Traditional network-based SDN construction method and device, electronic equipment and storage medium

Abstract

The application provides a traditional network-based SDN construction method and device, electronic equipment and storage medium. The method comprises: network planning; dividing different virtual private clouds, and configuring a corresponding VPN instance for each virtual private cloud; meanwhile, dividing each virtual private cloud into different subnets, assigning a corresponding subnet ID to each subnet, and configuring a centralized gateway on a core layer switch; configuring a subnet; for a physical server, configuring a switch interface, configuring a subnet ID on the switch, and dividing the corresponding switch interface into the subnet; and the switch performs subnet marking and unmarking according to the configured subnet ID to ensure the transmission of data packets in the network. The traditional network-based SDN construction method has the characteristics of supporting virtual private clouds of hybrid servers in a cloud scenario, access control list related configuration, and centralized configuration of virtualized servers.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of cloud computing network, and particularly relates to an SDN construction method and device based on a traditional network, an electronic device and a storage medium. BACKGROUND

[0002] With the development and popularity of cloud computing and cloud native, software-defined network (SDN) has a significant impact on the management of IT infrastructure and network design, which restructures network infrastructure, makes network control programmable, and enables enterprises to centrally control software at the edge of the network, thereby restructuring the original distributed control network architecture into centralized control.

[0003] In the traditional network, each device contains a tightly coupled control plane and data plane, which are integrated into a separate device box. The control plane of each device is distributed to each node of the network, and it is difficult to have a global control of the network situation of the whole network. After the routing calculation and topology change, each device needs to perform the routing calculation process again.

[0004] SDN separates the control plane in each network device from the physical hardware and hands it over to the virtualized network layer for processing. The entire virtualized network layer is loaded on the physical network, which screens the differences between the underlying physical forwarding devices and rebuilds the entire network in a virtual space. The data center virtualizes the physical server into multiple logical servers through virtualization technology, and SDN supports the management of the network of multiple logical servers and can also support the management of the network across data centers.

[0005] The existing SDN network solution mainly includes network Overlay and host Overlay, both of which require the purchase of specific network devices, the construction of new cloud resource pools, and the difficulty in planning the network with existing physical devices. In addition, network devices run very stably, and generally will not be replaced for 5 or even 10 years, so there are a large number of enterprises that currently have both traditional network architecture IT systems and virtualized businesses, and also need to divide the traditional network and the virtualized network. SUMMARY

[0006] Therefore, the present application aims to provide an SDN construction method and device based on a traditional network, an electronic device and a storage medium to solve the above problems.

[0007] To achieve the above purpose, the technical scheme of the present application is as follows:

[0008] In a first aspect, the present application provides an SDN construction method based on a traditional network, which comprises:

[0009] Network planning; dividing different virtual private clouds, and configuring corresponding VPN instances for each virtual private cloud; at the same time, dividing each virtual private cloud into different subnets, and assigning corresponding subnet IDs to each subnet, and configuring a centralized gateway in the core layer switch;

[0010] Configuring subnets;

[0011] For physical servers, configure switch interfaces, configure subnet IDs on the switch, and divide the corresponding switch interfaces into the subnet. The switch performs subnet tagging and untagging according to the configured subnet ID to ensure the transmission of data packets in the network.

[0012] For virtualized physical servers, configure switch interfaces to allow all subnets to pass through, configure br-business and br-ext bridges on the virtualized physical server, set the physical network card to promiscuous mode, add the physical network card to the br-ext bridge, create logical switches in the br-business bridge according to the divided subnets, and add virtual machine network cards to the logical switches. According to the allocated subnet ID, configure the corresponding subnet, aggregate multiple logical switches as sub-interfaces to a parent interface, and connect to the br-ext bridge through a patch interface.

[0013] Further, it also includes: configuring rules within the virtual private cloud; by configuring access control list rules to limit communication between subnets, the default traffic isolation between subnets within the virtual private cloud.

[0014] Further, it also includes: configuring rules between virtual private clouds; different virtual private clouds are isolated by default, and the import-extcommunity attribute is configured to enable intercommunication between different VPN instances.

[0015] Further, for physical servers, support multiple different subnet IDs for multiple network cards.

[0016] Further, it also includes: in response to communication traffic within the same subnet, forwarding and interacting through logical switches or layer 2 switches to maintain communication between physical servers and virtual machines;

[0017] In response to cross-subnet and cross-virtual private cloud communication traffic, forwarding and interacting through layer 3 switches to maintain communication between different subnets and different virtual private clouds.

