Network configuration method and device, electronic equipment and storage medium

Abstract

The invention provides a network configuration method and device, electronic equipment and a storage medium. The method comprises the following steps: creating a GRE tunnel between first firewall equipment and second firewall equipment; configuring a first virtual interface address for the first firewall device, and configuring a second virtual interface address and a third virtual interface address for the second firewall device; target static NAT mapping is configured for the second firewall device, the internal address of the target static NAT mapping is the IP address of the cloud security service, and the external address of the target static NAT mapping is the third virtual interface address; and configuring a target static route of the second firewall equipment passing through the GRE tunnel interface so as to get through a channel between the cloud security management platform and the cloud security service. According to the method, the network path between the cloud security management platform and the cloud security service can be opened on the premise that the public network address of the cloud security service is not exposed, so that the public network exposure degree of the cloud security service is reduced, and the security of the cloud security service is improved.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a network configuration method, device, electronic device and storage medium. Background Art

[0002] The cloud security management platform is a product that provides security services to cloud users. In order to support the enabling of security services, the cloud security management platform needs to manage cloud security services.

[0003] In actual applications, customers' cloud situations are relatively complex, including private clouds and edge clouds. For private clouds, security services and cloud security management platforms are deployed in private clouds, and the cloud security management platform can manage security services through intranet addresses. For edge clouds, the security services deployed there are far away from the cloud security management platform in the central location, and the cloud security management platform needs to manage security services through the public network. This makes the security services deployed in the edge cloud exposed to the public network in the form of public network address ports, increasing the exposure to the public network and bringing certain security risks. Summary of the invention

[0004] In order to overcome the problems existing in the related art, the present application provides a network configuration method, device, electronic device and storage medium.

[0005] According to a first aspect of an embodiment of the present application, a network configuration method is provided, the method comprising:

[0006] Creating a GRE tunnel between a first firewall device of a first cloud network and a second firewall device of a second cloud network;

[0007] Configuring a first virtual interface address for the GRE tunnel interface of the first firewall device, and configuring a second virtual interface address as a primary address and a third virtual interface address as a backup address for the GRE tunnel interface of the second firewall device;

[0008] Configure a target static NAT mapping for the second firewall device, wherein the internal address of the target static NAT mapping is the IP address of the cloud security service, and the external address of the target static NAT mapping is the third virtual interface address;

[0009] Configure the target static route of the second firewall device through the GRE tunnel interface to open up the path between the cloud security management platform and the cloud security service, wherein the destination network segment of the target static route is the network segment where the cloud security management platform is located, and the next hop address of the target static route is the first virtual interface address.

[0010] According to a second aspect of an embodiment of the present application, a network configuration device is provided, the device comprising:

[0011] A tunnel creation module, configured to create a GRE tunnel between a first firewall device of a first cloud network and a second firewall device of a second cloud network;

[0012] An address configuration module, configured to configure a first virtual interface address for the GRE tunnel interface of the first firewall device, and to configure a second virtual interface address as a primary address and a third virtual interface address as a backup address for the GRE tunnel interface of the second firewall device;

[0013] A mapping configuration module, configured to configure a target static NAT mapping for the second firewall device, wherein the internal address of the target static NAT mapping is the IP address of the cloud security service, and the external address of the target static NAT mapping is the third virtual interface address;

[0014] A routing configuration module is used to configure the target static route of the second firewall device through the GRE tunnel interface to open up the path between the cloud security management platform and the cloud security service, wherein the destination network segment of the target static route is the network segment where the cloud security management platform is located, and the next hop address of the target static route is the first virtual interface address.

[0015] According to a third aspect of an embodiment of the present application, an electronic device is provided, comprising a processor and a machine-readable storage medium, wherein the machine-readable storage medium stores machine-executable instructions that can be executed by the processor, and the processor is prompted by the machine-executable instructions to implement the steps of the network configuration method as described above.

