A method and device for interconnecting Ethernet Layer 2 networks in different locations

Abstract

This invention discloses a method and device for Layer 2 interconnection of Ethernet networks in different locations, relating to the field of communication technology. A tunnel T, penetrating the NAT network, is established between the access device and the router, and authentication is performed. After successful authentication, tunnel T is added to the local area network (LAN). When the access device receives IP packets with a public IP address as the destination from the LAN, it processes them through the NAT module and sends them to the Internet via the public interface. Other packets are processed according to the Layer 2 forwarding procedure. Tunnel T can be used in two modes: Mode 1: all packets are encapsulated as complete Ethernet packets before transmission to tunnel T; Mode 2: unicast IP packets are encapsulated only with the IP portion before transmission to tunnel T, while other packets are encapsulated as complete Ethernet packets before transmission to tunnel T. This invention enables Layer 2 interconnection of Ethernet networks in different locations, reduces the complexity of user service deployment, improves network efficiency, and has broad application prospects.

Description

Technical Field

[0001] This invention relates to the field of communication technology, specifically to a method and device for interconnecting a geographically dispersed Ethernet Layer 2 network. Background Technology

[0002] VPLS (Virtual Private LAN Service) establishes PW (Pseudo Wire) transmission between two geographically isolated Ethernet networks, virtually connecting the geographically isolated Ethernet networks into a single Layer 2 network; however, VPLS technology cannot be applied to ordinary broadband users.

[0003] Figure 1 This is a common broadband user network configuration. Router 1 and Router 2 are two geographically isolated user devices. Their public network interfaces connect to the Internet via broadband access technologies such as PPPoE (Point-to-Point Protocol over Ethernet). The routers also integrate a DHCP (Dynamic Host Configuration Protocol) server to assign private IP addresses to the internal Layer 2 network. IANA (Internet Address Allocation Organization) stipulates that the address ranges 10.0.0.0 to 10.255.255.255, 172.16.0.0 to 172.31.255.255, and 192.168.0.0 to 192.168.255.255 will not be assigned on the Internet and can only be used in a local area network. These are generally referred to as private IP addresses. Due to the scarcity of public IPv4 addresses, ISPs generally use NAT (Network Address Translation) technology to provide services to broadband users. Router public interfaces are typically assigned the 100.64.0.0 / 10 address range; in this case, Router 1 and Router 2 cannot establish a PW (Power-Only Wire) connection.

[0004] Therefore, it is particularly necessary to develop a method and device that can penetrate NAT networks to achieve Layer 2 interconnection of Ethernet networks in different locations. Summary of the Invention

[0005] To address the shortcomings of existing technologies, the present invention aims to provide a method and device for interconnecting Ethernet Layer 2 networks in different locations, which can perform Ethernet Layer 2 interconnection in different locations, reduce the complexity of user service deployment, improve network efficiency, and is easy to promote and use.

[0006] To achieve the above objectives, the present invention provides a method for interconnecting Ethernet networks at different locations at Layer 2. The network includes access devices and routers. Both the routers and access devices access the Internet via NAT technology and integrate a NAT module to provide Internet services to local area network devices. The specific steps are as follows: (1) Establish a tunnel T between the access device and the router to penetrate the NAT network and perform legal authentication. After successful authentication, add tunnel T to the local area network. (2) When the access device receives an IP packet whose destination IP is a public IP address from the local area network, it processes it through the NAT module and sends it to the Internet through the public interface. Other packets are processed according to the Layer 2 forwarding process. (3) Tunnel T transmission message mode 1: All messages are encapsulated as complete Ethernet messages and transmitted to tunnel T; (4) Tunnel T Transmission Message Mode 2: Unicast IP messages are encapsulated only in the IP part and transmitted to Tunnel T, while other messages are encapsulated in the complete Ethernet message and transmitted to Tunnel T.

[0007] Preferably, the router integrates DHCP server functionality to assign IP addresses to LAN devices, while the access devices do not have DHCP server functionality.

[0008] Preferably, step (1) establishes an IP tunnel T that penetrates NAT between the access device and the router. Tunnel T is established using STUN technology. The IP tunnel protocol type supports NAT, including TCP, UDP, and ICMP. After tunnel T is established, the access device is authenticated using a username + password or certificate. After successful authentication, tunnel T joins the local area network and functions and behaves the same as the physical port.