[0018] In a second aspect, based on the same inventive concept, the present application also provides an SDN construction device based on a traditional network, the device comprising:

[0019] A network planning module is configured to network planning, divide different virtual private clouds, and configure a corresponding VPN instance for each virtual private cloud; meanwhile, each virtual private cloud is divided into different subnets, and each subnet is assigned a corresponding subnet ID, and a centralized gateway is configured on a core layer switch;

[0020] A subnet configuration module is configured to configure a subnet.

[0021] For a physical server, a switch interface is configured, a subnet ID is configured on the switch, and the corresponding switch interface is divided into the subnet, the switch performs subnet tagging and untagging according to the configured subnet ID to ensure the transmission of data packets in the network.

[0022] For a virtualized physical server, a switch interface is configured to allow all subnets to pass through, a br-business bridge and a br-ext bridge are configured on the virtualized physical server, a physical network card is set to a promiscuous mode, the physical network card is added to the br-ext bridge, a logical switch is created in the br-business bridge according to the divided subnets, and a virtual machine network card is added to the logical switch, a corresponding subnet is configured according to the assigned subnet ID, a plurality of logical switches are aggregated as a sub-interface on a parent interface, and the patch interface is connected to the br-ext bridge.

[0023] In a third aspect, based on the same inventive concept, the present application also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to realize the SDN construction method based on a traditional network according to the first aspect.

[0024] In a fourth aspect, based on the same inventive concept, the present application also provides a non-transitory computer readable storage medium, wherein the non-transitory computer readable storage medium stores computer instructions for causing the computer to execute the SDN construction method based on a traditional network according to the first aspect.

[0025] Compared with the prior art, the SDN construction method based on a traditional network, the device, the electronic device, and the storage medium have the following beneficial effects:

[0026] The SDN construction method based on a traditional network, the device, the electronic device, and the storage medium have the following beneficial effects: BRIEF DESCRIPTION OF DRAWINGS

[0027] The accompanying drawings, which form a part of the present application, are intended to provide further understanding of the present application and are incorporated herein in

[0028] Figure 1 A flow chart of the method for constructing the SDN based on the traditional network according to an embodiment of the present application;

[0029] Figure 2 A schematic diagram of the SDN network topology and traffic direction according to an embodiment of the present application;

[0030] Figure 3 A schematic diagram of the apparatus structure for constructing the SDN based on the traditional network according to an embodiment of the present application;

[0031] Figure 4 A schematic diagram of the hardware structure of the electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0032] In order to make the objects, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the embodiments and the accompanying drawings.

[0033] It should be noted that, unless otherwise defined, the technical terms or scientific terms used in the embodiments of the present application should be understood as the common meanings understood by those with ordinary skills in the art to which the present application belongs. The terms "first", "second" and similar terms used in the embodiments of the present application do not represent any order, number or importance, but are only used to distinguish different components. The terms "include", "contain" and similar terms mean that the elements or objects before the terms encompass the elements or objects listed after the terms and their equivalents, and do not exclude other elements or objects. The terms "connect" or "connected" and similar terms do not mean physical or mechanical connection, but can include electrical connection, whether direct or indirect. The terms "upper", "lower", "left", "right" and the like only represent relative positional relationships, and when the absolute positions of the described objects are changed, the relative positional relationships can also be changed accordingly.

[0034] The embodiments of the present application will be described in detail below with reference to the accompanying drawings.

[0035] Please refer to Figure 1 and Figure 2 The method for constructing the SDN based on the traditional network according to an embodiment of the present application includes the following steps:

[0036] Step S101, network planning; different virtual private clouds are divided, and a corresponding VPN instance is configured for each virtual private cloud; meanwhile, each virtual private cloud is divided into different subnets, and a corresponding subnet ID is allocated to each subnet, and a centralized gateway is configured in the core layer switch.

[0037] In some embodiments, further comprising:

[0038] Configuring rules within the virtual private cloud; by configuring access control list rules, communication between subnets is limited, and default traffic isolation between subnets within the virtual private cloud is achieved;

[0039] Specifically, the access control list (ACL) rule: ACL is a network security function for controlling traffic between subnets, open the ACL management interface, create a new ACL or select an existing ACL, create rules to allow or deny communication between specific subnets according to customer demand, source IP address, target IP address, protocol, port, etc. Conditions can be used to define rules, apply ACL rules to appropriate subnets or subsets of subnets, after configuring ACL rules, traffic between subnets will be limited, according to rule definition, only allowed communication can pass. By default, traffic between subnets will be isolated.

[0040] Configuring rules between virtual private clouds; different virtual private clouds are isolated by default, and import-extcommunity attribute is configured to enable intercommunication between different VPN instances.

