Method and apparatus for Layer 2 multipath VPN forwarding based on SDN data center

Abstract

This invention discloses a method and apparatus for Layer 2 multipath VPN forwarding in SDN data centers. The method includes the following steps: deploying a data center gateway module on virtual machines or physical machine nodes of a Data Center Interface (DCI) to form one or more data center gateway nodes. The data center gateway module includes a proxy module, a protocol module, and a data plane module, used to provide Layer 2 VPN interoperability in the data center; connecting the proxy module to an SDN controller and receiving DCIBGP configuration sent by the SDN controller; after receiving DCI virtual network information sent by the SDN controller, the proxy module calls an API to configure the data plane module and the protocol module; and sending data packets to the data center gateway node of the virtual machine or physical machine for forwarding. This method enables flexible network expansion through software, effectively improving network resource utilization efficiency.

Description

Technical Field

[0001] This invention relates to the field of electronic communications, and in particular to a method and apparatus for Layer 2 multipath VPN forwarding based on SDN data centers. Background Technology

[0002] With the rapid development of cloud services, big data, and artificial intelligence, data centers, as crucial carriers of information storage and processing capabilities, are the infrastructure supporting next-generation internet applications, and their applications are becoming increasingly widespread. The surge in user numbers and business volume has led to a continuous increase in the scale of data centers, resulting in ever-growing information flow between them. This has highlighted the growing demand for efficient and high-performance communication processing, giving rise to data center interconnect networks (DCIs). Data Center Interconnect (DCI) is a network solution that enables interconnection and interoperability between multiple data centers. To meet the needs of cross-regional operations, user access, and off-site disaster recovery scenarios, more and more organizations and enterprises are deploying multiple data centers in different regions, requiring the interconnection of these data centers.

[0003] In existing technologies, Layer 2 multi-path VPN forwarding in data centers can be achieved by interconnecting SDN data centers and traditional hardware gateway devices. SDN data centers are data centers that support SDN technology. However, this technical solution is limited by hardware network equipment resources and cannot achieve flexible network expansion. Alternatively, Layer 2 multi-path VPN forwarding in data centers can be achieved by fully interconnecting data centers. However, this technical solution has relatively complex networking and wastes network resources, makes disaster recovery difficult, and results in poor network reliability.

[0004] The information disclosed in this background section is intended only to enhance the understanding of the overall background of the invention and should not be construed as an admission or in any way implying that the information constitutes prior art known to those skilled in the art. Summary of the Invention

[0005] The purpose of this invention is to provide a method and apparatus for Layer 2 multipath VPN forwarding based on SDN data centers, which can achieve flexible network expansion through software and improve network resource utilization efficiency.

[0006] To achieve the above objectives, embodiments of the present invention provide a method for Layer 2 multipath VPN forwarding based on SDN data centers.

[0007] The method includes: deploying a data center gateway module (a multi-path VPN forwarding module based on SDN data center layer 2) on nodes of virtual machines or physical machines in the DCI to form one or more data center gateway nodes, wherein the data center gateway module includes a proxy module, a protocol module, and a data plane module, used to provide the ability for data center layer 2 VPN interconnection; connecting the proxy module to the SDN controller and receiving DCIBGP configuration sent by the SDN controller; after the proxy module receives the DCI virtual network information sent by the SDN controller, calling the API to configure the data plane module and the protocol module; and sending data packets to the data center gateway node of the virtual machine or physical machine for forwarding processing.

[0008] In one or more embodiments of the present invention, the DCIBGP configuration includes BGPAS and BGP neighbor information, the DCI virtual network information includes VNI and RT information, and the method further includes: the protocol module receiving initialization information sent by the proxy module and performing basic configuration; the protocol module establishing an IBGP connection with the local SDN and establishing an EBGP connection with other DCIs based on the BGPAS and BGP neighbor information; the control thread of the protocol module cyclically waiting to receive configuration information sent by the proxy module; the protocol module configuring VNI and RT rules based on the configuration information sent by the proxy module, wherein the RT rules include import-RT rules and export-RT rules; and the worker thread of the protocol module cyclically waiting to receive BGP routing information.

[0009] In one or more embodiments of the present invention, the working thread of the protocol module cyclically waits to receive BGP routing information, including: the protocol module queries whether there is a labelVNI and import-RT configuration that matches the label and RT carried by the received route based on the received BGP routing information; if so, the routing information is sent to the Vxlanentry and L2fib entries of the data plane module and the configuration is completed, wherein the Vxlanentry entry includes VMmac, VNI, and Vxlantunnel information; the protocol module queries whether there is a labelVNI and export-RT configuration that matches the label and RT carried by the received route based on the received BGP routing information; if so, the tunnel information is modified, the nexthop field of the routing packet of the route is modified to the local IP, and the packet is sent to the corresponding BGP neighbor according to the export-RT rule.

[0010] In one or more embodiments of the present invention, the method further includes: the data plane module receiving configuration information sent by the proxy module in real time, creating an internal / external Vxlan vtep interface and a virtual bridge according to the configuration information, and connecting the internal / external Vxlan vtep interface to the virtual bridge; the data plane module receiving routing information sent by the protocol module in real time, creating a Vxlanentry dynamic entry with MAC address as key and tunnel IP address as value, and storing the key-value association information in a dynamic array.

