Route configuration method and device, equipment, storage medium and product

Abstract

The invention discloses a route configuration method and device, equipment, a storage medium and a product, and the method comprises the steps: directly configuring a route prefix on network equipment or declaring the route prefix through a sub-network in a user sub-network multi-homing access scene, enabling the network equipment to update a source address verification rule or add a corresponding static route after receiving route configuration information, and enabling the network equipment to access to a user. And the network equipment generates a corresponding source address verification rule after receiving the declaration information, so that accurate protection of more scenes such as asymmetric routing, multi-homing asymmetric access of intra-domain users, traffic bypass and the like can be realized, and the problem of mistakenly filtering legal traffic is avoided.

Description

Technical Field

[0001] The present invention relates to the field of communications, and in particular to a routing configuration method, device, equipment, storage medium and product. Background Art

[0002] The lack of consideration of security issues at the beginning of the design of the Internet architecture has led to data transmission security risks. Statistics show that many network attacks are based on source address forgery. In order to alleviate the impact of source address forgery attacks, many source address validation (SAV) technical solutions have been proposed. Currently, the commonly used source address validation technologies mainly include loose uRPF (Unicast Reverse Path Forwarding), strict uRPF, ACL (Access Control List) based on SAV (Source Address Validation), etc. In the scenario where the user network is single-homed to the network, ACL or strict uRPF can generally be used to provide good protection. However, for the scenario where the user network is multi-homed to the network, there may be path asymmetry for the purpose of traffic engineering, and the asymmetric routing prefix on the router may change dynamically to achieve dynamic flow adjustment. At this time, ACL or strict uRPF cannot be used directly for whitelist protection of the UNI interface, otherwise there may be problems with mis-filtering. Summary of the invention

[0003] The purpose of the embodiments of the present invention is to provide a routing configuration method, apparatus, device, storage medium and product, which can achieve accurate protection for more scenarios such as asymmetric routing, multi-homing asymmetric access of users within the domain, and traffic detour, and avoid the problem of mistakenly filtering legitimate traffic.

[0004] To achieve the above object, an embodiment of the present invention further provides a routing configuration method, which is applied to a subnet, and the method includes:

[0005] Sending a routing announcement to at least one network device; wherein the routing announcement is used to instruct the network device to generate a corresponding source address verification rule, and the routing announcement includes at least one of the following information:

[0006] At least two routing prefixes and their corresponding priority indication information;

[0007] At least one child route prefix and its parent route prefix.

[0008] As an improvement to the above solution, when the subnet accesses at least one network device through an internal border gateway protocol, the priority indication information is a local priority value.

[0009] As an improvement of the above solution, when the subnet accesses at least one network device through an external border gateway protocol, the priority indication information is a multi-exit distinction value.

[0010] As an improvement of the above solution, for different network devices, the priority indication information corresponding to the same routing prefix announced by the subnet is different.

[0011] As an improvement of the above solution, the source address verification rule includes a source prefix whitelist and interface information.

[0012] As an improvement of the above solution, the interface information is a user network interface of the network device.

[0013] To achieve the above object, an embodiment of the present invention further provides a routing configuration method, which is applied to a network device, and the method includes:

[0014] Receive routing announcements sent by the subnet;

[0015] Generate a corresponding source address verification rule according to the routing announcement; wherein the routing announcement includes at least one of the following information:

[0016] At least two routing prefixes and their corresponding priority indication information;

[0017] At least one child route prefix and its parent route prefix.

[0018] To achieve the above object, an embodiment of the present invention provides a routing configuration method, which is applied to a network device, and the method includes:

[0019] Receiving routing configuration information, wherein the routing configuration information includes a routing prefix and interface information;

[0020] Update the source address verification rules or add corresponding static routes according to the routing configuration information.

[0021] As an improvement of the above solution, the routing prefix includes a sub-routing prefix and its corresponding parent routing prefix.

[0022] As an improvement of the above solution, the routing configuration information also includes priority indication information of the routing prefix.

[0023] As an improvement of the above solution, the routing configuration information further includes one of the following priority configuration information:

[0024] The priority of the static route is lower than the priority of the dynamic route of the network device;

[0025] The management distance of the static route is greater than the management distance of the dynamic route of the network device.

[0026] As an improvement of the above solution, the source address verification rule includes a source prefix whitelist and interface information.

[0027] As an improvement of the above solution, the interface information is a user network interface of the network device.

[0028] To achieve the above object, an embodiment of the present invention provides a routing configuration device, which is applied to a subnet, and the device includes:

[0029] A routing announcement sending module, used to send a routing announcement to at least one network device; wherein the routing announcement is used to instruct the network device to generate a corresponding source address verification rule, and the routing announcement includes at least one of the following information:

[0030] At least two routing prefixes and their corresponding priority indication information;

[0031] At least one child route prefix and its parent route prefix.

[0032] To achieve the above object, an embodiment of the present invention provides a routing configuration device, which is applied to a network device, and the device includes:

[0033] A routing announcement receiving module, used for receiving routing announcements sent by a subnet;

[0034] A routing configuration module, configured to generate a corresponding source address verification rule according to the routing announcement; wherein the routing announcement includes at least one of the following information:

[0035] At least two routing prefixes and their corresponding priority indication information;

[0036] At least one child route prefix and its parent route prefix.

