Method and device for information interaction between firewall and switch

Abstract

The embodiment of the invention provides a method and device for information interaction between a firewall and a switch, and relates to the technical field of firewalls, and the method specifically comprises the steps: receiving a first registration request sent by a target firewall instance; in response to the first registration request, creating a target registration group, and adding the target firewall instance as a message publisher to the target registration group; the target registration group is named by the instance identifier of the target firewall instance; receiving a second registration request sent by the switch; in response to a second registration request, determining the target registration group through an instance identifier; and after the target registration group is determined, adding the switch as a message receiver to the target registration group, so that the target firewall instance and the switch perform information interaction through the registration group. According to the invention, when the configuration information of the drainage strategy of the firewall instance is dynamically published to the switch, the occupation of server resources is reduced, and the utilization rate of physical resources is improved.

Description

Technical Field

[0001] The present disclosure relates to the technical field of firewalls, and in particular to a method and device for information interaction between a firewall and a switch. Background Art

[0002] In the application networking of the firewall, the firewall often sends the configuration information of the diversion strategy to the switch based on NETCONF (Network Configuration Protocol, which is a network management protocol). Then, when the business traffic reaches the switch, the switch forwards the traffic to the firewall according to the diversion strategy sent, thereby achieving the purpose of diversion.

[0003] Among them, NETCONF is used to configure and manage network devices. Its transport layer relies on a secure communication protocol, and SSH2 (Secure Shell version 2, a secure remote login and file transfer protocol) provides this secure transmission mechanism. When the firewall uses NETCONF to connect to the switch through SSH2, it must first establish a connection with SSH2, which requires a key exchange and client authentication process between the firewall and the switch, that is, the firewall side needs to obtain the account and password set by the user on the switch.

[0004] However, in some scenarios involving confidential data traffic forwarding, considering that some abnormal configurations will affect the entire network during traffic forwarding, the switch account and password will not be provided to the firewall side; therefore, the firewall side cannot dynamically send the configuration information of the diversion policy to the switch through NETCONF, and can only use a static method to send the configuration information of the diversion policy to the switch.

[0005] At present, firewalls are usually deployed in clusters in the form of Pod (Pod is the smallest deployable and manageable computing unit in a cloud native cluster), that is, a firewall instance is created in the cluster. Once the configuration information of the diversion policy of the firewall instance changes, the policy routing of the corresponding diversion policy on the switch needs to be adjusted in time; in order to be able to publish the configuration information of the diversion policy of the firewall instance to the switch in a timely and dynamic manner, and at the same time more comprehensively protect nodes, better handle local traffic, and simplify the network architecture, it is usually necessary to change the resource control mode of the firewall instance from Deployment in the cluster to DaemonSet.

[0006] However, when using DaemonSet to control the resources of the firewall instance, a copy of the firewall instance Pod needs to be run on each physical server in the cluster. Therefore, the number of copies of the firewall instance will increase with the number of physical servers in the cluster, thereby occupying a large amount of server resources and reducing the utilization of physical resources. Summary of the invention

[0007] In view of this, an embodiment of the present application provides a method and device for information interaction between a firewall and a switch, which can reduce the occupancy of server resources and improve the utilization of physical resources when dynamically publishing the configuration information of the diversion strategy of the firewall instance to the switch.

[0008] In a first aspect, an embodiment of the present application provides a method for information interaction between a firewall and a switch, which is applied to a registration service module in a target cluster, and the method includes:

[0009] Receive a first registration request sent by a target firewall instance; the first registration request carries an instance identifier of the target firewall instance;

[0010] In response to the first registration request, a target registration group is created, and the target firewall instance is added to the target registration group as a message publisher; the target registration group is named with the instance identifier of the target firewall instance;

[0011] receiving a second registration request sent by the switch; the second registration request carries the target firewall instance identifier;

[0012] In response to the second registration request, determining the target registration group by using the instance identifier;

[0013] After the target registration group is determined, the switch is added to the target registration group as a message receiver, so that the target firewall instance and the switch perform information exchange through the registration group.

[0014] As an optional implementation of the embodiment of the present application, after determining the target registration group, adding the switch as a message receiver to the target registration group, the method includes:

[0015] In the target registration group, a communication connection between the target firewall instance and the switch is established through a publish-subscriber mode, so that the target firewall instance and the switch perform information exchange.