[0009] Preferably, the processing flow of the access device receiving the local area network physical interface message in step (2) is as follows: S1. Determine if the packet is an IP packet based on the packet type in the Ethernet packet: If the international standard 0x0800 is an IP packet, resolve the destination IP; if it is not an IP packet, treat other packets as non-IP packets and proceed directly to step S5; S2. Determine if it is a private network IP. Private network IPs include the three address ranges specified by IANA: 10.0.0.0 to 10.255.255.255, 172.16.0.0 to 172.31.255.255, and 192.168.0.0 to 192.168.255.255, as well as the LAN broadcast address 255.255.255.255. If it is a private network IP, proceed to step S5; if it is not a private network IP, proceed to step S3. S3. Determine whether access to the public network is allowed. If not, proceed to step S5; if access is allowed, proceed to step S4. S4. Following the public network message processing procedure, existing home wireless routers generally process the message through the NAT module and then send it to the Internet via the public network interface. S5. Following the Layer 2 message processing flow, query the MAC address table based on the destination MAC address to send Ethernet messages to which physical ports or tunnels, and learn the source MAC address.

[0010] Preferably, the processing flow for sending a message to the tunnel in step S5 is as follows: S11. Determine if it is an IP packet. If yes, proceed to S12; otherwise, proceed to S14. S12. Determine whether the message is broadcast or multicast based on the destination MAC address: all Fs indicate broadcast, and the least significant bit of the first byte being equal to 1 indicates multicast MAC; if yes, proceed to S16; otherwise, proceed to S13. S13. After removing the Ethernet header, perform tunnel encapsulation and end the operation; S14. Determine if it is an ARP message: if yes, proceed to S15; if no, proceed to S16. S15. ARP Learning: Parse the sender's IP and MAC address in ARP packets and save them to the ARP table; S16. Perform tunnel encapsulation according to the Ethernet message format, add 0x00 before the Ethernet message, encapsulate the tunnel IP header and UDP header, and end the operation.

[0011] Preferably, the message processing procedure for the access device receiving the message from tunnel T in step (2) is as follows: ① Delete the tunnel IP header and UDP header, but keep the Ethernet packets; ② Based on the destination MAC address of the Ethernet message, perform broadcast or unicast processing.

[0012] Preferably, the message processing procedure for the access device receiving the message from tunnel T in step (2) is as follows: ① Delete the tunnel IP header and UDP header. If the packets carried by the tunnel are Ethernet packets, proceed to step ②; if they are IP packets, proceed to step ③. ② All Ethernet packets enter the Layer 2 forwarding process; in particular, if it is an ARP packet, the sender's IP and MAC addresses need to be resolved and saved to the ARP table; ③ If it is an IP packet, use the destination IP and source IP of the packet to look up the ARP table to obtain the destination MAC and source MAC addresses, encapsulate them into an Ethernet packet, and then enter the Layer 2 forwarding process.

[0013] A device for interconnecting Ethernet networks at different locations at Layer 2 includes a tunnel establishment and authentication module, a Layer 2 forwarding module, an ACL module, and a NAT module. The tunnel establishment and authentication module is used to establish a tunnel T between the access device and the router that penetrates the NAT network, and is also used for legitimacy authentication. The Layer 2 forwarding module is used to forward packets based on the source MAC address, destination MAC address, and MAC address table. The ACL module is used to filter and judge the forwarded packets. The NAT module is used to convert the IP address in the IP datagram header to another IP address, enabling the internal network to access the external network and providing Internet services for the Layer 2 Ethernet device.

[0014] The beneficial effects of this invention are as follows: When a local network accesses the public network through NAT technology, this invention can perform Layer 2 interconnection of Ethernet networks in different locations, reducing the complexity of user service deployment. At the same time, each Ethernet network in a different location can access the Internet using the nearest public network interface, improving network efficiency and showing broad application prospects. Attached Figure Description

[0015] The present invention will now be described in detail with reference to the accompanying drawings and specific embodiments; Figure 1 This is a schematic diagram of the structure of common broadband user networking modes in the background technology; Figure 2 This is a schematic diagram of the networking mode structure of the present invention; Figure 3 This is a schematic diagram illustrating the processing flow of the access device of the present invention receiving a local area network physical interface message; Figure 4 This is a schematic diagram of packet encapsulation on a UDP tunnel T according to the present invention; Figure 5 This is a schematic diagram of the encapsulation of an Ethernet message according to the present invention; Figure 6 This is a schematic diagram of the process of sending messages to the tunnel according to the present invention. Implementation

[0016] To make the technical means, creative features, objectives and effects of this invention easier to understand, the invention will be further described below in conjunction with specific embodiments.