[0037] To achieve the above object, an embodiment of the present invention provides a routing configuration device, which is applied to a network device, and the device includes:

[0038] A routing configuration information receiving module, used to receive routing configuration information, wherein the routing configuration information includes a routing prefix and interface information;

[0039] The routing configuration module is used to update the source address verification rules or add corresponding static routes according to the routing configuration information.

[0040] To achieve the above objectives, an embodiment of the present invention further provides a routing configuration device, comprising a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein when the processor executes the computer program, the routing configuration method as described in any of the above embodiments is implemented.

[0041] To achieve the above objectives, an embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium includes a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute the routing configuration method as described in any of the above embodiments.

[0042] To achieve the above objective, an embodiment of the present invention further provides a computer program product, including computer instructions, which, when executed by a processor, implement the routing configuration method as described in any of the above embodiments.

[0043] Compared with the prior art, the routing configuration method, apparatus, equipment, storage medium and product disclosed in the present invention, in the scenario of multi-homing access of user subnets, directly configure the routing prefix on the network device or have the subnet announce the routing prefix, so that the network device updates the source address verification rule or adds the corresponding static route after receiving the routing configuration information, and generates the corresponding source address verification rule after receiving the announcement information, which can achieve precise protection for more scenarios such as asymmetric routing, multi-homing asymmetric access of users within the domain, traffic detour, etc., and avoid the problem of mistaken filtering of legitimate traffic. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 It is a schematic diagram of the intra-domain access point and extra-domain scenario in the prior art;

[0045] Figure 2 It is a schematic diagram of a multi-homing access subnet scenario in the prior art;

[0046] Figure 3 is a flow chart of a first routing configuration method provided by an embodiment of the present invention;

[0047] Figure 4 is a schematic diagram of a network device accessing a subnet provided by an embodiment of the present invention;

[0048] Figure 5 This is a first schematic diagram of a subnet performing routing declaration provided by an embodiment of the present invention;

[0049] Figure 6 This is a second schematic diagram of a subnet performing routing declaration provided by an embodiment of the present invention;

[0050] Figure 7 is a flow chart of a second routing configuration method provided by an embodiment of the present invention;

[0051] Figure 8 is a flow chart of a third routing configuration method provided by an embodiment of the present invention;

[0052] Fig. 9 This is a third schematic diagram of a subnet performing routing announcement provided by an embodiment of the present invention;

[0053] Fig.10 is a structural block diagram of a first routing configuration device provided by an embodiment of the present invention;

[0054] Fig.11 is a structural block diagram of a second routing configuration device provided by an embodiment of the present invention;

[0055] Fig.12 is a structural block diagram of a third routing configuration device provided by an embodiment of the present invention;

[0056] Fig.13 It is a structural block diagram of a routing configuration device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0057] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0058] The feasibility of source address verification technology stems from the fact that devices that forge source addresses and devices with legitimate source addresses usually have different geographical or access locations. Therefore, forged messages and legitimate messages going to the same destination will use different forwarding paths and pass through routers along the way from different inbound interfaces. Therefore, routers can identify which information is legitimate and which is forged through the mapping relationship between source addresses and inbound interfaces.

[0059] When using loose uRPF technology, the router will check the local forwarding table (Forwarding Information Base, FIB) to confirm whether the source address of the received message exists. As long as the source address exists in the FIB table, the message will be processed normally, otherwise the message will be discarded. Using loose uRPF technology within the autonomous system will cause the source address verification to be too loose, and it will not be able to effectively prevent the source address forgery between legitimate network addresses, and mistakenly miss the attack traffic with forged source addresses, causing false negative problems. Figure 1 As shown, Figure 1This is a schematic diagram of the intra-domain access point and extra-domain scenario in the prior art. The autonomous system includes 6 network devices A to F. Device C has a legitimate source prefix P1, device D has a legitimate source prefix P2, device F has a legitimate source prefix P3, and device A has a legitimate source prefix P4. A1, A2, B1, B2, and E1 are the outbound interfaces of their respective devices. Assuming that the FIB table of device B is as shown in Table 1, when device D forwards traffic with a forged source prefix P1 to device B, the attack traffic will be mistakenly missed because the FIB table of device B contains the prefix.

[0060] Table 1 FIB table of device B

[0061] Destination Prefix Outbound interface P1 B1 P2 B2 ... ...

[0062] When using strict uRPF technology, the router will look up the local FIB table to learn the inbound interface of the source address. The inbound interface through which the message is transmitted must be the outbound interface corresponding to the source address of the message in the FIB table, otherwise the message will be discarded. Strict uRPF technology strictly requires that the forwarding interface and the inbound interface be consistent. It is mainly used in single-homing or symmetric routing scenarios. In asymmetric multi-homing access scenarios, legitimate traffic will be mistakenly filtered, resulting in false positives. Figure 2 As shown, Figure 2 This is a schematic diagram of a multi-homing access subnet scenario in the prior art. The multi-homing subnet Subnet has legitimate source prefixes P1 and P2. Assume that the FIB table of device A is as shown in Table 2. Since the FIB table of device A only stores the outbound interface of prefix P2 as A2, the legitimate prefix P2 will be erroneously intercepted by the inbound interface A1 of device A.

[0063] Table 2 FIB table of device A

[0064] Destination Prefix Outbound interface P1 Subnet P2 A2 ... ...

