NAT (Network Address Translation) policy configuration management method based on DPU (Data Processing Unit) and network equipment
By judging the IP address type in the CPU chip system and splitting the address range, the problem of TCAM resource occupation during NAT policy matching is solved, and more efficient NAT policy configuration management is achieved, and the capacity of NAT policy is increased.
Patent Information
- Application Number
- CN202411297451.6
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-18
- Publication Date
- 2024-12-20
AI Technical Summary
In the prior art, when the IP address parameter matched by the NAT policy is an address range, it occupies TCAM resources seriously, resulting in a significant reduction in the number of NAT policies in the IP address range that the TCAM engine can accommodate in the DPU.
In the policy configuration management subsystem of the CPU chip system, determine the IP address parameter type. If it is a range address, multiple subnet addresses are calculated to cover the configured IP address range, and split the NAT policy into multiple policies. Sent to the TCAM subsystem and convert it into a subnet address form with a mask length of 32 to reduce the TCAM resource usage.
Through algorithm optimization, the TCAM resource occupied by a NAT policy is reduced, the quota of the NAT policy is increased, and the packet forwarding performance is improved.
Smart Images
Figure CN119172353A_ABST
Abstract
Description
Technical Field
[0001] The present invention belongs to the field of communication technology, and in particular relates to a NAT policy configuration management method and network equipment based on DPU. Background Art
[0002] The performance requirements for packet forwarding on the core firewall of the communication network are getting higher and higher. It is difficult to achieve forwarding performance of 100G or even 1T level by simply using software forwarding models.
[0003] As a new generation of processors for data-centric computing, the DPU (Data Processing Unit) chip has become the standard hardware acceleration engine for forwarding messages in high-end firewalls.
[0004] TCAM (ternary content addressable memory) serves as the matching acceleration engine of the DPU chip to accelerate the matching of NAT policies.
[0005] like Figure 1 As shown in the figure, a typical network device architecture diagram based on DPU chip using TCAM to accelerate packet forwarding is provided: the CPU running software constitutes the control plane, and the DPU's packet processing engine (NP) and TCAM engine together constitute the data plane. The control plane sends forwarding-related table entries to the DPU (sends NAT policy to the DPU's TCAM engine). When the message enters the DPU, it is processed by the message processing engine (NP). This involves matching the NAT policy. The DPU passes the searched key to the TCAM engine, completes the NAT conversion based on the result returned by the TCAM engine, and then forwards the message.
[0006] When the current CPU management plane sends a NAT policy to the TCAM of the DPU, if the matching IP address parameter in the NAT policy is an address range, the management plane will split the address in the IP address parameter of the NAT policy into multiple NAT policies with a subnet address with a mask length of 32 (that is, if the address range size is 90, it will be split into 90 NAT policies).
[0007] If the addresses in the IP address range are simply traversed and split into subnet addresses with a mask length of 32, the number of NAT policies with IP address ranges that can be accommodated by the TCAM engine in the DPU will be greatly reduced. Summary of the invention
[0008] 1. Technical issues to be resolved
[0009] The technical problem to be solved by the present invention is how to provide a DPU-based NAT policy configuration management method and network device to solve the technical problem in the prior art that TCAM resources are seriously occupied when the IP address parameter matched by the NAT policy is an address range.
[0010] (II) Technical solution
[0011] In order to solve the above technical problems, the present invention proposes a NAT policy configuration management method based on DPU, which includes the following steps:
[0012] S1. Initialize the CPU chip system and DPU chip system when the network device starts;
[0013] S2. When the network device is started, the user configures NAT policy information for the TCMA subsystem of the DPU chip system through the policy configuration management subsystem of the CPU chip system according to the needs; the TCAM subsystem stores the NAT policy information;
[0014] S3. After receiving the NAT policy configured by the user, the policy configuration management subsystem first obtains the matching IP address parameter corresponding to the NAT policy, and then determines whether the obtained IP address parameter is a host address, a subnet address, or a range address;
[0015] S4. If it is a host address, it is directly converted into a subnet address with a mask length of 32 and sent to the TCAM subsystem. If it is a subnet address, it is directly sent to the TCAM subsystem. If it is a range address, multiple subnet addresses are calculated to cover the configured IP address range, and then the NAT policy is split into multiple policies according to the calculated subnet address and sent to the TCAM subsystem.
