Security table item maintenance method and device, network equipment and storage medium

Abstract

The embodiment of the invention provides a security table item maintenance method and device, network equipment and a storage medium, and relates to the technical field of communication, and the method comprises the steps: obtaining an effective life cycle value included in each far-end MAC-IP table item when a protocol connection with second network equipment is interrupted, the effective life cycle value is used for indicating the effective life cycle of the IP address included in the far-end MAC-IP table item; and if the duration of the protocol connection interruption reaches the effective life cycle value, deleting at least one far-end MAC-IP table item. Therefore, illegal messages can be prevented from entering the network and resource waste can be avoided, and the network security is improved.

Description

Security entry maintenance method, device, network equipment and storage medium Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a security entry maintenance method, apparatus, network equipment, and storage medium. Background Art

[0002] To improve network security, a source address security check mechanism can be deployed on access devices. Access devices can check the legitimacy of received packets based on Media Access Control address-Internet Protocol address (MAC-IP) entries, thereby preventing illegal packets from passing through.

[0003] After access device 1 generates a MAC-IP entry for a terminal, it can notify the aggregation device through a protocol connection. The aggregation device then notifies the MAC-IP entry to other access devices. This way, when the terminal moves from the access point (AP) connected to access device 1 to the AP connected to access device 2, access device 2 can perform a validity check on the terminal based on the MAC-IP entry.

[0004] If access device 2 is connected to only one aggregation device and the protocol connection between them is interrupted, access device 2 can delete the MAC-IP table entry from that protocol connection. In this case, if the energy address security check mechanism is enabled, access device 2 cannot perform a validity check based on the MAC-IP table entry, resulting in legitimate packets being discarded. If the energy address security check mechanism is not enabled, illegitimate packets can still enter the network, reducing network security.

[0005] If access device 2 does not delete the MAC-IP table entry from the protocol connection, if the subsequent protocol connection has not been restored, the MAC-IP table entry will occupy hardware resources for a long time, resulting in resource waste. Therefore, how to maintain the MAC-IP table entry when the protocol connection is interrupted is an urgent problem that needs to be solved.

[0006] Summary of the Invention

[0007] The present invention aims to provide a method, apparatus, network device, and storage medium for maintaining security entries, which can avoid wasting resources and discarding legitimate messages. The specific technical solutions are as follows:

[0008] In a first aspect, an embodiment of the present application provides a security entry maintenance method, applied to a first network device, wherein the first network device includes a remote MAC-IP table, the remote MAC-IP table includes at least one remote MAC-IP entry announced by the second network device, the method comprising:

[0009] When the protocol connection with the second network device is interrupted, obtaining a valid lifetime value included in each remote MAC-IP table entry, where the valid lifetime value is used to indicate a valid lifetime of the IP address included in the remote MAC-IP table entry;

[0010] If the duration of the protocol connection interruption reaches the valid lifecycle value, the at least one remote MAC-IP table entry is deleted.

[0011] In a possible implementation, the method further includes:

[0012] When the first network device generates a DHCP relay entry, establishing a local MAC-IP entry based on the DHCP relay entry, and issuing a forwarding MAC-IP entry corresponding to the local MAC-IP entry to the hardware resource, the local MAC-IP entry including a first valid lifetime value of the first IP address;

[0013] Sending a first MAC-IP notification message to a third network device, so that the third network device establishes a first remote MAC-IP table entry;

[0014] The first MAC-IP notification message includes a first sequence number and the first valid lifetime value, and the first remote MAC-IP table entry includes the first sequence number and the first valid lifetime value;

[0015] The first sequence number is a sum of a maximum sequence number in a remote MAC-IP table entry that matches the local MAC-IP table entry and 1.

[0016] In a possible implementation, after sending the forwarding MAC-IP entry corresponding to the local MAC-IP entry to the hardware resource, the method further includes:

[0017] When the access entry matched by the local MAC-IP entry is deleted, the forwarding MAC-IP entry is deleted.

[0018] In a possible implementation, before obtaining the valid lifetime value included in each remote MAC-IP entry when the protocol connection with the second network device is interrupted, the method further includes:

[0019] Receive a second MAC-IP announcement message sent by the second network device, where the second MAC-IP announcement message includes a second valid lifetime value and a second sequence number of the second IP address;

[0020] A second remote MAC-IP table entry is established, where the second remote MAC-IP table entry includes the second valid lifetime value and the second sequence number.

[0021] In a possible implementation, the first network device includes a local MAC-IP table, and the local MAC-IP table includes at least one local MAC-IP table entry;

[0022] After the second remote MAC-IP entry is established, the method further includes:

[0023] Receiving a first message sent by a terminal, where the first message includes a MAC address and an IP address of the terminal;

[0024] If there is no local MAC-IP table entry matching the MAC address and IP address of the terminal in the local MAC-IP table, and the MAC address and IP address of the terminal match the second remote MAC-IP table entry, performing access detection on the terminal;

[0025] If an access response is received from the terminal, a composite MAC-IP entry is generated, where the composite MAC-IP entry includes the MAC address and IP address, the port identifier, and the VLAN identifier of the terminal;

[0026] Generate a forwarding MAC-IP table entry according to the synthesized MAC-IP table entry, wherein the forwarding MAC-IP table entry includes the MAC address and IP address of the terminal;

[0027] The forwarding MAC-IP table entry is sent to the hardware resource.

[0028] In a possible implementation, after sending the forwarding MAC-IP table entry to the hardware resource, the method further includes:

[0029] When the terminal access entry is deleted, the synthetic MAC-IP entry and the forwarding MAC-IP entry are deleted.

[0030] In one possible implementation, the first network device includes a local MAC-IP table, the local MAC-IP table includes a first local MAC-IP table entry, and the first local MAC-IP table entry includes a third sequence number; after establishing the second remote MAC-IP table entry, the method further includes:

[0031] If the second remote MAC-IP entry matches the first local MAC-IP entry, and the second sequence number is greater than the third sequence number, the first local MAC-IP entry is deleted, and the DHCP relay entry corresponding to the first local MAC-IP entry is deleted.

[0032] In a possible implementation manner, the MAC-IP advertisement message sent by the first network device includes a first extended community attribute, and the first extended community attribute includes a valid lifetime value of an IP address.

[0033] In a possible implementation manner, the MAC-IP advertisement message sent by the first network device further includes a second extended community attribute, and the second extended community attribute includes a sequence number of a MAC-IP table entry.

[0034] In a second aspect, an embodiment of the present application provides a security entry maintenance method, applied to a second network device, wherein the second network device includes a first remote MAC-IP table, and the first remote MAC-IP table includes at least one remote MAC-IP entry announced by a fourth network device, the method comprising:

[0035] When the protocol connection with the fourth network device is interrupted, obtaining a valid lifetime value included in each remote MAC-IP table entry, where the valid lifetime value is used to indicate a valid lifetime of the IP address included in the remote MAC-IP table entry;

[0036] If the duration of the protocol connection interruption reaches the valid lifecycle value, the at least one remote MAC-IP table entry is deleted.

[0037] In a possible implementation, before obtaining the valid lifetime value included in each remote MAC-IP entry when the protocol connection with the fourth network device is interrupted, the method further includes:

[0038] Receive a first MAC-IP announcement message sent by the fourth network device, where the first MAC-IP announcement message includes a first valid lifetime value and a first sequence number of the first IP address;

[0039] A first remote MAC-IP table entry is established, where the first remote MAC table entry includes the first valid lifetime value and the first sequence number.

[0040] In one possible implementation, the second network device further includes at least one second remote MAC-IP table, the at least one second remote table including a second remote MAC-IP entry, the second remote MAC-IP entry matching the first remote MAC-IP entry, and the second remote MAC-IP entry including a second sequence number; after establishing the first remote MAC-IP entry, the method further includes:

[0041] If the first sequence number is greater than the second sequence number, a second MAC-IP notification message is sent to other network devices except the fourth network device, where the second MAC-IP notification message includes the first valid lifetime value and the first sequence number.

[0042] In a possible implementation, the second remote device further includes at least one third remote MAC-IP table, each third remote MAC-IP table including at least one remote MAC-IP entry; after deleting the at least one remote MAC-IP entry, the method further includes:

[0043] For each deleted remote MAC-IP table entry, if there is no remote MAC-IP table entry matching the remote MAC-IP table entry in the at least one third remote MAC-IP table, sending a first MAC-IP revocation message to other network devices except the fourth network device, where the first MAC-IP revocation message includes the MAC address and IP address in the remote MAC-IP table entry; or

[0044] For each deleted remote MAC-IP table entry, if there is a remote MAC-IP table entry that matches the remote MAC-IP table entry in the at least one third remote MAC-IP table, select the third remote MAC-IP table entry with the largest sequence number from the matching remote MAC-IP table entries, and the third remote MAC-IP table entry includes a second valid lifetime value and a third sequence number; send a third MAC-IP announcement message to other network devices except the fifth network device, and the third MAC-IP announcement message includes the second valid lifetime value and the third sequence number, and the fifth network device is the source device of the third remote MAC-IP table entry.

[0045] In a possible implementation, the MAC-IP advertisement message sent by the second network device includes a first extended community attribute, and the first extended community attribute includes a valid lifetime value of an IP address.

[0046] In a possible implementation, the MAC-IP advertisement message sent by the second network device further includes a second extended community attribute, and the second extended community attribute includes a sequence number of a MAC-IP table entry.

[0047] In a third aspect, an embodiment of the present application provides a security entry maintenance device, applied to a first network device, wherein the first network device includes a remote MAC-IP table, the remote MAC-IP table includes at least one remote MAC-IP entry announced by the second network device, the device comprising:

[0048] an acquisition module, configured to, when the protocol connection with the second network device is interrupted, acquire a valid lifetime value included in each remote MAC-IP table entry, the valid lifetime value being used to indicate a valid lifetime of the IP address included in the remote MAC-IP table entry;

[0049] The deleting module is configured to delete the at least one remote MAC-IP entry if the duration of the protocol connection interruption reaches the valid lifecycle value.

[0050] In a possible implementation, the apparatus further includes:

[0051] an establishing module configured to, when the first network device generates a DHCP relay entry, establish a local MAC-IP entry based on the DHCP relay entry, and issue a forwarding MAC-IP entry corresponding to the local MAC-IP entry to the hardware resource, wherein the local MAC-IP entry includes a first valid lifetime value of the first IP address;

[0052] A sending module, configured to send a first MAC-IP notification message to a third network device, so that the third network device establishes a first remote MAC-IP table entry;

[0053] The first MAC-IP notification message includes a first sequence number and the first valid lifetime value, and the first remote MAC-IP table entry includes the first sequence number and the first valid lifetime value;

[0054] The first sequence number is a sum of a maximum sequence number in a remote MAC-IP table entry that matches the local MAC-IP table entry and 1.

[0055] In a possible implementation, the deleting module is further configured to delete the forwarding MAC-IP entry when the access entry matched by the local MAC-IP entry is deleted.

[0056] In a possible implementation, the apparatus further includes:

[0057] a receiving module, configured to receive a second MAC-IP announcement message sent by the second network device, where the second MAC-IP announcement message includes a second valid lifetime value and a second sequence number of the second IP address;

[0058] An establishing module is used to establish a second remote MAC-IP table entry, where the second remote MAC-IP table entry includes the second valid lifetime value and the second sequence number.

[0059] In a possible implementation, the first network device includes a local MAC-IP table, and the local MAC-IP table includes at least one local MAC-IP table entry;

[0060] The device also includes: a detection module, a generation module and a sending module;

[0061] The receiving module is further configured to receive a first message sent by a terminal, where the first message includes a MAC address and an IP address of the terminal;

[0062] The detection module is configured to perform access detection on the terminal if no local MAC-IP entry matching the MAC address and IP address of the terminal exists in the local MAC-IP table, and the MAC address and IP address of the terminal match the second remote MAC-IP entry;

[0063] The generating module is configured to generate a synthetic MAC-IP table entry upon receiving an access response sent by the terminal, wherein the synthetic MAC-IP table entry includes the MAC address and IP address, the port identifier, and the VLAN identifier of the terminal;

[0064] The generating module is further configured to generate a forwarding MAC-IP entry based on the synthesized MAC-IP entry, wherein the forwarding MAC-IP entry includes the MAC address and IP address of the terminal;

[0065] The sending module is used to send the forwarding MAC-IP table entry to the hardware resources.

[0066] In a possible implementation, the deleting module is further configured to delete the composite MAC-IP entry and the forwarding MAC-IP entry when the access entry of the terminal is deleted.

[0067] In one possible implementation, the first network device includes a local MAC-IP table, the local MAC-IP table includes a first local MAC-IP table entry, and the first local MAC-IP table entry includes a third sequence number;

[0068] The deleting module is further configured to delete the first local MAC-IP entry and the DHCP relay entry corresponding to the first local MAC-IP entry if the second remote MAC-IP entry matches the first local MAC-IP entry and the second sequence number is greater than the third sequence number.

[0069] In a possible implementation, the MAC-IP advertisement message sent by the first network device includes a first extended community attribute, and the first extended community attribute includes a valid lifetime value of an IP address.

[0070] In a possible implementation manner, the MAC-IP advertisement message sent by the first network device further includes a second extended community attribute, and the second extended community attribute includes a sequence number of a MAC-IP table entry.

