A method and system for implementing virtual private network multicasting

Abstract

The application discloses a kind of methods and systems for realizing virtual private network multicast, belong to computer network communication technical field, the implementation of the method includes: virtual private network opens multicast, provides the function of opening virtual private network multicast and builds the multicast relay gateway of exclusive type;Multicast security policy configuration: provide two kinds of security policies of all release and limit virtual private network multicast source, can set the cloud multicast source traffic of permission release;Virtual private network closes multicast: provide the function of closing virtual private network multicast, and clean the underlying resources and database resources involved.This application provides the solution of the two kinds of scenes using multicast for communication, cloud multicast source, cloud receiver and cloud receiver, cloud multicast source, and provides the function of quickly opening and closing virtual private network multicast, and ensures the exclusive nature and mutual non-interference of user-level multicast relay gateway.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of computer network communication technology, in particular to a method and system for implementing virtual private network multicast. BACKGROUND

[0002] With the development of the Internet and the popularity of multimedia applications, in one-to-many network communication scenarios, the problem of message duplication and repeated occupation of bandwidth occurs in unicast mode, and the problem of waste of bandwidth resources occurs in broadcast mode. SUMMARY

[0003] The technical task of the present application is to provide a method and system for implementing virtual private network multicast, which provides a solution for using multicast for communication in two scenarios of cloud-in multicast source, cloud-out receiver and cloud-in receiver, cloud-out multicast source, and provides the function of quickly opening and closing virtual private network multicast, and ensures the exclusive use and non-interference of user-level multicast transit gateway.

[0004] The technical solution adopted by the present application to solve its technical problems is:

[0005] A method for implementing virtual private network multicast, the implementation of the method comprises:

[0006] Virtual private network multicast opening, including transit gateway VLAN network configuration, multicast opening prerequisite verification, multicast subnet creation, multicast transit gateway creation, multicast transit gateway readiness determination, multicast transit gateway configuration issuance, multicast transit gateway type verification and virtual private network multicast data record, providing the function of opening virtual private network multicast and building exclusive multicast transit gateway;

[0007] Multicast security policy configuration: providing two security policies of all-pass and limiting virtual private network multicast source, allowing to set the cloud-in multicast source traffic allowed to pass;

[0008] Virtual private network multicast closing: providing the function of closing virtual private network multicast, and cleaning up the underlying resources and database resources involved.

[0009] The method supports VXLAN type virtual private network multicast function, provides cloud internal multicast source, cloud external receiver and cloud internal receiver, cloud external multicast source two scene solutions, and supports multicast security policy configuration and transit gateway level high availability; one-key type opening and closing of virtual private network multicast is realized, and the operation process is simplified; user exclusive VLAN network configuration is provided to guarantee network non-blocking; dynamic switching of transit gateway master and backup mode is provided to guarantee uninterrupted multicast service traffic forwarding; the transit gateway master and backup cluster is quickly built by making multicast transit gateway virtual machine image; personalized configuration of cloud internal multicast source security policy rules is provided to flexibly limit the multicast source range; the event chain method is used to record the creation process for the data source of the abnormal rollback mechanism. The method provides a multicast communication solution for cloud internal multicast source, cloud external receiver and cloud internal receiver, cloud external multicast source two scenes, provides a function of quickly opening and closing virtual private network multicast, and guarantees user level multicast transit gateway exclusivity and non-interference.

[0010] Further, the virtual private network opens multicast, wherein

[0011] 1) Transit gateway VLAN network configuration:

[0012] 1.1) First, configure two VLAN networks on the switch and open the IGMPv3 protocol;

[0013] 1.2) Transmit the two VLAN networks configured on the switch and create openstack vlan network and subnet resources, wherein the two VLAN networks are identified as vlan1 and vlan2 respectively;

[0014] 1.3) Design the VLAN network configuration table vlan_config, which involves fields including: id, user_id, vlan_id1, vlan_id2, created_time;

[0015] 1.4) Assign vlan1 and vlan2 to a certain userId and maintain them in the vlan_config table;

[0016] Through steps 1.1) to 1.4), the VLAN network configuration required for a user to configure an exclusive transit gateway is completed;

[0017] 2) Opening multicast prerequisite verification:

[0018] 2.1) Verify whether the required vlan network of the multicast transit gateway is valid, and obtain the vlan information from the vlan_config;

[0019] 2.2) Check if the virtual private network network resource exists;

[0020] 3) Multicast subnet creation:

[0021] Create a subnet under the virtual private network network resource, which will allocate an IP for the vxlan port of the multicast gateway, used to communicate between the virtual private network and the multicast transit gateway;

[0022] 4) Multicast transit gateway creation:

[0023] 4.1) Create two security groups vxlanSecurityGroup and vlanSecurityGroup respectively for binding vlan port and vxlan port;