[0016] The present invention provides a DPU-based NAT policy configuration management network device, the network device comprising: a CPU chip system and a DPU chip system; wherein the CPU chip system comprises a policy configuration management subsystem; the DPU chip system comprises an NP subsystem and a TCAM subsystem;
[0017] Policy configuration management subsystem: used to convert the configured NAT policy into a prefix form that can be stored by the TCAM subsystem, and buffer the configured NAT policy in the CPU chip system; also used to obtain the matching IP address parameters corresponding to the NAT policy after receiving the NAT policy configured by the user, and then determine whether the obtained IP address parameter is a host address, a subnet address, or a range address;
[0018] If it is a host address, it is directly converted into a subnet address with a mask length of 32 and sent to the TCAM subsystem. If it is a subnet address, it is directly sent to the TCAM subsystem. If it is a range address, multiple subnet addresses are calculated to cover the configured IP address range, and then the NAT policy is split into multiple policies based on the calculated subnet addresses and sent to the TCAM subsystem.
[0019] NP subsystem: used to parse, edit and forward data packets;
[0020] TCAM subsystem: used to store NAT policy information and perform exact match and fuzzy match searches through masks.
[0021] (III) Beneficial effects
[0022] The present invention proposes a DPU-based NAT policy configuration management method and network device, and the beneficial effects of the present invention are as follows: In the current technology of configuring NAT policy for a TCAM acceleration matching engine based on a DPU, the original NAT policy based on an address range is converted into multiple subnet addresses with a mask length of 32 bits (i.e., the address range is converted into as many TCAM NAT policy entries as possible) through an algorithm optimization into multiple subnet addresses with a mask length as small as possible. In this way, the TCAM resources occupied by a NAT policy can be greatly reduced, thereby increasing the quota of the NAT policy. BRIEF DESCRIPTION OF THE DRAWINGS
[0023] Figure 1 This is a diagram of a network device architecture based on a DPU chip using TCAM to accelerate message forwarding in the prior art;
[0024] Figure 2 It is a flow chart of the present invention. DETAILED DESCRIPTION
[0025] In order to make the purpose, content and advantages of the present invention more clear, the specific implementation methods of the present invention are further described in detail below in conjunction with the drawings and examples.
[0026] The present invention aims to improve the prior art in which TCAM resources are occupied when the IP address parameter matched by the NAT policy is an address range. In view of the shortcomings of the prior art, the present invention provides a method and network device for configuring a NAT policy in the form of multiple subnet addresses when the IP address parameter matched in the NAT policy is an IP address range and is converted to a DPU.
[0027] The network device at least includes: a CPU chip system and a DPU chip system, wherein the CPU chip system includes at least a policy configuration management subsystem; the DPU chip system includes at least an NP subsystem and a TCAM subsystem.
[0028] Policy configuration management subsystem: used to convert the configured NAT policy into a prefix format that can be stored by the TCAM subsystem, and buffer the configured NAT policy in the CPU chip system;
[0029] NP subsystem: used to parse, edit and forward data packets.
[0030] TCAM subsystem: used for exact match lookup and fuzzy match lookup through masks.
[0031] Figure 1 The arrow of IN indicates the path of the message entering the device; the arrow of OUT indicates the path of the message forwarding; the arrow of key indicates that the NP subsystem obtains the matching information by parsing the message and sends it to the TCAM subsystem for policy matching; the arrow of result indicates the processing result returned to the NP subsystem by the TCAM subsystem after matching; the arrow of set indicates the operation of the user operating the policy through the policy configuration management subsystem (such as adding, deleting, modifying, and checking the policy); the arrow of get indicates the set result returned by the TCAM subsystem to the policy configuration management subsystem after the set.
