A method and apparatus for information exchange between a firewall and a switch.

Abstract

This application provides a method and apparatus for information interaction between a firewall and a switch, relating to the field of firewall technology. The method specifically includes: receiving a first registration request sent by a target firewall instance; responding to the first registration request, creating a target registration group and adding the target firewall instance as a message publisher to the target registration group; the target registration group is named using the instance identifier of the target firewall instance; receiving a second registration request sent by the switch; responding to the second registration request, determining the target registration group using the instance identifier; and after determining the target registration group, adding the switch as a message receiver to the target registration group, so that the target firewall instance and the switch can interact through the registration group. This application can reduce the occupation of server resources and improve the utilization rate of physical resources when dynamically publishing the configuration information of the firewall instance's traffic redirection policy to the switch.

Description

Technical Field

[0001] This disclosure relates to the field of firewall technology, and specifically to a method and apparatus for information exchange between a firewall and a switch. Background Technology

[0002] In firewall-based network deployments, firewalls often use NETCONF (Network Configuration Protocol, a network management protocol) to send traffic redirection policy configuration information to switches. When service traffic reaches the switch, the switch forwards the traffic to the firewall according to the issued redirection policy, thus achieving the purpose of traffic redirection.

[0003] NETCONF is used for configuring and managing network devices. Its transport layer relies on a secure communication protocol, and SSH2 (Secure Shell version 2, a secure remote login and file transfer protocol) provides this secure transport mechanism. When a firewall uses NETCONF to connect to a switch via SSH2, it first needs to establish a connection with SSH2. This requires key exchange and client authentication between the firewall and the switch; that is, the firewall needs to obtain the user's username and password set on the switch.

[0004] However, in some scenarios involving the forwarding of confidential data traffic, considering that some abnormal configurations may affect the network during the entire traffic forwarding process, the switch's account and password will not be provided to the firewall side. Therefore, the firewall side cannot dynamically send the traffic redirection policy configuration information to the switch through NETCONF, and can only use a static method to send the traffic redirection policy configuration information to the switch.

[0005] Currently, firewalls are typically deployed in clusters as Pods (Pods are the smallest deployable and manageable computing units in cloud-native clusters). This means that firewall instances are created in the cluster. Once the configuration information of the firewall instance's traffic redirection policy changes, the corresponding traffic redirection policy routing on the switch needs to be adjusted in a timely manner. In order to dynamically publish the configuration information of the firewall instance's traffic redirection policy to the switch in a timely manner, and to achieve more comprehensive node protection, better handling of local traffic, and simplified network architecture, it is usually necessary to change the resource control method of the firewall instance from Deployment in the cluster to DaemonSet.

[0006] However, when using DaemonSet to control resources for firewall instances, a replica of the firewall instance Pod needs to be run on each physical server in the cluster. Therefore, the number of replicas of the firewall instance increases with the number of physical servers in the cluster, which in turn consumes a lot of server resources and reduces the utilization of physical resources. Summary of the Invention

[0007] In view of this, embodiments of this application provide a method and apparatus for information exchange between a firewall and a switch, which can reduce the occupation of server resources and improve the utilization of physical resources when dynamically publishing the configuration information of the traffic redirection policy of the firewall instance to the switch.

[0008] In a first aspect, embodiments of this application provide a method for information exchange between a firewall and a switch, applied to a registration service module in a target cluster, the method comprising:

[0009] Receive a first registration request sent by the target firewall instance; the first registration request carries the instance identifier of the target firewall instance;

[0010] In response to the first registration request, a target registration group is created, and the target firewall instance is added to the target registration group as a message publisher; the target registration group is named after the instance identifier of the target firewall instance.

[0011] Receive a second registration request sent by the switch; the second registration request carries the target firewall instance identifier;

[0012] In response to the second registration request, the target registration group is determined by the instance identifier;

[0013] After determining the target registration group, the switch is added to the target registration group as a message receiver, so that the target firewall instance and the switch can interact with each other through the registration group.

[0014] As an optional implementation of this application, after determining the target registration group and adding the switch as a message receiver to the target registration group, the method includes:

[0015] In the target registration group, a communication connection is established between the target firewall instance and the switch through the publish-subscriber pattern, so that the target firewall instance and the switch can interact with each other.

[0016] As an optional implementation of this application, the method further includes:

[0017] Receive a target policy update message sent by the target firewall instance; the target policy update message carries the latest address indicating the next hop of the switch;

[0018] The target policy update message is pushed to the switch so that the switch updates the address of the next hop to the latest address;

[0019] Receive the update completion message sent by the switch.