[0017] Reference Figure 2-6This specific implementation adopts the following technical solution: a method for interconnecting a Layer 2 Ethernet network in different locations, the network including access devices and routers. Both the routers and access devices access the Internet through NAT technology and integrate NAT modules to provide Internet services for local area network (Layer 2 Ethernet) devices. The routers integrate DHCP server functions, running a DHCP server to assign IP addresses to LAN devices, and have the function of assigning IP addresses. The access devices do not have DHCP server functions. The specific steps are as follows: (1) Establish a tunnel T between the access device and the router to penetrate the NAT network and perform legal authentication. After successful authentication, add tunnel T to the local area network. (2) When the access device receives an IP packet whose destination IP is a public IP address from the local area network, it processes it through the NAT module and sends it to the Internet through the public interface. Other packets are processed according to the Layer 2 forwarding process. (3) Tunnel T transmission message mode 1: All messages are encapsulated as complete Ethernet messages and transmitted to tunnel T; (4) Tunnel T Transmission Message Mode 2: Unicast IP messages are encapsulated only in the IP part and transmitted to Tunnel T, while other messages are encapsulated in the complete Ethernet message and transmitted to Tunnel T.

[0018] It is worth noting that step (1) establishes an IP tunnel T between the access device and the router that penetrates NAT. Tunnel T is established using STUN (Session Traversal Utilities for NAT) technology, but other methods can also be used. The IP tunnel protocol type must support NAT, including TCP (Transmission Control Protocol), UDP (User Datagram Protocol), and ICMP (Internet Control Message Protocol). After tunnel T is established, the access device needs to be further authenticated. The authentication method can be username + password or certificate. After successful authentication, tunnel T joins the local area network, and its functions and behaviors are the same as those of the physical port.

[0019] The specific implementation method for the access device to receive a local area network physical interface packet is as follows: S1. Determine if the packet is an IP packet based on the packet type in the Ethernet packet: If the international standard 0x0800 is an IP packet, resolve the destination IP; if it is not an IP packet, treat other packets as non-IP packets and proceed directly to step S5; S2. Determine if it is a private IP address. If it is, proceed to step S5; otherwise, proceed to step S3. S3. Determine whether access to the public network is allowed. If not, proceed to step S5; if access is allowed, proceed to step S4. S4. Following the public network message processing procedure, existing home wireless routers generally process the message through the NAT module and then send it to the Internet via the public network interface. S5. Following the Layer 2 message processing flow, query the MAC address table based on the destination MAC address to send Ethernet messages to which physical ports or tunnels, and learn the source MAC address.

[0020] It is worth noting that the private network IP in step S2 includes three address ranges as defined by IANA (Internet Address Allocation Organization): 10.0.0.0 to 10.255.255.255, 172.16.0.0 to 172.31.255.255, and 192.168.0.0 to 192.168.255.255, as well as the LAN broadcast address 255.255.255.255 and the multicast address (224.0.0.0 - 239.255.255.255). In this invention, these can be identified as private network addresses, or they can be configured by the user or product itself.

[0021] In some scenarios in step S3, due to user security or management needs, packets destined for the public network must be processed by specific devices. For example, when computer 2 sends an email, the email content may need to be checked or archived by computer 1 before it can be sent. In this case, it cannot be directly transferred to the public network through the access device. The rules for judging packets are generally called ACLs (Access Control Lists), and ACL rules can be defined by users.

[0022] Step S5 is similar to the Layer 2 forwarding process of VPLS technology. The difference is that VPLS tunnel packets are generally encapsulated with labels or GRE (Generic Routing Encapsulation), while this invention uses IP protocol encapsulation that supports NAT. Taking UDP as an example, the packet encapsulation on tunnel T is as follows: Figure 4 .

