A method and apparatus for limiting cross-vpn loop forwarding

Abstract

The application provides a method and device for limiting cross VPN loop forwarding, the method comprising: setting a loopback initial VLAN (Virtual Local Area Network), a loopback intermediate VLAN, and a loopback terminal VLAN; identifying a source VPN (Virtual Private Network) instance based on an access circuit (AC) of a data packet; finding a first routing and forwarding table item in a routing and forwarding table of the source VPN instance based on a destination IP address of the data packet; wherein a next hop of the first routing and forwarding table item is the destination VPN instance and an out interface is a loopback interface; determining that the data packet carries a double-layer VLAN label; setting an inner customer VLAN label of the data packet as a loopback initial VLAN label; and sending the data packet through the loopback interface.

Description

Technical Field

[0001] This application relates to communication technology, specifically a method and device for restricting forwarding across VPN loops. Background Technology

[0002] Virtual Private Network (VPN) technology utilizes public networks to establish dedicated data communication networks. It has strong access isolation to meet the network virtualization needs of business scenarios such as large networks and remote interconnection. It interconnects the same departments, groups, and businesses, while isolating different departments, groups, and business logics. VPN resources are not accessible to terminals within other VPNs in the network, providing secure and reliable connections to ensure data transmission.

[0003] However, in specific business scenarios, it is necessary to establish communication between different VPNs to achieve resource sharing or meet specific business requirements. The Provider Edge (PE) device sets a static route in the source VPN's routing table, with the destination address being a host address or network segment within the destination VPN, the next hop being the destination VPN, and the outgoing interface being a loopback interface. In this way, the PE device, based on the static route, loops back data packets destined for the destination VPN host through the loopback port, then continues to search for a matching next hop in the destination VPN's routing table, forwarding the cross-VPN data packets to the next hop of the destination VPN.

[0004] However, when there are problems with PE device configuration or route learning between VPNs, the PE device can dynamically generate default route entries that are cross-VPN loop routes and add them to the routing table, causing cross-VPN forwarding loops. This results in the PE device looping back data packets destined for the destination VPN host via the loopback port according to the static route, and then finding the source VPN as the next hop in the destination VPN's routing table to continue the default route. Consequently, cross-VPN forwarded data packets are repeatedly forwarded between the two VPNs, forming a persistent loop. Summary of the Invention

[0005] The purpose of this application is to provide a method and device for restricting forwarding across VPN loops, thereby preventing VPN loop routing from consuming device bandwidth without restriction.

[0006] To achieve the above objectives, this application provides a method for restricting cross-VPN loop forwarding. The method includes: setting up a loopback initial VLAN, a loopback intermediate VLAN, and a loopback termination VLAN; identifying the source VPN instance based on the access circuit AC of the data packet; finding a first routing table entry in the routing table of the source VPN instance based on the destination IP address of the data packet; wherein the next hop of the first routing table entry is the destination VPN instance and the outgoing interface is the loopback interface; determining that the data packet carries a double VLAN tag; setting the inner customer VLAN tag of the data packet to the loopback initial VLAN tag; and sending the data packet through the loopback interface.

[0007] To achieve the above objectives, this application also provides a device for restricting forwarding across VPN loops. This device includes a configuration module and a forwarding module. The configuration module is used to configure a loopback initial VLAN, a loopback intermediate VLAN, and a loopback termination VLAN. The forwarding module is used to identify the source VPN instance based on the access circuit AC of the data packet; based on the destination IP address of the data packet, find a first routing table entry in the routing table of the source VPN instance; wherein the next hop of the first routing table entry is the destination VPN instance and the outgoing interface is the loopback interface; determine that the data packet carries a double VLAN tag; set the inner customer VLAN tag of the data packet to the loopback initial VLAN tag; and send the data packet through the loopback interface.

[0008] The beneficial effects of this application are that it effectively avoids the consumption of device bandwidth by VPN routing loops inside the device, ensuring business stability. On the other hand, it also eliminates the need to spend a lot of manpower to locate, analyze, and solve routing loop problems. Attached Figure Description

[0009] Figure 1 The diagram shown is a flowchart of an embodiment of the method for restricting cross-VPN loop forwarding provided in this application; Figure 2A-2B This is a schematic diagram of a routing forwarding table within a PE device that causes a VPN routing loop, provided in an embodiment of this application. Figures 3A-3B A schematic diagram of adding an inner VLAN tag to limit the number of forwards across VPN loops, provided in an embodiment of this application; Figures 4A-4B are schematic diagrams illustrating how the VPN routing loop forwarding is restricted through inner VLAN tags according to embodiments of this application; Figure 5 A schematic diagram of a routing forwarding table for a PE device that eliminates VPN routing loops, provided in another embodiment of this application; Figure 6The diagram shown is a schematic representation of an embodiment of a device for restricting forwarding across VPN loops provided in this application. Detailed Implementation

[0010] The following detailed description will be provided with reference to several examples illustrated in the accompanying figures. In this detailed description, numerous specific details are used to provide a comprehensive understanding of the present application. Known methods, steps, components, and circuits are not described in detail in the examples to avoid obscuring their meaning.

