Security protection method and cloud platform

Abstract

The application provides a security protection method and a cloud platform, the method is applied to the cloud platform, the cloud platform comprises a spine switch, a first leaf switch and a second leaf switch; the first leaf switch is connected with a plurality of virtual switches, the virtual switches are connected with a plurality of tenant virtual machines, and the second leaf switch is connected with a plurality of hardware firewalls; the method comprises the following steps: when the virtual switch receives network traffic, a target second leaf switch is determined, the network traffic is sent to the hardware firewall through the first leaf switch connected with the virtual switch, the spine switch and the target second leaf switch, the network traffic is subjected to security detection through the hardware firewall, and if the traffic is abnormal traffic, the traffic is intercepted. According to the method of the application, the traffic can be guided to the hardware firewall for security detection, each tenant can share the hardware firewall to realize security protection, a virtual firewall does not need to be deployed by the tenant, the security protection cost can be reduced, and the resource utilization rate is improved.

Description

Technical Field

[0001] This invention relates to the field of cloud computing technology, and in particular to a security protection method and cloud platform. Background Technology

[0002] With the development of cloud computing technology, cloud platforms have been widely used in various service scenarios. During the service process of cloud platforms, it is usually necessary to perform security detection on network traffic in the cloud in order to protect the security of each tenant in the cloud.

[0003] Currently, security protection in cloud platforms is mainly implemented based on virtual firewalls. Typically, firewalls are deployed within each tenant's Virtual Private Cloud (VPC), using virtual machines to host the firewall. Network traffic requiring security checks is routed to the virtual machine hosting the firewall via subnet routing, thus achieving security protection.

[0004] In existing security protection methods, each virtual firewall only provides security protection for its associated tenants. This means that each tenant needs to deploy a corresponding virtual firewall, resulting in high security costs. Secondly, in real-world business scenarios, the traffic load of each tenant is usually uneven, which leads to significant differences in the resource utilization of each virtual firewall, easily causing resource waste. Summary of the Invention

[0005] In view of this, embodiments of the present invention provide a security protection method and cloud platform to solve the problem that in existing security protection methods, each tenant needs to deploy a virtual firewall, which is costly and easily leads to resource waste.

[0006] To achieve the above objectives, the embodiments of the present invention provide the following technical solutions:

[0007] A security protection method is applied to a cloud platform, the cloud platform comprising: a spine switch, a first switch cluster, and a second switch cluster; the first switch cluster includes at least one first leaf switch, and the second switch cluster includes at least one second leaf switch; the first leaf switch is connected to multiple virtual switches, each virtual switch is connected to multiple tenant virtual machines, and the second leaf switch is connected to multiple hardware firewalls; the method includes:

[0008] When the first virtual switch receives network traffic sent by the tenant virtual machine it is connected to, it determines the target second leaf switch corresponding to the network traffic in the second switch cluster; the first virtual switch is the virtual switch connected to the first leaf switch in the first switch cluster.

[0009] The first virtual switch performs virtual extended LAN packet encapsulation on the network traffic based on the address of the target second leaf switch to obtain the first traffic packet corresponding to the network traffic. The first traffic packet is then sent to the target second leaf switch through the first leaf switch and the spine switch connected by the first virtual switch.

[0010] The target second leaf switch performs virtual extended LAN packet decapsulation processing on the first traffic packet to obtain the second traffic packet corresponding to the network traffic.

[0011] The target second leaf switch determines the target hardware firewall corresponding to the network traffic among the various hardware firewalls it is connected to, and sends the second traffic packet to the target hardware firewall.

[0012] The target hardware firewall performs security detection on the network traffic based on the second traffic packet, and obtains a security detection result. If the security detection result indicates that the network traffic is abnormal, the network traffic is blocked to provide security protection for the cloud platform.

[0013] Optionally, in the above method, the hardware firewall connected to the second leaf switch is connected to the second leaf switch through a target interface, which is a Layer 2 aggregation interface configured as a port aggregation interface.

[0014] The hardware firewall connected to the second leaf switch is configured with multiple Layer 3 sub-interfaces and multiple virtual routing forwarding instances, and the multiple Layer 3 sub-interfaces and the multiple virtual routing forwarding instances are bound one-to-one.

[0015] Optionally, in the above method, sending the second traffic packet to the target hardware firewall includes:

[0016] Based on the pre-configured policy routing, the target Layer 3 sub-interface corresponding to the second traffic packet is determined among the Layer 3 sub-interfaces of the target hardware firewall. The second traffic packet is then sent to the virtual route forwarding instance bound to the target Layer 3 sub-interface through the target Layer 3 sub-interface, thereby sending the second traffic packet to the target hardware firewall.

[0017] Optionally, in the above method, the hardware firewalls connected to the second leaf switch perform session synchronization based on a preset remote backup management protocol.

[0018] The above methods may also include:

[0019] If the security detection result indicates that the network traffic is normal traffic, the target hardware firewall will send the second traffic packet to the target second leaf switch.

[0020] The target second leaf switch determines the target address corresponding to the second traffic packet, performs virtual extended LAN packet encapsulation processing on the second traffic packet based on the target address to obtain the third traffic packet corresponding to the network traffic, and forwards the third traffic packet through the spine switch and the first switch cluster so that the network traffic reaches the target address.

[0021] Optionally, if the network traffic is east-west traffic, the process of forwarding the third traffic packet through the spine switch and the first switch cluster to ensure the network traffic reaches the target address includes:

[0022] The target second leaf switch sends the third traffic packet to the spine switch;

[0023] The spine switch, within the first switch cluster, determines the target first leaf switch corresponding to the target address and sends the third traffic packet to the target first leaf switch.

[0024] The target first leaf switch determines the second virtual switch corresponding to the target address among the virtual switches it is connected to, and sends the third traffic packet to the second virtual switch;

[0025] The second virtual switch performs virtual extended LAN packet decapsulation processing on the third traffic packet to obtain the fourth traffic packet corresponding to the network traffic;

[0026] The second virtual switch determines the target tenant virtual machine corresponding to the target address among the various tenant virtual machines it is connected to, and sends the fourth traffic packet to the target tenant virtual machine.

