A method and system for constructing a virtual management network in a network range

Abstract

The present invention discloses a method and system for constructing a virtual management network in a network range. The method comprises: creating an external management network switch and an external core router; creating an internal service network switch of a topology instance; creating the internal management network switch of the topology instance, each internal service network switch corresponding to an internal management network switch, each internal management network switch corresponding to a virtual configuration collection agent node and a traffic generator; creating an internal core router according to the number of nodes accessed by the internal management network switch; enabling SNAT on the port connecting the internal core router and the external core router, and setting ACL rules on the internal management network switch. The present invention completely separates signaling traffic from the direct service traffic network routing of the service nodes in the range topology instance, improves the efficiency of receiving and responding to signaling traffic, and achieves load balancing.

Description

Technical Field

[0001] The present invention relates to a method and system for constructing a virtual management network in a network range, and belongs to the technical field of network security. Background Art

[0002] A cyber range is a simulation of a real-world network environment based on virtualization technology. It serves as a platform for cybersecurity technology verification, cyber weapon and equipment testing, offensive and defensive confrontation exercises, and network risk assessment. After a topology is built within the range, management operations such as network configuration, information collection, and traffic generation are required for the virtual machine instances within the topology. These operations require a pre-established virtual management network to route signaling traffic from the external network to the designated internal virtual machines. Existing cyber range management operations suffer from the following deficiencies:

[0003] 1. The network routing for signaling traffic used for management operations is not completely independent of the network routing for service traffic between topology instance nodes. Service traffic between instance nodes can affect the reception and response of signaling traffic, which can easily cause management operation execution anomalies.

[0004] 2. Topology instance nodes can attack the range platform through the virtual management network, and abnormal traffic can be sent to the range platform, which can easily cause instability of the range platform.

[0005] 3. The virtual management network does not perform load balancing for large-scale networks, and the reception and transmission of signaling traffic are prone to single point failures, causing abnormal execution of management operations. Summary of the Invention

[0006] Purpose of the invention: In response to the problems existing in the above-mentioned prior art, the purpose of the present invention is to provide a method and system for constructing a virtual management network in a network target range, which supports routing the signaling traffic for management operations sent by the target range platform that is connected to the external network to the specific topology instance node, and completes various node instance management operations performed after the topology instance is constructed, so as to achieve complete separation of the signaling traffic and the direct business traffic network routing of the business nodes in the target range topology instance, thereby improving the efficiency of signaling traffic reception and response and achieving load balancing.

[0007] Technical solution: To achieve the above-mentioned purpose, the present invention adopts the following technical solution:

[0008] A method for constructing a virtual management network in a network range includes the following steps:

[0009] Create an external management network switch and an external core router; the range platform and the external core router are connected to the external management network switch, and the external core router is used to route between the management network inside the topology instance and the external range platform network;

[0010] Create business network switches within the topology instance. Each business network switch corresponds to an independent business subnet within the topology instance. The network segment of the business subnet is randomly selected from a preset range.

[0011] Create an internal management network switch for the topology instance, where each internal business network switch corresponds to an internal management network switch, and each internal management network switch corresponds to an internal proxy node for management operations; the internal proxy node includes a virtual configuration collection proxy node and / or a traffic generator; the network segment of each internal management network switch is calculated based on the network segment of the corresponding internal business network switch; when creating a virtual business node in each topology instance, it needs to be connected to the corresponding internal business network switch and the internal management network switch corresponding to the internal business network switch;

[0012] Creating an internal core router according to the number of nodes connected to the internal management network switch, and connecting the internal core router to the external core router;

[0013] The port connecting the internal core router and the external core router opens SNAT, the virtual configuration collection agent node and the traffic generator set the default route, and the gateway is the port IP connecting the internal core router and the external core router;

[0014] The internal management network switch sets ACL rules to only allow internal proxy nodes to communicate with the range platform.

[0015] As a preferred option, a random algorithm for obtaining a network segment for a service subnet is as follows:

[0016] Using Set <e>Record the subnet value that has been assigned to the current topology, Lock <Set <e>>Assign a lock to the business subnet of the topology instance;

[0017] Determine the current network subnet value Vcidr based on the value obtained by the random function;

[0018] Waiting to acquire the lock;

[0019] Check Set <e>Whether it contains the current network subnet value Vcidr. If it does, Vcidr = Vcidr + 1 until Vcidr does not exist in Set <e>middle;

[0020] Add Vcidr to Set <e>After the middle, release the lock;

[0021] The network segment of the current service subnet is "A." + IntToStr((Vcidr>>8)&0xFF+128)+".." + IntToStr(Vcidr&0xFF)+".." + "0 / 24", where A is a preset fixed value.

[0022] Preferably, if the network segment corresponding to a service network switch is Abc0 / 24, then the network segment of the corresponding internal management network switch is A.(b-128).c.0 / 24.

