Virtual private network routing control method, network equipment and communication system

Abstract

The invention relates to a virtual private network routing control method, network equipment and a communication system, and relates to the field of network technologies and communication technologies. The method disclosed by the invention is executed by network equipment, and comprises the following steps: generating a VPN Prefix ORF entry under the condition that sending equipment of the stored VPN Prefix ORF entry under the same filtering condition comprises all internal border gateway (IBGP) neighbors of the network equipment except for equipment of a next hop address, the next-hop address is the next-hop address sent to network equipment in the direction of source provider equipment PE in the same filtering condition, and the filtering condition in the generated VPN Prefix ORF entry comprises the address of the source PE; and sending the generated VPN Prefix ORF entry to the equipment of the next hop address, so that the equipment of the next hop address filters the VPN route of the source PE.

Description

Technical Field

[0001] The present disclosure relates to the fields of network technology and communication technology, and in particular to a control method for virtual private network routing, a network device and a communication system. Background Art

[0002] In VPN (Virtual Private Network), VPN Prefix ORF (Outbound Route Filters) entries are used to filter VPN routes of PE (Provider Equipment). The upstream device stops sending VPN routes that meet the filtering conditions to the downstream device according to the stored VPN Prefix ORF entries. Summary of the invention

[0003] The inventors found that if an upstream device (e.g., RR (Route Reflector)) stores VPN Prefix ORF (Outbound Route Filter) entries with the same filtering conditions corresponding to all downstream devices (e.g., PE), it is necessary to send VPN routes that meet the filtering conditions to any downstream device. However, when VPN routes arrive, VPN route filtering needs to be continuously performed locally, which wastes upstream device resources.

[0004] A technical problem to be solved by the present disclosure is: how to save resources and improve resource utilization.

[0005] According to some embodiments of the present disclosure, a method for controlling virtual private network routing is provided, comprising: generating a VPNPrefix ORF entry when the sending device of the stored virtual private network prefix export routing filter VPN Prefix ORF entry of the same filtering condition includes all internal border gateway IBGP neighbors of the network device other than the device of the next hop address, wherein the next hop address is the next hop address of the network device in the direction of the source operator device PE in the same filtering condition, and the filtering condition in the generated VPN Prefix ORF entry includes the address of the source PE; sending the generated VPNPrefix ORF entry to the device of the next hop address, so that the device of the next hop address filters the VPN route sent by the source PE.

[0006] In some embodiments, the method further includes: determining a sending device of the stored VPN Prefix ORF entry and a next hop address corresponding to the source PE in the filtering condition.

[0007] In some embodiments, determining a sending device of a stored VPN Prefix ORF entry includes: determining a port field corresponding to the stored VPN Prefix ORF entry in an egress routing filter policy table; and determining a sending device of the stored VPN Prefix ORF entry according to a value of the port field corresponding to the stored VPN Prefix ORF entry.

[0008] In some embodiments, the filtering condition of the stored VPN Prefix ORF entry further includes: a routing identifier RD and a routing target RT of the source PE.

[0009] In some embodiments, determining the next hop address of the address of the source PE in the filtering condition of the stored VPN Prefix ORF entry includes: searching for the next hop address corresponding to the source PE in the forwarding information basic table.

[0010] In some embodiments, in the Option B scenario, the network device is a route reflector RR, and the device at the next hop address is an autonomous system boundary router ASBR within the autonomous system AS, or the network device is an ASBR, and the device at the next hop address is an ASBR within an adjacent AS, and the sending devices of the VPN Prefix ORF entries with the same filtering condition include all internal border gateway IBGP neighbors of the network device other than the device at the next hop address. The situations include: when the network device is RR, the sending devices of the VPN Prefix ORF entries with the same filtering condition include all PEs within the AS where the RR is located; or when the network device is ASBR, the sending device of the VPN Prefix ORF entries with the same filtering condition is the RR within the AS where the ASBR is located.

[0011] In some embodiments, in the Option C scenario, the network device is a route reflector RR, the device at the next hop address is the RR within an adjacent autonomous system AS, and the sending devices of the VPN Prefix ORF entries with the same filtering condition include all internal Border Gateway Protocol IBGP neighbors of the network device other than the device at the next hop address. The situation includes: the sending devices of the VPN Prefix ORF entries with the same filtering condition include all PEs within the AS where the RR is located.