[0016] As an optional implementation of the embodiment of the present application, the method further includes:

[0017] receiving a target policy update message sent by the target firewall instance; the target policy update message carries a latest address for indicating the next hop of the switch;

[0018] Pushing the target policy update message to the switch so that the switch updates the address of the next hop to the latest address;

[0019] Receive an update completion message sent by the switch.

[0020] As an optional implementation of the embodiment of the present application, the method further includes:

[0021] receiving a firewall deletion message sent by the target firewall instance; wherein the firewall deletion message instructs the switch to leave the next hop address vacant;

[0022] Pushing the wall deletion message to the switch;

[0023] Receive an idle processing completion message sent by the switch.

[0024] In a second aspect, an embodiment of the present application provides a method for information interaction between a firewall and a switch, which is applied to the switch, and the method includes:

[0025] Acquire policy configuration information; the policy configuration information instructs the switch to register the registration group; the policy configuration information includes the instance identifier and registration purpose of the target firewall instance;

[0026] Based on the policy configuration information, generating a second registration request;

[0027] According to the registration purpose in the policy configuration information, a registration service module is determined, and the second registration request is sent to the registration service module; so that the registration service module adds the switch as a message recipient to the target registration group based on the second registration request, and enables the target firewall instance and the switch to exchange information through the registration group.

[0028] As an optional implementation of the embodiment of the present application, the method further includes:

[0029] receiving a target policy update message; the target policy update message carries a latest address for indicating the next hop of the switch;

[0030] In response to the target policy update message, the address of the next hop is updated to the latest address, and after the update is completed, an update completion message is sent to the registration service module.

[0031] As an optional implementation of the embodiment of the present application, the method further includes:

[0032] Receive a wall deletion message sent by the target firewall instance;

[0033] In response to the wall deletion message sent by the target firewall instance, the next hop address is vacant, and after the vacant processing, a vacant processing completion message is sent to the registration service module.

[0034] In a third aspect, an embodiment of the present application provides an information interaction device between a firewall and a switch, serving a registration service module in a target cluster, the device comprising:

[0035] A receiving unit, configured to receive a first registration request sent by a target firewall instance; the first registration request carries an instance identifier of the target firewall instance;

[0036] a creating unit, configured to create a target registration group in response to the first registration request, and add the target firewall instance as a message publisher to the target registration group; the target registration group is named with the instance identifier of the target firewall instance;

[0037] The receiving unit is further configured to receive a second registration request sent by the switch; the second registration request carries the target firewall instance identifier;

[0038] a determining unit, configured to determine the target registration group by using the instance identifier in response to the second registration request;

[0039] The adding unit is used to add the switch as a message receiver to the target registration group after determining the target registration group, so that the target firewall instance and the switch can exchange information through the registration group.

[0040] As an optional implementation of the embodiment of the present application, the adding unit is specifically used to establish a communication connection between the target firewall instance and the switch in the target registration group through a publish-subscriber mode, so that the target firewall instance and the switch can exchange information.

[0041] As an optional implementation of an embodiment of the present application, the receiving unit is specifically used to receive a target policy update message sent by the target firewall instance; the target policy update message carries the latest address for indicating the next hop of the switch; the target policy update message is pushed to the switch so that the switch updates the address of the next hop to the latest address; and the update completion message sent by the switch is received.

[0042] As an optional implementation of the embodiment of the present application, the receiving unit is specifically used to receive a wall deletion message sent by the target firewall instance; the wall deletion message instructs the switch to leave the next hop address vacant; pushes the wall deletion message to the switch; and receives a vacancy processing completion message sent by the switch.

[0043] In a fourth aspect, an embodiment of the present application provides an information interaction device between a firewall and a switch, serving a registration service module in a target cluster, the device comprising:

[0044] An acquisition unit, configured to acquire policy configuration information; the policy configuration information instructs the switch to register a registration group; the policy configuration information includes an instance identifier of a target firewall instance and a registration purpose;

[0045] A generating unit, configured to generate a second registration request based on the policy configuration information;

[0046] A determination unit is used to determine a registration service module according to the registration purpose in the policy configuration information, and send the second registration request to the registration service module; so that the registration service module adds the switch as a message recipient to a target registration group based on the second registration request, and enables the target firewall instance and the switch to exchange information through the registration group.

[0047] As an optional implementation of an embodiment of the present application, the information interaction device 700 between the firewall and the switch also includes a receiving unit, which is specifically used to receive a target policy update message; the target policy update message carries the latest address for indicating the next hop of the switch; in response to the target policy update message, the address of the next hop is updated to the latest address, and after the update is completed, an update completion message is sent to the registration service module.

