A method and device for implementing remote access VPN based on SDN controller

Abstract

The application discloses a remote access VPN implementation method and device based on an SDN controller, relates to the fields of SDN network communication and cloud computing technology, and discloses the remote access VPN implementation method based on the SDN controller, which comprises the following steps: receiving data flow sent by a VPC cloud host vm; performing IPSec SA negotiation with a client ipsec server, and generating IPSec SA information when the IPSec configuration parameters of both ends are consistent, that is, the negotiation is successful; sending the IPSec SA to a standby IPSec server through an SDN controller; forwarding the data flow to the client ipsec server; receiving reply data flow of the client ipsec server; and forwarding the reply data flow to the VPC cloud host vm. The application supports simultaneous deployment of the primary and standby servers, rather than reconstructing the server only after detecting server failure after service interruption.

Description

Technical Field

[0001] This invention relates to the fields of SDN network communication and cloud computing technology, and in particular to a method and apparatus for implementing remote access VPN based on an SDN controller. Background Technology

[0002] With the development and maturity of private cloud technology, more and more enterprises prefer to deploy their businesses in the cloud and use technologies such as dedicated lines to connect local data centers and VPCs in the cloud. They also use IPsec VPN technology to build a virtual VPN tunnel on the Internet to ensure data security.

[0003] Currently, the following solutions are generally adopted: Solution 1: Considering link redundancy, two IPsec VPN servers are usually deployed in the cloud, or, considering cost, only one IPsec VPN is deployed. When the controller detects a problem with the IPsec VPN server, it will restart the IPsec VPN server to quickly restore the customer's business traffic; Solution 2: The customer's local server establishes a Security Association (SA) with the two IPsec VPN servers in the cloud (primary and backup redundancy), and then selects which IPsec link to use by configuring routing and BFD; Solution 3: By deploying primary and backup versions, a backup channel is added between the primary and backup versions to synchronize the SA on the primary IPsec VPN server to the backup IPsec VPN server.

[0004] However, in the process of implementing the inventive technical solution in the embodiments of this application, the inventors of this application discovered that the above-mentioned technology has at least the following technical problems:

[0005] The existing Solution 1 has a significant problem: when the primary IPsec VPN server fails, it requires re-triggering IPsec SA learning through traffic, causing service interruption for users. Solution 2, while providing packet-free failover, requires an additional public IP address, exacerbating IPv4 address depletion and increasing configuration complexity on the customer's local server, thus increasing maintenance difficulty. Solution 3, while offering hot standby, adds various confirmation and timeout mechanisms to ensure SA consistency between primary and standby, undoubtedly increasing complexity and equipment load. In conclusion, existing implementations of IPsec VPN technology are poorly usable. Summary of the Invention

[0006] This application provides a remote access VPN implementation method and apparatus based on an SDN controller, which solves the problem of poor usability of existing IPsec VPN implementations. It enables the simultaneous deployment of primary and backup servers, rather than waiting for a server failure to be detected after a service interruption before rebuilding the server.

[0007] This application provides a method for implementing a remote access VPN based on an SDN controller, used as a primary IPSec server, including the following steps:

[0008] S1 receives data traffic from the VPC cloud host (vm);

[0009] S2, negotiate IPSec SA with the client's IPSec server. When the IPSec configuration parameters of both ends are consistent, the negotiation is successful and IPSec SA information is generated.

[0010] S3 sends the IPSec SA to the backup IPSec server via the SDN controller;

[0011] S4 forwards data traffic to the client's IPsec server;

[0012] S5 receives response data traffic from the client's IPsec server;

[0013] S6 forwards the response data traffic to the VPC cloud host (VM).

[0014] Furthermore, the primary IPSec server reports IPSec SA information to the SDN controller via the northbound interface.

[0015] Furthermore, the SDN controller in S3 includes hash table entries for storing IPSec SA information.

[0016] Furthermore, the hash table entry includes the server identifier that reported the IPSec SA information.

[0017] This application provides a remote access VPN implementation device based on an SDN controller, including an acquisition module, a negotiation module, a reporting module, a forwarding module, a receiving module, and a response module.