[0065] In short, the loose uRPF and strict uRPF schemes can cause false negative and false positive problems in some scenarios. For another ACL technology based on SAV, manually configure filtering rules on the device and define a legal source prefix list, which has the problems of heavy burden and easy error, and is greatly limited in scalability. It is usually used as an auxiliary technology for using other verification technologies. Therefore, the ACL method based on SAV relies on static manual configuration and is difficult to use alone on a large scale. In addition, the ACL rules are manually maintained, and the maintenance overhead is large. Misconfiguration can lead to misblocking or mispassing. In addition, the prior art also uses the SAVNET (Source Address Validation in Networks) scheme of BGP (Border Gateway Protocol) detection messages. This scheme first exchanges source prefix information through the message domain, and then accurately restores the real forwarding path by sending BGP detection messages. The routing device that enables SAVNET will record the inbound interface it passes through, and generate a source address verification table consisting of the source prefix and the corresponding legal inbound interface. The edge and relay nodes within and between domains can use the source address verification table to provide all-round protection. However, this solution is not yet mature and may result in large message and path calculation overhead, as well as long latency, when used in large-scale networks.

[0066] In the scenario where the user network is accessed to the network with a single home, ACL or strict uRPF can generally be used to provide good protection. However, for the scenario where the user network is accessed to the network with multiple homes, for the purpose of traffic engineering, there may be path asymmetry, and the asymmetric routing prefixes on the router may change dynamically to achieve dynamic flow adjustment. At this time, ACL or strict uRPF cannot be used directly for whitelist protection of UNI (User Network Interface), otherwise the problem of mis-filtering may occur. In order to circumvent the above-mentioned shortcomings of the prior art, the present invention provides a routing configuration method to solve the problem of weak protection accuracy in the scenario of multi-home asymmetric access within the domain.

[0067] The network devices described in the embodiments of the present invention are edge devices, such as switches, routers, routing switches, IADs (Integrated Access Devices) and various MANs (Multiple-Access Networks) / WANs (Wide Area Networks) devices.

[0068] See also Figure 3 , Figure 3 is a flowchart of a first routing configuration method provided by an embodiment of the present invention. The first routing configuration method is implemented by a subnet. The first routing configuration method includes:

[0069] S11. Send a routing announcement to at least one network device; wherein the routing announcement is used to instruct the network device to generate a corresponding source address verification rule, and the routing announcement includes at least one of the following information:

[0070] 1) At least two routing prefixes and their corresponding priority indication information;

[0071] 2) At least one child routing prefix and its parent routing prefix.

[0072] For example, Figure 4 Take the following as an example to explain the two routing announcement methods. Figure 4 It is a schematic diagram of a network device accessing a subnet provided by an embodiment of the present invention. In a scenario of multi-homing access to a user subnet, three network devices are included, namely R1 to R3. Network device R1 accesses subnet 1 through an R1-1 interface and accesses network device R3 through an R1-2 interface. Network device R2 accesses subnet 1 through an R2-1 interface and accesses network device R3 through an R2-2 interface.

[0073] For the first case, the routing announcement includes at least two routing prefixes and their corresponding priority indication information.

[0074] For example, see Figure 5 , Figure 5 This is a first schematic diagram of subnet route announcement provided by an embodiment of the present invention. Subnet 1 is multi-homed and connected to network devices R1 and R2. For different network devices, the priority indication information corresponding to the same route prefix announced by the subnet is different. For example, subnet 1 announces a high-priority route prefix 2001:0db8:3c4d:1000:: / 64 to network device R1, and also announces a low-priority route prefix 2001:0db8:3c4d:1001:: / 64; in addition, subnet 1 announces a high-priority route prefix 2001:0db8:3c4d:1001:: / 64 to network device R2, and also announces a low-priority route prefix 2001:0db8:3c4d:1000:: / 64. At this time, R1 and R2 will generate the FIB table shown in Table 3. The packets destined for the destination prefix 2001:0db8:3c4d:1000:: / 64 will be forwarded to subnet 1 through R1 first, and the packets destined for the destination prefix 2001:0db8:3c4d:1001:: / 64 will be forwarded to subnet 1 through R2 first, thus achieving load balancing of the downstream traffic of subnet 1.

[0075] Table 3 FIB table of R1 and R2

[0076]

[0077] In this scenario, directly using strict uRPF based on FIB will cause mis-filtering problems. When subnet 1 sends a packet with a source address of 2001:0db8:3c4d:1001:: / 64, it will be intercepted by the R1-1 interface. This is because strict uRPF (the outbound interface and the inbound interface are the same) will extract the source address of the packet and search for the matching entry in the FIB through the longest prefix match. BGP first looks for a route that matches the longest prefix of the destination IP address, and checks whether the outbound interface of the matching entry matches the inbound interface of the packet. If the two match, the packet is legal. In this example, R1 finds through strict uRPF that the packet with a source address of 2001:0db8:3c4d:1001:: / 64 should arrive from the R1-2 interface, which is inconsistent with the actual interface R1-1 corresponding to this packet. Therefore, the packet is mistakenly considered to be an illegal packet.

