Transmission control method and device of VXLAN message, equipment and storage medium

Abstract

The invention discloses a VXLAN message transmission control method and device, equipment and a storage medium, and belongs to the technical field of communication, the method comprises the steps that a Flowspec route is acquired, and the Flowspec route comprises a first flow matching condition for VXLAN flow configuration and a flow control action corresponding to the first flow matching condition; based on the first flow matching condition, matching a currently received message to obtain a target VXLAN message; and determining a transmission mode of the target VXLAN message based on the flow control action. As the first flow matching condition in the Flowspec route and the flow control action corresponding to the first flow matching condition are both configured for the VXLAN flow, the identification and processing of the VXLAN message can be realized. And the limitation of the Flowspec technology on the identification and control of the VXLAN flow is broken.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a VXLAN message transmission control method, apparatus, device and storage medium. Background Art

[0002] At present, Flowspec (Flow Specification) technology is limited to traffic matching (traffic identification) and traffic action (traffic control) of IP traffic (for example, IPv4 (Internet Protocol version 4) traffic and IPv6 (Internet Protocol version 6) traffic, etc.), and cannot identify traffic other than Native IP (pure IP) traffic.

[0003] With the deepening of SDN (Software Defined Network) technology, the application of new technologies such as VXLAN (Virtual Extensible Local Area Network) will be more extensive. Since VXLAN is a network virtualization technology that establishes a logical tunnel, encapsulates the Ethernet frame of the data link layer into a UDP message, and transmits traffic in the network layer based on the VXLAN tunnel, when transmitting traffic through the VXLAN tunnel, it is necessary to encapsulate the VXLAN header and UDP (User Datagram Protocol) header for the traffic. However, Flowspec technology is limited to the identification and control of Native IP traffic, and has no identification capability for this VXLAN traffic, resulting in the inability to implement device-side traffic control for VXLAN messages through Flowspec NLRI (Network Layer Reachability Information) (hereinafter referred to as "Flowspec routing"), which greatly limits its application scenarios.

[0004] Therefore, the Flowspec technology in the related art has limitations in identifying and controlling flow. Summary of the invention

[0005] The main purpose of this application is to provide a VXLAN message transmission control method, device, equipment and storage medium, aiming to solve the technical problem that Flowspec technology has limitations in identifying and controlling traffic.

[0006] To achieve the above object, the present application provides a VXLAN message transmission control method, which is applied to a routing device and includes the following steps:

[0007] Obtain a Flowspec route, where the Flowspec route includes a first flow matching condition configured for VXLAN flow, and a flow control action corresponding to the first flow matching condition;

[0008] Based on the first traffic matching condition, matching the currently received message to obtain the target VXLAN message;

[0009] Based on the traffic control action, determine the transmission control method of the target VXLAN message.

[0010] The present application also provides a VXLAN message transmission control device, the device comprising:

[0011] A route receiving module, configured to obtain a Flowspec route, wherein the Flowspec route includes a first flow matching condition configured for VXLAN flow, and a flow control action corresponding to the first flow matching condition;

[0012] A matching module, configured to match the currently received message based on the first traffic matching condition to obtain a target VXLAN message;

[0013] A control module is used to determine a transmission mode of the target VXLAN message based on the flow control action.

[0014] The present application also provides a VXLAN message transmission control device, the device comprising: a memory, a processor, and a VXLAN message transmission control program stored in the memory and executable on the processor, the VXLAN message transmission control program being configured to implement the steps of the VXLAN message transmission control method as described in any one of the above items.

[0015] The present application also provides a storage medium, on which a transmission control program for a VXLAN message is stored. When the transmission control program for the VXLAN message is executed by a processor, the steps of the transmission control method for the VXLAN message as described in any one of the above items are implemented.

[0016] The present application provides a transmission control method for VXLAN messages. Compared with the Flowspec technology in the related art, which is limited to the identification and control of Native IP traffic, it has no identification capability for such VXLAN traffic, resulting in the inability to implement device-side traffic control for VXLAN messages through Flowspec routing, which greatly limits its application scenarios. The present application obtains Flowspec routing, and the Flowspec routing includes a first traffic matching condition configured for VXLAN traffic, and a traffic control action corresponding to the first traffic matching condition; based on the first traffic matching condition, the currently received message is matched to obtain the target VXLAN message; based on the traffic control action, the transmission mode of the target VXLAN message is determined. Since the first traffic matching condition in the Flowspec routing and the traffic control action corresponding to the first traffic matching condition are both configured for VXLAN traffic, the target VXLAN message can be identified through the first traffic matching condition in the Flowspec routing, and the processing of the VXLAN message can be realized based on the traffic control action corresponding to the first traffic matching condition. Break the limitations of Flowspec technology on the identification and control of VXLAN traffic. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 A flowchart of a first embodiment of a VXLAN message transmission control method of the present application;

[0018] Figure 2 A schematic diagram of a first scenario of a VXLAN message transmission control method according to a first embodiment of the present application;

[0019] Figure 3 A schematic diagram of a second scenario of the VXLAN message transmission control method of the first embodiment of the present application;

[0020] Figure 4 A schematic diagram of a third scenario of the VXLAN message transmission control method of the first embodiment of the present application;

[0021] Figure 5 A schematic diagram of a fourth scenario of the VXLAN message transmission control method of the first embodiment of the present application;

[0022] Figure 6 A schematic diagram of a fifth scenario of the VXLAN message transmission control method of the first embodiment of the present application;

[0023] Figure 7 A sixth scenario schematic diagram of the VXLAN message transmission control method of the second embodiment of the present application;

[0024] Figure 8It is a structural diagram of a transmission control device of a VXLAN message in a hardware operating environment involved in an embodiment of the present application;

[0025] Fig. 9 Schematic diagram of the transmission control device of the VXLAN message of the first embodiment of the present application.