[0041] Virtual private cloud (VPC) default traffic isolation requires additional import-extcommunity configuration to enable intercommunication between different VPN instances (vpn-instance).

[0042] Step S102, configuring subnets;

[0043] For physical servers, configure switch interfaces, configure subnet IDs on switches, and draw corresponding switch interfaces into the subnet, and the switch performs subnet tagging and untagging according to the configured subnet ID to ensure the transmission of data packets in the network, and supports multiple different subnet IDs for multiple network cards.

[0044] For the virtualization physical server, configuring the switch interface allows all subnets to pass, configuring the br-business bridge and the br-ext bridge on the virtualization physical server, setting the physical network card to the promiscuous mode, adding the physical network card to the br-ext bridge, being responsible for the transmission and reception of traffic, creating a logical switch in the br-business bridge according to the divided subnets, and adding the virtual machine network card to the logical switch, according to different subnets, mounting to different logical switches, according to the allocated subnet ID, configuring the corresponding subnet, aggregating multiple logical switches as sub-interfaces to a parent interface, and connecting the parent interface to the br-ext bridge through a patch interface.

[0045] Based on the existing network equipment in the enterprise traditional network, using part of the existing physical servers as virtualization and SDN control, and through the very mature vlan technology, distinguishing subnets and VPC (virtual private cloud), the SDN network based on the traditional network is constructed, supporting unified planning of the existing physical servers and the virtualized physical servers, including the same subnet, cross-subnet, and cross-VPC, supporting multiple business scenarios.

[0046] In some embodiments, referring to FIG. 1, the traffic in the SDN network is as follows: Figure 1

[0047] In response to the communication traffic in the same subnet, the logical switch or the layer 2 switch is used for forwarding and interaction, so as to maintain the communication between the physical servers and the virtual machines.

[0048] Specifically, in response to the access traffic in the same subnet, for the communication traffic between the physical servers, the ports connected to the same layer 2 switch are used for interaction, for the communication traffic between the virtual machines, the logical switch is used for forwarding the data packets to interact with each other, and for the communication traffic between the virtualized physical servers, the ports connected to the same layer 2 switch are used for interaction.

[0049] In response to the communication traffic across the subnets and the virtual private clouds, the layer 3 switch is used for forwarding and interaction, so as to maintain the communication between different subnets and different virtual private clouds.

[0050] Specifically, for the same VPC cross-subnet access, the gateway of the layer 3 switch is used for forwarding and interaction, and for the cross-VPC access, the gateway of the layer 3 switch is used for forwarding and interaction, so as to realize the communication and interaction between different subnets and different virtual private clouds.

[0051] In this embodiment, the SDN is constructed by using the existing network equipment and the physical servers, mainly including the underlay network configuration, the overlay network configuration, and the traffic scheduling. ​

[0052] Underlay network configuration refers to the configuration of physical connection in the network, which uses the same two-layer or three-layer network architecture as the existing traditional network, multiple physical servers are connected together by access layer switches or converged switches, and the subnet gateway is configured on the uppermost core layer switch. Some physical servers run existing services, and some physical servers need to be virtualized.

[0053] Overlay network configuration refers to the configuration of virtualized network. After the physical servers are virtualized into multiple logical servers, the logical servers are connected together, and the logical servers and the physical servers are connected together. The traffic of different subnets is identified by different vlanids. The gateway can be configured on the logical switch or the core layer switch to realize the two-layer intrasubnet communication and the three-layer intersubnet communication between the hybrid servers.

[0054] Traffic scheduling refers to the support of policy configuration between hybrid servers. Because the traffic can be identified by vlanid, VSI can be configured according to vlanid to support the configuration of virtual private cloud based on two-layer and three-layer communication, and support the configuration of ACL access control. Enterprises can divide the network according to their own business and security needs.

[0055] The SDN construction method based on the traditional network described in the embodiment is based on the existing network equipment, does not need to invest in the construction of new equipment, and only needs to set the configuration on the switch to upgrade the traditional data center to a hybrid cloud. The method has the characteristics of supporting the configuration of virtual private cloud (VPC) and access control list (ACL) related to hybrid servers in the cloud scenario, and the centralized configuration of virtualized servers.

[0056] It should be noted that the above describes some embodiments of the present application. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims can be performed in an order different from that described in the above embodiments and still achieve the desired result. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or sequential order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are possible or can be advantageous.

[0057] Based on the same inventive concept, the embodiments of the present application also provide an SDN construction device based on a traditional network corresponding to the method of any of the above embodiments.

