Vpc and cloud private line interconnection method and device, electronic equipment and storage medium

Abstract

The application provides a VPC and cloud private line interconnection method and device, electronic equipment and storage medium, the method comprises the following steps: creating a private line VFW in advance on a physical firewall, and configuring and initializing a private line NAT to ensure the physical connection between the physical firewall and the private line area; creating a specified VPC and private line intercommunication instance, and issuing the basic configuration of the VPC on the private line NAT; creating a private line security policy and checking the parameter legality of the private line security policy; in response to the parameter legality of the checked private line security policy, configuring the policy rule on the private line NAT according to the five-tuple parameters configured by the user on the console. The VPC and cloud private line interconnection method provided by the application does not need to purchase additional firewall equipment, reduces the use cost; while realizing the basic demand, the security policy can also be configured on the private line NAT, so that the intercommunication between the private line area and the VPC is more secure.

Description

Technical Field

[0001] This application belongs to the field of cloud computing services, and in particular relates to a method, apparatus, electronic device and storage medium for interconnecting a VPC with a cloud private line. Background Technology

[0002] A Virtual Private Cloud (VPC) is a cloud computing service in which a public cloud provider isolates specific portions of its public cloud infrastructure for private use. The VPC infrastructure is managed by the public cloud provider, but the resources allocated to a VPC are not shared with any other customers. It is a hybrid model of cloud computing, providing a private cloud solution within the public cloud provider's infrastructure. It builds an isolated, user-configurable and managed virtual network environment for elastic cloud servers, enhancing the security of resources in the user's cloud and simplifying network deployment. It is a basic cloud network environment purchased and built by the user from a cloud vendor. Through a VPC, users can securely, conveniently, and quickly configure and manage their internal network, customize many network products and configurations, and build a dedicated network topology according to their own needs.

[0003] After a user creates a VPC, if the leased line area wants to access the virtual machines within the VPC, the only way is to bind the virtual machines to an Elastic IP (EIP). The leased line area then directly accesses the EIP, and NAT is performed on the firewall. This requires the purchase of additional firewall equipment, increasing the cost of use. At the same time, the security of communication between the leased line area and the VPC is also low. Summary of the Invention

[0004] In view of this, this application aims to propose a method, device, electronic device and storage medium for interconnecting VPC and cloud private line, in order to solve the problem that if a private line area wants to access virtual machines in a VPC, it can only do so by binding the virtual machine to an Elastic IP (EIP), allowing the private line area to directly access the EIP, and NAT is performed on the firewall. This requires additional purchase of firewall equipment, which increases the cost of use. At the same time, the security of communication between the private line area and VPC is also low.

[0005] To achieve the above objectives, the technical solution of this application is implemented as follows:

[0006] Firstly, this application provides a method for interconnecting a VPC with a cloud private line, the method comprising:

[0007] A leased line VFW is pre-created on the physical firewall, and the leased line NAT is configured and initialized to ensure the physical connection between the physical firewall and the leased line zone.

[0008] Create a specified VPC instance that can communicate with the leased line, and issue the basic configuration of the VPC on the leased line NAT to ensure that the traffic of the VPC can pass through the leased line VFW;

[0009] Create a dedicated line security policy and verify the validity of the policy parameters;

[0010] In response to the verification of the leased line security policy parameters, and based on the five-tuple parameters configured by the user in the console, policy rules are configured on the leased line NAT; wherein, the leased line security policy is executed based on the inter-domain policy on the leased line VFW.

[0011] Secondly, based on the same inventive concept, this application also provides a VPC and cloud private line interconnection device, the device comprising:

[0012] The pre-created module is configured to pre-create a leased line VFW on the physical firewall and initialize the leased line NAT configuration to ensure the physical connection between the physical firewall and the leased line zone.

[0013] The interconnection instance creation module is configured to create an interconnection instance between a specified VPC and a dedicated line, and to distribute the basic configuration of the VPC on the dedicated line NAT to ensure that the traffic of the VPC can pass through the dedicated line VFW.