[0026] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0027] It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application. Although the terms first, second, third, etc. may be used herein to describe various information, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of this article, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information.

[0028] The present application embodiment provides a VXLAN message transmission control method, referring to Figure 1 In this embodiment, the VXLAN message transmission control method includes:

[0029] Step S10: Obtain a Flowspec route, where the Flowspec route includes a first flow matching condition configured for VXLAN flow, and a flow control action corresponding to the first flow matching condition;

[0030] Step S20: Based on the first traffic matching condition, matching the currently received message to obtain a target VXLAN message;

[0031] Step S30: Based on the traffic control action, determine the transmission mode of the target VXLAN message.

[0032] As an example, the VXLAN message transmission control method is applied to a VXLAN message transmission control device, the VXLAN message transmission control device is subordinate to the VXLAN message transmission control device, the VXLAN message transmission control device may be a routing device, and the routing device may be a router.

[0033] As an example, with the deepening of SDN technology, the application of new technologies such as VXLAN will be more extensive. Since VXLAN is a network virtualization technology that establishes a logical tunnel, encapsulates the Ethernet frame of the data link layer into a UDP message, and transmits traffic in the network layer based on the VXLAN tunnel, when transmitting traffic through the VXLAN tunnel, it is necessary to encapsulate the VXLAN header and UDP header for the traffic. However, Flowspec technology is limited to the identification and control of Native IP traffic, and has no identification capability for this VXLAN traffic, resulting in the inability to implement device-side traffic control for VXLAN messages through Flowspec routing, which greatly limits its application scenarios.

[0034] Specifically, Flowspec technology is currently used for policy routing of the inbound port of the routing device. By receiving the remote Flowspec route and applying it to the corresponding port of the device, traffic match (traffic matching conditions) and traffic action (traffic control actions) are designed for the IP traffic inbound to the Global or VPN (Virtual Private Network) port, which are used for accurate identification of traffic and policy execution respectively. When the traffic enters the inbound port of the routing device, it will be matched by the traffic matching conditions of the Flowspec route. If all the matching items are matched, the traffic forwarding action will be executed according to the traffic control action of the Flowspec route; if any item does not meet the traffic matching condition requirements, the match is not matched, and the forwarding action will be executed according to the forwarding table pre-configured by the routing device.

[0035] As an example, Figure 3 As shown in the figure, the destination address (DA) of the inbound traffic of the device is 12.12.12.1 / 24, the source address (SA) is 10.10.10.1 / 24, and the DSCP (Differentiated Services Code Point) value is equal to 10; based on the forwarding table pre-configured by the routing device, the next hop is the egress port A; when the routing device receives the Flowspec route, it matches the IP traffic based on the destination address, source address and DSCP in the Flowspec route; the corresponding flow control action includes at least one of the following:

[0036] 1) Redirection: the forwarding table can be ignored and the new next hop can be selected as the egress port B specified in the Flowspec route;

[0037] 2) Remark: the DSCP value in the forwarded message can be rewritten to 20;

[0038] 3) Rate limit: You can define the upper limit of the traffic rate, the size of the data content, etc.

[0039] This embodiment aims to add a first flow matching condition configured for VXLAN flow in the Flowspec route, and a flow control action corresponding to the first flow matching condition. When a message is received, the VXLAN flow can be hit and the transmission of the message can be controlled, thereby realizing device-side flow control for the VXLAN message and enriching the application scenarios of the Flowspec technology.

[0040] The specific steps are as follows:

[0041] Step S10: Obtain a Flowspec route, where the Flowspec route includes a first flow matching condition configured for VXLAN flow, and a flow control action corresponding to the first flow matching condition;

[0042] As an example, the Flowspec route is sent to a local routing device through a Flowspec server (Flowspec server).

[0043] As an example, the Flowspec route includes a first flow matching condition configured for VXLAN flow, and a flow control action corresponding to the first flow matching condition.

[0044] As an example, the network layer reachability information includes an address family and a sub-address family. The address family is a configuration module of a network layer protocol, which is used to classify and configure different types of networks to facilitate the management of different network types.

[0045] like Figure 2The encapsulation structure of FSv2 (FSv2, Flowspec technology version 2) BGP NLRI shown in the figure encapsulates data through TLVs in the existing Flowspec Version 2 (Flowspec routing) design. TLV is a combination of Type-Length-Value, where Type indicates the type of information carried in this structure; Value indicates the information carried by TLV; Length indicates the valid byte length of the "Value" field. TLV can be a nested structure, and the nested TLV is called a sub-TLV. Each sub-TLV can be used as a traffic matching condition. The FSv2 can realize the recognition capability of IPv4, IPv6, VPNv4 (Virtual Private Network version 4) and VPNv6 (VirtualPrivate Network version 6), but has no recognition capability for VXLAN traffic.

[0046] Specifically, the definitions of the fields in the existing FSv2 BGP NLRI (Flowspec routing) are as follows: Figure 2 As shown:

[0047] 1) total-length: includes the length of all Sub-TLVs fields;

[0048] 2)order: the order of traffic matching conditions;

[0049] 3) identifier: identifier of the flow control action;

[0050] 4) type: an identifier of a Flowspec route in FSv2 TLV format.

[0051] 5)length-Subtlv: length of the Sub-TLV field;

[0052] 6) value: the value contained in the Sub-TLV.

