Cloud service inter-visit method and system based on cloud private line, network node and medium

Abstract

The embodiment of the present application relates to the technical field of computer network, and discloses a cloud service inter-visit method and system based on cloud private line, network node and computer readable storage medium, the method comprises the following steps: encapsulating network address translation (NAT) mapping information, and sending to a firewall to make the firewall configure the NAT mapping information, wherein the NAT mapping information comprises DNAT mapping information, SNAT mapping information and PNAT mapping information; sending a virtual routing forwarding (VRF) creation request to a virtual gateway (VGW) device to make the VGW device create a VRF between the VGW device and the firewall; encapsulating a firewall configuration message, and sending to the firewall to make the firewall configure a firewall policy based on the firewall configuration message, wherein the firewall policy comprises a static route configuration policy, an access control list (ACL) rule configuration policy and a security policy configuration. Through the above method, the underlay network can be used without changing the local network planning.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of computer network technology, specifically to a method, system, network node, and computer-readable storage medium for cloud service mutual access based on cloud private lines. Background Technology

[0002] With the development of public cloud services, more and more enterprises are starting to use them, and at the same time, they are paying increasing attention to network security. The Underlay is the foundation of the entire public cloud service, while the Overlay is the business network encapsulated on top of it. The two are interconnected but can evolve independently.

[0003] Currently, network data exchange methods based on Overlay and Underlay require that the user subnet and the Underlay network be different. If the user subnet and the Underlay network conflict, the network planning must be readjusted. Summary of the Invention

[0004] In view of the above problems, embodiments of the present invention provide a cloud service interoperability method, system, network node and computer-readable storage medium based on cloud private lines, which is used to solve the problem of conflict between user subnets and underlay networks based on cloud private lines in the prior art, so as to enable the use of underlay networks without changing the local network planning.

[0005] According to one aspect of the present invention, a method for mutual access to cloud services based on a cloud private line is provided, the method comprising:

[0006] Encapsulate Network Address Translation (NAT) mapping information and send it to the firewall so that the firewall can configure the NAT mapping information. The NAT mapping information includes destination Network Address Translation (DNAT) mapping information, source Network Address Translation (SNAT) mapping information, and port address translation (PNAT) mapping information.

[0007] The VRF creation request is sent to the Virtual Gateway (VGW) device so that the VGW device can create a VRF between the VGW device and the firewall.

[0008] A firewall configuration message is encapsulated and sent to the firewall so that the firewall can configure firewall policies based on the firewall configuration message. The firewall policies include static routing configuration policies, access control list (ACL) rule configuration policies, and security policy configurations.

[0009] In one alternative approach, the network node includes a primary node and a secondary node. Before encapsulating the NAT mapping information and sending it to the firewall, the method further includes: obtaining a pre-assigned Internet Protocol (IP) address; and obtaining the address information of the underlay network.

[0010] The process of encapsulating NAT mapping information and sending it to the firewall includes: the first-level node encapsulating NAT mapping information based on the address information of the underlay network and the pre-assigned IP address, and sending the NAT mapping information to the second-level node; after receiving the NAT mapping information, the second-level node verifies the NAT mapping information; if the verification is successful, the second-level node sends the NAT mapping information to the firewall; if the verification fails, the second-level node returns an error message to the first-level node.

[0011] In one optional approach, obtaining a pre-assigned IP address includes: the primary node sending an available IP address range query request to the secondary node, the available IP address range query request including a resource pool identifier and a NAT mapping type; the secondary node searching for an available IP address range based on the resource pool identifier and the NAT mapping type, and returning it to the primary node; the primary node sending a pre-assigned IP address request to the secondary node; and the secondary node pre-assigning an IP address based on the pre-assigned IP address request, and returning the pre-assigned IP address to the primary node.

[0012] In one optional approach, obtaining the address information of the underlay network includes: the primary node sending a query request for underlay network address information to the secondary node, the query request including a user identifier and a resource pool identifier; the secondary node determining whether a user has subscribed to the underlay network based on the user identifier and resource pool identifier parameters; if it is determined that the user has subscribed to the underlay network, obtaining the address information of the underlay network and returning the address information of the underlay network to the primary node.

[0013] In one optional manner, sending the VRF creation request to the VGW device includes: the primary node sending the VRF creation request to the secondary node; the secondary node receiving the VRF creation request and verifying the parameters in the VRF creation request; if the parameter verification is successful, the secondary node sending the VRF creation request to the VGW device; if the parameter verification fails, the secondary node returning creation failure information to the primary node.

[0014] In one optional manner, the encapsulation of the firewall configuration message and its transmission to the firewall includes: the primary node sending a request to create a firewall configuration policy to the secondary node; the secondary node, upon receiving the request, verifying the parameters carried in the request; and, if the verification is successful, encapsulating the parameters carried in the request into a firewall configuration message and transmitting it to the firewall.

[0015] According to another aspect of the present invention, a cloud service access system based on a cloud private line is provided, comprising:

[0016] Network nodes are used to encapsulate NAT mapping information and send it to the firewall; send VRF creation requests to the VGW device; and encapsulate firewall configuration messages and send them to the firewall.

[0017] A firewall is used to configure NAT mapping information, which includes DNAT mapping information, SNAT mapping information, and PNAT mapping information; firewall policy configuration is performed based on the firewall configuration messages, which includes static route configuration policy, ACL rule configuration policy, and security policy configuration.

[0018] VGW devices are used to create VRFs between VGW devices and firewalls.

[0019] In an optional manner, network node 81 is also used to obtain a pre-assigned network IP address and to obtain address information of the underlay network.

[0020] Network node 81 includes primary nodes and secondary nodes;

[0021] The first-level node is used to encapsulate the address information of the underlay network and the reserved IP address to obtain NAT mapping information, and then send the NAT mapping information to the second-level node;

[0022] The secondary node is used to verify the NAT mapping information after receiving it; if the verification is successful, it sends the NAT mapping information to the firewall; if the verification fails, it returns an error message to the primary node.

[0023] In one optional manner, a first-level node is configured to send an available IP address range query request to the second-level node, the available IP address range query request including a resource pool identifier and a NAT mapping type;

[0024] The secondary node is used to find available IP address ranges based on the resource pool identifier and the NAT mapping type, and return them to the primary node.

[0025] The primary node is also used to send a request for a reserved IP address to the secondary node;

[0026] The secondary node is also used to reserve an IP address according to the reserved IP address request, and return the reserved IP address to the primary node.

[0027] In one optional approach, a first-level node is specifically used to send a request to the second-level node to query underlay network address information, the request including a user identifier and a resource pool identifier;

[0028] The secondary node is specifically used to determine whether a user has subscribed to the underlay network based on the user identifier and resource pool identifier parameters; if it is determined that the user has subscribed to the underlay network, it obtains the address information of the underlay network and returns the address information of the underlay network to the primary node.

[0029] In one alternative approach, a primary node is specifically used to send a VRF creation request to the secondary node;

[0030] The secondary node is specifically used to receive the VRF creation request, verify the parameters in the VRF creation request; if the parameter verification is successful, send the VRF creation request to the VGW device; if the parameter verification fails, return the creation failure information to the primary node.

[0031] In one alternative approach, a first-level node is specifically used to send a request to the second-level node to create a firewall configuration policy;

[0032] The secondary node is specifically used to receive the request to create a firewall configuration policy, verify the parameters carried in the request, and if the verification is successful, encapsulate the parameters carried in the request into a firewall configuration message and send it to the firewall.

[0033] In one alternative approach, the cloud service interoperability system also includes:

[0034] CPE devices are used to configure static routes to DNAT addresses;

[0035] The NPE device is used to learn the static route to the DNAT address from the CPE device.

