN devices uses the national cryptographic IPSec VPN technology based on the "GM / T 0022 IPSec VPN Technical Specification" to provide network layer security protection.

[0037] In this embodiment, the Layer 3 network switching device includes routers, NAT devices, and gateways.

[0038] When using the method proposed in this embodiment, if there are Layer 3 network switching devices between VXLAN devices, and the VXLAN device cannot obtain the MAC address of the VXLAN tunnel node, a default VXLAN tunnel node MAC address can be configured. When the VXLAN device cannot find the VXLAN tunnel node MAC address, the configured default VXLAN tunnel node MAC address is used, and the destination MAC address of the Ethernet header of all VXLAN packets is filled with the default VXLAN tunnel node MAC address, ensuring the normal transmission of VXLAN packets.

[0039] In practical applications, products using this method can be deployed directly at the enterprise's internal network boundary, which is simple and convenient.

[0040] This embodiment can solve the problem that existing VXLAN technology cannot function properly in scenarios where links are not reachable, enabling VXLAN technology to be applied in any scenario. At the same time, it adopts IPSec VPN secure communication technology to provide network security communication services for communication messages between VXLAN tunnel nodes, ensuring the security, reliability and unrecognizableness of data during transmission.

[0041] Example 2

[0042] This embodiment also provides an electronic device, including a memory and a processor, wherein the memory stores a computer program that can be loaded by the processor and executed to correspond to the VTEP method for automatically establishing a VXLAN as described in Embodiment 1.

[0043] Example 3

[0044] This embodiment also provides a computer-readable storage medium storing computer program instructions, which, when executed by a processor, are used to implement the process corresponding to the VTEP method for automatically establishing a VXLAN as described in Embodiment 1.

[0045] It should be noted that, in the description of the embodiments of the present invention, unless otherwise explicitly specified and limited, the terms "set" and "connection" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a direct connection or an indirect connection through an intermediate medium. Those skilled in the art can understand the specific meaning of the above terms in the present invention based on the specific circumstances. The accompanying drawings in the embodiments are used to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.

[0046] Although embodiments of this application have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting this application. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of this application.

Claims

1. A method for automatically establishing a VXLAN VTEP, characterized in that, This method is applied between VXLAN devices that are VXLAN tunnel nodes, and where there is a Layer 3 network switch between the VXLAN devices. When sending a VXLAN packet, the sending VXLAN device fills the destination address in the Ethernet header of the VXLAN packet with the MAC address of the Layer 3 network switch and sends the packet to the Layer 3 network switch. The Layer 3 network switch then sends the packet to the receiving VXLAN device. After receiving the VXLAN packet, the receiving VXLAN device binds the source IP address in the Ethernet packet, the source IP address in the VXLAN packet, and the source MAC address in the VXLAN packet into a VTEP. When encapsulating the VXLAN, the receiving VXLAN device determines the MAC address of the VXLAN tunnel node based on the MAC address in the VTEP. The VXLAN device at the sending end is configured with the default VXLAN MAC address as the MAC address of the connected Layer 3 network switching device. When the MAC address of the VXLAN tunnel node cannot be found, the default MAC address is directly filled into the VXLAN packet.

2. The method for automatically establishing a VXLAN VTEP according to claim 1, characterized in that, All VXLAN packets transmitted between VXLAN devices are encrypted and protected using overly secure IPSec VPN technology.

3. The method for automatically establishing a VXLAN VTEP according to claim 1, characterized in that, The three-layer network switching devices include routers, NAT devices, and gateways.

4. An electronic device, characterized in that, It includes a memory and a processor, wherein the memory stores a computer program that can be loaded by the processor and executed corresponding to the VTEP method for automatically establishing a VXLAN as described in any one of claims 1-3.

5. A computer-readable storage medium having computer program instructions stored thereon, characterized in that, When the program instructions are executed by the processor, they are used to implement the process corresponding to the VTEP method for automatically establishing VXLAN as described in any one of claims 1-3.

Images