[0027] Optionally, in the above method, the first switch cluster further includes a third-leaf switch, which is connected to the Internet gateway and the service gateway respectively; if the network traffic is north-south traffic, the process of forwarding the third-leaf traffic packets through the spine switch and the first switch cluster to enable the network traffic to reach the target address includes:

[0028] The target second leaf switch sends the third traffic packet to the spine switch;

[0029] The spine switch sends the third traffic packet to the third leaf switch;

[0030] The third leaf switch sends the third traffic packet to the Internet gateway;

[0031] The Internet gateway performs virtual extended LAN packet decapsulation processing on the third traffic packet to obtain the fifth traffic packet corresponding to the network traffic.

[0032] The Internet gateway performs network address translation on the target address to obtain the public network address corresponding to the target address, and performs virtual extended LAN packet encapsulation on the fifth traffic packet based on the public network address to obtain the sixth traffic packet corresponding to the network traffic.

[0033] The Internet gateway sends the sixth traffic packet to the service gateway through the third leaf switch;

[0034] The service gateway performs virtual extended LAN packet decapsulation processing on the sixth traffic packet to obtain the seventh traffic packet corresponding to the network traffic, and sends the seventh traffic packet to the public network.

[0035] The above methods may also include:

[0036] Collect network performance statistics for the first switch cluster and network performance statistics for the second switch cluster;

[0037] Collect network performance statistics for each virtual switch connected to the first leaf switch in the first switch cluster;

[0038] Collect network performance statistics for each hardware firewall connected to the second leaf switch in the second switch cluster;

[0039] The network performance statistics of the first switch cluster, the second switch cluster, each virtual switch, and each hardware firewall are sent to a preset operation and maintenance system so that the operation and maintenance system can display the data.

[0040] The above methods may also include:

[0041] Monitor each of the aforementioned hardware firewalls to determine if it is in a faulty state;

[0042] When each of the hardware firewalls is detected to be in a faulty state, for each virtual switch connected to the first leaf switch, the traffic forwarding mechanism of the virtual switch is changed so that the virtual switch forwards traffic according to the original path of the traffic packets.

[0043] A cloud platform, comprising:

[0044] The system includes a spine switch, a first switch cluster, and a second switch cluster; the first switch cluster includes at least one first leaf switch, and the second switch cluster includes at least one second leaf switch; the first leaf switch is connected to multiple virtual switches, each of the virtual switches is connected to multiple tenant virtual machines, and the second leaf switch is connected to multiple hardware firewalls.

[0045] The virtual switch is used to determine the target second leaf switch corresponding to the network traffic in the second switch cluster when it receives network traffic sent by the tenant virtual machine connected to it; based on the address of the target second leaf switch, it performs virtual extended LAN packet encapsulation processing on the network traffic to obtain the first traffic packet corresponding to the network traffic; and sends the first traffic packet to the target second leaf switch through the first leaf switch and the spine switch connected by the virtual switch.

[0046] The target second leaf switch is used to perform virtual extended LAN packet decapsulation processing on the first traffic packet to obtain the second traffic packet corresponding to the network traffic; among the hardware firewalls connected to the target second leaf switch, the target hardware firewall corresponding to the network traffic is determined, and the second traffic packet is sent to the target hardware firewall.

[0047] The target hardware firewall is used to perform security detection on the network traffic based on the second traffic packet, obtain a security detection result, and if the security detection result indicates that the network traffic is abnormal, then the network traffic is blocked to provide security protection for the cloud platform.

[0048] A security protection method based on the above embodiments of the present invention is applied to a cloud platform, which includes a spine switch, a first switch cluster, and a second switch cluster. The first switch cluster includes at least one first leaf switch, and the second switch cluster includes at least one second leaf switch. The first leaf switch is connected to multiple virtual switches, each virtual switch is connected to multiple tenant virtual machines, and the second leaf switch is connected to multiple hardware firewalls. The method includes: when the first virtual switch receives network traffic sent by its connected tenant virtual machines, it determines the target second leaf switch corresponding to the network traffic in the second switch cluster, and performs virtualization on the network traffic based on the address of the target second leaf switch. Extended LAN packet encapsulation processing is performed to obtain a first traffic packet corresponding to the network traffic. This first traffic packet is then sent to a target second leaf switch via a first leaf switch and a spine switch connected by a first virtual switch. The target second leaf switch performs virtual extended LAN packet decapsulation processing on the first traffic packet to obtain a second traffic packet corresponding to the network traffic. It then identifies the target hardware firewall among its connected hardware firewalls and sends the second traffic packet to it. The target hardware firewall performs security detection on the network traffic based on the second traffic packet, obtaining a security detection result. If the security detection result indicates that the network traffic is abnormal, the network traffic is intercepted to provide security protection for the cloud platform. Using the method provided in this embodiment of the invention, multiple hardware firewalls are connected to the cloud platform. When a virtual switch receives network traffic that a tenant virtual machine needs to transmit, it can redirect the network traffic to the hardware firewall for security detection. Each tenant of the cloud platform can share the hardware firewall in the cloud platform for security protection, eliminating the need for each tenant to deploy their own virtual firewall, which helps reduce security protection costs and improve resource utilization. In addition, in actual business scenarios, some tenants have security protection requirements for application hardware firewalls. The method provided by the embodiments of the present invention can meet the security protection requirements of tenant application hardware firewalls and improve user experience. Attached Figure Description

[0049] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0050] Figure 1 A schematic diagram of the architecture of a cloud platform provided in an embodiment of the present invention;

[0051] Figure 2 A flowchart illustrating a security protection method provided in an embodiment of the present invention;

[0052] Figure 3 This is an example diagram of the architecture of a virtual network provided in an embodiment of the present invention;

[0053] Figure 4 This is a schematic diagram illustrating the network traffic flow path during a security protection process, provided as an embodiment of the present invention.

[0054] Figure 5 This is another schematic diagram illustrating the network traffic flow path during a security protection process, provided by an embodiment of the present invention.

[0055] Figure 6 This is an example architecture diagram of a monitoring system provided in an embodiment of the present invention. Detailed Implementation

[0056] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0057] In this application, the terms "comprising," "including," or any other variations thereof are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0058] This invention provides a security protection method applied to a cloud platform. An example architecture diagram of the cloud platform is shown below. Figure 1 As shown.

