Method, apparatus and device for establishing an IPSec connection and storage medium

Abstract

The application provides an IPSec connection establishment method and device, equipment and a storage medium. The method is applied to any one of an inner network gateway and an outer network gateway, and is used for establishing an IPSec connection between the any one and the other one of the inner network gateway and the outer network gateway. A firewall is arranged between the inner network gateway and the outer network gateway. The method comprises the following steps: detecting whether a first NAT mapping exists on the firewall in the process of initiating an IPSec connection request to the other one; in the case that the detection result indicates that the first NAT mapping exists on the firewall, configuring source address information in the IPSec connection request to be different from corresponding address information of the any one in a matching condition of the first NAT mapping; and establishing the IPSec connection with the other one through the IPSec connection request, so that the firewall establishes a second NAT mapping according to the IPSec connection request.

Description

Technical Field

[0001] One or more embodiments of this application relate to the field of communications, and more particularly to a method, apparatus, device and storage medium for establishing an IPSec connection. Background Technology

[0002] IPSec (IP Security) is an encryption protocol operating at Layer 3 of the OSI (Open Systems Interconnection Reference Model) framework. It provides high-quality, cryptographically-based security guarantees for data transmitted over the Internet and is a security technology for implementing Layer 3 VPNs (Virtual Private Networks). IPSec establishes a secure IPSec tunnel between communicating parties, and then encrypts and verifies data flowing through the IPSec tunnel using security protocols, thereby enabling the secure transmission of specified data over the Internet.

[0003] Generally, communication between different local area networks (LANs) requires establishing an IPSec connection to ensure the confidentiality of business traffic over the external network. Due to the scarcity of external network addresses, a NAT (Network Address Translation) policy needs to be configured on the egress firewall.

[0004] Currently, to ensure normal business access, firewalls need to be configured with both source NAT and destination NAT policies. Source NAT is used to translate the address of traffic accessing the external network from the internal network, converting the internal network source address to an external network address. Destination NAT is used to map an external network address to a specific internal network address. When network instability or other reasons cause IPSec connections to be lost, conflicts can arise between sessions where the external gateway actively accesses the internal gateway and vice versa. This can result in one party's IPSec connection failing to be established, or both parties' IPSec connections failing to be established. Summary of the Invention

[0005] This application provides a method, apparatus, device, and storage medium for establishing an IPSec connection to address the shortcomings of related technologies.

[0006] According to a first aspect of one or more embodiments of this application, a method for establishing an IPSec connection is provided, the method being applied to any one of an internal network gateway and an external network gateway, for establishing the IPSec connection between the any one gateway and another of the internal network gateway and the external network gateway, wherein a firewall is provided between the internal network gateway and the external network gateway, the method comprising:

[0007] During the process of initiating an IPSec connection request to the other gateway, it is detected whether there is a first NAT mapping on the firewall, wherein the matching condition of the first NAT mapping is: the source address information of the message received by the firewall matches the address information of the internal network gateway and the destination address information matches the address information of the external network gateway.

[0008] If the detection result indicates that the first NAT mapping exists on the firewall, the source address information in the IPSec connection request is configured to be different from the address information corresponding to any gateway in the matching conditions of the first NAT mapping;

[0009] The IPSec connection request establishes an IPSec connection with the other gateway, so that the firewall establishes a second NAT mapping based on the IPSec connection request.

[0010] According to a second aspect of one or more embodiments of this application, an IPSec connection establishment apparatus is provided. The apparatus is applied to any one of an internal network gateway and an external network gateway to establish the IPSec connection between the any one gateway and another of the internal network gateway and the external network gateway, wherein a firewall is provided between the internal network gateway and the external network gateway. The apparatus includes:

[0011] The detection module is used to detect whether a first NAT mapping exists on the firewall during the process of initiating an IPSec connection request to the other gateway, wherein the matching condition of the first NAT mapping is: the source address information of the message received by the firewall matches the address information of the internal network gateway and the destination address information matches the address information of the external network gateway.

[0012] The configuration module is used to configure the source address information in the IPSec connection request to be different from the address information corresponding to the matching conditions of the first NAT mapping of any gateway when the detection result shows that the first NAT mapping exists on the firewall.