[0036] In one alternative approach, a firewall is used to perform SNAT on user subnet addresses to resolve user address conflicts; DNAT on underlay network addresses to resolve conflicts between user addresses and underlay network addresses; and PNAT on underlay network addresses. Since user subnets access multiple underlay networks through cloud private lines, PNAT is used to map each underlay network to a different port to reduce the amount of NAT addresses used.

[0037] In an alternative approach, the firewall also creates an aggregated interface interconnecting with the VGW to enable interconnection between the VGW, the lag-x interface, and the firewall; it also creates a sub-interface interconnecting with the VGW, using the same VRF and VLAN created in the VGW, and configuring the interconnect address of the VRF created in the VGW.

[0038] The VGW device is used to create the lag-x interface, configure mac-lag and include it in VSD management, add the physical interface that interconnects the VGW and the firewall to lag-x; create a VRF between the VGW and the firewall to achieve routing isolation for different users, and assign interconnect addresses on the firewall to interconnect the VGW's lag-x interface with the firewall; create a sub-interface on the lag-x interface, use the same VRF and VLAN on the CPE side, and configure a static route to the DNAT address, with the next-hop address pointing to the firewall interconnect address.

[0039] In an alternative approach, the firewall is also used to add the sub-interfaces created on the firewall to the untrust domain and allow the security policy of the VRF; add the user subnet corresponding to the VRF to the SNAT ACL and allow access permissions for the user subnet.

[0040] In one alternative approach, the firewall is also used to configure static routes to user subnets, with the next-hop address pointing to the VGW's interconnect address, to ensure return route reachability; and to configure static routes to the actual address of the underlay service, ensuring route reachability after DNAT resolution.

[0041] According to another aspect of the present invention, a network node is provided, comprising: a processor, a memory, a communication interface, and a communication bus, wherein the processor, the memory, and the communication interface communicate with each other through the communication bus;

[0042] The memory is used to store at least one executable instruction, which causes the processor to perform the following operations:

[0043] Encapsulate Network Address Translation (NAT) mapping information and send it to the firewall so that the firewall can configure the NAT mapping information. The NAT mapping information includes destination Network Address Translation (DNAT) mapping information, source Network Address Translation (SNAT) mapping information, and port address translation (PNAT) mapping information.

[0044] A request to create a virtual route forwarding (VRF) is sent to the virtual gateway (VGW) device, so that the VGW device can create a VRF between the VGW device and the firewall.

[0045] A firewall configuration message is encapsulated and sent to the firewall so that the firewall can configure firewall policies based on the firewall configuration message. The firewall policies include static routing configuration policies, access control list (ACL) rule configuration policies, and security policy configurations.

[0046] In an alternative approach, the executable instructions cause the processor to perform the following operation: before encapsulating the NAT mapping information and sending it to the firewall, the method further includes:

[0047] Obtain a pre-reserved Internet Protocol (IP) address;

[0048] Obtain the address information of the underlay network;

[0049] The encapsulation of NAT mapping information and its transmission to the firewall includes:

[0050] The first-level node encapsulates the address information of the underlay network and the reserved IP address to obtain NAT mapping information, and sends the NAT mapping information to the second-level node;

[0051] After receiving the NAT mapping information, the secondary node verifies the NAT mapping information.

[0052] If the verification is successful, the secondary node will send the NAT mapping information to the firewall;

[0053] In the event of a verification failure, the secondary node returns an error message to the primary node.

[0054] In an alternative approach, the executable instructions cause the processor to perform the following operations:

[0055] Obtaining a pre-reserved IP address includes:

[0056] The first-level node sends an available IP address range query request to the second-level node. The available IP address range query request includes the resource pool identifier and the NAT mapping type.

[0057] The secondary node searches for available IP address ranges based on the resource pool identifier and the NAT mapping type, and returns the results to the primary node.

[0058] The first-level node sends a request to the second-level node to reserve an IP address;

[0059] The secondary node reserves an IP address based on the reserved IP address request and returns the reserved IP address to the primary node.

[0060] In an alternative approach, the executable instructions cause the processor to perform the following operations:

[0061] The process of obtaining the address information of the underlay network includes:

[0062] The primary node sends a request to the secondary node to query the underlay network address information. The request to query the underlay network address information includes the user identifier and the resource pool identifier.

[0063] The secondary node determines whether the user has subscribed to the underlay network based on the user identifier and resource pool identifier parameters.

[0064] If it is determined that the user has subscribed to the underlay network, the address information of the underlay network is obtained and returned to the primary node.

[0065] In an alternative approach, the executable instructions cause the processor to perform the following operations:

[0066] Sending the VRF creation request to the VGW device includes:

[0067] The primary node sends a VRF creation request to the secondary node;

[0068] After receiving the VRF creation request, the secondary node verifies the parameters in the VRF creation request.

[0069] If the parameter verification is successful, the secondary node will send the VRF creation request to the VGW device;

[0070] If parameter verification fails, the secondary node will return a creation failure message to the primary node.

[0071] In an alternative approach, the executable instructions cause the processor to perform the following operations:

[0072] The encapsulation of the firewall configuration message and its subsequent transmission to the firewall include:

[0073] The primary node sends a request to the secondary node to create a firewall configuration policy;

[0074] After receiving the request to create a firewall configuration policy, the secondary node verifies the parameters carried in the request.

[0075] If the verification is successful, the secondary node encapsulates the parameters carried in the request to create a firewall configuration policy into a firewall configuration message and sends it to the firewall.

[0076] According to another aspect of the present invention, a computer-readable storage medium is provided, the storage medium storing at least one executable instruction that causes a network node to perform the following operations:

[0077] Encapsulate Network Address Translation (NAT) mapping information and send it to the firewall so that the firewall can configure the NAT mapping information. The NAT mapping information includes destination Network Address Translation (DNAT) mapping information, source Network Address Translation (SNAT) mapping information, and port address translation (PNAT) mapping information.

[0078] A request to create a virtual route forwarding (VRF) is sent to the virtual gateway (VGW) device, so that the VGW device can create a VRF between the VGW device and the firewall.

[0079] A firewall configuration message is encapsulated and sent to the firewall so that the firewall can configure firewall policies based on the firewall configuration message. The firewall policies include static routing configuration policies, access control list (ACL) rule configuration policies, and security policy configurations.

[0080] In an alternative embodiment, the executable instructions cause the network node to perform the following operation: before encapsulating the NAT mapping information and sending it to the firewall, the method further includes:

[0081] Obtain a pre-reserved Internet Protocol (IP) address;

[0082] Obtain the address information of the underlay network;

[0083] The encapsulation of NAT mapping information and its transmission to the firewall includes:

[0084] The first-level node encapsulates the address information of the underlay network and the reserved IP address to obtain NAT mapping information, and sends the NAT mapping information to the second-level node;

[0085] After receiving the NAT mapping information, the secondary node verifies the NAT mapping information.

[0086] If the verification is successful, the secondary node will send the NAT mapping information to the firewall;

[0087] In the event of a verification failure, the secondary node returns an error message to the primary node.

[0088] In an alternative approach, the executable instructions cause the network node to perform the following operations:

[0089] Obtaining a pre-reserved IP address includes:

[0090] The first-level node sends an available IP address range query request to the second-level node. The available IP address range query request includes the resource pool identifier and the NAT mapping type.

[0091] The secondary node searches for available IP address ranges based on the resource pool identifier and the NAT mapping type, and returns the results to the primary node.

[0092] The first-level node sends a request to the second-level node to reserve an IP address;

[0093] The secondary node reserves an IP address based on the reserved IP address request and returns the reserved IP address to the primary node.

[0094] In an alternative approach, the executable instructions cause the network node to perform the following operations:

[0095] The process of obtaining the address information of the underlay network includes:

[0096] The primary node sends a request to the secondary node to query the underlay network address information. The request to query the underlay network address information includes the user identifier and the resource pool identifier.

