A method and network device for implementing hardware multi-priority NAT service forwarding

Abstract

The present specification provides a method and network device for implementing hardware multi-priority NAT service forwarding, the method comprising: dividing a HandleIndex used for NAT rule issuing into several interval segments, each interval segment corresponding to a type of NAT rule and priority, dividing each interval segment into a high-priority area and a low-priority area, placing a high-priority type of ACL policy into the high-priority area, placing a low-priority type of ACL policy into the low-priority area, forming an ACL policy table item, and sending the formed ACL policy table item to a TCAM chip, so that the TCAM chip implements hardware multi-priority NAT service forwarding according to the converted hardware table item. Through the method, the priority of NAT can be implemented by TCAM.

Description

TECHNICAL FIELD

[0001] The present specification relates to the technical field of communication, and particularly relates to a method and a network device for implementing hardware multi-priority NAT service forwarding. BACKGROUND

[0002] As shown in the prior art, NAT (Network Address Translation) is a process of converting an IP address in an IP data packet header into another IP address. In actual application, NAT is mainly applied to edge devices connecting two networks, for the purpose of allowing internal network users to access external public networks and allowing external public networks to access part of internal network resources (such as internal servers). Figure 1

[0003] ACL (Access Control List) is a set of rules for identifying packet flows. Here, the rule refers to a judgment statement describing the matching condition of a packet, and the matching condition can be the source address, destination address, port number, etc. of the packet. The device identifies specific packets according to the ACL rule, and processes them according to the pre-set policy. The most common application is to use ACL for packet filtering. In addition, ACL can also be applied to identify packets in services such as routing, security, QoS, etc., and the specific processing method of these packets is determined by the service module applying ACL.

[0004] TCAM (ternary content addressable memory) is a kind of three-state content addressable memory device. Compared with general memory, each bit of TCAM has a * state in addition to 0 and 1 states, that is, a state of not caring. This feature of TCAM makes it possible to be used for both exact matching and fuzzy matching, and in the field of network, it can be used for routing and ACL lookup. SUMMARY

[0005] In order to overcome the problems in the related art, the present specification provides a method and a network device for implementing hardware multi-priority NAT service forwarding.

[0006] According to a first aspect of an embodiment of the present specification, a method for implementing hardware multi-priority NAT service forwarding is provided, and the method comprises:

[0007] The HandleIndex for NAT rule distribution is divided into several interval segments, and each interval segment corresponds to a type of NAT rule and priority;

[0008] ​each interval segment is divided into a high-priority area and a low-priority area, and ACL policies of a high-priority type are placed into the high-priority area and ACL policies of a low-priority type are placed into the low-priority area to form ACL policy table entries;

[0009] The ACL policy table entries formed are sent to a TCAM chip, so that the TCAM chip implements hardware multi-priority NAT service forwarding according to the converted hardware table entries.

[0010] The HandleIndex for NAT rule distribution is divided into a plurality of interval segments, each interval segment corresponding to a type of NAT rule and a priority, and includes:

[0011] The HandleIndex is divided into a first interval segment, a second interval segment, and a third interval segment.

[0012] The static NAT rule is placed into the first interval segment, the dynamic NAT rule is placed into the second interval segment, and the NAT ALG association rule is placed into the third interval segment.

[0013] The priority of the static NAT rule is greater than the priority of the dynamic NAT rule, and the priority of the dynamic NAT rule is greater than the priority of the NAT ALG association rule.

[0014] The segment number of the first interval segment is less than the segment number of the second interval segment, and the segment number of the second interval segment is less than the segment number of the third interval segment.

[0015] The high-priority area and the low-priority area are divided in each interval segment, and the high-priority type of ACL policy is placed into the high-priority area and the low-priority type of ACL policy is placed into the low-priority area, and includes:

[0016] The ACL Name type and the ACL Num type are distinguished.

[0017] The ACL policy of the ACL Name type is placed into the high-priority area, and the ACL policy of the ACL Num type is placed into the low-priority area.

[0018] The ACL policy of the ACL Name type is placed into the high-priority area, and the ACL policy of the ACL Num type is placed into the low-priority area, and includes:

[0019] The ACL policy is placed into the high-priority area in the order of the Rule ID of the ACL policy of the ACL Name type, and the ACL policy is placed into the high-priority area in the order of the Rule ID of the ACL policy of the ACL Num type.

