Method and device for realizing high reliability of NAT gateway of NFV

Abstract

The application provides a method for realizing high reliability of an NFV NAT gateway, comprising: establishing a NAT gateway group, the NAT gateway group having a plurality of different NFV computing nodes, each NFV computing node corresponding to a member of the gateway group, the member being a plurality of virtual machines; monitoring the virtual machines in terms of traffic, CPU and memory; when a monitoring index exceeds a preset threshold, the NFV controller reminds a customer to give an alarm, and a background dynamically adds a new gateway group member to expand the NAT gateway group. The method provided by the application realizes the clustering of the NAT gateway, realizes continuous session drop during NAT gateway switching through synchronous session, realizes rapid switching of a link between the NAT gateway and an upper-layer switch through rapid detection of the state of the NAT gateway and BFD, and solves the problem of long packet loss time during traffic switching after the NAT gateway fails.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, in particular to a method and device for realizing high reliability of NAT gateway of NFV. BACKGROUND

[0002] NAT gateway (NAT Gateway) is a network cloud service supporting IP address conversion, which can provide network address translation (Network Address Translation) for computing instances in a virtual private cloud (Virtual Private Cloud, VPC). Multiple elastic cloud hosts can share elastic IP access to the Internet (SNAT) or multiple elastic cloud hosts can provide Internet services (DNAT), protecting private network information from being directly exposed to the public network. The NAT gateway is an entrance and exit of public network traffic in the VPC.

[0003] In the related art, the session session of the NAT gateway is not synchronized, which can cause the session to be lost when the NAT gateway is switched and the session needs to be re-established. SUMMARY

[0004] The present application proposes a method and device for realizing high reliability of NAT gateway of NFV to solve the existing problems, and the specific technical solutions are as follows:

[0005] In the first aspect of the present application, a coroutine-based event scheduling method is provided, which includes: establishing a NAT gateway group, the NAT gateway group having a plurality of different NFV computing nodes, each of the NFV computing nodes corresponding to a member of the gateway group, and the member being a plurality of virtual machines; monitoring the virtual machines in terms of traffic, CPU, memory, etc.; when the monitoring index exceeds a preset threshold, the NFV controller reminds the customer to alarm, and a new gateway group member is dynamically added in the background to expand the NAT gateway group.

[0006] In some embodiments, the establishment of the NAT gateway group, the NAT gateway group having a plurality of different NFV computing nodes, each of the NFV computing nodes corresponding to a member of the gateway group, and the member being a plurality of virtual machines, includes: designating a member of the NAT gateway group as a leader, and the members other than the leader as members; the leader sends a multicast to synchronize session session information with other members; and the member synchronizes its own session session information with the leader member through unicast.

[0007] In some embodiments, the method further includes:

[0008] To launch the network element node, different types of network elements are created for each computing node.

[0009] In some implementations, the NFV controller creates different types of network elements for each compute node to start up the network element nodes, including: the NAT network element detecting whether it has received a probe packet; if the NAT network element receives a probe packet, it replies with a packet to inform the NFV controller that its working status is normal.

[0010] In some implementations, the NFV controller creates different types of network elements for each computing node to bring up the network element nodes, and further includes: if the NAT network element does not receive the probe message, the NFV controller actively takes the NAT network element offline and destroys it.

[0011] Secondly, this application proposes an apparatus for achieving high reliability of an NFV NAT gateway, comprising: a basic module for establishing a NAT gateway group, the NAT gateway group having multiple different NFV compute nodes, each of the NFV compute nodes corresponding to members of the gateway group, the members being multiple virtual machines; a monitoring module for monitoring the virtual machines in terms of traffic, CPU, memory, etc.; and a scaling module for dynamically adding new gateway group members to scale the NAT gateway group when monitoring indicators exceed preset thresholds, with the NFV controller alerting the client and the background system dynamically adding new gateway group members.

[0012] In some implementations, the basic module further includes: a designation module, which designates one member of the NAT gateway group as the leader and other members as members; a synchronization module, which is used by the leader to send multicast to synchronize session information with other members; and a unicast module, which is used to synchronize its own session information with the leader member via unicast.

[0013] In some implementations, the device further includes: a loopback port and a physical leaf device interface to initiate BFD detection, wherein the BFD detection is used to determine the fault point between the smart network card and the NAT element if the BFD1 detection on the uplink leaf switch to the smart network card is normal after a NAT network element failure.

[0014] In some embodiments, the device further includes: a detection module for determining whether the NAT network element has received a probe packet; and a response module for responding to the NFV controller with a packet to inform it that its operating status is normal when the NAT network element receives the probe packet.