[0020] As an optional implementation of this application, the method further includes:

[0021] Receive a firewall removal message sent by the target firewall instance; the firewall removal message instructs the switch to leave the next-hop address vacant;

[0022] The firewall removal message is pushed to the switch;

[0023] Receive the idle processing completed message sent by the switch.

[0024] Secondly, embodiments of this application provide a method for information exchange between a firewall and a switch, applied to a switch, the method comprising:

[0025] Obtain policy configuration information; the policy configuration information instructs the switch to register with the registration group; the policy configuration information includes the instance identifier of the target firewall instance and the registration purpose;

[0026] Based on the policy configuration information, a second registration request is generated;

[0027] Based on the registration purpose in the policy configuration information, a registration service module is determined, and a second registration request is sent to the registration service module; so that the registration service module adds the switch as a message receiver to the target registration group based on the second registration request, and enables the target firewall instance and the switch to interact with each other through the registration group.

[0028] As an optional implementation of this application, the method further includes:

[0029] Receive a target policy update message; the target policy update message carries the latest address indicating the next hop of the switch;

[0030] In response to the target policy update message, the address of the next hop is updated to the latest address, and after the update is completed, an update completion message is sent to the registration service module.

[0031] As an optional implementation of this application, the method further includes:

[0032] Receive the firewall removal message sent by the target firewall instance;

[0033] In response to the firewall deletion message sent by the target firewall instance, the next-hop address is left empty, and after the emptying process, an emptying completion message is sent to the registration service module.

[0034] Thirdly, embodiments of this application provide an information exchange device between a firewall and a switch, serving a registration service module in a target cluster, the device comprising:

[0035] The receiving unit is configured to receive a first registration request sent by the target firewall instance; the first registration request carries the instance identifier of the target firewall instance;

[0036] A creation unit is configured to, in response to the first registration request, create a target registration group and add the target firewall instance as a message publisher to the target registration group; the target registration group is named after the instance identifier of the target firewall instance;

[0037] The receiving unit is further configured to receive a second registration request sent by the switch; the second registration request carries the identifier of the target firewall instance;

[0038] A determining unit, configured to determine the target registration group by means of the instance identifier in response to the second registration request;

[0039] The adding unit is used to add the switch as a message receiver to the target registration group after the target registration group is determined, so that the target firewall instance and the switch can interact with each other through the registration group.

[0040] As an optional implementation of this application, the adding unit is specifically used to establish a communication connection between the target firewall instance and the switch in the target registration group through a publish-subscriber pattern, so that the target firewall instance and the switch can interact with each other.

[0041] As an optional implementation of this application, the receiving unit is specifically configured to receive a target policy update message sent by the target firewall instance; the target policy update message carries the latest address indicating the next hop of the switch; push the target policy update message to the switch so that the switch updates the address of the next hop to the latest address; and receive an update completion message sent by the switch.

[0042] As an optional implementation of this application, the receiving unit is specifically used to receive a wall removal message sent by the target firewall instance; the wall removal message instructs the switch to vacate the next-hop address; push the wall removal message to the switch; and receive a vacancy processing completion message sent by the switch.

[0043] Fourthly, embodiments of this application provide an information exchange device between a firewall and a switch, serving a registration service module in a target cluster. The device includes:

[0044] The acquisition unit is used to acquire policy configuration information; the policy configuration information instructs the switch to register a registration group; the policy configuration information includes the instance identifier of the target firewall instance and the registration purpose;

[0045] The generation unit is used to generate a second registration request based on the policy configuration information;

[0046] The determining unit is configured to determine the registration service module based on the registration purpose in the policy configuration information, and send the second registration request to the registration service module; so that the registration service module adds the switch as a message receiver to the target registration group based on the second registration request, and enables the target firewall instance and the switch to interact with each other through the registration group.

[0047] As an optional implementation of this application, the information interaction device 700 between the firewall and the switch further includes a receiving unit, specifically used to receive a target policy update message; the target policy update message carries the latest address indicating the next hop of the switch; in response to the target policy update message, the address of the next hop is updated to the latest address, and after the update is completed, an update completion message is sent to the registration service module.

[0048] As an optional implementation of this application, the receiving unit is further configured to receive a firewall deletion message sent by the target firewall instance; push the firewall deletion message to the switch based on the firewall deletion message sent by the target firewall instance; the firewall deletion instruction instructs the switch to vacate the next-hop address; in response to the firewall deletion message sent by the target firewall instance, vacate the next-hop address, and after vacating, send a vacating completion message to the registration service module.