[0048] As an optional implementation of the embodiment of the present application, the receiving unit is also used to receive a wall deletion message sent by the target firewall instance; based on the wall deletion message sent by the target firewall instance, the wall deletion message is pushed to the switch; the firewall deletion instruction instructs the switch to perform vacant processing on the next hop address; in response to the wall deletion message sent by the target firewall instance, the next hop address is vacant processing, and after the vacant processing, a vacant processing completion message is sent to the registration service module.

[0049] In a fifth aspect, an embodiment of the present application provides an electronic device, comprising: a memory and a processor, wherein the memory is used to store a computer program; and the processor is used to enable the electronic device to implement the information interaction method between a firewall and a switch described in any of the above embodiments when executing the computer program.

[0050] In a sixth aspect, an embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a computing device, the computing device implements the information interaction method between a firewall and a switch described in any of the above embodiments.

[0051] The information interaction method between a firewall and a switch provided in an embodiment of the present application is specifically as follows: receiving a first registration request sent by a target firewall instance; the first registration request carries an instance identifier of the target firewall instance; in response to the first registration request, creating a target registration group, and adding the target firewall instance as a message publisher to the target registration group; the target registration group is named after the instance identifier of the target firewall instance; receiving a second registration request sent by the switch; the second registration request carries the target firewall instance identifier; in response to the second registration request, determining the target registration group through the instance identifier; after determining the target registration group, adding the switch as a message recipient to the target registration group, so that the target firewall instance and the switch perform information interaction through the registration group. The present application creates the target registration group and names the target registration group as the instance identifier of the target firewall instance, and then adds the target firewall instance and the switch to the same target registration group through the instance identifier of the target firewall instance, and uses the target firewall instance as the publisher of the message and the switch as the receiver of the message in the target registration group, so that a communication connection between the target firewall instance and the switch can be established through the target registration group, which facilitates the dynamic distribution of the relevant policies of the target firewall instance to the switch. Therefore, there is no need to modify the resource scheduling mode of the firewall instance to the DaemonSet mode, thereby reducing the number of copies of the firewall instance, reducing the occupation of server resources, and improving the utilization of physical resources. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0053] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings required in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0054] Figure 1 An overall architecture diagram of the information interaction method between a firewall and a switch provided in an embodiment of the present application;

[0055] Figure 2 A flowchart of the steps of the information interaction method between the firewall and the switch provided in the embodiment of the present application;

[0056] Figure 3 One of the interactive step flow charts of the information interaction method between the firewall and the switch provided in the embodiment of the present application;

[0057] Figure 4 The second interactive step flow chart of the information interaction method between the firewall and the switch provided in the embodiment of the present application;

[0058] Figure 5 The third interactive step flow chart of the information interaction method between the firewall and the switch provided in the embodiment of the present application;

[0059] Figure 6 A schematic diagram of the structure of an information interaction device between a firewall and a switch provided in an embodiment of the present application;

[0060] Figure 7 A schematic diagram of the structure of an information interaction device between a firewall and a switch provided in an embodiment of the present application;

[0061] Figure 8 A schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0062] In order to more clearly understand the above-mentioned objectives, features and advantages of the present disclosure, the scheme of the present disclosure will be further described below. It should be noted that the embodiments of the present disclosure and the features in the embodiments can be combined with each other without conflict.

[0063] In the following description, many specific details are set forth to facilitate a full understanding of the present disclosure, but the present disclosure may also be implemented in other ways different from those described herein; it is obvious that the embodiments in the specification are only part of the embodiments of the present disclosure, rather than all of the embodiments.

[0064] In the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a concrete way. In addition, in the description of the embodiments of the present application, unless otherwise specified, the meaning of "multiple" refers to two or more.

[0065] It should be noted that, in this article, the term "comprises" or any other variant thereof is intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0066] In the embodiments of this application, refer to Figure 1 As shown, it is an overall architecture diagram of a method for information interaction between a firewall and a switch provided by the present application, including a firewall instance 11, a registration service module 12 and a switch 13. Specifically, the target firewall instance 11 and the registration service module 12 are both created in a target cluster 100, for example, a Kubernetes cluster (an open source container orchestration platform for automated deployment, expansion and management of containerized applications, referred to as K8s); then, the firewall instance 11 inside the cluster establishes a communication connection with the switch 13 outside the cluster through the registration service module 12, so that the diversion strategy of the firewall instance 11 is pushed to the switch 13 in a timely manner through the registration service module 12, and the switch 13 branch diversion strategy updates the address of the next hop and other operations.