[0071] In a fourth aspect, an embodiment of the present application provides a security entry maintenance device, applied to a second network device, wherein the second network device includes a first remote MAC-IP table, the first remote MAC-IP table includes at least one remote MAC-IP entry announced by a fourth network device, the device comprising:

[0072] an acquisition module, configured to, when the protocol connection with the fourth network device is interrupted, acquire a valid lifetime value included in each remote MAC-IP table entry, wherein the valid lifetime value is used to indicate a valid lifetime of the IP address included in the remote MAC-IP table entry;

[0073] The deleting module is configured to delete the at least one remote MAC-IP entry if the duration of the protocol connection interruption reaches the valid lifecycle value.

[0074] In a possible implementation, the apparatus further includes:

[0075] a receiving module, configured to receive a first MAC-IP announcement message sent by the fourth network device, where the first MAC-IP announcement message includes a first valid lifetime value and a first sequence number of the first IP address;

[0076] An establishing module is configured to establish a first remote MAC-IP table entry, wherein the first remote MAC table entry includes the first valid lifetime value and the first sequence number.

[0077] In one possible implementation, the second network device further includes at least one second remote MAC-IP table, the at least one second remote table includes a second remote MAC-IP entry, the second remote MAC-IP entry matches the first remote MAC-IP entry, and the second remote MAC-IP entry includes a second sequence number; and the apparatus further includes:

[0078] A sending module is used to send a second MAC-IP notification message to other network devices except the fourth network device if the first sequence number is greater than the second sequence number, and the second MAC-IP notification message includes the first valid lifetime value and the first sequence number.

[0079] In a possible implementation, the second remote device further includes at least one third remote MAC-IP table, each third remote MAC-IP table includes at least one remote MAC-IP table entry; the apparatus further includes a sending module;

[0080] The sending module is used to:

[0081] For each deleted remote MAC-IP table entry, if there is no remote MAC-IP table entry matching the remote MAC-IP table entry in the at least one third remote MAC-IP table, sending a first MAC-IP revocation message to other network devices except the fourth network device, where the first MAC-IP revocation message includes the MAC address and IP address in the remote MAC-IP table entry; or

[0082] For each deleted remote MAC-IP table entry, if there is a remote MAC-IP table entry that matches the remote MAC-IP table entry in the at least one third remote MAC-IP table, select the third remote MAC-IP table entry with the largest sequence number from the matching remote MAC-IP table entries, and the third remote MAC-IP table entry includes a second valid lifetime value and a third sequence number; send a third MAC-IP announcement message to other network devices except the fifth network device, and the third MAC-IP announcement message includes the second valid lifetime value and the third sequence number, and the fifth network device is the source device of the third remote MAC-IP table entry.

[0083] In a possible implementation, the MAC-IP advertisement message sent by the second network device includes a first extended community attribute, and the first extended community attribute includes a valid lifetime value of an IP address.

[0084] In a possible implementation, the MAC-IP advertisement message sent by the second network device further includes a second extended community attribute, and the second extended community attribute includes a sequence number of a MAC-IP table entry.

[0085] In a fifth aspect, an embodiment of the present application provides a first network device, wherein the first network device includes a remote MAC-IP table, wherein the remote MAC-IP table includes at least one remote MAC-IP table entry announced by the second network device; the first network device includes:

[0086] processor;

[0087] transceiver;

[0088] A machine-readable storage medium storing machine-executable instructions capable of being executed by the processor; the machine-executable instructions prompting the processor to perform the following steps:

[0089] When the protocol connection with the second network device is interrupted, obtaining a valid lifetime value included in each remote MAC-IP table entry, where the valid lifetime value is used to indicate a valid lifetime of the IP address included in the remote MAC-IP table entry;

[0090] If the duration of the protocol connection interruption reaches the valid lifecycle value, the at least one remote MAC-IP table entry is deleted.

[0091] In one possible implementation, the machine executable instructions further cause the processor to execute the following steps:

[0092] When the first network device generates a DHCP relay entry, establishing a local MAC-IP entry based on the DHCP relay entry, and issuing a forwarding MAC-IP entry corresponding to the local MAC-IP entry to the hardware resource, the local MAC-IP entry including a first valid lifetime value of the first IP address;

[0093] Sending a first MAC-IP notification message to a third network device through the transceiver, so that the third network device establishes a first remote MAC-IP table entry;

[0094] The first MAC-IP notification message includes a first sequence number and the first valid lifetime value, and the first remote MAC-IP table entry includes the first sequence number and the first valid lifetime value;

[0095] The first sequence number is a sum of a maximum sequence number in a remote MAC-IP table entry that matches the local MAC-IP table entry and 1.

[0096] In one possible implementation, the machine executable instructions further cause the processor to execute the following steps:

[0097] When the access entry matched by the local MAC-IP entry is deleted, the forwarding MAC-IP entry is deleted.

[0098] In one possible implementation, the machine executable instructions further cause the processor to execute the following steps:

[0099] receiving, by the transceiver, a second MAC-IP advertisement message sent by the second network device, wherein the second MAC-IP advertisement message includes a second valid lifetime value and a second sequence number of the second IP address;

[0100] A second remote MAC-IP table entry is established, where the second remote MAC-IP table entry includes the second valid lifetime value and the second sequence number.

[0101] In a possible implementation, the first network device includes a local MAC-IP table, and the local MAC-IP table includes at least one local MAC-IP table entry;

[0102] The machine executable instructions further cause the processor to perform the following steps:

[0103] Receiving, through a transceiver, a first message sent by a terminal, where the first message includes a MAC address and an IP address of the terminal;

[0104] If there is no local MAC-IP table entry matching the MAC address and IP address of the terminal in the local MAC-IP table, and the MAC address and IP address of the terminal match the second remote MAC-IP table entry, performing access detection on the terminal;

[0105] If an access response is received from the terminal, a composite MAC-IP entry is generated, where the composite MAC-IP entry includes the MAC address and IP address, the port identifier, and the VLAN identifier of the terminal;

[0106] Generate a forwarding MAC-IP table entry according to the synthesized MAC-IP table entry, wherein the forwarding MAC-IP table entry includes the MAC address and IP address of the terminal;

[0107] The forwarding MAC-IP table entry is sent to the hardware resource.

[0108] In one possible implementation, the machine executable instructions further cause the processor to execute the following steps:

[0109] When the access entry of the terminal is deleted, the synthetic MAC-IP entry and the forwarding MAC-IP entry are deleted.

[0110] In one possible implementation, the first network device includes a local MAC-IP table, the local MAC-IP table includes a first local MAC-IP table entry, and the first local MAC-IP table entry includes a third sequence number; and the machine-executable instructions further cause the processor to perform the following steps:

[0111] If the second remote MAC-IP entry matches the first local MAC-IP entry, and the second sequence number is greater than the third sequence number, the first local MAC-IP entry is deleted, and the DHCP relay entry corresponding to the first local MAC-IP entry is deleted.

[0112] In a possible implementation manner, the MAC-IP advertisement message sent by the first network device includes a first extended community attribute, and the first extended community attribute includes a valid lifetime value of an IP address.

[0113] In a possible implementation manner, the MAC-IP advertisement message sent by the first network device further includes a second extended community attribute, and the second extended community attribute includes a sequence number of a MAC-IP table entry.

[0114] In a sixth aspect, an embodiment of the present application provides a second network device, the second network device including a first remote MAC-IP table, the first remote MAC-IP table including at least one remote MAC-IP table entry announced by a fourth network device, the second network device including:

[0115] processor;

[0116] transceiver;

[0117] A machine-readable storage medium storing machine-executable instructions capable of being executed by the processor; the machine-executable instructions prompting the processor to perform the following steps:

[0118] When the protocol connection with the fourth network device is interrupted, obtaining a valid lifetime value included in each remote MAC-IP table entry, where the valid lifetime value is used to indicate a valid lifetime of the IP address included in the remote MAC-IP table entry;

[0119] If the duration of the protocol connection interruption reaches the valid lifecycle value, the at least one remote MAC-IP table entry is deleted.

[0120] In one possible implementation, the machine executable instructions further cause the processor to execute the following steps:

[0121] receiving, by the transceiver, a first MAC-IP announcement message sent by the fourth network device, wherein the first MAC-IP announcement message includes a first valid lifetime value and a first sequence number of a first IP address;

[0122] A first remote MAC-IP table entry is established, where the first remote MAC table entry includes the first valid lifetime value and the first sequence number.

[0123] In one possible implementation, the second network device further includes at least one second remote MAC-IP table, the at least one second remote table includes a second remote MAC-IP table entry, the second remote MAC-IP table entry matches the first remote MAC-IP table entry, and the second remote MAC-IP table entry includes a second sequence number; and the machine-executable instructions cause the processor to perform the following steps:

[0124] If the first sequence number is greater than the second sequence number, a second MAC-IP notification message is sent to other network devices except the fourth network device, where the second MAC-IP notification message includes the first valid lifetime value and the first sequence number.

[0125] In a possible implementation, the second remote device further includes at least one third remote MAC-IP table, each of which includes at least one remote MAC-IP table entry; and the machine-executable instructions cause the processor to perform the following steps:

[0126] For each deleted remote MAC-IP table entry, if there is no remote MAC-IP table entry matching the remote MAC-IP table entry in the at least one third remote MAC-IP table, sending a first MAC-IP revocation message to other network devices except the fourth network device, where the first MAC-IP revocation message includes the MAC address and IP address in the remote MAC-IP table entry; or

[0127] For each deleted remote MAC-IP table entry, if there is a remote MAC-IP table entry that matches the remote MAC-IP table entry in the at least one third remote MAC-IP table, select the third remote MAC-IP table entry with the largest sequence number from the matching remote MAC-IP table entries, and the third remote MAC-IP table entry includes a second valid lifetime value and a third sequence number; send a third MAC-IP announcement message to other network devices except the fifth network device, and the third MAC-IP announcement message includes the second valid lifetime value and the third sequence number, and the fifth network device is the source device of the third remote MAC-IP table entry.

[0128] In a possible implementation, the MAC-IP advertisement message sent by the second network device includes a first extended community attribute, and the first extended community attribute includes a valid lifetime value of an IP address.

[0129] In a possible implementation, the MAC-IP advertisement message sent by the second network device further includes a second extended community attribute, and the second extended community attribute includes a sequence number of a MAC-IP table entry.

[0130] In a seventh aspect, an embodiment of the present application provides a machine-readable storage medium storing machine-executable instructions. When called and executed by a processor, the machine-executable instructions prompt the processor to implement the method described in the first aspect or the second aspect.

[0131] In an eighth aspect, an embodiment of the present application provides a computer program product, which prompts the processor to implement the method described in the first aspect or the second aspect.

[0132] By adopting the above technical solution, the remote MAC-IP table entry in the first network device includes a valid lifetime value, and the valid lifetime value is used to indicate the valid lifetime of the IP address included in the remote MAC-IP table entry. If the duration of the protocol connection interruption reaches the valid lifetime value, it means that the IP address included in the MAC-IP table entry is no longer valid. That is, the terminal that originally applied for the IP address can no longer use the IP address. At this time, deleting the remote MAC-IP table entry will not affect the subsequent legitimacy verification of the terminal, will not affect network security, and can prevent the remote MAC-IP table entry from continuing to occupy the resources of the first network device. Before the duration of the protocol connection interruption reaches the valid lifetime value, the first network device will not delete the remote MAC-IP table entry. Therefore, when the energy address security check mechanism is enabled, the legitimate messages matching the remote MAC-IP table entry will not be discarded, and illegal messages can be prevented from entering the network, which can improve network security. BRIEF DESCRIPTION OF THE DRAWINGS

[0133] The drawings described herein are used to provide further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute improper limitations on the present application.

[0134] FIG1 is a schematic diagram of the structure of a Spine-Leaf networking system provided in an embodiment of the present application;

[0135] FIG2 is a flow chart of a security entry maintenance method provided in an embodiment of the present application;

[0136] FIG3 is an exemplary schematic diagram of a MAC-IP NLRI format provided in an embodiment of the present application;

[0137] FIG4 is an exemplary schematic diagram of a Route Type format provided in an embodiment of the present application;

[0138] FIG5 is an exemplary schematic diagram of a first extended community attribute format provided in an embodiment of the present application;

[0139] FIG6 is an exemplary diagram of a second extended community attribute format provided in an embodiment of the present application;

[0140] FIG7 is a flow chart of another security entry maintenance method provided in an embodiment of the present application;

[0141] FIG8 is a schematic diagram of another Spine-Leaf networking system structure provided in an embodiment of the present application;

[0142] FIG9 is a schematic diagram of the structure of another Spine-Leaf networking system provided in an embodiment of the present application;

[0143] FIG10 is a schematic diagram of the structure of another Spine-Leaf networking system provided in an embodiment of the present application;

[0144] FIG11 is a schematic diagram of the structure of a security entry maintenance device provided in an embodiment of the present application;

[0145] FIG12 is a schematic structural diagram of another security entry maintenance device provided in an embodiment of the present application;

[0146] FIG13 is a schematic structural diagram of a first network device provided in an embodiment of the present application;

[0147] FIG14 is a schematic structural diagram of a second network device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0148] To make the objectives, technical solutions, and advantages of the present invention more clearly understood, the present invention is further described below with reference to the accompanying drawings and examples. It should be understood that the described examples are only some examples of the present invention, not all examples. All other examples derived by persons of ordinary skill in the art based on the examples of the present invention fall within the scope of protection of the present invention.