[0020] As can be seen from the above embodiments, the NAT-related multi-level priority ACL rules of the interface level are issued in the TCAM chip, so that the NAT rules are quickly hit in the hardware level to establish the NAT session, the performance of the new establishment and forwarding of the NAT service is effectively improved, and the ACL table items are established according to the priority order of the NAT, so that the TCAM hardware can distinguish the different ACL rule priorities for high-speed matching processing and match and forward the NAT message.

[0021] According to a second aspect of the embodiments of the present specification, a network device is provided, and the network device comprises:

[0022] a software logic module configured to divide the HandleIndex for the NAT rule issuing into a plurality of interval segments, each interval segment corresponding to a type of NAT rule and priority, and divide each interval segment into a high-priority area and a low-priority area, and place the ACL policy of the high-priority type into the high-priority area and place the ACL policy of the low-priority type into the low-priority area

[0023] a hardware module configured to form the ACL policy table item according to the software logic module;

[0024] a sending module configured to send the formed ACL policy table item to the TCAM chip, so that the TCAM chip implements the service forwarding of the hardware multi-priority NAT according to the converted hardware table item.

[0025] The software logic module is specifically configured to divide the HandleIndex into a first interval segment, a second interval segment, and a third interval segment.

[0026] and place the static NAT rule into the first interval segment, place the dynamic NAT rule into the second interval segment, and place the NAT ALG associated rule into the third interval segment.

[0027] The priority of the static NAT rule is greater than the priority of the dynamic NAT rule, and the priority of the dynamic NAT rule is greater than the priority of the NAT ALG associated rule.

[0028] The segment number of the first interval segment is less than the segment number of the second interval segment, and the segment number of the second interval segment is less than the segment number of the third interval segment.

[0029] The software logic module is further configured to distinguish between the ACL Name type and the ACL Num type.

[0030] and place the ACL policy of the ACL Name type into the high-priority area and place the ACL policy of the ACL Num type into the low-priority area.

[0031] The software logic module is further configured to place ACL policies in the high-priority zone according to the Rule ID order of ACL policies of type ACL Name, and to place ACL policies in the high-priority zone according to the Rule ID order of ACL policies of type ACL Num.

[0032] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this specification. Attached Figure Description

[0033] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this specification and, together with the description, serve to explain the principles of this specification.

[0034] Figure 1 This is a schematic diagram illustrating a basic NAT workflow according to an exemplary embodiment of this specification.

[0035] Figure 2 This is a flowchart illustrating a method for implementing hardware multi-priority NAT service forwarding according to an exemplary embodiment. Detailed Implementation

[0036] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numerals in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this specification. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this specification as detailed in the appended claims.

[0037] The terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to be limiting of this specification. The singular forms “a,” “the,” and “the” as used in this specification and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any and all possible combinations of one or more of the associated listed items.

[0038] It should be understood that although the terms first, second, third, etc., may be used in this specification to describe various information, this information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, without departing from the scope of this specification, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "when," "when," or "in response to determination."

[0039] The current commonly used NAT rule is processed in a simple manner according to priority. The process of network traffic from a private network accessing a public network is as follows. In the hardware forwarding process of the device, the source IP of the packet hits the QoS configured on the device in interface, and the packet is directly sent to the CPU user state for processing. The user state analyzes the IP header of the packet, looks up the configuration of the corresponding out interface according to the destination IP, hits the NAT priority rule of the software, generates a NAT session table, and then converts the source IP of the packet. After that, the hardware is issued for forwarding.

[0040] Currently, all data session packets of NAT are processed in the CPU. The processing action of the traffic after hitting the QoS strategy on the TCAM chip is to directly send the CPU, and the software logic determines the effective order of the NAT rule on the CPU. The rate of new session after hitting the software NAT rule is limited by the CPU performance, and the actual NAT data service new and forwarding capability is limited, which cannot meet the user demand.

[0041] According to the foregoing content, the performance of sending the packet to the CPU for NAT is lower than that of directly performing NAT in the hardware NPU. When the software performs NAT, it can match the multi-level priority ACL, but it cannot match the multi-level priority ACL due to the capability of the hardware TCAM itself. In this case, the same data flow, even if the same configuration, the results of software and hardware NAT may be different.

