A tunnel port negotiation method and device, electronic equipment and storage medium

Abstract

Embodiments of the present disclosure disclose a tunnel port negotiation method and device, electronic equipment and a storage medium. The method comprises: an initiator sending a first negotiation message of a first port number; when a second negotiation message replied by a responder is not received, the initiator sends a plurality of first probe messages of a plurality of different port numbers, and the port numbers of all the first probe messages are port numbers in a preset port pool; the responder replies a second probe message according to a second port number corresponding to one of the received first probe messages; the negotiation port number of the initiator is set as the second port number according to the second probe message; the initiator sends a third negotiation message of the second port number; the negotiation port number of the responder is set as the second port number according to the received third negotiation message; and the responder replies a fourth negotiation message to the initiator, so as to complete the tunnel port negotiation between the initiator and the responder and establish a first tunnel. The method can realize self-negotiation of the tunnel port and has high usability.

Description

Technical Field

[0001] This disclosure relates to the field of network security technology, and in particular to a tunnel port negotiation method, apparatus, electronic device, and storage medium. Background Technology

[0002] The IKE (Internet Key Agreement) protocol enables automatic tunnel negotiation between two devices. The standard IKE protocol uses port numbers 500 and 4500 for negotiation. However, in scenarios where port numbers 500 and 4500 are disabled, the user's IKE protocol messages cannot be transmitted, resulting in the inability to establish a tunnel between the two devices.

[0003] In existing technologies, the problem of tunnel establishment between two devices when standard protocol ports are disabled is solved by first maintaining a port pool (which includes both standard protocol ports and non-standard protocol ports), and then allowing users to freely choose the negotiation method from the port pool.

[0004] However, the inventors discovered that the existing tunnel port negotiation method requires users to select the same port number at both ends before negotiation can proceed, and it cannot perform self-negotiation, making it difficult to use. Summary of the Invention

[0005] In view of this, the present disclosure provides a tunnel port negotiation method, apparatus, electronic device and storage medium, which can realize tunnel port self-negotiation and is highly easy to use.

[0006] In a first aspect, the present disclosure provides a tunnel port negotiation method, which adopts the following technical solution:

[0007] The tunnel port negotiation method includes:

[0008] The initiator sends the first negotiation message for the first port number;

[0009] If no response is received from the responder in the second negotiation message, the initiator sends multiple first probe messages with multiple different port numbers, and all the port numbers of the first probe messages are port numbers in a preset port pool;

[0010] The responder replies with a second probe message based on the second port number corresponding to a first probe message received;

[0011] According to the second probe message, the initializer's negotiation port number is set to the second port number;

[0012] The initiator sends a third negotiation message for the second port number;

[0013] Based on the received third negotiation message, the responder's negotiation port number is set to the second port number;

[0014] The responder replies to the initiator with a fourth negotiation message to complete tunnel port negotiation between the initiator and the responder, and establish a first tunnel.

[0015] Optionally, the tunnel port negotiation method is characterized by further comprising: before the initiator sends a first negotiation message for a first port number, creating a first state for the initiator according to the state machine configuration information of the initiator, wherein the negotiation port number recorded in the first state is the first port number; setting the negotiation port number of the initiator to the second port number comprises: modifying the negotiation port number recorded in the first state of the initiator to the second port number.

[0016] Setting the responder's negotiation port number to the second port number includes: creating a second state for the responder based on the responder's state machine configuration information, wherein the negotiation port number recorded in the second state is the second port number.

[0017] Optionally, the tunnel port negotiation method further includes:

[0018] Before the initiator sends the first negotiation message for the first port number, a first state is created for the initiator according to the initiator's state machine configuration information, and the negotiation port number recorded in the first state is the first port number;

[0019] When the responder receives the first negotiation message, a second state is created for the responder according to the responder's state machine configuration information, and the negotiation port number recorded in the second state is the first port number;

[0020] The responder replies to the initiator with the second negotiation message to complete tunnel port negotiation between the initiator and the responder and establish a first tunnel.

[0021] Optionally, determining that the initiator has not received a second negotiation message from the responder includes: the initiator sends a first negotiation message for the first port number only once, and if it does not receive a second negotiation message from the responder, then it is determined that the initiator has not received a second negotiation message from the responder; or, after the initiator sends a first negotiation message for the first port number for the first time and does not receive a second negotiation message from the responder, the initiator retransmits the first negotiation message for the first port number, and if it does not receive a second negotiation message from the responder after N retransmissions, then it is determined that the initiator has not received a second negotiation message from the responder, where N is a positive integer greater than or equal to 1.

[0022] Optionally, both the first probe message and the second probe message include a verification payload, which is used to determine that the first probe message and the second probe message are probe messages.

[0023] Optionally, the responder replies with a second probe message based on the second port number corresponding to the first probe message received.

[0024] Optionally, determining that the first probe message received by the responder is the first first probe message includes:

[0025] When the responder receives the first first probe message, it creates a third state for the first probe message, and the third state records the identification identifier common to all first probe messages;

[0026] When the responder receives any non-first probe message, it finds the third state based on the identification identifier and discards the non-first probe message.