[0149] The networking system used in the embodiment of the present application can be a spine-leaf network. As shown in Figure 1, the networking system includes two levels of aggregation devices, where Spine3 is the upper-level aggregation device of Spine1 in area 1 and Spine2 in area 2.

[0150] Spine3 is connected to a Dynamic Host Configuration Protocol Version 6 (DHCPv6) server and an Access Controller (AC). The DHCPv6 server is used to assign Internet Protocol Version 6 (IPv6) addresses to terminals.

[0151] Spine 1 is located in Area 1. Area 1 also includes three access devices: Leaf 1, Leaf 2, and Leaf 3. Leaf 1, Leaf 2, and Leaf 3 are all connected to Spine 1.

[0152] AP1 is connected to Leaf1, AP2 is connected to Leaf2, and AP3 is connected to Leaf3. The terminal can communicate with the AP. FIG1 exemplarily shows the terminal accessing AP1.

[0153] It should be noted that the number of devices in FIG1 is only an example. In actual implementation, the number of devices in FIG1 is not limited thereto.

[0154] A security check mechanism is deployed on the access device, which includes a control plane check mechanism and a data plane check mechanism.

[0155] The control plane inspection mechanism refers to the legitimacy check of received protocol packets. For example, it filters the Media Access Control (MAC) address and Internet Protocol (IP) address of the sender of Neighbor Discovery (ND) and Address Resolution Protocol (ARP) probe packets to prevent the generation of illegal ND and ARP entries.

[0156] The data plane inspection mechanism filters and controls the source MAC address and source IP address of received service packets to prevent illegal service packets from passing through.

[0157] Both the control plane check mechanism and the data plane check mechanism rely on pre-generated MAC-IP table entries. Currently, methods for dynamically generating MAC-IP table entries include: generating MAC-IP table entries based on Dynamic Host Configuration Protocol (DHCP) relay table entries and generating MAC-IP table entries through DHCP snooping. The embodiments of the present application do not limit the method by which the access device generates local security table entries.

[0158] It should be noted that if the user privately sets an IP address for the terminal, it will not trigger the access device to generate a MAC-IP table entry, and the access device will discard the message from the terminal.

[0159] The IP address in the embodiment of the present application may be an Internet Protocol Version 4 (IPv4) address or an IPv6 address.

[0160] The present invention provides a method for maintaining security entries. The method is applied to a first network device, which may be an access device, such as a leaf device in a spine-leaf architecture. The first network device includes a remote MAC-IP table, which includes at least one remote MAC-IP entry notified by a second network device. As shown in FIG2 , the method includes:

[0161] S201: When the protocol connection with the second network device is interrupted, obtain a valid lifetime value included in each remote MAC-IP entry.

[0162] The valid lifetime value is used to indicate the valid lifetime of the IP address included in the remote MAC-IP entry.

[0163] The second network device may be an aggregation device. Taking the networking system shown in FIG1 as an example, the first network device may be Leaf1, Leaf2, or Leaf3 in FIG1 , and the second network device may be Spine1. The protocol connection between the first network device and the second network device may be a Border Gateway Protocol (BGP) connection; or the protocol connection between the first network device and the second network device may be a custom private protocol connection. In the case where the protocol connection is a private protocol connection, the network devices communicate MAC-IP table entries through the private protocol.

[0164] S202: If the duration of the protocol connection interruption reaches the valid lifecycle value, delete at least one remote MAC-IP entry.

[0165] It is understood that, when the remote MAC-IP table includes a MAC-IP table entry, the first network device can obtain the valid lifetime value included in the MAC-IP table entry. The first network device saves the valid lifetime value of the remote MAC-IP table entry with the time when the protocol connection interruption is detected as the starting time. That is, after detecting the protocol connection interruption, the first network device maintains the valid lifetime value of the remote MAC-IP table entry and does not delete the remote MAC-IP table entry until the valid lifetime value is reached.

[0166] If the protocol connection is not restored when the time from the start time reaches the valid lifetime value, the remote MAC-IP entry is deleted.

[0167] For example, if the valid lifetime value is 100,000 seconds, the first network device starts timing after detecting that the protocol connection is interrupted and keeps the remote MAC-IP entry for 100,000 seconds. If the protocol connection is not restored after 100,000 seconds, the first network device deletes the remote MAC-IP entry.

[0168] In the case that the remote MAC-IP table includes multiple MAC-IP entries, the first network device may obtain valid lifetime values ​​of the multiple remote MAC-IP entries.

[0169] In one embodiment, after the duration of the protocol connection interruption reaches all the valid lifetime values ​​obtained, that is, after the duration of the protocol connection interruption reaches the maximum lifetime value among the valid lifetime values ​​obtained, the remote MAC-IP table including multiple MAC-IP table entries is deleted at one time.

[0170] In another implementation, for each valid lifetime value, if the duration of the protocol connection interruption reaches the valid lifetime value, the MAC-IP table entry to which the valid lifetime value belongs is deleted.

[0171] Using the above method, the remote MAC-IP table entry in the first network device includes a valid lifetime value, and the valid lifetime value is used to indicate the valid lifetime of the IP address included in the remote MAC-IP table entry. If the duration of the protocol connection interruption reaches the valid lifetime value, it means that the IP address included in the MAC-IP table entry is no longer valid. That is, the terminal that originally applied for the IP address can no longer use the IP address. At this time, deleting the remote MAC-IP table entry will not affect the subsequent legitimacy verification of the terminal, will not affect network security, and can prevent the remote MAC-IP table entry from continuing to occupy the resources of the first network device. Before the duration of the protocol connection interruption reaches the valid lifetime value, the first network device will not delete the remote MAC-IP table entry. Therefore, when the energy address security check mechanism is enabled, the legitimate messages matching the remote MAC-IP table entry will not be discarded, and illegal messages can be prevented from entering the network, which can improve network security.

[0172] The following is an example. In Figure 1, consider Leaf 1 as the first network device and Spine 1 as the second network device. Leaf 1 receives MAC-IP table entry 1 and MAC-IP table entry 2 from Spine 1 and saves them as remote MAC-IP table entry 1 and remote MAC-IP table entry 2. Assume that the valid lifetime of the IP address in remote MAC-IP table entry 1 is 90,000 seconds, and the valid lifetime of the IP address in remote MAC-IP table entry 2 is 100,000 seconds.

[0173] In one embodiment, if Leaf 1 detects that the protocol connection between Leaf 1 and Spine 1 is interrupted, Leaf 1 retains remote MAC-IP entry 1 and remote MAC-IP entry 2 for 100,000 seconds, starting from the time of detection. If the protocol connection between Leaf 1 and Spine 1 is still not restored after 100,000 seconds, Leaf 1 deletes remote MAC-IP entry 1 and remote MAC-IP entry 2.

[0174] In this way, the first network device can delete multiple remote MAC-IP entries at one time, avoiding resource waste without affecting network security, and saving processing overhead of the first network device in the process of deleting remote entries.

[0175] In another embodiment, still taking the example of Leaf 1 including the above-mentioned remote MAC-IP table entry 1 and remote MAC-IP table entry 2, if Leaf 1 detects that the protocol connection between Leaf 1 and Spine 1 is interrupted, Leaf 1 retains remote MAC-IP table entry 1 for 90,000 seconds starting from the moment of detecting the protocol connection interruption. If the protocol connection is not restored after 90,000 seconds, remote MAC-IP table entry 1 is deleted. Leaf 1 retains remote MAC-IP table entry 2 for 100,000 seconds starting from the moment of detecting the protocol connection interruption. If the protocol connection is still not restored after 100,000 seconds, remote MAC-IP table entry 2 is deleted.

[0176] In this way, each invalid remote MAC-IP entry can be deleted promptly and accurately, preventing invalid remote MAC-IP entries from occupying resources without affecting network security.

[0177] The first network device in the embodiment of the present application may further generate a local MAC-IP table entry and notify the local MAC-IP table entry to other network devices. This process specifically includes:

[0178] When the first network device generates a DHCP relay entry, it establishes a local MAC-IP entry based on the DHCP relay entry and sends a forwarding MAC-IP entry corresponding to the local MAC-IP entry to the hardware resource. The local MAC-IP entry includes a first valid lifetime value of the first IP address.

[0179] In an embodiment of the present application, the first network device can function as a DHCP relay device. After the DHCP relay device applies for an IP address for a terminal from a DHCP server, it can obtain the first IP address assigned by the DHCP server to the terminal, as well as the preferred lifetime value and effective lifetime value of the first IP address. In an embodiment of the present application, the first network device can add the first effective lifetime value of the first IP address to a local MAC-IP table entry, and optionally, can also add the preferred lifetime value of the first IP address to the local MAC-IP table entry.

[0180] Taking an IPv6 network as an example, the local MAC-IP table entry includes at least the fields shown in Table 1:

[0181] Table 1

[0182] The local MAC-IP table entry is the control MAC-IP table entry, which is maintained by the network device's software and can be stored in the device's memory. The control plane can use the control MAC-IP table entry to perform control plane protocol message validity checks, such as those on ND messages.

[0183] The forwarding MAC-IP table entry corresponding to the local MAC-IP table entry includes the aforementioned MAC address and IPv6 address fields and is stored in the hardware resources of the hardware forwarding chip. This consumes MAC-IP table entry resources in the hardware forwarding chip and is used to perform validity checks on service packets in the forwarding plane. The MAC-IP table entry resources in the hardware forwarding chip are relatively scarce.

[0184] After generating the local MAC-IP table entry, the first network device may send a first MAC-IP notification message to the third network device, so that the third network device establishes a first remote MAC-IP table entry.

[0185] The first MAC-IP notification message includes a first sequence number and a first valid lifetime value, and the first remote MAC-IP table entry includes the first sequence number and the first valid lifetime value. The first sequence number is the sum of the maximum sequence number in the remote MAC-IP table entry that matches the local MAC-IP table entry and 1.

[0186] It is understandable that the first MAC-IP advertisement message also includes the MAC address and the first IP address in the local MAC-IP table entry, and accordingly, the first remote MAC-IP table entry also includes the MAC address and the first IP address.

[0187] The third network device is a convergence device, and the third network device and the second network device may be the same convergence device or different convergence devices.

[0188] A remote MAC-IP table entry that matches a local MAC-IP table entry refers to a remote MAC-IP table entry that has the same MAC address and IP address as the local MAC-IP table entry. If a remote MAC-IP table entry that matches a local MAC-IP table entry is stored in the first network device, it means that the terminal has migrated from another access device, and each remote MAC-IP table entry includes a sequence number. The larger the sequence number carried in the remote MAC-IP table entry, the later the remote MAC-IP table entry was generated.

[0189] Taking an IPv6 network as an example, the first MAC-IP advertisement message may include the fields shown in Table 2:

[0190] Table 2

[0191] Based on the above embodiments, the first network device may delete ARP or ND entries. For example, in an IPv6 scenario, some terminals, when in a locked state or other state, may not respond to ND entry aging detection messages initiated by the first network device, which may cause the ND entry corresponding to the terminal in the first network device to be aged and deleted. Alternatively, if the access device detects that the terminal's access interface is disconnected, the access device may delete the ND entry for the terminal that has come online through that access interface.

[0192] After the first network device sends a forwarding MAC-IP table entry corresponding to the local MAC-IP table entry to the hardware resource, when the access table entry matched by the local MAC-IP table entry is deleted, the forwarding MAC-IP table entry is deleted.

[0193] The access entry is an ND entry or an ARP entry.

[0194] In the embodiment of the present application, the forwarding MAC-IP table entry in the hardware resource is deleted, which can save hardware resources. In addition, since the local MAC-IP table entry stored in the memory is not deleted at this time, if the terminal accesses again, after the access table entry of the terminal is learned again, the forwarding MAC-IP table entry can be re-issued to the hardware resource based on the local MAC-IP table entry. This prevents legitimate packets from being discarded due to the deletion of the forwarding MAC-IP table entry, thereby improving network security.

[0195] In addition, the deletion of an ND entry or ARP entry does not mean that the IP address lease applied for by the terminal has expired. Therefore, after deleting the ND entry or ARP entry, the DHCP relay entry corresponding to the terminal will not be deleted.

[0196] In the embodiment of the present application, the first network device may also receive MAC-IP entries notified by other network devices. Based on this, before obtaining the valid lifetime value included in each remote MAC-IP entry in the above S201 when the protocol connection with the second network device is interrupted, the method further includes:

[0197] Receive a second MAC-IP advertisement message sent by the second network device and establish a second remote MAC-IP table entry. The second MAC-IP advertisement message includes the second valid lifetime value and the second sequence number of the second IP address; the second remote table entry includes the second valid lifetime value and the second sequence number of the second IP address. It is understood that the second MAC-IP advertisement message also includes: the MAC address and the second IP address. Accordingly, the second remote MAC-IP table entry also includes the MAC address and the second IP address.

[0198] Optionally, the second MAC-IP advertisement message may further include a preferred lifetime value of the second IP address. Accordingly, the remote MAC-IP table entry also includes the preferred lifetime value of the second IP address.