[0023] As a preferred method, the algorithm for creating an internal core router based on the number of nodes connected to the internal management network switch is as follows:

[0024] Using Set <n>Store the number of nodes connected to each internal management network switch, using Map<M,I> Record the mapping relationship between the internal management network switches and their internal core router labels. The current internal core router is labeled R, with an initial value of 0. The current total number of nodes is labeled C, with an initial value of 0. Assume that a fixed T-station access node is assigned an internal core router.

[0025] Iterating over a Set <n>, for one of the elements Nx, make the following judgment:

[0026] If Nx > T / 2, Map<M, I> records key = x, value = R; R = R + 1;

[0027] If Nx < T / 2, C = C + Nx. If C < T, Map<M, I> records key = x, value = R; if C > T, Map<M, I> records key = x, value = R + 1; C = 0, R = R + 1.

[0028] Preferably, when connecting the internal core router and the external core router, allocate the network segments occupied by the connection lines according to the following algorithm:

[0029] Use the set Set <r>Record the connection subnet value that has been allocated to the current range platform, Lock <Set <r>>Assign a lock to the subnet segment of the range platform;

[0030] Determine the current network subnet value Vcidr based on the value obtained by the random function;

[0031] Waiting to acquire the lock;

[0032] Check Set <r>Whether it contains the current network subnet value Vcidr. If it does, Vcidr = Vcidr + 1 until Vcidr does not exist in Set <r>middle;

[0033] Add Vcidr to Set <r>After the middle, release the lock;

[0034] The current network segment is "B." + IntToStr((Vcidr>>14)&0xFF)+"."+

[0035] IntToStr((Vcidr>>6)&0xFF)+".”+IntToStr((Vcidr&0xFC)<<2)+" / 30"; where B is a preset fixed value.

[0036] As a preference, the virtual configuration collection agent node and traffic generator actively request the range platform to obtain the task order generated by the user management operation through regular polling and reverse connection mechanism, specifically including:

[0037] The internal core router turns on SNAT, and the network where the port connected to the external core router is located is the external network of SNAT, and the other ports are all internal networks;

[0038] Each internal proxy node sets a default route, and the gateway is the internal core router connected to the internal management network switch to which it is connected. The internal proxy node refers to the virtual configuration collection proxy node and the traffic generator;

[0039] Internal proxy nodes periodically send heartbeats to the range platform, carrying the unique ID of the internal management network switch to which they belong and their own proxy type;

[0040] When the range platform receives a heartbeat request from the internal proxy node of the topology instance, it will obtain the ID and proxy type carried in the request. If a user operates on the range platform and issues a task to the internal node of the specified range instance, the range platform will generate a task order.

[0041] Preferably, the task list fields include the node ID, the node management IP, the unique ID of the internal management network switch to which the node is connected, the agent type that actually performs the management operation, the content of the management operation performed, and the task list status.

[0042] A virtual management network construction system in a network range, comprising:

[0043] A pre-creation module is used to create an external management network switch and an external core router; the range platform and the external core router are connected to the external management network switch, and the external core router is used to route between the management network inside the topology instance and the external range platform network;

[0044] The business network switch creation module is used to create business network switches within the topology instance. Each business network switch corresponds to an independent business subnet within the topology instance. The network segment of the business subnet is randomly selected from a preset range.

[0045] An internal management network switch creation module is used to create an internal management network switch for a topology instance. Each internal business network switch corresponds to an internal management network switch, and each internal management network switch corresponds to an internal proxy node for management operations. The internal proxy node includes a virtual configuration collection proxy node and / or a traffic generator. The network segment of each internal management network switch is calculated based on the network segment of the corresponding internal business network switch. When creating a virtual business node in each topology instance, it is necessary to connect to the corresponding internal business network switch and the internal management network switch corresponding to the internal business network switch.

[0046] An internal core router creation module, configured to create an internal core router according to the number of nodes accessed by the internal management network switch, and connect the internal core router to the external core router;

[0047] A rule configuration module is used to enable SNAT on the port connecting the internal core router and the external core router, set a default route for the virtual configuration collection agent node and the traffic generator, and the gateway is the port IP connecting the internal core router and the external core router; and the internal management network switch sets ACL rules to only allow the internal agent node and the shooting range platform to communicate.

[0048] A computer system includes a memory, a processor, and a computer program / instruction stored in the memory and executable on the processor. When the computer program / instruction is executed by the processor, the steps of a method for constructing a virtual management network in a network range are implemented.

[0049] A computer program product includes a computer program / instruction, which, when executed by a processor, implements the steps of a method for constructing a virtual management network in a network range.

[0050] Beneficial effects: Compared with the prior art, the present invention has the following advantages:

[0051] 1. This invention designs an independent internal virtual management network within the network range, completely separating the signaling traffic used for management operations from the network routing of direct service traffic from the service nodes in the range topology instance. This ensures independent network routing for management signaling traffic, improving the efficiency of receiving and responding to management signaling traffic. This prevents unpredictable service traffic from impacting the normal operation of the range platform management operations.