[0018] Acquisition module: Used to receive data traffic sent by VPC cloud hosts (VMs);

[0019] Negotiation module: Used to negotiate IPSec SA with the client's IPSec server. When the IPSec configuration parameters of both ends are consistent, the negotiation is successful and IPSec SA information is generated.

[0020] Reporting module: Used to send IPSec SAs to the backup IPSec server via the SDN controller;

[0021] Forwarding module: Used to forward data traffic to the client's IPsec server;

[0022] Receiving module: Used to receive response data traffic from the client's IPsec server;

[0023] Response module: Used to forward response data traffic to VPC cloud host (VM).

[0024] This application provides a method for implementing a remote access VPN based on an SDN controller, used as a backup IPSec server, including the following steps:

[0025] S1 receives the IPSec SA sent by the primary IPSec server through the SDN controller;

[0026] S2, when the primary IPSec server has a sending failure, the backup IPSec server becomes the primary IPSec server and receives data traffic sent from the VPC cloud host (vm).

[0027] S3 forwards data traffic to the client's IPsec server;

[0028] S4 receives response data traffic from the client's IPsec server;

[0029] S5 forwards the response data traffic to the VPC cloud host (VM).

[0030] Furthermore, the SDN controller in S1 includes hash table entries for storing IPSec SA information.

[0031] Furthermore, the hash table entry includes the server identifier that reported the IPSec SA information.

[0032] Furthermore, in S2, the backup IPSec server is converted into the primary IPSec server, which means converting other servers in the AS_PATH attribute with a priority second only to the primary IPSec server into the primary IPSec server.

[0033] The AS_PATH attribute is an attribute included in the Anycast IP routing information published when the server establishes a BGP neighbor with the SDN controller, and it serves as a basis for determining server priority.

[0034] This application provides a remote access VPN implementation device based on an SDN controller, including a synchronization module, a replacement module, a forwarding module, a receiving module, and a reply module:

[0035] Synchronization module: Used to receive IPSec SA sent by the primary IPSec server through the SDN controller;

[0036] Alternate module: When the primary IPSec server experiences a transmission failure, the backup IPSec server takes over as the primary IPSec server and receives data traffic from the VPC cloud host (vm).

[0037] Forwarding module: Used to forward data traffic to the client's IPsec server;

[0038] Receiving module: Used to receive response data traffic from the client's IPsec server;

[0039] Response module: Used to forward response data traffic to VPC cloud host (VM).

[0040] One or more technical solutions provided in the embodiments of this application have at least the following technical effects or advantages:

[0041] 1. By combining Anycast, BGP, and AS_PATH methods, this method enables simultaneous deployment of primary and backup servers, effectively solving the problem of poor usability in existing IPsec VPN implementations, and thus enabling simultaneous deployment of primary and backup servers.

[0042] 2. By adopting the technology of establishing BGP neighbors between the servers in the cluster and the SDN controller, publishing Anycast IPs, and then selecting the primary server based on the length of the AS_PATH attribute in the Anycast IP routing information, it can support multiple servers in a cluster to select a primary or backup server. This effectively solves the problem that the selection of primary and backup servers in existing technologies is mostly done manually, thus realizing automatic selection of primary and backup servers, which is faster and more efficient.

[0043] 3. Since the SDN controller receives the SA information reported by the northbound interface of the primary IPSec server and then distributes the SA information to other backup IPSec servers, the SA information is directly transmitted and backed up by the northbound interface. This effectively solves the problem of time-consuming and labor-intensive maintenance of backup channels in the existing technology, and thus realizes that there is no need to maintain a separate backup channel, thereby saving time and effort. Attached Figure Description

[0044] Figure 1 The flowchart of the remote access VPN implementation method based on SDN controller provided in Embodiment 1 of this application Figure 1 ;

[0045] Figure 2This is a deployment diagram of the primary and backup IPSec servers in a cloud resource pool, as provided in Embodiment 1 of this application.