[0199] As can be understood, the second network device notifies the first network device of MAC-IP entries received from network devices other than the first network device. This allows the first network device to use the second remote MAC-IP entry to perform a validity check on the terminal's messages after the terminal migrates from the other access device to the first network device, thereby preventing illegal messages from entering the network and improving network security. Furthermore, because the second MAC-IP notification message includes the second sequence number, if the terminal subsequently migrates to the first network device, the first network device can learn about the terminal's migration status based on the sequence number.

[0200] The first network device may store the second remote MAC-IP table entry in memory. In this case, the second remote MAC-IP table entry does not occupy the control MAC-IP table entry resources in the memory. That is, the first network device may use idle resources in the memory other than the control MAC-IP table entry resources to store the second remote MAC-IP table entry. In this case, the remote MAC-IP table entry does not occupy hardware resources. The first network device may maintain a remote MAC-IP table entry for the second network device, and the second remote MAC-IP table entry is stored in the remote MAC-IP table.

[0201] Taking the IPv6 application scenario as an example, the fields included in the second remote MAC-IP entry are shown in Table 3:

[0202] Table 3

[0203] In the embodiment of the present application, the first network device further includes a local MAC-IP table, the local MAC-IP table includes a first local MAC-IP table entry, and the first local MAC-IP table entry includes a third serial number.

[0204] After the second remote MAC-IP entry is created, if the second remote MAC-IP entry matches the first local MAC-IP entry and the second sequence number is greater than the third sequence number, the first local MAC-IP entry is deleted and the DHCP relay entry corresponding to the first local MAC-IP entry is deleted.

[0205] The second remote MAC-IP entry matches the first local MAC-IP entry in that the MAC address and IP address included in the second remote MAC-IP entry are the same as the MAC address and IP address included in the first local MAC-IP entry.

[0206] It is understandable that if the second sequence number is greater than the third sequence number, it indicates that the terminal corresponding to the first local MAC-IP table entry has migrated to another access device. That is, the first network device will not receive service packets sent by the terminal until the terminal migrates back. Accordingly, the first network device will no longer use the first local MAC-IP table entry to perform validity checks on service packets from the terminal. Therefore, the first local MAC-IP table entry can be deleted, and the DHCP relay table entry corresponding to the first local MAC-IP table entry can be deleted.

[0207] The first network device can delete the first local MAC-IP table entry from the memory and delete the forwarding MAC-IP table entry corresponding to the first local MAC-IP table entry stored in the hardware resources of the hardware forwarding chip. In this way, the memory resources and hardware resources of the first network device can be saved without affecting the security of the network.

[0208] It should be noted that, after generating the first local MAC-IP table entry, the first network device notifies the first local MAC-IP table entry to other network devices. Accordingly, after deleting the first local MAC-IP table entry, the first network device needs to send a MAC-IP revocation message to the other network devices, so that the other network devices delete the remote MAC-IP table entry corresponding to the first local MAC-IP table entry.

[0209] In addition, when the first network device deletes the DHCP relay entry due to reasons such as the terminal releasing the IP address or the IP address lease aging, the local MAC-IP entry corresponding to the DHCP relay entry may be deleted simultaneously.

[0210] In another embodiment of the present application, the first network device includes a local MAC-IP table, the local MAC-IP table including at least one local MAC-IP table entry. After establishing the second remote MAC-IP table entry, the method further includes:

[0211] Step A: Receive a first message sent by a terminal, where the first message includes the MAC address and IP address of the terminal.

[0212] Step B: If there is no local MAC-IP entry matching the MAC address and IP address of the terminal in the local MAC-IP table, and the MAC address and IP address of the terminal match the second remote MAC-IP entry, access detection is performed on the terminal.

[0213] It is understandable that if there is no local MAC-IP table entry that matches the terminal's MAC address and IP address, but the terminal's MAC address and IP address match the second remote MAC-IP table entry, it means that the terminal has migrated from another access device.

[0214] Optionally, after the terminal migrates to the AP connected to the first network device, if the terminal does not immediately renew the IP address lease, the first network device may receive a first message from the terminal, where the first message may be a protocol message or a service message.

[0215] After the first network device receives the first message, the forwarding plane of the first network device generates a first packet event for the source MAC address of the first message. In an IPv6 scenario, this first packet event triggers an ND probe, and in an IPv4 scenario, this first packet event triggers an ARP probe.

[0216] Step C: If an access response is received from the terminal, a composite MAC-IP entry is generated, wherein the composite MAC-IP entry includes the terminal's MAC address and IP address, port ID, and VLAN ID.

[0217] In the IPv4 scenario, after the first network device performs ARP detection, if it receives an access response sent by the terminal, it can generate an ARP table entry, which includes the port identifier and VLAN identifier of the terminal access. Then, the first network device can generate a synthetic MAC-IP table entry based on the second remote MAC-IP table entry and the ARP table entry.

[0218] In the IPv6 scenario, after the first network device performs ND detection, if it receives an access response sent by the terminal, it can generate an ND table entry, which includes the port identifier and VLAN identifier of the terminal access. Then, the first network device can generate a synthetic MAC-IP table entry based on the second remote MAC-IP table entry and the ND table entry.

[0219] Taking the IPv6 scenario as an example, the fields included in the composite MAC-IP entry are shown in Table 4:

[0220] Table 4

[0221] It should be noted that the composite MAC-IP entry is only used in the first network device that generates the composite MAC-IP entry, and the first network device will not notify the composite MAC-IP entry to other network devices.

[0222] The synthesized MAC-IP table entry occupies resources in the memory of the first network device that are used to store control MAC-IP table entries.

[0223] Step D: Generate a forwarding MAC-IP table entry based on the synthesized MAC-IP table entry, where the forwarding MAC-IP table entry includes the MAC address and IP address of the terminal.

[0224] Step E: The forwarding MAC-IP table entry is saved and sent to the hardware resource.

[0225] The hardware resources are hardware resources in the hardware forwarding chip used to store and forward MAC-IP entries.

[0226] Using the above method, after the first network device generates the second remote MAC-IP table entry, the terminal may not have migrated to the terminal connected to the first network device at this time. Therefore, there is no need to use the second remote MAC-IP table entry to perform a security check, and there is no need to send the forwarding MAC-IP table entry corresponding to the second remote MAC-IP table entry to the hardware resource, which can avoid occupying scarce hardware resources. When the first network device determines that the terminal corresponding to the second remote MAC-IP table entry is connected to the first network device, it generates a synthetic MAC-IP table entry and sends the forwarding MAC-IP table entry corresponding to the synthetic MAC-IP table entry to the hardware resource, thereby realizing control plane inspection and forwarding plane inspection of the terminal's message, preventing illegal messages from entering the network, and improving network security.

[0227] Based on the above embodiments, the first network device may delete ARP or ND entries. For example, in an IPv6 scenario, some terminals, when in a locked state or other state, may not respond to ND entry aging detection messages initiated by the first network device, which may cause the ND entry corresponding to the terminal in the first network device to be aged and deleted. Alternatively, if the access device detects that the terminal's access interface is disconnected, the access device may delete the ND entry for the terminal that has come online through that access interface.

[0228] When the access entry of the terminal is deleted, the first network device may delete the composite MAC-IP entry and the forwarding MAC-IP entry.

[0229] The access entry of the terminal is an ND entry or ARP entry corresponding to the terminal.

[0230] Since the first network device will delete the ND table entry or ARP table entry only when it believes that the terminal has been disconnected, and thus there is no need to perform a validity check on the message from the terminal temporarily, the synthetic MAC-IP table entry stored in the memory can be deleted, and the forwarding MAC-IP table entry corresponding to the synthetic MAC-IP table entry can be deleted. This can reduce the occupation of the memory resources and hardware resources of the first network device. Since the second remote MAC-IP table entry corresponding to the synthetic MAC-IP table entry in the first network device has not been deleted, if the terminal accesses again, the first network device can still generate a synthetic MAC-IP table entry based on the second remote MAC-IP table entry, which will not cause the legitimate message from the terminal to be discarded. The first network device uses the synthetic MAC-IP table entry to perform security checks on the message, which can improve network security.

[0231] The following introduces the MAC-IP notification message sent by the first network device.

[0232] The MAC-IP notification message includes a first extended community attribute, and the first extended community attribute includes a valid lifetime value of the IP address.

[0233] Optionally, the MAC-IP notification message includes a second extended community attribute, and the second extended community attribute includes a sequence number of a MAC-IP entry.

[0234] The first network device may send a MAC-IP notification message and a MAC-IP withdrawal message based on the BGP protocol, and both the MAC-IP notification message and the MAC-IP withdrawal message may be BGP update (Update) messages.

[0235] The MAC-IP announcement message may be a BGP update message carrying a Multiprotocol_Reachable_Network Layer Reachability Information (MP_REACH_NLRI) attribute, where the MP_REACH_NLRI attribute indicates that the terminal corresponding to the MAC-IP entry is reachable to the device that sends the MAC-IP announcement message.

[0236] The MAC-IP withdrawal message may be a BGP Update message carrying a Multiprotocol_UNReachable_Network Layer Reachability Information (MP_UNREACH_NLRI) attribute. The MP_UNREACH_NLRI attribute indicates that the terminal corresponding to the MAC-IP table entry is unreachable to the device sending the MAC-IP withdrawal message.

[0237] Both the MP_REACH_NLRI attribute and the MP_UNREACH_NLRI attribute include the MAC-IP NLRI. The format of the MAC-IP NLRI is shown in FIG3 , and includes: Route Type, Length, and Route Type Specific.

[0238] Among them, Route Type represents the type of MAC-IP NLRI, which occupies 1 octet. In the embodiment of the present application, the route type can be defined as the route type used to transmit MAC-IP table entries.

[0239] Length indicates the length of the MAC-IP NLRI, which occupies 1 octet.

[0240] Route Type specific indicates the route type of the MAC-IP NLRI. The number of bits occupied is variable.

[0241] As shown in Figure 4, Route Type specific includes: Route Distinguisher (RD), Ethernet Segment Identifier, Ethernet Tag ID, MAC Address Length, MAC Address, IP Address Length, and IP Address.

[0242] Among them, RD occupies 8 octets;

[0243] Ethernet Segment Identifier is a unique non-zero identifier that identifies an Ethernet segment and occupies 10 octets.

[0244] Ethernet Tag ID is used to store the VLAN ID of the terminal's VLAN and occupies 4 octets.

[0245] MAC Address Length is used to record the terminal's MAC address length and occupies 1 octet.

[0246] MAC Address is used to record the MAC address of the terminal and occupies 6 octets;

[0247] IP Address Length is used to record the length of the terminal's IP address and occupies 1 octet.

[0248] IP Address is used to record the IP address of the terminal, occupying 0, 4, or 16 octets.

[0249] In order to carry the valid lifetime value of the IP address in the MAC-IP table entry in the BGP Update message, the BGP protocol can be extended by introducing the first extended community attribute of the MAC-IP table entry into the BGP protocol. The length of the first extended community attribute can be 16 bytes, and the structure is shown in Figure 5.

[0250] Among them, Type represents the type of the first extended community attribute, and its length is 1 byte. As an example, the value of Type can be 0x8d. The value of Type can be set according to actual conditions, and this embodiment of the application does not limit this.

[0251] Sub-Type indicates the subtype of the first extended community attribute, and its length is 1 byte. As an example, the value of Sub-Type may be 0x01. The value of Sub-Type may be set according to actual conditions, and is not limited in this embodiment of the present application.

[0252] Reserved is a reserved bit with a length of 2 bytes. As an example, the value of Reserved can be 0. The value of Reserved can be set according to actual conditions, and this embodiment of the present application does not limit this.

[0253] Preferred lifetime is the preferred lifetime value of the IP address in the local MAC-IP table entry, with a length of 4 bytes. This parameter is not used in the embodiments of this application.

[0254] Valid lifetime is the valid lifetime value of the IP address in the local MAC-IP table entry and is 4 bytes long.

[0255] Similarly, in order to carry the sequence number in the BGP Update message, the BGP protocol can be extended by introducing a second extended community attribute corresponding to the MAC-IP table entry in the BGP protocol. The second extended community attribute can be 8 bytes long, and the structure is shown in Figure 6.

[0256] Among them, Type represents the type of the second extended community attribute, and its length is 1 byte. As an example, the value of Type can be 0x8e. The value of Type can be set according to actual conditions, and this embodiment of the application does not limit this.

[0257] Sub-Type indicates the subtype of the second extended community attribute, and its length is 1 byte. As an example, the value of Sub-Type may be 0x01. The value of Sub-Type may be set according to actual conditions, and is not limited in this embodiment of the present application.

[0258] Reserved is a reserved bit with a length of 2 bytes. As an example, the value of Reserved can be 0. The value of Reserved can be set according to actual conditions, and this embodiment of the present application does not limit this.

[0259] Sequence Number is the sequence number corresponding to the MAC-IP table entry and is 4 bytes long.

[0260] Corresponding to the above embodiment, an embodiment of the present application further provides a security entry maintenance method, which is applied to a second network device, which may be Spine1, Spine2, or Spine3 in Figure 1. The second network device includes a first remote MAC-IP table, which includes at least one remote MAC-IP entry announced by a fourth network device. As shown in Figure 7, the method includes:

[0261] S701: When the protocol connection with the fourth network device is interrupted, obtain a valid lifetime value included in each remote MAC-IP entry.

