A method for building a virtual router for cross-public network interconnection of private network addresses

Abstract

The present application provides a method for building a virtual router for cross-public network interconnection of private network addresses. Using this method, test hosts using private network addresses in n IDC nodes can achieve interconnection. By allocating a virtual machine for each test host using a private network address in an IDC node and installing FRR software on this virtual machine to serve as an FRR-host host; building a virtual router based on the FRR-host, configuring the internal network ports, public network ports, bridge ports, vxlan ports, and vrf ports required for the virtual router, mounting the vxlan port on the bridge, and mounting the internal network port and the bridge port on the vrf; configuring the bgp peer neighbor relationship of n FRR-host hosts; establishing vxlan tunnels between n FRR-host hosts; starting the binding function from vrf to vxlan within the FRR routing software module to form a virtual router; performing MP-BGP evpn configuration on n FRR-host hosts and exchanging type 5 routes, private network address interconnection can be achieved, and the construction of the virtual router can be completed.

Description

Technical Field

[0001] This application relates to the field of network communication technologies, and more specifically, to a method for building a virtual router for cross-public network interconnection of private network addresses. Background Art

[0002] In the data center cloud network environment, private network addresses (commonly known as fake addresses) are widely used, such as the 192.168.0.0 / 16 network segment address or the 10.0.0.0 / 8 network segment address. However, because these private network addresses have no routes on the public network, they are usually only used internally.

[0003] With the expansion of business, a single data center node is difficult to accommodate the increasing business capacity. Businesses are often deployed across multiple data center nodes. For the convenience of business deployment, the private network address segments between multiple data center nodes need to be interconnected. How can the private network address segments be interconnected through the public network? The common approach is to establish tunnels to connect the two network segments and achieve the connection of the two private network address segments. Such as GRE tunnels, Ipsec tunnels, etc. However, although this traditional tunnel technology solves the connectivity problem, its performance is not satisfactory, often consuming a large amount of CPU resources. In addition, when the number of data center nodes continues to increase, the number of tunnels will also increase accordingly, resulting in a large amount of configuration work and an increase in subsequent maintenance costs. Summary of the Invention

[0004] The purpose of the embodiments of this application is to provide a method for building a virtual router for cross-public network interconnection of private network addresses, so as to route the private network addresses of each data center node through the virtual router and ultimately achieve the interconnection of the private network address networks of each data center node.

[0005] To achieve the above purpose, the embodiments of this application implement the building of a virtual router for cross-public network interconnection of private network addresses in the following manner:

[0006] In the first aspect, the embodiment of the present application provides a method for building a virtual router for interconnecting private network addresses across public networks, using the open source software of the Linux system to build a virtual router, including: allocating an FRR-host host to each test host using a private network address in an IDC node on the FRR-host, wherein the IP address of each test host is a private network address of a different network segment; configuring the intranet port connected to the private network address, the public network port connected to the public network, the bridge port, the vxlan port, and the vrf port required by the virtual router, and mounting the vxlan port on the bri On the dge bridge, mount the intranet port and the bridge port on the vrf; configure the bgp peer neighbor relationship of n FRR-host hosts; establish a full-mesh vxlan tunnel between the n FRR-host hosts, and form a large Layer 2 vxlan network between the n FRR-host hosts; start the vrf to vxlan binding function in the FRR routing software module of the n FRR-host hosts, and after binding, a virtual router is formed between the n FRR-host hosts; perform MP-BGP evpn configuration on the n FRR-host hosts, and exchange type5 routes, so that the private network addresses of the test hosts of the n IDC nodes can be interconnected, and the construction of a virtual router for interconnecting private network addresses across the public network can be completed.

[0007] In combination with the first aspect, in a first possible implementation manner of the first aspect, the n FRR-host hosts are all virtual machines, and the used FRR routing software modules are all open source software.

[0008] In combination with the first possible implementation method of the first aspect, in a second possible implementation method of the first aspect, the n FRR-host hosts all have dual network cards, the IP address of the public network card of each FRR-host host is completely interconnected with the IP addresses of other FRR-host hosts, and the intranet network card of each FRR-host host is configured with an intranet IP and serves as the intranet gateway of its corresponding test host.