[0013] A connection establishment module is used to establish an IPSec connection with the other gateway through the IPSec connection request, so that the firewall establishes a second NAT mapping according to the IPSec connection request.

[0014] According to a third aspect of one or more embodiments of this application, an electronic device is provided, comprising:

[0015] processor;

[0016] Memory used to store processor-executable instructions;

[0017] The processor executes the executable instructions to implement the method described in the first aspect above.

[0018] According to a fourth aspect of one or more embodiments of this application, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the steps of the method described in the embodiments of the first aspect above.

[0019] As can be seen from the above technical solutions, in one or more embodiments of this application, when any gateway initiates an IPSec connection request to another gateway, if a first NAT mapping is detected on the firewall, the source address information in the IPSec connection request is configured to be different from the address information corresponding to the first NAT mapping matching condition of any gateway, thereby avoiding session conflicts and enabling any gateway to successfully establish an IPSec connection with another gateway.

[0020] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and do not limit this application. Attached Figure Description

[0021] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0022] Figure 1 This is a schematic diagram illustrating communication between an intranet and an extranet, provided as an exemplary embodiment.

[0023] Figure 2 This is a flowchart of an exemplary embodiment of a method for establishing an IPSec connection.

[0024] Figure 3a This is a schematic diagram illustrating a preset correspondence between gateway IP addresses and port information, provided in an exemplary embodiment.

[0025] Figure 3b This is a schematic diagram illustrating a preset correspondence between gateway IP addresses and port information, provided by another exemplary embodiment.

[0026] Figure 4 This is a schematic diagram of a linked list data structure provided in an exemplary embodiment.

[0027] Figure 5 This is a schematic diagram illustrating the structure of an electronic device in an exemplary embodiment.

[0028] Figure 6 This is a block diagram illustrating an IPSec connection establishment apparatus as an exemplary embodiment. Detailed Implementation

[0029] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0030] It should be noted that the steps of the corresponding methods in other embodiments are not necessarily performed in the order shown and described in this application. In some other embodiments, the methods may include more or fewer steps than those described in this application. Furthermore, a single step described in this application may be broken down into multiple steps in other embodiments; and multiple steps described in this application may be combined into a single step in other embodiments.

[0031] Generally, communication between different local area networks requires the establishment of an IPSec connection to ensure the confidentiality of business traffic on the external network. Figure 1 This is a schematic diagram illustrating communication between an intranet and an extranet, provided as an exemplary embodiment. For example... Figure 1 As shown, VPN Gateway 1 is the external network gateway with an external IP address (IP1). VPN Gateway 2 is the internal network gateway with an internal IP address (IP3). A firewall is configured between the internal and external network gateways, and the firewall has an external IP address (IP2). To enable VPN Gateway 1 to initiate IPSec connections with VPN Gateway 2, an external IP address mapping needs to be configured on the firewall, mapping IP2 to the internal IP address (IP3). To enable VPN Gateway 2 to initiate IPSec connections with VPN Gateway 1, a source NAT policy needs to be configured on the firewall, mapping the internal IP address (IP3) to the external IP address (IP2). During source NAT translation, source port translation is typically performed simultaneously to ensure that the translated source IP address and source port do not conflict. During destination NAT translation, generally only the IP address is changed, without changing the port, to ensure consistency between the mapped and unmapped ports.

[0032] According to the IPSec negotiation protocol, both ends of the IPSec endpoint should have ports 500 and 4500 open to receive negotiation messages. The protocol also specifies that these two ports should be used for communication. Figure 1 When VPN Gateway 2 initiates an IPSec connection request to VPN Gateway 1, it will establish forward and reverse sessions on the firewall as shown in Table 1:

[0033] Forward session: Source IP3:port 500 → Destination IP1:port 500 Reverse session: Source IP1:port 500 → Destination IP2:port X

[0034] Table 1

[0035] The port X for the reverse session is because the source NAT policy is configured on the firewall, and port X is the port mapped during source NAT translation.