[0262] The valid lifetime value is used to indicate the valid lifetime of the IP address included in the remote MAC-IP entry.

[0263] The second network device may be an aggregation device. The fourth network device may be an access device or an aggregation device that has a protocol connection with the second network device.

[0264] Taking the networking system shown in FIG1 as an example, when the second network device is Spine1 in FIG1 , the fourth network device may be Leaf1, Leaf2, or Leaf3, or may be Spine3.

[0265] Alternatively, when the second network device is Spine3 in FIG. 1 , the fourth network device may be Spine1 or Spine2.

[0266] The protocol connection between the second network device and the fourth network device may be a BGP protocol connection. Alternatively, the protocol connection between the second network device and the fourth network device may be a custom private protocol connection. In the case where the protocol connection is a private protocol connection, the network devices communicate MAC-IP table entries through the private protocol.

[0267] S702: If the duration of the protocol connection interruption reaches the valid lifecycle value, delete at least one remote MAC-IP entry.

[0268] It is understood that, when the first remote MAC-IP table includes a MAC-IP entry, the second network device can obtain the valid lifetime value included in the MAC-IP entry. The second network device saves the valid lifetime value of the remote MAC-IP entry starting from the moment when the protocol connection is detected to be interrupted. That is, after detecting the protocol connection interruption, the second network device maintains the valid lifetime value of the remote MAC-IP entry and does not delete the remote MAC-IP entry until the valid lifetime value is reached.

[0269] If the protocol connection is not restored when the time from the start time reaches the valid lifetime value, the remote MAC-IP entry is deleted.

[0270] For example, if the valid lifetime is 100,000 seconds, the second network device starts timing after detecting that the protocol connection is interrupted and keeps the remote MAC-IP entry for 100,000 seconds. If the protocol connection is not restored after 100,000 seconds, the second network device deletes the remote MAC-IP entry.

[0271] In the case that the first remote MAC-IP table includes multiple MAC-IP entries, the second network device may obtain valid lifetime values ​​of the multiple remote MAC-IP entries.

[0272] In one embodiment, after the duration of the protocol connection interruption reaches all the valid life cycle values ​​obtained, that is, after the duration of the protocol connection interruption reaches the maximum life cycle value among the obtained valid life cycle values, the second remote MAC-IP table including multiple MAC-IP table entries is deleted at one time.

[0273] In another implementation, for each valid lifetime value, if the duration of the protocol connection interruption reaches the valid lifetime value, the MAC-IP table entry to which the valid lifetime value belongs is deleted.

[0274] By adopting the above method, the remote MAC-IP table entry in the second network device includes a valid lifetime value, and the valid lifetime value is used to indicate the valid lifetime of the IP address included in the remote MAC-IP table entry. If the duration of the protocol connection interruption reaches the valid lifetime value, it means that the IP address included in the MAC-IP table entry is no longer valid. That is, the terminal that originally applied for the IP address can no longer use the IP address. At this time, deleting the remote MAC-IP table entry will not affect the subsequent legitimacy verification of the terminal, will not affect network security, and can prevent the remote MAC-IP table entry from continuing to occupy the resources of the second network device. Before the duration of the protocol connection interruption reaches the valid lifetime value, the second network device will not delete the remote MAC-IP table entry. Therefore, when the energy address security check mechanism is enabled, the legitimate messages matching the remote MAC-IP table entry will not be discarded, and illegal messages can be prevented from entering the network, which can improve network security.

[0275] In another embodiment of the present application, the second network device may receive MAC-IP entries notified by other network devices. Based on this, in the above S701, when the protocol connection with the fourth network device is interrupted, before obtaining the valid lifetime value in each remote MAC-IP entry, the method further includes:

[0276] Receive a first MAC-IP notification message sent by the fourth network device, and establish a first remote MAC-IP table entry.

[0277] The first MAC-IP notification message includes a first valid lifetime value and a first sequence number of the first IP address. Accordingly, the first remote MAC-IP table entry includes the first valid lifetime value and the first sequence number.

[0278] It is understandable that the first MAC-IP advertisement message further includes a MAC address and a first IP address, and the first remote MAC-IP table entry also includes the MAC address and the first IP address.

[0279] Optionally, the first MAC-IP advertisement message may further include a preferred lifetime value of the first IP address. Accordingly, the first remote MAC-IP table entry also includes the preferred lifetime value of the first IP address.

[0280] It is understandable that network devices can notify each other of MAC-IP entries, so that after the terminal migrates, the access device to which the terminal accesses can still check the legitimacy of the terminal's messages based on the remote MAC-IP entries, reject illegal messages from entering the network, and improve network security.

[0281] In one embodiment of the present application, the second network device further includes at least one second remote MAC-IP table, the at least one second remote MAC-IP table includes a second remote MAC-IP table entry, and the second remote MAC-IP table entry includes a second sequence number. After the second network device establishes the remote MAC-IP table entry, the method further includes:

[0282] If the first sequence number is greater than the second sequence number, a second MAC-IP notification message is sent to other network devices except the fourth network device, where the second MAC-IP notification message includes the first valid lifetime value and the first sequence number.

[0283] Among them, if the first sequence number is greater than the second sequence number, it means that there is no remote table entry in each remote MAC-IP table stored in the second network device that matches the first remote MAC-IP table entry and includes a sequence number greater than the first sequence number.

[0284] It is understandable that for a remote MAC-IP table entry with the same IP address and MAC address, the larger the sequence number, the more recently the remote MAC-IP table entry corresponding to that sequence number was generated. Therefore, if the first sequence number is greater than the second sequence number, it indicates that the first remote MAC-IP table entry is the most recently generated MAC-IP table entry, and thus the first remote MAC-IP table entry needs to be notified to the other network devices except the fourth network device.

[0285] Using the above method, since sequence numbers are used to indicate the order in which MAC-IP table entries corresponding to the same terminal are generated, the larger the sequence number, the later the MAC-IP table entry corresponding to that sequence number was generated. Therefore, a remote MAC-IP table entry with a smaller sequence number may no longer be applicable to the terminal corresponding to that remote MAC-IP table entry. If the first sequence number is greater than the second sequence number, a second MAC-IP advertisement message is sent to the network devices other than the fourth network device. This improves the timeliness and accuracy of MAC-IP advertisements.

[0286] In another embodiment of the present application, based on the embodiment corresponding to Figure 7, the second network device further includes at least one third remote MAC-IP table, and each third remote MAC-IP table includes at least one remote MAC-IP table entry.

[0287] It is understandable that, after generating a remote MAC-IP table entry, the second network device will notify the generated remote MAC-IP table entry to other network devices except the fourth network device. Accordingly, after deleting the remote MAC-IP table entry, the second network device also needs to send a MAC-IP revocation message or a MAC-IP notification message based on the deleted remote MAC-IP table entry. After the second network device deletes at least one remote MAC-IP table entry, there are specifically two situations:

[0288] Case 1: For each deleted remote MAC-IP table entry, if there is no remote MAC-IP table entry matching the remote MAC-IP table entry in at least one third remote MAC-IP table, a first MAC-IP revocation message is sent to other network devices except the fourth network device.

[0289] The first MAC-IP revocation message includes the MAC address and IP address in the remote MAC-IP table entry.

[0290] Furthermore, after receiving the first MAC-IP revocation message, other network devices except the fourth network device can promptly update their own stored remote MAC-IP entries to avoid continuing to use invalid remote MAC-IP entries, thereby improving network security.

[0291] Case 2: For each deleted remote MAC-IP table entry, if there is a remote MAC-IP table entry matching the remote MAC-IP table entry in at least one third MAC-IP table, the third remote MAC-IP table entry with the largest serial number is selected from the other matching MAC-IP table entries, and a fifth MAC-IP notification message is sent to other network devices except the fifth network device.

[0292] The third remote MAC-IP table entry includes a second valid lifetime value and a third sequence number. Accordingly, the third MAC-IP notification message includes the second valid lifetime value and the third sequence number. The fifth network device is the source device of the third remote MAC-IP table entry. The fifth network device can be an access device or an upper-level aggregation device of the aggregation device.

[0293] That is to say, if there are other remote MAC-IP table entries in the second network device that match the deleted remote MAC-IP table entry, the second network device needs to re-announce a remote MAC-IP table entry with the same IP address and MAC address as the deleted remote MAC-IP table entry and the largest sequence number.

[0294] It should be noted that among the remote MAC-IP table entries that match the remote MAC-IP table entry, there may be multiple remote MAC-IP table entries with the largest sequence numbers, that is, multiple remote MAC-IP table entries have the same sequence number and are tied for the largest sequence number. The second network device can then randomly select one of the multiple remote MAC-IP table entries with the largest sequence numbers, use the selected remote MAC-IP table entry with the largest sequence number as the third remote MAC-IP table entry, and notify the other network devices except the fifth network device.

[0295] For example, the second network device stores:

[0296] Remote MAC-IP entry 1 from network device A, sequence number 3;

[0297] Remote MAC-IP entry 2 from network device B, sequence number 2;

[0298] Remote MAC-IP entry 3 from network device C, sequence number 1;

[0299] And the remote MAC-IP table entry 4 from network device D, with sequence number 2.

[0300] The MAC addresses and IP addresses in the above four remote table entries are all the same. After the protocol connection between the second network device and network device A is interrupted, and after the remote MAC-IP table entry 1 is deleted according to the method described in the above embodiment, it can be determined that the sequence numbers of remote MAC-IP table entry 2 and remote MAC-IP table entry 4 are the largest. The second network device randomly selects remote MAC-IP table entry 2 from remote MAC-IP table entry 2 and remote MAC-IP table entry 4, and then the second network device announces remote MAC-IP table entry 2 to network device C and network device D.

[0301] After network device C receives remote MAC-IP entry 2 announced by the second network device, it will find remote MAC-IP entry 1 announced by the second network device last time and modify its own stored remote MAC-IP entry 1 to remote MAC-IP entry 2.

[0302] After network device D receives remote MAC-IP entry 2 announced by the second network device, it will find the remote MAC-IP entry 1 announced by the second network device last time and modify the remote MAC-IP entry 1 stored in itself to remote MAC-IP entry 2.

[0303] In this way, after the second network device deletes the remote MAC-IP table entry, if it still stores other remote MAC-IP table entries with the same MAC address and IP address, it can promptly re-announce the remote MAC-IP table entry to other network devices, thereby preventing other network devices from continuing to use the invalid remote MAC-IP table entry, ensuring the accuracy of the remote MAC-IP table entries stored in each network device, and improving network security.

[0304] The following describes the MAC-IP notification message sent by the second network device:

[0305] The MAC-IP advertisement message sent by the second network device includes a first extended community attribute, and the first extended community attribute includes a valid lifetime value of the IP address.

[0306] The MAC-IP advertisement message sent by the second network device includes a second extended community attribute, and the second extended community attribute includes a sequence number of the MAC-IP entry.

[0307] The format of the MAC-IP notification message may refer to the relevant description in the above embodiment.

[0308] The following describes the security entry maintenance method provided in the embodiments of the present application in conjunction with specific application scenarios.

[0309] As shown in FIG8 , the structure of FIG8 is the same as that of FIG1 , wherein Leaf1, Leaf2, and Leaf3 are access devices, Spine1 and Spine2 are aggregation devices, and Spine3 is the upper-level aggregation device of Spine1 and Spine2.

[0310] After Leaf 1 in Area 1 generates a new local MAC-IP entry, it sends a MAC-IP Advertisement message to Spine 1 over the protocol connection. The MAC-IP Advertisement message includes the IP address in the local MAC-IP entry, the MAC address, the sequence number (SN), and the lifetime of the IP address. The sequence number in the MAC-IP Advertisement message is 1.

[0311] After receiving the MAC-IP advertisement message from Leaf1, Spine1 generates a remote MAC-IP entry. The remote MAC-IP entry includes the IP address, MAC address, SN, and the lifetime of the IP address in the MAC-IP advertisement message.

[0312] At this time, Spine1 only stores a remote MAC-IP table entry with serial number 1 corresponding to the terminal. Spine1 can send a MAC-IP notification message to Leaf2, Leaf3 and Spine3. The MAC-IP notification message includes the content in the remote MAC-IP table entry.

[0313] After receiving the MAC-IP advertisement message, Leaf2, Leaf3, and Spine3 can also generate remote MAC-IP entries.

[0314] Furthermore, assuming that there are no other remote MAC-IP entries in Spine3 that match the remote MAC-IP entry, Spine3 sends a MAC-IP announcement message to spine2 in area 2, and the MAC-IP announcement message includes the content of the remote MAC-IP entry.

[0315] After receiving the MAC-IP advertisement message, spine2 can also generate a remote MAC-IP entry.

[0316] Furthermore, based on Figure 8, if the terminal migrates to AP2 connected to Leaf2, as shown in Figure 9, in one implementation, if the terminal immediately initiates an IPv6 address lease update to the DHCPv6 server, Leaf2 can generate a DHCP relay table entry and generate a local MAC-IP table entry based on the DHCP relay table entry.

[0317] Then, Leaf2 can send a MAC-IP announcement message to Spine1. The sequence number carried in the MAC-IP announcement message is 2. After receiving the MAC-IP announcement message, Spine1 generates a remote MAC-IP table entry based on the MAC-IP announcement message. The sequence number included in the remote MAC-IP table entry is 2.