[0009] In combination with the first aspect, in a third possible implementation method of the first aspect, a vxlan tunnel is established between n FRR-host hosts, and a large Layer 2 vxlan network is formed between the n FRR-host hosts, including: entering the FRR routing software module installed in the Linux system, configuring MP-BGP evpn, and establishing a bgp peer connection between the n FRR-host hosts; enabling the MP-BGP evpn address cluster, exchanging type3 routes of MP-BGP evpn, so as to form a large Layer 2 vxlan network between the n FRR-host hosts.

[0010] In combination with the third possible implementation of the first aspect, in a fourth possible implementation of the first aspect, the MP-BGP evpn of one FRR-host is configured as an RR server, and the MP-BGP evpns of the other n-1 FRR-hosts are configured as RR Clients.

[0011] In a second aspect, an embodiment of the present application provides a virtual router for interconnecting private network addresses across public networks, and the virtual router is constructed by the method for constructing a virtual router for interconnecting private network addresses across public networks described in the first aspect or any one of the possible implementations of the first aspect.

[0012] Beneficial effects: This solution adopts vxlan tunnel technology to establish a large layer 2 vxlan network between each data center node (IDC node) through MP-BGP evpn, and on this basis, by binding this large layer 2 vxlan network to vrf and exchanging type 5 routes through MP-BGP evpn, a large layer 3 virtual router across data center nodes is realized. By mounting the ports of the private network address network in each data center node on the virtual router, the private network address of each data center node is routed through the virtual router, and finally the private network address network of each data center node is interconnected, realizing a true "large layer 3 virtual router". Therefore, the virtual router is used to realize the interconnection of private network addresses between multiple data center nodes in different regions through the public network as a data channel, alleviating the limitation that private network addresses can only be used in internal networks, and allowing the application of private network addresses to be further expanded to a wider range of applications.

[0013] The working principle of the virtual router is logically similar to that of a traditional router, and is different from the method of vxlan centralized gateway or distributed gateway, so it is easy to master and implement. The second-layer data forwarding of the virtual router is implemented through the vxlan large second-layer network, and the third-layer routing query is implemented through vrf, so the performance is stronger. And the network change adjustment is relatively simple. If you need to add or delete the private network address network of the data center node, you can complete it through simple configuration, and the maintenance cost is low. In addition, this solution is suitable for use in combination with SDN controllers to achieve centralized control of the network, and the control layer is separated from the data forwarding layer. In addition, in addition to connecting to private network addresses, this virtual router can also connect to any real IP address. The three-layer routing function of the virtual router can realize the interconnection between IP addresses. When it is inconvenient to broadcast the real IP address for some reason, this virtual router can be used to solve the interconnection problem. In addition, in the actual application of the virtual router, multiple vrfs can also be established to meet the needs of multi-tenant scenarios.

[0014] To make the above objects, features, and advantages of the present application more obvious and understandable, the following provides preferred embodiments in conjunction with the accompanying drawings and describes them in detail as follows. Description of the Drawings

[0015] To more clearly illustrate the technical solutions of the embodiments of the present application, the following briefly introduces the drawings required to be used in the embodiments of the present application. It should be understood that the following drawings only show some embodiments of the present application and should not be regarded as limiting the scope. For those of ordinary skill in the art, without creative efforts, other relevant drawings can be obtained based on these drawings.

[0016] Figure 1 It is a flowchart of a method for building a virtual router for cross-public-network interconnection of private network addresses provided by an embodiment of the present application.

[0017] Figure 2 It is a schematic diagram of the final logical effect of building a virtual router with 4 IDC nodes as an example.

[0018] Figure 3 It is a schematic diagram of a virtual router built by the FRR-host host with 4 IDC nodes as an example. Detailed Embodiments

[0019] The following will describe the technical solutions in the embodiments of the present application in conjunction with the drawings in the embodiments of the present application.

[0020] Please refer to Figure 1 , Figure 1 It is a flowchart of a method for building a virtual router for cross-public-network interconnection of private network addresses provided by an embodiment of the present application. In this embodiment, the method for building a virtual router for cross-public-network interconnection of private network addresses may include step S10, step S20, step S30, step S40, step S50, and step S60.