[0024] 4.2) Create a server group and set the soft-anti-affinity policy to let the multicast transit gateway be on different compute nodes as much as possible to ensure high availability of the multicast transit gateway;

[0025] 4.3) Get the Image and Flavor required for creating the multicast transit gateway, where the Image is the multicast transit gateway image made, and the Flavor is 4C8G40G;

[0026] 4.4) Create two transit gateways in a loop;

[0027] 5) Multicast transit gateway readiness determination:

[0028] 5.1) Send an http get request to the two gateways, with uri as: / multicasts / health-check;

[0029] 5.2) The response result true means that the gateway service is ready, and the response result false means that the gateway service is not ready;

[0030] 5.3) When it is detected that the gateway service is not ready, repeat steps 2) to 4) after waiting for a specified time;

[0031] 5.4) When either of the two gateway services is not ready, it means that the multicast start fails;

[0032] 6) Multicast transit gateway configuration distribution:

[0033] 6.1) Send an http post request to the two gateways, with uri as: / multicasts / distribute-config;

[0034] 6.2) one sent primary gateway configuration, one sent backup gateway configuration;

[0035] The transit gateway configured as the primary gateway undertakes the role of a communication bridge for opening up the communication from inside the cloud to outside the cloud and from outside the cloud to inside the cloud.

[0036] The transit gateway configured as the backup gateway exists as a backup machine, and once the primary gateway is detected to be faulty, it immediately switches to the primary gateway and continues to perform the duty of multicast traffic forwarding.

[0037] 7) Multicast transit gateway type verification:

[0038] 7.1) An http get request is initiated to the two gateways, and the uri is: / multicasts / check-gateway-status;

[0039] 7.2) Check whether the two gateways are in primary-backup mode;

[0040] 8) Virtual private network multicast data record:

[0041] Record a virtual private network multicast data;

[0042] Record the data of the two transit gateways;

[0043] Record the security group vxlanSecurityGroup ingress rule record.

[0044] Further, the security group vxlanSecurityGroup, vlanSecurityGroup,

[0045] The out rule is to only pass the multicast traffic of the 224.0.0.0 / 4 network segment;

[0046] The ingress rule is initially set to pass all.

[0047] Further, the loop creates two transit gateways, and the steps for creating each transit gateway are as follows:

[0048] 4.4.1) Create a transit gateway server according to Image, Flavor, and server group;

[0049] 4.4.2) Create a vxlan port using multiSubnet and bind vxlanSecurityGroup;

[0050] 4.4.3) Create a vlan port using vlan1 and bind vlanSecurityGroup, and the other one uses vlan2 to create a vlan port;

[0051] 4.4.4) Attach vlan port and vxlan port to transit gateway server respectively;

[0052] The creation of two transit gateways is completed through the above steps.

[0053] Further, the multicast security policy configuration comprises:

[0054] Full release mode: this mode is the initial mode of opening multicast, which does not limit the traffic of cloud multicast source;

[0055] Limit virtual private network multicast source mode: configure to release the traffic of a certain network segment to the transit gateway, such as 192.168.1.0 / 24; or configure to release the traffic of a certain IP to the transit gateway, such as 192.168.1.12 / 32.

[0056] Further, the virtual private network closes multicast, which is used to release the resources of opening multicast, so that the virtual private network returns to the state of not opening multicast, and the steps are as follows:

[0057] S1, release the transit gateway server;

[0058] S2, release the vxlan port, vlan port;

[0059] S3, release the vxlanSecurityGroup, vlanSecurityGroup;

[0060] S4, release the server group;

[0061] S5, release the multicast record, multicast transit gateway record, and security group rule record.

[0062] Further, the specific implementation process steps of opening multicast are as follows:

[0063] Step one: configure two VLAN networks exclusively for the user;

[0064] Step two: check whether the current virtual private network can open multicast, if it does not meet the conditions, multicast opening fails;

[0065] Step three: create a subnet for the virtual private network for gateway vxlan port;

[0066] Step four: create two transit gateway virtual machines using VLAN network, subnet, gateway image, etc.

[0067] Step five: check whether the services in the two transit gateways are started, if not started, multicast opening fails;

[0068] Step six: two transit gateway is divided into master and backup, and then the master and backup configuration is issued respectively, if the issuance fails, the multicast start fails;

[0069] Step seven: check if the two transit gateway types are master and backup mode, if not, the multicast start fails;

[0070] Step eight: if the multicast start is successful, record the multicast related data into the database.

[0071] The application also claims to protect a system for realizing virtual private network multicast, comprising:

[0072] The virtual private network multicast start module is used to provide the function of starting virtual private network multicast and build a dedicated multicast transit gateway, including a transit gateway VLAN network configuration submodule, a prerequisite check submodule before starting multicast, a multicast subnet creation submodule, a multicast transit gateway creation submodule, a multicast transit gateway readiness determination submodule, a multicast transit gateway configuration issuance submodule, a multicast transit gateway type verification submodule and a virtual private network multicast data recording submodule.