[0318] At this time, Spine1 determines that a remote MAC-IP with a serial number of 1 and the same MAC address and IP address as the newly generated remote MAC-IP entry is stored locally.

[0319] Because the sequence number in the newly generated remote MAC-IP entry is larger, Spine1 advertises the remote MAC-IP entry with sequence number 2 to Spine3, Leaf1, and Leaf3.

[0320] After Spine3, Leaf1, and Leaf3 receive the MAC-IP announcement message, Leaf1 generates a remote MAC-IP entry with a sequence number of 2. Spine3 and Leaf3 both store a remote MAC-IP entry with a sequence number of 1 from Spine1. The MAC address and IP address in this remote MAC-IP entry are the same as the MAC address and IP address in the MAC-IP announcement message received this time. Spine3 and Leaf3 then modify the remote MAC-IP entry with a sequence number of 1 to a remote MAC-IP entry with a sequence number of 2.

[0321] Spine3 also sends a MAC-IP notification message to Spine2, and Spine2 then modifies the corresponding remote MAC-IP entry with sequence number 1 to the remote MAC-IP entry with sequence number 2.

[0322] If the terminal adopts another implementation method, based on Figure 8, if the terminal migrates to AP2 connected to Leaf2, then as shown in Figure 10, if the terminal does not immediately initiate an IPv6 address lease renewal to the DHCPv6 server, if Leaf2 receives a message sent by the terminal, which can be a protocol message or a service message, it will trigger Leaf2 to perform ND detection on the terminal through the first packet event. Leaf2 learns the ND table entry corresponding to the terminal and generates a synthetic MAC-IP table entry based on the ND table entry and the remote MAC-IP table entry corresponding to the terminal stored on Leaf2.

[0323] It should be noted that, based on the embodiment of Figure 10, after Leaf2 generates a synthetic MAC-IP table entry corresponding to the terminal, if the terminal subsequently initiates an IPv6 address lease update to the DHCPv6 server, the access device can execute the process described in Figure 9, that is, Leaf2 can also generate a local MAC-IP table entry for the terminal.

[0324] Based on the same concept, an embodiment of the present application provides a security entry maintenance device, which is applied to a first network device. The first network device includes a remote MAC-IP table, and the remote MAC-IP table includes at least one remote MAC-IP entry announced by a second network device. As shown in FIG11 , the device includes:

[0325] an acquisition module 1101, configured to acquire, when the protocol connection with the second network device is interrupted, a valid lifetime value included in each remote MAC-IP table entry, the valid lifetime value being used to indicate a valid lifetime of the IP address included in the remote MAC-IP table entry;

[0326] The deleting module 1102 is configured to delete at least one remote MAC-IP entry if the duration of the protocol connection interruption reaches a valid lifecycle value.

[0327] Optionally, the device further comprises:

[0328] an establishing module configured to, when the first network device generates a DHCP relay entry, establish a local MAC-IP entry based on the DHCP relay entry, and issue a forwarding MAC-IP entry corresponding to the local MAC-IP entry to the hardware resource, wherein the local MAC-IP entry includes a first valid lifetime value of the first IP address;

[0329] A sending module, configured to send a first MAC-IP notification message to a third network device, so that the third network device establishes a first remote MAC-IP table entry;

[0330] The first MAC-IP notification message includes a first sequence number and a first valid lifetime value, and the first remote MAC-IP table entry includes a first sequence number and a first valid lifetime value;

[0331] The first sequence number is the sum of the maximum sequence number in the remote MAC-IP table entry that matches the local MAC-IP table entry and 1.

[0332] Optionally, the deleting module 1102 is further configured to delete the forwarding MAC-IP entry when the access entry matched by the local MAC-IP entry is deleted.

[0333] Optionally, the device further comprises:

[0334] a receiving module, configured to receive a second MAC-IP announcement message sent by the second network device, the second MAC-IP announcement message including a second valid lifetime value and a second sequence number of the second IP address;

[0335] The establishing module is used to establish a second remote MAC-IP table entry, where the second remote MAC-IP table entry includes a second valid lifetime value and a second sequence number.

[0336] Optionally, the first network device includes a local MAC-IP table, and the local MAC-IP table includes at least one local MAC-IP table entry;

[0337] The device also includes: a detection module, a generation module and a sending module;

[0338] The receiving module is further configured to receive a first message sent by the terminal, where the first message includes a MAC address and an IP address of the terminal;

[0339] a detection module, configured to perform access detection on the terminal if no local MAC-IP table entry matching the MAC address and IP address of the terminal exists in the local MAC-IP table, and the MAC address and IP address of the terminal match the second remote MAC-IP table entry;

[0340] A generating module, configured to generate a synthetic MAC-IP table entry upon receiving an access response sent by a terminal, the synthetic MAC-IP table entry including the MAC address and IP address of the terminal, a port identifier, and a VLAN identifier;

[0341] The generating module is further configured to generate a forwarding MAC-IP table entry based on the synthesized MAC-IP table entry, wherein the forwarding MAC-IP table entry includes the MAC address and IP address of the terminal;

[0342] The delivery module is used to deliver the forwarding MAC-IP table entries to the hardware resources.

[0343] Optionally, the deleting module 1102 is further configured to delete the synthesized MAC-IP entry and the forwarding MAC-IP entry when the access entry of the terminal is deleted.

[0344] Optionally, the first network device includes a local MAC-IP table, the local MAC-IP table includes a first local MAC-IP table entry, and the first local MAC-IP table entry includes a third sequence number;

[0345] The deleting module 1102 is further configured to delete the first local MAC-IP entry and the DHCP relay entry corresponding to the first local MAC-IP entry if the second remote MAC-IP entry matches the first local MAC-IP entry and the second sequence number is greater than the third sequence number.

[0346] Optionally, the MAC-IP advertisement message sent by the first network device includes a first extended community attribute, and the first extended community attribute includes a valid lifetime value of the IP address.

[0347] Optionally, the MAC-IP advertisement message sent by the first network device further includes a second extended community attribute, and the second extended community attribute includes a sequence number of the MAC-IP table entry.

[0348] Based on the same concept, an embodiment of the present application further provides a security entry maintenance device, which is applied to a second network device, wherein the second network device includes a first remote MAC-IP table, and the first remote MAC-IP table includes at least one remote MAC-IP entry announced by a fourth network device. As shown in FIG12 , the device includes:

[0349] an acquiring module 1201 configured to acquire, when the protocol connection with the fourth network device is interrupted, a valid lifetime value included in each remote MAC-IP table entry, the valid lifetime value being used to indicate a valid lifetime of the IP address included in the remote MAC-IP table entry;

[0350] The deleting module 1202 is configured to delete at least one remote MAC-IP entry if the duration of the protocol connection interruption reaches a valid lifecycle value.

[0351] Optionally, the device further comprises:

[0352] a receiving module, configured to receive a first MAC-IP announcement message sent by a fourth network device, where the first MAC-IP announcement message includes a first valid lifetime value and a first sequence number of the first IP address;

[0353] The establishing module is used to establish a first remote MAC-IP table entry, where the first remote MAC table entry includes a first valid lifetime value and a first sequence number.

[0354] Optionally, the second network device further includes at least one second remote MAC-IP table, the at least one second remote table includes a second remote MAC-IP table entry, the second remote MAC-IP table entry matches the first remote MAC-IP table entry, and the second remote MAC-IP table entry includes a second sequence number; the apparatus further includes:

[0355] The sending module is used to send a second MAC-IP notification message to other network devices except the fourth network device if the first sequence number is greater than the second sequence number, where the second MAC-IP notification message includes the first valid lifetime value and the first sequence number.

[0356] Optionally, the second remote device further includes at least one third remote MAC-IP table, each third remote MAC-IP table including at least one remote MAC-IP table entry; the apparatus further includes a sending module;

[0357] Sending module, used for:

[0358] For each deleted remote MAC-IP table entry, if there is no remote MAC-IP table entry matching the remote MAC-IP table entry in at least one third remote MAC-IP table, sending a first MAC-IP revocation message to other network devices except the fourth network device, where the first MAC-IP revocation message includes the MAC address and IP address in the remote MAC-IP table entry; or

[0359] For each deleted remote MAC-IP table entry, if there is a remote MAC-IP table entry matching the remote MAC-IP table entry in at least one third remote MAC-IP table, select the third remote MAC-IP table entry with the largest sequence number from the matching remote MAC-IP table entries, and the third remote MAC-IP table entry includes a second valid lifetime value and a third sequence number; send a third MAC-IP announcement message to other network devices except the fifth network device, and the third MAC-IP announcement message includes the second valid lifetime value and the third sequence number, and the fifth network device is the source device of the third remote MAC-IP table entry.

[0360] Optionally, the MAC-IP advertisement message sent by the second network device includes a first extended community attribute, and the first extended community attribute includes a valid lifetime value of the IP address.

[0361] Optionally, the MAC-IP advertisement message sent by the second network device further includes a second extended community attribute, and the second extended community attribute includes a sequence number of the MAC-IP table entry.

[0362] Based on the same concept, an embodiment of the present application further provides a first network device, the first network device including a remote MAC-IP table, the remote MAC-IP table including at least one remote MAC-IP table entry advertised by a second network device; as shown in FIG13 , the first network device includes:

[0363] Processor 1301;

[0364] transceiver 1304;

[0365] Machine-readable storage medium 1302, the machine-readable storage medium 1302 stores machine-executable instructions that can be executed by processor 1301; the machine-executable instructions prompt processor 1301 to perform the following steps:

[0366] When the protocol connection with the second network device is interrupted, obtaining a valid lifetime value included in each remote MAC-IP table entry, where the valid lifetime value is used to indicate a valid lifetime of the IP address included in the remote MAC-IP table entry;

[0367] If the duration of the protocol connection interruption reaches the valid lifetime value, at least one remote MAC-IP entry is deleted.

[0368] Optionally, the machine executable instructions further cause the processor 1301 to perform the following steps:

[0369] When the first network device generates a DHCP relay entry, the first network device establishes a local MAC-IP entry based on the DHCP relay entry, and issues a forwarding MAC-IP entry corresponding to the local MAC-IP entry to the hardware resource, where the local MAC-IP entry includes a first valid lifetime value of the first IP address;

[0370] Sending a first MAC-IP notification message to the third network device through the transceiver 1304, so that the third network device establishes a first remote MAC-IP table entry;

[0371] The first MAC-IP notification message includes a first sequence number and a first valid lifetime value, and the first remote MAC-IP table entry includes a first sequence number and a first valid lifetime value;

[0372] The first sequence number is the sum of the maximum sequence number in the remote MAC-IP table entry that matches the local MAC-IP table entry and 1.

[0373] Optionally, the machine executable instructions further cause the processor 1301 to perform the following steps:

[0374] When the access entry that the local MAC-IP entry matches is deleted, the forwarding MAC-IP entry is deleted.

[0375] Optionally, the machine executable instructions further cause the processor 1301 to perform the following steps:

[0376] Receiving, through transceiver 1304, a second MAC-IP advertisement message sent by the second network device, where the second MAC-IP advertisement message includes a second valid lifetime value and a second sequence number of the second IP address;

[0377] A second remote MAC-IP entry is established, where the second remote MAC-IP entry includes a second valid lifetime value and a second sequence number.

[0378] Optionally, the first network device includes a local MAC-IP table, and the local MAC-IP table includes at least one local MAC-IP table entry;

[0379] The machine executable instructions further cause the processor 1301 to perform the following steps:

[0380] Receive a first message sent by the terminal through the transceiver 1304, where the first message includes the MAC address and IP address of the terminal;

[0381] If there is no local MAC-IP entry matching the MAC address and IP address of the terminal in the local MAC-IP table, and the MAC address and IP address of the terminal match the second remote MAC-IP entry, performing access detection on the terminal;

[0382] If an access response is received from the terminal, a composite MAC-IP entry is generated, which includes the terminal's MAC address and IP address, port ID, and VLAN ID.

[0383] Generate a forwarding MAC-IP table entry based on the synthesized MAC-IP table entry, where the forwarding MAC-IP table entry includes the MAC address and IP address of the terminal;

[0384] Deliver the forwarding MAC-IP table entry to the hardware resources.

[0385] Optionally, the machine executable instructions further cause the processor 1301 to perform the following steps:

[0386] When the access entry of the terminal is deleted, the composite MAC-IP entry and the forwarding MAC-IP entry are deleted.

[0387] Optionally, the first network device includes a local MAC-IP table, the local MAC-IP table includes a first local MAC-IP table entry, and the first local MAC-IP table entry includes a third sequence number; the machine-executable instructions further cause the processor 1301 to perform the following steps:

[0388] If the second remote MAC-IP entry matches the first local MAC-IP entry and the second sequence number is greater than the third sequence number, the first local MAC-IP entry is deleted and the DHCP relay entry corresponding to the first local MAC-IP entry is deleted.

[0389] Optionally, the MAC-IP advertisement message sent by the first network device includes a first extended community attribute, and the first extended community attribute includes a valid lifetime value of the IP address.

[0390] Optionally, the MAC-IP advertisement message sent by the first network device further includes a second extended community attribute, and the second extended community attribute includes a sequence number of the MAC-IP table entry.