[0011] In the terminology used, the term "including" means including but not limited to; the term "containing" means including but not limited to; the terms "above," "within," and "below" include the number itself; the terms "greater than" and "less than" mean not including the number itself. The term "based on" means based on at least a portion of them.

[0012] Figure 1 The diagram shown is a flowchart of an embodiment of a method for restricting cross-VPN loop forwarding provided in this application; the method includes the following steps: Step 101: Configure a loopback initial VLAN, a loopback intermediate VLAN, and a loopback termination VLAN; Step 102: Identify the source VPN instance based on the access circuit AC of the data packet; Step 103: Based on the destination IP address of the data packet, find the first routing table entry in the routing table of the source VPN instance; wherein the next hop of the first routing table entry is the destination VPN instance and the outgoing interface is the loopback interface. Step 104: Determine that the data packet carries a double-layer VLAN tag; Step 105: Set the inner customer VLAN tag of the data packet to the loopback initial VLAN tag; Step 106: Send data packets through the loopback interface.

[0013] Figure 1 The beneficial effects of this embodiment are that it effectively avoids the consumption of device bandwidth by VPN routing loops inside the device, ensuring service stability. On the other hand, it also eliminates the need to spend a lot of manpower to locate, analyze, and solve routing loop problems.

[0014] Figure 2A-2B The diagram shows a routing table within a PE device that can cause a VPN routing loop. In routing table 201 of VPN instance A on the PE device, the destination IP address in host routing table entry 2011 is 192.0.0.1, the next hop is VPN instance B, and the outgoing interface is the loopback interface. In routing table 202 of VPN instance B on the PE device, the next hop in default routing table entry 2021 is VPN instance A, and the outgoing interface is the loopback interface.

[0015] The PE device is internally configured with loopback initial VLAN1, loopback intermediate VLAN2, and loopback termination VLAN3.

[0016] The ACL table of the PE device also has a loop termination access control list (ACL) entry; the matching items of this loop termination ACL entry include the incoming interface being the loopback interface, the outgoing interface being the loopback interface, the inner CVLAN (Customer VLAN) label being the VLAN3 label; and the action item being drop.

[0017] Figures 3A-3B This is a schematic diagram of adding an inner VLAN tag to limit the number of forwards across VPN loops, as provided in an embodiment of this application.

[0018] Figure 3A In this scenario, the PE device receives an Ethernet data packet 300 from the CE (Customer Edge) device, carrying an SVLAN tag 311 and a CVLAN tag 321. The PE device identifies the AC based on the receiving port of the Ethernet data packet 300 and the VLAN 1000 (not shown in the diagram) to which the SVLAN tag 311 belongs. Based on the AC, the PE device identifies the VPN instance A to which the Ethernet data packet 300 belongs. Using the destination MAC address (not shown in the diagram), SVLAN 1000, and CVLAN 2000 of the Ethernet data packet 300, the PE device locates a MAC address entry (not shown in the diagram) with Layer 3 forwarding attributes and determines to perform Layer 3 forwarding.

[0019] The PE device searches the routing table 201 of the VPNA instance based on the destination IP address 192.0.0.1 of Ethernet data packet 300. It finds a matching routing table entry 2011 and determines that the outgoing interface is the loopback interface; it then sets the inner CVLAN tag 321 to VLAN1.

[0020] The PE device modifies the VLAN 1000 of the outer SVLAN tag 311 to the VLAN 2000 bound to VPN instance B, and then loops back the Ethernet data packet 300 through the loopback interface.

[0021] Figure 3B In the process, the PE device receives an Ethernet data packet 300 carrying a VLAN tag 311 from the CE device. The PE device identifies the AC based on the receiving port of the Ethernet data packet 300 and the VLAN 1000 (not shown in the figure) to which the VLAN tag 311 belongs, and identifies the VPN instance A to which the Ethernet data packet 300 belongs based on the AC.