[0073] The multicast security policy configuration module is used to provide two security policies of all release and limit virtual private network multicast source, and can set the allowed release of intracloud multicast source flow.

[0074] The virtual private network multicast stop module is used to provide the function of stopping virtual private network multicast and clean up the underlying resources and database resources involved.

[0075] The system realizes virtual private network multicast through the above method.

[0076] The application also claims to protect a device for realizing virtual private network multicast, comprising: at least one memory and at least one processor.

[0077] The at least one memory is used to store machine readable programs.

[0078] The at least one processor is used to call the machine readable programs to realize the above method.

[0079] The application also claims to protect a computer readable medium, the computer readable medium stores computer instructions, and the computer instructions make the processor execute the above method when executed by the processor.

[0080] Compared with the prior art, the method and system for realizing virtual private network multicast of the application have the following beneficial effects:

[0081] 1. Provide the convenience of starting and stopping multicast of virtual private network.

[0082] 2. Support configuring a private VLAN network for a user.

[0083] 3. Provide a personalized configuration cloud multicast source security policy rule to flexibly limit the multicast source range.

[0084] 4. Flexibly switch the master-slave mode of the transit gateway to ensure uninterrupted multicast scenario business.

[0085] 5. The transit gateway is distributed in different computing nodes to ensure high availability. BRIEF DESCRIPTION OF DRAWINGS

[0086] Figure 1 is a multicast implementation process diagram of a virtual private network provided by an embodiment of the application;

[0087] Figure 2 is an architecture and process diagram of multicast security policy configuration and virtual private network multicast provided by an embodiment of the application. DETAILED DESCRIPTION

[0088] The application will be further described below in combination with the drawings and specific embodiments.

[0089] An embodiment of the application provides a method for implementing virtual private network multicast, and the implementation of the method comprises the following steps:

[0090] The virtual private network multicast comprises transit gateway VLAN network configuration, multicast precondition verification before multicast is started, multicast subnet creation, multicast transit gateway creation, multicast transit gateway readiness determination, multicast transit gateway configuration delivery, multicast transit gateway type verification, and virtual private network multicast data record, which provide the function of starting the virtual private network multicast and build a private multicast transit gateway through the above functional modules.

[0091] Multicast security policy configuration: provide two security policies of all-pass and limiting virtual private network multicast sources, and allow the cloud multicast source flow to be passed.

[0092] Virtual private network multicast shutdown: provide the function of shutting down the virtual private network multicast, and clean up the underlying resources and database resources involved.

[0093] The method realizes one-key starting and shutting down of the virtual private network multicast, simplifies the operation process, provides user private VLAN network configuration to ensure that the network is not blocked, dynamically switches the master-slave mode of the transit gateway to ensure uninterrupted multicast business flow forwarding, quickly builds the transit gateway master-slave cluster by making a multicast transit gateway virtual machine image, provides a personalized configuration cloud multicast source security policy rule to flexibly limit the multicast source range, and uses an event chain to record the creation process for data source of the abnormal rollback mechanism.

[0094] The following is combined Figure 1 and Figure 2 This method is explained in detail.

[0095] 1. Enable multicast in Virtual Private Network

[0096] This module is divided into eight sub-modules: VLAN network configuration for relay gateways, multicast prerequisite verification, multicast subnet creation, multicast relay gateway creation, multicast relay gateway readiness determination, multicast relay gateway configuration distribution, multicast relay gateway type verification, and virtual private network multicast data recording. These eight sub-modules implement the function of enabling multicast in virtual private networks. A more detailed explanation follows:

[0097] (1) VLAN network configuration for relay gateway:

[0098] (1.1) First, configure two VLAN networks on the switch and enable the IGMPv3 protocol;

[0099] (1.2) Transmit the two VLAN networks configured on the switch and create OpenStack vlannetwork and subnet resources, where the two VLAN networks are identified as vlan1 and vlan2 respectively;

[0100] (1.3) Design the VLAN network configuration table vlan_config, which includes the following fields: id, user_id, vlan_id1, vlan_id2, and created_time;

[0101] (1.4) Assign vlan1 and vlan2 to a certain userId and maintain them in the vlan_config table;

[0102] Steps (1.1) to (1.4) complete the VLAN network configuration required to configure a dedicated relay gateway for a user.

[0103] (2) Enable multicast prerequisite verification:

[0104] (2.1) Verify whether the VLAN network required by the multicast relay gateway is valid, and obtain the VLAN information from vlan_config;

[0105] (2.2) Verify that the virtual private network resource exists.