[0046] Figure 3 The structure of the remote access VPN implementation device based on the SDN controller provided in Embodiment 1 of this application Figure 1 ;

[0047] Figure 4 The flowchart of the remote access VPN implementation method based on SDN controller provided in Embodiment 1 of this application Figure 2 ;

[0048] Figure 5 This is a data traffic forwarding diagram provided in Embodiment 1 of this application;

[0049] Figure 6 A detailed flowchart of data traffic forwarding provided in Embodiment 1 of this application;

[0050] Figure 7 The structure of the remote access VPN implementation device based on the SDN controller provided in Embodiment 1 of this application Figure 2 . Detailed Implementation

[0051] This application provides a remote access VPN implementation method and apparatus based on an SDN controller, which solves the problem of poor usability of existing IPsec VPN technologies. In the scenario of interconnection between a local data center and a cloud resource pool (VPC), the use of an SDN controller to send and receive IPsec SA information achieves high availability of IPsec VPN services.

[0052] The technical solution in this application embodiment aims to address the aforementioned problem of poor usability in implementing IPsec VPN technology. The overall approach is as follows:

[0053] Multiple servers deployed within the cloud resource pool connect to the SDN controller and are configured with the same Anycast IP. Furthermore, BGP neighbors are established with the SDN controller to advertise Anycast IP routing information. Based on the AS_PATH attribute in the routing information, the priority of each server is evaluated, and the server with the highest priority is selected as the primary IPSec server. When the primary IPSec server receives data traffic from a VPC cloud host (VM), it initiates IPSec SA negotiation with the client IPSec server. If the IPSec configuration parameters of both ends are consistent, the negotiation is successful, and IPSec SA information is generated. The primary IPSec server then reports the IPSec SA information to the SDN controller via the northbound interface. The SDN controller then processes the received IPSec... SA information is distributed to other backup servers so that they have the same SA forwarding information as the primary IPSec server. This ensures that data traffic can be forwarded normally when the primary IPSec server becomes unavailable and takes its place. Then, data traffic from the VPC cloud host (VM) is forwarded to the client IPSec server, and the server receives response data traffic from the client IPSec server. Finally, the received response data traffic is forwarded back to the VPC cloud host (VM). If the primary IPSec server becomes unavailable for any reason, the SDN controller forwards traffic from the VPC cloud host (VM) to the same Anycast IP to the backup IPSec server. The backup IPSec server then acts as the primary IPSec server, forwarding data traffic from the VPC cloud host (VM) to the client IPSec server and continuing the above operations. This provides users with a highly reliable IPSec VPN service with zero packet loss.

[0054] To better understand the above technical solutions, the following will provide a detailed explanation of the technical solutions in conjunction with the accompanying drawings and specific implementation methods.

[0055] Example 1

[0056] like Figure 1 The diagram shows the implementation flow of a remote access VPN based on an SDN controller provided in this application embodiment. Figure 1 This method is applied in a remote access VPN implementation device based on an SDN controller, and is used as a primary IPSec server. The method includes the following steps:

[0057] S1 receives data traffic from the VPC cloud host (vm);

[0058] S2, negotiate IPSec SA with the client's IPSec server. When the IPSec configuration parameters of both ends are consistent, the negotiation is successful and IPSec SA information is generated.

[0059] S3 sends the IPSec SA to the backup IPSec server via the SDN controller;

[0060] S4 forwards data traffic to the client's IPsec server;

[0061] S5 receives response data traffic from the client's IPsec server;

[0062] S6 forwards the response data traffic to the VPC cloud host (VM).

[0063] Furthermore, the primary IPSec server reports IPSec SA information to the SDN controller via the northbound interface.

[0064] In this embodiment, the northbound interface refers to the interface through which a lower-level device connects to a higher-level device, typically at the top of the architecture, i.e., the interface that connects to the host computer.

[0065] IPSec SA information includes creation information and deletion information. The IPSec SA information reported to the SDN controller mentioned above refers to the creation information.

[0066] When an SA is deleted due to timeout or aging, the deletion information is also reported to the SDN controller, thereby ensuring that the SAs of different IPSec servers within the same cluster are the same.