[0032] The DPU-based NAT policy configuration management method of the present invention comprises the following steps:
[0033] S1. Initialize the CPU chip system and the DPU chip system when the network device starts.
[0034] S2. When the network device is started, the user configures NAT policy information for the TCMA subsystem of the DPU chip system through the policy configuration management subsystem of the CPU chip system according to the needs. The TCAM subsystem stores the NAT policy information.
[0035] S3. After receiving the NAT policy configured by the user, the policy configuration management subsystem first obtains the matching IP address parameters corresponding to the NAT policy, and then determines whether the obtained IP address parameters are host addresses, subnet addresses, or range addresses.
[0036] S4, if it is a host address, it is directly converted into a subnet address with a mask length of 32 and sent to the TCAM subsystem. If it is a subnet address, it is directly sent to the TCAM subsystem. If it is a range address, multiple subnet addresses are calculated by this algorithm to cover the configured IP address range, and then the NAT policy is split into multiple policies according to the calculated subnet addresses and sent to the TCAM subsystem. For details, refer to Figure 2 The processing flow.
[0037] The specific algorithm for converting multiple subnet addresses to cover the configured IP address range is as follows:
[0038] Step 1: Calculate the range size of the IP address range according to the start address start_ip and end address end_ip configured by the user;
[0039] range_size = ntohl(end_ip)-ntohl(start_ip)+1; (Note that end_ip and start_ip are in network byte order and need to be converted to host byte order).
[0040] Step 2: Convert the starting address start_ip to the host byte order tmp_ip.
[0041] tmp_ip=ntohl(start_ip).
[0042] Step 3: Calculate the number of consecutive non-zero bits of tmp_ip from right to left. The calculated number of bits is mask_bit_num.
[0043] Step 4: Then calculate the number of addresses that can be represented, mask_ip_num, based on mask_bit_num.
[0044] mask_ip_num=pow(2,mask_bit_num).
[0045] Note: The function of pow is to calculate the power function of a number.
[0046] Step 5: Compare the sizes of mask_ip_num and range_size;
[0047] If mask_ip_num and range_size are equal, start_ip / 32-mask_ip_num becomes the last subnet address of the conversion, and the algorithm conversion ends;
[0048] If mask_ip_num is greater than range_size, then reduce mask_bit_num by 1 and proceed to step 4;
[0049] If mask_ip_num is less than range_size, then ntohl(tmp_ip) / 32-mask_ip_num becomes a subnet address after the address range conversion. At the same time, range_size becomes the original size minus mask_ip_num, that is, range_size = range_size-mask_ip_num. tmp_ip also needs to increase mask_ip_num as the starting address of the new subnet address, that is
[0050] tmp_ip=tmp_ip+mask_ip_num. Then continue to execute the third step.
[0051] Embodiment 1:
[0052] 1. Initialize the CPU chip system and DPU chip system when the network device starts.
[0053] 2. After the device is started, the user configures three NAT policies for the device according to needs: nat_policyA, nat_policyB, and nat_policyC.
[0054] 3. The matching IP address parameter configured for policy nat_policyA is the host IP address 192.168.11.2, the matching IP address parameter configured for policy nat_policyB is the subnet IP address: 192.168.12.0 / 24, and the matching IP address parameter configured for policy nat_policyC is the IP address range: 192.168.13.10~192.168.13.100.