[0012] In some embodiments, the filtering condition in the generated VPN Prefix ORF entry further includes: a routing identifier RD and a routing target RT of the source PE.

[0013] In some embodiments, sending the generated VPN Prefix ORF entry to the device of the next hop address includes: sending the generated VPN Prefix ORF entry to the device of the next hop address via a border gateway routing refresh message.

[0014] In some embodiments, the method further includes: receiving a VPN Prefix ORF entry sent by a sending device; determining whether the received VPN Prefix ORF entry has been stored; and if the received VPN Prefix ORF entry has not been stored, storing the received VPN Prefix ORF entry.

[0015] According to some other embodiments of the present disclosure, a network device is provided, including: a generating module, used to generate a VPNPrefix ORF entry when the sending device of the stored virtual private network prefix export routing filter VPN Prefix ORF entry of the same filtering condition includes all internal border gateway IBGP neighbors of the network device other than the device of the next hop address, wherein the next hop address is the next hop address of the network device in the direction of the source operator device PE in the same filtering condition, and the filtering condition in the generated VPN Prefix ORF entry includes the address of the source PE; a sending module, used to send the generated VPN Prefix ORF entry to the device of the next hop address, so that the device of the next hop address filters the VPN route of the source PE.

[0016] According to some further embodiments of the present disclosure, a network device is provided, comprising: a processor; and a memory coupled to the processor, for storing instructions, which, when executed by the processor, causes the processor to execute a control method for virtual private network routing as in any of the aforementioned embodiments.

[0017] According to some further embodiments of the present disclosure, a non-transitory computer-readable storage medium is provided, on which a computer program is stored, wherein when the program is executed by a processor, the control method for virtual private network routing of any of the aforementioned embodiments is implemented.

[0018] According to some other embodiments of the present disclosure, a communication system is provided, comprising: a network device of any of the aforementioned embodiments; and a sending device, used to send VPN Prefix ORF entries to the network device; a receiving device, used to receive the VPN Prefix ORF entries sent by the network device, and filter VPN routes according to the received VPN Prefix ORF entries, wherein the receiving device is a device having a next hop address corresponding to a source operator device PE in a filtering condition in the VPN Prefix ORF entries sent by the network device, and the next hop address is a next hop address of the network device in a direction toward the source PE.

[0019] In the present disclosure, when the sending device of the VPN Prefix ORF entry storing the same filtering condition includes all the IBGP neighbors of the network device except the device of the next hop address, the VPN Prefix ORF entry is generated and sent to the device of the next hop address, and the VPN route of the source PE is filtered by the next hop device. In this way, the network device directly filters the VPN route upstream of the network device without sending the VPN route that meets the filtering condition to any downstream device, and no longer needs to repeatedly judge the filtering condition locally, which reduces the processing pressure of the network device, saves resources, and further pushes the route filtering work to the sending end of the VPN route, thereby improving the resource utilization rate as a whole.

[0020] Other features and advantages of the present disclosure will become apparent from the following detailed description of exemplary embodiments of the present disclosure with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the embodiments of the present disclosure or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0022] Figure 1 A schematic flow chart showing a method for controlling virtual private network routing according to some embodiments of the present disclosure.

[0023] Figure 2 A schematic diagram of a network architecture in an Option B scenario of some embodiments of the present disclosure is shown.

[0024] Figure 3 A schematic diagram of a network architecture in an Option C scenario of some embodiments of the present disclosure is shown.

[0025] Figure 4 A schematic diagram showing the structure of a network device according to some embodiments of the present disclosure.

[0026] Figure 5 A schematic diagram showing the structure of network devices according to other embodiments of the present disclosure.

[0027] Figure 6 A schematic diagram showing the structure of network devices according to some further embodiments of the present disclosure.

[0028] Figure 7 A schematic diagram showing the structure of a communication system according to some embodiments of the present disclosure. DETAILED DESCRIPTION

[0029] The technical solutions in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, rather than all of the embodiments. The following description of at least one exemplary embodiment is actually only illustrative and is by no means intended to limit the present disclosure and its application or use. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present disclosure.

[0030] The present disclosure proposes a method for controlling virtual private network routing. Figures 1 to 3 Give a description.

[0031] Figure 1 The flowchart of some embodiments of the control method of virtual private network routing disclosed in the present invention. Figure 1 As shown, the method of this embodiment is executed by a network device, and includes steps S102 to S106.