[0067] The deployment of primary and backup IPSec servers in the cloud resource pool is as follows: Figure 2 As shown, IPSec VPN1 refers to the primary IPSec server, and IPSec VPN2 refers to the backup IPSec server. The flat structure of Spine-Leaf is adopted, which makes the east-west traffic forwarding path shorter and the forwarding efficiency higher. Multiple network cards are bound together using bonds, allowing two or more interfaces to be used as one interface, thereby increasing bandwidth and providing network link redundancy. When one of the network cards fails, the server's services will not be interrupted.

[0068] Furthermore, the SDN controller in S3 includes hash table entries for storing IPSec SA information.

[0069] The hash table entries include the server identifier that reported the IPSec SA information.

[0070] In this embodiment, the hash table entry stores SA information to maintain local entries based on the information reported by the IPsec server. At the same time, the hash table entry will maintain the server identifier field that reports the IPSec SA information so that only the SA information in the hash table entry is synchronized to the non-source IPSec server.

[0071] like Figure 3 The diagram shows the structure of a remote access VPN implementation device based on an SDN controller provided in this application embodiment. Figure 1 The remote access VPN implementation device based on an SDN controller provided in this application embodiment is used for a primary IPSec server and includes an acquisition module, a negotiation module, a reporting module, a forwarding module, a receiving module, and a response module.

[0072] Acquisition module: Used to receive data traffic sent by VPC cloud hosts (VMs);

[0073] Negotiation module: Used to negotiate IPSec SA with the client's IPSec server. When the IPSec configuration parameters of both ends are consistent, the negotiation is successful and IPSec SA information is generated.

[0074] Reporting module: Used to send IPSec SAs to the backup IPSec server via the SDN controller;

[0075] Forwarding module: Used to forward data traffic to the client's IPsec server;

[0076] Receiving module: Used to receive response data traffic from the client's IPsec server;

[0077] Response module: Used to forward response data traffic to VPC cloud host (VM).

[0078] In this embodiment, the acquisition module first receives data traffic from the VPC cloud host (VM); the negotiation module negotiates an IPSec SA with the client's IPSec server. When the IPSec configuration parameters of both ends are consistent, the negotiation is successful, and IPSec SA information is generated; then, the reporting module sends the IPSec SA to the backup IPSec server through the SDN controller; then, the forwarding module forwards the data traffic to the client's IPSec server; next, the receiving module receives the reply data traffic from the client's IPSec server; finally, the reply module forwards the reply data traffic to the VPC cloud host (VM).

[0079] like Figure 4 The diagram shows the implementation flow of a remote access VPN based on an SDN controller provided in this application embodiment. Figure 2This method is applied in a remote access VPN implementation device based on an SDN controller for use as a backup IPSec server. The method includes the following steps:

[0080] S1 receives the IPSec SA sent by the primary IPSec server through the SDN controller;

[0081] S2, when the primary IPSec server has a sending failure, the backup IPSec server becomes the primary IPSec server and receives data traffic sent from the VPC cloud host (vm).

[0082] S3 forwards data traffic to the client's IPsec server;

[0083] S4 receives response data traffic from the client's IPsec server;

[0084] S5 forwards the response data traffic to the VPC cloud host (VM).

[0085] In this embodiment, as Figure 5 The data traffic forwarding diagram shown illustrates that when the primary IPSec server is available, the customer's local data and the data in the VPC cloud host (vm) are forwarded through IPSec VPN1, i.e., the primary IPSec server, in the diagram. When the primary IPSec server is unavailable, the customer's local data and the data in the VPC cloud host (vm) are forwarded through IPSec VPN2, i.e., the backup IPSec server, in the diagram.

[0086] The use case in this embodiment is the interconnection between a local data center and a cloud resource pool (VPC). In addition, it is also applicable to the interconnection between remote resource pools (VPCs) and between a work headquarters / branch and a resource pool (VPC).

[0087] Furthermore, the SDN controller in S1 includes hash table entries for storing IPSec SA information.

[0088] The hash table entries include the server identifier that reported the IPSec SA information.

[0089] Depend on Figure 6 The specific flowchart of data traffic forwarding is shown. The SDN controller manages IPSec VPN1 (the primary IPSec server) and IPSec VPN2 (the backup IPSec server) in the diagram and issues IPSec configurations to them.