[0049] Fifthly, embodiments of this application provide an electronic device, including: a memory and a processor, wherein the memory is used to store a computer program; and the processor is used to, when executing the computer program, cause the electronic device to implement the information interaction method between a firewall and a switch as described in any of the above embodiments.

[0050] Sixthly, embodiments of this application provide a computer-readable storage medium storing a computer program that, when executed by a computing device, causes the computing device to implement the information exchange method between a firewall and a switch as described in any of the preceding embodiments.

[0051] The method for information interaction between a firewall and a switch provided in this application embodiment specifically includes: receiving a first registration request sent by a target firewall instance; the first registration request carrying an instance identifier of the target firewall instance; in response to the first registration request, creating a target registration group and adding the target firewall instance as a message publisher to the target registration group; the target registration group being named after the instance identifier of the target firewall instance; receiving a second registration request sent by a switch; the second registration request carrying the target firewall instance identifier; in response to the second registration request, determining the target registration group through the instance identifier; after determining the target registration group, adding the switch as a message receiver to the target registration group, so that the target firewall instance and the switch can interact with each other through the registration group. This application creates a target registration group and names it after the instance identifier of the target firewall instance. Then, it adds the target firewall instance and the switch to the same target registration group using the instance identifier. Within this group, the target firewall instance acts as the message publisher, and the switch as the message receiver. This allows communication between the target firewall instance and the switch to be established through the target registration group, facilitating the dynamic distribution of relevant policies from the target firewall instance to the switch. Therefore, it eliminates the need to modify the firewall instance's resource scheduling method to DaemonSet, thereby reducing the number of firewall instance replicas, minimizing server resource consumption, and improving physical resource utilization. Attached Figure Description

[0052] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0053] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the accompanying drawings that need to be called in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0054] Figure 1 This application provides an overall architecture diagram of a method for information exchange between a firewall and a switch, as illustrated in the embodiments of this application.

[0055] Figure 2 A flowchart illustrating the steps of a method for information exchange between a firewall and a switch, provided in an embodiment of this application;

[0056] Figure 3 This is one of the flowcharts illustrating the interaction steps of a method for information exchange between a firewall and a switch, provided in an embodiment of this application.

[0057] Figure 4 The second flowchart of the interaction steps of the information exchange method between a firewall and a switch provided in the embodiments of this application;

[0058] Figure 5 The third flowchart of the interaction steps of the information exchange method between a firewall and a switch provided in the embodiments of this application;

[0059] Figure 6 This is a schematic diagram of the structure of an information interaction device between a firewall and a switch provided in an embodiment of this application;

[0060] Figure 7 This is a schematic diagram of the structure of an information interaction device between a firewall and a switch provided in an embodiment of this application;

[0061] Figure 8 This is a schematic diagram of the hardware structure of the electronic device provided in the embodiments of this application. Detailed Implementation

[0062] To better understand the above-mentioned objectives, features, and advantages of this disclosure, the solutions disclosed herein will be further described below. It should be noted that, unless otherwise specified, the embodiments and features described herein can be combined with each other.

[0063] Numerous specific details are set forth in the following description in order to provide a full understanding of this disclosure, but this disclosure may also be implemented in other ways different from those described herein; obviously, the embodiments in the specification are only some, and not all, of the embodiments of this disclosure.

[0064] In the embodiments of this application, the terms "exemplary" or "for example" are used to indicate examples, illustrations, or explanations. Any embodiment or design described as "exemplary" or "for example" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or design solutions. Specifically, the use of terms such as "exemplary" or "for example" is intended to present the relevant concepts in a specific manner. Furthermore, in the description of the embodiments of this application, unless otherwise stated, "multiple" means two or more.

[0065] It should be noted that, in this document, the term "comprising" or any other variation thereof is intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0066] In the embodiments of this application, reference is made to Figure 1 The diagram shown is an overall architecture diagram of an information interaction method between a firewall and a switch provided in this application. It includes a firewall instance 11, a registration service module 12, and a switch 13. Specifically, the target firewall instance 11 and the registration service module 12 are both created in a target cluster 100, such as a Kubernetes cluster (an open-source container orchestration platform used for automated deployment, scaling, and management of containerized applications, abbreviated as K8s). Furthermore, the firewall instance 11 inside the cluster establishes a communication connection with the switch 13 outside the cluster through the registration service module 12, so that the traffic redirection policy of the firewall instance 11 is pushed to the switch 13 in a timely manner through the registration service module 12, and the switch 13 performs operations such as updating the next-hop address of the traffic redirection policy.