[0058] As shown in Figure 3 The SDN construction device based on the traditional network comprises:

[0059] The network planning module 11 is configured to perform network planning, divide different virtual private clouds, configure a corresponding VPN instance for each virtual private cloud, divide each virtual private cloud into different subnets, assign a corresponding subnet ID to each subnet, and configure a centralized gateway on a core layer switch.

[0060] The subnet configuration module 12 is configured to configure a subnet.

[0061] For a physical server, a switch interface is configured, a subnet ID is configured on the switch, and the corresponding switch interface is divided into the subnet, the switch performs subnet tagging and untagging according to the configured subnet ID to ensure transmission of a data packet in the network.

[0062] For a virtualized physical server, a switch interface is configured to allow all subnets to pass through, a br-business bridge and a br-ext bridge are configured on the virtualized physical server, a physical network card is set to a promiscuous mode, the physical network card is added to the br-ext bridge, a logical switch is created in the br-business bridge according to the divided subnets, and a virtual machine network card is added to the logical switch, a corresponding subnet is configured according to the assigned subnet ID, a plurality of logical switches are aggregated as a sub-interface on a parent interface, and the patch interface is connected to the br-ext bridge.

[0063] For the convenience of description, the above apparatus is described in various modules according to functions. Of course, the functions of the modules can be implemented in one or more software and / or hardware in the implementation of the embodiments of the present application.

[0064] The apparatus of the above embodiments is used to implement the corresponding SDN construction method based on a traditional network in any of the above embodiments, and has the beneficial effects of the corresponding method embodiments, which are not described herein again.

[0065] Based on the same inventive concept, corresponding to the method of any of the above embodiments, the embodiments of the present application also provide an electronic device, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the SDN construction method based on a traditional network according to any of the above embodiments when executing the program.

[0066] Figure 4 A more specific hardware structure of an electronic device provided in the embodiment is shown, which can include a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040, and a bus 1050. The processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040 are connected to each other through the bus 1050 for communication between them inside the device.

[0067] The processor 1010 can be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an ASIC (Application Specific Integrated Circuit), or one or more integrated circuits, etc., for executing relevant programs to implement the technical solutions provided by the embodiments of the present specification.

[0068] The memory 1020 can be implemented in the form of a ROM (Read Only Memory), a RAM (Random Access Memory), a static storage device, a dynamic storage device, etc. The memory 1020 can store an operating system and other application programs, and when the technical solutions provided by the embodiments of the present specification are implemented by software or firmware, the relevant program codes are saved in the memory 1020 and called and executed by the processor 1010.

[0069] The input / output interface 1030 is configured to connect input / output modules to realize information input and output. The input / output modules can be configured as components in the device (not shown in the figure) or externally connected to the device to provide corresponding functions. The input devices can include a keyboard, a mouse, a touch screen, a microphone, various sensors, etc., and the output devices can include a display, a speaker, a vibrator, an indicator light, etc.

[0070] The communication interface 1040 is configured to connect a communication module (not shown in the figure) to realize the communication interaction between the device and other devices. The communication module can realize communication through a wired manner (such as USB, network cable, etc.) or through a wireless manner (such as mobile network, WIFI, Bluetooth, etc.).

[0071] The bus 1050 includes a channel for transmitting information between various components (such as the processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040) of the device.

[0072] It should be noted that although the above device only shows the processor 1010, the memory 1020, the input / output interface 1030, the communication interface 1040, and the bus 1050, in the specific implementation process, the device can also include other components necessary for normal operation. In addition, those skilled in the art can understand that the above device can also only include the components necessary to implement the solutions of the embodiments of the present specification, and does not necessarily include all the components shown in the figure.

[0073] The electronic device of the above embodiment is used to implement the corresponding SDN construction method based on a traditional network in any of the foregoing embodiments, and has the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0074] Based on the same inventive concept, corresponding to the method of any of the above embodiments, the present application also provides a non-transitory computer-readable storage medium storing computer instructions for causing the computer to perform the SDN construction method based on a traditional network according to any of the above embodiments.

[0075] The computer-readable medium of the present embodiment includes permanent and non-permanent, removable and non-removable media, which can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassette, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible by a computing device.

[0076] The storage medium of the above embodiment stores computer instructions for causing the computer to perform the SDN construction method based on a traditional network according to any of the above embodiments, and has the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0077] Those skilled in the art should understand that the discussion of any of the above embodiments is only exemplary and is not intended to imply that the scope of the present application (including claims) is limited to these examples; under the idea of the present application, the above embodiments or technical features in different embodiments can also be combined, the steps can be implemented in any order, and there are many other changes of different aspects of the embodiments of the present application as described above. In order to be brief, they are not provided in detail.