[0090] Furthermore, in S2, turning a standby IPSec server into a primary IPSec server means turning any other server in the AS_PATH attribute with a priority second only to the primary IPSec server into a primary IPSec server.

[0091] The AS_PATH attribute is an attribute included in the Anycast IP routing information published when the server establishes a BGP neighbor with the SDN controller, and it serves as a basis for determining server priority.

[0092] In this embodiment, not only can the primary and backup IPSec servers be selected based on the length of the AS_PATH attribute in BGP, but primary and backup routing can also be achieved by modifying methods such as weight, local-preference, and MED.

[0093] like Figure 7 The diagram shows the structure of a remote access VPN implementation device based on an SDN controller provided in this application embodiment. Figure 2 The remote access VPN implementation device based on an SDN controller provided in this application embodiment is used as a backup IPSec server and includes a synchronization module, a replacement module, a forwarding module, a receiving module, and a reply module.

[0094] Synchronization module: Used to receive IPSec SA sent by the primary IPSec server through the SDN controller;

[0095] Alternate module: When the primary IPSec server experiences a transmission failure, the backup IPSec server takes over as the primary IPSec server and receives data traffic from the VPC cloud host (vm).

[0096] Forwarding module: Used to forward data traffic to the client's IPsec server;

[0097] Receiving module: Used to receive response data traffic from the client's IPsec server;

[0098] Response module: Used to forward response data traffic to VPC cloud host (VM).

[0099] In this embodiment, the synchronization module first receives the IPSec SA sent by the primary IPSec server through the SDN controller; then, in the replacement module, when the primary IPSec server experiences a transmission failure, the backup IPSec server becomes the primary IPSec server and receives data traffic sent by the VPC cloud host (vm); then, the forwarding module forwards the data traffic to the client IPSec server; next, the receiving module receives the reply data traffic from the client IPSec server; finally, the reply module forwards the reply data traffic to the VPC cloud host (vm).

[0100] The technical solutions described in the above embodiments of this application have at least the following technical effects or advantages: By combining Anycast IP, BGP, and AS_PATH, this method enables the simultaneous deployment of primary and backup servers, which is more time-saving and convenient compared to the prior art where server failure is detected only after service interruption and then the server is rebuilt; at the same time, the SDN controller receives the SA information reported by the northbound interface of the primary IPSec server, and then the SDN controller distributes the SA information to other backup IPSec servers, thus eliminating the need to maintain a separate backup channel.

[0101] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0102] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0103] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0104] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1The steps of the function specified in one or more boxes.

[0105] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the invention.

[0106] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. A method for implementing remote access VPN based on an SDN controller, used as a primary IPSec server, characterized in that, Includes the following steps: S1 receives data traffic from the VPC cloud host (vm); S2, negotiate IPSec SA with the client's IPSec server. When the IPSec configuration parameters of both ends are consistent, the negotiation is successful and IPSec SA information is generated. S3 sends the IPSec SA to the backup IPSec server via the SDN controller; S4 forwards data traffic to the client's IPsec server; S5 receives response data traffic from the client's IPsec server; S6 forwards the response data traffic to the VPC cloud host (vm); The process before step S1 also includes: determining the primary IPSec server; The steps to determine the primary IPSec server are as follows: Select multiple servers deployed in the cloud resource pool, connect the SDN controller to the multiple servers and configure the same Anycast IP on them, and establish a BGP neighbor with the SDN controller to publish Anycast IP routing information. Based on the AS_PATH attribute in the routing information, evaluate the priority of each server and select the one with the highest priority as the primary IPSec server. The primary IPSec server reports IPSec SA information to the SDN controller via the northbound interface.

2. The remote access VPN implementation method based on an SDN controller as described in claim 1, characterized in that: The SDN controller in S3 includes hash table entries for storing IPSec SA information.

3. The remote access VPN implementation method based on an SDN controller as described in claim 2, characterized in that: The hash table entry includes the server identifier that reported the IPSec SA information.