[0067] The present application embodiment provides a method for information interaction between a firewall and a switch, which is applied to a registration service module in a target cluster. Figure 2 As shown, the information interaction method between the firewall and the switch includes the following steps S201-S205:

[0068] S201: Receive a first registration request sent by a target firewall instance.

[0069] The first registration request carries the instance identifier of the target firewall instance.

[0070] Specifically, a firewall instance is a network security system designed to monitor and control network traffic and decide whether to allow the transmission of data packets based on predefined security rules. Its main function is to protect the internal network from external threats, prevent unauthorized access, and establish a security barrier between the enterprise network and the Internet. By filtering traffic, blocking malicious attacks, and recording network activities, firewalls effectively improve the security and stability of the network. As the first line of defense for network security, firewalls play a key role in the network environment of enterprises, institutions, and individual users.

[0071] It should be noted that the target cluster is the K8s cluster mentioned above. The developers will first create the Pod corresponding to the target firewall instance in the K8s cluster and incubate the registration service module in the K8s cluster. Specifically, the registration service module provides services to other devices outside the cluster through the Service service provided in the K8s cluster, such as providing registration services to switches, etc.

[0072] In an embodiment of the present application, the target firewall instance Pod can send the first registration request to the registration service module to request the registration service module to create a registration group named after the target firewall instance identifier and create a corresponding group service for the registration group; wherein the group service is a series of services provided for the registration group; these services may include registration, query, management and other functions to meet the needs of entities in the registration group.

[0073] S202: In response to the first registration request, create a target registration group, and add the target firewall instance as a message publisher to the target registration group.

[0074] The target registration group is named after the instance identifier of the target firewall instance.

[0075] In some embodiments, after the firewall instance and the registration service module in the target cluster are successfully created, the target firewall instance will automatically initiate the first registration request to the registration service module; specifically, the first registration request will carry the target firewall instance identifier so that the target firewall instance identifier can be used as the name of the target registration group. After the target registration group is created, the target firewall instance can be added to the target registration group as a message publisher.

[0076] It should be noted that registration groups are usually used to manage and coordinate different components, including message publishers and message receivers; specifically, message publishers and message receivers can be registered in the same registration group to realize message publishing and receiving. The registration group provides a mechanism for centralized management and coordination of message delivery, so that different components in the system can communicate and collaborate effectively. Therefore, in this application, in order to enable the dynamic diversion strategy of the firewall instance to be timely delivered to the switch, the firewall instance is used as the publisher of the message, and the switch is used as the receiver of the message. Both are registered in the target registration group to establish a communication connection between the firewall instance and the switch, thereby eliminating the need to deploy multiple corresponding copies for the firewall, thereby reducing the utilization rate of physical resources.

[0077] S203: Receive a second registration request sent by the switch.

[0078] The second registration request carries the target firewall instance identifier.

[0079] In some embodiments, since the second registration request carries the target firewall instance identifier, the corresponding target registration group can be found in the registration service module, thereby facilitating the subsequent addition of the switch as a message recipient to the target registration group.

[0080] S204: In response to the second registration request, determine the target registration group through the instance identifier.

[0081] Specifically, after receiving the second registration request sent by the switch, the second registration request is immediately parsed to obtain the target firewall instance identifier carried in the second registration request, and the target registration group is found in the registration service module using the target firewall instance identifier.

[0082] S205: After determining the target registration group, add the switch as a message receiver to the target registration group, so that the target firewall instance and the switch exchange information through the registration group.

[0083] In some embodiments, after the target registration group is determined using the target firewall instance identifier, the switch can be added to the target registration group as a message recipient, and the target registration group includes both the firewall instance as the message publisher and the switch as the message receiver, and a communication connection is established between the firewall instance and the switch through the target registration group.

[0084] The information interaction method between a firewall and a switch provided in an embodiment of the present application is specifically as follows: receiving a first registration request sent by a target firewall instance; the first registration request carries an instance identifier of the target firewall instance; in response to the first registration request, creating a target registration group, and adding the target firewall instance as a message publisher to the target registration group; the target registration group is named after the instance identifier of the target firewall instance; receiving a second registration request sent by the switch; the second registration request carries the target firewall instance identifier; in response to the second registration request, determining the target registration group through the instance identifier; after determining the target registration group, adding the switch as a message recipient to the target registration group, so that the target firewall instance and the switch perform information interaction through the registration group. The present application creates the target registration group and names the target registration group as the instance identifier of the target firewall instance, and then adds the target firewall instance and the switch to the same target registration group through the instance identifier of the target firewall instance, and uses the target firewall instance as the publisher of the message and the switch as the receiver of the message in the target registration group, so that a communication connection between the target firewall instance and the switch can be established through the target registration group, which facilitates the dynamic distribution of the relevant policies of the target firewall instance to the switch. Therefore, there is no need to modify the resource scheduling mode of the firewall instance to the DaemonSet mode, thereby reducing the number of copies of the firewall instance, reducing the occupation of server resources, and improving the utilization of physical resources.