[0053] The type field in the existing FSv2 BGP NLRI (Flowspec routing) is set as follows:

[0054] -0-reserved field;

[0055] -1-IP traffic rules: IP traffic rules (traffic matching conditions for IP traffic);

[0056] -2-L2 traffic rules: data link layer traffic rules;

[0057] -3-SFC traffic rules: service chain traffic rules;

[0058] -4-SFC VPN traffic rules: VPN service chain traffic rules;

[0059] -5-BGP / MPLS VPN IP traffic rules: BGP, MPLS (Multi-Protocol Label Switching), VPN, IP traffic rules;

[0060] -6-BGP / MPLS VPN L2 traffic rules: BGP, MPLS, VPN, L2 traffic rules.

[0061] In this embodiment, the Flowspec route further includes a route distinguisher, and the route distinguisher is used to identify VPN traffic.

[0062] As an example, the original traffic matching condition for VPN traffic is replaced by setting the route distinguisher in the existing FSv2 BGP NLRI, that is, the type field related to VPN traffic is removed, and the VPN traffic is identified by the route distinguisher.

[0063] Specifically, the type field is designed as follows in this embodiment:

[0064] -0 - reserved field,

[0065] -1-L2(Ether or VPN) traffic match;

[0066] -2-L3 (IP or VPN) traffic match: network layer traffic rules;

[0067] -3-MPLS traffic match;

[0068] -4-SRv6 traffic match: SRv6 (Segment Routing IPv6, segment routing based on IPv6 forwarding plane) traffic rules;

[0069] -5-EVPN traffic match: EVPN (Ethernet Virtual Private Network) traffic rule;

[0070] -6-VXLAN traffic match.

[0071] As an example, VXLAN traffic match is the first traffic matching condition configured for VXLAN traffic.

[0072] Step S20: Based on the first traffic matching condition, matching the currently received message to obtain a target VXLAN message;

[0073] As an example, since VXLAN is a network virtualization technology that establishes a logical tunnel, encapsulates Ethernet frames at the data link layer into UDP packets, and transmits traffic at the network layer based on the VXLAN tunnel, when transmitting traffic through the VXLAN tunnel, it is necessary to encapsulate the traffic with a VXLAN header and a UDP (User Datagram Protocol) header. This is significantly different from traditional IP packets.

[0074] In this embodiment, the matching item in the first traffic matching condition includes at least one of the following:

[0075] The destination port number field in the UDP header;

[0076] The source port number field in the UDP header;

[0077] The VXLAN network identifier field in the VXLAN header.

[0078] As an example, during the VXLAN message forwarding process, the Destination Port is encapsulated in the UDP header. Generally, the destination port number defaults to 4789. Therefore, the destination port number is preferably used as the matching condition for VXLAN traffic.

[0079] As an example, the UDP header also encapsulates the Source Port (source port number) corresponding to the Ethernet frame (data packet on the Ethernet link) calculated by the hash algorithm, which can be used as a matching condition for VXLAN traffic.

[0080] As an example, during VXLAN message forwarding, a VNI (VXLAN Network Identifier) ​​field with practical significance is encapsulated in the VXLAN header, which can be used as a matching condition for VXLAN traffic.

[0081] As an example, based on the first traffic matching condition, the currently received message is matched. If the currently received message can hit the field corresponding to at least one of the above matching items, it is determined that the message is the target VXLAN message.

[0082] As an example, in order to facilitate transmission control of the target VXLAN message, this embodiment designs a flow control action corresponding to the first flow matching condition for the VXLAN message.

[0083] In this embodiment, the traffic control action includes a redirection action, and the redirection action includes at least one of the following:

[0084] A VXLAN tunnel guiding action, used to guide the target VXLAN message to a specified VXLAN tunnel, the VXLAN tunnel being mapped with a target port of the target VXLAN message;

[0085] A destination node switching action, used to modify the destination node in the target VXLAN message to a specified destination node, the destination node being mapped with a destination port of the target VXLAN message;

[0086] The rewriting action of the VXLAN network identifier is used to modify the VXLAN network identifier of the target VXLAN message to the VXLAN network identifier corresponding to the specified target virtual machine, and the VXLAN network identifier corresponding to the target virtual machine is mapped with the target port of the target VXLAN message.

[0087] As an example, the flow control actions in the original Flowspec technology include rate-limit, remark, and redirect.

[0088] In this embodiment, the redirection action is designed only based on the characteristics of the VXLAN message.

[0089] As an example, the VXLAN tunnel steering action is: by defining a new ID-Type=6 to represent the VXLAN tunnel, and assigning the indirection-id (specified ID) to the tunnel ID of the VXLAN. That is, the routing device searches for the local VXLAN tunnel through the specified ID, and guides the target VXLAN message to the specified VXLAN tunnel, and the VXLAN tunnel is mapped with the target port of the target VXLAN message, thereby realizing the diversion and forwarding of traffic. It should be noted that the VXLAN tunnel steering action is applicable to traffic at the data link layer or the network layer, and is not applicable if the inbound traffic is tunnel encapsulated traffic, that is, MPLS, SRv6 or VXLAN encapsulated messages are not supported.

[0090] As an example, the destination node switching action is used to modify the destination node in the target VXLAN message to a specified destination node, and the destination node is mapped with the destination port of the target VXLAN message.