[0014] The leased line security policy verification module is configured to create leased line security policies and verify the legality of the parameters of the leased line security policies.

[0015] The response module is configured to respond to the validity of the parameters of the leased line security policy by configuring policy rules on the leased line NAT according to the five-tuple parameters configured by the user in the console; wherein, the leased line security policy is executed based on the inter-domain policy on the leased line VFW.

[0016] Thirdly, based on the same inventive concept, this application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the VPC and cloud private line interconnection method as described in the first aspect.

[0017] Fourthly, based on the same inventive concept, this application also provides a non-transitory computer-readable storage medium, wherein the non-transitory computer-readable storage medium stores computer instructions for causing the computer to execute the VPC and cloud private line interconnection method as described in the first aspect.

[0018] Compared with existing technologies, the VPC and cloud private line interconnection method, apparatus, electronic device and storage medium described in this application have the following advantages:

[0019] The VPC and cloud leased line interconnection method, device, electronic device, and storage medium described in this application achieve the interconnection requirement between VPC and leased line area by creating a new VFW. This not only meets the requirement but also does not affect the original NAT VFW's services. The two VFWs do not conflict with each other, and the leased line VFW and NAT VFW share a single physical firewall, eliminating the need to purchase additional firewall equipment and reducing usage costs. In addition to meeting the basic requirements, security policies can also be configured on the leased line NAT to make the communication between the leased line area and VPC more secure. Attached Figure Description

[0020] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments and descriptions of this application are used to explain this application and do not constitute an undue limitation of this application. In the drawings:

[0021] Figure 1 This is an overall topology diagram of the VPC network described in the embodiments of this application;

[0022] Figure 2 This is a topology diagram of the interconnection between the VPC network and the leased line network as described in the embodiments of this application;

[0023] Figure 3 This is a flowchart illustrating the interconnection process between the VPC network and the leased line network as described in the embodiments of this application.

[0024] Figure 4 This is a flowchart illustrating the VPC leased line security policy described in an embodiment of this application.

[0025] Figure 5 This is a flowchart of the VPC and cloud private line interconnection method described in the embodiments of this application;

[0026] Figure 6 This is a schematic diagram of the VPC and cloud private line interconnection device described in the embodiments of this application;

[0027] Figure 7 This is a schematic diagram of the hardware structure of the electronic device described in an embodiment of this application. Detailed Implementation

[0028] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with specific embodiments and the accompanying drawings.

[0029] It should be noted that, unless otherwise defined, the technical or scientific terms used in the embodiments of this application should have the ordinary meaning understood by one of ordinary skill in the art to which this application pertains. The terms "first," "second," and similar terms used in the embodiments of this application do not indicate any order, quantity, or importance, but are merely used to distinguish different components. Terms such as "comprising" or "including" mean that the element or object preceding the word encompasses the elements or objects listed after the word and their equivalents, without excluding other elements or objects. Terms such as "connected" or "linked" are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. Terms such as "upper," "lower," "left," and "right" are only used to indicate relative positional relationships; when the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0030] The embodiments of this application are described in detail below with reference to the accompanying drawings.

[0031] VPC network implementation topology diagram as follows: Figure 1 As shown, the specific explanation is as follows:

[0032] Virtual machines purchased in a VPC network reside in various CVKs. CVKs are connected to Leaf switches, which in turn connect to the core Spine switches. The Spine switches connect to the Border switches, which are connected to physical firewalls. Within the Border switches, a virtual firewall called a NAT VFW is created. All Elastic IPs (EIPs) bound to the virtual machines undergo NAT translation on the NAT VFW. All firewall functionality is implemented on the virtual NAT VFW. A default route on the Border switch points to the NAT VFW. When VPC packets arrive at the Border, if no higher-priority route is available, the packets are directed to the NAT VFW. After NAT translation, the NAT VFW forwards the packets to the Internet ACC switch via the Border, and finally, the packets reach the Internet via a router.