[0016] According to a fourth aspect of an embodiment of the present application, a computer-readable storage medium is provided, wherein a computer program is stored in the computer-readable storage medium, and when the computer program is executed by a processor, the steps of the network configuration method described above are implemented.

[0017] The technical solution provided by the embodiments of the present application may have the following beneficial effects:

[0018] In an embodiment of the present application, a network configuration method is provided, which can open up a network path between a cloud security management platform and a cloud security service without exposing the public network address of the cloud security service, thereby reducing the public network exposure of the cloud security service and improving the security of the cloud security service.

[0019] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The accompanying drawings, which are incorporated in the specification and constitute a part of this application, illustrate embodiments consistent with the application and, together with the description, serve to explain the principles of the application.

[0021] Figure 1 A schematic diagram of a flow chart of a network configuration method provided in an embodiment of the present application;

[0022] Figure 2 A diagram of the cloud platform system architecture provided for an embodiment of the present application;

[0023] Figure 3 Another flowchart of the network configuration method provided in the embodiment of the present application;

[0024] Figure 4 This is a schematic diagram of the traditional network configuration solution;

[0025] Figure 5 A schematic diagram of a network configuration scheme provided for an embodiment of the present application;

[0026] Figure 6 A schematic diagram of the structure of a network configuration device provided in an embodiment of the present application;

[0027] Figure 7 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0028] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0029] The terms used in this application are for the purpose of describing specific embodiments only and are not intended to limit this application. The singular forms of "a", "said" and "the" used in this application and the appended claims are also intended to include plural forms unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0030] It should be understood that, although the terms first, second, third, etc. may be used in the present application to describe various information, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of the present application, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the words "if" or "if" as used herein may be interpreted as "at the time of" or "when...".

[0031] First, the concepts involved in the embodiments of the present application are introduced.

[0032] GRE tunnel (Generic Routing Encapsulation Tunnel) is a network tunnel technology used to encapsulate data packets of a certain protocol so that these encapsulated data packets can be transmitted in another network. The network layer protocols of the data packets before and after encapsulation can be the same or different. The path for the encapsulated data packets to be transmitted in the network is called a GRE tunnel.

[0033] Static NAT (Network Address Translation) is a network address translation technology used to map internal addresses in a private network to external addresses in a public network. It is usually used to enable devices in an internal network to communicate on an external network (such as the Internet) and maintain reachability with devices in the external network at a specific address.

[0034] Next, the embodiments of the present application are described in detail.

[0035] The present application embodiment provides a network configuration method, such as Figure 1 As shown, the method comprises the following steps:

[0036] Step 110: Create a GRE tunnel between the first firewall device of the first cloud network and the second firewall device of the second cloud network;

[0037] Step 120: configure a first virtual interface address for the GRE tunnel interface of the first firewall device, and configure a second virtual interface address as a primary address and a third virtual interface address as a backup address for the GRE tunnel interface of the second firewall device;

[0038] Step 130: configure a target static NAT mapping for the second firewall device, wherein the internal address of the target static NAT mapping is the IP address of the cloud security service, and the external address of the target static NAT mapping is the third virtual interface address;

[0039] Step 140: Configure the target static route of the second firewall device through the GRE tunnel interface to open up the path between the cloud security management platform and the cloud security service, wherein the destination network segment of the target static route is the network segment where the cloud security management platform is located, and the next hop address of the target static route is the first virtual interface address.

[0040] The purpose of this embodiment is to provide a network configuration method to open up the network path between the cloud security management platform and the cloud security service, so that the cloud security service no longer relies on exposing its own public network address to establish a connection with the cloud security management platform, thereby reducing the public network exposure of the cloud security service and improving the security of the cloud security service.

[0041] Among them, the cloud security management platform and cloud security services are deployed in different cloud networks. Figure 2 As shown, the cloud security management platform of this embodiment is deployed in the first cloud network, the cloud security service is deployed in the second cloud network, the first cloud network is deployed with a first firewall device, and the second cloud network is deployed with a second firewall device. As a specific implementation method, the first cloud network is a private cloud network, and the second cloud network is an edge cloud network.