[0027] Optionally, the tunnel port negotiation method further includes: deleting the third state after the creation of the third state reaches a preset time, wherein the preset time is shorter than the minimum time interval for retransmission by the initiator.

[0028] Optionally, the identification identifier is a triple including the initiator's iCooke, the source IP, and the destination IP.

[0029] Optionally, the tunnel port negotiation method further includes:

[0030] The initiator periodically sends a first DPD message to probe the first tunnel;

[0031] If the initiator does not receive a second DPD message in response from the responder, the initiator sends multiple first DPD messages for other port numbers in the port pool;

[0032] In the second state, based on the third port number corresponding to a received first DPD message, the negotiation port number recorded in the second state of the responder is modified to the third port number, and the responder replies with a second DPD message;

[0033] Based on the received second DPD message, the negotiation port number of the initiator's first state record is modified to the third port number, and tunnel port negotiation is completed between the initiator and the responder to establish a new first tunnel.

[0034] Optionally, the tunnel port negotiation method further includes:

[0035] Establish a second tunnel between the initiator and the responder;

[0036] When an anomaly is detected in the first tunnel using SDWAN technology, the traffic between the initiator and the responder is switched to the second tunnel;

[0037] Renegotiate the port number and establish a new first tunnel;

[0038] After establishing the new first tunnel, and upon detecting that the new first tunnel is functioning normally via SDWAN technology, the traffic between the initiator and the responder is switched to the new first tunnel.

[0039] Optionally, the preset port pool includes at least one standard port number and multiple non-standard port numbers; the first port number is a standard port number.

[0040] Secondly, this disclosure also provides a tunnel port negotiation device, which adopts the following technical solution:

[0041] The tunnel port negotiation device includes:

[0042] The first sending module is used for the initiator to send the first negotiation message for the first port number;

[0043] The second sending module is used to allow the initiator to send multiple first probe messages with multiple different port numbers when it does not receive a second negotiation message from the responder. All the port numbers of the first probe messages are port numbers in a preset port pool.

[0044] The first response module is used to allow the responder to reply with a second probe message based on the second port number corresponding to a received first probe message;

[0045] The first setting module is used to set the negotiation port number of the initiator to the second port number according to the second probe message;

[0046] The third sending module is used for the initiator to send a third negotiation message for the second port number;

[0047] The second setting module is used to set the responder's negotiation port number to the second port number according to the received third negotiation message;

[0048] The second response module is used for the responder to reply to the initiator with a fourth negotiation message to complete tunnel port negotiation between the initiator and the responder and establish a first tunnel.

[0049] Thirdly, this disclosure also provides an electronic device that adopts the following technical solution:

[0050] The electronic device includes:

[0051] At least one processor; and,

[0052] A memory communicatively connected to the at least one processor; wherein,

[0053] The memory stores instructions that can be executed by the at least one processor, which, when executed, enable the at least one processor to perform any of the tunnel port negotiation methods described above.

[0054] Fourthly, embodiments of this disclosure also provide a computer-readable storage medium storing computer instructions for causing a computer to perform any of the tunnel port negotiation methods described above.

[0055] This disclosure provides a tunnel port negotiation method, apparatus, electronic device, and storage medium. In this tunnel port negotiation method, if the selected first port number is disabled, the initiator will not be able to receive the second negotiation message from the responder. In this case, the initiator sends multiple first probe messages with multiple different port numbers, all of which are port numbers from a preset port pool. Based on the second port number corresponding to a received first probe message, the responder replies with a second probe message. Based on the second probe message, the initiator's negotiation port number is set to the second port number. The initiator then sends a third negotiation message with the second port number. Based on the received third negotiation message, the responder's negotiation port number is set to the second port number. The responder replies with a fourth negotiation message to the initiator, thereby completing the tunnel port negotiation between the initiator and the responder and establishing a first tunnel. Therefore, the above tunnel port negotiation method can achieve self-negotiation of tunnel ports and is highly usable.

[0056] The above description is merely an overview of the technical solution disclosed herein. In order to better understand the technical means of this disclosure and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of this disclosure more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0057] To more clearly illustrate the technical solutions of the embodiments of this disclosure, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this disclosure. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0058] Figure 1 A flowchart of a tunnel port negotiation method provided in this embodiment of the disclosure;

[0059] Figure 2A schematic diagram of the tunnel port negotiation process provided in the embodiments of this disclosure. Figure 1 ;

[0060] Figure 3 A schematic diagram of the tunnel port negotiation process provided in the embodiments of this disclosure. Figure 2 ;

[0061] Figure 4 A schematic diagram of the tunnel port negotiation process provided in the embodiments of this disclosure. Figure 3 ;

[0062] Figure 5 A schematic diagram of the tunnel port negotiation process provided in the embodiments of this disclosure. Figure 4 ;

[0063] Figure 6 A schematic diagram of the tunnel port negotiation process provided in the embodiments of this disclosure. Figure 5 ;

[0064] Figure 7 A schematic diagram of the tunnel port negotiation process provided in the embodiments of this disclosure. Figure 6 ;

[0065] Figure 8 A schematic diagram of the tunnel port negotiation process provided in the embodiments of this disclosure. Figure 7 ;

[0066] Figure 9 A schematic block diagram of a tunnel port negotiation device provided in an embodiment of this disclosure;

[0067] Figure 10 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present disclosure. Detailed Implementation

[0068] The embodiments of this disclosure will now be described in detail with reference to the accompanying drawings.