4. A remote access VPN implementation device based on an SDN controller, used as a primary IPSec server, characterized in that, It includes an acquisition module, a negotiation module, a reporting module, a forwarding module, a receiving module, and a response module: Acquisition module: Used to receive data traffic sent by VPC cloud hosts (VMs); Negotiation module: Used to negotiate IPSec SA with the client's IPSec server. When the IPSec configuration parameters of both ends are consistent, the negotiation is successful and IPSec SA information is generated. Reporting module: Used to send IPSec SAs to the backup IPSec server via the SDN controller; Forwarding module: Used to forward data traffic to the client's IPsec server; Receiving module: Used to receive response data traffic from the client's IPsec server; Response module: Used to forward response data traffic to VPC cloud host (VM); Before receiving data traffic from a VPC cloud host (vm), the process also includes: determining the primary IPSec server; The steps to determine the primary IPSec server are as follows: Select multiple servers deployed in the cloud resource pool, connect the SDN controller to the multiple servers and configure the same Anycast IP on them, and establish a BGP neighbor with the SDN controller to publish Anycast IP routing information. Based on the AS_PATH attribute in the routing information, evaluate the priority of each server and select the one with the highest priority as the primary IPSec server. The primary IPSec server reports IPSec SA information to the SDN controller via the northbound interface.

5. A method for implementing remote access VPN based on an SDN controller, used as a backup IPSec server, characterized in that, Includes the following steps: S1 receives the IPSec SA sent by the primary IPSec server through the SDN controller; S2, when the primary IPSec server has a sending failure, the backup IPSec server becomes the primary IPSec server and receives data traffic sent from the VPC cloud host (vm). S3 forwards data traffic to the client's IPsec server; S4 receives response data traffic from the client's IPsec server; S5 forwards the response data traffic to the VPC cloud host (vm); Before receiving the IPSec SA from the primary IPSec server through the SDN controller, the process also includes: determining the primary IPSec server; The steps to determine the primary IPSec server are as follows: Select multiple servers deployed in the cloud resource pool, connect the SDN controller to the multiple servers and configure the same Anycast IP on them, and establish a BGP neighbor with the SDN controller to publish Anycast IP routing information. Based on the AS_PATH attribute in the routing information, evaluate the priority of each server and select the one with the highest priority as the primary IPSec server. The primary IPSec server reports IPSec SA information to the SDN controller via the northbound interface.

6. The remote access VPN implementation method based on an SDN controller as described in claim 5, characterized in that: The SDN controller in S1 includes hash table entries for storing IPSec SA information.

7. The remote access VPN implementation method based on an SDN controller as described in claim 6, characterized in that: The hash table entry includes the server identifier that reported the IPSec SA information.

8. The remote access VPN implementation method based on an SDN controller as described in claim 5, characterized in that: In S2, turning the standby IPSec server into the primary IPSec server means turning other servers in the AS_PATH attribute whose priority is second only to the primary IPSec server into the primary IPSec server. The AS_PATH attribute is an attribute included in the Anycast IP routing information published when the server establishes a BGP neighbor with the SDN controller, and it serves as a basis for determining server priority.

9. A remote access VPN implementation device based on an SDN controller, used as a backup IPSec server, characterized in that, It includes a synchronization module, a replacement module, a forwarding module, a receiving module, and a reply module: Synchronization module: Used to receive IPSec SA sent by the primary IPSec server through the SDN controller; Alternate module: When the primary IPSec server experiences a transmission failure, the backup IPSec server takes over as the primary IPSec server and receives data traffic from the VPC cloud host (vm). Forwarding module: Used to forward data traffic to the client's IPsec server; Receiving module: Used to receive response data traffic from the client's IPsec server; Response module: Used to forward response data traffic to VPC cloud host (VM); Before receiving the IPSec SA from the primary IPSec server through the SDN controller, the process also includes: determining the primary IPSec server; The steps to determine the primary IPSec server are as follows: Select multiple servers deployed within the cloud resource pool, connect these servers to the SDN controller, configure the same Anycast IP on each server, establish a BGP neighbor with the SDN controller to publish Anycast IP routing information, evaluate the priority of each server based on the AS_PATH attribute in the routing information, and select the server with the highest priority as the primary IPSec server; The primary IPSec server reports IPSec SA information to the SDN controller through the northbound interface.

Images