[0042] In this embodiment, when creating a GRE tunnel, it is necessary to configure the source address and destination address of the GRE tunnel, and configure the address of the GRE tunnel interface. Specifically, on the first firewall device, a first GRE tunnel instance is created, the source address of the first GRE tunnel instance is configured as the address of the first firewall device, the destination address is configured as the address of the second firewall device, and the address of the GRE tunnel interface of the first firewall device is configured as the first virtual interface address; on the second firewall device, a second GRE tunnel instance is created, the source address of the second GRE tunnel instance is configured as the address of the second firewall device, the destination address is configured as the address of the first firewall device, and the address of the GRE tunnel interface of the second firewall device is configured as the second virtual interface address and the third virtual interface address, wherein the second virtual interface address is the primary address, and the third virtual interface address is the backup interface address.

[0043] After the GRE tunnel is created, the first firewall device implements routing and forwarding of data packets in the GRE tunnel according to the first virtual interface address, and the second firewall device implements routing and forwarding of data packets in the GRE tunnel according to the second virtual interface address.

[0044] This embodiment configures the target static NAT mapping for the second firewall device. Specifically, the internal address of the target static NAT mapping is the IP address of the cloud security service, and the external address is the third virtual interface address. That is, this embodiment maps the IP address of the cloud security service to the third virtual interface address of the GRE tunnel interface of the second firewall device, so that the cloud security service can communicate with the second firewall device through the third virtual interface address.

[0045] Specifically, to create a GRE tunnel, this embodiment pre-configures a target VPN network segment. When configuring the interface address, a first virtual interface address is allocated to the GRE tunnel interface of the first firewall device from the target VPN network segment, and a second virtual interface address and a third virtual interface address are allocated to the GRE tunnel interface of the second firewall device from the target VPN network segment.

[0046] Correspondingly, after configuring the target static NAT mapping as described above for the second firewall device, the cloud security service can communicate with the device (including but not limited to the second firewall device) located in the above-mentioned target VPN segment through the third virtual interface address.

[0047] After configuring the target static NAT mapping for the second firewall device, this embodiment further configures the target static route of the second firewall device through the GRE tunnel interface. At this point, the network path between the cloud security management platform and the cloud security service has been opened. The cloud security management platform can manage the cloud security service. Specifically, the third virtual interface address and the port number of the cloud security service are sent to the cloud security management platform, so that the cloud security management platform performs management operations on the cloud security service. Specifically, the cloud security service can be managed through the RESTFUL API.

[0048] As described above, this embodiment provides a network configuration method, and a specific network configuration process can be started based on a network configuration request, such as Figure 3 As shown:

[0049] Step 310: receiving a network configuration request;

[0050] Step 320: Determine the cloud security management platform to be configured and the cloud security service to be configured according to the network configuration request;

[0051] Step 330: Determine the first cloud network where the cloud security management platform is located, and determine the second cloud network where the cloud security service is located.

[0052] Step 340: Obtain a first address of a first firewall device of a first cloud network and a second address of a second firewall device of a second cloud network;

[0053] Step 350: Create a GRE tunnel between the first firewall device and the second firewall device according to the first address and the second address.

[0054] Step 360: configure a first virtual interface address for the GRE tunnel interface of the first firewall device, and configure a second virtual interface address as a primary address and a third virtual interface address as a backup address for the GRE tunnel interface of the second firewall device;

[0055] Step 370: configure a target static NAT mapping for the second firewall device, wherein the internal address of the target static NAT mapping is the IP address of the cloud security service, and the external address is the third virtual interface address;

[0056] Step 380: configure the target static route of the second firewall device through the GRE tunnel interface to open up a path between the cloud security management platform and the cloud security service, wherein the destination network segment of the target static route is the network segment where the cloud security management platform is located, and the next hop address is the first virtual interface address;

[0057] Step 390: Send the third virtual interface address and the port number of the cloud security service to the cloud security management platform so that the cloud security management platform performs management operations on the cloud security service.