[0059] The cloud platform includes: a spine switch 101, a first switch cluster, and a second switch cluster; the first switch cluster includes at least one first leaf switch 102, and the second switch cluster includes at least one second leaf switch 103; the first leaf switch 102 is connected to multiple virtual switches 104, each virtual switch 104 is connected to multiple tenant virtual machines 105, and the second leaf switch 103 is connected to multiple hardware firewalls 106.

[0060] The method provided in this invention can be applied to cloud platforms based on a Spine-Leaf network architecture, which consists of spine switches and multiple leaf switches. In this invention, the first and second leaf switches in the cloud platform are the leaf switches in the Spine-Leaf network. The first leaf switch connects to virtual switches (OpenVS), with each first leaf switch connected to multiple virtual switches, and each virtual switch connected to various tenant virtual machines (VMs). The tenant VMs are the virtual machines (VMs) associated with a tenant. The second leaf switch connects to a hardware firewall cluster, with each second leaf switch connected to one hardware firewall cluster, which contains multiple hardware firewalls. For example... Figure 1 As shown, the first leaf switch is connected to virtual switches such as virtual switch 1 and virtual switch 2. Virtual switch 1 is connected to tenant virtual machines such as tenant virtual machine 1 and tenant virtual machine 2. Virtual switch 2 is connected to tenant virtual machines such as tenant virtual machine 3 and tenant virtual machine 4. The second leaf switch is connected to hardware firewalls such as hardware firewall 1 and hardware firewall 2.

[0061] It should be noted that, Figure 1 The architecture shown is merely a simplified schematic diagram provided to better illustrate the method of the present invention. It does not show all platform components, nor is it intended to limit the platform architecture in actual application scenarios. In actual application scenarios, the number of various leaf switches, the number of virtual switches connected to the first leaf switch, the number of tenant virtual machines connected to the virtual switches, and the number of hardware firewalls connected to the second leaf switch can all be deployed according to actual conditions without affecting the functionality of the method provided in the embodiments of the present invention.

[0062] The method flowchart provided in the embodiments of the present invention can be seen as follows: Figure 2 As shown, the method includes:

[0063] S201: When the first virtual switch receives network traffic sent by the tenant virtual machine it is connected to, it determines the target second leaf switch corresponding to the network traffic in the second switch cluster; the first virtual switch is the virtual switch connected to the first leaf switch in the first switch cluster.

[0064] In the method provided by this invention, when a tenant virtual machine needs to send network traffic to a designated traffic recipient, the network traffic it sends is first sent to the virtual switch it is connected to. The virtual switch then redirects the network traffic to a hardware firewall for security detection. When a virtual switch in the cloud platform receives the network traffic sent by the tenant virtual machine, that virtual switch becomes the so-called first virtual switch. Based on a pre-configured flow table, the first virtual switch can find a second leaf switch in the second leaf switch cluster that matches the current network traffic and use that second leaf switch as the target second leaf switch.

[0065] S202: The first virtual switch performs virtual extended LAN packet encapsulation on the network traffic based on the address of the target second leaf switch to obtain the first traffic packet corresponding to the network traffic, and sends the first traffic packet to the target second leaf switch through the first leaf switch and the spine switch connected by the first virtual switch.

[0066] In the method provided by the embodiments of the present invention, during the security protection process, Virtual Extended Local Area Network (VXLAN) technology is used to forward traffic. VXLAN is also known as an extensible virtual local area network.

[0067] The first virtual switch uses the address of the target second leaf switch as the destination address for packet forwarding, performs Virtual Extended LAN (VXLAN) packet encapsulation on the network traffic, and uses the encapsulated VXLAN packet as the first traffic packet. The first leaf switch and the spine switch connected via the first virtual switch send the first traffic packet to the target second leaf switch. Specifically, the first virtual switch sends the first traffic packet to its connected first leaf switch, which then forwards it to the spine switch, which in turn forwards it to the target second leaf switch.

[0068] S203: The target second leaf switch performs virtual extended LAN packet decapsulation processing on the first traffic packet to obtain the second traffic packet corresponding to the network traffic;

[0069] In the method provided by this embodiment of the invention, when the target second leaf switch receives the first traffic packet sent by the spine switch, it decapsulates the VXLAN packet and uses the decapsulated packet as the second traffic packet.

[0070] S204: The target second leaf switch determines the target hardware firewall corresponding to the network traffic in each of the hardware firewalls it is connected to, and sends the second traffic packet to the target hardware firewall.

[0071] In the method provided by this embodiment of the invention, the target second leaf switch can find a hardware firewall that matches the current network traffic among the various hardware firewalls it is connected to based on pre-configured policy routing, use that hardware firewall as the target hardware firewall, and send the second traffic packet to the target hardware firewall so that the target hardware firewall can perform security detection on the current network traffic.

[0072] S205: The target hardware firewall performs security detection on the network traffic based on the second traffic packet, and obtains a security detection result. If the security detection result indicates that the network traffic is abnormal, the network traffic is blocked to provide security protection for the cloud platform.

[0073] In the method provided by this embodiment of the invention, after receiving the second traffic packet, the target hardware firewall performs security detection based on the second traffic packet, that is, performs security detection on the network traffic and obtains the security detection result of the network traffic. If the security detection result indicates that the current network traffic is abnormal traffic, the network traffic is intercepted and no longer forwarded, thus ending the current network traffic processing process.

[0074] Based on the method provided in this embodiment of the invention, when a virtual switch receives network traffic sent by a tenant virtual machine connected to it, it determines a target second leaf switch in a second switch cluster and performs virtual extended LAN packet encapsulation processing on the network traffic based on the address of the target second leaf switch to obtain a first traffic packet. This first traffic packet is then sent to the target second leaf switch via the first leaf switch and the spine switch connected to the virtual switch. The target second leaf switch performs virtual extended LAN packet decapsulation processing on the first traffic packet to obtain a second traffic packet. Among the various hardware firewalls connected to the target second leaf switch, a target hardware firewall is determined, and the second traffic packet is sent to the target hardware firewall. The target hardware firewall performs security detection on the network traffic based on the second traffic packet. If the security detection result indicates that the network traffic is abnormal, the network traffic is intercepted to provide security protection for the cloud platform. By applying the method provided in this embodiment of the invention, multiple hardware firewalls are connected to the cloud platform. When a virtual switch receives network traffic that a tenant's virtual machine needs to transmit, it can redirect the network traffic to the hardware firewall for security inspection. Each tenant in the cloud platform can share the hardware firewall for security protection, eliminating the need for each tenant to deploy their own virtual firewall. This helps reduce security protection costs and improve resource utilization. Furthermore, in actual business scenarios, some tenants have security protection requirements for using hardware firewalls. Based on the method provided in this embodiment of the invention, these requirements can be met, improving the user experience.