[0106] (3) Multicast subnet creation:

[0107] Create a subnet multiSubnet with cidr 11.0.104.0 / 24 under the virtual private network network resource; the subnet will allocate ip for the vxlan port of the multicast gateway, which is used to open the communication between the virtual private network and the multicast transit gateway.

[0108] (4) Multicast transit gateway creation:

[0109] (4.1) Create two security groups vxlanSecurityGroup and vlanSecurityGroup respectively for binding vlan port and vxlan port; the outbound rules of the two security groups are only to pass multicast traffic of 224.0.0.0 / 4 network segment; the inbound rules are initially set to pass all;

[0110] (4.2) Create a server group and set the soft-anti-affinity policy to make the multicast transit gateway as different as possible on different compute nodes to ensure high availability of the multicast transit gateway;

[0111] (4.3) Get the Image and Flavor required for creating the multicast transit gateway, where the Image is the multicast transit gateway image made, and the Flavor is 4C8G40G;

[0112] (4.4) Create two transit gateways in a loop, and the creation steps of each transit gateway are as follows:

[0113] (4.4.1) Create the transit gateway server according to the Image, Flavor, and server group;

[0114] (4.4.2) Create the vxlan port using multiSubnet and bind the vxlanSecurityGroup;

[0115] (4.4.3) Create the vlan port using vlan1 and bind the vlanSecurityGroup, and the other one uses vlan2 to create the vlan port;

[0116] (4.4.4) Attach the vlan port and vxlan port to the transit gateway server respectively;

[0117] Through the above steps, the creation of two transit gateways is completed.

[0118] (5) Multicast transit gateway readiness determination:

[0119] (5.1) Initiate http get request to two gateways, uri is: / multicasts / health-check;

[0120] (5.2) Response result is true represents that the gateway service is ready, response result is false represents that the gateway service is not ready;

[0121] (5.3) When detecting that the gateway service is not ready, repeat steps (2) to (4) after waiting for a specified time; try at most 3 times until success;

[0122] (5.4) When either of the two gateway services is not ready, it represents that the multicast starts to fail.

[0123] (6) Multicast transit gateway configuration delivery:

[0124] (6.1) Initiate http post request to two gateways, uri is: / multicasts / distribute-config;

[0125] (6.2) One is sent the master gateway configuration, and one is sent the backup gateway configuration;

[0126] The transit gateway configured as the master gateway undertakes the communication bridge of connecting the communication from inside the cloud to outside the cloud and from outside the cloud to inside the cloud;

[0127] The transit gateway configured as the backup gateway exists as a backup machine, and switches to the master gateway as soon as the master gateway is detected to be faulty, and continues to perform the responsibility of multicast traffic forwarding.

[0128] (7) Multicast transit gateway type verification:

[0129] (7.1) Initiate http get request to two gateways, uri is: / multicasts / check-gateway-status;

[0130] (7.2) Check whether the two gateways are in master-backup mode.

[0131] (8) Virtual private network multicast data record:

[0132] (8.1) Record a virtual private network multicast data;

[0133] (8.2) Record the data of two transit gateways;

[0134] (8.3) Record the security group vxlanSecurityGroup entry rule record.

[0135] 2, Multicast security policy configuration, including:

[0136] Full release mode: this mode is the initial mode of multicast, and there is no restriction on the traffic of multicast sources in the cloud.

[0137] Limit virtual private network multicast source mode: configure only the traffic of a certain network segment, such as 192.168.1.0 / 24, to be released to the transit gateway; or configure only the traffic of a certain IP, such as 192.168.1.12 / 32, to be released to the transit gateway.

[0138] 3. Virtual private network closes multicast, which is used to release the resources of opening multicast, so that the virtual private network returns to the state of not opening multicast, and the steps are as follows:

[0139] S1. Release the transit gateway server;

[0140] S2. Release the vxlan port and the vlan port;

[0141] S3. Release the vxlanSecurityGroup and the vlanSecurityGroup;

[0142] S4. Release the server group;

[0143] S5. Release the multicast record, the multicast transit gateway record, and the security group rule record.

[0144] The specific implementation process steps of opening multicast are as follows:

[0145] Step one: configure two VLAN networks exclusively for the user.

[0146] Step two: check whether the current virtual private network can open multicast. If the condition is not met, multicast opening fails.

[0147] Step three: create a subnet 11.0.104.0 / 24 for the virtual private network for the gateway vxlan port.

[0148] Step four: create two transit gateway virtual machines using VLAN networks, subnets, gateway images, etc.

[0149] Step five: check whether the services in the two transit gateways are started. If not, multicast opening fails.

[0150] Step six: divide the two transit gateways into master and backup, and then respectively issue master and backup configurations. If the issue fails, multicast opening fails.