[0042] In order to solve the problem that all data session packets of NAT are currently processed in the CPU, thereby causing the rate of new session after hitting the software NAT rule to be limited by the CPU performance, and the actual NAT data service new and forwarding capability is limited, the embodiment of the present disclosure provides a method for implementing hardware multi-priority NAT service forwarding, which realizes the differentiated forwarding according to different NAT rule priorities through the hardware TCAM chip.

[0043] The embodiment of the present disclosure provides a method for implementing hardware multi-priority NAT service forwarding, as shown in Figure 2 The method comprises the following steps.

[0044] S201 divides the HandleIndex for NAT rule distribution into several interval segments, and each interval segment corresponds to a type of NAT rule and priority;

[0045] S202 divides each interval segment into a high-priority area and a low-priority area, and places the ACL strategy of the high-priority type in the high-priority area and the ACL strategy of the low-priority type in the low-priority area to form an ACL strategy table item;

[0046] S203 sends the formed ACL policy entry to the TCAM chip, so that the TCAM chip implements hardware multi-priority NAT service forwarding according to the converted hardware entry.

[0047] Before step S201 is performed, the multi-level priorities related to the NAT rules taking effect on the same interface can be defined, and in this example, the priorities are in descending order, and in other embodiments, the priorities can be in ascending order, which is not limited here.

[0048] For example, the multi-level priorities (in descending order) related to the NAT rules taking effect on the same interface are described as follows:

[0049] 1. Static NAT rule > dynamic NAT rule > NAT ALG associated rule.

[0050] 2. ACL priority, the user-configured ACL includes ACL with name and ACL with number, and the priority is AclName > AclNum, AclName is arranged in internal dictionary order, and the greater the AclNum value is, the higher the priority is.

[0051] 3. There are multiple ACL rules (Rule) under the same ACL, and the smaller the RuleID is, the higher the priority is.

[0052] Then, two related software Hash table structures for implementing the above priorities are described as follows:

[0053] a: interface ACL software Hash table (hereinafter referred to as interface ACL table).

[0054] Key: interface index of the NAT configuration interface;

[0055] Value: all NAT-related ACLs (stored in the form of a double-linked list, and the list element is composed of three elements of AclNum, AclName and AclMode used to distinguish AclNum / AclName) bound under the interface.

[0056] b: NAT rule software Hash table (hereinafter referred to as NAT rule table)

[0057] Key: ACL index, ID of the ACL rule (Rule), and interface index of the NAT configuration interface;

[0058] Value: HandleIndex of the current rule issued in the TCAM chip, and HandleIndexPre of the rule with the highest priority but the lowest priority.

[0059] In step S201, the HandleIndex can be divided into a first interval segment, a second interval segment and a third interval segment. For example, the total range of the HandleIndex available to hardware is 1-30000, the first interval segment is 1-10000, the second interval segment is 10001-20000, and the third interval segment is 20001-30000. The priority of the first interval segment can be defined to be greater than the priority of the second interval segment, and the priority of the second interval segment can be defined to be greater than the priority of the third interval segment.

[0060] In this embodiment, the interval ranges of the first interval segment, the second interval segment and the third interval segment can be set to be adaptive. For example, according to the above rules, static NAT rules > dynamic NAT rules > NAT ALG association rules. Assuming that there are 5000 static NAT rules, 15000 dynamic NAT rules and 10000 NAT ALG association rules, the first interval segment can be 1-5000, the second interval segment can be 5001-20000, and the third interval segment can be 20001-30000.

[0061] In this embodiment, each interval segment is divided into a high-priority area and a low-priority area, and the ACL policy of the high-priority type is placed in the high-priority area, and the ACL policy of the low-priority type is placed in the low-priority area, including:

[0062] distinguishing between the ACL Name type and the ACL Num type;

[0063] placing the ACL policy of the ACL Name type in the high-priority area and placing the ACL policy of the ACL Num type in the low-priority area.

[0064] In this embodiment, placing the ACL policy of the ACL Name type in the high-priority area and placing the ACL policy of the ACL Num type in the low-priority area includes:

[0065] placing the ACL policy of the ACL Name type in the high-priority area in the order of the Rule ID of the ACL policy, and placing the ACL policy of the ACL Num type in the high-priority area in the order of the Rule ID of the ACL policy.