[0023] To utilize public network bandwidth more efficiently, tunnel T can remove the Ethernet header when sending IP-type unicast Ethernet packets. This is because the first byte of an IP packet is the version number (4 bits) + header length (4 bits), which is always greater than 0x40. A first byte less than 0x40 can be used to represent other packet types; for example, 0x00 represents an Ethernet packet. Figure 5 As shown.

[0024] The processing flow for sending messages to the tunnel in step S5 above is as follows: S11. Determine if it is an IP packet. If yes, proceed to S12; otherwise, proceed to S14. S12. Determine whether the message is broadcast or multicast based on the destination MAC address: all Fs indicate broadcast, and the least significant bit of the first byte being equal to 1 indicates multicast MAC; if yes, proceed to S16; otherwise, proceed to S13. S13. After removing the Ethernet header, perform tunnel encapsulation and end the operation; S14. Determine if it is an ARP message: if yes, proceed to S15; if no, proceed to S16. S15. ARP Learning: Parse the sender's IP and MAC address in ARP packets and save them to the ARP table; S16. Perform tunnel encapsulation according to the Ethernet message format, add 0x00 before the Ethernet message, encapsulate the tunnel IP header and UDP header, and end the operation.

[0025] The specific implementation method for the access device to process messages received from tunnel T is as follows: ① Delete the tunnel IP header and UDP header, but keep the Ethernet packets; ② Based on the destination MAC address of the Ethernet message, perform broadcast or unicast processing.

[0026] The message processing procedure for the access device receiving a message from tunnel T is as follows: ① Delete the tunnel IP header and UDP header. If the packets carried by the tunnel are Ethernet packets, proceed to step ②; if they are IP packets, proceed to step ③. ② All Ethernet packets enter the Layer 2 forwarding process; in particular, if it is an ARP packet, the sender's IP and MAC addresses need to be resolved and saved to the ARP table; ③ If it is an IP packet, use the destination IP and source IP of the packet to look up the ARP table to obtain the destination MAC and source MAC addresses, encapsulate them into an Ethernet packet, and then enter the Layer 2 forwarding process.

[0027] This specific embodiment also provides a device for interconnecting Ethernet Layer 2 networks in different locations, including a tunnel establishment and authentication module, a Layer 2 forwarding module, an ACL module, and a NAT module. The tunnel establishment and authentication module is used to establish a tunnel T between the access device and the router that penetrates the NAT network, and is also used for legitimacy authentication. The Layer 2 forwarding module is used to forward packets based on the source MAC address, destination MAC address, and MAC address table. The ACL module is used to filter and judge the forwarded packets. The NAT module is used to convert the IP address in the IP datagram header to another IP address, enabling the internal network to access the external network and providing Internet services for the Layer 2 Ethernet device.

[0028] In this specific implementation, when computer 2 is powered on, it typically runs the DHCP protocol as a client to request an IP address from the DHCP server. Through this process, the router will inevitably assign an IP address to computer 2 within the local area network segment, thereby simulating two geographically isolated Ethernet networks as the same local area network to achieve Layer 2 interconnection. Simultaneously, computer 2 can access the Internet through its local access device, avoiding the need to forward traffic through tunnel T to the router, thus saving bandwidth and improving network efficiency. This specific implementation method enables geographically dispersed Ethernet Layer 2 interconnection. It leverages the simplicity of Layer 2 network communication to reduce the complexity of user service deployment. At the same time, each geographically dispersed Ethernet network can access the Internet via a nearby public network interface, improving network efficiency and demonstrating broad market application prospects.

[0029] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely illustrative of the principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as claimed. The scope of protection of this invention is defined by the appended claims and their equivalents.

Claims

1. A method for interconnecting two layer 2 networks of different sites, characterized in that, Its network architecture includes access devices and routers. Both routers and access devices access the Internet through NAT technology and integrate NAT modules to provide Internet services to local area network devices. The specific steps are as follows: Step (1) Establish a tunnel T between the access device and the router to penetrate the NAT network and perform legality authentication. After successful authentication, add tunnel T to the local area network. Step (2) When the access device receives an IP packet whose destination IP is a public IP address from the local area network, it processes it through the NAT module and sends it to the Internet through the public interface. Other packets are processed according to the Layer 2 forwarding process. Step (3) Tunnel T transmits messages in mode one: all messages are encapsulated as complete Ethernet messages and transmitted to tunnel T; Step (4) Tunnel T transmits messages in mode 2: Unicast IP messages are encapsulated only in the IP part and transmitted to tunnel T, while other messages are encapsulated in the complete Ethernet message and transmitted to tunnel T.