[0011] In one or more embodiments of the present invention, the forwarding process of sending data packets to the data center gateway node of the virtual machine or physical machine includes: the data plane module network card cyclically receiving data packets; when the packet format is a Vxlan packet and a local Vxlanvtep interface exists, the data packet is sent to the corresponding Vxlanvtep interface for decapsulation processing and then sent to the Layer 2 virtual bridge; based on the L2fib entry, the packet is forwarded to the corresponding Vxlanvtep interface for encapsulation processing through the Layer 2 virtual bridge.

[0012] In one or more embodiments of the present invention, the step of forwarding the data packet to the corresponding Vxlanvtep interface via the Layer 2 virtual bridge for encapsulation includes: querying the Vxlanentry table entry using the destination MAC address of the data packet as a hash key; if the corresponding Vxlanentry table entry exists, calculating the key value using the destination MAC address based on the CRC algorithm, and taking the modulo of the key value according to the length of the dynamic array associated with the corresponding Vxlanentry table entry to obtain the array index; retrieving the corresponding tunnelIP address from the dynamic array according to the array index as the destination tunnelIP of the encapsulation information to complete the header filling of the Vxlan packet; and sending the encapsulated data packet to the corresponding physical network card for forwarding.

[0013] In one or more embodiments of the present invention, when multiple data center gateway nodes are deployed within a DCI, all data center gateway nodes receive the same VPN configuration information except for the initial basic network configuration and BGPIP.

[0014] In one or more embodiments of the present invention, the method further includes: after receiving the same route, the protocol modules of different data center gateway nodes send it to their respective data plane modules; based on the export-RT rule, after modifying the nextop field of the route with their respective local IP, they send the packet to the SDN node adjacent to the data center gateway node or other DCI BGP neighbors.

[0015] In one or more embodiments of the present invention, the method further includes: based on the MAC address of the data packet, distributing different data packets equally to different data center gateway nodes for forwarding processing.

[0016] In one or more embodiments of the present invention, if a data center gateway node exists at the data center layer 2 after any data center gateway node is disconnected, VPN traffic will be forwarded normally.

[0017] In another aspect of the present invention, an apparatus for Layer 2 multipath VPN forwarding based on SDN data center is provided, which includes an installation module, an initialization module and a forwarding module.

[0018] The installation module is used to deploy the data center gateway module on the virtual machine or physical machine node of DCI to form one or more data center gateway nodes. The data center gateway module includes a proxy module, a protocol module and a data plane module, which are used to provide the ability of data center layer 2 VPN interconnection.

[0019] An initialization module is used to connect the proxy module to the SDN controller and receive DCIBGP configuration sent by the SDN controller; after the proxy module receives DCI virtual network information sent by the SDN controller, it calls the API to configure the data plane module and the protocol module.

[0020] The forwarding module is used to send data packets to the data center gateway node of the virtual machine or physical machine for forwarding processing.

[0021] In one or more embodiments of the present invention, the installation module is further configured to: receive initialization information sent by the proxy module and perform basic configuration; establish an IBGP connection with the local SDN and an EBGP connection with other DCIs based on the BGPAS and BGP neighbor information; the control thread of the protocol module cyclically waits to receive configuration information sent by the proxy module; the protocol module configures VNI and RT rules based on the configuration information sent by the proxy module, wherein the RT rules include import-RT rules and export-RT rules; and the worker thread of the protocol module cyclically waits to receive BGP routing information.

[0022] In one or more embodiments of the present invention, the installation module is further configured to: the protocol module, based on the received BGP routing information, query whether there is a labelVNI and import-RT configuration that matches the label and RT carried by the received route; if so, send the routing information to the Vxlanentry and L2fib entries of the data plane module and complete the configuration, wherein the Vxlan entry includes VMmac, VNI, and Vxlantunnel information; the protocol module, based on the received BGP routing information, query whether there is a labelVNI and export-RT configuration that matches the label and RT carried by the received route; if so, modify the tunnel information, modify the nexthop field of the routing packet of the route to the local IP, and send it to the corresponding BGP neighbor according to the export-RT rule.

[0023] In one or more embodiments of the present invention, the installation module is further configured to: receive configuration information sent by the proxy module in real time, create an internal / external Vxlanvtep interface and a virtual bridge according to the configuration information, and connect the internal / external Vxlanvtep interface to the virtual bridge; receive routing information sent by the protocol module in real time, create a Vxlanentry dynamic entry with MAC address as key and tunnelIP address as value, and store the key-value association information in a dynamic array.

[0024] In one or more embodiments of the present invention, the installation module is further configured to: when multiple data center gateway nodes are deployed within a DCI, all data center gateway nodes receive the same VPN configuration information except for the initial basic network configuration and BGPIP.

[0025] In one or more embodiments of the present invention, the forwarding module is further configured to: the data plane module network card cyclically receive data packets; when the packet format is a Vxlan packet and a local Vxlanvtep interface exists, send the data packet to the corresponding Vxlanvtep interface for decapsulation processing, and send it to the Layer 2 virtual bridge; based on the L2fib table entry, forward it to the corresponding Vxlanvtep interface for encapsulation processing through the Layer 2 virtual bridge.

[0026] In one or more embodiments of the present invention, the forwarding module is further configured to: use the destination MAC address of the data packet as a hash key to query the Vxlanentry table entry; if a corresponding Vxlan entry is found, calculate a key value using the destination MAC address based on the CRC algorithm, and take the modulo of the key value according to the length of the dynamic array associated with the corresponding Vxlanentry table entry to obtain an array index; extract the corresponding tunnelIP address from the dynamic array according to the array index as the destination tunnelIP of the encapsulation information to complete the header filling of the Vxlan packet; and send the encapsulated data packet to the corresponding physical network card for forwarding.