[0067] This application provides a method for information exchange between a firewall and a switch, applied to a registration service module in a target cluster, as described above. Figure 2 As shown, the method for information exchange between the firewall and the switch includes the following steps S201-S205:

[0068] S201. Receive the first registration request sent by the target firewall instance.

[0069] The first registration request carries the instance identifier of the target firewall instance.

[0070] Specifically, a firewall instance, as a network security system, is designed to monitor and control network traffic, deciding whether to allow data packet transmission based on predefined security rules. Its main function is to protect internal networks from external threats, prevent unauthorized access, and establish a security barrier between the corporate network and the internet. By filtering traffic, blocking malicious attacks, and logging network activity, firewalls effectively improve network security and stability. As the first line of defense in network security, firewalls play a crucial role in the network environments of enterprises, institutions, and individual users.

[0071] It should be noted that the target cluster is the aforementioned K8s cluster. Developers will first create the Pod corresponding to the target firewall instance in the K8s cluster and incubate the registration service module in the K8s cluster. Specifically, the registration service module provides services to other devices outside the cluster through the Service provided in the K8s cluster, such as providing registration services to switches, etc.

[0072] In this embodiment of the application, the target firewall instance Pod can send the first registration request to the registration service module to request the creation of a registration group named after the target firewall instance identifier, and to create a corresponding group service for the registration group; wherein, the group service is a series of services provided for the registration group; these services may include functions such as registration, query, and management to meet the needs of entities in the registration group.

[0073] S202. In response to the first registration request, create a target registration group and add the target firewall instance as a message publisher to the target registration group.

[0074] The target registration group is named using the instance identifier of the target firewall instance.

[0075] In some embodiments, after the firewall instance and registration service module in the target cluster are successfully created, the target firewall instance will automatically initiate the first registration request to the registration service module. Specifically, the first registration request will carry the target firewall instance identifier, so that the target firewall instance identifier can be used as the name of the target registration group. After the target registration group is created, the target firewall instance can be added to the target registration group as a message publisher.

[0076] It should be noted that registration groups are typically used to manage and coordinate different components, including message publishers and message receivers. Specifically, message publishers and receivers can be registered in the same registration group to enable message publishing and receiving. Registration groups provide a centralized management and coordination mechanism for message passing, enabling different components in the system to communicate and collaborate effectively. Therefore, in this application, to ensure that the dynamic traffic redirection strategy of the firewall instance can reach the switch in a timely manner, the firewall instance, as the message publisher, and the switch, as the message receiver, are both registered in the target registration group to establish a communication connection between the firewall instance and the switch. This eliminates the need to deploy multiple copies of the firewall, reducing the utilization of physical resources.

[0077] S203, Receive the second registration request sent by the switch.

[0078] The second registration request carries the identifier of the target firewall instance.

[0079] In some embodiments, since the second registration request carries the target firewall instance identifier, the corresponding target registration group can be found in the registration service module, which facilitates the subsequent addition of the switch as a message receiver to the target registration group.

[0080] S204. In response to the second registration request, the target registration group is determined by the instance identifier.

[0081] Specifically, after receiving the second registration request sent from the switch, the second registration request will be parsed immediately to obtain the target firewall instance identifier carried in the second registration request, and the target registration group will be found in the registration service module using the target firewall instance identifier.

[0082] S205. After determining the target registration group, add the switch as a message receiver to the target registration group so that the target firewall instance and the switch can interact with each other through the registration group.

[0083] In some embodiments, after the target registration group is determined using the target firewall instance identifier, the switch can be added to the target registration group as a message receiver. The target registration group includes both the firewall instance as a message publisher and the switch as a message receiver, thereby establishing a communication connection between the firewall instance and the switch through the target registration group.