[0097] The secondary node determines whether the user has subscribed to the underlay network based on the user identifier and resource pool identifier parameters.

[0098] If it is determined that the user has subscribed to the underlay network, the address information of the underlay network is obtained and returned to the primary node.

[0099] In an alternative approach, the executable instructions cause the network node to perform the following operations:

[0100] Sending the VRF creation request to the VGW device includes:

[0101] The primary node sends a VRF creation request to the secondary node;

[0102] After receiving the VRF creation request, the secondary node verifies the parameters in the VRF creation request.

[0103] If the parameter verification is successful, the secondary node will send the VRF creation request to the VGW device;

[0104] If parameter verification fails, the secondary node will return a creation failure message to the primary node.

[0105] In an alternative approach, the executable instructions cause the network node to perform the following operations:

[0106] The encapsulation of the firewall configuration message and its subsequent transmission to the firewall include:

[0107] The primary node sends a request to the secondary node to create a firewall configuration policy;

[0108] After receiving the request to create a firewall configuration policy, the secondary node verifies the parameters carried in the request.

[0109] If the verification is successful, the secondary node encapsulates the parameters carried in the request to create a firewall configuration policy into a firewall configuration message and sends it to the firewall.

[0110] This invention encapsulates Network Address Translation (NAT) mapping information and sends it to the firewall, enabling the firewall to configure NAT mapping and perform NAT mapping. It also sends a VRF creation request to the VGW device, allowing the VGW device to create a VRF between itself and the firewall, ensuring routing isolation between different user subnets. Furthermore, it encapsulates firewall configuration messages and sends them to the firewall, enabling the firewall to configure firewall policies based on these messages, thereby opening access control to the underlay network and establishing an access link between the user subnet and the underlay network. This allows for automatic configuration of mutual access information between the user subnet and the public cloud underlay network via the cloud private line, improving configuration efficiency, saving operational costs, and ensuring network stability and security for mutual access between the user subnet and the public cloud underlay network. Moreover, NAT address mapping resolves address conflicts between the user subnet and the underlay network, ensuring the use of the public cloud underlay network without altering local network planning.

[0111] The above description is merely an overview of the technical solutions of the embodiments of the present invention. In order to better understand the technical means of the embodiments of the present invention and to implement them in accordance with the contents of the specification, and to make the above and other objects, features and advantages of the embodiments of the present invention more apparent and understandable, specific embodiments of the present invention are described below. Attached Figure Description

[0112] The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings:

[0113] Figure 1 This diagram illustrates a scenario where a user subnet accesses a public cloud, as provided by existing technologies.

[0114] Figure 2 The flowchart illustrates a cloud service interoperability method based on a cloud private line provided by an embodiment of the present invention.

[0115] Figure 3 A flowchart illustrating a NAT mapping information configuration method provided by an embodiment of the present invention is shown;

[0116] Figure 4 The diagram illustrates a flowchart of a method for obtaining a reserved IP address according to an embodiment of the present invention.

[0117] Figure 5 The diagram illustrates a flowchart of a method for obtaining address information of an underlay network according to an embodiment of the present invention.

[0118] Figure 6 A flowchart illustrating a VRF creation method provided by an embodiment of the present invention is shown;

[0119] Figure 7 A flowchart illustrating a firewall configuration method provided by an embodiment of the present invention is shown;

[0120] Figure 8 This invention provides an architecture diagram of a cloud service interoperability system based on a cloud private line, according to an embodiment of the present invention.

[0121] Figure 9 This illustration shows a scenario diagram of a cloud service interoperability method based on a cloud private line provided by an embodiment of the present invention;

[0122] Figure 10 This illustration shows a scenario diagram of another cloud service interoperability method based on a cloud private line provided by an embodiment of the present invention;

[0123] Figure 11 A schematic diagram of the structure of a network node provided in an embodiment of the present invention is shown. Detailed Implementation

[0124] Exemplary embodiments of the invention will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the invention are shown in the drawings, it should be understood that the invention can be implemented in various forms and should not be limited to the embodiments set forth herein.

[0125] Currently, it is possible for user subnets to communicate with the overlay network (implemented based on tunneling technology, where overlay traffic needs to run on the underlay). This means that traffic is forwarded to virtual machines via the cloud private line, but traffic cannot be forwarded to the public cloud's underlay network (the underlying network responsible for interconnection). As a result, after using the cloud private line, user subnets cannot access services deployed in the public cloud provider's underlay network through that private line.

[0126] Figure 1 This diagram illustrates a scenario where a user subnet accesses a public cloud, as provided by existing technologies. Figure 1 As shown, the arrows indicate the direction of traffic from a user's subnet to the public cloud. Figure 1 It is known that the user subnet through the cloud dedicated line can only access virtual machines within the Virtual Private Cloud (VPC), meaning that traffic ends at the overlay and cannot reach the underlay network.

[0127] To address the aforementioned issues, the service request's source host IP address can be used as the source IP address when sending the corresponding data packet to the switching kernel. Then, the outbound transmission rules representing the destination virtual machine's virtual IP address are queried according to a pre-configured outbound rule table. Finally, the service request's corresponding data packet is encapsulated and sent from the underlay network to the overlay network, thus achieving traffic forwarding from the underlay to the overlay.

[0128] However, the above method requires that the source and destination IP addresses be different. Furthermore, it cannot achieve traffic forwarding from overlay to underlay, and it is not applicable to scenarios where the user's subnet address and the underlay's subnet address conflict.

[0129] In public cloud solutions, a common approach is to expose the underlay network to users via the public internet, allowing users to access it. Similarly, if the underlay network needs to access a user's subnet, the user's subnet must expose its public IP address. This public internet access method requires both the user's subnet and the underlay network to provide public IP addresses, which compromises the security and bandwidth of public network transmission.

[0130] Therefore, the existing technology has the following problems:

[0131] 1. Accessing via the public network requires using public channels, which result in poor network stability and security. Furthermore, it requires users to expose themselves to the public internet, increasing their security protection costs.

[0132] 2. Access via cloud private lines has drawbacks. Since cloud private lines can only access the overlay network, access from the overlay to the underlay requires manual configuration, increasing the time cost for users to activate services. Furthermore, the need for manual configuration by operations and maintenance personnel also increases the difficulty of maintenance.

[0133] 3. The network data exchange method based on overlay and underlay requires that the user subnet and the underlay subnet be different. When the user subnet and the underlay subnet conflict, the user needs to readjust the network plan, which increases the user's network planning and deployment costs.

[0134] Figure 2 The diagram illustrates a flowchart of a cloud service interoperability method based on a cloud private line, provided by an embodiment of the present invention. This method is executed by a network node. The network node can be located in the backbone network and possesses a unique network address. Figure 2 As shown, the method includes the following steps:

[0135] Step 210: Encapsulate the Network Address Translation (NAT) mapping information and send it to the firewall so that the firewall can configure the NAT mapping information.

[0136] The NAT mapping information includes Destination Network Address Translation (DNAT) mapping information, Source Network Address Translation (SNAT) mapping information, and Port Network Address Translation (PNAT) mapping information.

[0137] Here, DNAT mapping information is used to map addresses of the underlay network, resolving address conflicts between the user's subnet and the underlay network. SNAT mapping information is also used to map addresses of the user's subnet, resolving address conflicts. PNAT mapping information is used to map port addresses. When a user's subnet accesses multiple underlay networks via a cloud private line, PNAT mapping information is used to add port mapping rules, mapping different underlay networks to different ports of the same mapped address. This reduces the amount of IP address resources used.

[0138] Optionally, NAT mapping information can be represented as shown in Table 1 below.

[0139] Table 1

[0140]

[0141] Step 220: Send a Virtual Routing and Rorwarding (VRF) creation request to the Virtual Private Gateway (VGW) device so that the VGW device can create a VRF between the VGW device and the firewall.