[0015] In some implementations, it also includes a startup module, which is used to start the network element nodes by creating different types of network elements for each computing node.

[0016] A third aspect of the present invention provides an electronic device, the electronic device comprising:

[0017] At least one processor; and,

[0018] A memory that is communicatively connected to at least one processor; wherein,

[0019] The memory stores instructions that can be executed by at least one processor, such that the at least one processor can perform the method steps proposed in the first aspect of the present invention.

[0020] In a fourth aspect of the present invention, a computer-readable storage medium is provided, which stores a computer program that, when executed by a processor, implements the method steps proposed in the first aspect of the present invention.

[0021] This application proposes a method for achieving high reliability of NAT gateways in NFV, comprising: establishing a NAT gateway group, wherein the NAT gateway group has multiple different NFV compute nodes, each of which corresponds to a member of the gateway group, the member being multiple virtual machines; monitoring the virtual machines for traffic, CPU, memory, etc.; when the monitoring indicators exceed preset thresholds, the NFV controller alerts the client, and the background dynamically adds new gateway group members to expand the NAT gateway group. This application proposes a method for achieving high reliability of NAT gateways in NFV to achieve NAT gateway clustering, and simultaneously ensures uninterrupted session switching during NAT gateway switching by synchronizing session sessions. Furthermore, it achieves rapid link switching between the NAT gateway and the uplink switch by quickly detecting the NAT gateway status and combining BFD, thus solving the problem of long packet loss time during traffic switching after NAT gateway failure. Attached Figure Description

[0022] The accompanying drawings, which are incorporated in and form a part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure.

[0023] Figure 1 This is a schematic diagram of the electronic device structure of the hardware operating environment involved in the embodiments of this application;

[0024] Figure 2 This is a flowchart illustrating the steps of a method for achieving high reliability of an NFV NAT gateway, as provided in an embodiment of this application. Detailed Implementation

[0025] To make the above-mentioned objectives, features, and advantages of this application more apparent and understandable, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments. Obviously, the described embodiments are only some, not all, of the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0026] If AT gateway session synchronization is not performed, session loss will occur during virtual network element (NFV) failover. When traffic switches to the standby NAT gateway, the session needs to be re-established, resulting in a noticeable service interruption for users. Because NAT gateways handle a large number of sessions, traditional hardware uses RBM technology to synchronize sessions between primary and standby devices. RBM relies on TCP for synchronization, leading to a large number of synchronized packets on both devices. This typically requires a dedicated synchronization line, placing high demands on deployment and generally supporting only two devices (primary and standby), making it unsuitable for public cloud NFV network element scenarios. Failure to synchronize NAT gateway session data will result in session loss during NAT gateway failover, necessitating session re-establishment.

[0027] Because the NAT gateway is deployed using NFV virtual machines, when a failure occurs within the virtual machine, the physical network interface card (NIC) on the server will not go down. Consequently, the uplink switch will not immediately detect the NAT gateway failure. Traffic originally destined for the NAT gateway will still be routed through the original path to the failed virtual machine, resulting in dropped service traffic. Even if the NFV control platform detects the virtual machine failure and initiates a switchover, the uplink switch will wait until ARP aging occurs before switching traffic to the backup NAT gateway, leading to packet loss time exceeding several seconds. The NAT gateway's lack of rapid detection and switching capability contributes to the prolonged packet loss time.

[0028] Based on this, this application proposes a method and apparatus for achieving high reliability of NFV NAT gateways to improve the above-mentioned problems.

[0029] The following is a brief explanation of some of the technical terms mentioned in this application.

[0030] Definitions of abbreviations and key terms

[0031] SDN (Software-Defined Network)

[0032] OVS (Open vSwitch, Virtual Switch)

[0033] NFV (Network Functions Virtualization)

[0034] NAT (Network Address Translation)

[0035] VXLAN (Virtual eXtensible LAN)

[0036] SNAT (Source Address Translation) allows multiple cloud hosts within a VPC to actively access the internet via the same public IP address. It can be used to build a public network exit point for a VPC, allowing users to share Elastic IP addresses to access the internet, flexibly supporting various deployment modes. Through the SNAT function of a NAT gateway, resources within a VPC without a public IP address can directly access the public network.

[0037] DNAT (Destination Address Translation) is used to map the private IP addresses, protocols, and ports of cloud hosts within a VPC to public IP addresses, protocols, and ports, making services on the cloud hosts accessible to external users. It provides DNAT port-level forwarding functionality, enabling cloud services to easily provide services to the Internet while simultaneously saving a significant amount of elastic public IP addresses.