[0052] 2. The virtual configuration collection agent nodes and traffic generation instruments in the internal virtual management network designed by this invention use a periodic polling and reverse connection mechanism to obtain management operation information issued by the target range platform. Combined with the internal core router's SNAT mechanism, this prevents the internal management network from directly connecting to a pre-created external core router, saving the network segments that the external core router needs to connect to and reducing the routing and forwarding pressure on the external core router. This improves the efficiency of receiving and responding to signaling traffic for management operations.

[0053] 3. The present invention creates corresponding internal virtual management networks according to the number of internal business management networks, effectively achieving the purpose of load balancing of signaling traffic for management operations. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Figure 1 Flowchart of a method according to an embodiment of the present invention.

[0055] Figure 2 A topology example is constructed as shown in the embodiment of the present invention. DETAILED DESCRIPTION

[0056] The technical solution of the present invention will be clearly and completely described below with reference to the accompanying drawings and specific embodiments.

[0057] like Figure 1 As shown, an embodiment of the present invention discloses a method for constructing a virtual management network in a network range, which mainly includes the following steps: first, creating an external management network switch and an external core router, the range platform and the external core router are connected to the external management network switch, and the external core router is used to route between the management network inside the topology instance and the external range platform network; then, creating a business network switch inside the topology instance, each business network switch corresponds to an independent business subnet inside the topology instance; the network segment of the business subnet is randomly selected from a preset range; then, constructing the internal management network of the topology instance, specifically including:

[0058] First, create an internal management network switch for the topology instance. Each internal business network switch corresponds to an internal management network switch, and each internal management network switch corresponds to an internal proxy node for management operations. The internal proxy node includes a virtual configuration collection proxy node and / or a traffic generator. The network segment of each internal management network switch is calculated based on the network segment of the corresponding internal business network switch. When creating a virtual business node in each topology instance, it needs to be connected to the corresponding internal business network switch and the internal management network switch corresponding to the internal business network switch.

[0059] Next, create an internal core router based on the number of nodes connected to the internal management network switch, and connect the internal core router to the external core router;

[0060] Then, SNAT is enabled on the port connecting the internal core router and the external core router. The default route is set for the virtual configuration collection agent node and the traffic generator, and the gateway is the port IP connecting the internal core router and the external core router.

[0061] Finally, ACL rules are set on the internal management network switch to allow only internal agent nodes to communicate with the range platform.

[0062] The method for constructing a virtual management network in a network range, described in an embodiment of the present invention, ensures that the range platform can normally send signaling traffic to topology instance nodes while separating the network routing of signaling traffic from the service traffic between topology instance nodes. Furthermore, network firewall rules are added to implement traffic control between the instance nodes within the topology and the range platform. Furthermore, different numbers of management networks are created based on the number of subnets in different topologies to achieve load balancing of management network signaling traffic and prevent single points of failure from causing global failures.

[0063] Below is Figure 2 Taking the topology example 1 shown in the figure as an example, the detailed design and implementation of the solution of the present invention are specifically described. Figure 2 As shown in topology example 1, seven nodes—virtual node a, service network switch a, virtual node b, virtual service network router, service network switch b, virtual node c, and virtual node d—are the service nodes of topology example 1. These nodes are directly visible to users of the range platform when viewing topology example 1. Internal management network switch a, internal management network switch b, and internal core router represent the management network routers constructed for the service network of topology example 1. Virtual configuration collection agent a and virtual configuration collection agent b are virtual configuration and collection agents corresponding to the management network mapped to the service network in topology example 1. They perform configuration and collection management operations for all service nodes connected to the internal management network switch. Furthermore, each service network switch is connected to a traffic generator, Trex, which performs traffic generation and other traffic management operations for all service nodes connected to the service network switch. All internal management network switches are connected to a single internal core router. The internal core router is connected to a pre-established external core router. SNAT is also enabled to allow all virtual configuration collection agents and the traffic generator, Trex, to proactively report collected data, query configurations, and perform traffic operations to the external range platform.

[0064] The following describes in detail how the virtual management network is constructed along with the topology instance, and how the created virtual management network implements the signaling traffic of the range platform management operation to the virtual configuration collection agent and traffic generating instrument TREX within the range instance.

[0065] Step 1. Create a predefined external management network switch and external core router.

[0066] When installing the Range Platform, we pre-configure a fixed external network switch—the external management network switch. Virtual machines deployed with the Range Platform are permanently connected to the external management network switch. An external core router is also pre-created to route between the management network within the topology instance and the external Range Platform network. Therefore, the external management network switch is also pre-configured to connect to the external core router.

[0067] Step 2. Create the internal service network switch for the topology instance.

[0068] Let's take the business network in topology example 1 in the figure as an example. We'll first create business network switches A and B. Each of these two independent subnets is created. By default, two subnets are randomly selected from the 32,768 subnets between 10.128.0.0 / 24 and 10.255.255.0 / 24. The random algorithm for obtaining a network segment for a business subnet is as follows:

[0069] Step 2.1 Set <e>Record the subnet value assigned to the current topology, for example, {1,2}.