[0075] The method provided in this invention can be implemented based on a virtual network on a cloud platform, which can be deployed and controlled based on Software Defined Networking (SDN). The architecture of this virtual network can be as follows: Figure 3 As shown, the virtual network is divided into three layers.

[0076] The first layer is the TC zone, responsible for accessing external networks, including external network traffic, Network Attached Storage (NAS) traffic, leased POP points, high-speed cloud devices, and Virtual Private Network (VPN) devices. All these devices utilize multi-active access. Leased POP points are accessed through a Direct Connect Gateway (DCGW), high-speed cloud devices through a Cloud Gateway (CGW), and VPN devices through a Virtual Private Network Gateway (VPNGW). This zone deploys Access Gateways (AGWs) and Serving Gateways (SGWs). The AGW is responsible for publishing Classless Inter-Domain Routing (CIDR) routes, while the SGW is responsible for rate limiting. The AGW and SGW interact with BLeaf switch nodes.

[0077] The second layer is the network element service area. The service areas deployed in this area provide tenants with network services from layer 3 to layer 7, including leased lines, Internet Gateway (IGW), Network Address Translation Gateway (NATGW), Load Balance (LB), INAT gateway, PDN gateway (PDNGateway (PGW), PSGW gateway, Virtual Private Cloud Peer (VPC Peer, VPCP), NAS, object storage public services, Virtual Gateway (VGW), VPN access, etc.

[0078] The third layer is the resource access layer, which is responsible for providing virtual network access services for VMs, containers and bare metals. The network element types are Distributed Virtual Router (DVR) and SmartNIC.

[0079] In combination Figure 1 and Figure 2Based on the provided method, in the method provided by the embodiments of the present invention, the hardware firewall connected to the second leaf switch is connected to the second leaf switch through a target interface, which is a Layer 2 aggregation interface configured as a port aggregation interface;

[0080] The hardware firewall connected to the second leaf switch is configured with multiple Layer 3 sub-interfaces and multiple virtual routing forwarding instances, and the multiple Layer 3 sub-interfaces and the multiple virtual routing forwarding instances are bound one-to-one.

[0081] In the method provided by this invention, each hardware firewall in the platform is connected to the second leaf switch via a Layer 2 aggregation interface. This interface is configured as a port aggregation interface, i.e., a trunk port, which can pass through all Virtual Local Area Networks (VLANs). Each hardware firewall in the platform is configured with multiple Layer 3 sub-interfaces and multiple Virtual Routing Forwarding (VRF) instances. Each Layer 3 sub-interface on the hardware firewall is bound to a specific VRF, meaning each Layer 3 sub-interface is bound to a separate VRF.

[0082] Based on the method provided in the above embodiments, the process of sending the second traffic packet to the target hardware firewall mentioned in step S204 of the method provided in this embodiment includes:

[0083] Based on the pre-configured policy routing, the target Layer 3 sub-interface corresponding to the second traffic packet is determined among the Layer 3 sub-interfaces of the target hardware firewall. The second traffic packet is then sent to the virtual route forwarding instance bound to the target Layer 3 sub-interface through the target Layer 3 sub-interface, thereby sending the second traffic packet to the target hardware firewall.

[0084] In the method provided by this invention, the target second-leaf switch can, based on pre-configured policy routing, find a Layer 3 sub-interface among the Layer 3 sub-interfaces of the target hardware firewall that matches the current network traffic, and designate this Layer 3 sub-interface as the target Layer 3 sub-interface. The second traffic packet is sent to the target Layer 3 sub-interface, causing the second traffic packet to enter the VRF bound to the target Layer 3 sub-interface, thus enabling the second traffic packet to reach the target hardware firewall. The target hardware firewall can then perform security inspections on the current network traffic at this VRF.

[0085] Based on the method provided in this embodiment of the invention, the hardware firewall can perform security detection on network traffic based on VRF, and can isolate the traffic of each tenant in the hardware firewall.

[0086] In combination Figure 1 and Figure 2 Based on the provided method, in the method provided by the embodiments of the present invention, the hardware firewalls connected to the second leaf switch perform session synchronization based on a preset remote backup management protocol.

[0087] In the method provided by this invention, the hardware firewalls connected to each second leaf switch in the platform synchronize session information based on the Remote Backup Management (RBM) protocol. That is, each second leaf switch is connected to a hardware firewall cluster based on the RBM protocol, and the hardware firewalls in the cluster can back each other up.

[0088] Based on the method provided in this embodiment of the invention, the synchronization of session information between the various hardware firewalls connected to the second leaf switch can improve the reliability of security detection services and achieve high load reliability.

[0089] In combination Figure 1 and Figure 2 Based on the provided method, the method provided in this embodiment of the invention further includes:

[0090] If the security detection result indicates that the network traffic is normal traffic, the target hardware firewall will send the second traffic packet to the target second leaf switch.

[0091] In the method provided by this embodiment of the invention, if the target hardware firewall indicates that the current network traffic is normal traffic based on its security detection result, the target hardware firewall will return the second traffic packet to the target second leaf switch.

[0092] The target second leaf switch determines the target address corresponding to the second traffic packet, performs virtual extended LAN packet encapsulation processing on the second traffic packet based on the target address to obtain the third traffic packet corresponding to the network traffic, and forwards the third traffic packet through the spine switch and the first switch cluster so that the network traffic reaches the target address.

[0093] In the method provided by this invention, the target second leaf switch parses the second traffic packet to obtain its corresponding destination address, i.e., the address of the current network traffic's destination. Based on the destination address, the target second leaf switch determines its forwarding path and accordingly encapsulates the second traffic packet with a Virtual Extended LAN (VXLAN) packet, using the encapsulated VXLAN packet as the third traffic packet. Then, the third traffic packet is forwarded via the spine switch and the leaf switches in the first switch cluster, which is also considered forwarding the current network traffic to ensure the network traffic reaches the destination address, thus completing the network traffic transmission.