[0091] Specifically, VTEP (VXLAN Tunnel Endpoint) is responsible for the encapsulation and decapsulation of VXLAN messages. Each VTEP has two ports: one is the local bridge port, which is responsible for receiving and sending original Ethernet frames, and the other is the IP port, which is responsible for receiving and sending VXLAN data frames. VTEP can be a physical switch or a software switch. Traffic transmission control can be achieved by changing the switching or forwarding method of the VTEP destination address, retaining the inner UDP header and VXLAN header, and performing the destination node switching action. It should be noted that the destination node switching action is applicable to VXLAN traffic encapsulated in the outer IP layer, and is different from the redirect Nexthop (next hop address redirection) action defined in [RFC8955]. If the VTEP intermediate network adopts forwarding methods such as MPLS and SRv6, it is necessary to expand the corresponding outer forwarding header action.

[0092] As an example, the rewriting action of the VXLAN network identifier is designed for the value of the network identifier in the VXLAN header. The rewriting action of the VXLAN network identifier is used to modify the network identifier to change the behavior of the forwarding destination VTEP, and forward the inner layer message to the newly defined data link layer or network layer. It should be noted that the rewriting action of the VXLAN network identifier is applicable to VXLAN traffic.

[0093] Step S30: Based on the traffic control action, determine the transmission mode of the target VXLAN message.

[0094] As an example, after the target VXLAN message is determined, the transmission of the target VXLAN message can be controlled based on the traffic control action corresponding to the first traffic matching condition.

[0095] As an example, Figure 4As shown, the local routing information (router information) of the routing device includes: forwarding table (route-table): the next hop address (NextHop) corresponding to the traffic with the destination address (DA) of 12.12.12.1 / 24 is the directly connected address node A, and the outbound port is Int2; VXLAN tunnels (VXLAN tunnels): local IP (Local IP), remote IP (Remote IP), EVPN protocol dynamically creates Tunnel ID = 10, the forwarding table iterates the next hop outbound port to reach the directly connected address node B as Int3, and the rest of the information is omitted.

[0096] The device inbound port receives Native IP traffic: The device inbound port Int1 receives a packet with a destination address of 12.12.12.1 / 24, a source address (SA) of 10.10.10.1 / 24, and a DSCP value of 10.

[0097] Flowspec route 1 currently received from the remote Flowspec server to the local: the traffic matching condition includes Sub-TLV type = 2, and the optional matching items are destination address DA = 12.12.12.1 / 24 and DSCP = 10. The traffic control action is the VXLAN tunnel steering action, where Type-ID = 6 represents VXLAN diversion, and Indirection-id = 10 represents the selection of Tunnel ID = 10.

[0098] When the routing device does not receive the Flowspec route, the public network port Int1 of the routing device receives the Native IP traffic, and by querying the public network forwarding table of the routing device, it determines that the next hop address is node A, and then transmits the Native IP traffic from the egress port Int2 to node A.

[0099] When the routing device receives Flowspec route 1, it verifies the validity of the Flowspec route and applies it to the inbound port Int1. The inbound port of the routing device receives Native IP traffic and, based on the traffic matching conditions, hits DA = 12.12.12.1 / 24 and DSCP = 10, determines that the target VXLAN packet is hit, executes the VXLAN tunnel boot action, redirects the VXLAN tunnel to the tunnel with VXLAN Tunnel ID = 10, and the device forwarding plane queries the forwarding table to iterate the next hop port and chooses to forward the traffic to the egress port Int3 for transmission to node B.

[0100] As an example, verify the validity of the Flowspec route: first, the traffic matching condition is required to include the destination prefix of the network layer. Second, if the traffic control action includes redirect IP, the redirection destination address is required to come from the unicast BGP route published by the Flowspec server.

[0101] As an example, Figure 5 As shown, the local routing information of the routing device: the routing device port Int1 is connected to VTEP1, the routing device port Int2 is connected to VTEP2, and the routing device port Int3 is connected to VTEP3; the routing device forwarding table: the egress port to the destination address 1.1.1.1 / 32 is Int1, the egress port to the destination address 2.2.2.2 / 32 is Int2, and the egress port to the destination address 3.3.3.3 / 32 is Int3.

[0102] VTEP information: VTEP1, VTEP2, and VTEP3 have two subnets, VNI=a and VNI=b, respectively. The address of VTEP1 is 1.1.1.1, and the host address of the attached virtual machine VM1 is 11.1.1.1. VM1 belongs to the subnet of VNI=a. The host address of VM2 is 11.1.1.1, and VM2 belongs to the subnet of VNI=b. Similarly, the addresses and virtual machine deployments of VTEP2 and VTEP3 are as follows: Figure 5 shown.

[0103] VXLAN tunnel information of VTEP1: There are two VXLAN tunnels on the VTEP1 device. The Local IP of Tunnel 1 is 1.1.1.1 / 32, Remote IP is 2.2.2.2 / 32, and VNI is supported. The Local IP of Tunnel 2 is 1.1.1.1 / 32, Remote IP is 3.3.3.3 / 32, and VNI is supported.

[0104] VTEP1 receives Native IP traffic from VM1: VM1 sends an IPv4 packet with a destination address of 12.1.1.1 and a source address of the local host address 11.1.1.1, and forwards it to the network layer gateway device VTEP1 through the direct port. VTEP1 encapsulates the Native IP traffic to obtain VXLAN traffic and sends it to the routing device (router).

[0105] The routing device receives VXLAN traffic on inbound port Int1: the outer destination IP address is 2.2.2.2, the UDP encapsulation source port number is 6253, the UDP encapsulation destination port number is 4789, the VXLAN encapsulation VNI is a, and the inner IPv4 destination address is 12.1.1.1.

[0106] Flowspec route 2: The traffic matching condition includes Sub-TLV type=6, and the optional matching items are destination port number 4789 and VNI=a. The traffic control action is the destination node switching action, that is, redirecting the destination node to VTEP3 with RemoteIP=3.3.3.3.