[0021] To achieve cross-public-network interconnection of private network addresses, the method for building a virtual router for cross-public-network interconnection of private network addresses can be applied in the Linux system, and the FRR routing software module is installed in the Linux system. Based on this, step S10 can be run first.

[0022] Step S10: In an n IDC node environment, assign an FRR-host host to each test host using a private network address in each IDC node, where the IP address of each test host is a private network address in a different network segment.

[0023] In this embodiment, for the cross-public network interconnection of the private network addresses of n IDC nodes (each IDC node corresponds to a test host, the IDC node is denoted as IDC site, and the test host can be denoted as test machine host), a FRR-host host can be allocated for each test host respectively. Here, the IP addresses of each test host are private network addresses in different network segments, and the FRR-host host can be a physical host or a virtual host. In this solution, virtual machines are used for all virtual routers.

[0024] Each FRR-host host has dual network cards. The IP address of the public network network card of each FRR-host host is fully interconnected with the IP addresses of other FRR-host hosts. The internal network network card of each FRR-host host is configured with an internal network IP and serves as the internal network gateway for its corresponding test host.

[0025] After that, step S20 can be run.

[0026] Step S20: Configure the internal network ports for connecting private network addresses, public network ports for connecting to the public network, bridge network ports, vxlan ports, and vrf ports required for the virtual router, mount the vxlan port on the bridge network, and mount the internal network ports and bridge network ports on the vrf.

[0027] In this embodiment, basic port configuration needs to be performed first:

[0028] The internal network ports for connecting private network addresses, public network ports for connecting to the public network, bridge network ports, vxlan ports, and vrf ports required for the virtual router can be configured, mount the vxlan port on the bridge network, and mount the internal network ports and bridge network ports on the vrf.

[0029] After completing the basic port configuration, step S30 can be run.

[0030] Step S30: Configure the bgp peer neighbor relationships of n FRR-host hosts.

[0031] In this embodiment, based on actual requirements, the bgp peer neighbor relationships of n FRR-host hosts can be set. For example, assign RR server and RR Client roles to n FRR-host hosts, and establish bgp peer neighbor relationships between all RR clients and RR servers.

[0032] After configuring the bgp peer neighbor relationships of n FRR-host hosts, step S40 can be run.

[0033] Step S40: Establish a full-mesh vxlan tunnel between n FRR-host hosts to form a large Layer 2 vxlan network between the n FRR-host hosts.

[0034] In this embodiment, a full-mesh vxlan tunnel can be established between n FRR-host hosts to form a large Layer 2 vxlan network between the n FRR-host hosts.

[0035] Exemplarily, you can enter the FRR routing software module installed in the Linux system, configure MP-BGP evpn, establish a bgp peer neighbor relationship between the FRR-host host with the RR server role and the FRR-host hosts with other RR Client roles, enable the MP-BGP evpn address cluster, exchange type3 routes of MP-BGP evpn, and automatically establish a full-mesh vxlan tunnel between n FRR-host hosts based on the type3 route, thereby forming a large Layer 2 vxlan network between the n FRR-host hosts.

[0036] After a large Layer 2 vxlan network is formed between the n FRR-host hosts, step S50 can be executed.

[0037] Step S50: Start the vrf to vxlan binding function in the FRR routing software module of the n FRR-host hosts. After binding, a virtual router is formed between the n FRR-host hosts.

[0038] In this embodiment, the vrf to vxlan binding function can be started in the FRR routing software module of the n FRR-host hosts. Then, the n bound FRR-host hosts have a layer 3 routing function and can form a virtual router.

[0039] In order to realize the interconnection and intercommunication of private network addresses across the public network, step S60 needs to be executed.

[0040] Step S60: Perform MP-BGP evpn configuration on n FRR-hosts and exchange type5 routes, so as to realize the interconnection of private network addresses of the test hosts of n IDC nodes and complete the construction of a virtual router for interconnection of private network addresses across the public network.

[0041] In this embodiment, MP-BGP evpn configuration can be performed on n FRR-host hosts (for example, the MP-BGP evpn of one FRR-host host is configured as an RR server, and the MP-BGP evpn of other n-1 FRR-host hosts is configured as an RR Client, or, some of the n FRR-host hosts are configured as RR servers, and the other part are configured as RR Clients), and type5 routes are exchanged, thereby realizing the interconnection of private network addresses of the test hosts of n IDC nodes, and completing the construction of a virtual router for interconnecting private network addresses across the public network.