[0055] 4. After receiving the three NAT policies configured by the user, the policy configuration management subsystem first determines the matching IP address parameter type of the NAT policy;
[0056] Since the matching IP address parameter type of nat_policyA is the host address, the policy configuration management subsystem converts the IP address into a table entry in the mask format of 192.168.11.2 / 32 and sends it to the TCAM of the DPU chip system for storage for message matching;
[0057] Since the matching IP address parameter type of nat_policyB is a subnet address, the policy configuration management subsystem does not need to do any conversion and directly uses the TCAM sent to the DPU chip system under the 192.168.12.0 / 24 table entry to store it for message matching;
[0058] Since the matching IP address parameter type of nat_policyC is a range address, it is necessary to convert it into 192.168.13.10 / 31, 192.168.13.12 / 30, 192.168.13.16 / 28, 192.168.13.32 / 27, 192.168.13.64 / 27, 192.168.13.96 / 30, and 192.168.13.100 / 32 subnet addresses according to the algorithm provided by this patent, and split the nat_policyC policy into 7 entries (instead of 91 entries) and send them to the TCAM of the DPU chip system for storage for message matching.
[0059] 5. When the message enters the DPU chip system, the NP subsystem will parse the IP address of the message and send it to the TCAM in the form of a key for NAT policy matching. The key will match the NAT policy table entry stored in the TCAM subsystem. If the match is successful, the NAT-converted IP address will be returned to the NP subsystem for the NP subsystem to edit the IP address of the message and complete the forwarding. At the same time, the number of successful matches will be recorded in the TCAM table entry. If the match fails, an empty address is returned to indicate that the message does not require NAT conversion and the message forwarding can continue.
[0060] 6. When the user needs to view the match count information of the NAT policy, the policy configuration management subsystem will send a request message to the TCAM subsystem of the DPU through the set path. The TCAM subsystem will return the number of successful matches recorded in step 5 to the policy configuration management subsystem through the get path and then display it to the user.
[0061] The key technical points involved in this application are as follows:
[0062] The original NAT policy based on address segments is converted into multiple policies with a subnet address with a mask length of 32 bits (that is, the address range is converted into as many TCAM NAT policy table entries as possible). The policy is optimized through an algorithm into multiple subnet addresses with a mask length as small as possible, and then sent to the TCAM acceleration engine of the DPU chip.
[0063] The beneficial effects of the present invention are as follows: In the current technology of configuring NAT policies for TCAM acceleration matching engines based on DPU, the original NAT policies based on address ranges are converted into multiple subnet addresses with a mask length of 32 bits (i.e., the address range is converted into as many TCAM NAT policy entries as possible) through an algorithm optimization into multiple subnet addresses with a mask length as small as possible. This can greatly reduce the TCAM resources occupied by a NAT policy, thereby increasing the quota of the NAT policy.
[0064] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.
Claims
1. A NAT policy configuration management method based on DPU, characterized in that: The method comprises the following steps: S1. Initialize the CPU chip system and DPU chip system when the network device starts; S2. When the network device is started, the user configures NAT policy information for the TCMA subsystem of the DPU chip system through the policy configuration management subsystem of the CPU chip system according to the needs; the TCAM subsystem stores the NAT policy information; S3. After receiving the NAT policy configured by the user, the policy configuration management subsystem first obtains the matching IP address parameter corresponding to the NAT policy, and then determines whether the obtained IP address parameter is a host address, a subnet address, or a range address; S4. If it is a host address, it is directly converted into a subnet address with a mask length of 32 and sent to the TCAM subsystem. If it is a subnet address, it is directly sent to the TCAM subsystem. If it is a range address, multiple subnet addresses are calculated to cover the configured IP address range, and then the NAT policy is split into multiple policies according to the calculated subnet address and sent to the TCAM subsystem.