[0085] As an extension and refinement of the above embodiment, the present application embodiment provides another information interaction method between a firewall and a switch, referring to Figure 3 As shown, the information interaction method between the firewall and the switch includes the following steps S301-S308:

[0086] S301: A registration service module receives a first registration request sent by a target firewall instance.

[0087] The first registration request carries the instance identifier of the target firewall instance.

[0088] S302: The registration service module creates a target registration group in response to the first registration request, and adds the target firewall instance as a message publisher to the target registration group.

[0089] The target registration group is named after the instance identifier of the target firewall instance.

[0090] S303: The switch obtains policy configuration information.

[0091] The policy configuration information instructs the switch to register a registration group, and the policy configuration information includes an instance identifier of a target firewall instance and a registration purpose.

[0092] In some embodiments, the developer will pre-acquire the firewall instance identifier corresponding to the firewall instance and add the firewall instance identifier to the policy configuration information, so that when the switch requests registration from the registration service module according to the policy configuration information, the registration group where the target firewall instance is located is found through the instance identifier of the target firewall instance, and the switch is added to the registration group, thereby establishing a communication connection between the target firewall instance and the switch through the registration group.

[0093] Specifically, the policy configuration information specifically includes: the purpose of the registration can be understood as the object used to indicate the switch to request registration. In the embodiment of the present application, the policy configuration information also includes the ip+port corresponding to the registration service module; this is because the object the switch requests registration for is the registration service module; since the registration service module is incubated in the K8s cluster, and the registration service module needs to provide registration services to switches outside the cluster, it is necessary to use the ip+port provided in the K8s cluster to realize the function of providing services to the outside world, and then establish a communication connection between the switch and the registration service module through the ip+port corresponding to the registration service module in the cluster. The policy configuration information also includes the specified fields that need to be extracted from the target policy update message when interacting with the target firewall instance, such as the field where the latest address of the subsequent next hop is located.

[0094] It should be noted that when the switch requests registration from the registration service module, the switch's related information needs to be authenticated, and if the authentication is passed, the subsequent registration is completed. The policy configuration information may also include other information, which is not specifically limited in this application.

[0095] S304: The switch generates a second registration request based on the policy configuration information.

[0096] Specifically, the switch may clearly need to send the second registration request to the registration service module according to the registration purpose in the policy configuration information.

[0097] S305. The switch determines a registration service module according to the registration purpose in the policy configuration information, and sends the second registration request to the registration service module; so that the registration service module adds the switch as a message recipient to the target registration group based on the second registration request, and enables the target firewall instance and the switch to exchange information through the registration group.

[0098] S306: The registration service module receives a second registration request sent by the switch.

[0099] The second registration request carries the target firewall instance identifier.

[0100] S307: The registration service module responds to the second registration request and determines the target registration group through the instance identifier.

[0101] S308. After determining the target registration group, the registration service module adds the switch as a message receiver to the target registration group, so that the target firewall instance and the switch exchange information through the registration group.

[0102] Specifically, in the target registration group, a communication connection between the target firewall instance and the switch is established through a publish-subscriber mode, so that the target firewall instance and the switch perform information exchange.

[0103] The present application creates the target registration group and names the target registration group as the instance identifier of the target firewall instance, and then adds the target firewall instance and the switch to the same target registration group through the instance identifier of the target firewall instance, and uses the target firewall instance as the publisher of the message and the switch as the receiver of the message in the target registration group, so that a communication connection between the target firewall instance and the switch can be established through the target registration group, which facilitates the dynamic distribution of relevant policies of the target firewall instance to the switch.

[0104] As an extension and refinement of the above embodiment, refer to Figure 4 As shown, the information interaction method between the firewall and the switch provided in the embodiment of the present application includes the following steps:

[0105] S401. A registration service module receives a target policy update message sent by the target firewall instance.

[0106] The target policy update message carries the latest address for indicating the next hop of the switch.