[0391] In Figure 13 , a communication bus 1303 may also be included. The processor 1301, the machine-readable storage medium 1302, and the transceiver 1304 communicate with each other via the communication bus 1303. The communication bus 1303 may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus. The communication bus may be divided into an address bus, a data bus, a control bus, and the like.

[0392] The transceiver 1304 may be a wireless communication module. Under the control of the processor 1301 , the transceiver 1304 exchanges data with other devices.

[0393] The machine-readable storage medium 1302 may include random access memory (RAM) or non-volatile memory (NVM), such as at least one disk storage device. Alternatively, the machine-readable storage medium may be at least one storage device located remotely from the processor.

[0394] Processor 1301 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic device, discrete hardware component.

[0395] Based on the same concept, an embodiment of the present application further provides a second network device, the second network device including a first remote MAC-IP table, the first remote MAC-IP table including at least one remote MAC-IP table entry advertised by a fourth network device, as shown in FIG14 . The second network device includes:

[0396] Processor 1401;

[0397] transceiver 1404;

[0398] Machine-readable storage medium 1402, the machine-readable storage medium 1402 stores machine-executable instructions that can be executed by processor 1401; the machine-executable instructions prompt processor 1401 to perform the following steps:

[0399] When the protocol connection with the fourth network device is interrupted, obtaining a valid lifetime value included in each remote MAC-IP table entry, where the valid lifetime value is used to indicate a valid lifetime of the IP address included in the remote MAC-IP table entry;

[0400] If the duration of the protocol connection interruption reaches the valid lifetime value, at least one remote MAC-IP entry is deleted.

[0401] Optionally, the machine executable instructions further cause the processor 1401 to perform the following steps:

[0402] receiving, through the transceiver 1404, a first MAC-IP advertisement message sent by the fourth network device, where the first MAC-IP advertisement message includes a first valid lifetime value and a first sequence number of the first IP address;

[0403] A first remote MAC-IP entry is established, where the first remote MAC entry includes a first valid lifetime value and a first sequence number.

[0404] Optionally, the second network device further includes at least one second remote MAC-IP table, the at least one second remote table includes a second remote MAC-IP table entry, the second remote MAC-IP table entry matches the first remote MAC-IP table entry, and the second remote MAC-IP table entry includes a second sequence number; the machine-executable instructions cause the processor 1401 to perform the following steps:

[0405] If the first sequence number is greater than the second sequence number, a second MAC-IP notification message is sent to other network devices except the fourth network device, where the second MAC-IP notification message includes the first valid lifetime value and the first sequence number.

[0406] Optionally, the second remote device further includes at least one third remote MAC-IP table, each of which includes at least one remote MAC-IP table entry; the machine-executable instructions cause the processor 1401 to perform the following steps:

[0407] For each deleted remote MAC-IP table entry, if there is no remote MAC-IP table entry matching the remote MAC-IP table entry in at least one third remote MAC-IP table, sending a first MAC-IP revocation message to other network devices except the fourth network device, where the first MAC-IP revocation message includes the MAC address and IP address in the remote MAC-IP table entry; or

[0408] For each deleted remote MAC-IP table entry, if there is a remote MAC-IP table entry matching the remote MAC-IP table entry in at least one third remote MAC-IP table, select the third remote MAC-IP table entry with the largest sequence number from the matching remote MAC-IP table entries, and the third remote MAC-IP table entry includes a second valid lifetime value and a third sequence number; send a third MAC-IP announcement message to other network devices except the fifth network device, and the third MAC-IP announcement message includes the second valid lifetime value and the third sequence number, and the fifth network device is the source device of the third remote MAC-IP table entry.

[0409] Optionally, the MAC-IP advertisement message sent by the second network device includes a first extended community attribute, and the first extended community attribute includes a valid lifetime value of the IP address.

[0410] Optionally, the MAC-IP advertisement message sent by the second network device further includes a second extended community attribute, and the second extended community attribute includes a sequence number of the MAC-IP table entry.

[0411] In Figure 14 , a communication bus 1403 may also be included. The processor 1401, the machine-readable storage medium 1402, and the transceiver 1404 communicate with each other via the communication bus 1403. The communication bus 1403 may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus. The communication bus may be divided into an address bus, a data bus, a control bus, and the like.

[0412] The transceiver 1404 may be a wireless communication module. Under the control of the processor 1401 , the transceiver 1404 exchanges data with other devices.

[0413] The machine-readable storage medium 1402 may include random access memory (RAM) or non-volatile memory (NVM), such as at least one disk storage device. Alternatively, the machine-readable storage medium may be at least one storage device located remotely from the processor.

[0414] Processor 1401 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic device, discrete hardware component.

[0415] Based on the same inventive concept, in accordance with the security entry maintenance method provided in the above embodiments of the present application, the present application also provides a machine-readable storage medium storing machine-executable instructions that can be executed by a processor. The processor is prompted by the machine-executable instructions to implement any of the steps of the above security entry maintenance method.

[0416] In another embodiment provided by the present application, a computer program product including instructions is also provided, which, when executed on a computer, enables the computer to execute the steps of any security entry maintenance method in the above embodiments.

[0417] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply the existence of any such actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or device comprising the element.

[0418] Each embodiment in this specification is described in a related manner. Similar portions between the embodiments can be referred to in conjunction with each other. Each embodiment focuses on the differences from other embodiments. In particular, the device embodiments are generally similar to the method embodiments, so their description is relatively simple. For related portions, refer to the description of the method embodiments.

[0419] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of this application should be included in the scope of protection of this application.

Claims

1. A security entry maintenance method, characterized in that: Applied to a first network device, the first network device includes a remote MAC-IP table, the remote MAC-IP table includes at least one remote MAC-IP table entry announced by the second network device, the method includes: When the protocol connection with the second network device is interrupted, obtaining a valid life cycle value included in each remote MAC-IP table entry, where the valid life cycle value is used to indicate a valid life cycle of an IP address included in the remote MAC-IP table entry; If the duration of the protocol connection interruption reaches the valid life cycle value, the at least one remote MAC-IP table entry is deleted.

2. The method according to claim 1, characterized in that The method further comprises: When the first network device generates a DHCP relay entry, a local MAC-IP entry is established based on the DHCP relay entry, and a forwarding MAC-IP entry corresponding to the local MAC-IP entry is issued to the hardware resource, wherein the local MAC-IP entry includes a first valid lifecycle value of the first IP address; Sending a first MAC-IP notification message to a third network device so that the third network device establishes a first remote MAC-IP table entry; The first MAC-IP notification message includes a first sequence number and the first valid life cycle value, and the first remote MAC-IP table entry includes the first sequence number and the first valid life cycle value; The first sequence number is the sum of the maximum sequence number in the remote MAC-IP table entry matching the local MAC-IP table entry and 1.

3. The method according to claim 2, characterized in that After sending the forwarding MAC-IP table entry corresponding to the local MAC-IP table entry to the hardware resource, the method further includes: When the access entry matched by the local MAC-IP entry is deleted, the forwarding MAC-IP entry is deleted.

4. The method according to claim 1, characterized in that: Before obtaining the valid life cycle value included in each remote MAC-IP table entry when the protocol connection with the second network device is interrupted, the method further includes: Receive a second MAC-IP announcement message sent by the second network device, where the second MAC-IP announcement message includes a second valid life cycle value and a second sequence number of the second IP address; A second remote MAC-IP table entry is established, wherein the second remote MAC-IP table entry includes the second valid lifetime value and the second sequence number.

5. The method according to claim 4, characterized in that The first network device includes a local MAC-IP table, wherein the local MAC-IP table includes at least one local MAC-IP table entry; After the second remote MAC-IP entry is established, the method further includes: Receiving a first message sent by a terminal, where the first message includes a MAC address and an IP address of the terminal; If there is no local MAC-IP table entry matching the MAC address and IP address of the terminal in the local MAC-IP table, and the MAC address and IP address of the terminal match the second remote MAC-IP table entry, performing access detection on the terminal; If an access response sent by the terminal is received, a synthetic MAC-IP table entry is generated, wherein the synthetic MAC-IP table entry includes the MAC address and IP address, the port identifier and the VLAN identifier of the terminal; Generate a forwarding MAC-IP table entry according to the synthesized MAC-IP table entry, wherein the forwarding MAC-IP table entry includes a MAC address and an IP address of the terminal; The forwarding MAC-IP table entry is sent to the hardware resources.

6. The method according to claim 5, characterized in that After sending the forwarding MAC-IP table entry to the hardware resource, the method further includes: When the access entry of the terminal is deleted, the synthetic MAC-IP entry and the forwarding MAC-IP entry are deleted.

7. The method according to claim 4, characterized in that The first network device includes a local MAC-IP table, the local MAC-IP table includes a first local MAC-IP table entry, and the first local MAC-IP table entry includes a third sequence number; after the second remote MAC-IP table entry is established, the method further includes: If the second remote MAC-IP entry matches the first local MAC-IP entry, and the second sequence number is greater than the third sequence number, the first local MAC-IP entry is deleted, and the DHCP relay entry corresponding to the first local MAC-IP entry is deleted.

8. The method according to any one of claims 1 to 7, characterized in that: The MAC-IP notification message sent by the first network device includes a first extended community attribute, and the first extended community attribute includes a valid life cycle value of an IP address.

9. The method according to claim 8, characterized in that The MAC-IP notification message sent by the first network device also includes a second extended community attribute, and the second extended community attribute includes a sequence number of a MAC-IP table entry.

10. A method for maintaining a security entry, characterized in that: Applied to a second network device, the second network device includes a first remote MAC-IP table, the first remote MAC-IP table includes at least one remote MAC-IP table entry notified by a fourth network device, the method includes: When the protocol connection with the fourth network device is interrupted, obtaining a valid life cycle value included in each remote MAC-IP table entry, wherein the valid life cycle value is used to indicate a valid life cycle of the IP address included in the remote MAC-IP table entry; If the duration of the protocol connection interruption reaches the valid life cycle value, the at least one remote MAC-IP table entry is deleted.

11. The method according to claim 10, characterized in that Before obtaining the valid life cycle value included in each remote MAC-IP table entry when the protocol connection with the fourth network device is interrupted, the method further includes: Receive a first MAC-IP announcement message sent by the fourth network device, where the first MAC-IP announcement message includes a first valid life cycle value and a first sequence number of the first IP address; A first remote MAC-IP table entry is established, wherein the first remote MAC table entry includes the first valid lifetime value and the first sequence number.

12. The method according to claim 11, characterized in that The second network device further includes at least one second remote MAC-IP table, the at least one second remote table includes a second remote MAC-IP entry, the second remote MAC-IP entry matches the first remote MAC-IP entry, and the second remote MAC-IP entry includes a second sequence number; after establishing the first remote MAC-IP entry, the method further includes: If the first sequence number is greater than the second sequence number, a second MAC-IP notification message is sent to other network devices except the fourth network device, where the second MAC-IP notification message includes the first valid life cycle value and the first sequence number.

13. The method according to claim 10, characterized in that The second remote device further comprises at least one third remote MAC-IP table, each third remote MAC-IP table comprising at least one remote MAC-IP table entry; After deleting the at least one remote MAC-IP entry, the method further includes: For each deleted remote MAC-IP table entry, if there is no remote MAC-IP table entry matching the remote MAC-IP table entry in the at least one third remote MAC-IP table, sending a first MAC-IP revocation message to other network devices except the fourth network device, wherein the first MAC-IP revocation message includes a MAC address and an IP address in the remote MAC-IP table entry; or, For each remote MAC-IP entry to be deleted, if there is a remote MAC-IP entry in the at least one third remote MAC-IP table corresponding to the remote MAC-IP If there is a remote MAC-IP table entry that matches the table entry, a third remote MAC-IP table entry with the largest sequence number is selected from the matching remote MAC-IP table entries, and the third remote MAC-IP table entry includes a second valid life cycle value and a third sequence number; a third MAC-IP announcement message is sent to other network devices except the fifth network device, and the third MAC-IP announcement message includes the second valid life cycle value and the third sequence number, and the fifth network device is the source device of the third remote MAC-IP table entry.

14. The method according to any one of claims 10 to 13, characterized in that: The MAC-IP notification message sent by the second network device includes a first extended community attribute, and the first extended community attribute includes a valid life cycle value of an IP address.

15. The method according to claim 14, characterized in that The MAC-IP notification message sent by the second network device also includes a second extended community attribute, and the second extended community attribute includes a sequence number of a MAC-IP table entry.

16. A security entry maintenance device, characterized in that: Applied to a first network device, the first network device includes a remote MAC-IP table, the remote MAC-IP table includes at least one remote MAC-IP table entry notified by the second network device, the apparatus includes: an acquisition module, configured to acquire a valid life cycle value included in each remote MAC-IP table entry when the protocol connection with the second network device is interrupted, wherein the valid life cycle value is used to indicate a valid life cycle of an IP address included in the remote MAC-IP table entry; The deleting module is used to delete the at least one remote MAC-IP table entry if the duration of the protocol connection interruption reaches the valid life cycle value.