[0032] In step S102, the sending device of the stored VPN Prefix ORF entry and the next hop address corresponding to the source PE in the filtering condition are determined. Step S102 is optional.

[0033] In some embodiments, the network device receives a VPN Prefix ORF entry sent by a sending device; determines whether the received VPN Prefix ORF entry has been stored; and if the received VPN Prefix ORF entry has not been stored, stores the received VPN Prefix ORF entry.

[0034] For example, the network device is RR, and the sending device is PE. When a certain VRF (Virtual Routing and Forwarding) on ​​PE has a route overlimit problem, and other VRFs on PE do not need to receive the VPN routes that cause the overlimit problem, PE will send a VPN Prefix ORF entry to its upstream device (RR). After receiving the VPN Prefix ORF entry, RR will check whether the VPN Prefix ORF entry has been stored locally. If not, the received VPN Prefix ORF entry will be stored. Subsequently, according to the VPN Prefix ORF entry, it will stop sending VPN routes that meet the filtering conditions to PE. If it has been stored, it does not need to store the received VPN Prefix ORF entry.

[0035] In some embodiments, the received VPN Prefix ORF entry is compared with information stored in an ORF-Policy (egress routing filter policy) table to determine whether the received VPN Prefix ORF entry has been stored.

[0036] For example, the fields corresponding to each VPN Prefix ORF entry in the ORF-Policy table include: Action, Match, Offending VPN routes process method, Sequence, VRF prefix limit, Route Distinguisher (RD), Source PE, Route Target (RT), Interface, and other fields.

[0037] The VPN Prefix ORF entries are shown in Table 1, including: Action, Match, OffendingVPN routes process method, Length, Sequence, VRF prefix limit, Route Distinguisher (RD, route identifier), OptionalTLVs (optional type length value). Source PE, RT, interface and other values ​​can be configured in Optional TLVs.

[0038] Table 1

[0039] Action(2bits) Match(1bit) Offending VPN Routes Process Method(1bit) Reserved(4 bits) Sequence(32bits) Length(16bits) VRF Prefix Limit(16bits) Route Distinguisher(64bits) Optional TLVs(variable)

[0040] By comparing the information such as the port, RD, RT and address of the source PE corresponding to the received VPN Prefix ORF entry with the information stored in the ORF-Policy table, it can be determined whether the received VPN Prefix ORF entry has been stored.

[0041] In some embodiments, each time a VPN Prefix ORF entry is received and stored, the sending device of the stored VPN Prefix ORF entry and the next hop address corresponding to the source PE in the filtering condition are determined, or the sending device of the stored VPN Prefix ORF entry and the next hop address corresponding to the source PE in the filtering condition are determined every preset period. Step S102 may also be triggered in other ways, not limited to the examples given.

[0042] In some embodiments, in the ORF-Policy table, a port field corresponding to a stored VPN Prefix ORF entry is determined; and a sending device of the stored VPN Prefix ORF entry is determined according to a value of the port field corresponding to the stored VPN Prefix ORF entry.

[0043] In some embodiments, the next hop address corresponding to the source PE is the next hop address of the network device in the direction of the source PE, that is, the next hop address of the network device when the address of the source PE is the destination address. It should be noted that when the VPN route of the PE needs to be filtered through the VPN Prefix ORF entry, the PE is called Source PE in the ORF-Policy table or VPNPrefix ORF entry. However, when determining the next hop address corresponding to the PE, the address of the PE is used as the destination address for search, which is not contradictory.

[0044] In some embodiments, the next hop address corresponding to the source PE is searched in the FIB (Forwarding Information Base) table. For example, the address of the source PE is matched with the destination address (Destination / mask) field in the FIB table, and the next hop address corresponding to the destination address that is the same as the address of the source PE is used as the next hop address corresponding to the source PE.

[0045] In some embodiments, the filtering conditions of the VPN Prefix ORF entry include: RD, RT and IP address of the source PE.

[0046] In step S104, a VPN Prefix ORF entry is generated when the sending devices of the VPN Prefix ORF entry of the same filtering condition include all IBGP (Internal Border Gateway Protocol) neighbors of the network device other than the device of the next hop address.