[0107] As an example, when the routing device does not receive the Flowspec route, the routing device's public port Int1 receives VXLAN traffic, queries the local IPv4 forwarding table for the corresponding outer IP header, and transmits the traffic with the destination address 2.2.2.2 from the egress port Int2 to the next hop node VTEP2; VTEP2 completes the decapsulation of the VXLAN message and forwards the VXLAN message to the virtual machine VM3 based on VNI=a and the inner destination IP=12.1.1.1.

[0108] When the routing device receives Flowspec route 2, it verifies the validity of the Flowspec route and applies it to the inbound port Int1. The inbound port of the routing device receives VXLAN traffic, hits UDPDestination Port (destination port number) = 4789 and VNI = a based on the traffic matching conditions, executes the destination node switching action, switches the next hop address of VXLAN to Remote IP = 3.3.3.3, and queries the IPv4 forwarding table and the corresponding egress port, and chooses to transmit the traffic from egress port Int3 to VTEP3. VTEP3 completes the decapsulation of the VXLAN message and forwards it to the virtual machine VM5 based on VNI = a and the inner destination IP = 12.1.1.1.

[0109] As an example, Figure 6 As shown, the routing device information: device Int1 connects to VTEP1, and device Int2 connects to VTEP2; the device forwarding table has an egress port of Int1 to the destination address 1.1.1.1 / 32, and an egress port of Int2 to the destination address 2.2.2.2 / 32. VTEP information: VTEP1 and VTEP2 have two subnets, VNI=a and VNI=b, respectively. The address of VTEP1 is 1.1.1.1, and the host address of the attached virtual machine VM1 is 11.1.1.1, which belongs to the subnet of VNI=a. The host address of VM2 is 11.1.1.1, which belongs to the subnet of VNI=b. Similarly, the address of VTEP2 and the virtual machine deployment are as follows: Figure 6 shown.

[0110] VXLAN tunnel information corresponding to VTEP1: A VXLAN tunnel exists on VTEP1, with the tunnel's Local IP = 1.1.1.1 / 32, Remote IP = 2.2.2.2 / 32, and supports VNI = a / b. VTEP1 receives Native IP traffic from VM1: VM1 sends an IPv4 packet with a destination address of 12.1.1.1 and a source address of the local host address 11.1.1.1, and forwards it to the network layer gateway device VTEP1 through the direct port. The device inbound port receives VXLAN traffic: The device inbound port Int1 receives a VXLAN packet with an outer destination IP of 2.2.2.2, a UDP encapsulation source port number of 6253, a UDP encapsulation destination port number of 4789, a VXLAN encapsulation VNI = a, and an inner IPv4 destination address of 12.1.1.1.

[0111] Flowspec route 3: The traffic matching condition includes Sub-TLV type=6, and the optional matching item UDP destination port number is 4789, and the UDP source port number is 6253. The traffic control action is the rewrite action of the VXLAN network identifier, that is, the VNI is changed to b.

[0112] When the routing device does not receive the Flowspec route, the routing device's public port Int1 receives inbound VXLAN traffic, queries the local IPv4 forwarding table based on the outer IP header, and the traffic with the destination address 2.2.2.2 is sent out from the egress port Int2 to the next hop node VTEP2; VTEP2 completes the decapsulation of the VXLAN message and forwards the VXLAN message to the virtual machine VM3 based on VNI=a and the inner destination IP=12.1.1.1.

[0113] When the routing device receives Flowspec route 3, the routing device verifies the validity of the Flowspec route and applies it to the inbound port Int1; the routing device receives VXLAN traffic at the inbound port, and based on the traffic matching conditions hitting UDPDestination Port = 4789 and UDP Source Port = 6253, the VXLAN network identifier rewrite action is performed, that is, the VNI is rewritten to VNI = b, and the routing device selects to forward the traffic to the outbound port Int2VTEP2 by querying the IPv4 forwarding table and the corresponding outbound port next hop node; VTEP3 completes the decapsulation of the VXLAN message and forwards it to the virtual machine VM4 based on VNI = b and the inner destination IP = 12.1.1.1.

[0114] In this embodiment, the routing device obtains a Flowspec route including a first traffic matching condition configured for VXLAN traffic and a traffic control action corresponding to the first traffic matching condition; matches the currently received message based on the first traffic matching condition to obtain a target VXLAN message; and determines the transmission mode of the target VXLAN message based on the traffic control action. Since the first traffic matching condition in the Flowspec route and the traffic control action corresponding to the first traffic matching condition are both configured for VXLAN traffic, the target VXLAN message can be identified through the first traffic matching condition in the Flowspec route, and the target port of the target VXLAN message can be determined based on the traffic control action corresponding to the first traffic matching condition, and the target VXLAN message is transmitted from the target port. The identification and processing of VXLAN messages are realized. The limitations of Flowspec technology on the identification and control of VXLAN traffic are broken.

[0115] Further, based on the above-mentioned embodiment of the present application, another embodiment of the present application is provided, referring to Figure 7 In this embodiment, the Flowspec routing also includes a second flow matching condition configured for other types of flows.

[0116] In this embodiment, if Figure 7 As shown, the other types of traffic include at least one of data link layer traffic, network layer traffic, MPLS traffic, SRv6 traffic and EVPN traffic.

[0117] In this embodiment, the Flowspec route includes a type field, and the type field is used to indicate the matching conditions of different types of traffic included in the Flowspec route.

[0118] As an example, the following content included in the type field is the second traffic matching condition configured for other types of traffic:

[0119] -1-L2(Ether or VPN) traffic match;

[0120] -2-L3 (IP or VPN) traffic match;

[0121] -3-MPLS traffic match;

[0122] -4-SRv6 traffic match;

[0123] -5-EVPN traffic match.