[0142] Here, the VRF between the VGW device and the firewall enables route isolation between different user subnets, ensuring independent routing and preventing interference between them. The parameters included in the VRF are shown in Table 2.

[0143] Table 2

[0144]

[0145]

[0146] Step 330: Encapsulate the firewall configuration message and send it to the firewall so that the firewall can configure firewall policies based on the firewall configuration message.

[0147] Firewall policies can include static route configuration policies, access control list (ACL) rule configuration policies, and security policy configurations.

[0148] Here, static route configuration policies can include: return static route configuration policies to user subnets, and outgoing static route configuration policies to the actual addresses of the underlay network, etc.

[0149] Security policies can control packets through security policy rules. Security policy rules can include filtering conditions for matching packets, actions for processing packets, and rules for deep inspection of packet content. An ACL (Access Control List) is a list of instructions applied to an interface, used to filter packets on the interface based on defined conditions. ACL rules are statements that describe the conditions under which packets match.

[0150] In addition, firewall policies can include parameters as shown in Table 3.

[0151] Table 3

[0152] Parameter name Is it mandatory? Parameter type describe vlanId yes String VLAN identifier sourceIp yes String Source IP address destionIp yes String Destination IP address

[0153] In this embodiment of the invention, Network Address Translation (NAT) mapping information is encapsulated and sent to the firewall, enabling the firewall to configure NAT mapping and perform NAT mapping. A VRF creation request is also sent to the VGW device, allowing the VGW device to create a VRF between itself and the firewall, ensuring routing isolation between different user subnets. Furthermore, a firewall configuration message is encapsulated and sent to the firewall, enabling the firewall to configure firewall policies based on the message, thereby opening access control to the underlay network and establishing an access link between the user subnet and the underlay network. This allows for automatic configuration of mutual access information between the user subnet and the public cloud underlay network via the cloud private line, improving configuration efficiency, saving operational costs, and ensuring network stability and security for mutual access between the user subnet and the public cloud underlay network. Moreover, NAT address mapping resolves address conflicts between the user subnet and the underlay network, ensuring the use of the public cloud underlay network without altering local network planning.

[0154] In one optional approach, the network nodes include primary nodes and secondary nodes. Before encapsulating the NAT mapping information and sending it to the firewall in step 110, this cloud service interoperability method based on cloud private lines also includes:

[0155] Obtain a pre-reserved Internet Protocol (IP) address;

[0156] Obtain the address information of the underlay network.

[0157] Here, the reserved IP address can be an IP address pre-assigned to the user's subnet. Using a reserved IP address can resolve conflicts between the user's subnet address and the underlay network address. The reserved IP address can include the parameters shown in Table 4.

[0158] Table 4

[0159] Parameter name Is it mandatory? Parameter type describe poolId yes String Resource pool identifier l3vpnId yes String L3VPN for creating cloud private lines cidrAndTypes yes List <cidrandtype> < / cidrandtype> Address ranges and mapping types

[0160] The data structure of the ciderAndTypes field is described in Table 5.

[0161] Table 5

[0162]

[0163] Here, the address information of the underlay network can include IP address and port. Using the underlay network's address information, the user can obtain the underlay networks they have subscribed to that require mutual access.

[0164] In one optional way, Figure 3 This diagram illustrates a flowchart of a NAT mapping information configuration method provided by an embodiment of the present invention. Figure 3 As shown, step 110 encapsulates the NAT mapping information and sends it to the firewall, including:

[0165] The first-level node encapsulates the NAT mapping information based on the address information of the underlay network and the reserved IP address, and then sends the NAT mapping information to the second-level node.

[0166] After receiving the NAT mapping information, the secondary node verifies the NAT mapping information;

[0167] If the verification is successful, the secondary node will send the NAT mapping information to the firewall;

[0168] If the verification fails, the secondary node returns an error message to the primary node.

[0169] Here, the encapsulation operation of the first-level node can be to map the IP addresses in the address information of the underlay network to the reserved IP addresses, and to assign mapped ports to the ports of the underlay network.

[0170] The secondary node verifies the NAT mapping information, checking whether the parameters in the NAT mapping information conform to preset rules. Optionally, the secondary node's checks on whether the parameters in the NAT mapping information conform to preset rules may include, but are not limited to, checking whether the parameters in the NAT mapping information are missing, and whether the mapped IP is being used.

[0171] In this embodiment of the application, the error message can be an address information error message from the underlay network. For example... Figure 3 As shown, in the event of a verification failure, the secondary node returns an error message to the primary node, and the primary node re-executes the operation of encapsulating the NAT mapping information.

[0172] In one optional approach, after successful verification, the secondary node sends the NAT mapping information to the firewall. This cloud service interoperability method based on cloud private lines also includes:

[0173] The secondary node obtains the configuration status information sent by the firewall and sends the configuration status information to the primary node.

[0174] Here, the configuration status information can include success and failure messages. The firewall writes the NAT mapping information into the configuration to make the configuration take effect. For example... Figure 3 As shown, the firewall returns configuration status information to the secondary node based on the configuration write status. Specifically, if the firewall configuration write fails, the firewall returns a configuration failure message to the secondary node. The secondary node receives the configuration failure message and returns it to the primary node. If the firewall configuration write succeeds, the firewall returns a configuration success message to the secondary node. The secondary node receives the configuration success message and returns it to the primary node.

[0175] In one optional way, Figure 4 The following is a flowchart illustrating a method for obtaining a reserved IP address according to an embodiment of the present invention. Figure 4 As shown, obtaining a pre-assigned IP address includes:

[0176] The first-level node sends an available IP address range query request to the second-level node. The available IP address range query request includes the resource pool identifier and NAT mapping type.

[0177] The secondary node searches for available IP address ranges based on the resource pool identifier and NAT mapping type, and returns them to the primary node;

[0178] The primary node sends a request to the secondary node to reserve an IP address;

[0179] The secondary node reserves an IP address based on the reserved IP address request and returns the reserved IP address to the primary node.

[0180] Here, the cloud resource pool identifier can be represented by the `poolId` parameter, and the NAT mapping type can be represented by the `natTypes` parameter. The request for a reserved IP address can carry parameters from the reserved IP address, such as `poolId`, `l3vpnId`, and `cidrAndTypes`.

[0181] In one optional way, Figure 5 This diagram illustrates a flowchart of a method for obtaining address information of an underlay network according to an embodiment of the present invention. Figure 5 As shown, the address information of the underlay network is obtained, including:

[0182] The primary node sends a request to the secondary node to query the underlay network address information. The request to query the underlay network address information includes the user identifier and the resource pool identifier.

[0183] The secondary node determines whether the user has subscribed to the underlay network based on the user identifier and resource pool identifier parameters;

[0184] If it is confirmed that the user has subscribed to the underlay network, the address information of the underlay network is obtained and returned to the primary node.

[0185] Here, the resource pool identifier can be a public cloud resource pool identifier, which can be represented by poolId. The parameters included in the underlay network address information request are shown in Table 6.

[0186] Table 6

[0187] name Data types Is this field required? describe poolId String yes Resource pool identifier userId String no User ID

[0188] In addition, such as Figure 5 As shown, after receiving the address information of the underlay network returned by the second-level node, the first-level node stores the address information of the underlay network into the database.

[0189] In one optional way, Figure 6 The following is a flowchart illustrating a VRF creation method provided by an embodiment of the present invention, as shown in the figure. Figure 6 As shown, sending a VRF creation request to the VGW device includes:

[0190] The primary node sends a VRF creation request to the secondary node;

[0191] After receiving the VRF creation request, the secondary node verifies the parameters in the VRF creation request;

[0192] If the parameter verification is successful, the secondary node will send a VRF creation request to the VGW device;

[0193] If parameter verification fails, the secondary node will return a creation failure message to the primary node.