[0069] It should be understood that the following specific examples illustrate the implementation of this disclosure, and those skilled in the art can easily understand other advantages and effects of this disclosure from the content disclosed in this specification. Obviously, the described embodiments are only a part of the embodiments of this disclosure, and not all of them. This disclosure can also be implemented or applied through other different specific implementation methods, and the details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of this disclosure. It should be noted that, in the absence of conflict, the following embodiments and features in the embodiments can be combined with each other. Based on the embodiments in this disclosure, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this disclosure.

[0070] It should be noted that various aspects of embodiments within the scope of the appended claims are described below. It will be apparent that the aspects described herein can be embodied in a wide variety of forms, and any particular structure and / or function described herein is merely illustrative. Based on this disclosure, those skilled in the art will understand that one aspect described herein can be implemented independently of any other aspect, and two or more of these aspects can be combined in various ways. For example, any number of aspects set forth herein can be used to implement the device and / or practice the method. Additionally, this device and / or method can be implemented using structures and / or functionalities other than one or more of the aspects set forth herein.

[0071] It should also be noted that the illustrations provided in the following embodiments are only schematic representations of the basic concept of this disclosure. The drawings only show the components related to this disclosure and are not drawn according to the number, shape and size of the components in actual implementation. In actual implementation, the form, quantity and proportion of each component can be arbitrarily changed, and the layout of the components may also be more complex.

[0072] Furthermore, specific details are provided in the following description to facilitate a thorough understanding of the examples. However, those skilled in the art will understand that the described aspects can be practiced without these specific details.

[0073] This disclosure provides a tunnel port negotiation method, specifically, as follows: Figure 1 As shown, the tunnel port negotiation method includes:

[0074] Step S1: The initiator sends the first negotiation message for the first port number.

[0075] The first port number mentioned above is one of the preset port numbers in a port pool. The preset port pool may include at least one standard port number (e.g., port number 500) and multiple non-standard port numbers. In this case, the standard port number has higher priority in the port pool, and when a standard port number is available, it can be preferentially selected for tunnel establishment. Optionally, the first port number in step S1 is a standard port number. Alternatively, the preset port pool may consist entirely of non-standard port numbers, in which case the first port number can be any non-standard port number. The number of ports in the port pool can be determined according to actual needs to avoid excessive resource consumption and insufficient negotiation efficiency. For example, the number of ports in the port pool is 6.

[0076] For example, such as Figure 2 and Figure 3As shown, before initiator A sends the first negotiation message m1 with the first port number (port number 500), a first state st1 is created for initiator A according to the state machine configuration information (configuration ConfA). The negotiation port number recorded in the first state st1 is the first port number, as shown below. Figure 2 As shown, if the first port number is blocked, the first negotiation message m1 cannot reach responder B; if the first port number is available, as... Figure 3 As shown, the first negotiation message m1 can reach responder B.

[0077] In step S1, the initiator A may send the first negotiation message m1 for the first port number only once, or, as... Figure 2 As shown, initiator A sends a first negotiation message m1 on the first port number for the first time. If the first negotiation message m1 cannot reach responder B, the initiator retransmits the first negotiation message m1 on the first port number. The more retransmissions, the longer the time interval between two retransmissions. For example, the interval between the first transmission and the first retransmission is 10 seconds, the interval between the first retransmission and the second retransmission is 20 seconds, and the interval between the second retransmission and the third retransmission is 30 seconds.

[0078] Step S2: When no response is received from the responder in the second negotiation message, the initiator sends multiple first probe messages with different port numbers. All first probe messages use port numbers from a preset port pool.

[0079] like Figure 2 As shown, if the first port number is blocked, the first negotiation message m1 cannot reach responder B, and responder B will not reply with the second negotiation message. Consequently, the initiator cannot receive the second negotiation message replied by the responder.

[0080] Optionally, determining that the initiator has not received a second negotiation message from the responder includes: the initiator sends a first negotiation message for the first port number only once, and if it does not receive a second negotiation message from the responder, then it is determined that the initiator has not received a second negotiation message from the responder; or, after the initiator sends a first negotiation message for the first port number for the first time and does not receive a second negotiation message from the responder, the initiator retransmits the first negotiation message for the first port number, and if it does not receive a second negotiation message from the responder after N retransmissions, then it is determined that the initiator has not received a second negotiation message from the responder, where N is a positive integer greater than or equal to 1, for example, N=2, N=3, N=4, etc.

[0081] At this time, as Figure 4As shown, initiator A sends multiple first probe packets with different port numbers. All first probe packets use port numbers from a pre-defined port pool, such as mp(port2), mp2(port3), etc. During this process, initiator A can also send a first probe packet with the first port number, which will inevitably fail to reach responder B.

[0082] Of course, such as Figure 3 As shown, when the first port number is available and the first negotiation message m1 can reach responder B, a second state st2 can be created for responder B according to the state machine configuration information (configuration ConfB) of responder B. At this time, the negotiation port number recorded in the second state st2 is the first port number. Responder B replies to initiator A with the second negotiation message m2 to complete the tunnel port negotiation between initiator A and responder B and establish the first tunnel.