[0036] If VPN Gateway 1 happens to initiate an IPSec connection request to VPN Gateway 2 at this time, then a forward session and a reverse session will be established on the firewall as shown in Table 2:

[0037] Forward session: Source IP1:port 500 → Destination IP2:port 500 Reverse session: Source IP3:port 500 → Destination IP1:port 500

[0038] Table 2

[0039] In Table 2, when VPN Gateway 1 initiates an IPSec connection request, VPN Gateway 1 cannot know the internal network address of VPN Gateway 2. VPN Gateway 1 only knows the external network address IP2 of the firewall. Therefore, the destination IP of the forward session on the firewall is the external network IP2. After the business traffic reaches the firewall, it will be mapped to the internal network address IP3 of VPN Gateway 2 through destination NAT mapping.

[0040] As shown in Tables 1 and 2, the five-tuples of the forward session in Table 1 and the reverse session in Table 2 are consistent. Since there are both source NAT mapping and destination NAT mapping on the firewall, when the firewall receives the message source IP3:port 500→destination IP1:port 500, a session conflict will occur, causing the firewall to forward abnormally and drop the negotiation message, thus preventing the IPSec connection from being established. This problem usually occurs after network instability causes the IPSec connection to be disconnected. In this scenario, three situations may occur: (1) If the internal VPN gateway 2 initiates an IPSec connection request to the VPN gateway 1 first, then the IPSec connection initiated by the VPN gateway 2 to the VPN gateway 1 can be established, while the IPSec connection initiated by the VPN gateway 1 cannot be established. (2) If the external VPN gateway 1 initiates an IPSec connection request to the VPN gateway 2 first, then the IPSec connection initiated by the VPN gateway 1 to the VPN gateway 2 can be established, while the IPSec connection initiated by the VPN gateway 2 cannot be established. (3) If both external VPN gateway 1 and internal VPN gateway 2 initiate IPSec connection requests at the same time, it is possible that neither of the IPSec connections initiated by them will be able to be established.

[0041] This application provides a method for establishing an IPSec connection, which can effectively avoid session conflicts on firewalls and enable any gateway to successfully establish an IPSec connection with another gateway.

[0042] Figure 2This is a flowchart illustrating an exemplary embodiment of a method for establishing an IPSec connection. This method can be applied to either an internal network gateway or an external network gateway to establish an IPSec connection between any gateway and another gateway between the internal and external networks. A firewall is configured between the internal and external network gateways. Figure 2 As shown, the method may include the following steps:

[0043] S201: During the process of initiating an IPSec connection request to the other gateway, detect whether there is a first NAT mapping on the firewall, wherein the matching condition of the first NAT mapping is: the source address information of the message received by the firewall matches the address information of the internal network gateway and the destination address information matches the address information of the external network gateway.

[0044] The establishment of an IPSec VPN tunnel consists of two phases: the first phase involves IKE negotiation and authentication, and the second phase involves IPSec SA negotiation. When either the internal or external gateway initiates an IPSec connection request to the other gateway, the presence of a first NAT mapping can be detected through the packets generated during the IKE negotiation and authentication phase.

[0045] Combination Figure 1 In the illustrated embodiment, VPN gateway 2 is used as one gateway, and VPN gateway 1 is used as the other gateway. When VPN gateway 2 initiates an IPSec connection to VPN gateway 1, it needs to first check whether a first NAT mapping exists on the firewall. In this embodiment, the matching condition for the first NAT mapping is: the source address information of the message received on the firewall matches the address information of VPN gateway 2, and the destination address information matches the address information of VPN gateway 1. In other words, the matching condition for the first NAT mapping is: the message received on the firewall is source IP3:port 500 → destination IP1:port 500.

[0046] If no source IP3:port 500 → destination IP1:port 500 message is detected on the firewall, it means that there is no first NAT mapping on the firewall. In this case, VPN Gateway 2 can directly create the forward and reverse sessions as shown in Table 1 through port 500, thereby establishing an IPSec connection with VPN Gateway 1. When the source IP3:port 500 → destination IP1:port 500 message is detected on the firewall, it means that there is a first NAT mapping on the firewall.

[0047] S202: If the detection result indicates that the first NAT mapping exists on the firewall, configure the source address information in the IPSec connection request to be different from the address information corresponding to any gateway in the matching conditions of the first NAT mapping.