[0027] In one or more embodiments of the present invention, the forwarding module is further configured to: after receiving the same route, the protocol modules of different data center gateway nodes forward the route to their respective data plane modules; based on the export-RT rule, after modifying the nextop field of the route with their respective local IP, send the packet to the SDN node adjacent to the data center gateway node or other DCI BGP neighbors.

[0028] In one or more embodiments of the present invention, the forwarding module is further configured to: distribute different data packets equally to different data center gateway nodes for forwarding processing based on the MAC address of the data packets.

[0029] In one or more embodiments of the present invention, the forwarding module is further configured to: after disconnecting any data center gateway node, if a data center gateway node exists at the data center layer 2, the VPN traffic is forwarded normally.

[0030] Compared with existing technologies, the method and apparatus for SDN-based Layer 2 multipath VPN forwarding in data centers according to embodiments of the present invention can solve the problem of inflexible network expansion due to hardware network equipment resource limitations. By deploying data center gateway modules to physical machines or virtual machines, pure software forwarding can be achieved without relying on traditional hardware gateway devices. By deploying multiple data center gateway nodes within the same DCI, flexible network expansion can be achieved. It can solve the problems of complex DCI networking, difficult disaster recovery, and poor reliability. By evenly distributing different data packet traffic to different data center gateway nodes for forwarding processing, traffic distribution can be achieved, thereby improving the utilization rate of network resources. Normal communication can be achieved as long as at least one data center gateway node survives within a DCI, which can solve the disaster recovery problem and improve the reliability of traffic forwarding. Attached Figure Description

[0031] Figure 1This is a flowchart of a method for Layer 2 multipath VPN forwarding based on an SDN data center according to an embodiment of the present invention;

[0032] Figure 2 This is a detailed flowchart of a method for Layer 2 multipath VPN forwarding based on an SDN data center according to an embodiment of the present invention;

[0033] Figure 3 This is a detailed flowchart of a method for Layer 2 multipath VPN forwarding based on an SDN data center according to an embodiment of the present invention;

[0034] Figure 4 This is a detailed flowchart of a method for Layer 2 multipath VPN forwarding based on an SDN data center according to an embodiment of the present invention;

[0035] Figure 5 This is a flowchart illustrating the structure of a method for Layer 2 multipath VPN forwarding based on an SDN data center according to an embodiment of the present invention.

[0036] Figure 6 This is a structural diagram of a method for Layer 2 multipath VPN forwarding based on SDN data center according to an embodiment of the present invention;

[0037] Figure 7 This is a structural diagram of a method for Layer 2 multipath VPN forwarding based on SDN data center according to an embodiment of the present invention;

[0038] Figure 8 This is a flowchart illustrating the structure of a method for Layer 2 multipath VPN forwarding based on an SDN data center according to an embodiment of the present invention.

[0039] Figure 9 This is a structural diagram of an apparatus for Layer 2 multipath VPN forwarding based on an SDN data center according to an embodiment of the present invention;

[0040] Figure 10 This is a hardware structure diagram of a computing device for a method of Layer 2 multipath VPN forwarding based on SDN data center according to an embodiment of the present invention. Detailed Implementation

[0041] The specific embodiments of the present invention will now be described in detail with reference to the accompanying drawings, but it should be understood that the scope of protection of the present invention is not limited to the specific embodiments.

[0042] Unless otherwise expressly stated, throughout the specification and claims, the term "comprising" or its variations such as "including" or "comprises" shall be understood to include the stated elements or components without excluding other elements or other components.

[0043] The technical solutions provided by the various embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0044] Example 1

[0045] like Figure 1 As shown, an embodiment of the present invention describes a method for Layer 2 multipath VPN forwarding based on SDN data center, which includes the following steps.

[0046] In step S101, the data center gateway module is deployed on the virtual machine or physical machine node of the DCI to form one or more data center gateway nodes.

[0047] DCI, or Data Center Interconnect, is a network solution for achieving network interconnection and interoperability across data centers. It features flexible interconnection, high efficiency and security, and simplified operation and maintenance, meeting the needs of scenarios such as efficient data exchange and disaster recovery between data centers. Layer 2 interconnection, also known as data center server network interconnection, constructs a large Layer 2 network (L2 network) across different data center server network access layers to meet the Layer 2 network access requirements of scenarios such as dynamic migration of server clusters or virtual machines. One or more embodiments of this invention are implemented using SDN data center Layer 2 architecture.

[0048] Specifically, this invention provides an SDN-based Layer 2 multi-path VPN forwarding device for data centers, referred to as a data center gateway device, or SDGW module. The data center gateway module consists of modules including a proxy module, a protocol module, and a data plane module. This module can be flexibly installed and deployed on virtual machine or physical machine nodes to provide Layer 2 VPN interoperability in the data center, enabling cross-DCI interoperability between virtual machines or physical machines.

[0049] As can be seen, the naming rules of the three modules represent their main functions.

[0050] The agent module, also known as the AGENT module, refers to an agent that can continuously and autonomously play a role in a distributed system, possessing autonomy, interactivity, responsiveness, and initiative.

[0051] The protocol module is the BGP module. BGP (Border Gateway Protocol) is a routing protocol used to exchange network layer reachability information between routing domains.

[0052] The data plane module, or DATAPLANE module, refers to the data plane, which is responsible for data processing, forwarding, and status collection. Its core device is a switch, including physical switches or virtual switches. Furthermore, one or more data center gateway modules can be deployed within a DCI, meaning that one or more data center gateway nodes can exist within a DCI.