[0070] Lock <Set <e>>Assign a lock to the business subnet of topology instance 1. When setting cidr for all business subnets, you need to obtain Lock first <Set <e>>Lock.

[0071] Step 2.2 calls the Random function, inputs the current time as the seed, and obtains a floating-point number n in the range [0,1].

[0072] In step 2.3, the current network subnet value Vcidr is 32768 multiplied by the random number n obtained in the previous step, and then rounded down.

[0073] Step 2.4 Waiting to obtain Lock <Set <e>>Lock.

[0074] Step 2.5 Check Set <e>Whether to include the current network subnet value Vcidr, if included, Vcidr=

[0075] Vcidr+1, until Vcidr no longer exists in Set <e>For example, if the first random value of Vcidr is 1, 1 is already included in Set <e>Then Vcidr=Vcidr+1=2. 2 is still included in Set <e>In the example, Vcidr=Vcidr+1=3. 3 is not in Set <e>If Vcidr=3, you can proceed to the next step.

[0076] Step 2.6 Add Vcidr to Set <e>After the middle, release the Lock <Set <e>>Lock.

[0077] In step 2.7, the network segment of the current service subnet is "10." + IntToStr((Vcidr>>8)&0xFF+128)+".." + IntToStr(Vcidr&0xFF)+".." + "0 / 24". That is, the first segment of the IPv4 address is fixed to 10. The second segment is Vcidr shifted right by 8 bits, ANDed with 0xFF, and then added to 128. The third segment is Vcidr and 0xFF, ANDed together. The fourth segment is fixed to 0, and the mask is fixed to 24 bits.

[0078] Step 3. Build the internal management network of the topology instance.

[0079] Step 2 has created all the service network switches for the topology instance. The network segment where the switches reside has a default 24-bit mask, supporting up to 254 hosts. A large topology instance may create hundreds or even thousands of service network switches, supporting hundreds of thousands of hosts. To facilitate host information collection, network configuration distribution, and traffic generation, it is not possible for the range platform to directly connect these hosts to the same internal management subnet. First, if all hosts were connected to the same internal management subnet, these machines would initially send ARP broadcast packets, placing significant traffic pressure on the internal management subnet. Furthermore, the large number of hosts in the internal management subnet also resulted in an excessively large ARP cache table for each host. Second, the range platform needs to use this internal management subnet to distribute management signaling for host network configuration, information collection, and traffic routing. All signaling traffic relies on the same internal management subnet, which can easily cause network congestion and signaling traffic transmission and reception failures. Furthermore, if all hosts were connected to the same internal management subnet, hosts could communicate directly with each other, disrupting the logic of the service network in the current topology instance. In this regard, the following internal management network construction plan has been designed specifically.

[0080] Step 3.1 Each internal business network switch corresponds to an internal management network switch, each internal management network switch corresponds to a virtual configuration collection agent node, and each internal management network switch corresponds to a traffic generator trex. The specific steps are as follows:

[0081] Step 3.1.1 Calculate the network segment of the internal management switch based on the network segment of the internal business network switch. According to the internal business switch network calculation algorithm described in Step 2, each business network has a different network segment. Furthermore, the first 9 bits of the IPv4 network segment of all business networks are fixed: the sum of the first 8 bits is 10, and the ninth bit is always 1. For example, if the network segment corresponding to a business network switch is 10.bc0 / 24, then the network segment corresponding to the internal management network switch is 10.(b-128).c.0 / 24. To determine the network segment of a business network switch, simply flip the ninth bit of the network segment from 1 to 0. The remaining 23 bits remain the same, and the mask is always 24 bits.

[0082] In step 3.1.2, when creating a virtual business node in each topology instance, it must be connected to at least two internal network switches: an internal business network switch and the internal management network switch corresponding to this internal business network switch. At the same time, the default route set for the virtual business node should be the route of the business network to which it belongs; there is no need to set a route specifically for the internal management network. This is because the virtual business node will only communicate directly with the virtual configuration collection node and traffic generator (TREX) in the internal management network. Their direct communication is within the same local area network and does not require any routing. For example, virtual node A in topology instance 1 in the figure only requires a default route, and the gateway is the IP address of the port where the virtual business router connects to business network switch A.

[0083] Step 3.1.3 A virtual configuration acquisition agent node is created for each internal management network switch. This node will only connect to its corresponding internal management network switch and will be responsible for the network configuration operations of all business nodes connected to the internal management network switch. For example, in topology instance 1, we need to set the DNS setting of the network card that connects to the internal business network switch for virtual node a to 1.1.1.1. The range platform cannot directly connect to the specified business node in the specified topology instance and issue the configuration. It completes the network configuration by issuing the network configuration information of the business node through the virtual configuration acquisition agent node in the topology instance. For the detailed implementation of the virtual configuration acquisition agent system, please refer to the patent application document CN117857290A "Automatic configuration method and system based on configuration agent in network range".