[0048] Combination Figure 1 In the illustrated embodiment, when external VPN gateway 1 initiates an IPSec connection request to VPN gateway 2, a reverse session is created on the firewall: Source IP3: Port 500 → Destination IP1: Port 500. At this time, when VPN gateway 2 initiates an IPSec connection to VPN gateway 1, it detects the existence of a first NAT mapping on the firewall. To avoid session conflicts, the source address information in the IPSec connection request initiated by either gateway needs to be reconfigured. The source address information includes the source IP address and source port information.

[0049] In one embodiment, the source port information in the IPSec connection request can be configured to be different from the corresponding port information of any gateway in the matching conditions of the first NAT mapping.

[0050] In the above embodiments, external VPN gateway 1 first initiates an IPSec connection request to VPN gateway 2, creating forward and reverse sessions on the firewall as shown in Table 2. At this time, VPN gateway 2 initiates an IPSec connection request to VPN gateway 1, detecting a message on the firewall: Source IP3: Port 500 → Destination IP1: Port 500. Since the port information corresponding to the matching condition in the first NAT mapping of VPN gateway 2 is port 500, configuring the source port information in the IPSec connection request to be different from port 500 can successfully avoid session conflicts. For example, the source port information can be configured to port Y. At this time, forward and reverse sessions can be created on the firewall as shown in Table 3:

[0051] Forward session: Source IP3:port Y → Destination IP1:port 500 Reverse session: Source IP1:port 500 → Destination IP2:port Z

[0052] Table 3

[0053] The port Z in Table 3 for the reverse session is because a source NAT policy is configured on the firewall; port Z is the port mapped during source NAT translation. As shown in Table 3, the forward session in Table 3 is different from the reverse session (source IP3: port 500 → destination IP1: port 500) created by VPN Gateway 1 actively accessing VPN Gateway 2 in Table 2. This avoids session conflicts, allowing the IPSec connection initiated by VPN Gateway 2 to VPN Gateway 1 to be successfully established.

[0054] In one embodiment, VPN gateway 2 first initiates an IPSec connection request to VPN gateway 1, creating forward and reverse sessions on the firewall as shown in Table 1. Then, VPN gateway 1 initiates an IPSec connection request to VPN gateway 2, detecting a message on the firewall: Source IP3: Port 500 → Destination IP1: Port 500. Since the port information corresponding to the matching condition in the first NAT mapping of VPN gateway 1 is port 500, configuring the source port information in the IPSec connection request to be different from port 500 can successfully avoid session conflicts. For example, the source port information can be configured to port P. At this time, the IPSec connection request initiated by VPN gateway 1 can create forward and reverse sessions on the firewall as shown in Table 4.

[0055] Forward session: Source IP1:port P → Destination IP2:port P Reverse session: Source IP3:port P → Destination IP1:port P

[0056] Table 4

[0057] Table 4 shows the destination NAT mapping, which generally only changes the IP address and not the port. As shown in Table 4, the reverse session in Table 4 is different from the forward session (source IP3: port 500 → destination IP1: port 500) created by VPN gateway 2 actively accessing VPN gateway 1 in Table 1. This avoids session conflicts, thus enabling the IPSec connection initiated by VPN gateway 1 to VPN gateway 2 to be successfully established.

[0058] In one embodiment, a pre-defined mapping between gateway IP addresses and port information can be established. When any gateway initiates an IPSec connection request to another gateway, if a first NAT mapping is detected on the firewall, the port information corresponding to the other gateway is queried based on the pre-defined mapping between gateway IP addresses and port information. Then, the source port information in the IPSec connection request is configured with the queried port information.

[0059] Figure 3a This is a schematic diagram illustrating a preset mapping relationship between gateway IP addresses and port information, provided in an exemplary embodiment. For example... Figure 3a As shown, there is a one-to-one correspondence between the IP addresses and port information of each gateway. For example, when any gateway wants to initiate an IPSec connection request to the gateway with IP address 4, if a first NAT mapping is detected on the firewall, the source port information of the IPSec connection request can be configured to port D by querying the correspondence between IP address 4 and port D, thus avoiding session conflicts and establishing an IPSec connection through port D. By pre-setting a one-to-one correspondence between each gateway IP address and port information, the utilization of port resources can be maximized, and port resource conflicts can be avoided.