[0078] After adopting the embodiment of the present invention, R1 will generate a complete source prefix whitelist based on RIB information on the UNI interface (i.e., R1-1), and the whitelist will include 2001:0db8:3c4d:1000:: / 64 and 2001:0db8:3c4d:1001:: / 64 at the same time. Similarly, R2 will generate a complete source prefix whitelist based on RIB information on the UNI interface (i.e., R2-1), and the whitelist will include 2001:0db8:3c4d:1000:: / 64 and 2001:0db8:3c4d:1001:: / 64 at the same time. The source address verification rules of R1 and R2 are shown in Table 4, and the source address verification rules include a source prefix whitelist and interface information, and the interface information is the user network interface of the network device. At this time, the message whose source address sent by the user subnet belongs to these two address spaces will not be intercepted by R1-1 or R1-2, thereby avoiding the problem of mis-filtering.

[0079] Table 4 Source address verification rules for R1 and R2 (SVA table)

[0080] interface Source prefix whitelist R1-1 2001:0db8:3c4d:1000:: / 64, 2001:0db8:3c4d:1001:: / 64 R2-1 2001:0db8:3c4d:1000:: / 64, 2001:0db8:3c4d:1001:: / 64

[0081] Specifically, in the first case, when the subnet accesses at least one network device via an internal border gateway protocol, the priority indication information is a local priority value.

[0082] For example, when a subnet announces a route to a network device, it needs to carry both high-priority routes and low-priority routes. This method requires the user subnet to change the configuration of the route announcement. Assume that subnet 1 is dual-homed to network devices R1 and R2 via iBGP (Internal Border Gateway Protocol). When announcing routes using BGP, the route 2001:0db8:3c4d:1000:: / 64 and the route 2001:0db8:3c4d:1001:: / 64 are announced to both R1 and R2. The next-hop interfaces of these two routes are both user-side UNI interfaces (i.e., R1-1 and R2-1). When subnet 1 announces routes, in the route announcement sent to R1, a larger local preference value needs to be set for 2001:0db8:3c4d:1000:: / 64, and a smaller local preference value needs to be set for 2001:0db8:3c4d:1001:: / 64. Conversely, in the route announcement sent to R2, a smaller local preference value needs to be set for 2001:0db8:3c4d:1000:: / 64, and a larger local preference value needs to be set for 2001:0db8:3c4d:1001:: / 64. As a result, R1 and R2 can achieve load balancing of traffic with destination prefixes of 2001:0db8:3c4d:1000:: / 64 and 2001:0db8:3c4d:1001:: / 64, and both R1 and R2 can obtain user routes with the next hop of UNI interface in RIB. Using the above SAVNET solution, the source prefix whitelists of R1 and R2 on R1-1 and R2-1 will eventually include both 2001:0db8:3c4d:1000:: / 64 and 2001:0db8:3c4d:1001:: / 64. The packets sent by the user subnet whose source addresses belong to this address space will not be intercepted by R1-1 or R2-1, thus avoiding the problem of mis-filtering.

[0083] Specifically, in the first case, when the subnet accesses at least one network device through an external border gateway protocol, the priority indication information is a multi-exit distinction value.

[0084] For example, it is assumed that subnet 1 is dual-homed to access devices R1 and R2 through eBGP (External Border Gateway Protocol). When declaring routes using BGP, route 2001:0db8:3c4d:1000:: / 64 and route 2001:0db8:3c4d:1001:: / 64 are announced to both R1 and R2, and the next-hop interfaces of these two routes are both user-side UNI interfaces (i.e., R1-1 or R2-1). When declaring routes, in the route announcement of subnet 1 to R1, a smaller MED (Multi-Exit Discriminator) value needs to be set for 2001:0db8:3c4d:1000:: / 64, and a larger MED value needs to be set for 2001:0db8:3c4d:1001:: / 64. On the contrary, in the route announcement from subnet 1 to R2, a larger MED value needs to be set for 2001:0db8:3c4d:1000:: / 64 and a smaller MED value needs to be set for 2001:0db8:3c4d:1001:: / 64. MED is a BGP attribute that is used to influence the decision of eBGP neighbors to select routes. Routes with smaller MED values ​​are considered better, thus affecting route selection. As a result, R1 and R2 can achieve load balancing of downstream traffic to destination prefixes 2001:0db8:3c4d:1000:: / 64 and 2001:0db8:3c4d:1001:: / 64, and both R1 and R2 can obtain user routes with the next hop of UN I interface in RIB. Using the above SAVNET solution, the source prefix whitelists of R1 and R2 on R1-1 and R2-1 will eventually include both 2001:0db8:3c4d:1000:: / 64 and 2001:0db8:3c4d:1001:: / 64. The packets sent by the user subnet whose source addresses belong to this address space will not be intercepted by R1-1 or R2-1, thus avoiding the problem of mis-filtering.

[0085] For the second case, the routing announcement includes at least one child routing prefix and its parent routing prefix.

[0086] For example, see Figure 6 , Figure 6This is a second schematic diagram of subnet route announcement provided by an embodiment of the present invention. Subnet 1 is multi-homed to network devices R1 and R2. Subnet 1 announces the sub-route prefix 2001:0db8:3c4d:1000:: / 64 to network device R1, and also announces the parent route prefix 2001:0db8:3c4d:1000:: / 63 of the sub-route prefix. In addition, subnet 1 announces the sub-route prefix 2001:0db8:3c4d:1001:: / 64 to network device R2, and also announces the parent route prefix 2001:0db8:3c4d:1000:: / 63 of the sub-route prefix. It is worth noting that the parent route prefix is ​​the prefix of the parent node, and the sub-route prefix is ​​the prefix of the child node under the parent node. There can be multiple child nodes under one parent node. At this time, R1 and R2 will generate the FIB table shown in Table 5. The packets destined for the destination prefix 2001:0db8:3c4d:1000:: / 64 will be forwarded to subnet 1 through R1 first, and the packets destined for the destination prefix 2001:0db8:3c4d:1001:: / 64 will be forwarded to subnet 1 through R2 first. At this time, the network can still achieve load balancing of subnet downstream traffic.