[0194] Here, the VRF creation request carries parameters included in the VRF, such as the resource pool identifier, device identifier, and port list.

[0195] The secondary node validates the parameters in the VRF creation request, which allows the secondary node to detect errors in the VRF creation request.

[0196] Whether the parameters conform to preset rules. Optionally, the secondary node can check whether the parameters in the VRF creation request conform to preset rules, which may include whether the secondary node checks whether the parameter type and port are correct, etc.

[0197] In the embodiments of this application, such as Figure 6 As shown, in the event of parameter verification failure, after receiving the creation failure information returned by the second-level node, the first-level node re-encapsulates the VRF creation request and re-executes the operation of sending the VRF creation request.

[0198] like Figure 6 As shown, if the parameter verification is successful, the secondary node will send a VRF creation request to the VGW device, and the VGW device will create the VRF of the VGW device to the firewall according to the VRF creation request.

[0199] In an optional approach, after the secondary node sends a VRF request to the VGW device upon successful parameter verification, this cloud service interoperability method based on the cloud private line also includes:

[0200] The secondary node obtains the VRF configuration status information sent by the VGW device and sends the VRF configuration status information to the primary node.

[0201] Here, VRF configuration status information can include both successful and failed VRF configuration messages. For example... Figure 6 As shown, the VGW device can send VRF configuration status information to the secondary node based on the VRF creation status. Specifically, if VRF creation is successful, the VGW device returns a VRF configuration success message to the secondary node. The secondary node receives the VRF configuration success message and returns it to the primary node. If VRF creation fails, the VGW device returns a VRF configuration failure message to the secondary node. The secondary node receives the VRF configuration failure message and returns it to the primary node.

[0202] In one optional way, Figure 7 This diagram illustrates a flowchart of a firewall configuration method provided by an embodiment of the present invention. Figure 7 As shown, the firewall configuration message is encapsulated and sent to the firewall, including:

[0203] The primary node sends a request to the secondary node to create a firewall configuration policy.

[0204] After receiving the request to create a firewall configuration policy, the secondary node verifies the parameters carried in the request.

[0205] If the verification is successful, the secondary node will encapsulate the parameters carried in the firewall configuration policy request into a firewall configuration message and send it to the firewall.

[0206] Here, the parameters carried in the request to create a firewall configuration policy may include, but are not limited to, VLAN identifiers, user subnet IP addresses, and underlay network addresses. The firewall configuration message can be a netconf message.

[0207] The secondary node validates the parameters carried in the request to create a firewall configuration policy. This can be understood as the secondary node checking whether the parameters in the request conform to preset rules. Optionally, the validation of the parameters carried in the request may include, but is not limited to, validating the parameters for validity, correct parameter types, and correct VLAN identifiers.

[0208] In the embodiments of this application, such as Figure 7 As shown, in the event of a verification failure, the secondary node returns a message indicating that the firewall configuration policy creation failed to be created to the primary node. The primary node then repackages the request to create the firewall configuration policy and re-executes the request sending and verification operations.

[0209] In one optional way, such as Figure 7 As shown, if the verification is successful, the secondary node will encapsulate the parameters carried in the firewall configuration policy creation request into a firewall configuration message and send it to the firewall. This message also includes:

[0210] The secondary node obtains the security configuration status information sent by the firewall and sends the security configuration status information to the primary node.

[0211] Here, security configuration status information can include both successful and failed security configuration messages. This information indicates the security configuration status. After receiving a firewall configuration message, the firewall parses it to obtain configuration instructions and executes them. These instructions include, but are not limited to, security policy configuration instructions, ACL rule configuration instructions, and static route configuration instructions. Figure 7 As shown, the firewall returns security configuration status information to the secondary nodes based on the execution status of the configuration instructions. If the firewall executes the instructions successfully, it returns a security configuration success message to the secondary nodes, which then forward the message to the primary node. If the firewall fails to execute the instructions, it returns a security configuration failure message to the secondary nodes, which then forward the message to the primary node.

[0212] Figure 8 This diagram illustrates the architecture of a cloud service interoperability system based on a cloud private line, as provided in an embodiment of the present invention. Figure 8 As shown, the cloud service access system 80 based on cloud private lines includes:

[0213] Network node 81 is used to encapsulate NAT mapping information and send it to the firewall; send the VRF creation request to the VGW device; encapsulate firewall configuration messages and send them to the firewall;

[0214] Firewall 82 is used to configure NAT mapping information, wherein the NAT mapping information includes DNAT mapping information, SNAT mapping information and PNAT mapping information; and to configure firewall policies based on the firewall configuration message, wherein the firewall policies include static route configuration policies, ACL rule configuration policies and security policy configurations.

[0215] VGW device 83 is used to create a VRF between the VGW device and the firewall.

[0216] In the above embodiments, NAT (Network Address Translation) mapping information is encapsulated and sent to the firewall, enabling the firewall to configure NAT mapping and perform NAT mapping. A VRF (Virtual Radio Service) creation request is sent to the VGW (Virtual Gateway) device, allowing the VGW device to create a VRF between itself and the firewall, ensuring routing isolation between different user subnets. Furthermore, a firewall configuration message is encapsulated and sent to the firewall, enabling the firewall to configure firewall policies based on the message, thereby opening access control to the underlay network and establishing an access link between the user subnet and the underlay network. This allows for automatic configuration of mutual access information between the user subnet and the public cloud underlay network via the cloud private line, improving configuration efficiency, saving operational costs, and ensuring network stability and security for mutual access between the user subnet and the public cloud underlay network. Moreover, NAT address mapping resolves address conflicts between the user subnet and the underlay network, ensuring the use of the public cloud underlay network without altering local network planning.

[0217] In an optional manner, network node 81 is also used to obtain a pre-assigned network IP address and to obtain address information of the underlay network.

[0218] Network node 81 includes primary nodes and secondary nodes;

[0219] The first-level node is used to encapsulate the address information of the underlay network and the reserved IP address to obtain NAT mapping information, and then send the NAT mapping information to the second-level node;

[0220] The secondary node is used to verify the NAT mapping information after receiving it; if the verification is successful, it sends the NAT mapping information to the firewall; if the verification fails, it returns an error message to the primary node.

[0221] In one optional manner, a first-level node is configured to send an available IP address range query request to the second-level node, the available IP address range query request including a resource pool identifier and a NAT mapping type;

[0222] The secondary node is used to find available IP address ranges based on the resource pool identifier and the NAT mapping type, and return them to the primary node.

[0223] The primary node is also used to send a request for a reserved IP address to the secondary node;

[0224] The secondary node is also used to reserve an IP address according to the reserved IP address request, and return the reserved IP address to the primary node.

[0225] In one optional approach, a first-level node is specifically used to send a request to the second-level node to query underlay network address information, the request including a user identifier and a resource pool identifier;

[0226] The secondary node is specifically used to determine whether a user has subscribed to the underlay network based on the user identifier and resource pool identifier parameters; if it is determined that the user has subscribed to the underlay network, it obtains the address information of the underlay network and returns the address information of the underlay network to the primary node.

[0227] In one alternative approach, a primary node is specifically used to send a VRF creation request to the secondary node;

[0228] The secondary node is specifically used to receive the VRF creation request, verify the parameters in the VRF creation request; if the parameter verification is successful, send the VRF creation request to the VGW device; if the parameter verification fails, return the creation failure information to the primary node.

[0229] In one alternative approach, a first-level node is specifically used to send a request to the second-level node to create a firewall configuration policy;

[0230] The secondary node is specifically used to receive the request to create a firewall configuration policy, verify the parameters carried in the request, and if the verification is successful, encapsulate the parameters carried in the request into a firewall configuration message and send it to the firewall.