[0058] The following uses actual applications as examples to illustrate the traditional network configuration scheme and the network configuration method provided in the embodiments of the present application.

[0059] like Figure 4 As shown in the figure, a virtual machine VM1 is created in edge cloud 1, and cloud security services, such as bastion host services, are deployed in virtual machine VM1. The IP address of the bastion host service is configured as 192.168.1.6. In the traditional network configuration scheme, in order to open up the network path between the cloud security service and the cloud security management platform, NAT mapping is configured on the egress firewall device FW1 of edge cloud 1, and the port 8899 of the public network address 29.29.30.1 of the egress firewall device FW1 is mapped to the port 443 of the IP address of the bastion host service. To achieve management, a bastion host service instance is created on the cloud security management platform, and the input IP address is configured as 29.29.30.1, the input port is configured as 8899, and the account password and other information are recorded to achieve management of the bastion host service.

[0060] It can be seen that the above traditional network configuration solution exposes the bastion host service to the public network in the form of a public network address port, which brings certain security risks to the cloud security service.

[0061] To avoid the above problems, the present application provides a network configuration method, such as Figure 5 shown.

[0062] In this embodiment, the cloud security management platform M2 is deployed in the private cloud, and the cloud security service is deployed on the virtual machine VM1 of the edge cloud 1. The above cloud security service can be a bastion host service. Taking the bastion host service as an example, the network configuration process is as follows:

[0063] Assign a GRE VPN network segment, and establish a GRE tunnel between the egress firewall device FW1 of edge cloud 1 and the egress firewall device FW2 of the private cloud through the public network address. On the egress firewall device FW1 of edge cloud 1, assign a virtual interface address from the GRE VPN network segment to the GRE tunnel, referred to as address A, and statically NAT address A to the IP address of the bastion service inside the edge cloud. On the firewall device FW2 of the private cloud, assign a virtual interface address from the GRE VPN network segment to the GRE tunnel, referred to as address B. Add a static route to the egress firewall device FW1 of edge cloud 1, with the destination network segment being the network segment where the cloud security management platform is located and the next hop address being the egress address B. After that, create a bastion instance on the security management platform, configure the IP address to address A, configure the port to the port of the bastion service, save the instance information, and implement the management of the bastion service on the cloud security management platform.

[0064] Specifically, the steps for network configuration of the cloud security management platform and bastion host service are as follows:

[0065] Step 1. Create a virtual machine VM1 in edge cloud 1, deploy a bastion host service in the virtual machine VM1, and set the IP address of the bastion host service to 192.168.1.6;

[0066] Step 2: Allocate a GRE VPN network segment of 9.9.9.0 / 24;

[0067] Step 3. Create a new GRE tunnel instance on the egress firewall device FW1 of edge cloud 1, set the source address of the GRE tunnel to the IP address 29.29.30.1 of FW1, the destination address to the IP address 29.29.29.1 of FW2, the GRE tunnel interface number to 6, the GRE tunnel interface name to Tun6, the virtual interface address of the GRE tunnel interface to 9.9.9.1, which is the primary address;

[0068] Step 4. Create a new GRE tunnel instance on the private cloud firewall device FW2, set the source address of the GRE tunnel to FW2's IP address 29.29.29.1, the destination address to FW1's IP address 29.29.30.1, the GRE tunnel interface number to 6, the GRE tunnel interface name to Tun6, and the virtual interface address of the GRE tunnel interface to 9.9.9.2;

[0069] Step 5. After the GRE tunnel is built, add a virtual interface address 9.9.9.10 to the GRE tunnel interface of the firewall device FW1 at the edge cloud 1 egress. This virtual interface address is used as a backup address.

[0070] Step 6: Add static NAT on the firewall device FW1 at the edge cloud 1 exit. The intranet address of the static NAT is the IP address 192.168.1.6 of the bastion server service, and the external network address is the above-mentioned standby virtual interface address 9.9.9.10.