17. The device according to claim 16, characterized in that The device also includes: an establishing module, configured to establish a local MAC-IP entry based on the DHCP relay entry when the first network device generates the DHCP relay entry, and issue a forwarding MAC-IP entry corresponding to the local MAC-IP entry to the hardware resource, wherein the local MAC-IP entry includes a first valid lifecycle value of the first IP address; A sending module, configured to send a first MAC-IP notification message to a third network device, so that the third network device establishes a first remote MAC-IP table entry; The first MAC-IP notification message includes a first sequence number and the first valid life cycle value, and the first remote MAC-IP table entry includes the first sequence number and the first valid life cycle value; The first sequence number is the sum of the maximum sequence number in the remote MAC-IP table entry matching the local MAC-IP table entry and 1.

18. The device according to claim 17, characterized in that The deleting module is further configured to delete the forwarding MAC-IP entry when the access entry matched by the local MAC-IP entry is deleted.

19. The device according to claim 16, characterized in that The device also includes: A receiving module, configured to receive a second MAC-IP announcement message sent by the second network device, wherein the second MAC-IP announcement message includes a second valid life cycle value and a second sequence number of the second IP address; An establishing module is used to establish a second remote MAC-IP table entry, wherein the second remote MAC-IP table entry includes the second valid life cycle value and the second sequence number.

20. The device according to claim 19, characterized in that The first network device includes a local MAC-IP table, wherein the local MAC-IP table includes at least one local MAC-IP table entry; The device also includes: a detection module, a generation module and a sending module; The receiving module is further configured to receive a first message sent by a terminal, wherein the first message includes a MAC address and an IP address of the terminal. address; The detection module is used to perform access detection on the terminal if there is no local MAC-IP table entry matching the MAC address and IP address of the terminal in the local MAC-IP table, and the MAC address and IP address of the terminal match the second remote MAC-IP table entry; The generating module is used to generate a synthetic MAC-IP table entry if an access response sent by the terminal is received, wherein the synthetic MAC-IP table entry includes the MAC address and IP address, port identifier and VLAN identifier of the terminal; The generating module is further used to generate a forwarding MAC-IP table entry according to the synthesized MAC-IP table entry, wherein the forwarding MAC-IP table entry includes a MAC address and an IP address of the terminal; The sending module is used to send the forwarding MAC-IP table entry to the hardware resources.

21. The device according to claim 20, characterized in that The deleting module is further used to delete the synthetic MAC-IP entry and the forwarding MAC-IP entry when the access entry of the terminal is deleted.

22. The device according to claim 19, characterized in that The first network device includes a local MAC-IP table, the local MAC-IP table includes a first local MAC-IP table entry, and the first local MAC-IP table entry includes a third sequence number; The deleting module is further configured to delete the first local MAC-IP entry and the DHCP relay entry corresponding to the first local MAC-IP entry if the second remote MAC-IP entry matches the first local MAC-IP entry and the second sequence number is greater than the third sequence number.

23. The device according to any one of claims 16 to 22, characterized in that The MAC-IP notification message sent by the first network device includes a first extended community attribute, and the first extended community attribute includes a valid life cycle value of an IP address.

24. The device according to claim 23, characterized in that The MAC-IP notification message sent by the first network device also includes a second extended community attribute, and the second extended community attribute includes a sequence number of a MAC-IP table entry.

25. A security entry maintenance device, characterized in that: Applied to a second network device, the second network device includes a first remote MAC-IP table, the first remote MAC-IP table includes at least one remote MAC-IP table entry notified by a fourth network device, the apparatus includes: an acquisition module, configured to acquire a valid life cycle value included in each remote MAC-IP table entry when the protocol connection with the fourth network device is interrupted, wherein the valid life cycle value is used to indicate a valid life cycle of an IP address included in the remote MAC-IP table entry; The deleting module is used to delete the at least one remote MAC-IP table entry if the duration of the protocol connection interruption reaches the valid life cycle value.

26. The device according to claim 25, characterized in that The device also includes: A receiving module, configured to receive a first MAC-IP announcement message sent by the fourth network device, wherein the first MAC-IP announcement message includes a first valid life cycle value and a first sequence number of the first IP address; An establishing module is used to establish a first remote MAC-IP table entry, wherein the first remote MAC table entry includes the first valid life cycle value and the first sequence number.

27. The device according to claim 26, characterized in that The second network device further includes at least one second remote MAC-IP table, the at least one second remote table includes a second remote MAC-IP table entry, the second remote MAC-IP table entry matches the first remote MAC-IP table entry, and the second remote MAC-IP table entry includes a second sequence number; the apparatus further includes: A sending module is used to send a second MAC-IP notification message to other network devices except the fourth network device if the first sequence number is greater than the second sequence number, and the second MAC-IP notification message includes the first valid life cycle value and the first sequence number.

28. The device according to claim 25, characterized in that The second remote device further includes at least one third remote MAC-IP table, each third remote MAC-IP table includes at least one remote MAC-IP table entry; the apparatus further includes a sending module; The sending module is used for: For each deleted remote MAC-IP table entry, if there is no remote MAC-IP table entry matching the remote MAC-IP table entry in the at least one third remote MAC-IP table, sending a first MAC-IP revocation message to other network devices except the fourth network device, wherein the first MAC-IP revocation message includes a MAC address and an IP address in the remote MAC-IP table entry; or, For each remote MAC-IP table entry deleted, if there is a remote MAC-IP table entry matching the remote MAC-IP table entry in the at least one third remote MAC-IP table, select a third remote MAC-IP table entry with the largest sequence number from the matching remote MAC-IP table entries, and the third remote MAC-IP table entry includes a second valid life cycle value and a third sequence number; send a third MAC-IP announcement message to other network devices except the fifth network device, and the third MAC-IP announcement message includes the second valid life cycle value and the third sequence number, and the fifth network device is the source device of the third remote MAC-IP table entry.

29. The device according to any one of claims 25 to 28, characterized in that The MAC-IP notification message sent by the second network device includes a first extended community attribute, and the first extended community attribute includes a valid life cycle value of an IP address.

30. The device according to claim 29, characterized in that The MAC-IP notification message sent by the second network device also includes a second extended community attribute, and the second extended community attribute includes a sequence number of a MAC-IP table entry.

31. A first network device, characterized in that: The first network device includes a remote MAC-IP table, wherein the remote MAC-IP table includes at least one remote MAC-IP table entry notified by the second network device; the first network device includes: processor; Transceiver; A machine-readable storage medium storing machine-executable instructions that can be executed by the processor; the machine-executable instructions prompt the processor to perform the following steps: When the protocol connection with the second network device is interrupted, obtaining a valid life cycle value included in each remote MAC-IP table entry, where the valid life cycle value is used to indicate a valid life cycle of an IP address included in the remote MAC-IP table entry; If the duration of the protocol connection interruption reaches the valid life cycle value, the at least one remote MAC-IP table entry is deleted.

32. The first network device according to claim 31, characterized in that: The machine executable instructions further cause the processor to perform the following steps: When the first network device generates a DHCP relay entry, a local MAC-IP entry is established based on the DHCP relay entry, and a forwarding MAC-IP entry corresponding to the local MAC-IP entry is issued to the hardware resource, wherein the local MAC-IP entry includes a first valid lifecycle value of the first IP address; Sending a first MAC-IP notification message to a third network device through the transceiver, so that the third network device establishes a first remote MAC-IP table entry; The first MAC-IP notification message includes a first sequence number and the first valid life cycle value, and the first remote MAC-IP table entry includes the first sequence number and the first valid life cycle value; The first sequence number is the sum of the maximum sequence number in the remote MAC-IP table entry matching the local MAC-IP table entry and 1.

33. The first network device according to claim 32, characterized in that: The machine executable instructions further cause the processor to perform the following steps: When the access entry matched by the local MAC-IP entry is deleted, the forwarding MAC-IP entry is deleted.

34. The first network device according to claim 31, characterized in that The machine executable instructions further cause the processor to perform the following steps: Receiving, by the transceiver, a second MAC-IP announcement message sent by the second network device, wherein the second MAC-IP announcement message includes a second valid life cycle value and a second sequence number of the second IP address; A second remote MAC-IP table entry is established, wherein the second remote MAC-IP table entry includes the second valid lifetime value and the second sequence number.

35. The first network device according to claim 34, characterized in that: The first network device includes a local MAC-IP table, wherein the local MAC-IP table includes at least one local MAC-IP table entry; The machine executable instructions further cause the processor to perform the following steps: Receiving, by a transceiver, a first message sent by a terminal, wherein the first message includes a MAC address and an IP address of the terminal; If there is no local MAC-IP table entry matching the MAC address and IP address of the terminal in the local MAC-IP table, and the MAC address and IP address of the terminal match the second remote MAC-IP table entry, performing access detection on the terminal; If an access response sent by the terminal is received, a synthetic MAC-IP table entry is generated, wherein the synthetic MAC-IP table entry includes the MAC address and IP address, the port identifier and the VLAN identifier of the terminal; Generate a forwarding MAC-IP table entry according to the synthesized MAC-IP table entry, wherein the forwarding MAC-IP table entry includes a MAC address and an IP address of the terminal; The forwarding MAC-IP table entry is sent to the hardware resources.

36. The first network device according to claim 35, characterized in that The machine executable instructions further cause the processor to perform the following steps: When the access entry of the terminal is deleted, the synthetic MAC-IP entry and the forwarding MAC-IP entry are deleted.

37. The first network device according to claim 34, characterized in that: The first network device includes a local MAC-IP table, the local MAC-IP table includes a first local MAC-IP table entry, the first local MAC-IP table entry includes a third sequence number; the machine executable instructions further cause the processor to perform the following steps: If the second remote MAC-IP entry matches the first local MAC-IP entry, and the second sequence number is greater than the third sequence number, the first local MAC-IP entry is deleted, and the DHCP relay entry corresponding to the first local MAC-IP entry is deleted.

38. The first network device according to any one of claims 31 to 37, characterized in that: The MAC-IP notification message sent by the first network device includes a first extended community attribute, and the first extended community attribute includes a valid life cycle value of an IP address.

39. The first network device according to claim 38, characterized in that: The MAC-IP notification message sent by the first network device also includes a second extended community attribute, and the second extended community attribute includes a sequence number of a MAC-IP table entry.

40. A second network device, characterized in that: The second network device includes a first remote MAC-IP table, the first remote MAC-IP table includes at least one remote MAC-IP table entry announced by the fourth network device, and the second network device includes: processor; Transceiver; A machine-readable storage medium storing machine-executable instructions that can be executed by the processor; the machine-executable instructions prompt the processor to perform the following steps: When the protocol connection with the fourth network device is interrupted, obtaining a valid life cycle value included in each remote MAC-IP table entry, wherein the valid life cycle value is used to indicate a valid life cycle of the IP address included in the remote MAC-IP table entry; If the duration of the protocol connection interruption reaches the valid life cycle value, the at least one remote MAC-IP table entry is deleted.

41. The second network device according to claim 40, characterized in that: The machine executable instructions further cause the processor to perform the following steps: Receiving, by the transceiver, a first MAC-IP announcement message sent by the fourth network device, wherein the first MAC-IP announcement message includes a first valid life cycle value and a first sequence number of a first IP address; A first remote MAC-IP table entry is established, wherein the first remote MAC table entry includes the first valid lifetime value and the first sequence number.

42. The second network device according to claim 41, characterized in that: The second network device further includes at least one second remote MAC-IP table, the at least one second remote table including a second remote MAC-IP entry, the second remote MAC-IP entry matches the first remote MAC-IP entry, and the second remote MAC-IP entry includes a second sequence number; the machine executable instructions cause the processor to perform the following steps: If the first sequence number is greater than the second sequence number, a second MAC-IP notification message is sent to other network devices except the fourth network device, where the second MAC-IP notification message includes the first valid life cycle value and the first sequence number.

43. The second network device according to claim 40, characterized in that: The second remote device further includes at least one third remote MAC-IP table, each of which includes at least one remote MAC-IP table entry; and the machine executable instructions cause the processor to perform the following steps: For each deleted remote MAC-IP table entry, if there is no remote MAC-IP table entry matching the remote MAC-IP table entry in the at least one third remote MAC-IP table, sending a first MAC-IP revocation message to other network devices except the fourth network device, wherein the first MAC-IP revocation message includes a MAC address and an IP address in the remote MAC-IP table entry; or, For each remote MAC-IP table entry deleted, if there is a remote MAC-IP table entry matching the remote MAC-IP table entry in the at least one third remote MAC-IP table, select a third remote MAC-IP table entry with the largest sequence number from the matching remote MAC-IP table entries, and the third remote MAC-IP table entry includes a second valid life cycle value and a third sequence number; send a third MAC-IP announcement message to other network devices except the fifth network device, and the third MAC-IP announcement message includes the second valid life cycle value and the third sequence number, and the fifth network device is the source device of the third remote MAC-IP table entry.

44. The second network device according to any one of claims 40 to 43, characterized in that: The MAC-IP notification message sent by the second network device includes a first extended community attribute, and the first extended community attribute includes a valid life cycle value of an IP address.

45. The second network device according to claim 44, characterized in that: The MAC-IP notification message sent by the second network device also includes a second extended community attribute, and the second extended community attribute includes a sequence number of a MAC-IP table entry.

46. ​​A machine-readable storage medium, characterized in that Machine executable instructions are stored, and when called and executed by a processor, the machine executable instructions prompt the processor to implement the method described in any one of claims 1-9 or 10-15.

47. A computer program product, characterized in that The computer program product causes the processor to implement the method of any one of claims 1-9 or 10-15.

Images