[0084] In step 3.1.4, each internal management network switch creates a corresponding traffic generator, Trex. This node is connected to both the current internal management network switch and the internal service network switch corresponding to the internal management network switch. It is responsible for executing the actual traffic generation service for all service nodes connected to the internal service network switch. For a detailed description of the specific traffic generation service, please refer to patent document CN117749639B, "A Method and System for Automatically Generating Network Range Traffic."

[0085] Step 3.2: Create an internal core router based on the number of nodes connected to the internal management network switch, and connect the internal core router to the pre-established external core router. The specific steps are as follows:

[0086] Step 3.2.1: Create a reasonable number of internal core routers based on the number of access nodes connected to the internal management network switch to load balance signaling traffic between the range platform and the virtual agents connected to the internal management network switch. By default, one internal core router is assigned for every 300 access nodes.

[0087] The specific algorithm is as follows:

[0088] Step 3.2.1.1 Assume that there are internal management network switches a, b, c, d, and e, and the number of nodes connected to them is Na, Nb, Nc, Nd, and Ne respectively. Use Set <n>The current total number of nodes is marked as C, and the initial value is 0. The internal core routers connected to each internal management network switch are marked as Ia, Ib, Ic, Id, and Ie.<M,I> Records the mapping between internal management network switches and their internal core router tags. The current routing tag is R, and the initial value is 0. By default, each T-station access node is assigned an internal core router. The default value of T is 300.

[0089] Step 3.2.1.2 Traverse the Set <n>, for the value Nx of a certain element among them, perform the following operations

[0090] Step 3.2.1.3 If Nx > T / 2, Map<M, I> records key = x, value = R. R = R + 1.

[0091] Step 3.2.1.4 If Nx < T / 2, C = C + Nx. If C < T, Map<M, I> records key = x, value = R. If C > T, Map<M, I> records key = x, value = R + 1. C = 0, R = R + 1.

[0092] After executing the above algorithm, ensure that the total number of all service nodes connected under each internal core router accessing the internal management network router does not exceed T. The number of internal core routers to be created is R. The relationship between each management network router and the internal core routers to be accessed can be queried from Map<M, I>.

[0093] Step 3.2.2 When an internal core router is connected to an external core router, it is necessary to reasonably allocate the network segments occupied by the connection lines.

[0094] The subnet mask of the network segment occupied by each connection line between an internal core router and an external core router is 30 bits. The network segments need to be non-repetitive among all topology instances. That is, before obtaining the allocated network segment, it is necessary to obtain a unique lock for the range platform first. And the first 8 bits of the network segment value are defaulted to 99. That is, the range of the network segment value is from 99.0.0.0 / 30 to 99.0.0.252 / 30. That is, there are 2^22 = 4194304 subnets to choose from. The specific algorithm for obtaining the subnet network segment is similar to Step 2 mentioned above.

[0095] Step 3.2.2.1 Set <r>Record the connection subnet value that has been assigned to the current range platform, such as {1,2}. <Set <r>>Assign a lock to the subnet segment of the range platform When setting the subnet of the connection line between all internal core routers and external core routers, you need to obtain Lock first. Lock.

[0096] Step 3.2.2.2 calls the Random function, inputs the current time as the seed, and obtains a floating point number n in the range [0,1].

[0097] Step 3.2.2.3 The current network subnet value Vcidr is 4194304 multiplied by the random number n obtained in the previous step, and then rounded down.

[0098] Step 3.2.2.4 Waiting for Lock Lock.

[0099] Step 3.2.2.5 Check Set <r>Whether it contains the current network subnet value Vcidr. If it does, Vcidr = Vcidr + 1 until Vcidr does not exist in Set <r>For example, if the first random value of Vcidr is 1, 1 is already included in Set <r>Then Vcidr=Vcidr+1=2. 2 is still included in Set <e>In the example, Vcidr=Vcidr+1=3. 3 is not in Set <r>If Vcidr=3, you can proceed to the next step.

[0100] Step 3.2.2.6 Add Vcidr to Set <r> After the middle, release the Lock< / r> < / r> < / e> < / r> < / r> < / r> Lock.

[0101] In step 3.2.2.7, the network segment of the current connection is "99." + IntToStr((Vcidr>>14)&0xFF)+"." + IntToStr((Vcidr>>6)&0xFF)+"." + IntToStr((Vcidr&0xFC)<<2) + " / 30". That is, the first segment of the IPv4 address is fixed at 99. The second segment is Vcidr shifted right by 14 bits and then ANDed with 0xFF. The third segment is Vcidr shifted right by 6 bits and then ANDed with 0xFF. The fourth segment is Vcidr shifted left by 2 bits and then ANDed with 0xFC. The mask is fixed at 30 bits.