[0087] Table 5 FIB table of R1 and R2

[0088]

[0089] Similarly, for the same reason as in the first case, directly using strict uRPF will result in the problem of mis-filtering. After adopting the embodiment of the present invention, R1 will generate a complete source prefix whitelist based on RIB information on the UNI interface (i.e., R1-1), and the whitelist will include 2001:0db8:3c4d:1000:: / 63 and 2001:0db8:3c4d:1000:: / 64 at the same time. Similarly, R2 will generate a complete source prefix whitelist based on RIB information on the UNI interface (i.e., R2-1), and the whitelist will include 2001:0db8:3c4d:1000:: / 63 and 2001:0db8:3c4d:1001:: / 64 at the same time. The source address verification rules of R1 and R2 are shown in Table 6. At this time, the message whose source address belongs to this address space sent by the user subnet will not be intercepted by R1-1 or R1-2, thereby avoiding the problem of mis-filtering.

[0090] Table 6 Source address verification rules for R1 and R2 (SVA table)

[0091] interface Source prefix whitelist R1-1 2001:0db8:3c4d:1000:: / 63, 2001:0db8:3c4d:1000:: / 64 R2-1 2001:0db8:3c4d:1000:: / 63, 2001:0db8:3c4d:1001:: / 64

[0092] Compared with the prior art, the first routing configuration method disclosed in the present invention, in the scenario of multi-homing access of user subnets, the subnet announces the routing prefix on the network device, so that the network device generates the corresponding source address verification rules after receiving the announcement information, which can achieve accurate protection for more scenarios such as asymmetric routing, multi-homing asymmetric access of users in the domain, and traffic detour, and avoid the problem of mis-filtering legitimate traffic. In addition, compared with the existing loose uRPF and strict uRPF technologies, it can solve the false negative and false positive problems caused by the uRPF solution. Compared with the static access control list technology based on SAV in the prior art, it does not require continuous manual operation and maintenance investment, and can achieve adaptive protection and application in large-scale networks. Compared with the source address verification technology using real detection of BGP messages, the routing announcement / configuration process is simple and fast, saving additional message overhead and complex path calculation overhead, and reducing latency.

[0093] See also Figure 7 , Figure 7 is a flow chart of a second routing configuration method provided by an embodiment of the present invention. The second routing configuration method is implemented by a network device. The second routing configuration method includes:

[0094] S21, receiving the routing announcement sent by the subnet;

[0095] S22. Generate a corresponding source address verification rule according to the routing announcement; wherein the routing announcement includes at least one of the following information:

[0096] At least two routing prefixes and their corresponding priority indication information;

[0097] At least one child route prefix and its parent route prefix.

[0098] Specifically, the source address verification rule includes a source prefix whitelist and interface information.

[0099] Specifically, the interface information is the user network interface of the network device.

[0100] Specifically, when the subnet accesses at least one network device through an internal border gateway protocol, the priority indication information is a local priority value.

[0101] Specifically, when the subnet accesses at least one network device through an external border gateway protocol, the priority indication information is a multi-exit distinction value.

[0102] Specifically, for different network devices, the priority indication information corresponding to the same routing prefix announced by the subnet is different.

[0103] It is worth noting that the working process of the second routing configuration method described in the embodiment of the present invention can refer to the working process of the first routing configuration method described in the above embodiment, and will not be repeated here.

[0104] See also Figure 8 , Figure 8 : is a flowchart of a third routing configuration method provided by an embodiment of the present invention. The third routing configuration method is implemented by a network device, and the method includes:

[0105] S31, receiving routing configuration information, wherein the routing configuration information includes a routing prefix and interface information;

[0106] S32. Update source address verification rules or add corresponding static routes according to the routing configuration information.

[0107] It is worth noting that the routing configuration information can be sent by the user through the human-computer interaction interface. After the network device receives the routing configuration information, there are two routing configuration methods: one is to update the source address verification rule according to the routing configuration information, and the other is to add the corresponding static route according to the routing configuration information. Fig. 9 Take this as an example to illustrate: Fig. 9 This is the third schematic diagram of subnet routing announcement provided by an embodiment of the present invention. If the routing prefixes announced by subnet 1 to R1 and R2 are asymmetric, such as the routing prefix announced by subnet 1 to R1 is: 2001:0db8:3c4d:1000:: / 64, and the routing prefix announced by subnet 1 to R2 is: 2001:0db8:3c4d:1001:: / 64, then R1 cannot obtain the complete prefix information on interface R1-1 (that is, it does not include these two routing prefixes at the same time), and R2 cannot obtain the complete prefix information on interface R2-1, and therefore cannot generate a complete source prefix whitelist.