[0084] The method for information interaction between a firewall and a switch provided in this application embodiment specifically includes: receiving a first registration request sent by a target firewall instance; the first registration request carrying an instance identifier of the target firewall instance; in response to the first registration request, creating a target registration group and adding the target firewall instance as a message publisher to the target registration group; the target registration group being named after the instance identifier of the target firewall instance; receiving a second registration request sent by a switch; the second registration request carrying the target firewall instance identifier; in response to the second registration request, determining the target registration group through the instance identifier; after determining the target registration group, adding the switch as a message receiver to the target registration group, so that the target firewall instance and the switch can interact with each other through the registration group. This application creates a target registration group and names it after the instance identifier of the target firewall instance. Then, it adds the target firewall instance and the switch to the same target registration group using the instance identifier. Within this group, the target firewall instance acts as the message publisher, and the switch as the message receiver. This allows communication between the target firewall instance and the switch to be established through the target registration group, facilitating the dynamic distribution of relevant policies from the target firewall instance to the switch. Therefore, it eliminates the need to modify the firewall instance's resource scheduling method to DaemonSet, thereby reducing the number of firewall instance replicas, minimizing server resource consumption, and improving physical resource utilization.

[0085] As an extension and refinement of the above embodiments, this application provides another method for information exchange between a firewall and a switch, referring to... Figure 3 As shown, the method for information exchange between the firewall and the switch includes the following steps S301-S308:

[0086] S301. The registration service module receives the first registration request sent by the target firewall instance.

[0087] The first registration request carries the instance identifier of the target firewall instance.

[0088] S302. In response to the first registration request, the registration service module creates a target registration group and adds the target firewall instance as a message publisher to the target registration group.

[0089] The target registration group is named using the instance identifier of the target firewall instance.

[0090] S303, the switch obtains policy configuration information.

[0091] The policy configuration information instructs the switch to register with the registration group, and the policy configuration information includes the instance identifier of the target firewall instance and the registration purpose.

[0092] In some embodiments, developers may pre-obtain the firewall instance identifier corresponding to the firewall instance and add the firewall instance identifier to the policy configuration information. When the switch requests registration from the registration service module according to the policy configuration information, it can also find the registration group where the target firewall instance is located through the instance identifier of the target firewall instance, add the switch to the registration group, and then establish a communication connection between the target firewall instance and the switch through the registration group.

[0093] Specifically, the policy configuration information includes: the purpose of registration can be understood as instructing the switch to request registration of the target object. In this embodiment, the policy configuration information also includes the IP address and port corresponding to the registration service module; this is because the target object requested for registration by the switch is the registration service module; since the registration service module is incubated in a K8s cluster, and the registration service module needs to provide registration services to switches outside the cluster, it needs to use the IP address and port provided by the K8s cluster to provide services to the outside world, and then establish a communication connection between the switch and the registration service module through the IP address and port corresponding to the registration service module in the cluster. The policy configuration information also includes specified fields that need to be extracted from the target policy update message when interacting with the target firewall instance, such as the field containing the latest address of the next hop.

[0094] It should be noted that when the switch requests registration from the registration service module, the switch's relevant information also needs to be authenticated. Only after successful authentication can the subsequent registration be completed. The policy configuration information may also include other information, which this application does not specifically limit.

[0095] S304. The switch generates a second registration request based on the policy configuration information.

[0096] Specifically, based on the registration purpose in the policy configuration information, the switch can determine whether it needs to send the second registration request to the registration service module.

[0097] S305. The switch determines the registration service module according to the registration purpose in the policy configuration information, and sends the second registration request to the registration service module; so that the registration service module adds the switch as a message receiver to the target registration group based on the second registration request, and enables the target firewall instance and the switch to interact with each other through the registration group.

[0098] S306. The registration service module receives the second registration request sent by the switch.

[0099] The second registration request carries the identifier of the target firewall instance.

[0100] S307. In response to the second registration request, the registration service module determines the target registration group through the instance identifier.

[0101] S308. After determining the target registration group, the registration service module adds the switch as a message receiver to the target registration group, so that the target firewall instance and the switch can interact with each other through the registration group.

[0102] Specifically, in the target registration group, a communication connection is established between the target firewall instance and the switch through the publish-subscriber pattern, so that the target firewall instance and the switch can interact with each other.

[0103] This application creates a target registration group and names the target registration group as the instance identifier of the target firewall instance. Then, the target firewall instance and the switch are added to the same target registration group through the instance identifier of the target firewall instance. In this target registration group, the target firewall instance is the message publisher and the switch is the message receiver. This allows a communication connection to be established between the target firewall instance and the switch through the target registration group, facilitating the dynamic distribution of relevant policies of the target firewall instance to the switch.

[0104] As an extension and refinement of the above embodiments, refer to Figure 4 As shown in the embodiments of this application, the specific information interaction process of the information interaction method between the firewall and the switch includes the following steps:

[0105] S401. The registration service module receives the target policy update message sent by the target firewall instance.