[0094] Based on the methods provided in the above embodiments, in the method provided in this embodiment of the invention, if the network traffic is east-west traffic, the process of forwarding the third traffic packet through the spine switch and the first switch cluster to enable the network traffic to reach the target address includes:

[0095] The target second leaf switch sends the third traffic packet to the spine switch;

[0096] In the method provided by this embodiment of the invention, if the current network traffic is east-west traffic, which refers to traffic between virtual machines of tenants within the cloud platform, the target second leaf switch, after obtaining the third traffic packet, sends the third traffic packet to the spine switch, causing the spine switch to forward the current network traffic.

[0097] The spine switch, within the first switch cluster, determines the target first leaf switch corresponding to the target address and sends the third traffic packet to the target first leaf switch.

[0098] In the method provided by this embodiment of the invention, the spine switch can find the first leaf switch associated with the target address in the first switch cluster according to the routing information, take it as the target first leaf switch, and send the third traffic packet to the target first leaf switch so that the target first leaf switch can further forward the current network traffic.

[0099] The target first leaf switch determines the second virtual switch corresponding to the target address among the virtual switches it is connected to, and sends the third traffic packet to the second virtual switch;

[0100] In the method provided by this embodiment of the invention, after receiving the third traffic packet, the target first leaf switch can, based on routing information, find the virtual switch associated with the target address among the virtual switches connected to it, and designate that virtual switch as the second virtual switch. The third traffic packet is then sent to that virtual switch so that it can further forward the current network traffic.

[0101] The second virtual switch performs virtual extended LAN packet decapsulation processing on the third traffic packet to obtain the fourth traffic packet corresponding to the network traffic;

[0102] The second virtual switch determines the target tenant virtual machine corresponding to the target address among the various tenant virtual machines it is connected to, and sends the fourth traffic packet to the target tenant virtual machine.

[0103] In the method provided by this embodiment of the invention, after receiving the third traffic packet, the second virtual switch performs VXLAN packet decapsulation processing on the third traffic packet, and uses the decapsulated packet as the fourth traffic packet. Based on the routing information, among the various tenant virtual machines connected to the second virtual switch, the tenant virtual machine associated with the target address is found, and this tenant virtual machine is designated as the target tenant virtual machine. The fourth traffic packet is then sent to this tenant virtual machine, so that the current network traffic reaches the target tenant virtual machine. The current network traffic is the traffic that the tenant virtual machine sending the network traffic wants to send to the target tenant virtual machine.

[0104] To better illustrate the method provided in the embodiments of the present invention, based on the method provided in the above embodiments and in combination with actual application scenarios, an example is given to illustrate the network traffic flow process in the method provided in the embodiments of the present invention.

[0105] For example Figure 4As shown, leaf switch 1 (i.e., a first leaf switch) connects virtual switch 1 (OVS1) and virtual switch 2 (OVS2). Tenant virtual machine 1 connected to virtual switch 1 sends network traffic that needs to access tenant virtual machine 4. This network traffic needs to be processed by the hardware firewall for security protection. The SDN controller pre-issues a flow table to OVS1, so that traffic packets sent by each tenant virtual machine connected to OVS1 first pass through OVS1 on the compute node for corresponding operations. Based on its configuration, when OVS1 receives the traffic sent by tenant virtual machine 1, it encapsulates it with VXLAN. The destination address of the VXLAN packet header is leaf switch 2 (i.e., a second leaf switch), and the vxlanID is 100. The packet passes through the physical network devices leaf switch 1 and spine switch to reach leaf switch 2, where VXLAN decapsulation is performed. The SDN controller pre-issues a policy routing configuration to leaf switch 2, and the policy routing aggregates the outgoing interface of the packet after VXLAN decapsulation with the interface of the hardware firewall. When processing current traffic, Leaf Switch 2 can use policy-based routing to forward traffic packets to the VLAN with VLAN ID 100. The traffic then enters a VRF (Virtual Radio Service) through the Layer 3 sub-interface of the hardware firewall. This VRF has a pre-configured default route, with the outgoing interface being the Layer 3 sub-interface from which the traffic entered. Security rules are implemented on the VRF within the hardware firewall to protect the traffic. Once the hardware firewall has implemented these security rules, if the current traffic is allowed to flow, it returns to Leaf Switch 2 with a VLAN header of 100. Leaf Switch 2 performs VLAN-to-VXLAN mapping, mapping the traffic from VLAN 100 to VXLAN 101. The destination address of VXLAN 101 is OVS2. After forwarding to OVS2, OVS2 decapsulates the traffic using VXLAN and then directs it to the destination address of tenant virtual machine 4, completing the traffic forwarding. The configuration of the switches and hardware firewall involved in this entire process can be uniformly distributed by the SDN controller through the netconf channel. The SDN controller uniformly allocates VLANs and VXLAN IDs, and uniformly manages the conversion and mapping relationship between VXLAN IDs and VLANs, ensuring that one VXLAN ID corresponds to one VLAN header, thereby achieving isolation of VPC traffic.

[0106] Based on the methods provided in the above embodiments, the method provided in this embodiment of the invention further includes a third leaf switch, which is connected to the Internet gateway and the service gateway respectively; if the network traffic is north-south traffic, the process of forwarding the third traffic packets through the spine switch and the first switch cluster to enable the network traffic to reach the target address includes:

[0107] The target second leaf switch sends the third traffic packet to the spine switch;

[0108] The spine switch sends the third traffic packet to the third leaf switch;

[0109] In the method provided by this embodiment of the invention, a third leaf switch is also deployed in the first switch cluster. The third leaf switch is a leaf switch used to connect various types of gateways. The third leaf switch is connected to the Internet Gateway (IGW) and the Service Gateway (SGW).

[0110] In the method provided by this embodiment of the invention, if the current network traffic is north-south traffic, which is the traffic between the cloud platform and the external network, the target second leaf switch, after obtaining the third traffic packet, sends the third traffic packet to the spine switch, causing the spine switch to forward the third traffic packet to the third leaf switch.

[0111] The third leaf switch sends the third traffic packet to the Internet gateway;

[0112] In the method provided by this embodiment of the invention, after receiving the third traffic packet, the third leaf switch forwards it to the IGW.

[0113] The Internet gateway performs virtual extended LAN packet decapsulation processing on the third traffic packet to obtain the fifth traffic packet corresponding to the network traffic.