[0108] In the first implementation, static SAV rules are configured, that is, source address verification rules are updated according to the routing configuration information, such as Fig. 9As shown in the figure, using the SAVNET solution, R1 generates a source prefix whitelist on interface R1-1 based on the announcement information of subnet 1, which only includes 2001:0db8:3c4d:1000:: / 64. At this time, the routing prefix 2001:0db8:3c4d:1001:: / 64 can be configured to the source prefix whitelist of R1 on interface R1-1 by sending routing configuration information. Finally, the source prefix whitelist of R1 on interface R1-1 will include two routing prefixes: 2001:0db8:3c4d:1000:: / 64 and 2001:0db8:3c4d:1001:: / 64. Similarly, the source prefix whitelist generated by R2 on interface R2-1 only includes 2001:0db8:3c4d:1001:: / 64. At this time, the routing prefix 2001:0db8:3c4d:1000:: / 64 can be configured to the source prefix whitelist of R2 on interface R2-1 by sending routing configuration information. Finally, the source prefix whitelist of R2 on interface R2-1 will include two routing prefixes: 2001:0db8:3c4d:1000:: / 64 and 2001:0db8:3c4d:1001:: / 64. The packets sent by subnet 1 whose source addresses belong to these two address spaces will not be intercepted by R1-1 or R2-1 interfaces, thus avoiding the problem of mis-filtering.

[0109] Specifically, the source address verification rule includes a source prefix whitelist and interface information. The updated source prefix whitelists of R1 and R2 can refer to Table 3. The interface information is the user network interface of the network device, that is, Figure 5 R1-1 and R2-1 in.

[0110] Table 7 Updated source prefix whitelist for R1 and R2

[0111] interface Source prefix whitelist R1-1 2001:0db8:3c4d:1000:: / 64, 2001:0db8:3c4d:1001:: / 64 R2-1 2001:0db8:3c4d:1000:: / 64, 2001:0db8:3c4d:1001:: / 64

[0112] Specifically, when the source address verification rule is updated according to the routing configuration information, the routing configuration information further includes priority indication information of the routing prefix.

[0113] Exemplarily, the priorities of 2001:0db8:3c4d:1000:: / 64 and 2001:0db8:3c4d:1001:: / 64 are added to the routing configuration information, such as configuring the high priority routing prefix 2001:0db8:3c4d:1000:: / 64 to the network device R1, and configuring the low priority routing prefix 2001:0db8:3c4d:1001:: / 64. In addition, configuring the high priority routing prefix 2001:0db8:3c4d:1001:: / 64 to the network device R2, and configuring the low priority routing prefix 2001:0db8:3c4d:1001:: / 64. Packets destined for the destination prefix 2001:0db8:3c4d:1000:: / 64 will be forwarded to subnet 1 through R1 first, and packets destined for the destination prefix 2001:0db8:3c4d:1001:: / 64 will be forwarded to subnet 1 through R2 first, thus achieving load balancing of the downstream traffic of subnet 1.

[0114] Specifically, the routing prefix includes a sub-routing prefix and its corresponding parent routing prefix.

[0115] Exemplarily, the sub-routing prefix and its corresponding parent-routing prefix are added to the routing configuration information. For example, the sub-routing prefix 2001:0db8:3c4d:1000:: / 64 is configured for the network device R1, and the parent-routing prefix 2001:0db8:3c4d:1000:: / 63 of the sub-routing prefix is ​​configured at the same time; in addition, the sub-routing prefix 2001:0db8:3c4d:1001:: / 64 is configured for the network device R2, and the parent-routing prefix 2001:0db8:3c4d:1000:: / 63 of the sub-routing prefix is ​​configured at the same time. The load balancing of the downstream traffic of subnet 1 can also be achieved.

[0116] In a second implementation manner, a static backup route is configured, that is, a corresponding static route is added according to the route configuration information. In this case, the route configuration information further includes one of the following priority configuration information:

[0117] The priority of the static route is lower than the priority of the dynamic route of the network device;

[0118] The management distance of the static route is greater than the management distance of the dynamic route of the network device.

[0119] For example, a static route with a next hop of interface R1-1 and a route prefix of 2001:0db8:3c4d:1001:: / 64 is configured on R1. The priority of the static route is lower than the dynamic route 2001:0db8:3c4d:1001:: / 64 learned from network R3, or the administrative distance (AD) of the static route is greater than the dynamic route. The greater the administrative distance, the lower the trust and the lower the priority. That is, the configured static route cannot affect the original dynamic route, so a lower priority needs to be set. Using the above SAVNET solution, the source prefix whitelist of R1 on interface R1-1 and R2 on interface R2-1 will eventually include both 2001:0db8:3c4d:1000:: / 64 and 2001:0db8:3c4d:1001:: / 64. The messages sent by the user subnet whose source addresses belong to this address space will not be intercepted by R1-1 or R2-1, thus avoiding the problem of mis-filtering.

[0120] Furthermore, when configuring static routing, you can also configure the sub-routing prefix and its parent routing prefix, and you also need to set the priority of the sub-routing prefix and its parent routing prefix lower than the dynamic routing, or the management distance of the sub-routing prefix and its parent routing prefix is ​​greater than the management distance of the dynamic routing.