[0107] In some embodiments, the firewall instance often encounters a restart or other reasons, resulting in the server originally used by the firewall instance Pod being unable to continue to be used, and then a new server needs to be rescheduled for use by the firewall instance Pod. Since the server has changed, the next hop address of the switch needs to be updated to the physical node IP information corresponding to the current latest server, that is, the latest address of the next hop is the physical node IP information corresponding to the latest server corresponding to the target firewall instance, so that the switch can subsequently forward the subsequent traffic to the current firewall instance through the physical node IP information corresponding to the latest server.

[0108] It should be noted that when the physical node IP information corresponding to the server of the firewall instance is updated, the firewall instance will actively report the message, i.e., the target policy update message, to the registration service module, informing the registration service module that its server has been transferred and the corresponding switch needs to be instructed to update the next hop address.

[0109] S402: The registration service module pushes the target policy update message to the switch, so that the switch updates the address of the next hop to the latest address.

[0110] Specifically, after obtaining the target policy update message sent by the target firewall instance, the target policy update message needs to be pushed to the switch immediately; specifically, since in the same registration group, the target firewall instance acts as a message publisher and the switch acts as a message receiver, the target policy update message can be pushed to the switch based on the publish-subscriber mode.

[0111] S403: The switch receives a target policy update message.

[0112] The target policy update message carries the latest address for indicating the next hop of the switch.

[0113] S404: The switch updates the address of the next hop to the latest address in response to the target policy update message, and sends an update completion message to the registration service module after the update is completed.

[0114] Specifically, after receiving the target policy update message, the switch will first parse the target policy update message to obtain the latest address of the next hop of the switch, and then update the address of the next hop to the latest address. After the switch updates the address of the next hop to the latest address, it needs to send a feedback message, i.e., the update completion message, to the registration service module to inform the registration service module that the address update of the next hop has been completed.

[0115] S405: The registration service module receives an update completion message sent by the switch.

[0116] Through the above method, the embodiment of the present application can timely send the target policy update message sent by the target firewall instance to the switch through the registration service module, thereby dynamically sending the target policy update message of the target firewall instance to the switch.

[0117] As an extension and refinement of the above embodiment, refer to Figure 5 As shown, the information interaction method between the firewall and the switch provided in the embodiment of the present application includes the following steps:

[0118] S501. The registration service module receives a wall deletion message sent by the target firewall instance.

[0119] The wall deletion message instructs the switch to leave the next hop address vacant.

[0120] In some embodiments, after the current target firewall instance is used, it is necessary to perform a wall deletion operation on the current target firewall instance. Therefore, it is necessary to inform the switch that the target firewall instance is about to perform a wall deletion operation so that the next hop address of the switch is left vacant, that is, no next hop is performed. Therefore, before performing a wall deletion operation on the target firewall instance, the target firewall instance will actively notify the registration service module so that the registration service module pushes the information of the wall deletion operation to the switch.

[0121] S502: The registration service module pushes the wall deletion message to the switch.

[0122] Specifically, after receiving the wall deletion message sent by the target firewall instance, it is necessary to immediately push the wall deletion message sent by the target firewall instance to the switch; specifically, since in the same registration group, the target firewall instance acts as a message publisher and the switch acts as a message receiver, the wall deletion message can be pushed to the switch based on the publish-subscriber mode.

[0123] S503: The switch receives a wall deletion message sent by the target firewall instance.

[0124] S504: In response to the wall deletion message sent by the target firewall instance, the switch performs vacancy processing on the next hop address, and after the vacancy processing, sends a vacancy processing completion message to the registration service module.

[0125] Specifically, after receiving the wall deletion message sent by the target firewall instance, the switch can clearly know that the current target firewall instance is about to be deleted, that is, the switch does not need to forward traffic to the physical node address of the server originally corresponding to the target firewall instance at the next hop. At this time, the next hop address can be processed as vacant, and there is no need to execute the next hop. After the switch processes the address of the next hop as vacant, it needs to send a feedback message to the registration service module, that is, the vacancy processing completion message, to inform the registration service module that the vacancy processing of the next hop has been completed.

[0126] S505: The registration service module receives the vacancy processing completion message sent by the switch.

[0127] Through the above method, the embodiment of the present application can timely send the wall deletion message sent by the target firewall instance to the switch through the registration service module, thereby dynamically sending the wall deletion message of the target firewall instance to the switch.