[0022] The PE device finds the MAC address entry with Layer 3 forwarding attribute based on the destination MAC address of Ethernet data packet 300 (not shown in the figure) and VLAN 1000, and determines to perform Layer 3 forwarding.

[0023] The PE device searches the routing table 201 of the VPNA instance based on the destination IP address 192.0.0.1 of the Ethernet data packet 300. It finds a matching routing table entry 2011 and determines that the outgoing interface is the loopback interface. It adds an inner VLAN tag 321 to the Ethernet data packet 300 and sets the inner VLAN tag 321 to the initial loopback VLAN, i.e., VLAN1.

[0024] The PE device modifies the outer VLAN 311 label to VLAN 2000 bound to VPN instance B, and then loops back Ethernet data packets 300 through the loopback interface.

[0025] Figures 4A-4B are schematic diagrams illustrating how VPN routing loop forwarding is restricted through inner VLAN tags according to embodiments of this application.

[0026] Figure 4A In the process, the PE device receives an Ethernet data packet 300 encapsulated with the initial VLAN tag VLAN1 via the loopback port, and identifies the VPN instance B to which it belongs based on VLAN2000. The PE device then uses the destination MAC address of the Ethernet data packet 300 (not shown in the figure) and the VLAN2000 to find the MAC address entry with Layer 3 forwarding attributes (not shown in the figure) and determines to perform Layer 3 forwarding.

[0027] The PE device uses the destination IP address 192.0.0.1 of Ethernet data packet 300 to look up the routing table 202 of VPN instance B. It finds a matching routing table entry 2021, confirming the outgoing interface as the loopback interface. It then sets the inner CVLAN tag 321 to identify the loopback intermediate VLAN, i.e., VLAN 2. The PE device sets the outer SVLAN tag 311 to identify VLAN 1000 of VPN instance A. Finally, it sends data packet 300 through the loopback interface.

[0028] Figure 4B In the diagram, the PE device receives Ethernet data packet 300 through the loopback port; the outer SVLAN tag is VLAN1000; the inner CVLAN tag is VLAN2. The PE device receives the looped-back Ethernet data packet 300 through the loopback port and identifies the VPN instance A it belongs to based on VLAN1000. The PE device then uses the destination MAC address of Ethernet data packet 300 (not shown in the diagram) and its VLAN 2000 to find the MAC address entry with Layer 3 forwarding attributes and determines to perform Layer 3 forwarding.

[0029] Based on the destination IP address 192.0.0.1 of Ethernet data packet 300, the PE device finds a matching routing table entry 2011 in the routing table 201 for the VPNA instance and determines that the outgoing interface is the loopback interface; it determines that VLAN2 of the inner CVLAN tag 321 is not equal to the loopback termination VLAN3; it sets the inner CVLAN tag 321 to VLAN3 and sets the outer SVLAN to VLAN2000 that identifies VPNB.

[0030] Afterwards, the PE device receives through the loopback port. Figure 4B If the PE device does not find a matching routing table entry for Ethernet data packet 300, it will find a loop termination ACL entry for the ingress interface, egress interface, and inner CVLAN tag VLAN3 of the Ethernet data packet 300 and discard the data packet 300.

[0031] PE devices drop Ethernet data packets (300) through loopback ACL entries to avoid repeated forwarding between VPN instances.

[0032] In practical network applications, especially in large network environments, the networking and configuration are complex, most routing table entries are dynamically generated and are numerous. Before the internal routing loops mentioned above cause a more obvious impact, it is difficult to detect the routing loop problem. By limiting the number of forwardings between VPNs as described above, internal routing loops can be effectively controlled.

[0033] Compared to existing technologies that decrement the Time to Live (TTL) value in the IP packet header by 1 each time an internal loopback is forwarded across a VPN, this method does not affect packet forwarding within the network after the internal loop disappears.

[0034] Figure 5 A schematic diagram of a routing table for a PE device that eliminates VPN routing loops, provided in another embodiment of this application.

[0035] The PE device receives an Ethernet data packet 300 encapsulated with the initial VLAN tag VLAN3 via the loopback port and identifies the VPN instance B to which it belongs based on VLAN2000. The PE device then uses the destination MAC address of the Ethernet data packet 300 (not shown in the figure) and the VLAN2000 to find the MAC address entry with Layer 3 forwarding attributes (not shown in the figure) and determines to perform Layer 3 forwarding.