[0114] The Internet gateway performs network address translation on the target address to obtain the public network address corresponding to the target address, and performs virtual extended LAN packet encapsulation on the fifth traffic packet based on the public network address to obtain the sixth traffic packet corresponding to the network traffic.

[0115] The Internet gateway sends the sixth traffic packet to the service gateway through the third leaf switch;

[0116] In the method provided by this embodiment of the invention, the third traffic packet is decapsulated using VXLAN on the IGW, and the decapsulated packet is used as the fifth traffic packet. After the IGW performs NAT mapping on the target address, it obtains the corresponding public network address. Based on the public network address, the fifth traffic packet is encapsulated using VXLAN, and the encapsulated VXLAN packet is used as the sixth traffic packet. The sixth traffic packet is sent to the SGW via the third leaf switch.

[0117] The service gateway performs virtual extended LAN packet decapsulation processing on the sixth traffic packet to obtain the seventh traffic packet corresponding to the network traffic, and sends the seventh traffic packet to the public network.

[0118] In the method provided by this embodiment of the invention, the SGW performs VXLAN packet decapsulation processing on the sixth traffic packet, uses the decapsulated packet as the seventh traffic packet, performs traffic rate limiting, and then sends the seventh traffic packet to the public network.

[0119] To better illustrate the method provided in the embodiments of the present invention, based on the method provided in the above embodiments and in combination with actual application scenarios, the flow process of network traffic in the method provided in the embodiments of the present invention will be explained from a distance.

[0120] For example Figure 5 As shown, the platform deploys leaf switch 3 (i.e., the third leaf switch), which connects the Internet gateway IGW, the service gateway SGW, and the access gateway AGW. Figure 5 Other objects and Figure 4 The corresponding objects shown are the same, as can be seen in the previous explanation, and will not be repeated here.

[0121] In this embodiment of the invention, virtual switch 1 sends out network traffic that needs to access the public network. This network traffic flows through leaf switch 1, spine switch, and leaf switch 2 to the hardware firewall for security inspection. This flow process is similar to... Figure 4 The process of traffic flowing to the hardware firewall for security inspection is similar to that shown in the previous embodiments, and will not be repeated here. In this embodiment of the invention, after the traffic leaves the hardware firewall and reaches leaf switch 2, the destination address of the VXLAN packet is set to the IGW address. Then, the traffic is sent to leaf switch 3 via the spine switch. Leaf switch 3 then sends the traffic to the IGW. The traffic is decapsulated in VXLAN on the IGW, and after NAT mapping of the public network address, VXLAN encapsulation is added. The encapsulated packet is sent to SGW via leaf switch 3. After VXLAN decapsulation on the SGW, traffic rate limiting is performed, and then the traffic directly leaves the public network.

[0122] To better illustrate the method provided in the embodiments of the present invention, based on the methods provided in the above embodiments, the security protection method provided in the embodiments of the present invention will be further briefly described. The security protection process provided in the embodiments of the present invention mainly includes:

[0123] A hardware firewall cluster is connected to a leaf switch. Each hardware firewall in the cluster uses the RBM protocol to synchronize firewall session information. The hardware firewalls connect to the leaf switch via a Layer 2 aggregation interface, configured as a trunk port, allowing access to all VLANs. The SDN controller distributes the connection configurations for the uplink leaf switch and the hardware firewall itself. Each VPC corresponds to a VLAN on both the hardware firewall and the uplink leaf switch, achieving traffic isolation between VPCs. VXLAN packets from the OVS are decapsulated on the leaf switch and then routed via policy-based routing to the corresponding Layer 3 sub-interface of the hardware firewall. Each Layer 3 sub-interface on the hardware firewall is bound to a separate VRF, achieving tenant traffic isolation on the hardware firewall. Outgoing traffic on the hardware firewall is differentiated into east-west and north-south traffic. East-west traffic is routed via policy-based routing to the corresponding VXLAN and forwarded to the destination OVS. North-south traffic is routed via policy-based routing, encapsulated in VXLAN, and forwarded to the IGW. The configurations for the hardware firewall and its uplink leaf switch are distributed by the SDN controller via the netconf channel.

[0124] Based on the method provided in this embodiment of the invention, a hardware firewall can be deployed, and traffic requiring security protection can be diverted to the hardware firewall through configuration on OVS. At the same time, the session synchronization technology of the hardware firewall can achieve high load reliability, which can improve the traffic throughput of the hardware firewall in the entire cloud, make full use of resources, allow multiple tenants to share the hardware firewall, and the hardware firewall can be implemented by existing facilities in the actual business scenario, making use of old resources.

[0125] In combination Figure 1 and Figure 2 Based on the provided method, the method provided in this embodiment of the invention further includes:

[0126] Collect network performance statistics for the first switch cluster and network performance statistics for the second switch cluster;

[0127] The method provided in this invention can deploy a monitoring system to collect information from various leaf switches, hardware firewalls, and virtual switches on the platform, obtaining network performance statistics for each node. Specifically, information collection modules can be deployed on each node to collect various network performance statistics, including bit rate (bps), packets per second (pps), latency and packet loss statistics, and dropped packet content at the level of network interface card (NIC), VPC, CPU, subnet, and connection count.

[0128] In the method provided by this embodiment of the invention, network performance statistics information corresponding to a first switch cluster and network performance statistics information corresponding to a second switch cluster are collected. Specifically, an information collection module is deployed in each first leaf switch and each second leaf switch to collect network performance statistics data for each first leaf switch and each second leaf switch. The network performance statistics data of each first leaf switch are used as the network performance statistics information corresponding to the first switch cluster, and the network performance statistics data of each second leaf switch are used as the network performance statistics information corresponding to the second switch cluster.

[0129] Collect network performance statistics for each virtual switch connected to the first leaf switch in the first switch cluster;

[0130] In the method provided by this embodiment of the invention, each virtual switch information collection module in the platform collects network performance statistics data for each virtual switch to obtain network performance statistics information corresponding to each virtual switch.

[0131] Collect network performance statistics for each hardware firewall connected to the second leaf switch in the second switch cluster;

[0132] In the method provided by this embodiment of the invention, an information collection module is deployed on each hardware firewall in the platform to collect network performance statistics for each hardware firewall, thereby obtaining network performance statistics for each hardware firewall.

[0133] The network performance statistics of the first switch cluster, the second switch cluster, each virtual switch, and each hardware firewall are sent to a preset operation and maintenance system so that the operation and maintenance system can display the data.