[0106] The target policy update message carries the latest address indicating the next hop of the switch.

[0107] In some embodiments, firewall instances often encounter restarts or other reasons, causing the server originally used by the firewall instance Pod to become unusable. Consequently, a new server needs to be rescheduled for the firewall instance Pod to use. Since the server has changed, the next-hop address of the switch needs to be updated to the physical node IP information corresponding to the latest server. That is, the latest address of the next hop is the physical node IP information corresponding to the latest server of the target firewall instance. This allows the switch to continue forwarding subsequent traffic to the current firewall instance through the physical node IP information corresponding to the latest server.

[0108] It should be noted that when the physical node IP information corresponding to the server of the firewall instance is updated, the firewall instance will actively report the message, namely the target policy update message, to the registration service module, informing the registration service module that its server has been moved and that it needs to instruct the corresponding switch to update the next-hop address.

[0109] S402. The registration service module pushes the target policy update message to the switch so that the switch updates the next hop address to the latest address.

[0110] Specifically, after receiving the target policy update message sent by the target firewall instance, the target policy update message needs to be pushed to the switch immediately. Specifically, since the target firewall instance is the message publisher and the switch is the message receiver in the same registration group, the target policy update message can be pushed to the switch based on the publish-subscriber pattern.

[0111] S403, The switch receives the target policy update message.

[0112] The target policy update message carries the latest address indicating the next hop of the switch.

[0113] S404. In response to the target policy update message, the switch updates the address of the next hop to the latest address, and after the update is completed, sends an update completion message to the registration service module.

[0114] Specifically, after receiving the target policy update message, the switch first parses the message to obtain the latest address of its next hop, and then updates the next hop address to the latest address. After updating the next hop address, the switch needs to send a feedback message, i.e., an update completion message, to the registration service module to inform it that the next hop address update has been completed.

[0115] S405. The registration service module receives the update completion message sent by the switch.

[0116] This application embodiment, through the above method, can promptly distribute the target policy update message sent by the target firewall instance to the switch via the registration service module, thereby achieving dynamic delivery of the target policy update message of the target firewall instance to the switch.

[0117] As an extension and refinement of the above embodiments, refer to Figure 5 As shown in the embodiments of this application, the specific information interaction process of the information interaction method between the firewall and the switch includes the following steps:

[0118] S501. The registration service module receives the firewall removal message sent by the target firewall instance.

[0119] The wall removal message instructs the switch to leave the next-hop address vacant.

[0120] In some embodiments, after the current target firewall instance has been used, a wall removal operation needs to be performed on the current target firewall instance. Therefore, it is necessary to inform the switch that the target firewall instance is about to perform a wall removal operation so that the switch can leave the next-hop address empty, i.e., no further next-hop will be established. Therefore, before performing the wall removal operation on the target firewall instance, the target firewall instance will proactively notify the registration service module so that the registration service module can push the wall removal operation information to the switch.

[0121] S502, The registration service module pushes the firewall deletion message to the switch.

[0122] Specifically, after receiving the firewall deletion message sent by the target firewall instance, the firewall deletion message sent by the target firewall instance needs to be pushed to the switch immediately. Specifically, since the target firewall instance is the message publisher and the switch is the message receiver in the same registration group, the firewall deletion message can be pushed to the switch based on the publish-subscriber pattern.

[0123] S503: The switch receives a firewall removal message sent by the target firewall instance.

[0124] S504. In response to the firewall deletion message sent by the target firewall instance, the switch vacates the next-hop address and sends a vacancy completion message to the registration service module after vacancy processing.

[0125] Specifically, after receiving the firewall deletion message from the target firewall instance, the switch can clearly determine that the target firewall instance is about to be deleted. This means the switch's next hop no longer needs to forward traffic to the physical node address of the server originally corresponding to the target firewall instance. At this point, the next hop address can be left empty, and no further execution of the next hop is required. After the switch leaves the next hop address empty, it needs to send a feedback message to the registration service module, namely the "emptying process complete" message, to inform the registration service module that the next hop emptying process has been completed.

[0126] S505, The registration service module receives the idle processing completion message sent by the switch.

[0127] This application embodiment, through the above method, can promptly distribute the firewall deletion message sent by the target firewall instance to the switch via the registration service module, thereby dynamically delivering the firewall deletion message of the target firewall instance to the switch.