[0042] This solution uses vxlan tunnel technology to establish a large layer 2 vxlan network between each data center node (IDC node) through MP-BGPevpn. On this basis, by binding this large layer 2 vxlan network to vrf, a large layer 3 virtual router across data center nodes is realized, and type 5 routes are exchanged with each other through MP-BGP evpn, so that each FRR-host obtains the private network segment route of other IDC nodes, and a large layer 3 virtual router across data center nodes is realized. By mounting the ports of the private network address network in each data center node on the virtual router, the private network address of each data center node is routed through the virtual router, and finally the private network address network of each data center node is interconnected, realizing a true "large layer 3 virtual router". Therefore, the virtual router is used to realize the interconnection of private network addresses between multiple data center nodes in different regions through the public network as a data channel, alleviating the limitation that private network addresses can only be used in internal networks, and allowing the application of private network addresses to be further expanded to a wider range of applications.

[0043] The logic of the working principle of the virtual router is very simple, similar to the working principle of the traditional router, so it is easy to master and implement. The second-layer data forwarding of the virtual router is implemented through the vxlan large second-layer network, and the third-layer routing query is implemented through vrf, so the performance is stronger. And the network change adjustment is relatively simple. If you need to add or delete the private network address network of the data center node, you can complete it through simple configuration, and the maintenance cost is low. In addition, this solution is suitable for use in combination with the SDN controller to achieve centralized control of the network, and the control layer is separated from the data forwarding layer. In addition, in addition to connecting to private network addresses, this virtual router can also connect to any real IP address. The three-layer routing function of the virtual router can realize the interconnection between IP addresses. In the actual application of the virtual router, multiple vrfs can also be established to meet the needs of multi-tenant scenarios.

[0044] For the convenience of understanding this solution, this embodiment takes the establishment of a virtual router for cross-public network interconnection of private network addresses based on 4 IDC nodes as an example for description. Please refer to Figure 2 , Figure 2 Figure 4 is a schematic diagram of the final logical effect of constructing a virtual router with 4 IDC nodes as an example.

[0045] Taking 4 IDC nodes as examples, namely IDC node 1, IDC node 2, IDC node 3, and IDC node 4 (i.e., IDCsite1, IDC site2, IDC site3, IDC site4), each IDC node represents an IDC computer room distributed in different regions. Among them, test machines host1, host2, host3, and host4 are test hosts in each IDC computer room, and the IP addresses of the four test hosts are private network addresses in different network segments. Since private network addresses cannot broadcast routes on the public network, they cannot be interconnected through the public network.

[0046] FRR-host hosts are assigned to the four test hosts respectively (FRR-host can be a physical host or a virtual machine. In this case, a virtual machine is used and the FRR routing software is installed): FRR-host1, FRR-host2, FRR-host3, and FRR-host4. The four FRR-host hosts are the main bearing devices for implementing the virtual router. It is required to have dual network cards, and the IP address of the public network network card of each FRR-host host is fully interconnected with the IP addresses of the other three nodes; the private network IP is configured for the internal network network card of each FRR-host host as the internal network gateway of its corresponding test host.

[0047] The IP resource configuration is as shown in the example in Table 1 below:

[0048] Table 1. IP Resource Configuration

[0049] IDC Node 1 IDC Node 2 IDC Node 3 IDC Node 4 Test host IP 10.16.1.100 / 24 10.16.2.100 / 24 10.16.3.100 / 24 10.16.4.100 / 24 Test host gateway 10.16.1.254 / 24 10.16.2.254 / 24 10.16.3.254 / 24 10.16.4.254 / 24 FRR-host private network IP 10.16.1.254 / 24 10.16.2.254 / 24 10.16.3.254 / 24 10.16.4.254 / 24 FRR-host public network IP 223.192.1.254 / 24 223.192.2.254 / 24 223.192.3.254 / 24 223.192.4.254 / 24

[0050] Among them, the system environment of each FRR-host host is as follows:

[0051] Basic environment: virtual machine + dual network cards

[0052] System environment: Centos Stream release 9 (kernel version 6.1.9-100.fc36.x86_64, )

[0053] Software module: FRR (Free Range Routing) version 8.5-02.el9, Bridge (bridge-utils.x86_64, version 1.7.1-3.el9).