[0124] As an example, the second traffic matching condition of other types of traffic configurations may be set based on the characteristics of the type of traffic.

[0125] In this embodiment, after the step of obtaining the Flowspec route, the method further includes:

[0126] Step S40: Based on the type field, the currently received message is matched to obtain a message corresponding to the target type traffic.

[0127] As an example, when a Flowspec route is obtained, the Flowspec route may include matching conditions for different types of traffic.

[0128] Therefore, it is necessary to match the currently received message based on the traffic matching conditions corresponding to each traffic type in the type field in the Flowspec route.

[0129] For example, if the type field in the current Flowspec route includes traffic matching conditions corresponding to MPLS traffic, EVPN traffic, and VXLAN traffic, then, when matching the currently received message based on the type field, when a certain traffic matching condition is hit, it is determined that the currently received message is a message corresponding to the target type traffic. (Wherein, the target type traffic is the traffic that the Flowspec route wants to match and is matched, and the target type traffic corresponding message is at least one of the MPLS traffic, EVPN traffic, and VXLAN traffic corresponding messages).

[0130] In this embodiment, the step of matching the currently received message based on the first traffic matching condition to obtain the target VXLAN message includes:

[0131] Step A1: Based on the priorities of the first traffic matching condition and the second traffic matching condition, and the priorities of each matching item in the first traffic matching condition, the currently received message is matched to obtain the target VXLAN message.

[0132] In this embodiment, the priority of the first traffic matching condition is lower than the priority of the second traffic matching condition, the priority of the VXLAN network identifier field in the VXLAN header is lower than the priority of the source port number field in the UDP header, and the priority of the source port number field in the UDP header is lower than the priority of the destination port number field in the UDP header.

[0133] As an example, if the first traffic matching condition only includes one of the destination port number field in the UDP header, the source port number field in the UDP header, and the VXLAN network identifier field in the VXLAN header, then in the process of matching the currently received message based on the first traffic matching condition, there is no need to judge the priority among the three.

[0134] As an example, if the first traffic matching condition includes at least two of the destination port number field in the UDP header, the source port number field in the UDP header, and the VXLAN network identifier field in the VXLAN header, then matching the currently received message based on the priority between the three can improve the efficiency of traffic matching.

[0135] As an example, at the same time, since different types of traffic have different processing priorities, it is necessary to match the currently received message based on the priority of the first traffic matching condition and the priority of the second traffic matching condition corresponding to different types of traffic. Specifically, the priority of the first traffic matching condition is lower than the priority of the second traffic matching condition.

[0136] In this embodiment, after the step of matching the currently received message based on the first traffic matching condition, the method further includes:

[0137] Step S60: If the currently received message is matched based on the first traffic matching condition in the Flowspec route to obtain the target VXLAN message, and at the same time, the currently received message is matched based on the second traffic matching condition in the Flowspec route to obtain the message corresponding to the other type of traffic, then it is determined that the target VXLAN message obtained by matching is invalid, and the message corresponding to the other type of traffic obtained by matching is valid.

[0138] As an example, since the processing priority of VXLAN traffic is low, if the Flowspec route contains the first traffic matching condition and the second traffic matching condition, then in the traffic matching process, if the currently received message is matched based on the first traffic matching condition in the Flowspec route to obtain the target VXLAN message, and at the same time, the currently received message is matched based on the second traffic matching condition in the Flowspec route to obtain the message corresponding to the other type of traffic, then it is determined that the target VXLAN message obtained by matching is invalid, and the message corresponding to the other type of traffic obtained by matching is valid. If the currently received message is matched based on the first traffic matching condition in the Flowspec route to obtain the target VXLAN message, and no message corresponding to other types of traffic is matched, then it is determined that the target VXLAN message is valid.

[0139] In this embodiment, standardized suggestions are made for the priorities and effectiveness conditions of traffic matching conditions for each type of traffic, so as to facilitate the standardized implementation of the transmission control method of the VXLAN message.

[0140] Furthermore, based on the above-mentioned embodiments of the present application, another embodiment of the present application is provided. In this embodiment, the flow control action also includes other redirection actions.

[0141] In this embodiment, before the step of determining the transmission control mode of the target VXLAN message based on the traffic control action, the method further includes:

[0142] Step S70: determining whether the traffic control action corresponding to the first traffic matching condition contains both the redirection action and the other redirection action;

[0143] Step S80: If it exists, it is determined that the Flowspec route is invalid, and the step of determining the transmission control method of the target VXLAN message based on the flow control action is not performed.

[0144] As an example, the traffic control action includes at least one of the above-designed VXLAN tunnel guiding action, destination node switching action and VXLAN network identifier rewriting action.

[0145] As an example, the flow control action also includes other redirection actions specified by the original Flowspe technology.

[0146] Therefore, before the step of determining the transmission control mode of the target VXLAN message based on the flow control action, it is necessary to determine whether the redirection action and the other redirection action exist in the flow control action corresponding to the first flow matching condition at the same time, and then the flow control action is considered to be conflicting, and the Flowspec route is determined to be invalid, and the step of determining the transmission control mode of the target VXLAN message based on the flow control action is not performed. If not, it is determined that the Flowspec route is valid, and the step of determining the transmission control mode of the target VXLAN message based on the flow control action is continued.

[0147] In this embodiment, standard recommendations are made for conflict handling of redirection actions and the validity of Flowspec routing, so as to facilitate the standard implementation of the transmission control method of VXLAN packets.