[0151] Step seven: check whether the types of the two transit gateways are master and backup modes. If not, multicast opening fails.

[0152] Step 8: If multicast is successfully started, record the multicast-related data into the database.

[0153] In one-to-many network communication scenarios, multicast communication can help reduce server load and improve bandwidth utilization compared to unicast and broadcast communication modes. The Internet Group Management Protocol (IGMP), as a key component of multicast in IPv4 networks, plays an indispensable role. IGMP is a protocol in the TCP / IP protocol suite responsible for managing IP multicast membership, used to establish and maintain multicast group membership relationships between IP hosts and their directly adjacent multicast routers. To date, there are three versions of IGMP: IGMPv1, IGMPv2, and IGMPv3. All versions of IGMP support the ASM (Any-Source Multicast) model; IGMPv3 can be directly applied to the SSM (Source-Specific Multicast) model, while IGMPv1 and IGMPv2 require the support of IGMP SSM Mapping technology to be applied to the SSM model. Therefore, this method uses IGMPv3.

[0154] Multicast network roles include multicast source, multicast receiver, multicast group, and multicast router:

[0155] Multicast source: The sender of multicast information is called a "multicast source". A multicast source can send data to multiple multicast groups simultaneously, and multiple multicast sources can also send messages to a single multicast group simultaneously. Multicast sources typically do not need to join multicast groups.

[0156] Multicast group: A collection identified by IP multicast addresses. Any user host (or other receiving device) that joins a multicast group becomes a member of that group and can identify and receive multicast data sent to that multicast group.

[0157] Multicast group members: All hosts that join a multicast group become members of that multicast group. Membership in a multicast group is dynamic; hosts can join or leave the group at any time. Multicast group members can be widely distributed throughout the network.

[0158] Multicast router: A router or Layer 3 switch that supports Layer 3 multicast functionality. Multicast routers not only provide multicast routing capabilities but also management functions for multicast group members on the stub network segments connected to users.

[0159] Multicast technology is one of the three ways of IP network data transmission, and the multicast mode solves the problems of message repeated copying and repeated occupation of bandwidth in the unicast mode, and also solves the problem of waste of bandwidth resources in the broadcast mode. It is often applied to one-to-many network communication scenarios such as online live broadcast, video conference, financial transaction data synchronization, remote education and network television. Based on this, the method provides a method for implementing virtual private network multicast. The method provides a solution for using multicast communication for two scenarios of cloud-in multicast source, cloud-out receiver and cloud-in receiver, cloud-out multicast source, provides the function of quickly opening and closing virtual private network multicast, and ensures the exclusive use and non-interference of the user-level multicast transit gateway.

[0160] The embodiment of the application also provides a system for implementing virtual private network multicast, which implements virtual private network multicast through the method described in the above embodiment, and can realize multicast opening, multicast security policy configuration and multicast closing of the virtual private network. The system comprises:

[0161] A virtual private network multicast opening module is configured to provide the function of opening virtual private network multicast and build an exclusive multicast transit gateway, and comprises a transit gateway VLAN network configuration submodule, a multicast opening precondition verification submodule, a multicast subnet creation submodule, a multicast transit gateway creation submodule, a multicast transit gateway readiness determination submodule, a multicast transit gateway configuration issuing submodule, a multicast transit gateway type verification submodule and a virtual private network multicast data recording submodule.

[0162] A multicast security policy configuration module is configured to provide two security policies of all-passing and limiting virtual private network multicast sources, and can set the cloud-in multicast source flow allowed to pass.

[0163] A virtual private network multicast closing module is configured to provide the function of closing virtual private network multicast and clean up the underlying resources and database resources involved.

[0164] The virtual private network multicast opening module comprises eight submodules, namely, a transit gateway VLAN network configuration submodule, a multicast opening precondition verification submodule, a multicast subnet creation submodule, a multicast transit gateway creation submodule, a multicast transit gateway readiness determination submodule, a multicast transit gateway configuration issuing submodule, a multicast transit gateway type verification submodule and a virtual private network multicast data recording submodule. The eight submodules realize the function of opening virtual private network multicast, and will be described in more detail as follows:

[0165] (1) Transit gateway VLAN network configuration submodule:

[0166] (1.1) First, configure two VLAN networks on the switch and open the IGMPv3 protocol;

[0167] (1.2) The two VLAN networks configured on the switch are transmitted and openstack vlan network and subnet resources are created, wherein the two VLAN networks are identified as vlan1 and vlan2 respectively;

[0168] (1.3) A VLAN network configuration table vlan_config is designed, and the fields involved include id, user_id, vlan_id1, vlan_id2, and created_time;

[0169] (1.4) vlan1 and vlan2 are assigned to a certain user and maintained in the vlan_config table;

[0170] Through steps (1.1) to (1.4), the VLAN network configuration required for configuring a dedicated transit gateway for a certain user is completed.