[0066] Specifically, when a user configures a NAT rule through an interface, the user issues three parameters of AclNum (ACL number), AclName (ACL name) and AclMode (used to distinguish AclNum / AclName), which are stored in a linked list of an ACL table. The linked list is stored in descending order, and the linked list node of AclName is arranged before the linked list node of AclNum. The linked list node of AclName is arranged in internal lexicographical order, and the linked list node of AclNum is arranged in internal descending order.

[0067] When the user issues the NAT-related ACL rule configuration under the interface, the effective rules in the current ACL group are traversed, and arranged in ascending order of RuleID.

[0068] The ACLNum, ACLName, ACLMode, RuleID, and hardware HandleIndex obtained when the TCAM hardware table is issued are stored in the NAT rule table.

[0069] Through the above several steps, the NAT rules are sorted according to the requirements, and are issued on the hardware according to the priority. Subsequently, the newly added rules only need to be inserted into the software and hardware tables according to the above steps.

[0070] As can be seen from the above embodiments, the interface-level NAT-related multi-level priority ACL rules are issued in the TCAM chip, so that the NAT rules are quickly hit in the hardware layer to establish a NAT session, effectively improving the new establishment and forwarding performance of the NAT service. At the same time, the ACL table items are established according to the priority order of the NAT, so that the TCAM hardware can distinguish the priority of different ACL rules for high-speed matching processing and matching forwarding of the NAT packet.

[0071] Based on the above embodiments, the present embodiment also provides a network device, which comprises:

[0072] A software logic module is configured to divide the HandleIndex for NAT rule issuance into several interval segments, each interval segment corresponding to a type of NAT rule and priority, and divide each interval segment into a high-priority area and a low-priority area, and place the ACL policy of the high-priority type into the high-priority area and the ACL policy of the low-priority type into the low-priority area.

[0073] A hardware module is configured to form an ACL policy table item according to the software logic module.

[0074] A sending module is configured to send the formed ACL policy table item to the TCAM chip, so that the TCAM chip realizes the hardware multi-priority NAT service forwarding according to the converted hardware table item.

[0075] The software logic module is specifically configured to divide the HandleIndex into a first interval segment, a second interval segment, and a third interval segment.

[0076] The static NAT rule is placed into the first interval segment, the dynamic NAT rule is placed into the second interval segment, and the NAT ALG associated rule is placed into the third interval segment.

[0077] The priority of the static NAT rule is greater than the priority of the dynamic NAT rule, and the priority of the dynamic NAT rule is greater than the priority of the NAT ALG association rule.

[0078] The segment number of the first interval segment is less than the segment number of the second interval segment, and the segment number of the second interval segment is less than the segment number of the third segment.

[0079] The software logic module is further configured to distinguish between the ACL Name type and the ACL Num type.

[0080] The software logic module is further configured to place the ACL policy of the ACL Name type in a high priority area and place the ACL policy of the ACL Num type in a low priority area.

[0081] The software logic module is further configured to place the ACL policy of the ACL Name type in a high priority area according to the Rule ID sequence of the ACL policy of the ACL Name type, and place the ACL policy of the ACL Num type in a high priority area according to the Rule ID sequence of the ACL policy of the ACL Num type.

[0082] For the device embodiment, since it basically corresponds to the method embodiment, the relevant part can be referred to the part of the method embodiment. The device embodiment described above is only illustrative, wherein the modules described as separate components can or can not be physically separated, and the components shown as modules can or can not be physical modules, i.e., can be located in one place or distributed on multiple network modules. Part or all of the modules can be selected to achieve the purpose of the scheme of the present specification according to actual needs. Those skilled in the art can understand and implement without creative labor.

[0083] The above describes specific embodiments of the present specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims can be performed in an order different than the order in the embodiments and still achieve the desired result. In addition, the processes depicted in the figures do not necessarily require the particular order shown or sequential order to achieve the desired results. In certain implementations, multitasking and parallel processing can be advantageous or possible.

[0084] Other embodiments of the present description will be apparent to those skilled in the art from consideration of the specification and practice of the application disclosed herein. It is intended that the description be considered as exemplary only and the true scope and spirit of the present description being indicated by the following claims.