[0128] Based on the same inventive concept, as an implementation of the above method, this application embodiment also provides an information interaction device between a firewall and a switch. This embodiment corresponds to the aforementioned method embodiment. For ease of reading, this embodiment will not repeat the details of the aforementioned method embodiment one by one, but it should be clear that the information interaction device between a firewall and a switch in this embodiment can correspondingly implement all the contents of the aforementioned method embodiment.

[0129] This application provides an apparatus for information exchange between a firewall and a switch. Figure 6 This is a schematic diagram of the structure of the information exchange device between the firewall and the switch, as shown below. Figure 6 As shown, the information exchange device 600 between the firewall and the switch includes:

[0130] The receiving unit 601 is configured to receive a first registration request sent by the target firewall instance; the first registration request carries the instance identifier of the target firewall instance;

[0131] Creation unit 602 is used to respond to the first registration request, create a target registration group, and add the target firewall instance as a message publisher to the target registration group; the target registration group is named with the instance identifier of the target firewall instance;

[0132] The receiving unit 601 is further configured to receive a second registration request sent by the switch; the second registration request carries the target firewall instance identifier;

[0133] The determining unit 603 is configured to determine the target registration group by means of the instance identifier in response to the second registration request;

[0134] The adding unit 604 is used to add the switch as a message receiver to the target registration group after the target registration group is determined, so that the target firewall instance and the switch can interact with each other through the registration group.

[0135] As an optional implementation of this application, the adding unit 604 is specifically used to establish a communication connection between the target firewall instance and the switch in the target registration group through a publish-subscriber pattern, so that the target firewall instance and the switch can interact with each other.

[0136] As an optional implementation of this application, the receiving unit 601 is specifically used to receive a target policy update message sent by the target firewall instance; the target policy update message carries the latest address for indicating the next hop of the switch; push the target policy update message to the switch so that the switch updates the address of the next hop to the latest address; and receive an update completion message sent by the switch.

[0137] As an optional implementation of this application, the receiving unit 601 is specifically used to receive a wall removal message sent by the target firewall instance; the wall removal message instructs the switch to vacate the next-hop address; push the wall removal message to the switch; and receive a vacancy processing completion message sent by the switch.

[0138] This application also provides another device for information exchange between a firewall and a switch. Figure 7 This is a schematic diagram of the structure of the information exchange device between the firewall and the switch, as shown below. Figure 7 As shown, the information exchange device 700 between the firewall and the switch includes:

[0139] The acquisition unit 701 is used to acquire policy configuration information; the policy configuration information instructs the switch to register a registration group; the policy configuration information includes the instance identifier of the target firewall instance and the registration purpose;

[0140] The generation unit 702 is used to generate a second registration request based on the policy configuration information;

[0141] The determining unit 703 is configured to determine the registration service module according to the registration purpose in the policy configuration information, and send the second registration request to the registration service module; so that the registration service module adds the switch as a message receiver to the target registration group based on the second registration request, and enables the target firewall instance and the switch to interact with each other through the registration group.

[0142] As an optional implementation of this application, the information interaction device 700 between the firewall and the switch further includes a receiving unit, specifically used to receive a target policy update message; the target policy update message carries the latest address indicating the next hop of the switch; in response to the target policy update message, the address of the next hop is updated to the latest address, and after the update is completed, an update completion message is sent to the registration service module.

[0143] As an optional implementation of this application, the receiving unit is further configured to receive a firewall deletion message sent by the target firewall instance; push the firewall deletion message to the switch based on the firewall deletion message sent by the target firewall instance; the firewall deletion instruction instructs the switch to vacate the next-hop address; in response to the firewall deletion message sent by the target firewall instance, vacate the next-hop address, and after vacating, send a vacating completion message to the registration service module.

[0144] Based on the same inventive concept, this disclosure also provides an electronic device. Figure 8 This is a schematic diagram of the structure of the electronic device provided in the embodiments of this disclosure, such as... Figure 8 As shown, the electronic device provided in this embodiment includes a memory 801 and a processor 802. The memory 801 is used to store computer programs; the processor 802 is used to execute the information interaction method between the firewall and the switch provided in the above embodiment when executing the computer program.

[0145] Based on the same inventive concept, embodiments of this application also provide a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, it enables the computing device to implement the information interaction method between a firewall and a switch provided in the above embodiments.

[0146] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product implemented on one or more computer-usable storage media containing computer-usable program code.

[0147] The processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor can be a microprocessor or any conventional processor.