[0083] Optionally, the first probe message includes a verification payload (which can be a vendor-defined payload). The verification payload is used to determine that the first probe message is a probe message, thereby distinguishing the probe message from the negotiation message.

[0084] Step S3: Based on the second port number corresponding to the received first probe message, the responder replies with a second probe message.

[0085] Optionally, the responder replies with a second probe message based on the second port number corresponding to the first probe message received. Specifically, as shown... Figure 4 As shown, determining that the first probe message received by the responder is the first probe message includes: when responder B receives the first probe message mp(port2), a third state PrvSt is created for the first probe message mp(port2). The third state PrvSt records an identification identifier common to all first probe messages; when responder B receives any non-first probe message, after finding the third state PrvSt based on the identification identifier, the non-first probe message is discarded. If the third state PrvSt does not exist, it means that responder B received the first probe message.

[0086] Optionally, the identification identifier is a triple including the initiator's iCooke, the source IP, and the destination IP. For all first probe packets, the corresponding triple is exactly the same.

[0087] Optionally, the tunnel port negotiation method further includes: deleting the third-state PrvSt after a preset time has elapsed since its creation, with the preset time being shorter than the minimum retransmission interval of the initiator. Since the third-state PrvSt is no longer needed after the probe in step S3, deleting it periodically satisfies memory management requirements. Furthermore, the preset time being shorter than the minimum retransmission interval of the initiator further avoids conflicts with the third states of potentially newly initiated probe packets, thus preventing the responder from determining whether the received packet is the first probe packet.

[0088] Optionally, the second probe message includes a verification payload (which can be a vendor-defined payload). The verification payload is used to determine that the second probe message is a probe message, thereby distinguishing the probe message from the negotiation message.

[0089] like Figure 5 As shown, based on the second port number port2 corresponding to the first received probe message mp(port2), the responder replies with a second probe message. Figure 5 In this context, it is also represented as mp(port2).

[0090] Optionally, whether a received message is a first probe message can be determined based on whether it has a check payload.

[0091] Step S4: Based on the second probe message, set the initialist's negotiation port number to the second port number.

[0092] Optionally, such as Figure 5 As shown, before the initiator A sends the first negotiation message m1 with the first port number (port number 500), a first state st1 is created for the initiator A according to the state machine configuration information (configuration ConfA). When the negotiation port number recorded in the first state st1 is the first port number, the negotiation port number recorded in the first state st1 of the initiator A can be directly modified to the second port number port2 according to the second probe message mp (port2).

[0093] Optionally, whether a received message is a second probe message can be determined based on whether the received message has a check payload.

[0094] Step S5: The initiator sends a third negotiation message for the second port number.

[0095] The content of the third negotiation message is the same as that of the first negotiation message, only the port number is different. Therefore, the above statement "the initiator sends the third negotiation message on the second port number" is essentially equivalent to "the initiator retransmits the first negotiation message through the second port number." Figure 5 As shown, the initiator A sends a third negotiation message m3(port2) on the second port number port2.

[0096] Step S6: Based on the received third negotiation message, set the responder's negotiation port number to the second port number.

[0097] Optionally, the responder's negotiation port number can be set to a second port number, including: such as Figure 5 As shown, based on the state machine configuration information (configuration ConfB) of responder B, a second state st2 is created for responder B. The negotiation port number recorded in the second state st2 is the second port number port2. Specifically, after responder B receives the third negotiation message m3 (port2), it finds that the port number is a non-standard port number. When searching for a matching configuration ConfB, it uses <source IP, port number 500, destination IP, port number 500> to find a matching ConfB. After finding a matching ConfB, the second state st2 of responder B is created based on the ConfB. At this time, the port number on the second state st2 is not recorded as a standard port number but as the second port number port2.

[0098] Step S7: The responder replies to the initiator with a fourth negotiation message to complete the tunnel port negotiation between the initiator and the responder and establish the first tunnel.

[0099] like Figure 5 As shown, responder B replies to initiator A with the fourth negotiation message m4(port2) via the second port number port2, so as to complete the tunnel port negotiation between initiator A and responder B and establish the first tunnel.

[0100] Furthermore, the inventors discovered that after tunnel port negotiation is completed between initiator A and responder B to establish the first tunnel, the second port number still carries the risk of being suddenly blocked. If NAT exists in the middle of the first tunnel, data packets using NAT to traverse the port number will be directly blocked, but the status of the first tunnel remains that the negotiation was successful. To solve the above problems, the tunnel port negotiation method in this disclosure embodiment further includes:

[0101] A. The initiator periodically sends the first DPD message to probe the first tunnel.

[0102] Once the first tunnel is established, the initiator will periodically send the first DPD message to probe the connectivity of the first tunnel. For example... Figure 6 As shown, the first tunnel is established based on standard port number 500. Initiator A sends DPD_outI1 (first DPD message). If standard port number 500 is not disabled, responder B, upon receiving DPD_outI1, will reply with DPD_inI1_outR1 (second DPD message). Figure 7As shown, if standard port number 500 is suddenly disabled, the initiator A will keep sending DPD_outI1. If it does not receive a reply DPD_inI1_outR1 from responder B after a certain period of time or number of times, it will assume that standard port number 500 is disabled and the first tunnel has been disconnected.