[0036] The PE device searches the routing table 202 of the VPNB instance based on the destination IP address 192.0.0.1 of the Ethernet data packet 300. It finds a matching routing table entry 2022, determines that the next hop is the peer tunnel interface address 192.0.0.148 and the outgoing interface is the local tunnel interface Tunnel1; it removes the inner customer VLAN tag 321; it removes the Ethernet header of the Ethernet data packet 300, and based on the local tunnel interface IP address as the source IP address and the peer tunnel interface address as the destination IP address, it encapsulates the data packet Tunnel1 with a VPN tunnel header and sends it through the local tunnel interface tunnel1.

[0037] Figure 6 The diagram illustrates an embodiment of a device for restricting forwarding across VPN loops provided in this application. The device 60 includes at least a network interface, a switching chip, a CPU, and a memory. The switching chip includes at least a forwarding module. The processor executes the configuration module by running processor-executable instructions in the memory.

[0038] The configuration module is used to configure a loopback initial VLAN, a loopback intermediate VLAN, and a loopback termination VLAN. The forwarding module is used to identify the source VPN instance based on the access circuit AC of the data packet; based on the destination IP address of the data packet, it looks up the first routing table entry in the routing table of the source VPN instance; wherein the next hop of the first routing table entry is the destination VPN instance and the outgoing interface is the loopback interface; it determines that the data packet carries a double VLAN tag; it sets the inner customer VLAN tag of the data packet to the loopback initial VLAN tag; and it sends the data packet through the loopback interface.

[0039] The forwarding module is also used to determine if a data packet carries a single-layer VLAN tag; add an inner customer VLAN tag to the data packet to identify the initial VLAN of the loopback; add an outer service VLAN tag to the data packet to identify the destination VPN instance; and send the data packet through the loopback interface.

[0040] The forwarding module is also used to receive looped-back data packets through the loopback interface; identify the destination VPN instance based on the outer service VLAN tag; find the second routing table entry in the destination VPN instance's routing table based on the destination IP address of the data packet; wherein the next hop of the routing table entry is the source VPN instance and the outgoing interface is the loopback interface; set the inner customer VLAN tag to identify the loopback intermediate VLAN; set the outer service VLAN tag to identify the VLAN of the source VPN instance; and send the data packet through the loopback interface.

[0041] The forwarding module is also used to receive looped-back data packets through the loopback interface; identify the source VPN instance based on the outer service VLAN tag; find the first routing forwarding table entry in the source VPN instance routing forwarding table based on the destination IP address of the data packet; set the inner customer VLAN tag to identify the loopback termination VLAN; and set the outer service VLAN tag to identify the VLAN of the destination VPN instance.

[0042] The forwarding module is also used to receive looped-back data packets through the loopback interface; identify the source VPN instance based on the outer service VLAN tag; find the third routing forwarding table entry in the source VPN instance routing forwarding table based on the destination IP address of the data packet; wherein the next hop of the third routing forwarding table entry is the peer tunnel interface address and the outgoing interface is the local tunnel interface; remove the inner customer VLAN tag; remove the Ethernet header of the data packet, and encapsulate the VPN tunnel header for the data packet based on the IP address of the local tunnel interface as the source IP address and the address of the peer tunnel interface as the destination IP address, and send it through the local tunnel interface.

[0043] The forwarding module is also used to receive looped-back data packets through the loopback interface; and to discard data packets according to the loop termination access control table entry; wherein the matching item of the loop termination access control table entry is that the ingress interface and the egress interface are loopback interfaces and the inner customer VLAN tag is set to identify the loopback termination VLAN; the action item of the loop termination access control table entry is discard.

[0044] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A method for restricting forwarding across VPN loops, characterized in that, The method includes, Configure a loopback initial VLAN, a loopback intermediate VLAN, and a loopback termination VLAN for use inside the PE device; Access Circuit-Aided Source Identification (AC) Example Based on Data Packet Access (AC) for Virtual Private Network (VPN) Based on the destination IP address of the data packet, a first routing table entry is found in the routing table of the source VPN instance; wherein the next hop of the first routing table entry is the destination VPN instance and the outgoing interface is the loopback interface; It is determined that the data packet carries a dual-layer VLAN tag; Set the inner customer VLAN tag of the data packet to the loopback initial VLAN tag; The data packet is sent through the loopback interface; The loopback data packet is received through the loopback interface; The destination VPN instance is identified based on the outer service VLAN tag; In the destination VPN instance routing table, a second routing table entry is found based on the destination IP address of the data packet; wherein the next hop of the routing table entry is the source VPN instance and the outgoing interface is the loopback interface; Set the inner customer VLAN tag to identify the loopback intermediate VLAN; Set the outer service VLAN tag to identify the VLAN of the source Virtual Private Network (VPN) instance; The data packet is sent through the loopback interface; The loopback data packet is received through the loopback interface; The source VPN instance is identified based on the outer service VLAN tag; In the source VPN instance routing table, the first routing entry is found based on the destination IP address of the data packet; Set the inner customer VLAN tag to identify the loopback termination VLAN; Set the outer service VLAN tag to identify the VLAN of the destination VPN instance.