[0121] Compared with the prior art, the routing configuration method disclosed in the present invention directly configures the routing prefix on the network device in the scenario of multi-homing access of the user subnet, so that the network device updates the source address verification rule or adds the corresponding static route after receiving the routing configuration information, which can realize accurate protection of more scenarios such as asymmetric routing, multi-homing asymmetric access of users in the domain, and traffic detour, and avoid the problem of mis-filtering legitimate traffic. In addition, compared with the existing loose uRPF and strict uRPF technologies, it can solve the false negative and false positive problems caused by the uRPF solution. Compared with the static access control list technology based on SAV in the prior art, it does not require continuous manual operation and maintenance investment, and can realize adaptive protection and application in large-scale networks. Compared with the source address verification technology using real detection of BGP messages, the routing declaration / configuration process is simple and fast, saving additional message overhead and complex path calculation overhead, and reducing latency.

[0122] See also Fig.10 , Fig.10 1 is a structural block diagram of a first routing configuration device 100 provided in an embodiment of the present invention. The routing configuration device 100 is applied to a subnet, and the routing configuration includes:

[0123] The routing announcement sending module 11 is used to send a routing announcement to at least one network device; wherein the routing announcement is used to instruct the network device to generate a corresponding source address verification rule, and the routing announcement includes at least one of the following information:

[0124] At least two routing prefixes and their corresponding priority indication information;

[0125] At least one child route prefix and its parent route prefix.

[0126] Specifically, when the subnet accesses at least one network device through an internal border gateway protocol, the priority indication information is a local priority value.

[0127] Specifically, when the subnet accesses at least one network device through an external border gateway protocol, the priority indication information is a multi-exit distinction value.

[0128] Specifically, for different network devices, the priority indication information corresponding to the same routing prefix announced by the subnet is different.

[0129] Specifically, the source address verification rule includes a source prefix whitelist and interface information.

[0130] Specifically, the interface information is the user network interface of the network device.

[0131] It is worth noting that the working process of each module in the routing configuration device 100 described in the embodiment of the present invention can refer to the working process of the first routing configuration method described in the above embodiment, and will not be repeated here.

[0132] See also Fig.11 , Fig.11 : is a structural block diagram of a second routing configuration device 200 provided in an embodiment of the present invention. The routing configuration device 200 is applied to a network device, and the routing configuration device 200 includes:

[0133] A routing announcement receiving module 21, used for receiving a routing announcement sent by a subnet;

[0134] The routing configuration module 22 is used to generate a corresponding source address verification rule according to the routing announcement; wherein the routing announcement includes at least one of the following information:

[0135] At least two routing prefixes and their corresponding priority indication information;

[0136] At least one child route prefix and its parent route prefix.

[0137] Specifically, when the subnet accesses at least one network device through an internal border gateway protocol, the priority indication information is a local priority value.

[0138] Specifically, when the subnet accesses at least one network device through an external border gateway protocol, the priority indication information is a multi-exit distinction value.

[0139] Specifically, for different network devices, the priority indication information corresponding to the same routing prefix announced by the subnet is different.

[0140] Specifically, the source address verification rule includes a source prefix whitelist and interface information.

[0141] Specifically, the interface information is the user network interface of the network device.

[0142] It is worth noting that the working process of each module in the routing configuration device 200 described in the embodiment of the present invention can refer to the working process of the second routing configuration method described in the above embodiment, and will not be repeated here.

[0143] See also Fig.12 , Fig.12 : is a structural block diagram of a third routing configuration device 300 provided in an embodiment of the present invention. The routing configuration device 300 is applied to a network device, and the routing configuration device 300 includes:

[0144] The routing configuration information receiving module 31 is used to receive routing configuration information, wherein the routing configuration information includes a routing prefix and interface information;

[0145] The routing configuration module 32 is used to update the source address verification rule or add a corresponding static route according to the routing configuration information.

[0146] Specifically, the routing prefix includes a sub-routing prefix and its corresponding parent routing prefix.

[0147] Specifically, the routing configuration information also includes priority indication information of the routing prefix.

[0148] Specifically, the routing configuration information also includes one of the following priority configuration information:

[0149] The priority of the static route is lower than the priority of the dynamic route of the network device;

[0150] The management distance of the static route is greater than the management distance of the dynamic route of the network device.

[0151] Specifically, the source address verification rule includes a source prefix whitelist and interface information.

[0152] Specifically, the interface information is the user network interface of the network device.

[0153] It is worth noting that the working process of each module in the routing configuration device 300 described in the embodiment of the present invention can refer to the working process of the third routing configuration method described in the above embodiment, and will not be repeated here.

[0154] See also Fig.13 , Fig.13 4 is a structural block diagram of a routing configuration device 400 provided in an embodiment of the present invention, wherein the routing configuration device 400 includes a processor 41, a memory 42, and a computer program stored in the memory 42 and executable on the processor 41. When the processor 41 executes the computer program, the steps in the above-mentioned various routing configuration method embodiments are implemented.

[0155] Exemplarily, the computer program may be divided into one or more modules / units, which are stored in the memory 42 and executed by the processor 41 to implement the present invention. The one or more modules / units may be a series of computer program instruction segments capable of implementing specific functions, which are used to describe the execution process of the computer program in the routing configuration device 400.

[0156] The routing configuration device 400 may include, but is not limited to, a processor 41 and a memory 42. Those skilled in the art will appreciate that the schematic diagram is merely an example of the routing configuration device 400 and does not constitute a limitation on the routing configuration device 400. The routing configuration device 400 may include more or fewer components than shown in the diagram, or may combine certain components, or different components. For example, the routing configuration device 400 may also include input and output devices, network access devices, buses, and the like.