[0102] In step 3.3, SNAT is enabled on the port connecting the internal and external core routers. The virtual configuration collection agent node and traffic generator, Trex, set a default route, with the gateway being the IP address of the port connecting the internal and external core routers. The virtual configuration collection agent node and traffic generator, Trex, actively request the range platform to obtain task orders generated by user management operations through periodic polling and reverse connection mechanisms.

[0103] After steps 3.1 and 3.2, the virtual management network has been initially established. However, the range platform cannot ping the virtual configuration collection agent node and the traffic generator TREX in the topology instance. This is because the range platform cannot route to the network within the topology instance. A range platform creates multiple topology instances, and the management network segments within different topology instances may overlap. Therefore, if the range platform specifies the IP address of a virtual configuration collection agent node, it is impossible to determine which internal core router is required to reach it.

[0104] Therefore, the virtual configuration collection agent node and traffic generator trex node within the topology instance need to use reverse connection to communicate with the external range platform. The specific configuration process is as follows:

[0105] In step 3.3.1, enable SNAT on the core router within the topology example. The network on which the port connected to the external core router resides is the SNAT external network. All other ports are on the internal network.

[0106] In step 3.3.2, the term "internal agent node" is used to refer to the virtual configuration collection agent node and traffic generator trex within the topology instance.

[0107] Step 3.3.2 Set a default route for each internal proxy node, with the gateway being the internal core router connected to the internal management network switch to which it accesses.

[0108] In step 3.3.3, each internal agent node needs to set a scheduled task to send a heartbeat to the range platform every T time interval (T defaults to 60 seconds). This task carries the unique ID of the internal management network switch to which it belongs, mgmtNetworkId, and its agent type, which is either CONFIG or FLOW. CONFIG represents the virtual configuration collection agent, and FLOW represents the traffic generator trex.

[0109] In step 3.3.4, the Range Platform receives a heartbeat request from the proxy node within the topology instance and obtains the bizNetworkId and proxy type carried in the request. If a user operates on the Range Platform, network configuration information will be sent to the specified node within the Range instance. For example, for VM Node 1 in Topology Instance 1, if its port g0 / 1 is configured with the DNS address 1.1.1.1, the Range Platform will generate a task list with the following fields:

[0110] Table 1: Task Order Fields

[0111]

[0112]

[0113] The specific steps are as follows:

[0114] Step 3.3.4.1 When the range platform receives a heartbeat request from a proxy node within a topology instance, it obtains the mgmtNetworkId and proxy type carried in the request.

[0115] Step 3.3.4.2: The range platform then queries the generated task order. If the task order's node_access_mgmt_network_id and proxy_type match the mgmtNetworkId and proxy type in the request, and the task order's state is 0, the task order is returned as the response body to the corresponding request, and the task order's state is set to 1.

[0116] After the internal proxy node receives a response to the heartbeat request in step 3.3.4.2, it can begin executing the tasks described in the proxy_content task list. For detailed instructions, please refer to "Automatic Configuration Method and System Based on Configuration Proxy in a Network Range" and "Automatic Traffic Generation Method and System for a Network Range." This article only describes how to construct a virtual management network to distribute signaling traffic.

[0117] Step 3.4 Set up ACL rules on the internal management network switch to allow only the virtual configuration collection agent node and traffic generator TREX in the internal management network to communicate with the range platform. The term "internal agent node" is used to refer to the virtual configuration collection agent node and traffic generator TREX. The specific rule settings are as follows:

[0118] Step 3.4.1 rejects all traffic packets of ipv4 and ipv6 protocols with a priority of 1001

[0119] Step 3.4.2 allows traffic packets whose source and destination IP addresses are the port IP addresses of the internal proxy node accessing the management network switch, with a priority of 1002, which is higher than the previous priority.

[0120] At this point, we have completed the construction of the virtual management network, as well as the transformation of the reverse connection method required for the proxy nodes within the topology instance to obtain the signaling traffic for the range platform management operations based on the current implementation method of the virtual management network construction.

[0121] Based on the same inventive concept, an embodiment of the present invention discloses a system for constructing a virtual management network in a network range, including:

[0122] A pre-creation module is used to create an external management network switch and an external core router; the range platform and the external core router are connected to the external management network switch, and the external core router is used to route between the management network inside the topology instance and the external range platform network;

[0123] The business network switch creation module is used to create business network switches within the topology instance. Each business network switch corresponds to an independent business subnet within the topology instance. The network segment of the business subnet is randomly selected from a preset range.

[0124] An internal management network switch creation module is used to create an internal management network switch for a topology instance. Each internal business network switch corresponds to an internal management network switch, and each internal management network switch corresponds to an internal proxy node for management operations. The internal proxy node includes a virtual configuration collection proxy node and / or a traffic generator. The network segment of each internal management network switch is calculated based on the network segment of the corresponding internal business network switch. When creating a virtual business node in each topology instance, it is necessary to connect to the corresponding internal business network switch and the internal management network switch corresponding to the internal business network switch.