[0231] In one alternative approach, the cloud service interoperability system also includes:

[0232] CPE devices are used to configure static routes to DNAT addresses;

[0233] The NPE device is used to learn the static route to the DNAT address from the CPE device.

[0234] In one alternative approach, a firewall is used to perform SNAT on user subnet addresses to resolve user address conflicts; DNAT on underlay network addresses to resolve conflicts between user addresses and underlay network addresses; and PNAT on underlay network addresses. Since user subnets access multiple underlay networks through cloud private lines, PNAT is used to map each underlay network to a different port to reduce the amount of NAT addresses used.

[0235] Here, a network segment that does not conflict with the local data center LAN is provided. Within this segment, a DNAT address and an SNAT address are assigned to each user subnet. A DNAT mapping is created on the firewall's ingress interface. When a user subnet accesses the underlay network, the destination address is the address after DNAT mapping. After the access packet reaches the firewall, the DNAT mapping is used to resolve the real address of the underlay service, and the destination address of the access packet becomes the real address of the underlay network. The firewall then forwards the access packet to the underlay network.

[0236] SNAT mapping is performed on the firewall's outgoing interface to resolve address conflicts between different users. When an access packet reaches the firewall, its source address is translated to the SNAT-reverted address. When a return packet travels from the underlay network to the user's subnet, the firewall restores the source and destination addresses based on the previous session, redirecting the traffic to the VRF. PNAT mapping is performed on the firewall's ingoing interface to forward packets accessing the underlay network to the actual underlay service.

[0237] When accessing the local data center from the underlay network, the destination address is the address after DNAT mapping. Upon reaching the firewall, the access packet is resolved to the real address of the local data center through DNAT mapping, and the destination address of the access packet becomes the real address of the local data center. The firewall then forwards the access packet to the local data center.

[0238] When an access packet reaches the firewall, the source address is translated to the address after SNAT. When a return packet travels from the local data center to the underlay network, the firewall restores the source and destination addresses based on the previous session and redirects the traffic to the underlay network.

[0239] In an alternative approach, the firewall also creates an aggregated interface interconnecting with the VGW to enable interconnection between the VGW, the lag-x interface, and the firewall; it also creates a sub-interface interconnecting with the VGW, using the same VRF and VLAN created in the VGW, and configuring the interconnect address of the VRF created in the VGW.

[0240] The VGW device is used to create the lag-x interface, configure mac-lag and include it in the Virtual Switch Device (VSD) management, add the physical interface that interconnects the VGW and the firewall to lag-x, create a VRF between the VGW and the firewall to achieve routing isolation for different users, assign interconnect addresses on the firewall, and interconnect the VGW's lag-x interface with the firewall; create a sub-interface on the lag-x interface, use the same VRF and VLAN on the CPE side, and configure a static route to the DNAT address, with the next-hop address pointing to the firewall interconnect address.

[0241] In an alternative approach, the firewall is also used to add the sub-interfaces created on the firewall to the untrust domain and allow the security policy of the VRF; add the user subnet corresponding to the VRF to the SNAT ACL and allow access permissions for the user subnet.

[0242] In one alternative approach, the firewall is also used to configure static routes to user subnets, with the next-hop address pointing to the VGW's interconnect address, to ensure return route reachability; and to configure static routes to the actual address of the underlay service, ensuring route reachability after DNAT resolution.

[0243] Figure 9 This illustration shows a scenario diagram of a cloud service interoperability method based on a cloud private line, provided by an embodiment of the present invention. For example... Figure 9As shown, the cloud service access system can include customer network edge devices (CE), network provider edge devices (NPE), cloud provider backbone routers (CPE), virtual gateways (VGW), firewalls, and underlay networks. The arrows indicate the packet transmission direction when a user subnet accesses the underlay network. Taking object storage as an example, the traffic model for a user's local data center (i.e., the user subnet) accessing the underlay network to the cloud is as follows:

[0244] The user's subnet address is 10.10.10.2 / 32, the object storage address is 10.10.10.2 / 32, the port is 18080, the assigned SNAT address is 192.168.2.2 / 32, the assigned DNAT address is 100.100.100.2 / 32, and the assigned PNAT is 10000.

[0245] The L3VPN of the cloud private line terminates at the backbone network edge device. After the access packet is decapsulated by L3VPN, it is forwarded to the VGW. At this time, the destination address of the packet is 100.100.100.2 / 32 and the source address is 10.10.10.2 / 32.

[0246] The VGW matches the route to 100.100.100.2 / 32 in the VRF routing table of the cloud private line. Through the interconnect sub-interface, it forwards the access packet to the ingress interface of the firewall. At this time, the destination address of the access packet is 100.100.100.2 / 32, the destination port is 10000, and the source address is 10.10.10.2 / 32.

[0247] After receiving an access packet, the firewall's inbound interface matches the DNAT and PNAT policies from 100.100.100.2:10000 to 10.10.10.2:18080, performs DNAT and PNAT mapping, and translates the destination address to 10.10.10.2 / 32 and the destination port to 18080. At this point, the destination address of the access packet is 10.10.10.2 / 32, the destination port is 18080, and the source address is 10.10.10.2 / 32.

[0248] After the firewall receives the access packet on the outgoing interface, it hits the SNAT policy from 10.10.10.2 / 32 to 192.168.2.2 / 32, performs SNAT mapping, and translates the source address to 192.168.2.2 / 32. At this time, the destination address of the access packet is 10.10.10.2 / 32, the destination port is 18080, and the source address is 192.168.2.2 / 32.

[0249] The firewall forwards the access packet from the outgoing interface to port 18080 of the 10.10.10.2 / 32 address in the underlay network, and the packet transmission is complete.

[0250] Figure 10 This illustration shows a scenario diagram of another cloud service interoperability method based on a cloud private line provided by an embodiment of the present invention. For example... Figure 10 As shown, the arrows indicate the packet transmission direction when the underlay network accesses the user's subnet. Taking cloud desktops as an example, the traffic model for the outbound solution accessed by the underlay network to the user's local data center (i.e., the user's subnet) is as follows:

[0251] The user's subnet address is 10.10.10.2 / 32, the cloud desktop address is 10.10.10.2 / 32, the assigned SNAT address is 192.168.2.2 / 32, and the DNAT address is 100.100.100.2 / 32.

[0252] The cloud desktop initiates an access request to the user's subnet address. The destination address of the request message is 100.100.100.2 / 32, and the source address is 10.10.10.2 / 32.

[0253] After receiving the request packet, the firewall ingress interface hits the DNAT policy of 100.100.100.2 and performs DNAT mapping, converting the destination address to 10.10.10.2 / 32. At this time, the destination address of the request packet is 10.10.10.2 / 32 and the source address is 10.10.10.2 / 32.

[0254] After receiving the request packet on its outgoing interface, the firewall matches the SNAT policy covering addresses 10.10.10.2 / 32 to 192.168.2.2 / 32, performs SNAT mapping, and translates the source address to 192.168.2.2 / 32. At this point, the destination address of the request packet is 10.10.10.2 / 32, and the source address is 192.168.2.2 / 32. The firewall then forwards the request packet to the VGW through its interconnect sub-interface with the VGW.

[0255] In the VRF of the cloud private line, the VGW hits the route to 10.10.10.2 / 32 and forwards the request packet to the CPE through the interconnect sub-interface. At this time, the destination address of the request packet is 10.10.10.2 / 32 and the source address is 192.168.2.2 / 32.

[0256] The CPE transmits the request message to the user's subnet via the cloud private line, and the request message transmission is complete.

[0257] Figure 11 The diagram illustrates a network node structure according to an embodiment of the present invention. The specific implementation of the network node is not limited by the specific embodiments of the present invention.

[0258] like Figure 11 As shown, the network node may include: processor 112, communications interface 114, memory 116, and communication bus 118.