[0085] It is to be understood that the present description is not limited to the precise details of apparatus and methodology described herein and as illustrated in the drawings. Various modifications and changes in the precise operations and implementations can be made by those skilled in the art without departing from the scope of the present description. The scope of the present description is indicated only by the appended claims.

[0086] The above description is intended to be illustrative and not restrictive. Many other embodiments will be apparent to those of skill in the art upon reviewing the above description. The scope of the description should, therefore, be determined not with reference to the above description, but instead with reference to the appended claims, along with their full scope of equivalents.

Claims

1. A method for implementing hardware multi-priority NAT service forwarding, characterized in that, The method includes: The HandleIndex used for issuing NAT rules is divided into several intervals, each interval corresponding to a type of NAT rule and priority. Each interval is divided into a high-priority area and a low-priority area. High-priority ACL policies are placed in the high-priority area, and low-priority ACL policies are placed in the low-priority area, forming ACL policy entries. The generated ACL policy entries are sent to the TCAM chip so that the TCAM chip can implement hardware multi-priority NAT service forwarding based on the converted hardware entries.

2. The method according to claim 1, characterized in that, The HandleIndex used for issuing NAT rules is divided into several segments, each segment corresponding to a type of NAT rule and priority, including: Divide HandleIndex into three intervals: the first interval, the second interval, and the third interval. Place static NAT rules in the first section, dynamic NAT rules in the second section, and NAT ALG association rules in the third section. Among them, the priority of the static NAT rule is higher than that of the dynamic NAT rule, and the priority of the dynamic NAT rule is higher than that of the NAT ALG association rule.

3. The method according to claim 2, characterized in that, The segment number of the first interval is less than the segment number of the second interval, and the segment number of the second interval is less than the segment number of the third interval.

4. The method according to claim 1, characterized in that, The step of dividing each interval into a high-priority zone and a low-priority zone, and placing high-priority ACL policies in the high-priority zone and low-priority ACL policies in the low-priority zone, includes: Distinguish between ACL Name type and ACL Num type; Place ACL policies of type Name in the high-priority zone and ACL policies of type Num in the low-priority zone.

5. The method according to claim 4, characterized in that, The step of placing ACL policies of type ACL Name in the high-priority zone and ACL policies of type ACL Num in the low-priority zone includes: ACL policies are placed in the high-priority zone according to the Rule ID order of ACL Name type ACL policies, and ACL policies are placed in the high-priority zone according to the Rule ID order of ACLNum type ACL policies.

6. A network device, characterized in that, The network device includes: The software logic module divides the HandleIndex used for issuing NAT rules into several segments, each segment corresponding to a type of NAT rule and its priority. It also divides each segment into high-priority and low-priority zones, placing high-priority ACL policies in the high-priority zone and low-priority ACL policies in the low-priority zone. The hardware module is used to generate ACL policy entries based on the software logic module; The sending module is used to send the generated ACL policy entries to the TCAM chip, so that the TCAM chip can implement hardware multi-priority NAT service forwarding based on the converted hardware entries.

7. The network device according to claim 6, characterized in that, The software logic module is specifically used to divide the HandleIndex into a first interval segment, a second interval segment, and a third interval segment; And put static NAT rules into the first interval, dynamic NAT rules into the second interval, and NAT ALG association rules into the third interval; Among them, the priority of the static NAT rule is higher than that of the dynamic NAT rule, and the priority of the dynamic NAT rule is higher than that of the NAT ALG association rule.

8. The network device according to claim 7, characterized in that, The segment number of the first interval is less than the segment number of the second interval, and the segment number of the second interval is less than the segment number of the third interval.

9. The network device according to claim 6, characterized in that, The software logic module is also used to distinguish between ACL Name type and ACL Num type; Additionally, ACL policies of type ACL Name are placed in the high-priority zone, and ACL policies of type ACL Num are placed in the low-priority zone.

10. The network device according to claim 9, characterized in that, The software logic module is also used to place ACL policies in the high priority area according to the Rule ID order of ACL policies of type ACL Name, and to place ACL policies in the high priority area according to the Rule ID order of ACL policies of type ACL Num.

Images