[0053] In this embodiment, a data center gateway module is deployed on a virtual machine or physical machine node to form one or more data center gateway nodes, i.e., SDGW nodes. The physical network configuration is initialized, and the proxy module, protocol module, and data plane module are installed and started. The initialization configuration of these three modules is completed sequentially by calling APIs, thus creating the necessary devices and rules for traffic forwarding.

[0054] In step S102, the data packet is sent to the data center gateway node of the virtual machine or physical machine for forwarding.

[0055] In this embodiment, if multiple data center gateway nodes are deployed within a DCI, the different data packets are evenly distributed to different data center gateway nodes for data forwarding processing based on the MAC address of the received traffic data packets.

[0056] Furthermore, even if any number of data center gateway nodes are disconnected within a DCI, VPN traffic can still be forwarded and processed normally as long as there are still data center gateway nodes that are functioning normally within that DCI.

[0057] Example 2

[0058] like Figures 1 to 7 As shown, an embodiment of the present invention describes a method for Layer 2 multipath VPN forwarding based on SDN data center, which includes the following steps.

[0059] In step S101, the data center gateway module is deployed on the virtual machine or physical machine node of the DCI to form one or more data center gateway nodes.

[0060] Specifically, install and start the agent module, protocol module, and data plane module of the data center gateway module.

[0061] Vxlan (Virtual Extended Local Area Network) is a virtualized tunneling communication technology that can build a virtual Layer 2 network through a Layer 3 network.

[0062] Vxlan-DCI tunneling technology uses Vxlan technology to achieve Layer 2 and Layer 3 interconnection of multiple data center networks.

[0063] VNI (Vxlan Network Identifier) ​​is the identifier for Vxlan networks, which is 24 bits long.

[0064] Vtep (VxlanTunnelEndPoint) is a Vxlan tunnel endpoint, a type of Vxlan edge device. Vxlan-related processing is performed on the Vtep, including identifying the Vxlan to which Ethernet data frames belong, performing Layer 2 forwarding of data based on the Vxlan, and encapsulating / decapsulating packets.

[0065] VxlanTunnel is a point-to-point logical tunnel between two VTEPs. After encapsulating data frames with Vxlan headers, UDP headers, and IP headers, the VTEP forwards the encapsulated packets to the remote VTEP through the Vxlan tunnel, where the remote VTEP decapsulates them.

[0066] like Figure 2 The diagram illustrates the relevant operations of the proxy module. After startup, the proxy module loads the configuration file and connects to the SDN controller according to the configuration. It receives the DCI BGP configuration sent by the SDN controller, where the DCI BGP configuration includes BGPAS and BGP neighbor information, and the BGP AS includes IBGP-AS and EBGP-AS.

[0067] The proxy module cyclically waits to receive DCI virtual network information sent by the SDN controller, wherein the DCI virtual network information, i.e., DCIVPN configuration information, includes VNI and RT information; and after receiving the DCI virtual network information, the proxy module calls the corresponding API to configure the data plane module and the corresponding API to configure the protocol module.

[0068] like Figure 3 The diagram illustrates the relevant operations of the protocol module. The proxy module calls the protocol module's API based on the initialization message to complete the configuration of BGPAS and BGP neighbors. The protocol module receives the initialization information sent by the proxy module and performs basic configuration. Based on the BGP AS and BGP neighbor information, the protocol module establishes an IBGP connection with the local SDN and an EBGP connection with other DCIs. The control thread of the protocol module continuously waits to receive configuration information sent by the proxy module. Based on the configuration information sent by the proxy module, the protocol module configures VNI and RT rules, where the RT rules include import-RT rules and export-RT rules. The worker thread of the protocol module continuously waits to receive BGPEVPN routing information.

[0069] RT (Route-Target) is an important attribute carried by VPN routes, which determines the sending, receiving, and filtering of VPN routes and is used for the distribution of routing information. RT is divided into import-RT and export-RT, which are used for importing and exporting routing information, respectively.

[0070] Specifically, the protocol module queries whether there is a labelVNI and import-RT configuration that matches the label and RT rule carried by the received BGP routing information. If there is, the routing information is sent to the Vxlanentry and L2fib entries of the data plane module and the configuration is completed. The Vxlanentry entry includes VMmac, VNI, and Vxlantunnel information.

[0071] On the other hand, the protocol module queries whether there is a labelVNI and export-RT configuration that matches the label and RT rule carried by the received BGP routing information. If it does, it modifies the tunnel information, changes the nexthop field of the routing packet of the route to the local IP, and sends it to the corresponding BGP neighbor according to the export-RT rule.

[0072] like Figure 4 The diagram illustrates the operations of the data plane module. The data plane module receives configuration information from the proxy module in real time, creates internal / external Vxlanvtep interfaces and virtual bridges based on the configuration information, and connects the internal / external Vxlanvtep interfaces to the virtual bridges. The data plane module also receives dynamic routing information from the protocol module in real time, creates Vxlanentry dynamic entries using the MAC address as the key and the tunnel IP address as the value, and stores the key-value association information in a dynamic array.

[0073] In step S102, the data packet is sent to the data center gateway node of the virtual machine or physical machine for forwarding.