[0038] The scheme of this application will be further described below with reference to the accompanying drawings.

[0039] Reference Figure 1 , Figure 1 This is a schematic diagram of the electronic device structure of the hardware operating environment involved in the embodiments of this application.

[0040] like Figure 1As shown, the electronic device may include: a processor 1001, such as a central processing unit (CPU), a communication bus 1002, a user interface 1003, a network interface 1004, and a memory 1005. The communication bus 1002 is used to enable communication between these components. The user interface 1003 may include a display screen or an input unit such as a keyboard; optionally, the user interface 1003 may also include a standard wired interface or a wireless interface. The network interface 1004 may optionally include a standard wired interface or a wireless interface (such as a Wi-Fi interface). The memory 1005 may be a high-speed random access memory (RAM) or a stable non-volatile memory (NVM), such as a disk drive. The memory 1005 may also optionally be a storage device independent of the aforementioned processor 1001.

[0041] Those skilled in the art will understand that Figure 1 The structure shown does not constitute a limitation on the electronic device and may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0042] like Figure 1 As shown, the memory 1005, which serves as a storage medium, may include an operating system, a data storage module, a network communication module, a user interface module, and electronic programs.

[0043] exist Figure 1 In the illustrated electronic device, the network interface 1004 is mainly used for data communication with the network server; the user interface 1003 is mainly used for data interaction with the user; the processor 1001 and the memory 1005 in the electronic device of the present invention can be set in the electronic device, and the electronic device calls a method for implementing high reliability of NAT gateway for NFV stored in the memory 1005 through the processor 1001, and executes the method for implementing high reliability of NAT gateway for NFV provided in the embodiment of this application.

[0044] Reference Figure 2 Based on the aforementioned hardware operating environment, embodiments of this application provide a method for achieving high reliability of an NFV NAT gateway, which may specifically include the following steps:

[0045] S201: Establish a NAT gateway group, which has multiple different NFV compute nodes. Each NFV compute node corresponds to a member of the gateway group, and the member is multiple virtual machines.

[0046] On the NFV controller, a NAT gateway group is set up. The members of this NAT gateway are distributed across different NFV compute nodes and share a common external address. In this way, traffic load can be distributed among the members that make up the NAT gateway group through equal-cost routing.

[0047] S202: Monitor the virtual machine for traffic, CPU, memory, etc.

[0048] S203: When the monitoring indicators exceed the preset threshold, the NFV controller reminds the customer to issue an alarm, and the background dynamically adds new gateway group members to expand the capacity of the NAT gateway group.

[0049] Within a NAT gateway group, all members are dynamically started and destroyed by the NFV controller. The NFV controller monitors the traffic, CPU, and memory of each virtual machine in the NAT gateway group. This system is responsible for collecting and reporting statistics from all network element nodes to the operations and maintenance or product monitoring system. It deploys sys-agent on network element nodes to obtain relevant statistics from OVS, DPOS, and LB, including packet BBS, PPS, latency, and packet loss statistics at the level of network interface card, VPC, CPU, subnet, and connection count. Netprobe and DTC statistics are also written to Elasticsearch. The vnet-controller reads all statistical data from Elasticsearch and delivers the data to the operations and maintenance system via Kafka for display.

[0050] If any indicator exceeds 80% of the specification, the NFV controller will alert the customer and require them to purchase a new NAT network element node. At the same time, the backend will dynamically create new gateway group members to expand the gateway group, prioritizing the stability of the customer's traffic, and prompting the customer to purchase new network element nodes for expansion.

[0051] 4. Within the NAT gateway group, the NFV controller designates one member as the leader, and the others as members. The leader sends multicast messages every 60 seconds to synchronize session information with other members. Other members synchronize their session information with the leader via unicast. After receiving all messages from the leader, each member proactively sends more session information than the leader. Members do not proactively send session information to each other, significantly reducing the number of synchronization messages within the gateway group. When the leader fails and is detected by the NFV controller, the NFV controller designates another member as the new leader to synchronize session information with the other members. The specific synchronization message format is as follows:

[0052] Index Contents Update Record Point 01 10 Session Information 001

[0053] The index serves as the sequential number for the 10 session entries, while the content contains the specific session information. The update record point serves as a record of session updates. During the initial session synchronization, the content of the 10 session entries is sent, along with an update record point. Subsequent synchronizations only require sending the index number and the previous update record point, provided the session content remains unchanged. If the content of these 10 sessions changes locally, the updated session content and the update record point incremented by 1 are sent during the update process. This allows the recipient to update the corresponding session information and record the new update record point. This reduces the number of message exchanges.