2. The method for interconnecting a geographically dispersed Ethernet network at Layer 2 according to claim 1, characterized in that, The router integrates DHCP server functionality to assign IP addresses to LAN devices, while the access devices do not have DHCP server functionality.

3. The method for interconnecting two-layer of Ethernet networks in different sites according to claim 1, wherein, Step (1) establishes an IP tunnel T that penetrates NAT between the access device and the router. Tunnel T is established using STUN technology. The IP tunnel protocol type supports NAT, including TCP, UDP, and ICMP.

4. The method for interconnecting two-layer of Ethernet networks in different sites according to claim 1, wherein, After tunnel T is established in step (1), the access device is authenticated. The authentication method is username + password or certificate. After successful authentication, tunnel T joins the local area network and has the same functions and behaviors as the physical port.

5. The method for interconnecting two-layer of Ethernet networks in different sites according to claim 1, wherein, The processing flow of the access device receiving the local area network physical interface message in step (2) is as follows: Step (S1). Determine whether the packet is an IP packet based on the packet type in the Ethernet packet: if the international standard 0x0800 is an IP packet, resolve the destination IP; if it is not an IP packet, treat other packets as non-IP packets and proceed directly to step (S5); Step (S2). Determine if it is a private network IP. Private network IPs include the three address ranges specified by IANA: 10.0.0.0 to 10.255.255.255, 172.16.0.0 to 172.31.255.255, and 192.168.0.0 to 192.168.255.255, as well as the LAN broadcast address 255.255.255.

255. If it is a private network IP, proceed to step (S5); if it is not a private network IP, proceed to step (S3). Step (S3). Determine whether access to the public network is allowed. If not, proceed to step (S5); if access is allowed, proceed to step (S4). Step (S4). Following the public network packet processing procedure, existing home wireless routers generally process the packets through the NAT module and then send them to the Internet via the public network interface. Step (S5). According to the Layer 2 packet processing flow, query the MAC address table based on the destination MAC to send Ethernet packets to which physical ports or tunnels, and learn the source MAC address.

6. The method for interconnecting two-layer of Ethernet networks at different sites according to claim 5, wherein, The process of sending a message to the tunnel in step (S5) is as follows: Step (S11). Determine if it is an IP packet. If yes, proceed to step (S12); otherwise, proceed to step (S14). Step (S12). Determine whether the message is a broadcast or multicast based on the destination MAC address: all Fs indicate broadcast, and the least significant bit of the first byte being equal to 1 indicates multicast MAC. If yes, proceed to step (S16); otherwise, proceed to step (S13). Step (S13). After removing the Ethernet header, perform tunnel encapsulation and end the operation; Step (S14). Determine if it is an ARP packet: if yes, proceed to step (S15); if no, proceed to step (S16). Step (S15). ARP learning: parse the sender's IP and MAC address of the ARP packet and save it to the ARP table; Step (S16). Perform tunnel encapsulation according to the Ethernet message format, add 0x00 before the Ethernet message, encapsulate the tunnel IP header and UDP header, and end the operation.

7. The method for interconnecting two-layer of Ethernet networks in different sites according to claim 1, wherein, The message processing procedure for the access device receiving the message from tunnel T in step (2) is as follows: ① Delete the tunnel IP header and UDP header, but keep the Ethernet packets; ② Based on the destination MAC address of the Ethernet message, perform broadcast or unicast processing.

8. The method for geographically distributed Ethernet Layer 2 interconnection according to claim 1, wherein, The message processing procedure for the access device receiving the message from tunnel T in step (2) is as follows: ① Delete the tunnel IP header and UDP header. If the packets carried by the tunnel are Ethernet packets, proceed to step ②; if they are IP packets, proceed to step ③. ② All Ethernet packets enter the Layer 2 forwarding process; If it is an ARP packet, parse the sender's IP and MAC addresses and save them to the ARP table; ③ If it is an IP packet, use the destination IP and source IP of the packet to look up the ARP table to obtain the destination MAC and source MAC addresses, encapsulate them into an Ethernet packet, and then enter the Layer 2 forwarding process.

Images