[0060] Figure 3b This is a schematic diagram illustrating a preset mapping relationship between gateway IP addresses and port information, provided by another exemplary embodiment. For example... Figure 3b As shown, all gateway IP addresses correspond to the same port information, E. In this case, when any gateway initiates an IPSec connection request to any of the four gateways with IP addresses 5, 6, 7, or 8, if a first NAT mapping is detected on the firewall, the source port information of the IPSec connection request can be configured to port information of port E to avoid session conflicts, thereby establishing an IPSec connection through port E. By pre-setting each gateway IP address to the same port information, the source port information in the IPSec connection request can be directly configured to this port information when a first NAT mapping is detected on the firewall, reducing query time and improving the overall efficiency of IPSec connection establishment.

[0061] The specific mapping between a network IP address and a port can be configured by those skilled in the art according to actual business needs, and this application does not impose any restrictions on this. In addition, besides setting the mapping between gateway IP address and port information, the mapping can also be set between authentication method (digital certificate or shared key, etc.), key information, encryption strategy or encryption algorithm, etc., and the port information can be selected according to the mapping.

[0062] In one embodiment, a port resource pool with multiple ports can be preset. When any gateway initiates an IPSec connection request to another gateway, if a first NAT mapping is detected on the firewall, the source port information in the IPSec connection request is configured to the port information of any unused port in the preset port resource pool to avoid session conflicts, thereby realizing the establishment of an IPSec connection.

[0063] In one embodiment, each port in the preset port resource pool can be stored in the form of a linked list. Figure 4 This is a schematic diagram of a linked list data structure provided in an exemplary embodiment. For example... Figure 4 As shown, the linked list contains port information for each port and the last time each port was used. When searching for an unused port in the linked list, a port that meets preset conditions must be found. If a port does not meet the preset conditions, the search continues sequentially to the next port pointed to by the linked list pointer, thus achieving an ordered and fast port search. This continues until a port that meets the preset conditions is found, and the source port information in the IPSec connection request is configured to the port information of that port that meets the preset conditions.

[0064] Since recently used or released ports leave residual sessions on the firewall, affecting current IPSec connection requests, a preset condition can be set: the time interval between the last time a port was used and the current time is greater than a preset time interval. This avoids situations where the port has just been used or released. For example, setting the preset time interval to 120 seconds means that the port meets the preset condition if the time interval between the last time a port was used and the current time is greater than 120 seconds. Furthermore, if the time interval between the last time a port was used and the current time for all ports in the port resource pool is less than 120 seconds, the source port information in the IPSec connection request will be configured to use the port information of the port with the longer time interval to minimize the impact of residual sessions.

[0065] In one embodiment, used ports and unused ports in a preset port resource pool can be stored in the form of linked lists. When querying unused ports in the port resource pool, the query can be performed directly in the unused port linked list, which greatly reduces the query time and improves the overall efficiency of IPSec connection establishment.

[0066] When any used port is released, it is removed from the used port list and added to the unused port list. Simultaneously, the last used time of the released port is updated to the current release time. Similarly, if the source port information in the IPSec connection request is configured to be that of any unused port, the unused port is removed from the unused port list and added to the used port list. This process achieves real-time updates to both the unused and used port lists, ensuring that the unused port list contains only unused ports, thus improving the efficiency of unused port lookup.

[0067] The above configuration method for the source port information in IPSec connection requests applies not only to situations where a first NAT mapping exists on the firewall, but also to scenarios where one gateway sends multiple (e.g., 3) IPSec requests to another gateway, and the other gateway still does not respond to the IPSec requests. In this scenario, session conflicts caused by NAT may occur. Therefore, the same configuration method for the source port information in IPSec connection requests can be used to establish an IPSec connection between two gateways.

[0068] S203: Establish an IPSec connection with the other gateway through the IPSec connection request, so that the firewall establishes a second NAT mapping according to the IPSec connection request.

[0069] Any gateway can successfully establish an IPSec connection with another gateway through an IPSec connection request with reconfigured source address information, and the firewall can establish a second NAT mapping based on this IPSec connection request. Referring to Table 3, port Z is the port obtained based on the second NAT mapping.