[0259] The processor 112, communication interface 114, and memory 116 communicate with each other via communication bus 118. Communication interface 114 is used to communicate with other network elements, such as clients or other servers. The processor 112 executes program 1110, specifically performing the relevant steps described in the embodiment of the cloud service interoperability method based on cloud private lines.

[0260] Specifically, program 1110 may include program code, which includes computer-executable instructions.

[0261] Processor 112 may be a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement embodiments of the present invention. The network node may include one or more processors of the same type, such as one or more CPUs; or it may include processors of different types, such as one or more CPUs and one or more ASICs.

[0262] Memory 116 is used to store program 1110. Memory 116 may include high-speed RAM memory, and may also include non-volatile memory, such as at least one disk storage device.

[0263] Specifically, program 1110 can be called by processor 112 to cause the network node to perform the following operations:

[0264] Encapsulate Network Address Translation (NAT) mapping information and send it to the firewall so that the firewall can configure the NAT mapping information. The NAT mapping information includes destination Network Address Translation (DNAT) mapping information, source Network Address Translation (SNAT) mapping information, and port address translation (PNAT) mapping information.

[0265] A request to create a virtual route forwarding (VRF) is sent to the virtual gateway (VGW) device, so that the VGW device can create a VRF between the VGW device and the firewall.

[0266] A firewall configuration message is encapsulated and sent to the firewall so that the firewall can configure firewall policies based on the firewall configuration message. The firewall policies include static routing configuration policies, access control list (ACL) rule configuration policies, and security policy configurations.

[0267] In the above embodiments, NAT (Network Address Translation) mapping information is encapsulated and sent to the firewall, enabling the firewall to configure NAT mapping and perform NAT mapping. A VRF (Virtual Radio Service) creation request is sent to the VGW (Virtual Gateway) device, allowing the VGW device to create a VRF between itself and the firewall, ensuring routing isolation between different user subnets. Furthermore, a firewall configuration message is encapsulated and sent to the firewall, enabling the firewall to configure firewall policies based on the message, thereby opening access control to the underlay network and establishing an access link between the user subnet and the underlay network. This allows for automatic configuration of mutual access information between the user subnet and the public cloud underlay network via the cloud private line, improving configuration efficiency, saving operational costs, and ensuring network stability and security for mutual access between the user subnet and the public cloud underlay network. Moreover, NAT address mapping resolves address conflicts between the user subnet and the underlay network, ensuring the use of the public cloud underlay network without altering local network planning.

[0268] In an alternative embodiment, the network node includes a primary node and a secondary node, and program 1110 can be specifically invoked by processor 112 to cause the network node to perform the following operations: before encapsulating the NAT mapping information and sending it to the firewall, the method further includes:

[0269] Obtain a pre-reserved Internet Protocol (IP) address;

[0270] Obtain the address information of the underlay network;

[0271] The first-level node encapsulates the address information of the underlay network and the reserved IP address to obtain NAT mapping information, and sends the NAT mapping information to the second-level node;

[0272] After receiving the NAT mapping information, the secondary node verifies the NAT mapping information.

[0273] If the verification is successful, the secondary node will send the NAT mapping information to the firewall;

[0274] In the event of a verification failure, the secondary node returns an error message to the primary node.

[0275] In one alternative approach, obtaining a pre-reserved IP address includes:

[0276] The first-level node sends an available IP address range query request to the second-level node. The available IP address range query request includes the resource pool identifier and the NAT mapping type.

[0277] The secondary node searches for available IP address ranges based on the resource pool identifier and the NAT mapping type, and returns the results to the primary node.

[0278] The first-level node sends a request to the second-level node to reserve an IP address;

[0279] The secondary node reserves an IP address based on the reserved IP address request and returns the reserved IP address to the primary node.

[0280] In an alternative approach, program 1110 may be invoked by processor 112 to cause the network node to perform the following operations:

[0281] The process of obtaining the address information of the underlay network includes: the primary node sending a request to the secondary node to query the address information of the underlay network, the request including a user identifier and a resource pool identifier; the secondary node determining whether the user has subscribed to the underlay network based on the user identifier and resource pool identifier parameters; if the user has subscribed to the underlay network, obtaining the address information of the underlay network and returning the address information of the underlay network to the primary node.

[0282] In an alternative approach, program 1110 may be invoked by processor 112 to cause the network node to perform the following operations:

[0283] Sending the VRF creation request to the VGW device includes: the primary node sending the VRF creation request to the secondary node; the secondary node receiving the VRF creation request and verifying the parameters in the VRF creation request; if the parameter verification is successful, the secondary node sending the VRF creation request to the VGW device; if the parameter verification fails, the secondary node returning the creation failure information to the primary node.

[0284] In an alternative approach, program 1110 may be invoked by processor 112 to cause the network node to perform the following operations:

[0285] The process of encapsulating a firewall configuration message and sending it to the firewall includes: the primary node sending a request to create a firewall configuration policy to the secondary node; the secondary node receiving the request to create a firewall configuration policy and verifying the parameters carried in the request; if the verification is successful, the secondary node encapsulating the parameters carried in the request to create a firewall configuration policy into a firewall configuration message and sending it to the firewall.

[0286] This invention provides a computer-readable storage medium storing at least one executable instruction that, when executed on a network node, causes the network node to perform the cloud service interoperability method based on a cloud private line in any of the above method embodiments.

[0287] Specifically, executable instructions can be used to cause network nodes to perform the following operations:

[0288] Encapsulate Network Address Translation (NAT) mapping information and send it to the firewall so that the firewall can configure the NAT mapping information. The NAT mapping information includes destination Network Address Translation (DNAT) mapping information, source Network Address Translation (SNAT) mapping information, and port address translation (PNAT) mapping information.

[0289] The virtual route will be created to forward the VRF request to the virtual gateway VGW device, so that the VGW device can create a VRF between the VGW device and the firewall;

[0290] A firewall configuration message is encapsulated and sent to the firewall so that the firewall can configure firewall policies based on the firewall configuration message. The firewall policies include static routing configuration policies, access control list (ACL) rule configuration policies, and security policy configurations.

[0291] In one alternative approach, the network node includes a primary node and a secondary node. Specifically, the executable instructions can cause the network node to perform the following operations: obtain a pre-assigned Internet Protocol (IP) address; obtain the address information of the underlay network; the primary node encapsulates the underlay network address information and the pre-assigned IP address to obtain NAT mapping information, and sends the NAT mapping information to the secondary node; upon receiving the NAT mapping information, the secondary node verifies the NAT mapping information; if the verification is successful, the secondary node sends the NAT mapping information to the firewall; if the verification fails, the secondary node returns an error message to the primary node.

[0292] In one alternative approach, the executable instructions can be used to cause the network node to perform the following operations:

[0293] The step of obtaining a pre-reserved IP address includes: the first-level node sending an available IP address range query request to the second-level node, the available IP address range query request including a resource pool identifier and a NAT mapping type; the second-level node searching for an available IP address range based on the resource pool identifier and the NAT mapping type, and returning it to the first-level node;

[0294] The primary node sends a request to the secondary node to reserve an IP address; the secondary node reserves an IP address according to the request and returns the reserved IP address to the primary node.

[0295] In one optional approach, obtaining the address information of the underlay network includes: the primary node sending a query request for underlay network address information to the secondary node, the query request including a user identifier and a resource pool identifier; the secondary node determining whether a user has subscribed to the underlay network based on the user identifier and resource pool identifier parameters; if it is determined that the user has subscribed to the underlay network, obtaining the address information of the underlay network and returning the address information of the underlay network to the primary node.

[0296] In one optional manner, sending the VRF creation request to the VGW device includes: the primary node sending the VRF creation request to the secondary node; the secondary node receiving the VRF creation request and verifying the parameters in the VRF creation request; if the parameter verification is successful, the secondary node sending the VRF creation request to the VGW device; if the parameter verification fails, the secondary node returning creation failure information to the primary node.