[0134] The method provided in this embodiment of the invention can summarize the network performance statistics of each node and send them to a preset operation and maintenance system, and the operation and maintenance system can display various network performance statistics.

[0135] Based on the methods provided in the above embodiments, the methods provided in the embodiments of the present invention further include:

[0136] Monitor each of the aforementioned hardware firewalls to determine if it is in a faulty state;

[0137] When each of the hardware firewalls is detected to be in a faulty state, for each virtual switch connected to the first leaf switch, the traffic forwarding mechanism of the virtual switch is changed so that the virtual switch forwards traffic according to the original path of the traffic packets.

[0138] In the method provided by this invention, the operating status of each hardware firewall can also be monitored through a monitoring system to detect whether each hardware firewall is in a fault state. When all hardware firewalls are detected to be in a fault state, the traffic forwarding mechanism of each virtual switch in the platform is changed. That is, when the hardware firewalls are running normally, the traffic forwarding mechanism of the virtual switch is to redirect traffic to the hardware firewalls for security detection. When all hardware firewalls are faulty, the traffic forwarding mechanism is changed to forward traffic according to the original path of the traffic, directly forwarding the traffic to its destination.

[0139] Based on the method provided in this embodiment of the invention, the processing of the hardware firewall can be skipped when both hardware firewalls fail, which helps to ensure the normal operation of services.

[0140] To better illustrate the method provided in the embodiments of the present invention, based on the method provided in the above embodiments and combined with actual application scenarios, an example of a monitoring system for collecting network performance statistics and monitoring hardware firewall status is given. The architecture of the monitoring system mentioned in the embodiments of the present invention can be as follows: Figure 6 As shown. It should be noted that, Figure 6 The architecture shown is merely a simplified schematic diagram provided to better illustrate the method of the present invention. It does not show all information collection objects in actual application scenarios, nor is it intended to limit the architecture deployment in actual application scenarios.

[0141] The monitoring system is responsible for collecting network performance statistics from all compute nodes, leaf switches, hardware firewalls, and virtual switches, and reporting the collected data to the operations and maintenance (O&M) or product monitoring system. A sys-agent module is deployed on each compute node, leaf switch, hardware firewall, virtual switch, xGW gateway, load balancer (LB), and other nodes to obtain relevant statistical data from virtual switches, DPOS, and physical switches. The collected statistics include packet bps, pps, latency and packet loss statistics, and dropped packet content at the levels of network interface card (NIC), VPC, CPU, subnet, and connection count. Data from each node can be sent to the Elasticsearch (ES) search engine. Simultaneously, statistics from the real-time network monitoring tool netprobe and the data center DTC are also written to ES. The virtual network controller vnet-controller is responsible for reading all statistical data from ES and delivering the data to the O&M system for display via Kafka.

[0142] The monitoring system monitors the operating status of the hardware firewall cluster. When the SDN controller detects that the entire hardware firewall cluster has failed, it directly changes the destination IP address of the traffic via VXLAN. Instead of sending the traffic to the leaf switch connected to the hardware firewall, it sends the traffic directly to the destination OVS or IGW, which is equivalent to bypassing the hardware firewall. When the monitoring system detects that the hardware firewall cluster is normal, the traffic forwarding process is resumed according to the previous procedure.

[0143] and combination Figure 1 and Figure 2 Corresponding to the security protection method provided, this embodiment of the invention also provides a cloud platform for the specific implementation of the above method. An example architecture diagram of this cloud platform is shown below. Figure 1 As shown, the cloud platform includes:

[0144] The system includes a spine switch 101, a first switch cluster, and a second switch cluster; the first switch cluster includes at least one first leaf switch 102, and the second switch cluster includes at least one second leaf switch 103; the first leaf switch 102 is connected to multiple virtual switches 104, each virtual switch 104 is connected to multiple tenant virtual machines 105, and the second leaf switch 103 is connected to multiple hardware firewalls 106.

[0145] The virtual switch is used to determine the target second leaf switch corresponding to the network traffic in the second switch cluster when it receives network traffic sent by the tenant virtual machine connected to it; based on the address of the target second leaf switch, it performs virtual extended LAN packet encapsulation processing on the network traffic to obtain the first traffic packet corresponding to the network traffic; and sends the first traffic packet to the target second leaf switch through the first leaf switch and the spine switch connected by the virtual switch.

[0146] The target second leaf switch is used to perform virtual extended LAN packet decapsulation processing on the first traffic packet to obtain the second traffic packet corresponding to the network traffic; among the hardware firewalls connected to the target second leaf switch, the target hardware firewall corresponding to the network traffic is determined, and the second traffic packet is sent to the target hardware firewall.

[0147] The target hardware firewall is used to perform security detection on the network traffic based on the second traffic packet, obtain a security detection result, and if the security detection result indicates that the network traffic is abnormal, then the network traffic is blocked to provide security protection for the cloud platform.

[0148] The cloud platform provided in this invention integrates multiple hardware firewalls. When a virtual switch receives network traffic from a tenant's virtual machine, it can redirect the traffic to the hardware firewalls for security checks. Tenants on the cloud platform can share the hardware firewalls for security protection, eliminating the need for each tenant to deploy their own virtual firewalls. This reduces security costs and improves resource utilization. Furthermore, in real-world business scenarios, some tenants require security protection through hardware firewalls. The cloud platform provided in this invention can meet these requirements, enhancing the user experience.