[0033] The topology diagram of the interconnection between the VPC network and the cloud private line network is as follows: Figure 2 As shown, the specific explanation is as follows:

[0034] As shown in the topology diagram, in this invention, the physical firewall has been changed from simply virtualizing a single NAT VFW to virtualizing both a NAT VFW and a dedicated line VFW. The original EIP's NAT functionality is still implemented entirely on the NAT VFW. If the VPC needs to use the dedicated line area, this is done on the new dedicated line NAT VFW, with routing directing VPC packets to the dedicated line area network. After passing through the dedicated line VFW, packets no longer undergo NAT, but security policies can still be created on the dedicated line NAT according to user needs, providing firewall security protection. By adding routing on the dedicated line NAT, packets are directly sent to the dedicated line area, bypassing the border and reaching the Internet.

[0035] Please see Figure 3 and Figure 5 As shown, an embodiment of this application describes a method for interconnecting a VPC with a cloud private line, which includes the following steps:

[0036] Step S101: Pre-create a leased line VFW on the physical firewall and configure and initialize the leased line NAT to ensure the physical connection between the physical firewall and the leased line zone.

[0037] In some implementations, the physical firewall and the leased line area are connected by a physical cable, and a route to the leased line area is configured on the physical firewall.

[0038] Pre-create a dedicated line VFW instance and associate it with a physical firewall to ensure that traffic is transmitted from the dedicated line zone to the physical firewall;

[0039] Specifically, configure routes to the leased area on the physical firewall to ensure that traffic can be correctly transmitted from the leased area to the physical firewall, and configure the routing table to specify that network traffic from the leased area is forwarded through the correct interfaces and gateways.

[0040] Configure forwarding rules for leased line NAT to ensure that traffic reaches the target address within the VPC from the leased line zone.

[0041] Specifically, configure forwarding rules on the leased line NAT to ensure that traffic from the leased area to the destination address within the VPC can be forwarded correctly. Configure the rules, specifying parameters such as source IP address, destination IP address, and port, so that traffic can be forwarded according to the rules.

[0042] In step S101, a leased line VFW is pre-created and associated with a physical firewall to ensure physical connectivity between the physical firewall and the leased line zone, and routing to the leased line zone is configured. Simultaneously, forwarding rules are configured on the leased line NAT to ensure traffic reaches its destination address within the VPC from the leased line zone. These steps provide the foundation for subsequent network security and traffic management.

[0043] Step S102: Create a specified VPC instance that can communicate with the leased line, and issue the basic configuration of the VPC on the leased line NAT to ensure that the traffic of the VPC can pass through the leased line VFW.

[0044] Specifically, create a detailed route on the Border with a destination address of the specified leased network segment and a next hop to the leased VFW;

[0045] On the leased line NAT, create a detailed route with the destination address set to the specified leased line network segment and the next hop to the leased line area.

[0046] In the VPC access direction of the leased line area, create a detailed route with the destination address as the VPC network segment and the next hop to Border;

[0047] The basic configuration of the VPC is issued on the leased line NAT, which includes leased line NAT configuration, leased line security policy configuration and routing configuration to ensure that traffic on the leased line VFW is transmitted to the VPC.

[0048] Specifically, to create a dedicated line interconnection instance for a specified VPC, you first need to create a detailed route on the Border with the destination address being the specified dedicated line network segment and the next hop being the dedicated line VFW. By configuring a detailed route on the Border device with the destination address being the specified dedicated line network segment and setting the next hop to the address of the dedicated line VFW, you can ensure that traffic is transmitted from the Border to the dedicated line VFW. This route has a higher priority than the default route from the Border to the NAT VFW and will prioritize matching network segments to access the dedicated line NAT.