[0103] B. If no response is received from the responder in the second DPD message, the initiator sends multiple first DPD messages for other port numbers in the port pool.

[0104] For example, when standard port number 500 is suddenly disabled, responder B cannot receive DPD_outI1 sent by initiator A, and the initiator will inevitably not receive DPD_inI1_outR1 replied by responder B. At this time, as follows: Figure 8 As shown, initiator A sends multiple first DPD packets for other port numbers in the port pool. Figure 8 This is represented as DPD_outI1(port2, port3, ...). Alternatively, the first DPD message corresponding to the port number of the first tunnel can be retransmitted simultaneously; this first DPD message will not be received by responder B.

[0105] Optionally, the sequence number in the first DPD packet of other port numbers in the port pool is the same.

[0106] C. In the second state, based on the third port number corresponding to the received first DPD message, the responder modifies the negotiation port number in the second state record to the third port number, and the responder replies with a second DPD message.

[0107] Optionally, in the second state, based on the third port number corresponding to the first received first DPD message, the negotiation port number in the responder's second state record is modified to the third port number, and the responder replies with a second DPD message. Specifically, as follows: Figure 8 As shown, after creating a first state st1 for initiator A and a second state st2 for responder B, due to the anti-replay mechanism of the second state st2, responder B only receives the first first DPD message (DPD_outI1(port3)). Subsequent first DPD messages with the same sequence number will be discarded. The negotiation port number recorded in responder B's second state st2 is modified to the third port number port3 of the first first DPD message. Responder B then replies with a second DPD message (…). Figure 8 This is also represented as DPD_outI1(port3)), which is used to re-establish the tunnel using the third port number port3 of the first DPD message.

[0108] D. Based on the received second DPD message, modify the negotiation port number in the initiator's first state record to the third port number, complete the tunnel port negotiation between the initiator and the responder, and establish a new first tunnel.

[0109] like Figure 8 As shown, based on the received DPD_outI1(port3), the negotiation port number recorded in the first state st1 of the initiator A is modified to the third port number port3, thereby completing the tunnel port negotiation between the initiator A and the responder B and establishing a new first tunnel.

[0110] It should be noted that since DPD is bidirectional, the responder will also send DPD messages in return to probe the connectivity of the first tunnel.

[0111] During the above process of renegotiating the port number, since the first and second states have already been created, the efficiency of renegotiation based on these states is much higher than re-executing steps S1 to S7 to negotiate the tunnel port.

[0112] Optionally, to further mitigate or avoid black hole routing, restore normal network status more quickly, and increase tunnel robustness, the tunnel port negotiation method provided in this disclosure embodiment further includes:

[0113] A. Establish a second tunnel between the initiator and the responder.

[0114] Optionally, by executing steps S1 to S7, a second tunnel is established between the initiator and the responder. The port number of the second tunnel is necessarily different from that of the first tunnel. The first tunnel is the primary tunnel, and the second tunnel is the backup tunnel. The routing priority of the primary tunnel is higher than that of the backup tunnel. When the primary tunnel is functioning normally, all traffic goes through the primary tunnel.

[0115] B. When an anomaly is detected in the first tunnel using SDWAN technology, the traffic between the initiator and the responder is switched to the second tunnel.

[0116] Establish an SDWAN connection and enable its link detection function. When the detection detects that traffic in the first tunnel (primary tunnel) is not working, SDWAN switches the traffic between the initiator and responder to the second tunnel (backup tunnel) for forwarding. The response time for detection using SDWAN technology can be as fast as 1 second, enabling rapid switching from the first tunnel to the second tunnel, thus significantly reducing the losses caused by black hole routing.

[0117] C. Re-negotiate the port number and establish a new first tunnel.

[0118] At this point, the renegotiation process following the sudden disabling of the port can be re-executed to establish a new first tunnel. Of course, the port number of the new first tunnel will not be the same as that of the second tunnel.

[0119] D. After establishing the new first tunnel, and upon detecting that the new first tunnel is functioning normally via SDWAN technology, switch the traffic between the initiator and the responder to the new first tunnel.

[0120] The new first tunnel serves as the primary tunnel, while the second tunnel continues to serve as the backup tunnel. When the new first tunnel is detected to be functioning normally via SDWAN technology, traffic between the initiator and the responder is switched to the new first tunnel.

[0121] In the tunnel port negotiation method provided in this embodiment, if the selected first port number is disabled, the initiator will not be able to receive the second negotiation message replied by the responder. In this case, the initiator sends multiple first probe messages with multiple different port numbers, all of which are port numbers from a preset port pool. Based on the second port number corresponding to a received first probe message, the responder replies with a second probe message. Based on the second probe message, the initiator's negotiation port number is set to the second port number. The initiator then sends a third negotiation message with the second port number. Based on the received third negotiation message, the responder's negotiation port number is set to the second port number. The responder replies with a fourth negotiation message to the initiator, thereby completing the tunnel port negotiation between the initiator and the responder and establishing the first tunnel. Therefore, the above tunnel port negotiation method can achieve self-negotiation of tunnel ports and is highly usable.