[0171] (2) Start the multicast prerequisite verification submodule:

[0172] (2.1) Verify whether the vlan network required by the multicast transit gateway is valid, and obtain the vlan information from the vlan_config;

[0173] (2.2) Verify whether the virtual private network network resource exists.

[0174] (3) Multicast subnet creation submodule:

[0175] A subnet multiSubnet with a cidr of 11.0.104.0 / 24 is created under the virtual private network network resource; the subnet will allocate an ip for the vxlan port of the multicast gateway, which is used to communicate between the virtual private network and the multicast transit gateway.

[0176] (4) Multicast transit gateway creation submodule:

[0177] (4.1) Two security groups vxlanSecurityGroup and vlanSecurityGroup are created for binding the vlan port and the vxlan port respectively; the outbound rules of the two security group networks are only multicast traffic of the 224.0.0.0 / 4 network segment; the inbound rules are initially set to all pass;

[0178] (4.2) A server group is created and a soft-anti-affinity policy is set, which is used to make the multicast transit gateway as different as possible on different computing nodes to ensure the high availability of the multicast transit gateway;

[0179] (4.3) Get the Image and Flavor needed to create the multicast transit gateway, wherein the Image is the multicast transit gateway image produced, and the Flavor is 4C8G40G;

[0180] (4.4) Create two transit gateways in a loop, and the steps for creating each transit gateway are as follows:

[0181] (4.4.1) Create the transit gateway server according to the Image, Flavor, and server group;

[0182] (4.4.2) Create the vxlan port using multiSubnet and bind the vxlanSecurityGroup;

[0183] (4.4.3) Create the vlan port using vlan1 and bind the vlanSecurityGroup, wherein the other one uses vlan2 to create the vlan port;

[0184] (4.4.4) Attach the vlan port and the vxlan port to the transit gateway server, respectively;

[0185] The creation of the two transit gateways is completed through the above steps.

[0186] (5) Multicast transit gateway readiness determination submodule:

[0187] (5.1) Initiate an http get request to the two gateways, and the uri is: / multicasts / health-check;

[0188] (5.2) The response result true represents that the gateway service is already ready, and the response result false represents that the gateway service is not ready yet;

[0189] (5.3) When it is detected that the gateway service is not ready, repeat steps (2) to (4) after waiting for a specified time again; try at most 3 times until success;

[0190] (5.4) When either of the two gateway services is not ready, it represents that the multicast start fails.

[0191] (6) Multicast transit gateway configuration distribution submodule:

[0192] (6.1) Initiate an http post request to the two gateways, and the uri is: / multicasts / distribute-config;

[0193] (6.2) one sent main gateway configuration, one sent backup gateway configuration;

[0194] The transit gateway configured as the main gateway undertakes the communication bridge of opening up the communication from inside the cloud to outside the cloud and from outside the cloud to inside the cloud.

[0195] The transit gateway configured as the backup gateway exists as a backup machine, and once the main gateway is detected to be faulty, the transit gateway is switched to the main gateway immediately and continues to perform the duty of forwarding multicast traffic.

[0196] (7) Multicast transit gateway type verification submodule:

[0197] (7.1) An http get request is initiated to the two gateways, and the uri is: / multicasts / check-gateway-status;

[0198] (7.2) Check whether the two gateways are in the main-backup mode.

[0199] (8) Virtual private network multicast data recording submodule:

[0200] (8.1) Record a virtual private network multicast data;

[0201] (8.2) Record the data of the two transit gateways;

[0202] (8.3) Record the security group vxlanSecurityGroup entry rule record.

[0203] The multicast security policy configuration module comprises:

[0204] All-pass mode: This mode is the initial mode of opening multicast, and the traffic of the cloud multicast source is not limited.

[0205] Limit virtual private network multicast source mode: Configure to pass only the traffic of a certain network segment to the transit gateway, such as 192.168.1.0 / 24; or configure to pass only the traffic of a certain IP to the transit gateway, such as 192.168.1.12 / 32.

[0206] The virtual private network multicast closing module is used to release the resources of opening multicast, so that the virtual private network returns to the state of not opening multicast, and the steps are as follows:

[0207] S1, release the transit gateway server;

[0208] S2, release the vxlan port, the vlan port;

[0209] S3, release the vxlanSecurityGroup, the vlanSecurityGroup;

[0210] S4, release server group;

[0211] S5, release multicast record, multicast transit gateway record, security group rule record.

[0212] The specific implementation process steps of starting multicast by the system are as follows:

[0213] Step one: configure two VLAN networks exclusively for users.

[0214] Step two: check whether the current virtual private network can start multicast, if not, multicast start fails.

[0215] Step three: create a subnet 11.0.104.0 / 24 for the virtual private network for gateway vxlan port.