[0071] Step 7. Add a static route on the firewall device FW1 at the edge cloud 1 egress. The destination network segment of the static route is the network segment 8.8.8.0 / 24 where the cloud security management platform is located, and the next hop address is 9.9.9.2.

[0072] Step 8. Create a bastion host instance on the cloud security management platform, enter the IP address as 9.9.9.10, and the port as the default port 443 of the bastion host. This completes the management of the bastion host service.

[0073] It can be seen from the above technical solutions that the embodiment of the present application provides a network configuration method that can open up the network path between the cloud security management platform and the cloud security service without exposing the public network address of the cloud security service, thereby reducing the public network exposure of the cloud security service and improving the security of the cloud security service.

[0074] Based on the same inventive concept, the present application also provides a network configuration device, whose structural diagram is as follows: Figure 6 As shown, specifically including:

[0075] A tunnel creation module 610, configured to create a GRE tunnel between a first firewall device of a first cloud network and a second firewall device of a second cloud network;

[0076] An address configuration module 620, configured to configure a first virtual interface address for the GRE tunnel interface of the first firewall device, and to configure a second virtual interface address as a primary address and a third virtual interface address as a backup address for the GRE tunnel interface of the second firewall device;

[0077] A mapping configuration module 630, configured to configure a target static NAT mapping for the second firewall device, wherein the internal address of the target static NAT mapping is the IP address of the cloud security service, and the external address of the target static NAT mapping is the third virtual interface address;

[0078] The routing configuration module 640 is used to configure the target static route of the second firewall device through the GRE tunnel interface to open up the path between the cloud security management platform and the cloud security service, wherein the destination network segment of the target static route is the network segment where the cloud security management platform is located, and the next hop address of the target static route is the first virtual interface address.

[0079] As a specific implementation, the first cloud network is a private cloud network, and the second cloud network is an edge cloud network.

[0080] As a specific implementation, the device further includes:

[0081] A request receiving module, used for receiving a network configuration request;

[0082] An object determination module, used to determine the cloud security management platform to be configured and the cloud security service to be configured according to the network configuration request;

[0083] The network determination module is used to determine the first cloud network where the cloud security management platform is located, and to determine the second cloud network where the cloud security service is located.

[0084] As a specific implementation, the tunnel creation module 610 specifically includes:

[0085] An address acquisition unit, used to acquire a first address of a first firewall device and a second address of a second firewall device;

[0086] A tunnel creation unit is used to create a GRE tunnel between the first firewall device and the second firewall device according to the first address and the second address.

[0087] As a specific implementation, the device further includes:

[0088] A management module is used to send the third virtual interface address and the port number of the cloud security service to the cloud security management platform, so that the cloud security management platform performs a management operation on the cloud security service.

[0089] The present application also provides an electronic device, such as Figure 7 As shown, it includes a processor 710 and a machine-readable storage medium 720, wherein the machine-readable storage medium 720 stores machine-executable instructions that can be executed by the processor 710, and the processor 710 is prompted by the machine-executable instructions to implement the steps of any of the above-mentioned network configuration methods.

[0090] The machine-readable storage medium may include a random access memory (RAM) or a non-volatile memory (NVM), such as at least one disk storage. Optionally, the machine-readable storage medium may also be at least one storage device located away from the processor.

[0091] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0092] In another embodiment provided in the present application, a computer-readable storage medium is provided, in which a computer program is stored. When the computer program is executed by a processor, the steps of any of the above network configuration methods are implemented.