[0070] Corresponding to the aforementioned embodiments of the IPSec connection establishment method, this application also provides an embodiment of an IPSec connection establishment apparatus.

[0071] Figure 5 This is a schematic diagram illustrating the structure of an electronic device according to an exemplary embodiment of this application. (Reference) Figure 5 At the hardware level, the electronic device includes a processor 502, an internal bus 504, a network interface 506, memory 508, and non-volatile memory 510, and may also include other hardware required for business operations. The processor 502 reads the corresponding computer program from the non-volatile memory 510 into memory 508 and then runs it. Of course, in addition to software implementation, this application does not exclude other implementation methods, such as logic devices or a combination of hardware and software, etc. That is to say, the execution subject of the following processing flow is not limited to individual logic units, but can also be hardware or logic devices.

[0072] Figure 6 This is a block diagram illustrating an IPSec connection establishment apparatus according to an exemplary embodiment. The apparatus is applied to either an internal network gateway or an external network gateway to establish an IPSec connection between that gateway and the other of the internal and external network gateways, wherein a firewall is provided between the internal and external network gateways. (Refer to...) Figure 6 The device includes a detection module 602, a configuration module 604, and a connection establishment module 606, wherein:

[0073] The detection module 602 is configured to detect whether a first NAT mapping exists on the firewall during the process of initiating an IPSec connection request to the other gateway, wherein the matching condition of the first NAT mapping is: the source address information of the message received by the firewall matches the address information of the internal network gateway and the destination address information matches the address information of the external network gateway.

[0074] Configuration module 604 is configured to, when the detection result indicates that the first NAT mapping exists on the firewall, configure the source address information in the IPSec connection request to be different from the address information corresponding to any gateway in the matching conditions of the first NAT mapping.

[0075] Connection establishment module 606 is configured to establish an IPSec connection with the other gateway through the IPSec connection request, so that the firewall establishes a second NAT mapping based on the IPSec connection request.

[0076] Optionally, the configuration module 604 is specifically used to: configure the source port information in the IPSec connection request to be different from the corresponding port information of any gateway in the matching conditions of the first NAT mapping.

[0077] Optionally, the configuration module 604 is specifically used to: query the port information corresponding to the other gateway based on the preset correspondence between gateway IP addresses and port information; and configure the source port information in the IPSec connection request to the queried port information.

[0078] Optionally, in the preset correspondence between gateway IP addresses and port information, each gateway IP address and port information corresponds one-to-one, or all gateway IP addresses correspond to the same port information.

[0079] Optionally, the configuration module 604 is specifically used to: configure the source port information in the IPSec connection request as the port information of any unused port in a preset port resource pool; the preset port resource pool contains at least two ports.

[0080] Optionally, each port in the preset port resource pool is stored in the form of a linked list, which contains port information of each port in the preset port resource pool and the last time each port was used; the configuration module 604 is specifically used to: query the port in the linked list that meets preset conditions, the preset conditions including: the time interval between the last time the port was used and the current time is greater than a preset time interval; and configure the source port information in the IPSec connection request as the port information of the queried port.

[0081] Optionally, the linked list includes a used port linked list and an unused port linked list, and the device further includes:

[0082] The update module 608 is configured to, when the source port information in the IPSec connection request is configured as the port information of any unused port, remove the unused port from the unused port list and add the unused port to the used port list; when any used port is released, remove the released port from the used port list and add the released port to the unused port list, and update the last used time of the released port to the current released time.

[0083] The specific implementation process of the functions and roles of each unit in the above device can be found in the implementation process of the corresponding steps in the above method, and will not be repeated here.

[0084] The apparatus or unit described in the above embodiments can be implemented by a computer chip or physical entity, or by a product with a certain function. A typical implementation device is a computer, which can be a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email sending and receiving device, game console, tablet computer, wearable device, or any combination of these devices.