[0074] like Figure 4 As shown, the network interface card (NIC) of the data plane module cyclically receives traffic data packets. When the packet format is a Vxlan packet and a local Vxlanvtep interface exists, the packet is sent to the corresponding Vxlanvtep interface for decapsulation and then sent to the Layer 2 virtual bridge. Based on the L2fib entry, the packet is forwarded to the corresponding Vxlanvtep interface for encapsulation through the Layer 2 virtual bridge.

[0075] Specifically, the encapsulation process is as follows: The destination MAC address of the packet is used as the hash key to query the Vxlanentry table entry; if a corresponding Vxlan entry is found using the destination MAC address as the hash key, a key value is calculated based on the destination MAC address using the CRC algorithm, and the key value is moduloed according to the length of the dynamic array associated with the corresponding Vxlanentry table entry to obtain the array index; the corresponding tunnel IP address in the dynamic array is retrieved based on the array index as the destination tunnel IP address for encapsulation information, completing the packet header filling; and the encapsulated data packet is sent to the corresponding physical network card for forwarding to the corresponding destination address.

[0076] In this embodiment, multiple data center gateway nodes can be deployed simultaneously within a single DCI. All data center gateway nodes receive identical VPN configuration information, except for their initial basic network configuration and BGPIP settings. Upon receiving the same BGPEVPN route, the protocol modules of different data center gateway nodes all forward it to their respective data plane modules. Based on the exportRT rule, they modify the nexthop field of the route's routing packet to the local IP address, and then send the packet to the adjacent SDN node or another DCI's BGP neighbor.

[0077] like Figure 5 and Figure 6 As shown, taking a virtual machine vm1 in the local DCI and a virtual machine vm2 in the peer DCI as an example, all data center gateway nodes within this DCI receive the vm1 route and distribute it to their respective local data plane modules, which then forward the vm1 route to N BGP neighbors in the peer DCI. Each data center gateway node also receives the vm2 route from the N BGP neighbors in the peer DCI and distributes it to its local DATAPLANE, generating entries as shown below. Figure 6 After the above interaction, all data center gateway nodes of the local DCI will have one VM1 and N VM2 L2VPN forwarding table entries.

[0078] like Figure 7 As shown, when there are more than two data center gateway nodes in a DCI, disconnecting any two data center gateway nodes will disconnect the BGP connections of these two data center gateway nodes from the BGP connections of other interconnected nodes. When the other data center gateway nodes discover that their BGP neighbors are disconnected, they will cancel the routes published by the BGP neighbors, send information to their respective data plane modules, delete the Vxlanentry entries based on the neighbors, and reorder the corresponding dynamic storage units.

[0079] After completing the above operations, subsequent incoming data packets, when querying the Vxlanentry table based on the destination MAC address, will still calculate the same value using the same key according to the CRC algorithm. However, as long as the value in the corresponding Vxlan entry table still exists, a new array index can be obtained by recalculating based on the new dynamic array length. This allows for the selection of a new tunnel IP and completion of packet forwarding. This achieves the following: if one or more data center gateway nodes in a DCI with multiple data center gateway nodes fail, and if there are still surviving data center gateway nodes in the DCI, communication between different DCIs can still be maintained, enabling normal traffic forwarding. This improves forwarding reliability and solves the disaster recovery problem.

[0080] Example 3

[0081] like Figure 8 As shown, an embodiment of the present invention describes a method for Layer 2 multipath VPN forwarding based on SDN data center, which includes the following steps.

[0082] Taking DCI1, which has one virtual machine vm1, and DCI2, which has one virtual machine vm2, as an example, this paper describes in detail the implementation process of cross-DCI interoperability between vm1 and vm2.

[0083] 1) Deploy one data center gateway module in DCI1 and two data center gateway modules in DCI2.

[0084] 2) The above data center gateway module has been started and initialized. The AGENT, BGP, and DATAPLANE modules have been configured accordingly, and BGP connections have been established between them. L2VPN has been configured for the two DCIs respectively.

[0085] 3) Taking the data center gateway node in DCI1 as an example, the data center gateway receives the VNIA configuration information from SDN, and its proxy module calls the API of its data plane module to create it. Based on the VNIA's local IP [1.1.1.1], an internal VxlanvtepA1 is created, and based on the external local IP [2.2.2.1], an external VxlanvtepA2 is created, and a virtual bridge BRA is created to connect to VxlanvtepA1 and VxlanvtepA2.

[0086] 4) Its proxy module calls the API of its protocol module to configure the VNIA's InternalRT1 (i.e., import-RT rule) and ExternalRT2 (i.e., export-RT rule).

[0087] 5) Its protocol module receives the BGPEVPN routes of type 2 and type 3 of virtual machine vm1, matches the RT1 rules and sends the information to its DAPALAME module to generate VxlanvtepA1entry.

[0088] 6) Its protocol module receives the vm2 routes published by the two data center gateway nodes of the peer DCI2 respectively, matches the RT2 rules and sends the information to its data plane module to generate VxlanvtepA2entry. The key of VxlanvtepA2entry is mac-vm2, and the values ​​are value[0]=3.3.3.1 and value[1]=3.3.3.2 respectively.

[0089] 7) The data center gateway node protocol module of DCI1 forwards the VM2 route to the local DCI1 SDN node and modifies the next hop of the route to the local internal localip1.1.1.1.

[0090] 8) The data center gateway node protocol module of DCI1 forwards the VM1 route to two BGP neighbors of DCI2 and modifies the next hop of the route to the local external IP address 2.2.2.1.