[0128] Based on the same inventive concept, as an implementation of the above method, an embodiment of the present application also provides an information interaction device between a firewall and a switch. This embodiment corresponds to the above method embodiment. For ease of reading, this embodiment will no longer repeat the details of the above method embodiment one by one, but it should be clear that an information interaction device between a firewall and a switch in this embodiment can correspond to the implementation of all the contents in the above method embodiment.

[0129] The present application embodiment provides a device for information interaction between a firewall and a switch. Figure 6 is a schematic diagram of the structure of the information interaction device between the firewall and the switch, such as Figure 6 As shown, the information interaction device 600 between the firewall and the switch includes:

[0130] The receiving unit 601 is configured to receive a first registration request sent by a target firewall instance; the first registration request carries an instance identifier of the target firewall instance;

[0131] A creating unit 602 is used to create a target registration group in response to the first registration request, and add the target firewall instance as a message publisher to the target registration group; the target registration group is named with the instance identifier of the target firewall instance;

[0132] The receiving unit 601 is further configured to receive a second registration request sent by the switch; the second registration request carries the target firewall instance identifier;

[0133] A determining unit 603, configured to determine the target registration group by using the instance identifier in response to the second registration request;

[0134] The adding unit 604 is configured to add the switch as a message receiver to the target registration group after determining the target registration group, so that the target firewall instance and the switch can exchange information through the registration group.

[0135] As an optional implementation of the embodiment of the present application, the adding unit 604 is specifically used to establish a communication connection between the target firewall instance and the switch in the target registration group through a publish-subscriber mode, so that the target firewall instance and the switch can exchange information.

[0136] As an optional implementation of an embodiment of the present application, the receiving unit 601 is specifically used to receive a target policy update message sent by the target firewall instance; the target policy update message carries the latest address for indicating the next hop of the switch; the target policy update message is pushed to the switch so that the switch updates the address of the next hop to the latest address; and the update completion message sent by the switch is received.

[0137] As an optional implementation of the embodiment of the present application, the receiving unit 601 is specifically used to receive a wall deletion message sent by the target firewall instance; the wall deletion message instructs the switch to leave the next hop address vacant; pushes the wall deletion message to the switch; and receives a vacancy processing completion message sent by the switch.

[0138] The embodiment of the present application also provides another information interaction device between a firewall and a switch. Figure 7 is a schematic diagram of the structure of the information interaction device between the firewall and the switch, such as Figure 7 As shown, the information interaction device 700 between the firewall and the switch includes:

[0139] The acquisition unit 701 is used to acquire policy configuration information; the policy configuration information instructs the switch to register a registration group; the policy configuration information includes an instance identifier of a target firewall instance and a registration purpose;

[0140] A generating unit 702, configured to generate a second registration request based on the policy configuration information;

[0141] The determination unit 703 is used to determine a registration service module according to the registration purpose in the policy configuration information, and send the second registration request to the registration service module; so that the registration service module adds the switch as a message recipient to the target registration group based on the second registration request, and enables the target firewall instance and the switch to exchange information through the registration group.

[0142] As an optional implementation of an embodiment of the present application, the information interaction device 700 between the firewall and the switch also includes a receiving unit, which is specifically used to receive a target policy update message; the target policy update message carries the latest address for indicating the next hop of the switch; in response to the target policy update message, the address of the next hop is updated to the latest address, and after the update is completed, an update completion message is sent to the registration service module.

[0143] As an optional implementation of the embodiment of the present application, the receiving unit is also used to receive a wall deletion message sent by the target firewall instance; based on the wall deletion message sent by the target firewall instance, the wall deletion message is pushed to the switch; the firewall deletion instruction instructs the switch to perform vacant processing on the next hop address; in response to the wall deletion message sent by the target firewall instance, the next hop address is vacant processing, and after the vacant processing, a vacant processing completion message is sent to the registration service module.

[0144] Based on the same inventive concept, an embodiment of the present disclosure also provides an electronic device. Figure 8 A schematic diagram of the structure of an electronic device provided in an embodiment of the present disclosure, such as Figure 8 As shown, the electronic device provided in this embodiment includes: a memory 801 and a processor 802, wherein the memory 801 is used to store a computer program; the processor 802 is used to execute the information interaction method between the firewall and the switch provided in the above embodiment when executing the computer program.

[0145] Based on the same inventive concept, an embodiment of the present application also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the computing device implements the information interaction method between the firewall and the switch provided in the above embodiment.

[0146] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media that include computer-usable program code.

[0147] The processor may be a central processing unit (CPU), other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc.