2. The DPU-based NAT policy configuration management method according to claim 1, characterized in that: If it is a range address, calculating multiple subnet addresses to cover the configured IP address range specifically includes the following steps: Step 1: Calculate the range size of the IP address range according to the start address start_ip and end address end_ip configured by the user; Step 2: Convert the starting address start_ip to the host byte order tmp_ip; Step 3: Calculate the number of consecutive non-zero bits of tmp_ip from right to left. The calculated number of bits is mask_bit_num; Step 4: Then calculate the number of addresses that can be represented, mask_ip_num, based on mask_bit_num; Step 5: Compare the sizes of mask_ip_num and range_size; If mask_ip_num and range_size are equal, start_ip / 32-mask_ip_num becomes the last subnet address of the conversion, and the conversion ends; If mask_ip_num is greater than range_size, then reduce mask_bit_num by 1 and proceed to step 4; If mask_ip_num is less than range_size, then ntohl(tmp_ip) / 32-mask_ip_num becomes a subnet address after the address range conversion; at the same time, the range_size size becomes the original size minus mask_ip_num, that is, range_size = range_size-mask_ip_num; tmp_ip also needs to increase mask_ip_num as the starting address of the new subnet address, that is, tmp_ip = tmp_ip + mask_ip_num; then continue to the third step.
3. The DPU-based NAT policy configuration management method according to claim 2, characterized in that: In the first step, range_size=ntohl(end_ip)-ntohl(start_ip)+1.
4. The DPU-based NAT policy configuration management method according to claim 3, characterized in that: end_ip and start_ip are in network byte order and need to be converted to host byte order.
5. The DPU-based NAT policy configuration management method according to claim 2, characterized in that: In the second step, tmp_ip=ntohl(start_ip).
6. The DPU-based NAT policy configuration management method according to claim 2, characterized in that: In the fourth step, mask_ip_num=pow(2,mask_bit_num); pow is used to calculate the power function of a number.
7. The DPU-based NAT policy configuration management method according to claim 2, characterized in that: The CPU chip system includes a policy configuration management subsystem; the DPU chip system includes an NP subsystem and a TCAM subsystem; the policy configuration management subsystem is used to convert the configured NAT policy into a prefix form that can be stored by the TCAM subsystem, and buffer the configured NAT policy in the CPU chip system; NP subsystem: used to parse, edit and forward data packets; TCAM subsystem: used to perform exact match and fuzzy match searches through masks.
8. The DPU-based NAT policy configuration management method according to claim 7, characterized in that: When the message enters the DPU chip system, the NP subsystem will parse the IP address of the message and send it to the TCAM in the form of a key for NAT policy matching. The key will match the NAT policy table entry stored in the TCAM subsystem. If the match is successful, the NAT-converted IP address will be returned to the NP subsystem for the NP subsystem to edit the IP address of the message and complete the forwarding. At the same time, the number of successful matches will be recorded in the TCAM table entry. If the match fails, an empty address is returned to indicate that the message does not require NAT conversion and the message forwarding can continue.
9. The DPU-based NAT policy configuration management method according to claim 8, characterized in that: When the user needs to view the match count information of the NAT policy, the policy configuration management subsystem will send a request message to the TCAM subsystem of the DPU through the set path. The TCAM subsystem will return the number of successful matches recorded in the message to the policy configuration management subsystem through the get path and then display it to the user.
10. A NAT policy configuration management network device based on DPU, characterized in that: The network device includes: a CPU chip system and a DPU chip system; wherein the CPU chip system includes a policy configuration management subsystem; the DPU chip system includes an NP subsystem and a TCAM subsystem; Policy configuration management subsystem: used to convert the configured NAT policy into a prefix form that can be stored by the TCAM subsystem, and buffer the configured NAT policy in the CPU chip system; also used to obtain the matching IP address parameters corresponding to the NAT policy after receiving the NAT policy configured by the user, and then determine whether the obtained IP address parameter is a host address, a subnet address, or a range address; If it is a host address, it is directly converted into a subnet address with a mask length of 32 and sent to the TCAM subsystem. If it is a subnet address, it is directly sent to the TCAM subsystem. If it is a range address, multiple subnet addresses are calculated to cover the configured IP address range, and then the NAT policy is split into multiple policies based on the calculated subnet addresses and sent to the TCAM subsystem. NP subsystem: used to parse, edit and forward data packets; TCAM subsystem: used to store NAT policy information and perform exact match and fuzzy match searches through masks.