[0149] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, for system or system embodiments, since they are basically similar to method embodiments, the description is relatively simple, and relevant parts can be referred to the descriptions in the method embodiments. The systems and system embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0150] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0151] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A security protection method, characterized in that, The method is applied to a cloud platform, which includes: a spine switch, a first switch cluster, and a second switch cluster; the first switch cluster includes at least one first leaf switch, and the second switch cluster includes at least one second leaf switch; the first leaf switch is connected to multiple virtual switches, each virtual switch is connected to multiple tenant virtual machines, and the second leaf switch is connected to multiple hardware firewalls; the method includes: When the first virtual switch receives network traffic sent by the tenant virtual machine it is connected to, it determines the target second leaf switch corresponding to the network traffic in the second switch cluster; the first virtual switch is the virtual switch connected to the first leaf switch in the first switch cluster. The first virtual switch performs virtual extended LAN packet encapsulation on the network traffic based on the address of the target second leaf switch to obtain the first traffic packet corresponding to the network traffic. The first traffic packet is then sent to the target second leaf switch through the first leaf switch and the spine switch connected by the first virtual switch. The target second leaf switch performs virtual extended LAN packet decapsulation processing on the first traffic packet to obtain the second traffic packet corresponding to the network traffic. The target second leaf switch determines the target hardware firewall corresponding to the network traffic among the various hardware firewalls it is connected to, and sends the second traffic packet to the target hardware firewall. The target hardware firewall performs security detection on the network traffic based on the second traffic packet, obtains a security detection result, and if the security detection result indicates that the network traffic is abnormal, then the network traffic is blocked to provide security protection for the cloud platform; The hardware firewall connected to the second leaf switch is connected to the second leaf switch through a target interface, which is a Layer 2 aggregation interface configured as a port aggregation interface; The hardware firewall connected to the second leaf switch is configured with multiple Layer 3 sub-interfaces and multiple virtual routing forwarding instances, and the multiple Layer 3 sub-interfaces and the multiple virtual routing forwarding instances are bound one-to-one.

2. The method according to claim 1, characterized in that, Sending the second traffic packet to the target hardware firewall includes: Based on the pre-configured policy routing, the target Layer 3 sub-interface corresponding to the second traffic packet is determined among the Layer 3 sub-interfaces of the target hardware firewall. The second traffic packet is then sent to the virtual route forwarding instance bound to the target Layer 3 sub-interface through the target Layer 3 sub-interface, thereby sending the second traffic packet to the target hardware firewall.

3. The method according to claim 1, characterized in that, The various hardware firewalls connected to the second leaf switch perform session synchronization based on a preset remote backup management protocol.

4. The method according to claim 1, characterized in that, Also includes: If the security detection result indicates that the network traffic is normal traffic, the target hardware firewall will send the second traffic packet to the target second leaf switch. The target second leaf switch determines the target address corresponding to the second traffic packet, performs virtual extended LAN packet encapsulation processing on the second traffic packet based on the target address to obtain the third traffic packet corresponding to the network traffic, and forwards the third traffic packet through the spine switch and the first switch cluster so that the network traffic reaches the target address.

5. The method according to claim 4, characterized in that, If the network traffic is east-west traffic, the process of forwarding the third traffic packet through the spine switch and the first switch cluster to ensure the network traffic reaches the target address includes: The target second leaf switch sends the third traffic packet to the spine switch; The spine switch, within the first switch cluster, determines the target first leaf switch corresponding to the target address and sends the third traffic packet to the target first leaf switch. The target first leaf switch determines the second virtual switch corresponding to the target address among the virtual switches it is connected to, and sends the third traffic packet to the second virtual switch; The second virtual switch performs virtual extended LAN packet decapsulation processing on the third traffic packet to obtain the fourth traffic packet corresponding to the network traffic; The second virtual switch determines the target tenant virtual machine corresponding to the target address among the various tenant virtual machines it is connected to, and sends the fourth traffic packet to the target tenant virtual machine.

6. The method according to claim 4, characterized in that, The first switch cluster also includes a third leaf switch, which is connected to the Internet gateway and the service gateway respectively; if the network traffic is north-south traffic, the process of forwarding the third leaf traffic packets through the spine switch and the first switch cluster to enable the network traffic to reach the target address includes: The target second leaf switch sends the third traffic packet to the spine switch; The spine switch sends the third traffic packet to the third leaf switch; The third leaf switch sends the third traffic packet to the Internet gateway; The Internet gateway performs virtual extended LAN packet decapsulation processing on the third traffic packet to obtain the fifth traffic packet corresponding to the network traffic. The Internet gateway performs network address translation on the target address to obtain the public network address corresponding to the target address, and performs virtual extended LAN packet encapsulation on the fifth traffic packet based on the public network address to obtain the sixth traffic packet corresponding to the network traffic. The Internet gateway sends the sixth traffic packet to the service gateway through the third leaf switch; The service gateway performs virtual extended LAN packet decapsulation processing on the sixth traffic packet to obtain the seventh traffic packet corresponding to the network traffic, and sends the seventh traffic packet to the public network.

7. The method according to claim 1, characterized in that, Also includes: Collect network performance statistics for the first switch cluster and network performance statistics for the second switch cluster; Collect network performance statistics for each virtual switch connected to the first leaf switch in the first switch cluster; Collect network performance statistics for each hardware firewall connected to the second leaf switch in the second switch cluster; The network performance statistics of the first switch cluster, the second switch cluster, each virtual switch, and each hardware firewall are sent to a preset operation and maintenance system so that the operation and maintenance system can display the data.

8. The method according to claim 1, characterized in that, Also includes: Monitor each of the aforementioned hardware firewalls to determine if it is in a faulty state; When each of the hardware firewalls is detected to be in a faulty state, for each virtual switch connected to the first leaf switch, the traffic forwarding mechanism of the virtual switch is changed so that the virtual switch forwards traffic according to the original path of the traffic packets.

9. A cloud platform, characterized in that, include: The system includes a spine switch, a first switch cluster, and a second switch cluster; the first switch cluster includes at least one first leaf switch, and the second switch cluster includes at least one second leaf switch; the first leaf switch is connected to multiple virtual switches, each of the virtual switches is connected to multiple tenant virtual machines, and the second leaf switch is connected to multiple hardware firewalls. The virtual switch is used to determine the target second leaf switch corresponding to the network traffic in the second switch cluster when it receives network traffic sent by the tenant virtual machine connected to it; based on the address of the target second leaf switch, it performs virtual extended LAN packet encapsulation processing on the network traffic to obtain the first traffic packet corresponding to the network traffic; and sends the first traffic packet to the target second leaf switch through the first leaf switch and the spine switch connected by the virtual switch. The target second leaf switch is used to perform virtual extended LAN packet decapsulation processing on the first traffic packet to obtain the second traffic packet corresponding to the network traffic; among the hardware firewalls connected to the target second leaf switch, the target hardware firewall corresponding to the network traffic is determined, and the second traffic packet is sent to the target hardware firewall. The target hardware firewall is used to perform security detection on the network traffic based on the second traffic packet, obtain a security detection result, and if the security detection result indicates that the network traffic is abnormal, then the network traffic is blocked to provide security protection for the cloud platform.

Images