[0148] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0149] Computer-readable media include both permanent and non-permanent, removable and non-removable storage media. Storage media can store information using any method or technology; the information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0150] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

Claims

1. A method for information exchange between a firewall and a switch, characterized in that, The method, applied to the registration service module in the target cluster, includes: Receive a first registration request sent by the target firewall instance; the first registration request carries the instance identifier of the target firewall instance; In response to the first registration request, a target registration group is created, and the target firewall instance is added to the target registration group as a message publisher; the target registration group is named after the instance identifier of the target firewall instance. Receive a second registration request sent by the switch; the second registration request carries the target firewall instance identifier; In response to the second registration request, the target registration group is determined by the instance identifier; After determining the target registration group, the switch is added to the target registration group as a message receiver, so that the target firewall instance and the switch can interact with each other through the target registration group.

2. The method according to claim 1, characterized in that, After determining the target registration group, and adding the switch as a message receiver to the target registration group, the method includes: In the target registration group, a communication connection is established between the target firewall instance and the switch through the publish-subscriber pattern, so that the target firewall instance and the switch can interact with each other.

3. The method according to any one of claims 1-2, characterized in that, The method further includes: Receive a target policy update message sent by the target firewall instance; the target policy update message carries the latest address indicating the next hop of the switch; The target policy update message is pushed to the switch so that the switch updates the address of the next hop to the latest address; Receive the update completion message sent by the switch.

4. The method according to any one of claims 1-2, characterized in that, The method further includes: Receive a firewall removal message sent by the target firewall instance; the firewall removal message instructs the switch to leave the next-hop address vacant; The firewall removal message is pushed to the switch; Receive the idle processing completed message sent by the switch.

5. A method for information exchange between a firewall and a switch, characterized in that, Applied to a switch, the method includes: Obtain policy configuration information; the policy configuration information instructs the switch to register with the registration group; the policy configuration information includes the instance identifier of the target firewall instance and the registration purpose; Based on the policy configuration information, a second registration request is generated; Based on the registration purpose in the policy configuration information, a registration service module is determined, and a second registration request is sent to the registration service module; so that the registration service module adds the switch as a message receiver to the target registration group based on the second registration request, and enables the target firewall instance and the switch to interact with each other through the target registration group.

6. The method according to claim 5, characterized in that, The method further includes: Receive a target policy update message; the target policy update message carries the latest address indicating the next hop of the switch; In response to the target policy update message, the address of the next hop is updated to the latest address, and after the update is completed, an update completion message is sent to the registration service module.

7. The method according to claim 5, characterized in that, The method further includes: Receive the firewall removal message sent by the target firewall instance; In response to the firewall deletion message sent by the target firewall instance, the next-hop address is left empty, and after the emptying process, an emptying completion message is sent to the registration service module.

8. A device for information exchange between a firewall and a switch, characterized in that, The device includes a registration service module serving the target cluster, comprising: The receiving unit is configured to receive a first registration request sent by the target firewall instance; the first registration request carries the instance identifier of the target firewall instance; A creation unit is configured to, in response to the first registration request, create a target registration group and add the target firewall instance as a message publisher to the target registration group; the target registration group is named after the instance identifier of the target firewall instance; The receiving unit is further configured to receive a second registration request sent by the switch; the second registration request carries the identifier of the target firewall instance; A determining unit, configured to determine the target registration group by means of the instance identifier in response to the second registration request; The adding unit is used to add the switch as a message receiver to the target registration group after the target registration group is determined, so that the target firewall instance and the switch can interact with each other through the target registration group.

9. A device for information exchange between a firewall and a switch, characterized in that, Serving a switch, the device includes: The acquisition unit is used to acquire policy configuration information; the policy configuration information instructs the switch to register a registration group; the policy configuration information includes the instance identifier of the target firewall instance and the registration purpose; The generation unit is used to generate a second registration request based on the policy configuration information; The determining unit is configured to determine the registration service module based on the registration purpose in the policy configuration information, and send the second registration request to the registration service module; so that the registration service module adds the switch as a message receiver to the target registration group based on the second registration request, and enables the target firewall instance and the switch to interact with each other through the target registration group.

10. An electronic device, characterized in that, include: A memory and a processor, the memory being used to store a computer program; the processor being used to cause the electronic device to implement, when executing the computer program, the information exchange method between a firewall and a switch as described in any one of claims 1-4 or 5-7.

11. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a computing device, causes the computing device to implement the information exchange method between a firewall and a switch as described in any one of claims 1-4 or 5-7.

Images