[0078] Additionally, to simplify the description and discussion, and so as not to obscure the embodiments of the application being presented, the well-known functions or constructions of integrated circuit (IC) chips and other components can or can not be shown in the figures and will be omitted as not to unnecessarily obscure the embodiments of the application being presented. Moreover, the devices can be shown in block diagram form in order to avoid obscuring the embodiments of the application, and this also acknowledges the fact that the details in regard to the implementation of the block diagram devices are highly dependent on the platform within which the embodiments of the application are to be implemented (i.e., these details should be well within the purview of one of ordinary skill in the art). Where specific details are set forth in order to describe an illustrative embodiment of the application, it will be apparent to one of ordinary skill in the art that the embodiments of the application can be practiced without, or with variation of, these specific details. Thus, the description is to be considered as illustrative only and not restrictive in nature.

[0079] While the application has been described in connection with specific embodiments thereof, it will be understood that many modifications, substitutions and changes will be apparent to those of ordinary skill in the art. For example, other memory architectures (e.g., dynamic RAM (DRAM)) can use the embodiments discussed.

[0080] It is intended to cover all alternatives, modifications and variations of this application falling within the scope of the appended claims. Accordingly, all such changes are intended to be included within the scope of the application as set forth in the claims.

Claims

1. A method for constructing SDN based on traditional networks, characterized in that, The method includes: Network planning; dividing the network into different virtual private clouds and configuring a corresponding VPN instance for each virtual private cloud; at the same time, dividing each virtual private cloud into different subnets, assigning a corresponding subnet ID to each subnet, and configuring a centralized gateway on the core layer switch; Configure subnet; For physical servers, configure switch interfaces, configure subnet IDs on the switches, and assign the corresponding switch interfaces to the subnets. The switches will then tag and untag the subnets according to the configured subnet IDs to ensure the transmission of data packets in the network. For the virtualized physical server, configure the switch interface to allow all subnets to pass through. Configure the br-business bridge and br-ext bridge on the virtualized physical server, set the physical network card to promiscuous mode, add the physical network card to the br-ext bridge, create logical switches in the br-business bridge according to the divided subnets, add the virtual machine network cards to the logical switches, configure the corresponding subnets according to the assigned subnet IDs, aggregate multiple logical switches as sub-interfaces to a parent interface, and connect them to the br-ext bridge through the patch interface.

2. The SDN construction method based on traditional networks according to claim 1, characterized in that, Also includes: Configure rules within the Virtual Private Cloud; restrict communication between subnets by configuring access control list rules. Subnets within the Virtual Private Cloud are isolated by default.

3. The SDN construction method based on traditional networks according to claim 1, characterized in that, Also includes: Configure rules between virtual private clouds; traffic is isolated by default between different virtual private clouds, and configure the import-extcommunity attribute to enable communication between different VPN instances.

4. The SDN construction method based on traditional networks according to claim 1, characterized in that: For physical servers, it is supported to configure multiple different subnet IDs for multiple network cards.

5. The SDN construction method based on traditional networks according to claim 1, characterized in that, Also includes: In response to communication traffic within the same subnet, forwarding and interaction are performed through logical switches or Layer 2 switches to ensure communication between physical servers and virtual machines; In response to communication traffic across subnets and virtual private clouds, it forwards and interacts through a Layer 3 switch to maintain communication between different subnets and different virtual private clouds.

6. An SDN construction device based on traditional networks, characterized in that, The device includes: The network planning module is used for network planning; it divides different virtual private clouds and configures a corresponding VPN instance for each virtual private cloud; at the same time, it divides each virtual private cloud into different subnets, assigns a corresponding subnet ID to each subnet, and configures a centralized gateway on the core layer switch. The subnet configuration module is used to configure subnets; For physical servers, configure switch interfaces, configure subnet IDs on the switches, and assign the corresponding switch interfaces to the subnets. The switches will then tag and untag the subnets according to the configured subnet IDs to ensure the transmission of data packets in the network. For the virtualized physical server, configure the switch interface to allow all subnets to pass through. Configure the br-business bridge and br-ext bridge on the virtualized physical server, set the physical network card to promiscuous mode, add the physical network card to the br-ext bridge, create logical switches in the br-business bridge according to the divided subnets, add the virtual machine network cards to the logical switches, configure the corresponding subnets according to the assigned subnet IDs, aggregate multiple logical switches as sub-interfaces to a parent interface, and connect them to the br-ext bridge through the patch interface.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the SDN construction method based on traditional networks as described in any one of claims 1-5.

8. A non-transitory computer-readable storage medium, characterized in that, in, The non-transitory computer-readable storage medium stores computer instructions for causing the computer to execute the SDN construction method based on any one of claims 1-5.

Images