[0091] 9) After the routing table entries are mutually advertised, vm1 requests vm2. The DCI1's SDN, based on the protocol module of the local data center gateway node, can find the next hop as 1.1.1.1. At this time, it encapsulates the Vxlan header VNIA and the next hop address 1.1.1.1 and sends the packet to the data plane module of the DCI1's data center gateway node.

[0092] 10) After the network card of the data plane module receives the packet request, it sends the packet to the corresponding Vxlan vtepA1 for decapsulation processing, and forwards it to VxlanvtepA2 through the virtual bridge BrAL2. It uses the destination MAC, i.e., vm2-mac, as the hash key to look up the hash table of VxlanvtepA2entry. After the hash table is hit, key1 is calculated according to the MAC and CRC algorithm. Since the length of the macvalue array of vm2 is 2, key1%2 calculates to a value of 0. Therefore, value[0], i.e. 3.3.3.1, is taken out as the destination tunnel IP for Vxlan encapsulation.

[0093] 11) After encapsulation, the message is forwarded to node 3.3.3.1 in the data center gateway node of DCI2 for forwarding and processing. After arriving at DCI2, it continues to be forwarded in the same way, and finally the message is transmitted to the virtual machine vm2.

[0094] 12) The return response message from virtual machine vm2 to virtual machine vm1 follows the same process as above, enabling cross-DCI communication between vm1 and vm2.

[0095] If node 3.3.3.1 in the data center gateway node of DCI2 is down, the protocol module of the data center gateway node of DCI1 will find that node 3.3.3.1 is disconnected. It will then cancel the deletion of the 3.3.3.1 route and send information to its data plane module. It will delete the value of value[0] = 3.3.3.1 in the hash table of mac-vm2 of VxlanvtepA2. After reordering, value[0] = 3.3.3.2 is obtained. At this time, value[1] is released and the array length is calculated to be 1. After subsequent packets hit the hash table, the value calculated according to the MAC and CRC algorithms is still key1, but the array length becomes 1. After key1%1, the value is calculated to be 0. value[0], i.e., 3.3.3.2, is taken out. The address 3.3.3.2 is used as the tunnelIP of Vxlan to encapsulate the packet. Subsequent packets are sent to node 3.3.3.2 in the data center gateway node of DCI2. As described above, in a DCI with multiple data center gateway nodes, if one or more data center gateway nodes go down, the virtual machine can still maintain connectivity and traffic can be forwarded normally if there are still surviving data center gateway nodes in the DCI.

[0096] The method and apparatus for multi-path VPN forwarding based on SDN data center layer 2 according to embodiments of the present invention can solve the problem of inflexible network expansion due to hardware network equipment resource limitations. By deploying data center gateway modules to physical machines or virtual machines, pure software forwarding can be achieved without relying on traditional hardware gateway devices. By deploying multiple data center gateway nodes within the same DCI, flexible network expansion can be achieved. It can solve the problems of complex DCI networking, difficult disaster recovery, and poor reliability. By evenly distributing different data packet traffic to different data center gateway nodes for forwarding processing, traffic distribution can be achieved, thereby improving the utilization rate of network resources. Normal communication can be achieved as long as at least one data center gateway node survives within a DCI, thus solving the disaster recovery problem and improving the reliability of traffic forwarding.

[0097] like Figure 9 As shown, an apparatus for Layer 2 multipath VPN forwarding based on SDN data center according to a specific embodiment of the present invention is described.

[0098] In an embodiment of the present invention, the device for forwarding a Layer 2 multipath VPN based on an SDN data center includes an installation module 901, an initialization module 902, and a forwarding module 903.

[0099] Installation module 901 is used to deploy the data center gateway module on the virtual machine or physical machine node of DCI to form one or more data center gateway nodes, wherein the data center gateway module includes a proxy module, a protocol module and a data plane module, which are used to provide the ability of data center layer 2 VPN interconnection.

[0100] The initialization module 902 is used to connect the proxy module to the SDN controller and receive the DCIBGP configuration sent by the SDN controller; after the proxy module receives the DCI virtual network information sent by the SDN controller, it calls the API to configure the data plane module and the protocol module.

[0101] The forwarding module 903 is used to send data packets to the data center gateway node of the virtual machine or physical machine for forwarding processing.

[0102] The installation module 902 is further configured to: receive initialization information sent by the proxy module and perform basic configuration; establish IBGP connections with the local SDN and establish EBGP connections with other DCIs based on the BGPAS and BGP neighbor information; have the control thread of the protocol module cyclically wait to receive configuration information sent by the proxy module; configure VNI and RT rules based on the configuration information sent by the proxy module, wherein the RT rules include import-RT rules and export-RT rules; and have the worker thread of the protocol module cyclically wait to receive BGP routing information.

[0103] The installation module 902 is further configured to: The protocol module, based on the received BGP routing information, query whether there is a labelVNI and import-RT configuration that matches the label and RT carried by the received route; if so, send the routing information to the Vxlanentry and L2fib entries of the data plane module and complete the configuration, wherein the Vxlanentry entry includes VMmac, VNI, and Vxlantunnel information; The protocol module, based on the received BGP routing information, query whether there is a labelVNI and export-RT configuration that matches the label and RT carried by the received route; if so, modify the tunnel information, change the nexthop field of the routing packet of the route to the local IP, and send it to the corresponding BGP neighbor according to the export-RT rule.

[0104] The installation module 902 is also used for: the data plane module receiving configuration information sent by the proxy module in real time, creating internal / external Vxlanvtep interfaces and virtual bridges according to the configuration information, and connecting the internal / external Vxlanvtep interfaces to the virtual bridges; the data plane module receiving routing information sent by the protocol module in real time, creating Vxlanentry dynamic entries with MAC as the key and tunnelIP as the value, and storing the key-value association information in a dynamic array.