2. The method according to claim 1, characterized in that, When it is determined that the data packet carries a single-layer VLAN tag, the method further includes... Add an inner customer VLAN tag to the data packet to identify the initial loopback VLAN; Add an outer service VLAN tag identifying the destination VPN instance to the data packet; The data packet is sent through the loopback interface.

3. The method according to claim 1, characterized in that, The loopback data packet is received through the loopback interface; The source VPN instance is identified based on the outer service VLAN tag; In the source VPN instance routing table, a third routing entry is found based on the destination IP address of the data packet; wherein the next hop of the third routing entry is the peer tunnel interface address and the outgoing interface is the local tunnel interface. Remove the inner layer customer VLAN tag; Stripping the Ethernet header from the data packet, and using the IP address of the local tunnel interface as the source IP address and the address of the peer tunnel interface as the destination IP address, encapsulate the data packet with a VPN tunnel header and send it through the local tunnel interface.

4. The method according to claim 1, characterized in that, The loopback data packet is received through the loopback interface; According to the loop termination access control entry, the data packet is discarded; wherein the matching entry of the loop termination access control entry is that the ingress interface and egress interface are the loopback interface and the inner customer VLAN tag is set to identify the loopback termination VLAN; the action item of the loop termination access control entry is discard.

5. A device for restricting forwarding across VPN loops, characterized in that, The device includes, The configuration module is used to configure a loopback initial VLAN, a loopback intermediate VLAN, and a loopback termination VLAN for use within the PE device. The forwarding module is used to identify the source of a VPN instance based on the access circuit AC (Access Circuit-Agent) for data packets. Based on the destination IP address of the data packet, a first routing table entry is found in the routing table of the source VPN instance; wherein the next hop of the first routing table entry is the destination VPN instance and the outgoing interface is the loopback interface; it is determined that the data packet carries a double VLAN tag; the inner client VLAN tag of the data packet is set as the loopback initial VLAN tag; the data packet is sent through the loopback interface; The forwarding module is further configured to: receive the looped-back data packet through the loopback interface; identify the destination VPN instance based on the outer service VLAN tag; find a second routing table entry in the destination VPN instance routing table based on the destination IP address of the data packet; wherein the next hop of the routing table entry is the source VPN instance and the outgoing interface is the loopback interface; set the inner customer VLAN tag to identify the loopback intermediate VLAN; set the outer service VLAN tag to identify the VLAN of the source VPN instance; and send the data packet through the loopback interface. The forwarding module is further configured to receive the looped-back data packet through the loopback interface; identify the source VPN instance based on the outer service VLAN tag; find the first routing table entry in the source VPN instance routing table based on the destination IP address of the data packet; set the inner customer VLAN tag to identify the loopback termination VLAN; and set the outer service VLAN tag to identify the VLAN of the destination VPN instance.

6. The device according to claim 5, characterized in that, The forwarding module is further configured to: determine that the data packet carries a single-layer VLAN tag; add an inner customer VLAN tag to the data packet to identify the initial loopback VLAN; add an outer service VLAN tag to the data packet to identify the destination VPN instance; and send the data packet through the loopback interface.

7. The device according to claim 5, characterized in that, The forwarding module is further configured to: receive the looped-back data packet through the loopback interface; identify the source VPN instance based on the outer service VLAN tag; find a third routing table entry in the source VPN instance routing table based on the destination IP address of the data packet; wherein the next hop of the third routing table entry is the peer tunnel interface address and the outgoing interface is the local tunnel interface; remove the inner customer VLAN tag; remove the Ethernet header of the data packet; encapsulate the data packet with a VPN tunnel header based on the IP address of the local tunnel interface as the source IP address and the address of the peer tunnel interface as the destination IP address; and send the data packet through the local tunnel interface.

8. The device according to claim 5, characterized in that, The forwarding module is further configured to receive the looped-back data packet through the loopback interface; discard the data packet according to the loop termination access control entry; wherein the matching item of the loop termination access control entry is that the ingress interface and the egress interface are the loopback interface and the inner customer VLAN tag is set to identify the loopback termination VLAN; the action item of the loop termination access control entry is discard.

Images