[0049] On a leased NAT, the address for creating the next entry is the specified network segment, and the next hop is the route to the leased area. By setting the destination address to the detailed route of the specified leased network segment on the leased NAT device and setting the next hop to the address of the leased area, it is possible to ensure that traffic from the leased NAT to the leased area is forwarded normally.

[0050] Simultaneously, for traffic accessing the VPC from the leased line area, a detailed route is required where the next address is the VPC network segment and the next hop is the Border. This requires configuring a detailed route on the leased line area device with the destination address being the VPC network segment and setting the next hop to the Border's address. This ensures that traffic accessing the VPC from the leased line area can be correctly forwarded to the Border.

[0051] At the same time, the basic configuration of VPC, including dedicated line NAT configuration, dedicated line security policy configuration and routing configuration, is deployed on the dedicated line NAT device to ensure that the configuration is correct so that the dedicated line NAT can correctly transmit traffic to the VPC. The basic configuration of VPC needs to be deployed on the dedicated line NAT to ensure that the traffic of VPC can pass through the dedicated line VFW.

[0052] Step S103: Create a dedicated line security policy and verify the validity of the parameters of the dedicated line security policy.

[0053] Specifically, leased line security policy parameters include parameters such as source address, destination address, protocol, and port, as well as allowed or denied operations. When creating a leased line security policy, it is necessary to verify the legality of the parameters, ensure that the source address, destination address, protocol, and port parameters are set correctly and meet security requirements, check for conflicts or duplications in the rules, and ensure that business operations comply with regulations.

[0054] In this embodiment, secure communication between the leased line area and the VPC can be provided. The leased line security policy can restrict unnecessary traffic from being transmitted through the leased line, prevent unauthorized access and attacks, and thus ensure the security of network resources.

[0055] In some implementations, the following steps are included before verifying the validity of the leased line security policy parameters:

[0056] Determine if a dedicated line instance exists;

[0057] If a dedicated line instance is found, the validity of the parameters of the dedicated line security policy is verified.

[0058] If no dedicated line instance exists, an exception is thrown and a failure result is returned.

[0059] To determine if a dedicated line instance exists, you can query the relevant devices, network, or cloud platform to see if a dedicated line instance has been created. If no dedicated line instance exists, you cannot proceed with the subsequent verification and configuration. If it is determined that no dedicated line instance exists in this step, you need to throw an exception and return a failure result.

[0060] Determine if a dedicated line instance exists, and then proceed with subsequent operations based on the result. This ensures that necessary pre-checks are performed before verifying the legality of the dedicated line security policy parameters.

[0061] Step S104: In response to the verification of the validity of the leased line security policy parameters, the policy rules are configured on the leased line NAT based on the five-tuple parameters configured by the user in the console, which include the source IP address, source port, destination IP address, destination port and protocol type; wherein, the leased line security policy is executed based on the inter-domain policy on the leased line VFW.

[0062] In some implementations, in response to the validity of the parameters of the leased line security policy verified, policy rules are configured on the leased line NAT based on the configured source IP address, source port, destination IP address, destination port and protocol type parameters to manage and control the traffic flowing through the leased line NAT.

[0063] In this embodiment, the security policy for the leased line is implemented using inter-domain policies on the leased line VFW. Inter-domain policies are network security policies used to control access and communication between different network domains. A network domain can be a subnet, a virtual local area network (VLAN), a sub-interface, or a virtual router, etc. Inter-domain policies define the rules for allowing or denying traffic transmission between different domains.

[0064] Inter-domain policies are typically applied to network devices (such as firewalls, routers, and switches) to ensure network security and isolation. By configuring inter-domain policies, data packets flowing through different domains can be filtered, authenticated, and authorized, protecting the network from unauthorized access and malicious behavior.

[0065] Here are some common inter-domain policy configuration options:

[0066] Access Control Lists (ACLs): By configuring ACLs, you can allow or deny packets flowing through different domains based on conditions such as source IP address, destination IP address, protocol type, source / destination port, etc.