[0148] Reference Figure 8 , Figure 8 It is a schematic diagram of the device structure of the hardware operating environment involved in the embodiment of the present application.

[0149] like Figure 8 As shown, the transmission control device of the VXLAN message may include: a processor 1001, a memory 1005, and a communication bus 1002. The communication bus 1002 is used to realize the connection communication between the processor 1001 and the memory 1005.

[0150] Optionally, the transmission control device of the VXLAN message may also include a user port, a network port, a camera, an RF (Radio Frequency) circuit, a sensor, a WiFi module, etc. The user port may include a display screen (Display), an input submodule such as a keyboard (Keyboard), and the optional user port may also include a standard wired port and a wireless port. The network port may include a standard wired port and a wireless port (such as a WI-FI port).

[0151] Those skilled in the art will understand that Figure 8 The VXLAN message transmission control device structure shown in the figure does not constitute a limitation on the VXLAN message transmission control device, and may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0152] like Figure 8As shown, the memory 1005 as a storage medium may include an operating system, a network communication module, and a transmission control program for VXLAN messages. The operating system is a program that manages and controls the hardware and software resources of the transmission control device of the VXLAN message, and supports the operation of the transmission control program of the VXLAN message and other software and / or programs. The network communication module is used to realize the communication between the components inside the memory 1005, and to communicate with other hardware and software in the transmission control system of the VXLAN message.

[0153] exist Figure 8 In the VXLAN message transmission control device shown, the processor 1001 is used to execute the VXLAN message transmission control program stored in the memory 1005 to implement the steps of the VXLAN message transmission control method described in any one of the above items.

[0154] The specific implementation of the transmission control device of the VXLAN message in the present application is basically the same as the various embodiments of the transmission control method of the above-mentioned VXLAN message, and will not be repeated here.

[0155] The present application also provides a VXLAN message transmission control device, which is applied to a routing device, such as Fig. 9 As shown, the device comprises:

[0156] A route receiving module 10 is used to obtain a Flowspec route, wherein the Flowspec route includes a first flow matching condition configured for VXLAN flow, and a flow control action corresponding to the first flow matching condition;

[0157] A matching module 20, configured to match the currently received message based on the first traffic matching condition to obtain a target VXLAN message;

[0158] The control module 30 is used to determine the transmission mode of the target VXLAN message based on the traffic control action.

[0159] Optionally, in a possible implementation manner of the present application, a VXLAN header and a UDP header are encapsulated in a VXLAN message corresponding to the VXLAN traffic, and a matching item in the first traffic matching condition includes at least one of the following:

[0160] The destination port number field in the UDP header;

[0161] The source port number field in the UDP header;

[0162] The VXLAN network identifier field in the VXLAN header.

[0163] Optionally, in a possible implementation manner of the present application, the Flowspec routing further includes a second flow matching condition configured for other types of flows, and the matching module 20 includes:

[0164] A matching submodule, configured to match the currently received message based on the priority of the first traffic matching condition and the second traffic matching condition, and the priority of each matching item in the first traffic matching condition, to obtain the target VXLAN message;

[0165] Among them, the priority of the first traffic matching condition is lower than the priority of the second traffic matching condition, the priority of the VXLAN network identifier field in the VXLAN header is lower than the priority of the source port number field in the UDP header, and the priority of the source port number field in the UDP header is lower than the priority of the destination port number field in the UDP header.

[0166] Optionally, in a possible implementation manner of the present application, the other types of traffic include at least one of data link layer traffic, network layer traffic, MPLS traffic, SRv6 traffic, and EVPN traffic, and after the step of matching the currently received message based on the first traffic matching condition, the device further includes:

[0167] The effectiveness judgment module is used to match the currently received message based on the first traffic matching condition in the Flowspec route to obtain the target VXLAN message, and at the same time match the currently received message based on the second traffic matching condition in the Flowspec route to obtain the message corresponding to the other type of traffic, then determine that the matched target VXLAN message is invalid, and the matched message corresponding to the other type of traffic is valid.

[0168] Optionally, in a possible implementation manner of the present application, the traffic control action includes a redirection action, and the redirection action includes at least one of the following:

[0169] A VXLAN tunnel guiding action, used to guide the target VXLAN message to a specified VXLAN tunnel, the VXLAN tunnel being mapped with a target port of the target VXLAN message;

[0170] A destination node switching action, used to modify the destination node in the target VXLAN message to a specified destination node, the destination node being mapped with a destination port of the target VXLAN message;

[0171] The rewriting action of the VXLAN network identifier is used to modify the VXLAN network identifier of the target VXLAN message to the VXLAN network identifier corresponding to the specified target virtual machine, and the VXLAN network identifier corresponding to the target virtual machine is mapped with the target port of the target VXLAN message.

[0172] Optionally, in a possible implementation manner of the present application, the traffic control action further includes other redirection actions, and before the step of determining the transmission control mode of the target VXLAN message based on the traffic control action, the device further includes:

[0173] an action determination module, configured to determine whether the redirection action and the other redirection action exist simultaneously in the flow control action corresponding to the first flow matching condition;

[0174] The validity judgment module is used to determine that the Flowspec route is invalid if it exists, and not execute the step of determining the transmission control method of the target VXLAN message based on the flow control action.

[0175] Optionally, in a possible implementation manner of the present application, the Flowspec route includes a type field, and the type field is used to indicate matching conditions of different types of traffic included in the Flowspec route. After the step of obtaining the Flowspec route, the device further includes:

[0176] The field matching module is used to match the currently received message based on the type field to obtain the message corresponding to the target type traffic.