[0125] An internal core router creation module, configured to create an internal core router according to the number of nodes accessed by the internal management network switch, and connect the internal core router to the external core router;

[0126] A rule configuration module is used to enable SNAT on the port connecting the internal core router and the external core router, set a default route for the virtual configuration collection agent node and the traffic generator, and the gateway is the port IP connecting the internal core router and the external core router; and the internal management network switch sets ACL rules to only allow the internal agent node and the shooting range platform to communicate.

[0127] Based on the same inventive concept, an embodiment of the present invention discloses a computer system, including a memory, a processor, and a computer program / instruction stored in the memory and executable on the processor. When the computer program / instruction is executed by the processor, the steps of the method for constructing a virtual management network in a network target range are implemented.

[0128] Based on the same inventive concept, an embodiment of the present invention discloses a computer program product, including a computer program / instruction, which, when executed by a processor, implements the steps of the method for constructing a virtual management network in a network target range. < / r> < / r> < / n> < / n> < / e> < / e> < / e> < / e> < / e> < / e> < / e> < / e> < / e> < / e> < / e> < / r> < / r> < / r> < / r> < / r> < / n> < / n> < / e> < / e> < / e> < / e> < / e>

Claims

1. A method for constructing a virtual management network in a network range, characterized in that: The steps include: Create an external management network switch and an external core router; the range platform and the external core router are connected to the external management network switch, and the external core router is used to route between the management network inside the topology instance and the external range platform network; Create service network switches within the topology instance. Each service network switch corresponds to an independent service subnet within the topology instance. The service subnet's network segment is randomly selected from a preset range. The network segment of the service subnet is "A." + IntToStr((Vcidr >> 8) & 0xFF + 128) + "." + IntToStr(Vcidr & 0xFF) + "." + "0 / 24". Vcidr is the network subnet value determined by the random function, and A is a preset fixed value. Create an internal management network switch for the topology instance, where each internal business network switch corresponds to an internal management network switch, and each internal management network switch corresponds to an internal proxy node for management operations; the internal proxy node includes a virtual configuration collection proxy node and / or a traffic generator; the network segment of each internal management network switch is calculated based on the network segment of the corresponding internal business network switch; when creating a virtual business node in each topology instance, it needs to be connected to the corresponding internal business network switch and the internal management network switch corresponding to the internal business network switch; According to the number of nodes connected to the internal management network switch, an internal core router is created, and the internal core router is connected to the external core router; the algorithm for creating an internal core router according to the number of nodes connected to the internal management network switch is as follows: Use the set Set <n>Store the number of nodes connected to each internal management network switch, using Map<M,I> Record the mapping relationship between the internal management network switch and its internal core router tag. The current number of internal core routers is marked as R, the initialization value is 0, the current total number of nodes is marked as C, the initialization value is 0, and a fixed T platform access node is assigned an internal core router; traverse Set <n> , for one of the elements Nx, make the following judgment:< / n> < / n> If Nx > T / 2, Map<M,I> Record key=x, value=R; R = R + 1; If Nx < T / 2, C = C + Nx, if C < T, Map<M,I> Record key=x, value=R; if C >T, Map<M,I> Record key = x, value = R + 1; C = 0, R = R+1; When connecting an internal core router to an external core router, the network segment of the connection is "B." + IntToStr((Vcidr>> 14) & 0xFF) + "." + IntToStr((Vcidr >> 6) & 0xFF) + "." + IntToStr((Vcidr& 0xFC)<<2) + " / 30". B is a preset fixed value. The port connecting the internal core router and the external core router opens SNAT, the virtual configuration collection agent node and the traffic generator set the default route, and the gateway is the port IP connecting the internal core router and the external core router; The internal management network switch sets ACL rules to only allow internal proxy nodes to communicate with the range platform.

2. The method for constructing a virtual management network in a network range according to claim 1, characterized in that: The random algorithm for obtaining a network segment for a business subnet is as follows: Using Set <e>Record the subnet value that has been assigned to the current topology, Lock <Set <e> >Assign a lock to the business subnet of the topology instance;< / e> < / e> Determine the current network subnet value Vcidr based on the value obtained by the random function; Waiting to acquire the lock; Check Set <e>Whether to include the current network subnet value Vcidr. If included, Vcidr = Vcidr + 1 until Vcidr does not exist in Set <e> middle;< / e> < / e> Add Vcidr to Set <e> After the middle, release the lock;< / e> The network segment of the current service subnet is "A." + IntToStr((Vcidr >> 8) & 0xFF + 128) + "." + IntToStr(Vcidr & 0xFF) + "." + "0 / 24".

3. The method for constructing a virtual management network in a network range according to claim 2, characterized in that: If the network segment corresponding to a business network switch is Abc0 / 24, then the network segment of its corresponding internal management network switch is A.(b-128).c.0 / 24.