[0216] Step four: create two transit gateway virtual machines using VLAN network, subnet, gateway image, etc.

[0217] Step five: check whether the services in the two transit gateways are started, if not, multicast start fails.

[0218] Step six: divide the two transit gateways into master and backup, and then respectively issue master and backup configurations, if the issue fails, multicast start fails.

[0219] Step seven: check whether the types of the two transit gateways are master and backup mode, if not, multicast start fails.

[0220] Step eight: if multicast start succeeds, record multicast related data into the database.

[0221] The embodiment of the application also provides a device for implementing virtual private network multicast, comprising at least one memory and at least one processor.

[0222] The at least one memory is used for storing machine readable programs.

[0223] The at least one processor is used for calling the machine readable programs to realize the method for implementing virtual private network multicast in the above embodiment.

[0224] The embodiments of the present application also provide a computer readable medium, which stores computer instructions. The computer instructions, when executed by a processor, cause the processor to perform the method for implementing the virtual private network multicast according to the above embodiments. Specifically, a system or device equipped with a storage medium can be provided. The storage medium stores software program codes for implementing the functions of any of the above embodiments. The computer (or CPU or MPU) of the system or device reads and executes the program codes stored in the storage medium.

[0225] In this case, the program codes read from the storage medium can implement the functions of any of the above embodiments. Therefore, the program codes and the storage medium storing the program codes constitute a part of the present application.

[0226] The embodiments of the storage medium for storing the program codes include floppy disks, hard disks, magneto-optical disks, optical disks (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD+RW), magnetic tapes, nonvolatile memory cards, and ROMs. Alternatively, the program codes can be downloaded from a server computer via a communication network.

[0227] In addition, it should be understood that the functions of any of the above embodiments can be implemented not only by executing the program codes read by the computer, but also by causing the operating system or the like operating on the computer to perform part or all of the actual operations based on the instructions of the program codes.

[0228] In addition, it should be understood that the program codes read from the storage medium can be written into the memory provided in the expansion board inserted into the computer or the memory provided in the expansion unit connected to the computer. Then, part or all of the actual operations can be performed by the CPU or the like installed in the expansion board or the expansion unit based on the instructions of the program codes, so as to implement the functions of any of the above embodiments.

[0229] The present application has been described in detail by the above drawings and preferred embodiments, however, the present application is not limited to the disclosed embodiments, and those skilled in the art can know that the code review means in the above different embodiments can be combined to obtain more embodiments of the present application, which are also within the protection scope of the present application.

Claims

1. A method for implementing virtual private network multicasting, the method comprising: The implementation of the method comprises: The virtual private network opens multicast, including transit gateway VLAN network configuration, multicast precondition verification, multicast subnet creation, multicast transit gateway creation, multicast transit gateway readiness determination, multicast transit gateway configuration issuance, multicast transit gateway type verification, and virtual private network multicast data record, providing the function of opening virtual private network multicast and building a dedicated multicast transit gateway; Multicast security policy configuration: provides two security policies of all release and limited virtual private network multicast source, and can set the allowed release of intranet multicast source flow; Virtual private network closes multicast: provides the function of closing virtual private network multicast, and cleans up the underlying resources and database resources involved; The specific implementation process steps of opening multicast are as follows: Step one: configure two VLAN networks for the user; Step two: verify whether the current virtual private network can open multicast, if not, multicast opening fails; Step three: create a subnet for the virtual private network for gateway vxlan port; Step four: create two transit gateway virtual machines using VLAN network, subnet, and gateway image; Step five: check whether the services in the two transit gateways are started, if not, multicast opening fails; Step six: divide the two transit gateways into master and backup, and then respectively issue master and backup configurations, if the issuance fails, multicast opening fails; Step seven: check whether the types of the two transit gateways are master and backup mode, if not, multicast opening fails; Step eight: if multicast opening is successful, record the multicast related data in the database.