[0177] Optionally, in a possible implementation manner of the present application, the Flowspec route further includes a route distinguisher, and the route distinguisher is used to identify VPN traffic.

[0178] The specific implementation of the transmission control device of the VXLAN message of the present application is basically the same as the various embodiments of the transmission control method of the above-mentioned VXLAN message, and will not be repeated here.

[0179] The present application also provides a storage medium, on which a transmission control program for a VXLAN message is stored. When the transmission control program for the VXLAN message is executed by a processor, the steps of the transmission control method for the VXLAN message as described in any one of the above items are implemented.

[0180] The specific implementation method of the storage medium of the present application is basically the same as the various embodiments of the above-mentioned VXLAN message transmission control method, and will not be repeated here.

[0181] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or system including the element.

[0182] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0183] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) as described above, and includes a number of instructions for a terminal device (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in each embodiment of the present application.

[0184] The above are only preferred embodiments of the present application, and are not intended to limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A VXLAN message transmission control method, characterized in that: Applied to routing equipment, including the following steps: Obtain a Flowspec route, where the Flowspec route includes a first flow matching condition configured for VXLAN flow, and a flow control action corresponding to the first flow matching condition; Based on the first traffic matching condition, matching the currently received message to obtain a target VXLAN message; Based on the traffic control action, determine a transmission mode for the target VXLAN message.

2. The VXLAN message transmission control method according to claim 1, characterized in that: A VXLAN header and a UDP header are encapsulated in the VXLAN message corresponding to the VXLAN traffic, and the matching items in the first traffic matching condition include at least one of the following: The destination port number field in the UDP header; The source port number field in the UDP header; The VXLAN network identifier field in the VXLAN header.

3. The VXLAN message transmission control method according to claim 2, characterized in that: The Flowspec routing also includes a second flow matching condition configured for other types of flows; The step of matching the currently received message based on the first traffic matching condition to obtain the target VXLAN message includes: Based on the priorities of the first traffic matching condition and the second traffic matching condition, and the priorities of the matching items in the first traffic matching condition, the currently received message is matched to obtain the target VXLAN message; Among them, the priority of the first traffic matching condition is lower than the priority of the second traffic matching condition, the priority of the VXLAN network identifier field in the VXLAN header is lower than the priority of the source port number field in the UDP header, and the priority of the source port number field in the UDP header is lower than the priority of the destination port number field in the UDP header.

4. The VXLAN message transmission control method according to claim 3, characterized in that: The other types of traffic include at least one of data link layer traffic, network layer traffic, MPLS traffic, SRv6 traffic, and EVPN traffic; After the step of matching the currently received message based on the first traffic matching condition, the method further includes: If the currently received message is matched based on the first traffic matching condition in the Flowspec route to obtain the target VXLAN message, and at the same time, the currently received message is matched based on the second traffic matching condition in the Flowspec route to obtain the message corresponding to the other type of traffic, then it is determined that the matched target VXLAN message is invalid, and the matched message corresponding to the other type of traffic is valid.

5. The VXLAN message transmission control method according to any one of claims 1 to 4, characterized in that: The flow control action includes a redirection action, and the redirection action includes at least one of the following: A VXLAN tunnel guiding action, used to guide the target VXLAN message to a specified VXLAN tunnel, the VXLAN tunnel being mapped with a target port of the target VXLAN message; A destination node switching action, used to modify the destination node in the target VXLAN message to a specified destination node, the destination node being mapped with a destination port of the target VXLAN message; The rewriting action of the VXLAN network identifier is used to modify the VXLAN network identifier of the target VXLAN message to the VXLAN network identifier corresponding to the specified target virtual machine, and the VXLAN network identifier corresponding to the target virtual machine is mapped with the target port of the target VXLAN message.

6. The VXLAN message transmission control method according to claim 5, characterized in that: The flow control action further includes other redirection actions. Before the step of determining the transmission control mode of the target VXLAN message based on the flow control action, the method further includes: Determining whether the redirection action and the other redirection action exist simultaneously in the flow control action corresponding to the first flow matching condition; If so, it is determined that the Flowspec route is invalid, and the step of determining the transmission control method of the target VXLAN message based on the flow control action is not performed.

7. The VXLAN message transmission control method according to claim 3, characterized in that: The Flowspec route includes a type field, and the type field is used to indicate matching conditions of different types of traffic included in the Flowspec route; After the step of obtaining the Flowspec route, the method further includes: Based on the type field, the currently received message is matched to obtain a message corresponding to the target type traffic.

8. The VXLAN message transmission control method according to claim 7, characterized in that: The Flowspec route also includes a route distinguisher, and the route distinguisher is used to identify VPN traffic.

9. A transmission control device for a VXLAN message, characterized in that: The device comprises: A route receiving module, configured to obtain a Flowspec route, wherein the Flowspec route includes a first flow matching condition configured for VXLAN flow, and a flow control action corresponding to the first flow matching condition; A matching module, configured to match the currently received message based on the first traffic matching condition to obtain a target VXLAN message; A control module is used to determine a transmission mode of the target VXLAN message based on the flow control action.

10. A VXLAN message transmission control device, characterized in that: The device includes: a memory, a processor, and a transmission control program for VXLAN messages stored in the memory and executable on the processor, wherein the transmission control program for VXLAN messages is configured to implement the steps of the transmission control method for VXLAN messages according to any one of claims 1 to 8.

11. A storage medium, characterized in that: The storage medium stores a transmission control program for a VXLAN message, and when the transmission control program for the VXLAN message is executed by the processor, the steps of the transmission control method for the VXLAN message as described in any one of claims 1 to 8 are implemented.

Images