[0297] In one optional manner, the encapsulation of the firewall configuration message and its transmission to the firewall includes: the primary node sending a request to create a firewall configuration policy to the secondary node; the secondary node, upon receiving the request, verifying the parameters carried in the request; and, if the verification is successful, encapsulating the parameters carried in the request into a firewall configuration message and transmitting it to the firewall.

[0298] This invention provides a computer program that can be called by a processor to enable network nodes to execute the cloud service interoperability method based on cloud private lines in any of the above method embodiments.

[0299] This invention provides a computer program product, which includes a computer program stored on a computer-readable storage medium. The computer program includes program instructions, which, when executed on a computer, cause the computer to perform the cloud service interoperability method based on cloud private lines in any of the above method embodiments.

[0300] The algorithms or displays provided herein are not inherently related to any particular computer, virtual system, or other device. Various general-purpose systems can also be used in conjunction with the teachings herein. The required structure for constructing such systems is apparent from the above description. Furthermore, the embodiments of the present invention are not directed to any particular programming language. It should be understood that the content of the invention described herein can be implemented using various programming languages, and the above description of specific languages ​​is for the purpose of disclosing the best mode of implementation of the invention.

[0301] Numerous specific details are set forth in the specification provided herein. However, it will be understood that embodiments of the invention may be practiced without these specific details. In some instances, well-known methods, structures, and techniques have not been shown in detail so as not to obscure the understanding of this specification.

[0302] Similarly, it should be understood that, in order to streamline the invention and aid in understanding one or more of the various aspects of the invention, features of the embodiments of the invention are sometimes grouped together in a single embodiment, figure, or description thereof in the above description of exemplary embodiments of the invention. However, this disclosure should not be construed as reflecting an intention that the claimed invention requires more features than are expressly recited in each claim.

[0303] Those skilled in the art will understand that modules in the device of the embodiments can be adaptively changed and placed in one or more devices different from that embodiment. Modules, units, or components in the embodiments can be combined into a single module, unit, or component, and can be divided into multiple sub-modules, sub-units, or sub-components. Except where at least some of such features and / or processes or units are mutually exclusive, any combination can be used to combine all features disclosed in this specification (including the accompanying claims, abstract, and drawings) and all processes or units of any method or device so disclosed. Unless expressly stated otherwise, each feature disclosed in this specification (including the accompanying claims, abstract, and drawings) may be replaced by an alternative feature that serves the same, equivalent, or similar purpose.

[0304] It should be noted that the above embodiments are illustrative of the invention and not restrictive, and that those skilled in the art can devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses should not be construed as limiting the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The invention can be implemented by means of hardware comprising several different elements and by means of a suitably programmed computer. In the unit claims enumerating several means, several of these means may be embodied by the same item of hardware. The use of the words first, second, and third, etc., does not indicate any order. These words can be interpreted as names. The steps in the above embodiments, unless otherwise specified, should not be construed as limiting the order of execution.

Claims

1. A method for mutual access to cloud services based on cloud private lines, characterized in that, Applied to network nodes, which include primary nodes and secondary nodes, the method includes: Obtain a pre-reserved Internet Protocol (IP) address; obtain address information for the underlay network; The primary node encapsulates the NAT mapping information based on the address information of the underlay network and the reserved Internet Protocol (IP) address, and sends the NAT mapping information to the secondary node. After receiving the NAT mapping information, the secondary node verifies the NAT mapping information. If the verification is successful, the secondary node sends the NAT mapping information to the firewall so that the firewall can configure the NAT mapping information. The NAT mapping information includes destination network address translation (DNAT) mapping information, source network address translation (SNAT) mapping information, and port address translation (PNAT) mapping information. The VRF creation request is sent to the Virtual Gateway (VGW) device so that the VGW device can create a VRF between the VGW device and the firewall. A firewall configuration message is encapsulated and sent to the firewall so that the firewall can configure firewall policies based on the firewall configuration message. The firewall policies include static routing configuration policies, access control list (ACL) rule configuration policies, and security policy configurations.

2. The method according to claim 1, characterized in that, The method further includes: In the event of a verification failure, the secondary node returns an error message to the primary node.

3. The method according to claim 2, characterized in that, The process of obtaining a pre-reserved Internet Protocol (IP) address includes: The first-level node sends an available IP address range query request to the second-level node. The available IP address range query request includes the resource pool identifier and the NAT mapping type. The secondary node finds an available IP address range based on the resource pool identifier and the NAT mapping type, and returns it to the primary node; The primary node sends the reserved Internet Protocol (IP) address to the secondary node; The secondary node reserves an IP address based on the reserved IP address request and returns the reserved Internet Protocol (IP) address to the primary node.

4. The method according to claim 1, characterized in that, The process of obtaining the address information of the underlay network includes: The primary node sends a request to the secondary node to query the underlay network address information. The request to query the underlay network address information includes the user identifier and the resource pool identifier. The secondary node determines whether the user has subscribed to the underlay network based on the user identifier and resource pool identifier parameters. If it is determined that the user has subscribed to the underlay network, the address information of the underlay network is obtained and returned to the primary node.

5. The method according to claim 1, characterized in that, Sending the VRF creation request to the VGW device includes: The primary node sends a VRF creation request to the secondary node; After receiving the VRF creation request, the secondary node verifies the parameters in the VRF creation request. If the parameter verification is successful, the secondary node will send the VRF creation request to the VGW device; If parameter verification fails, the secondary node will return a creation failure message to the primary node.

6. The method according to claim 1, characterized in that, The encapsulation of the firewall configuration message and its subsequent transmission to the firewall include: The primary node sends a request to the secondary node to create a firewall configuration policy; After receiving the request to create a firewall configuration policy, the secondary node verifies the parameters carried in the request. If the verification is successful, the secondary node encapsulates the parameters carried in the request to create a firewall configuration policy into a firewall configuration message and sends it to the firewall.

7. A cloud service interoperability system based on a cloud private line, characterized in that, The system includes: The network node, comprising a primary node and a secondary node, is used to obtain a pre-assigned Internet Protocol (IP) address; obtain the address information of the underlay network; the primary node encapsulates the underlay network address information and the pre-assigned IP address to obtain NAT mapping information, and sends the NAT mapping information to the secondary node; after receiving the NAT mapping information, the secondary node verifies the NAT mapping information; if the verification is successful, the secondary node sends the NAT mapping information to the firewall; and sends a Virtual Router Forwarding (VRF) request to the Virtual Gateway (VGW) device. A firewall is used to configure NAT mapping information, wherein the NAT mapping information includes destination network address translation (DNAT) mapping information, source network address translation (SNAT) mapping information, and port address translation (PNAT) mapping information; firewall policy configuration is performed based on the firewall configuration message, wherein the firewall policy includes static route configuration policy, access control list (ACL) rule configuration policy, and security policy configuration. VGW devices are used to create VRFs between VGW devices and firewalls.

8. The system according to claim 7, characterized in that, The system also includes: CPE (Cloud Provider Edge) devices are used to configure static routes to DNAT addresses; NPE (Network Provider Edge) devices are used to learn static routes to DNAT addresses from CPE devices.

9. A network node, characterized in that, include: The processor, memory, communication interface, and communication bus are provided, wherein the processor, memory, and communication interface communicate with each other via the communication bus. The memory is used to store at least one executable instruction, which causes the processor to perform the operation of the cloud service access method based on cloud private lines as described in any one of claims 1-6.

10. A computer-readable storage medium, characterized in that, The storage medium stores at least one executable instruction, which, when executed on a network node, causes the network node to perform the operation of the cloud service interoperability method based on a cloud private line as described in any one of claims 1-6.

Images