[0148] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0149] Computer readable media include permanent and non-permanent, removable and non-removable storage media. Storage media can be implemented by any method or technology to store information, and the information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0150] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for information interaction between a firewall and a switch, characterized in that: The registration service module applied to the target cluster comprises: Receive a first registration request sent by a target firewall instance; the first registration request carries an instance identifier of the target firewall instance; In response to the first registration request, a target registration group is created, and the target firewall instance is added to the target registration group as a message publisher; the target registration group is named with the instance identifier of the target firewall instance; receiving a second registration request sent by the switch; the second registration request carries the target firewall instance identifier; In response to the second registration request, determining the target registration group by using the instance identifier; After the target registration group is determined, the switch is added to the target registration group as a message receiver, so that the target firewall instance and the switch perform information exchange through the registration group.

2. The method according to claim 1, characterized in that After determining the target registration group, adding the switch as a message recipient to the target registration group, the method includes: In the target registration group, a communication connection between the target firewall instance and the switch is established through a publish-subscriber mode, so that the target firewall instance and the switch perform information exchange.

3. The method according to any one of claims 1 to 2, characterized in that: The method further comprises: receiving a target policy update message sent by the target firewall instance; the target policy update message carries a latest address for indicating the next hop of the switch; Pushing the target policy update message to the switch so that the switch updates the address of the next hop to the latest address; Receive an update completion message sent by the switch.

4. The method according to any one of claims 1 to 2, characterized in that: The method further comprises: receiving a firewall deletion message sent by the target firewall instance; wherein the firewall deletion message instructs the switch to leave the next hop address vacant; Pushing the wall deletion message to the switch; Receive an idle processing completion message sent by the switch.

5. A method for information interaction between a firewall and a switch, characterized in that: Applied to a switch, the method comprises: Acquire policy configuration information; the policy configuration information instructs the switch to register the registration group; the policy configuration information includes the instance identifier and registration purpose of the target firewall instance; Based on the policy configuration information, generating a second registration request; According to the registration purpose in the policy configuration information, a registration service module is determined, and the second registration request is sent to the registration service module; so that the registration service module adds the switch as a message recipient to the target registration group based on the second registration request, and enables the target firewall instance and the switch to exchange information through the registration group.

6. The method according to claim 5, characterized in that The method further comprises: receiving a target policy update message; the target policy update message carries a latest address for indicating the next hop of the switch; In response to the target policy update message, the address of the next hop is updated to the latest address, and after the update is completed, an update completion message is sent to the registration service module.

7. The method according to claim 5, characterized in that The method further comprises: Receive a wall deletion message sent by the target firewall instance; In response to the wall deletion message sent by the target firewall instance, the next hop address is vacant, and after the vacant processing, a vacant processing completion message is sent to the registration service module.

8. An information interaction device between a firewall and a switch, characterized in that: A registration service module serving in a target cluster, the device comprising: A receiving unit, configured to receive a first registration request sent by a target firewall instance; the first registration request carries an instance identifier of the target firewall instance; a creating unit, configured to create a target registration group in response to the first registration request, and add the target firewall instance as a message publisher to the target registration group; the target registration group is named with the instance identifier of the target firewall instance; The receiving unit is further configured to receive a second registration request sent by the switch; the second registration request carries the target firewall instance identifier; a determining unit, configured to determine the target registration group by using the instance identifier in response to the second registration request; The adding unit is used to add the switch as a message receiver to the target registration group after determining the target registration group, so that the target firewall instance and the switch can exchange information through the registration group.

9. An information interaction device between a firewall and a switch, characterized in that: Serving a switch, the device comprises: An acquisition unit, configured to acquire policy configuration information; the policy configuration information instructs the switch to register a registration group; the policy configuration information includes an instance identifier of a target firewall instance and a registration purpose; A generating unit, configured to generate a second registration request based on the policy configuration information; A determination unit is used to determine a registration service module according to the registration purpose in the policy configuration information, and send the second registration request to the registration service module; so that the registration service module adds the switch as a message recipient to a target registration group based on the second registration request, and enables the target firewall instance and the switch to exchange information through the registration group.

10. An electronic device, characterized in that: include: A memory and a processor, wherein the memory is used to store a computer program; and the processor is used to enable the electronic device to implement the information interaction method between a firewall and a switch as described in any one of claims 1-4 or 5-7 when executing the computer program.

11. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a computing device, the computing device implements the information interaction method between a firewall and a switch as described in any one of claims 1-4 or 5-7.

Images