[0047] The VPN Prefix ORF entry for the same filtering condition may include one or more VPN Prefix ORF entries. For example, when the network device is an ASBR (Autonomous System Boundary Router) and the sending device is an RR, the VPN Prefix ORF entry for the same filtering condition may include only one; when the network device is an RR and the sending device is a PE, the VPN Prefix ORF entry for the same filtering condition may include multiple entries.

[0048] In some embodiments, when the network device is RR, it is possible to first check whether there is a VPN Prefix ORF entry in the local ORF-Policy table with the same filtering condition but a different sending device. If so, it is determined whether the sending device of the VPN Prefix ORF entry with the same filtering condition includes all IBGP neighbors of the network device other than the device of the next hop address.

[0049] In some embodiments, when the network device is an ASBR, it can be directly determined whether the sending device of the VPNPrefix ORF entry of the same filtering condition includes all IBGP neighbors of the network device other than the device of the next hop address.

[0050] In some embodiments, in the Option B scenario, the network device is an RR, the device at the next hop address is an ASBR within the AS (Autonomous system), or the network device is an ASBR, the device at the next hop address is an ASBR within an adjacent AS, and the sending devices of the VPN Prefix ORF entries with the same filtering condition include all internal border gateway IBGP neighbors of the network device other than the device at the next hop address. The following situations include: when the network device is an RR, the sending devices of the VPN Prefix ORF entries with the same filtering condition include all PEs within the AS where the RR is located; or, when the network device is an ASBR, the sending device of the VPN Prefix ORF entries with the same filtering condition is the RR within the AS where the ASBR is located.

[0051] like Figure 2 As shown, in the Option B cross-domain scenario, ASBR1 of AS1 and ASBR2 of AS2 are eBGP (external border gateway protocol) peers. PE1, PE2, ASBR1 and RR1 in AS1 are iBGP peers (neighbors), and PE3, PE4, ASBR2 and RR2 in AS2 are iBGP peers.

[0052] For RR1, PE1 and PE2 both send VPN Prefix ORF entries with the same filtering conditions (RD = RD1, Source PE = IP4, RT = RT1) to RR1. Figure 2PE4 in the filter. RR1 checks the local ORF-Policy table for a VPN Prefix ORF entry with the same filter condition but different sending devices. It then checks the IP address value (IP4) of the Source PE (PE4) in the filter condition and searches the FIB table for the next hop address corresponding to the IP address (IP4) destined for PE4. The next hop address is the IP address of ASBR1. RR1 determines whether the sending devices of the VPN Prefix ORF entry with the same filter condition cover all IBGP neighbors (i.e., PE1 and PE2) except ASBR1. If so, RR1 generates a VPN Prefix ORF entry.

[0053] For ASBR1, RR1 sends a VPN Prefix ORF entry to ASBR1. ASBR1 checks the IP address value (IP4) of the Source PE (PE4) in the filter condition and searches the FIB table for the next hop address corresponding to the IP address (IP4) bound for PE4. The next hop address is RR2. ASBR1 determines that the sending device (ie, RR1) of the VPN Prefix ORF entry with the same filter condition is the only connected IBGP neighbor, so it generates the VPN Prefix ORF entry.

[0054] In some embodiments, in the Option C scenario, the network device is RR, the device at the next hop address is RR in an adjacent AS, and the sending devices of the VPN Prefix ORF entries with the same filtering condition include all IBGP neighbors of the network device other than the device at the next hop address. The situations include: the sending devices of the VPN Prefix ORF entries with the same filtering condition include all PEs in the AS where the RR is located.

[0055] like Figure 3 As shown in the figure, in the Option C cross-domain scenario, RR1 of AS1 and RR2 of AS2 are eBGP peers. In AS1, PE1, PE2, PE3 and RR1 are iBGP peers (neighbors), and in AS2, PE4, PE5, PE6 and RR2 are iBGP peers.

[0056] For RR1, PE1, PE2, and PE3 all send VPN Prefix ORF entries with the same filtering conditions (RD = RD1, Source PE = IP4, RT = RT1) to RR1. That is, the source PE is Figure 3RR1 checks the local ORF-Policy table for VPN Prefix ORF entries with the same filter conditions but different sending devices. It then checks the IP address value (IP4) of the Source PE (PE4) in the filter conditions and searches the FIB table for the next hop address corresponding to the IP address (IP4) destined for PE4. The next hop address is the IP address of RR2. RR1 determines whether the sending devices of the VPN Prefix ORF entries with the same filter conditions cover all IBGP neighbors (i.e., PE1, PE2, and PE3) except RR2. If so, RR1 generates a VPN Prefix ORF entry.