[0067] Security Zones: Divide the network into different security zones and define access rules between them. For example, divide the internal network into trusted security zones and the external network into untrusted security zones, and then configure inter-domain policies to restrict communication between different security zones.

[0068] Security domain: Similar to a security zone, a security domain is a group of network devices or interfaces that can be configured with inter-domain policies to restrict traffic transmission between different security domains.

[0069] Virtual Private Network (VPN): By configuring a VPN tunnel, secure communication between domains can be achieved, encrypting and isolating data packets between different domains.

[0070] In some implementations, if the parameters of the leased line security policy being verified are invalid, an exception is thrown and a failure result is returned.

[0071] The VPC and cloud private line interconnection method described in this embodiment connects the physical firewall to the private line area through physical connections and routing. A private line VFW is pre-created, and the basic configuration initialization work on the private line NAT is completed. Users create a VPC and private line interconnection instance from the console. When creating the instance, the private line area network segment for interconnection needs to be specified. After the interconnection instance is created, the target interconnection network segment can be added, deleted, or modified according to actual needs. After the VPC and private line interconnection instance is created, an interconnection security policy can also be created under the instance. If a security policy exists under the interconnection instance, the interconnection instance cannot be deleted.

[0072] The VPC and cloud private line interconnection method described in this embodiment achieves the interconnection requirement between VPC and private line area by creating a new VFW. This not only meets the requirement but also does not affect the original NAT VFW's services. The two VFWs do not conflict with each other, and the private line VFW and NAT VFW share a single physical firewall, eliminating the need to purchase additional firewall equipment and reducing usage costs. In addition to meeting the basic requirements, security policies can also be configured on the private line NAT to make the communication between the private line area and VPC more secure.

[0073] It should be noted that the above description describes some embodiments of this application. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in a different order than that shown in the above embodiments and still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require a specific or sequential order to achieve the desired result. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0074] Based on the same inventive concept, and corresponding to the methods of any of the above embodiments, the embodiments of this application also provide a VPC and cloud private line interconnection device.

[0075] like Figure 6 As shown, the VPC and cloud private line interconnection device is characterized in that the device includes:

[0076] Module 11 is pre-created and configured to pre-create a leased line VFW on the physical firewall and initialize the leased line NAT configuration to ensure the physical connection between the physical firewall and the leased line zone.

[0077] Interconnection instance creation module 12 is configured to create a specified VPC and leased line interconnection instance, and issue the basic configuration of the VPC on the leased line NAT to ensure that the traffic of the VPC can pass through the leased line VFW;

[0078] The leased line security policy verification module 13 is configured to create a leased line security policy and verify the legality of the leased line security policy parameters.

[0079] Response module 14 is configured to, in response to the verification of the validity of the leased line security policy parameters, configure policy rules on the leased line NAT based on the five-tuple parameters configured by the user in the console; wherein, the leased line security policy is executed based on the inter-domain policy on the leased line VFW.

[0080] For ease of description, the above apparatus is described in terms of its functions, divided into various modules. Of course, in implementing the embodiments of this application, the functions of each module can be implemented in one or more software and / or hardware.

[0081] The apparatus described above is used to implement the corresponding VPC and cloud private line interconnection method in any of the foregoing embodiments, and has the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0082] Based on the same inventive concept, corresponding to the methods of any of the above embodiments, embodiments of this application also provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the VPC and cloud private line interconnection method as described in any of the above embodiments.

[0083] Figure 7 This embodiment illustrates a more specific hardware structure of an electronic device, which may include a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040, and a bus 1050. The processor 1010, memory 1020, input / output interface 1030, and communication interface 1040 are interconnected internally via the bus 1050.

[0084] The processor 1010 can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this specification.

[0085] The memory 1020 can be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage device, dynamic storage device, etc. The memory 1020 can store the operating system and other applications. When the technical solutions provided in the embodiments of this specification are implemented by software or firmware, the relevant program code is stored in the memory 1020 and is called and executed by the processor 1010.