[0157] The processor 41 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc. The processor 41 is the control center of the routing configuration device 400, and uses various interfaces and lines to connect various parts of the entire routing configuration device 400.

[0158] The memory 42 can be used to store the computer program and / or module. The processor 41 implements various functions of the routing configuration device 400 by running or executing the computer program and / or module stored in the memory 42 and calling the data stored in the memory 42. The memory 42 can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area can store data created according to the use of the mobile phone (such as audio data, a phone book, etc.), etc. In addition, the memory 42 can include a high-speed random access memory, and can also include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (SecureDigital, SD) card, a flash card (Flash Card), at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0159] Wherein, if the module / unit integrated in the routing configuration device 400 is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on such an understanding, the present invention implements all or part of the processes in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium. When the computer program is executed by the processor 41, the steps of the above-mentioned various method embodiments can be implemented. Wherein, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium can include: any entity or device capable of carrying the computer program code, recording medium, U disk, mobile hard disk, disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electrical carrier signal, telecommunication signal and software distribution medium, etc.

[0160] The above is a preferred embodiment of the present invention. It should be pointed out that a person skilled in the art can make several improvements and modifications without departing from the principle of the present invention. These improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A routing configuration method, characterized in that: Applied to a subnet, the method comprises: Sending a routing announcement to at least one network device; wherein the routing announcement is used to instruct the network device to generate a corresponding source address verification rule, and the routing announcement includes at least one of the following information: At least two routing prefixes and their corresponding priority indication information; At least one child route prefix and its parent route prefix.

2. The routing configuration method according to claim 1, characterized in that: When the subnet accesses at least one network device via an internal border gateway protocol, the priority indication information is a local priority value.

3. The routing configuration method according to claim 1, characterized in that: When the subnet accesses at least one network device through an external border gateway protocol, the priority indication information is a multi-exit distinction value.

4. The routing configuration method according to any one of claims 1 to 3, characterized in that: For different network devices, the priority indication information corresponding to the same routing prefix announced by the subnet is different.

5. The routing configuration method according to claim 1, characterized in that: The source address verification rule includes a source prefix whitelist and interface information.

6. The routing configuration method according to claim 5, characterized in that: The interface information is the user network interface of the network device.

7. A routing configuration method, characterized in that: Applied to a network device, the method comprises: Receive routing announcements sent by the subnet; Generate a corresponding source address verification rule according to the routing announcement; wherein the routing announcement includes at least one of the following information: At least two routing prefixes and their corresponding priority indication information; At least one child route prefix and its parent route prefix.

8. The routing configuration method according to claim 7, characterized in that: The source address verification rule includes a source prefix whitelist and interface information.

9. The routing configuration method according to claim 8, characterized in that: The interface information is the user network interface of the network device.

10. A routing configuration method, characterized in that: Applied to a network device, the method comprises: Receiving routing configuration information, wherein the routing configuration information includes a routing prefix and interface information; Update the source address verification rules or add corresponding static routes according to the routing configuration information.

11. The routing configuration method according to claim 10, characterized in that: The routing prefix includes a sub-routing prefix and its corresponding parent routing prefix.

12. The routing configuration method according to claim 10, characterized in that: The routing configuration information also includes priority indication information of the routing prefix.

13. The routing configuration method according to claim 10, characterized in that: The routing configuration information also includes one of the following priority configuration information: The priority of the static route is lower than the priority of the dynamic route of the network device; The management distance of the static route is greater than the management distance of the dynamic route of the network device.

14. The routing configuration method according to claim 10, characterized in that: The source address verification rule includes a source prefix whitelist and interface information.

15. The routing configuration method according to claim 14, characterized in that: The interface information is the user network interface of the network device.

16. A routing configuration device, characterized in that: Applied to a subnet, the device comprises: A routing announcement sending module, used to send a routing announcement to at least one network device; wherein the routing announcement is used to instruct the network device to generate a corresponding source address verification rule, and the routing announcement includes at least one of the following information: At least two routing prefixes and their corresponding priority indication information; At least one child route prefix and its parent route prefix.

17. A routing configuration device, characterized in that: Applied to network equipment, the device comprises: A routing announcement receiving module, used for receiving routing announcements sent by a subnet; A routing configuration module, configured to generate a corresponding source address verification rule according to the routing announcement; wherein the routing announcement includes at least one of the following information: At least two routing prefixes and their corresponding priority indication information; At least one child route prefix and its parent route prefix.

18. A routing configuration device, characterized in that: Applied to network equipment, the device comprises: A routing configuration information receiving module, used to receive routing configuration information, wherein the routing configuration information includes a routing prefix and interface information; The routing configuration module is used to update the source address verification rules or add corresponding static routes according to the routing configuration information.

19. A routing configuration device, characterized in that: The method comprises a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor implements the routing configuration method according to any one of claims 1 to 15 when executing the computer program.

20. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored computer program, wherein when the computer program is executed, the device where the computer-readable storage medium is located is controlled to execute the routing configuration method according to any one of claims 1 to 15.

21. A computer program product, characterized in that The method comprises computer instructions, which, when executed by a processor, implement the routing configuration method according to any one of claims 1 to 15.

Images