[0122] The above tunnel port negotiation method can be applied to scenarios where edge gateway devices need to use IPSEC VPN but the standard negotiation port is blocked by the operator.

[0123] For example, the specific application process of the above tunnel port negotiation method includes:

[0124] 1. Configure two tunnels, a primary tunnel and a backup tunnel, and enable DPD detection for both tunnels. The default negotiation port number of the backup tunnel needs to be different from that of the primary tunnel to ensure that the backup tunnel is unobstructed when the primary tunnel switches to the backup tunnel.

[0125] 2. Enable port anti-blocking function for both tunnels and configure port pools independently for port switching when a port is blocked;

[0126] 3. After the two tunnels have successfully negotiated, configure the SDWAN link detection function, configure the SDWAN routing and select the specified routing function, prioritize the link where the main tunnel is located, and then select the link where the backup tunnel is located. When the main tunnel is not available, SDWAN will switch the traffic to the backup tunnel.

[0127] 4. If the port is blocked during the negotiation of the main tunnel or the backup tunnel, use steps S1 to S7 in the tunnel port negotiation method to negotiate a new port in the port pool for tunnel negotiation.

[0128] 5. If an intermediate network port is blocked after the main tunnel or backup tunnel has been successfully negotiated, an SDWAN link probe will be performed first. If the main tunnel probe fails, the system will switch to the backup tunnel during the black hole routing time of the main tunnel to ensure uninterrupted service. During the black hole routing time of the main tunnel, an available port number will be renegotiated using the DPD probe function, and the tunnel will be renegotiated. If the negotiation is successful, the SDWAN link probe will find that the main tunnel is now accessible again, and traffic will switch back to the main tunnel.

[0129] This disclosure also provides a tunnel port negotiation device, such as... Figure 9 As shown, the tunnel port negotiation device includes:

[0130] The first sending module is used for the initiator to send the first negotiation message for the first port number;

[0131] The second sending module is used to allow the initiator to send multiple first probe messages with multiple different port numbers when it does not receive a second negotiation message from the responder. All port numbers of the first probe messages are port numbers in a preset port pool.

[0132] The first response module is used to allow the responder to reply with a second probe message based on the second port number corresponding to a first probe message received;

[0133] The first setting module is used to set the initialist's negotiated port number to the second port number according to the second probe message;

[0134] The third sending module is used for the initiator to send the third negotiation message for the second port number;

[0135] The second setting module is used to set the responder's negotiation port number to the second port number based on the received third negotiation message;

[0136] The second response module is used for the responder to reply to the initiator with the fourth negotiation message, so as to complete the tunnel port negotiation between the initiator and the responder and establish the first tunnel.

[0137] Optionally, the tunnel port negotiation device further includes: a state creation module, used to create a first state for the initiator based on the initiator's state machine configuration information, and to create a second state for the responder based on the responder's state machine configuration information.

[0138] Optionally, the tunnel port negotiation device further includes a state deletion module, used to delete the third state after a preset time has elapsed since the creation of the third state, the preset time being shorter than the minimum time interval for retransmission by the initiator.

[0139] Optionally, the tunnel port negotiation device further includes a tunnel reconstruction module, specifically used for: the initiator periodically sending a first DPD message to probe the first tunnel; when no second DPD message is received from the responder, the initiator sends multiple first DPD messages for other port numbers in the port pool; in the second state, based on the third port number corresponding to a received first DPD message, the initiator modifies the negotiation port number recorded in the second state of the responder to the third port number, and the responder replies with a second DPD message; based on the received second DPD message, the initiator modifies the negotiation port number recorded in the first state of the initiator to the third port number, and completes tunnel port negotiation between the initiator and the responder to establish a new first tunnel.

[0140] Optionally, the tunnel port negotiation device further includes a tunnel switching module, specifically used for: establishing a second tunnel between the initiator and the responder; switching traffic between the initiator and the responder to the second tunnel when an anomaly is detected in the first tunnel via SDWAN technology; renegotiation of the port number to establish a new first tunnel; and switching traffic between the initiator and the responder to the new first tunnel after the new first tunnel is established and when a normal operation is detected via SDWAN technology.

[0141] It should be noted that the specific details of the tunnel port negotiation method in this embodiment are applicable to the corresponding module of the tunnel port negotiation device, and will not be repeated here.

[0142] An electronic device according to embodiments of the present disclosure includes a memory and a processor. The memory is used to store non-transitory computer-readable instructions. Specifically, the memory may include one or more computer program products, which may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may, for example, include random access memory (RAM) and / or cache memory. The non-volatile memory may, for example, include read-only memory (ROM), a hard disk, flash memory, etc.

[0143] The processor may be a central processing unit (CPU) or other form of processing unit with data processing capabilities and / or instruction execution capabilities, and may control other components in the electronic device to perform desired functions. In one embodiment of this disclosure, the processor is used to execute computer-readable instructions stored in the memory, causing the electronic device to perform all or part of the steps of the tunnel port negotiation methods of the foregoing embodiments of this disclosure.

[0144] Those skilled in the art will understand that, in order to solve the technical problem of how to achieve a good user experience, this embodiment may also include well-known structures such as communication buses and interfaces, and these well-known structures should also be included within the protection scope of this disclosure.