2. The method for implementing virtual private network multicast of claim 1, wherein, The virtual private network opens multicast, wherein, 1) Transit gateway VLAN network configuration: 1.1) First, configure two VLAN networks on the switch and open IGMPv3 protocol; 1.2) Transmit the two VLAN networks configured on the switch, and create openstack vlan network and subnet resources, wherein the two VLAN networks are identified as vlan1 and vlan2 respectively; 1.3) Design VLAN network configuration table vlan_config, which involves fields including id, user_id, vlan_id1, vlan_id2, and created_time; 1.4) Assign vlan1 and vlan2 to a certain userId, and maintain them in the vlan_config table; 2) Multicast precondition verification: 2.1) Verify whether the vlan networks required by the multicast transit gateway are valid, and obtain vlan information from the vlan_config table; 2.2) Verify whether the virtual private network network resource exists; 3) Multicast subnet creation: Create a subnet under the virtual private network network resource, which will allocate ip for the vxlan port of the multicast gateway, for communication between the virtual private network and the multicast transit gateway; 4) Multicast transit gateway creation: 4.1) Create two security groups vxlanSecurityGroup and vlanSecurityGroup for binding vlanport and vxlan port respectively; 4.2) Create a server group and set soft-anti-affinity policy to make multicast transit gateway in different compute nodes as much as possible to ensure high availability of multicast transit gateway; 4.3) Obtain the Image and Flavor required for creating multicast transit gateway; 4.4) Create two transit gateways in a loop; 5) Multicast transit gateway readiness determination: 5.1) Send an http get request to the two gateways, and the uri is: / multicasts / health-check; 5.2) The response result true represents that the gateway service is ready, and the response result false represents that the gateway service is not ready; 5.3) When it is detected that the gateway service is not ready, repeat steps 2) to 4) after waiting for a specified time; 5.4) When either of the two gateway services is not ready, it means that the multicast start fails; 6) Multicast transit gateway configuration distribution: 6.1) Send an http post request to the two gateways, and the uri is: / multicasts / distribute-config; 6.2) One is sent the main gateway configuration and the other is sent the backup gateway configuration; The transit gateway configured as the main gateway undertakes the communication bridge of connecting cloud to cloud and cloud to cloud; The transit gateway configured as the backup gateway exists as a backup, and switches to the main gateway as soon as the main gateway is detected to be faulty, and continues to perform the responsibility of multicast traffic forwarding; 7) Multicast transit gateway type verification: 7.1) Send an http get request to the two gateways, and the uri is: / multicasts / check-gateway-status; 7.2) Check whether the two gateways are in master-slave mode; 8) Virtual private network multicast data record: Record a virtual private network multicast data; Record the data of the two transit gateways; Record the security group vxlanSecurityGroup entry rule.

3. The method of claim 2, wherein, The security group vxlanSecurityGroup and vlanSecurityGroup, The exit rule is to only pass the multicast traffic of the 224.0.0.0 / 4 network segment; The entry rule is initially set to pass all.

4. The method for implementing virtual private network multicast according to claim 2 or 3, characterized in that, The two transit gateways are created in a loop, and the steps of creating each transit gateway are as follows: 4.4.1) Create a transit gateway server according to the Image, Flavor, and server group; 4.4.2) Create a vxlan port using multiSubnet and bind the vxlanSecurityGroup; 4.4.3) create a vlan port using vlan1 and bind vlanSecurityGroup, and another one using vlan2; 4.4.4) attach vlan port and vxlan port to transit gateway server respectively; Through the above steps, the creation of two transit gateways is completed.

5. The method for implementing virtual private network multicast according to claim 1 or 2, characterized in that, The multicast security policy configuration comprises: All-pass mode: this mode is the initial mode of opening multicast, and does not limit the traffic of cloud multicast sources; Limiting virtual private network multicast source mode: configuring to pass only the traffic of a certain network segment to the transit gateway, or configuring to pass only the traffic of a certain IP to the transit gateway.

6. The method for implementing virtual private network multicast according to claim 1 or 2, characterized in that, The virtual private network closes multicast, which is used to release the resources of opening multicast, so that the virtual private network returns to the state of not opening multicast, and the steps are as follows: S1, release the transit gateway server; S2, release the vxlan port and the vlan port; S3, release the vxlanSecurityGroup and the vlanSecurityGroup; S4, release the server group; S5, release the multicast record, the multicast transit gateway record, and the security group rule record.

7. A system for implementing virtual private network multicasting, the system comprising: Comprise: A virtual private network multicast opening module is configured to provide the function of opening virtual private network multicast and build a dedicated multicast transit gateway, comprising a transit gateway VLAN network configuration submodule, a multicast subnet creation submodule, a multicast transit gateway creation submodule, a multicast transit gateway readiness determination submodule, a multicast transit gateway configuration issuing submodule, a multicast transit gateway type verification submodule, and a virtual private network multicast data record submodule; A multicast security policy configuration module is configured to provide two security policies of all-pass and limiting virtual private network multicast source, and set the allowed cloud multicast source traffic; A virtual private network multicast closing module is configured to provide the function of closing virtual private network multicast, and clean up the underlying resources and database resources involved; The system realizes virtual private network multicast through the method of any one of claims 1 to 6.

8. An apparatus for implementing virtual private network multicasting, the apparatus comprising: Comprise: At least one memory and at least one processor; The at least one memory is configured to store machine readable programs; The at least one processor is configured to call the machine readable programs to realize the method of any one of claims 1 to 6.

9. A computer readable medium characterized by The computer readable medium stores computer instructions, and the computer instructions make the processor execute the method of any one of claims 1 to 6 when executed by the processor.

Images