[0086] The input / output interface 1030 is used to connect input / output modules to realize information input and output. Input / output modules can be configured as components within the device (not shown in the figure) or externally connected to the device to provide corresponding functions. Input devices may include keyboards, mice, touchscreens, microphones, various sensors, etc., while output devices may include displays, speakers, vibrators, indicator lights, etc.

[0087] The communication interface 1040 is used to connect a communication module (not shown in the figure) to enable communication between this device and other devices. The communication module can communicate via wired means (such as USB, Ethernet cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.).

[0088] Bus 1050 includes a pathway for transmitting information between various components of the device, such as processor 1010, memory 1020, input / output interface 1030, and communication interface 1040.

[0089] It should be noted that although the above-described device only shows the processor 1010, memory 1020, input / output interface 1030, communication interface 1040, and bus 1050, in specific implementations, the device may also include other components necessary for normal operation. Furthermore, those skilled in the art will understand that the above-described device may only include the components necessary for implementing the embodiments of this specification, and not necessarily all the components shown in the figures.

[0090] The electronic devices described above are used to implement the corresponding VPC and cloud private line interconnection method in any of the foregoing embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0091] Based on the same inventive concept, corresponding to the methods of any of the above embodiments, this application also provides a non-transitory computer-readable storage medium that stores computer instructions for causing the computer to execute the VPC and cloud private line interconnection method as described in any of the above embodiments.

[0092] The computer-readable medium of this embodiment includes permanent and non-permanent, removable and non-removable media, and information storage can be implemented by any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transfer medium that can be used to store information accessible by a computing device.

[0093] The computer instructions stored in the storage medium of the above embodiments are used to cause the computer to execute the VPC and cloud private line interconnection method as described in any of the above embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0094] Those skilled in the art should understand that the discussion of any of the above embodiments is merely exemplary and is not intended to imply that the scope of this application (including the claims) is limited to these examples; within the framework of this application, the technical features of the above embodiments or different embodiments can also be combined, the steps can be implemented in any order, and there are many other variations of different aspects of the embodiments of this application as described above, which are not provided in the details for the sake of brevity.

[0095] Additionally, to simplify the description and discussion, and to avoid obscuring the embodiments of this application, the well-known power / ground connections to integrated circuit (IC) chips and other components may or may not be shown in the provided drawings. Furthermore, the apparatus may be shown in block diagram form to avoid obscuring the embodiments of this application, and this also takes into account the fact that the details of the implementation of these block diagram apparatuses are highly dependent on the platform on which the embodiments of this application will be implemented (i.e., these details should be fully understood by those skilled in the art). While specific details (e.g., circuits) have been set forth to describe exemplary embodiments of this application, it will be apparent to those skilled in the art that the embodiments of this application can be implemented without these specific details or with variations thereof. Therefore, these descriptions should be considered illustrative rather than restrictive.

[0096] Although this application has been described in conjunction with specific embodiments thereof, many substitutions, modifications, and variations of these embodiments will be apparent to those skilled in the art from the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may be used with the embodiments discussed.

[0097] The embodiments of this application are intended to cover all such substitutions, modifications, and variations that fall within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the embodiments of this application should be included within the protection scope of this application.

Claims

1. A method for interconnecting a VPC with a cloud private line, characterized in that, The method includes: A leased line VFW is pre-created on the physical firewall, and the leased line NAT is configured and initialized to ensure the physical connection between the physical firewall and the leased line zone. Create a specified VPC instance that can communicate with the leased line, and deploy the basic configuration of the VPC on the leased line NAT to ensure that VPC traffic can pass through the leased line VFW, including: Create a detailed route on the Border with the destination address set to the specified leased network segment and the next hop to the leased VFW; On the leased line NAT, create a detailed route with the destination address set to the specified leased line network segment and the next hop to the leased line area. In the VPC access direction of the leased line area, create a detailed route with the destination address as the VPC network segment and the next hop to Border; The basic configuration of the VPC is issued on the leased line NAT, which includes leased line NAT configuration, leased line security policy configuration and routing configuration to ensure that traffic on the leased line VFW is transmitted to the VPC. Create a dedicated line security policy and verify the validity of the policy parameters; In response to the validity of the parameters of the leased line security policy, the policy rules are configured on the leased line NAT according to the five-tuple parameters configured by the user in the console; wherein, the leased line security policy is executed based on the inter-domain policy on the leased line VFW.