[0054] In some implementations, the establishment of a NAT gateway group includes multiple different NFV compute nodes, each of which corresponds to a member of the gateway group, which is a plurality of virtual machines. This includes: designating one member of the NAT gateway group as a leader, and other members as members; the leader sending multicast to synchronize session information with other members; and members unicasting their own session information with the leader.

[0055] In some embodiments, the method further includes:

[0056] To launch the network element node, different types of network elements are created for each computing node.

[0057] In some implementations, the NFV controller creates different types of network elements for each compute node to start up the network element nodes, including: the NAT network element detecting whether it has received a probe packet; if the NAT network element receives a probe packet, it replies with a packet to inform the NFV controller that its working status is normal.

[0058] The NFV controller creates different types of network elements for each compute node to start up the network element nodes. Simultaneously, it sends a probe packet per second to the underlying NAT network elements to ensure their normal status and prevent virtual machines from entering a "dead" state. Once a NAT network element receives a probe packet, it immediately replies to the NFV controller to inform it that its working status is normal. If no probe reply is received, the NFV controller proactively takes the NAT network element offline and destroys it. At the same time, a new NAT network element is started on the new compute node to ensure service load balancing to meet customer purchase requirements. Since the newly started NAT gateway does not have previous service sessions, the cost value of the VTEP address of the newly started NAT gateway is incremented by 10, waiting for the new NAT gateway to join the NAT cluster and synchronize the previous service session sessions. After the service session synchronization is complete, the cost value of the VTEP address is restored to the default value, thus load balancing traffic is distributed to the newly started NAT gateway node.

[0059] In some implementations, the NFV controller creates different types of network elements for each computing node to bring up the network element nodes, and further includes: if the NAT network element does not receive the probe message, the NFV controller actively takes the NAT network element offline and destroys it.

[0060] Secondly, this application proposes an apparatus for achieving high reliability of an NFV NAT gateway, comprising: a basic module for establishing a NAT gateway group, the NAT gateway group having multiple different NFV compute nodes, each of the NFV compute nodes corresponding to members of the gateway group, the members being multiple virtual machines; a monitoring module for monitoring the virtual machines in terms of traffic, CPU, memory, etc.; and a scaling module for dynamically adding new gateway group members to scale the NAT gateway group when monitoring indicators exceed preset thresholds, with the NFV controller alerting the client and the background system dynamically adding new gateway group members.

[0061] In some implementations, the basic module further includes: a designation module, which designates one member of the NAT gateway group as the leader and other members as members; a synchronization module, which is used by the leader to send multicast to synchronize session information with other members; and a unicast module, which is used to synchronize its own session information with the leader member via unicast.

[0062] Since the traffic coming out of the NAT network element is encapsulated with VXLAN, when the NAT network element fails, the server's network card will not be in a DOWN state. The uplink access leaf physical device will not be able to detect the failure of the NAT network element through the status of the physical link. Therefore, it is impossible to quickly switch traffic from the failed NAT network element to other normally functioning network elements.

[0063] In some implementations, the device further includes: a loopback port and a physical leaf device interface to initiate BFD detection, wherein the BFD detection is used to determine the fault point between the smart network card and the NAT element if the BFD1 detection on the uplink leaf switch to the smart network card is normal after a NAT network element failure.

[0064] In some embodiments, the device further includes: a detection module for determining whether the NAT network element has received a probe packet; and a response module for responding to the NFV controller with a packet to inform it that its operating status is normal when the NAT network element receives the probe packet.

[0065] On the NAT network element, start a dedicated loopback interface and a physical leaf device interface to start BFD detection (BFD2). On the leaf device, this BFD detection needs to be attached to the next hop of all VXLANs associated with this NAT network element. At the same time, start an interface on the smart network card (or Linux bridge) to establish BFD detection (BFD1) with the Leaf switch. This BFD detection is attached to the physical network port of the leaf device connected to this server. When a NAT element fails, the BFD2 detection from the NAT element to the upstream leaf switch goes down. If the BFD1 detection from the upstream leaf switch to the smart NIC (or Linux bridge) is normal, the fault lies between the smart NIC and the NAT element. This won't affect services on other network element nodes. Therefore, only services on this NAT element are switched to other NAT elements. Specifically, all next-hops of previously connected VXLANs related to this NAT element are removed from the switch. Because the NAT element's VTEP is an equal-cost route, traffic will automatically switch to other NAT elements. The upstream leaf switch can quickly detect the NAT element failure and rapidly switch VXLAN traffic destined for this NAT element to other NAT elements. Simultaneously, the NFV controller starts a new node for the NAT element as described in the previous step.