[0054] For the configuration of the FFR hosts (FRR-host1, FRR-host2, FRR-host3, FRR-host4) corresponding to each IDC node (IDC site1, IDC site2, IDC site3, IDC site4), the steps are as follows:

[0055] (1) Basic port configuration:

[0056] Configure the internal network port, public network port, bridge port, vxlan port, and vrf port for connecting the private network address required by the virtual router, mount the vxlan port on the bridge, and mount the internal network port and bridge port on the vrf.

[0057] The configuration example is as follows:

[0058]

[0059]

[0060] (2) Configuration of FRR bgp peers:

[0061] On the basis of completing the vxlan port configuration, enter the FRR routing software module. First, configure the bgp peer relationship between FRR-host1 and FRR-host2, FRR-host3, FRR-host4. The configuration example of FRR-host1 is as follows:

[0062] router bgp 65001

[0063] bgp log-neighbor-changes

[0064] neighbor cloud-nodes peer-group

[0065] neighbor cloud-nodes remote-as internal

[0066] neighbor 223.193.2.254 peer-group cloud-nodes

[0067] neighbor 223.193.3.254 peer-group cloud-nodes

[0068] neighbor 223.193.3.254 peer-group cloud-nodes

[0069] !

[0070] exit

[0071] Next, configure the bgp peer neighbor relationship between FRR-host2, FRR-host3, and FRR-host4 and FFR-host1. The configurations of FRR-host2, FRR-host3, and FRR-host4 are basically the same. The specific contents of FRR-host2 are as follows:

[0072]

[0073] (3) vxlan configuration:

[0074] Based on the above configuration of vxlan port and bgp peer neighbor relationship, enter the FRR routing software module, configure MP-BGP evpn in FRR, establish bgp peer connection, enable evpn address cluster, and exchange evpn type3 routes. Among them, FRR-host1 is configured as the RR server for routing exchange, and the other three machines are configured as RR Clients.

[0075] The configuration example of FRR-host1 is as follows:

[0076]

[0077] The configuration examples of FRR-host2, FRR-host3, and FRR-host4 are as follows:

[0078]

[0079] After the above configuration is completed, a full-mesh vxlan tunnel will be automatically established between FRR-host1, FRR-host2, FRR-host3, and FRR-host4, forming a large Layer 2 vxlan network between the four FRR-hosts.

[0080] (4) vrf configuration:

[0081] Start the vrf to vxlan binding function in the FRR routing software module of the four FRR-host hosts. After the binding is completed, a virtual router is formed between the four FRR-hosts.

[0082] The configurations of the four FRR-hosts are the same, as shown below:

[0083] vrf vrf100

[0084] vni 100

[0085] exit-vrf

[0086] (5) BGP EVPN configuration, exchange type 5 routes:

[0087] The configurations of the 4 FRR-host hosts are basically the same. Taking FRR-host1 as an example here, the configurations of the other FRR-host2, FRR-host3, and FRR-host4 will not be elaborated. The configuration example is as follows:

[0088]

[0089] After the above configurations are completed, the type 5 routes (private network segment routes of each IDC node) exchanged through MP-BGP EVPN can be viewed through the FRR command show ip route vrf all at each node. The private network addresses of each IDC node (10.16.x.100 in this example) can communicate with each other. Ping tests can be performed between the test hosts (test machine host1, test machine host2, test machine host3, test machine host4) and they can communicate with each other. Finally, the schematic diagram of the virtual router built by FRR-host is as Figure 3 shown.

[0090] Based on the same inventive concept, the embodiment of the present application further provides a virtual router for cross-public-network interconnection and intercommunication of private network addresses. The virtual router is formed by building through the method for building a virtual router for cross-public-network interconnection and intercommunication of private network addresses.