[0145] like Figure 10 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present disclosure. It illustrates a structural schematic diagram suitable for implementing the electronic device in the embodiment of the present disclosure. Figure 10 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of the embodiments disclosed herein.

[0146] like Figure 10 As shown, an electronic device may include a processor (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes based on a program stored in read-only memory (ROM) or a program loaded from a storage device into random access memory (RAM). The RAM also stores various programs and data required for the operation of the electronic device. The processor, ROM, and RAM are interconnected via a bus. Input / output (I / O) interfaces are also connected to the bus.

[0147] Typically, the following devices can be connected to the I / O interface: input devices, such as sensors or visual information acquisition devices; output devices, such as displays; storage devices, such as magnetic tapes or hard drives; and communication devices. Communication devices allow electronic devices to communicate wirelessly or wiredly with other devices (such as edge computing devices) to exchange data. Although Figure 10 Electronic devices with various devices are shown, but it should be understood that it is not required to implement or have all of the devices shown. More or fewer devices may be implemented or have alternatively.

[0148] In particular, according to embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from a storage device, or installed from a ROM. When the computer program is executed by a processor, all or part of the steps of the tunnel port negotiation method of embodiments of this disclosure are performed.

[0149] For a detailed description of this embodiment, please refer to the corresponding descriptions in the foregoing embodiments, which will not be repeated here.

[0150] A computer-readable storage medium according to embodiments of the present disclosure stores non-transitory computer-readable instructions. When these non-transitory computer-readable instructions are executed by a processor, all or part of the steps of the tunnel port negotiation methods described in the foregoing embodiments of the present disclosure are performed.

[0151] The aforementioned computer-readable storage media include, but are not limited to: optical storage media (e.g., CD-ROM and DVD), magneto-optical storage media (e.g., MO), magnetic storage media (e.g., magnetic tape or portable hard drive), media with built-in rewritable non-volatile memory (e.g., memory card), and media with built-in ROM (e.g., ROM cartridge).

[0152] For a detailed description of this embodiment, please refer to the corresponding descriptions in the foregoing embodiments, which will not be repeated here.

[0153] The basic principles of this disclosure have been described above with reference to specific embodiments. However, it should be noted that the advantages, benefits, and effects mentioned in this disclosure are merely examples and not limitations, and should not be considered as essential features of each embodiment of this disclosure. Furthermore, the specific details disclosed above are for illustrative and facilitative purposes only, and are not limitations. These details do not limit the scope of this disclosure to the necessity of employing the aforementioned specific details for implementation.

[0154] In this disclosure, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. The block diagrams of devices, apparatuses, devices, and systems involved in this disclosure are merely illustrative examples and are not intended to require or imply that they must be connected, arranged, or configured in the manner shown in the block diagrams. As those skilled in the art will recognize, these devices, apparatuses, devices, and systems can be connected, arranged, and configured in any manner. Words such as "comprising," "including," "having," etc., are open-ended terms meaning "including but not limited to," and are used interchangeably with them. The terms "or" and "and" as used herein refer to the terms "and / or," and are used interchangeably with them unless the context clearly indicates otherwise. The term "such as" as used herein refers to the phrase "such as but not limited to," and is used interchangeably with it.

[0155] Additionally, as used herein, the “or” used in a list of items beginning with “at least one” indicates a separate list, such that a list of, for example, “at least one of A, B, or C” means A or B or C, or AB or AC or BC, or ABC (i.e., A and B and C). Furthermore, the word “exemplary” does not imply that the described example is preferred or better than other examples.

[0156] It should also be noted that in the systems and methods of this disclosure, the components or steps can be decomposed and / or recombined. These decompositions and / or recombinations should be considered as equivalent solutions to this disclosure.

[0157] Various changes, substitutions, and modifications can be made to the technology described herein without departing from the teachings defined by the appended claims. Furthermore, the scope of the claims of this disclosure is not limited to the specific aspects of the processes, machines, manufactures, events, means, methods, and actions described above. Currently existing or later-developed processes, machines, manufactures, events, means, methods, or actions that perform substantially the same function or achieve substantially the same result as the corresponding aspects described herein can be utilized. Therefore, the appended claims include such processes, machines, manufactures, events, means, methods, or actions within their scope.

[0158] The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use this disclosure. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other aspects without departing from the scope of this disclosure. Therefore, this disclosure is not intended to be limited to the aspects shown herein, but rather to be carried out within the widest scope consistent with the principles and novel features disclosed herein.

[0159] The above description has been given for purposes of illustration and description. Furthermore, this description is not intended to limit the embodiments of this disclosure to the forms disclosed herein. Although numerous exemplary aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, alterations, additions, and sub-combinations therein.

Claims

1. A tunnel port negotiation method, characterized in that, include: The initiator sends the first negotiation message for the first port number; If no response is received from the responder in the second negotiation message, the initiator sends multiple first probe messages with multiple different port numbers, and all the port numbers of the first probe messages are port numbers in a preset port pool; The responder replies with a second probe message based on the second port number corresponding to a first probe message received; According to the second probe message, the initializer's negotiation port number is set to the second port number; The initiator sends a third negotiation message for the second port number; Based on the received third negotiation message, the responder's negotiation port number is set to the second port number; The responder replies to the initiator with a fourth negotiation message to complete tunnel port negotiation between the initiator and the responder, and establish a first tunnel.