[0066] When BFD1 detects a failure, it indicates a fault in the link between the switch and the smart NIC (or Linux bridge). The upstream leaf switch immediately drops the port connected to this physical server, thus switching the routing to another server. The NFV controller then follows the steps in step 5 to re-start a new corresponding network element node for all network element nodes on this server on the new server.

[0067] By following the steps above, the NAT gateway can achieve elastic scaling and rapid status detection and traffic switching. Traffic interruption during switching is guaranteed to be within milliseconds, while ensuring no session loss, and users are completely unaware of the traffic switching.

[0068] In some implementations, it also includes a startup module, which is used to start the network element nodes by creating different types of network elements for each computing node.

[0069] Based on the same inventive concept, embodiments of this application also provide an electronic device, the electronic device comprising:

[0070] At least one processor; and,

[0071] A memory that is communicatively connected to at least one processor; wherein,

[0072] The memory stores instructions that can be executed by at least one processor, such that the instructions are executed by at least one processor to enable at least one processor to perform the aforementioned method.

[0073] Based on the same inventive concept, embodiments of this application also provide a computer-readable storage medium storing a computer program, the computer program being executed by a processor using the aforementioned method.

[0074] Based on the same inventive concept, embodiments of this application also provide a computer program product that, when processed, implements the aforementioned method.

[0075] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, embodiments of the present invention can take the form of entirely hardware embodiments, entirely software embodiments, or embodiments combining software and hardware aspects. Furthermore, embodiments of the present invention can take the form of computer program products implemented on one or more computer-usable vehicles (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0076] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, terminal devices (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing terminal device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing terminal device, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A system that specifies functions in one or more boxes.

[0077] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing terminal device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including an instruction set implemented in a process. Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0078] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal equipment, causing a series of operational steps to be performed on the computer or other programmable terminal equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable terminal equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0079] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. "And / or" indicates that either one or both can be chosen. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or terminal device. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or terminal device that includes said element.

[0080] The method and apparatus provided by the present invention have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A method for achieving high reliability of a NAT gateway in NFV, characterized in that, The method includes the following steps: Establish a NAT gateway group, which has multiple different NFV compute nodes. Each NFV compute node corresponds to a member of the gateway group, and the member is a multiple virtual machine. One member in the NAT gateway group is designated as the leader, and the other members are designated as members. The leader sends a multicast to synchronize session information with other members; The member synchronizes its session information with the leader member via unicast; Monitor the virtual machine in terms of traffic, CPU, and memory. When the monitoring indicators exceed the preset threshold, the NFV controller alerts the customer and dynamically adds new gateway group members in the background to expand the capacity of the NAT gateway group.

2. The method for achieving high reliability of an NFV NAT gateway according to claim 1, characterized in that, The method further includes: To launch the network element node, different types of network elements are created for each computing node.

3. The method for achieving high reliability of a NAT gateway for NFV according to claim 2, characterized in that, The NFV controller creates different types of network elements for each computing node to start up the network element nodes, including: The NAT network element detects whether a probe message has been received. If the NAT network element receives a probe message, it replies with a message to inform the NFV controller that its working status is normal.

4. The method for achieving high reliability of a NAT gateway for NFV according to claim 3, characterized in that, The NFV controller creates different types of network elements for each computing node to start up the network element nodes, and also includes: If the NAT network element does not receive the probe message, the NFV controller will proactively take the NAT network element offline and destroy it.

5. An apparatus for achieving high reliability of a NAT gateway for NFV, characterized in that, A method for implementing high reliability of a NAT gateway for NFV as described in claim 1 includes: The basic module is used to establish a NAT gateway group, which has multiple different NFV compute nodes. Each NFV compute node corresponds to a member of the gateway group, and the member is multiple virtual machines. A monitoring module is used to monitor the virtual machine in terms of traffic, CPU, and memory. The expansion module is used to prompt the customer to issue an alarm when the monitoring indicators exceed a preset threshold, and to dynamically add new gateway group members in the background to expand the capacity of the NAT gateway group. The basic module further includes: a designation module, which is used to designate one member of the NAT gateway group as the leader and other members as members; The synchronization module is used by the leader to send multicasts to synchronize session information with other members; The unicast module is used to synchronize its session information with the leader member via unicast.

6. The apparatus for achieving high reliability of an NFV NAT gateway according to claim 5, characterized in that, Also includes: The detection module is used to determine whether the NAT network element detection has received a probe packet; The response module is used to respond to the NAT network element when it receives a probe message to inform the NFV controller that its working status is normal. The startup module is used to start up the network element nodes by creating different types of network elements for each computing node.

Images