[0085] In a typical configuration, a computer includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0086] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0087] Computer-readable media, including both permanent and non-permanent, removable and non-removable media, can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, disk storage, quantum memory, graphene-based storage media or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0088] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A method for establishing an IPSec connection, characterized in that, The method is applied to either an internal network gateway or an external network gateway to establish an IPSec connection between the either gateway and another gateway among the internal and external network gateways, wherein a firewall is provided between the internal network gateway and the external network gateway. The method includes: During the process of initiating an IPSec connection request to the other gateway, it is detected whether there is a first NAT mapping on the firewall, wherein the matching condition of the first NAT mapping is: the source address information of the message received by the firewall matches the address information of the internal network gateway and the destination address information matches the address information of the external network gateway. If the detection result indicates that the first NAT mapping exists on the firewall, the source address information in the IPSec connection request is configured to be different from the address information corresponding to any gateway in the matching condition of the first NAT mapping; wherein if the detection result indicates that the first NAT mapping does not exist on the firewall, there is no need to modify the source address information in the IPSec connection request. The IPSec connection request establishes an IPSec connection with the other gateway, so that the firewall establishes a second NAT mapping based on the IPSec connection request.

2. The method according to claim 1, characterized in that, The step of configuring the source address information in the IPSec connection request to be different from the address information corresponding to any gateway in the matching conditions of the first NAT mapping includes: Configure the source port information in the IPSec connection request to be different from the corresponding port information of any gateway in the matching conditions of the first NAT mapping.

3. The method according to claim 2, characterized in that, The step of configuring the source port information in the IPSec connection request to be different from the corresponding port information of any gateway in the matching conditions of the first NAT mapping includes: Based on the preset correspondence between gateway IP addresses and port information, query the port information corresponding to the gateway IP address of the other gateway; Configure the source port information in the IPSec connection request to the queried port information.

4. The method according to claim 3, characterized in that, In the preset correspondence between gateway IP addresses and port information, each gateway IP address and port information corresponds one-to-one, or all gateway IP addresses correspond to the same port information.

5. The method according to claim 2, characterized in that, The step of configuring the source port information in the IPSec connection request to be different from the corresponding port information of any gateway in the matching conditions of the first NAT mapping includes: Configure the source port information in the IPSec connection request to the port information of any unused port in the preset port resource pool; the preset port resource pool contains at least two ports.

6. The method according to claim 5, characterized in that, Each port in the preset port resource pool is stored in the form of a linked list. The linked list contains the port information of each port in the preset port resource pool, as well as the last time each port was used. The step of configuring the source port information in the IPSec connection request to the port information of any unused port in the preset port resource pool includes: Query the linked list for ports that meet preset conditions, including: the time interval between the last time the port was used and the current time is greater than a preset time interval; Configure the source port information in the IPSec connection request to the port information of the queried port.

7. The method according to claim 6, characterized in that, The linked list includes a used port linked list and an unused port linked list, and the method further includes: If the source port information in the IPSec connection request is configured as the port information of any unused port, the unused port is removed from the unused port list and added to the used port list; If any used port is released, the released port is removed from the used port list, added to the unused port list, and the last used time of the released port is updated to the current released time.

8. An IPSec connection establishment apparatus, characterized in that, The device is applied to either an internal network gateway or an external network gateway to establish an IPSec connection between the either gateway and another gateway among the internal and external network gateways, wherein a firewall is provided between the internal network gateway and the external network gateway. The device includes: The detection module is used to detect whether a first NAT mapping exists on the firewall during the process of initiating an IPSec connection request to the other gateway, wherein the matching condition of the first NAT mapping is: the source address information of the message received by the firewall matches the address information of the internal network gateway and the destination address information matches the address information of the external network gateway. The configuration module is used to configure the source address information in the IPSec connection request to be different from the address information corresponding to the matching conditions of the first NAT mapping for any gateway when the detection result indicates that the first NAT mapping exists on the firewall; wherein when the detection result indicates that the first NAT mapping does not exist on the firewall, it is not necessary to modify the source address information in the IPSec connection request. A connection establishment module is used to establish an IPSec connection with the other gateway through the IPSec connection request, so that the firewall establishes a second NAT mapping according to the IPSec connection request.

9. An electronic device, characterized in that, include: processor; Memory used to store processor-executable instructions; The processor implements the method as described in any one of claims 1-7 by executing the executable instructions.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the steps of the method as described in any one of claims 1-7.

Images