2. The tunnel port negotiation method according to claim 1, characterized in that, Also includes: Before the initiator sends the first negotiation message for the first port number, a first state is created for the initiator according to the initiator's state machine configuration information, and the negotiation port number recorded in the first state is the first port number; Setting the negotiation port number of the initiator to the second port number includes: modifying the negotiation port number of the first state record of the initiator to the second port number; Setting the responder's negotiation port number to the second port number includes: creating a second state for the responder based on the responder's state machine configuration information, wherein the negotiation port number recorded in the second state is the second port number.

3. The tunnel port negotiation method according to claim 1, characterized in that, Also includes: Before the initiator sends the first negotiation message for the first port number, a first state is created for the initiator according to the initiator's state machine configuration information, and the negotiation port number recorded in the first state is the first port number; When the responder receives the first negotiation message, a second state is created for the responder according to the responder's state machine configuration information, and the negotiation port number recorded in the second state is the first port number; The responder replies to the initiator with the second negotiation message to complete tunnel port negotiation between the initiator and the responder and establish a first tunnel.

4. The tunnel port negotiation method according to any one of claims 1 to 3, characterized in that, Determining that the initiator has not received a second negotiation message from the responder includes: the initiator sends a first negotiation message for the first port number only once; if it does not receive a second negotiation message from the responder, then it is determined that the initiator has not received a second negotiation message from the responder; or, after the initiator sends a first negotiation message for the first port number for the first time and does not receive a second negotiation message from the responder, the initiator retransmits the first negotiation message for the first port number; if it does not receive a second negotiation message from the responder after N retransmissions, then it is determined that the initiator has not received a second negotiation message from the responder, where N is a positive integer greater than or equal to 1.

5. The tunnel port negotiation method according to any one of claims 1 to 3, characterized in that, Both the first probe message and the second probe message include a verification payload, which is used to determine that the first probe message and the second probe message are probe messages.

6. The tunnel port negotiation method according to any one of claims 1 to 3, characterized in that, Based on the second port number corresponding to the first probe message received, the responder replies with a second probe message.

7. The tunnel port negotiation method according to claim 6, characterized in that, Determining that the first probe message received by the responder is the first probe message includes: When the responder receives the first first probe message, it creates a third state for the first probe message, and the third state records the identification identifier common to all first probe messages; When the responder receives any non-first probe message, it finds the third state based on the identification identifier and discards the non-first probe message.

8. The tunnel port negotiation method according to claim 7, characterized in that, Also includes: After the third state is created for a preset time, the third state is deleted. The preset time is shorter than the minimum time interval for retransmission of the initiator.

9. The tunnel port negotiation method according to claim 7, characterized in that, The identification identifier is a triple including the initiator's iCooke, the source IP, and the destination IP.

10. The tunnel port negotiation method according to claim 2 or 3, characterized in that, Also includes: The initiator periodically sends a first DPD message to probe the first tunnel; If the initiator does not receive a second DPD message in response from the responder, the initiator sends multiple first DPD messages for other port numbers in the port pool; In the second state, based on the third port number corresponding to a received first DPD message, the negotiation port number recorded in the second state of the responder is modified to the third port number, and the responder replies with a second DPD message; Based on the received second DPD message, the negotiation port number of the initiator's first state record is modified to the third port number, and tunnel port negotiation is completed between the initiator and the responder to establish a new first tunnel.

11. The tunnel port negotiation method according to any one of claims 1 to 3, characterized in that, Also includes: Establish a second tunnel between the initiator and the responder; When an anomaly is detected in the first tunnel using SDWAN technology, the traffic between the initiator and the responder is switched to the second tunnel; Renegotiate the port number and establish a new first tunnel; After establishing the new first tunnel, and upon detecting that the new first tunnel is functioning normally via SDWAN technology, the traffic between the initiator and the responder is switched to the new first tunnel.

12. The tunnel port negotiation method according to any one of claims 1 to 3, characterized in that, The preset port pool includes at least one standard port number and multiple non-standard port numbers; the first port number is a standard port number.

13. A tunnel port negotiation device, characterized in that, include: The first sending module is used for the initiator to send the first negotiation message for the first port number; The second sending module is used to allow the initiator to send multiple first probe messages with multiple different port numbers when it does not receive a second negotiation message from the responder. All the port numbers of the first probe messages are port numbers in a preset port pool. The first response module is used to allow the responder to reply with a second probe message based on the second port number corresponding to a received first probe message; The first setting module is used to set the negotiation port number of the initiator to the second port number according to the second probe message; The third sending module is used for the initiator to send a third negotiation message for the second port number; The second setting module is used to set the responder's negotiation port number to the second port number according to the received third negotiation message; The second response module is used for the responder to reply to the initiator with a fourth negotiation message to complete tunnel port negotiation between the initiator and the responder and establish a first tunnel.

14. An electronic device, characterized in that, The electronic device includes: At least one processor; and, A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the tunnel port negotiation method according to any one of claims 1-12.

15. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions for causing a computer to perform the tunnel port negotiation method according to any one of claims 1-12.

Images