[0105] Installation module 902 is also used to ensure that when multiple data center gateway nodes are deployed within a DCI, all data center gateway nodes receive the same VPN configuration information, except for the initial basic network configuration and BGPIP.

[0106] The forwarding module 903 is also used for: the data plane module network card cyclically receiving data packets; when the packet format is a Vxlan packet and a local Vxlanvtep interface exists, sending the data packet to the corresponding Vxlanvtep interface for decapsulation processing, and then sending it to the Layer 2 virtual bridge; based on the L2fib table entry, forwarding it through the Layer 2 virtual bridge to the corresponding Vxlanvtep interface for encapsulation processing.

[0107] The forwarding module 903 is further configured to: use the destination MAC address of the data packet as a hash key to query the Vxlanentry table entry; if a corresponding Vxlanentry table entry is found, calculate the key value using the destination MAC address based on the CRC algorithm, and take the modulo of the key value according to the length of the dynamic array associated with the corresponding Vxlanentry table entry to obtain the array index; extract the corresponding tunnelIP address from the dynamic array according to the array index as the destination tunnelIP of the encapsulation information to complete the header filling of the Vxlan packet; and send the encapsulated data packet to the corresponding physical network card for forwarding.

[0108] The forwarding module 903 is also used for: after receiving the same route, the protocol modules of different data center gateway nodes forward it to their respective data plane modules; based on the export-RT rule, after modifying the nextop field of the route with their respective local IP, sending the packet to the SDN node adjacent to the data center gateway node or other DCI BGP neighbors.

[0109] The forwarding module 903 is also used to: based on the MAC address of the data packet, distribute different data packets equally to different data center gateway nodes for forwarding processing.

[0110] The forwarding module 903 is also used to: if a data center gateway node exists at the data center layer 2 after any data center gateway node is disconnected, VPN traffic will be forwarded normally.

[0111] Figure 10 A hardware structure diagram of a computing device 100 for Layer 2 multipath VPN forwarding in an SDN-based data center, according to an embodiment of this specification, is shown. Figure 10 As shown, the computing device 100 may include at least one processor 1001, a memory 1002 (e.g., non-volatile memory), a main memory 1003, and a communication interface 1004, and the at least one processor 1001, memory 1002, main memory 1003, and communication interface 1004 are connected together via a bus 1005. The at least one processor 1001 executes at least one computer-readable instruction stored or encoded in the memory 1002.

[0112] It should be understood that the computer-executable instructions stored in memory 1002, when executed, cause at least one processor 1001 to perform the above-described combinations in the various embodiments of this specification. Figure 1-10 The description includes various operations and functions.

[0113] In the embodiments of this specification, the computing device 100 may include, but is not limited to: personal computer, server computer, workstation, desktop computer, laptop computer, notebook computer, mobile computing device, smartphone, tablet computer, cellular phone, personal digital assistant (PDA), handheld device, messaging device, wearable computing device, consumer electronic device, etc.

[0114] According to one embodiment, a program product, such as a machine-readable medium, is provided. The machine-readable medium may have instructions (i.e., the elements implemented in software as described above), which, when executed by a machine, cause the machine to perform the above-described combinations of the various embodiments of this specification. Figure 1-10 The various operations and functions described. Specifically, a system or apparatus equipped with a readable storage medium storing software program code that implements the functions of any of the embodiments described above, and enabling the computer or processor of the system or apparatus to read and execute the instructions stored in the readable storage medium.

[0115] The method and apparatus for multi-path VPN forwarding based on SDN data center layer 2 according to embodiments of the present invention can solve the problem of inflexible network expansion due to hardware network equipment resource limitations. By deploying data center gateway modules to physical machines or virtual machines, pure software forwarding can be achieved without relying on traditional hardware gateway devices. By deploying multiple data center gateway nodes within the same DCI, flexible network expansion can be achieved. It can solve the problems of complex DCI networking, difficult disaster recovery, and poor reliability. By evenly distributing different data packet traffic to different data center gateway nodes for forwarding processing, traffic distribution can be achieved, thereby improving the utilization rate of network resources. Normal communication can be achieved as long as at least one data center gateway node survives within a DCI, thus solving the disaster recovery problem and improving the reliability of traffic forwarding.

[0116] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0117] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0118] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0119] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0120] The foregoing description of specific exemplary embodiments of the invention is for illustrative and explanatory purposes. These descriptions are not intended to limit the invention to the precise forms disclosed, and it will be apparent that many changes and variations can be made in accordance with the foregoing teachings. The exemplary embodiments were chosen and described in order to explain the specific principles of the invention and its practical application, thereby enabling those skilled in the art to implement and utilize various different exemplary embodiments of the invention, as well as various different choices and variations. The scope of the invention is intended to be defined by the claims and their equivalents.