2. The method for interconnecting a VPC and a cloud private line according to claim 1, characterized in that, The process of pre-creating a leased VFW on the physical firewall and configuring and initializing the leased NAT to ensure the physical connection between the physical firewall and the leased zone includes: Connect the physical firewall and the leased line area via a physical cable, and configure the route to the leased line area on the physical firewall; Pre-create a dedicated line VFW instance and associate it with a physical firewall to ensure that traffic is transmitted from the dedicated line zone to the physical firewall; Configure forwarding rules for leased line NAT to ensure that traffic reaches the target address within the VPC from the leased line zone.

3. The method for interconnecting a VPC and a cloud private line according to claim 1, characterized in that, Before verifying the validity of the leased line security policy parameters, the following steps are also included: Determine if a dedicated line instance exists; If a dedicated line instance is found, the validity of the parameters of the dedicated line security policy is verified. If no dedicated line instance exists, an exception is thrown and a failure result is returned.

4. The method for interconnecting a VPC and a cloud private line according to claim 1, characterized in that: The five-tuple parameters include source IP address, source port, destination IP address, destination port, and protocol type.

5. The method for interconnecting a VPC and a cloud private line according to claim 4, characterized in that, The parameters of the leased line security policy, as verified, are valid. Based on the five-tuple parameters configured by the user in the console, policy rules are configured on the leased line NAT. The leased line security policy is executed based on the inter-domain policy on the leased line VFW, including: In response to the validity of the parameters of the leased line security policy, policy rules are configured on the leased line NAT based on the configured source IP address, source port, destination IP address, destination port and protocol type parameters to manage and control the traffic flowing through the leased line NAT.

6. The method for interconnecting a VPC and a cloud private line according to claim 1, characterized in that, Also includes: If the parameters of the leased line security policy being verified are invalid, an exception is thrown and a failure result is returned.

7. A VPC and cloud private line interconnection device, characterized in that, The device includes: The pre-created module is configured to pre-create a leased line VFW on the physical firewall and initialize the leased line NAT configuration to ensure the physical connection between the physical firewall and the leased line zone. The interoperability instance creation module is configured to create interoperability instances between a specified VPC and the leased line, and to distribute the basic configuration of the VPC on the leased line NAT to ensure that VPC traffic can pass through the leased line VFW, including: Create a detailed route on the Border with the destination address set to the specified leased network segment and the next hop to the leased VFW; On the leased line NAT, create a detailed route with the destination address set to the specified leased line network segment and the next hop to the leased line area. In the VPC access direction of the leased line area, create a detailed route with the destination address as the VPC network segment and the next hop to Border; The basic configuration of the VPC is issued on the leased line NAT, which includes leased line NAT configuration, leased line security policy configuration and routing configuration to ensure that traffic on the leased line VFW is transmitted to the VPC. The leased line security policy verification module is configured to create leased line security policies and verify the legality of the parameters of the leased line security policies. The response module is configured to respond to the validity of the parameters of the leased line security policy by configuring policy rules on the leased line NAT according to the five-tuple parameters configured by the user in the console; wherein, the leased line security policy is executed based on the inter-domain policy on the leased line VFW.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the VPC and cloud private line interconnection method according to any one of claims 1-6.

9. A non-transitory computer-readable storage medium, characterized in that, in, The non-transitory computer-readable storage medium stores computer instructions, which are used to cause the computer to execute the VPC and cloud private line interconnection method according to any one of claims 1-6.

Images