[0091] In summary, the embodiment of the present application provides a method for building a virtual router for interconnection of private network addresses across the public network, adopts vxlan tunnel technology, establishes a large two-layer vxlan network through MP-BGP evpn between each data center node (IDC node), and on this basis, by binding the large two-layer vxlan network to vrf, and exchanging type 5 routes through MP-BGP evpn, a large three-layer virtual router across data center nodes is realized. By mounting the ports of the private network address network in each data center node on the virtual router, the private network address of each data center node is routed through the virtual router, and finally the interconnection of the private network address network of each data center node is realized, realizing the real "large three-layer virtual router". Therefore, the interconnection of private network addresses between multiple data center nodes in different regions through the public network as a data channel is realized by using a virtual router, which alleviates the limitation that private network addresses can only be used in internal networks, and allows the application of private network addresses to be further expanded to a wider range of applications. The working principle of the virtual router is logically similar to that of a traditional router, which is different from the method of vxlan centralized gateway or distributed gateway, so it is easy to master and implement. The layer 2 data forwarding of the virtual router is implemented through the vxlan large layer 2 network, and the layer 3 routing query is implemented through vrf, so the performance is stronger. And the network change adjustment is relatively simple. If you need to add or delete the private network address network of the data center node, you can complete it through simple configuration, and the maintenance cost is low. In addition, this solution is suitable for use in conjunction with the SDN controller to achieve centralized control of the network, and the control layer is separated from the data forwarding layer. In addition, in addition to connecting to private network addresses, this virtual router can also connect to any real IP address. The layer 3 routing function of the virtual router can realize the interconnection between IP addresses. When it is inconvenient to broadcast the real IP address for some reason, this virtual router can be used to solve the interconnection problem. In addition, in the actual application of the virtual router, multiple vrfs can be established to meet the needs of multi-tenant scenarios.

[0092] The above description is only an embodiment of the present application and is not intended to limit the protection scope of the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A method for building a virtual router for cross-public network interconnection of private network addresses, characterized in that Use the open source software of Linux system to build a virtual router, including: In an environment with n IDC nodes, an FRR-host is assigned to each test host in the IDC node that uses a private network address. The IP address of each test host is a private network address in a different network segment. FRR stands for Free Range Routing. Configure the intranet port connected to the private network address, the public network port connected to the public network, the bridge port, the vxlan port, and the vrf port required by the virtual router on the FRR-host, and mount the vxlan port on the bridge, and mount the intranet port and the bridge port on the vrf; Configure the BGP peer neighbor relationship of n FRR-host hosts; Establish a full-mesh vxlan tunnel between n FRR-hosts to form a large Layer 2 vxlan network between n FRR-hosts; Start the vrf to vxlan binding function in the FRR routing software modules of n FRR-host hosts. After binding, a virtual router is formed between the n FRR-host hosts. Perform MP-BGP evpn configuration on n FRR-hosts, exchange type5 routes, realize the interconnection of private network addresses of the test hosts of n IDC nodes, and complete the construction of a virtual router for interconnection of private network addresses across the public network.

2. The method for building a virtual router for cross-public network interconnection of private network addresses according to claim 1, characterized in that, The n FRR-hosts are all virtual machines, and the FRR routing software modules used are all open source software.

3. The method for building a virtual router for cross-public network interconnection of private network addresses according to claim 2, characterized in that, All n FRR-hosts have dual network cards. The IP address of the public network card of each FRR-host is fully interconnected with the IP addresses of other FRR-hosts. The intranet network card of each FRR-host is configured with an intranet IP and serves as the intranet gateway of its corresponding test host.

4. The method for building a virtual router for cross-public network interconnection of private network addresses according to claim 1, wherein Establish a vxlan tunnel between n FRR-hosts to form a large Layer 2 vxlan network between n FRR-hosts, including: Enter the FRR routing software module installed in the Linux system, configure MP-BGP evpn, and establish a BGP peer connection between n FRR-host hosts; Enable the MP-BGP evpn address cluster and exchange MP-BGP evpn type3 routes to form a large Layer 2 vxlan network between n FRR-host hosts.

5. The method for building a virtual router for cross-public network interconnection of private network addresses according to claim 4, wherein, The MP-BGP evpn of one FRR-host is configured as an RR server, and the MP-BGP evpn of the other n-1 FRR-hosts is configured as an RR client.

Images