Claims

1. A method for Layer 2 multipath VPN forwarding based on SDN data centers, characterized in that, The method includes: The data center gateway module is deployed on the virtual machine or physical machine node of DCI to form one or more data center gateway nodes. The data center gateway module includes a proxy module, a protocol module and a data plane module, which are used to provide the ability of data center layer 2 VPN interconnection. The proxy module is connected to the SDN controller and receives the DCI BGP configuration sent by the SDN controller. After receiving the DCI virtual network information sent by the SDN controller, the proxy module calls the API to configure the data plane module and the protocol module; and Data packets are sent to the data center gateway node of the virtual machine or physical machine for forwarding. The process of sending data packets to the data center gateway node of the virtual machine or physical machine for forwarding includes: the data plane module network card cyclically receiving data packets; when the packet format is a Vxlan packet and a local Vxlan VTEP interface exists, the packet is sent to the corresponding Vxlan VTEP interface for decapsulation processing and then sent to the Layer 2 virtual bridge; based on the L2 fib entry, the packet is forwarded through the Layer 2 virtual bridge to the corresponding Vxlan VTEP interface for encapsulation processing; The process of forwarding the data packet to the corresponding Vxlan VTEP interface via the Layer 2 virtual bridge for encapsulation includes: using the destination MAC address of the data packet as a hash key to query the Vxlan entry table; if a corresponding Vxlan entry table entry exists, calculating the key value using the destination MAC address based on the CRC algorithm, and taking the modulo of the key value according to the length of the dynamic array associated with the corresponding Vxlan entry table entry to obtain the array index; retrieving the corresponding tunnel IP address from the dynamic array according to the array index as the destination tunnel IP address of the encapsulation information to complete the header filling of the Vxlan packet; and sending the encapsulated data packet to the corresponding network interface card for forwarding.

2. The method for Layer 2 multi-path VPN forwarding based on SDN data center as described in claim 1, characterized in that, The DCI BGP configuration includes BGP AS and BGP neighbor information, the DCI virtual network information includes VNI and RT information, and the method further includes: The protocol module receives initialization information sent by the proxy module and performs basic configuration; The protocol module establishes an IBGP connection with the local SDN and an EBGP connection with other DCIs based on the BGP AS and BGP neighbor information. The control thread of the protocol module waits in a loop to receive configuration information sent by the proxy module; The protocol module configures VNI and RT rules based on the configuration information sent by the proxy module, wherein the RT rules include import-RT rules and export-RT rules; and The protocol module's worker thread loops and waits to receive BGP routing information.

3. The method for Layer 2 multi-path VPN forwarding based on SDN data center as described in claim 2, characterized in that, The protocol module's worker thread loops, waiting to receive BGP routing information, including: The protocol module queries whether there is a label VNI and import-RT configuration that matches the label and RT carried by the received BGP routing information. If there is, the routing information is sent to the Vxlan entry and L2 fib table entries of the data plane module and the configuration is completed. The Vxlan entry table entries include VM mac, VNI, and Vxlan tunnel information. The protocol module checks whether there is a label VNI and export-RT configuration that matches the label and RT carried by the received BGP routing information. If there is, it modifies the tunnel information, changes the nexthop field of the routing packet of the route to the local IP, and sends it to the corresponding BGP neighbor according to the export-RT rule.

4. The method for Layer 2 multi-path VPN forwarding based on SDN data center as described in claim 3, characterized in that, The method further includes: The data plane module receives configuration information sent by the proxy module in real time, creates internal / external Vxlan vtep interfaces and virtual bridges according to the configuration information, and connects the internal / external Vxlan vtep interfaces to the virtual bridges; The data plane module receives routing information sent by the protocol module in real time, creates a Vxlan entry dynamic table entry with MAC address as key and tunnel IP address as value, and stores the key-value association information in a dynamic array.

5. The method for Layer 2 multipath VPN forwarding based on SDN data center as described in claim 1, characterized in that, When multiple data center gateway nodes are deployed within a DCI, all data center gateway nodes receive the same VPN configuration information, except for the initial basic network configuration and BGP IP.

6. The method for Layer 2 multipath VPN forwarding based on SDN data center as described in claim 5, characterized in that, The method further includes: After receiving the same route, the protocol modules of different data center gateway nodes forward it to their respective data plane modules; Based on the export-RT rule, after modifying the nexthop field of the route with their respective local IPs, packets are sent to the SDN node adjacent to the data center gateway node or other DCI BGP neighbors.

7. The method for Layer 2 multipath VPN forwarding based on SDN data center as described in claim 5, characterized in that, The method further includes: Based on the MAC address of the data packet, different data packets are evenly distributed to different data center gateway nodes for forwarding.

8. The method for Layer 2 multipath VPN forwarding based on SDN data center as described in claim 5, characterized in that, If any data center gateway node is disconnected, VPN traffic will be forwarded normally if a data center gateway node exists at the data center layer 2.

9. An apparatus for Layer 2 multipath VPN forwarding based on SDN data centers, used to implement the method for Layer 2 multipath VPN forwarding based on SDN data centers as described in claim 1, characterized in that, The device further includes: The installation module is used to deploy the data center gateway module on the virtual machine or physical machine node of DCI to form one or more data center gateway nodes. The data center gateway module includes a proxy module, a protocol module and a data plane module, which are used to provide the ability of data center layer 2 VPN interconnection. An initialization module is used to connect the proxy module to the SDN controller and receive DCIBGP configuration sent by the SDN controller; after the proxy module receives DCI virtual network information sent by the SDN controller, it calls the API to configure the data plane module and the protocol module; and The forwarding module is used to send data packets to the data center gateway node of the virtual machine or physical machine for forwarding processing.

10. An electronic device, characterized in that, include: At least one processor; as well as A memory storing instructions that, when executed by the at least one processor, cause the at least one processor to perform the method of SDN-based data center Layer 2 multipath VPN forwarding as described in any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the method for Layer 2 multipath VPN forwarding based on SDN data center as described in any one of claims 1 to 8.

Images