4. The method for constructing a virtual management network in a network range according to claim 1, characterized in that: When connecting an internal core router to an external core router, the network segments occupied by the connection lines are allocated according to the following algorithm: Using Set <r>Record the connection subnet value that has been allocated to the current range platform, Lock <Set <r> >Assign a lock to the subnet segment of the range platform;< / r> < / r> Determine the current network subnet value Vcidr based on the value obtained by the random function; Waiting to acquire the lock; Check Set <r>Whether to include the current network subnet value Vcidr. If included, Vcidr = Vcidr + 1 until Vcidr does not exist in Set <r> middle;< / r> < / r> Add Vcidr to Set <r> After the middle, release the lock;< / r> The network segment of the current connection is "B." + IntToStr((Vcidr >> 14) & 0xFF) + "." + IntToStr((Vcidr >> 6) & 0xFF) + "." + IntToStr((Vcidr & 0xFC)<<2) + " / 30".

5. The method for constructing a virtual management network in a network range according to claim 1, characterized in that: The virtual configuration collection agent node and traffic generator actively request the range platform to obtain the task orders generated by user management operations through regular polling and reverse connection mechanisms, including: The internal core router turns on SNAT, and the network where the port connected to the external core router is located is the external network of SNAT, and the other ports are all internal networks; Each internal proxy node sets a default route, and the gateway is the internal core router connected to the internal management network switch it accesses; Internal proxy nodes periodically send heartbeats to the range platform, carrying the unique ID of the internal management network switch to which they belong and their own proxy type; When the range platform receives a heartbeat request from the internal proxy node of the topology instance, it will obtain the ID and proxy type carried in the request. If a user operates on the range platform and issues a task to the internal node of the specified range instance, the range platform will generate a task order.

6. The method for constructing a virtual management network in a network range according to claim 5, characterized in that: The task order fields include the node ID, the node management IP, the unique ID of the internal management network switch to which the node is connected, the agent type that actually performs the management operation, the content of the management operation performed, and the task order status.

7. A virtual management network construction system in a network range, characterized in that: include: Pre-built modules for creating external management network switches and external core routers; The range platform and the external core router are connected to the external management network switch, and the external core router is used for routing between the management network inside the topology instance and the external range platform network; The service network switch creation module is used to create service network switches within the topology instance. Each service network switch corresponds to an independent service subnet within the topology instance. The service subnet's network segment is randomly selected from a preset range. The service subnet's network segment is "A." + IntToStr((Vcidr >> 8) & 0xFF + 128) + "." + IntToStr(Vcidr & 0xFF) + "." + "0 / 24". Vcidr is the network subnet value determined by the value obtained by the random function, and A is a preset fixed value. An internal management network switch creation module is used to create an internal management network switch for a topology instance. Each internal business network switch corresponds to an internal management network switch, and each internal management network switch corresponds to an internal proxy node for management operations. The internal proxy node includes a virtual configuration collection proxy node and / or a traffic generator. The network segment of each internal management network switch is calculated based on the network segment of the corresponding internal business network switch. When creating a virtual business node in each topology instance, it is necessary to connect to the corresponding internal business network switch and the internal management network switch corresponding to the internal business network switch. The internal core router creation module is used to create an internal core router according to the number of nodes connected to the internal management network switch, and connect the internal core router to the external core router; the algorithm for creating an internal core router according to the number of nodes connected to the internal management network switch is as follows: Use the set Set <n>Store the number of nodes connected to each internal management network switch, using Map<M,I> Record the mapping relationship between the internal management network switch and its internal core router tag. The current number of internal core routers is marked as R, the initialization value is 0, the current total number of nodes is marked as C, the initialization value is 0, and a fixed T platform access node is assigned an internal core router; traverse Set <n> , for one of the elements Nx, make the following judgment:< / n> < / n> If Nx > T / 2, Map<M,I> Record key=x, value=R; R = R + 1; If Nx < T / 2, C = C + Nx, if C < T, Map<M,I> Record key=x, value=R; if C >T, Map<M,I> Record key = x, value = R + 1; C = 0, R = R+1; When connecting an internal core router to an external core router, the network segment of the connection is "B." + IntToStr((Vcidr>> 14) & 0xFF) + "." + IntToStr((Vcidr >> 6) & 0xFF) + "." + IntToStr((Vcidr& 0xFC)<<2) + " / 30". B is a preset fixed value. A rule configuration module is used to enable SNAT on the port connecting the internal core router and the external core router, set a default route for the virtual configuration collection agent node and the traffic generator, and the gateway is the port IP connecting the internal core router and the external core router; and the internal management network switch sets ACL rules to only allow the internal agent node and the shooting range platform to communicate.

8. A computer system comprising a memory, a processor, and a computer program / instruction stored in the memory and executable on the processor, wherein: When the computer program / instructions are executed by a processor, the steps of a method for constructing a virtual management network in a network range according to any one of claims 1 to 6 are implemented.

9. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of a method for constructing a virtual management network in a network range according to any one of claims 1 to 6 are implemented.

Images