[0093] The embodiment of the present application also provides a cloud security network system, the cloud security network system comprising: a cloud security management platform deployed on a first cloud network, and also comprising a cloud security service deployed on a second cloud network;

[0094] A GRE tunnel is created between the first firewall device of the first cloud network and the second firewall device of the second cloud network;

[0095] The address of the GRE tunnel interface of the first firewall device is configured as a first virtual interface address, and the address of the GRE tunnel interface of the second firewall device is configured as a second virtual interface address and a third virtual interface address, wherein the second virtual interface address is used as a primary address and the third virtual interface address is used as a backup address;

[0096] The second firewall device is configured with a target static NAT mapping, the internal address of the target static NAT mapping is the IP address of the cloud security service, and the external address is the third virtual interface address;

[0097] The target static route of the second firewall device through the GRE tunnel interface is configured as follows: the destination network segment is the network segment where the cloud security management platform is located, and the next hop address is the first virtual interface address.

[0098] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

Claims

1. A network configuration method, characterized in that: The method comprises: Creating a GRE tunnel between a first firewall device of a first cloud network and a second firewall device of a second cloud network; Configuring a first virtual interface address for the GRE tunnel interface of the first firewall device, and configuring a second virtual interface address as a primary address and a third virtual interface address as a backup address for the GRE tunnel interface of the second firewall device; Configure a target static NAT mapping for the second firewall device, wherein the internal address of the target static NAT mapping is the IP address of the cloud security service, and the external address of the target static NAT mapping is the third virtual interface address; Configure the target static route of the second firewall device through the GRE tunnel interface to open up the path between the cloud security management platform and the cloud security service, wherein the destination network segment of the target static route is the network segment where the cloud security management platform is located, and the next hop address of the target static route is the first virtual interface address.

2. The method according to claim 1, characterized in that The first cloud network is a private cloud network, and the second cloud network is an edge cloud network.

3. The method according to claim 1, characterized in that The method further comprises: receiving a network configuration request; Determining the cloud security management platform to be configured and the cloud security service to be configured according to the network configuration request; Determine a first cloud network where the cloud security management platform is located, and determine a second cloud network where the cloud security service is located.

4. The method according to claim 3, characterized in that The method further comprises: Obtaining a first address of a first firewall device and a second address of a second firewall device; A GRE tunnel is created between the first firewall device and the second firewall device according to the first address and the second address.

5. The method according to claim 1, characterized in that The method further comprises: The third virtual interface address and the port number of the cloud security service are sent to the cloud security management platform so that the cloud security management platform performs a management operation on the cloud security service.

6. A network configuration device, characterized in that: The device comprises: A tunnel creation module, configured to create a GRE tunnel between a first firewall device of a first cloud network and a second firewall device of a second cloud network; An address configuration module, configured to configure a first virtual interface address for the GRE tunnel interface of the first firewall device, and to configure a second virtual interface address as a primary address and a third virtual interface address as a backup address for the GRE tunnel interface of the second firewall device; A mapping configuration module, configured to configure a target static NAT mapping for the second firewall device, wherein the internal address of the target static NAT mapping is the IP address of the cloud security service, and the external address of the target static NAT mapping is the third virtual interface address; A routing configuration module is used to configure the target static route of the second firewall device through the GRE tunnel interface to open up the path between the cloud security management platform and the cloud security service, wherein the destination network segment of the target static route is the network segment where the cloud security management platform is located, and the next hop address of the target static route is the first virtual interface address.

7. The device according to claim 6, characterized in that The device also includes: A request receiving module, used for receiving a network configuration request; An object determination module, used to determine the cloud security management platform to be configured and the cloud security service to be configured according to the network configuration request; The network determination module is used to determine the first cloud network where the cloud security management platform is located, and to determine the second cloud network where the cloud security service is located.

8. The device according to claim 6, characterized in that The device also includes: A management module is used to send the third virtual interface address and the port number of the cloud security service to the cloud security management platform, so that the cloud security management platform performs a management operation on the cloud security service.

9. An electronic device, characterized in that: The method comprises a processor and a machine-readable storage medium, wherein the machine-readable storage medium stores machine-executable instructions that can be executed by the processor, and the processor is prompted by the machine-executable instructions to implement the method steps described in any one of claims 1 to 5.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method steps of any one of claims 1 to 5 are implemented.

Images