[0057] The filtering conditions of the generated VPN Prefix ORF entry include: RD, RT, and IP address of the source PE.

[0058] In step S106, the generated VPN Prefix ORF entry is sent to the device at the next hop address, so that the device at the next hop address filters the route of the source PE.

[0059] The device of the next hop address is the upstream device of the network device in the direction from the source PE to the network device. The generated VPN Prefix ORF entry is sent to the upstream device, and the VPN route can be filtered at the upstream device. The network device can mark the corresponding stored VPN Prefix ORF entry as not to be matched when sending the generated VPN Prefix ORF entry, which can save resources.

[0060] In some embodiments, the generated VPNPrefix ORF entry is sent to the device of the next hop address via a border gateway route refresh (BGP ROUTE REFRESH) message.

[0061] like Figure 2 As shown in the figure, in the Option B cross-domain scenario, RR1 sends the generated VPN Prefix ORF entry to ASBR1 through the BGP ROUTE REFRESH message; after receiving the VPN Prefix ORF entry, ASBR1 stops sending VPN routes that meet the filtering conditions to RR1. Since RR1 is the only directly connected iBGP neighbor of ASBR1, ASBR1 also generates a VPN Prefix ORF entry carrying the corresponding filtering conditions (RD = RD1, Source PE = IP4, RT = RT1) and sends it to ASBR2 through the BGP ROUTE REFRESH message. After receiving the VPN Prefix ORF entry, ASBR2 stops sending VPN routes that meet the filtering conditions to ASBR1.

[0062] like Figure 3 As shown in FIG. 1 , in the Option C cross-domain scenario, RR1 sends the generated VPN Prefix ORF entry to RR2 through a BGP ROUTE REFRESH message. After receiving the VPN Prefix ORF entry, RR2 stops sending VPN routes that meet the filtering conditions to RR1.

[0063] In some embodiments, for a network device with multiple IBGP neighbors, the network device can first determine whether there is a VPN Prefix ORF entry with the same filtering condition but a different sending device. If so, determine the next hop address corresponding to the source PE in the filtering condition, and determine whether the sending device of the VPN Prefix ORF entry with the same filtering condition includes all IBGP neighbors of the network device other than the device with the next hop address. If so, generate a VPN Prefix ORF entry including the filtering condition corresponding to the source PE, and send the generated VPN Prefix ORF entry to the upstream device (the device with the next hop address corresponding to the source PE).

[0064] In some embodiments, for a network device with only one IBGP neighbor, after receiving the VPNPrefix ORF entry, the network device may directly generate a VPN Prefix ORF entry including a filter condition corresponding to the source PE, and send the generated VPN Prefix ORF entry to the upstream device.

[0065] In some embodiments, the network device can determine whether the device at the next hop address corresponding to the source PE in the filtering condition in the received VPN Prefix ORF entry is a device within the AS. If so, determine whether the sending device of the VPNPrefix ORF entry with the same filtering condition includes all IBGP neighbors of the network device other than the device at the next hop address. If so, generate a VPN Prefix ORF entry including the filtering condition corresponding to the source PE, and send the generated VPN Prefix ORF entry to the upstream device. Otherwise, directly generate a VPN Prefix ORF entry including the filtering condition corresponding to the source PE, and send the generated VPN Prefix ORF entry to the upstream device.

[0066] The upstream device filters the VPN routes that meet the filtering conditions based on the received VPN Prefix ORF entries.

[0067] In the above embodiment, the network device determines the sending device of the stored VPN Prefix ORF entry and the next hop address corresponding to the source PE in the filtering condition. If the sending device of the VPN Prefix ORF entry of the same filtering condition includes all IBGP neighbors of the network device other than the device of the next hop address, a VPN Prefix ORF entry is generated and sent to the device of the next hop address, and the VPN route of the source PE is filtered by the next hop device. In this way, the network device directly filters the VPN route upstream of the network device without sending the VPN route that meets the filtering condition to any downstream device, and no longer needs to repeatedly judge the filtering condition locally, which reduces its own processing pressure, saves resources, and further pushes the route filtering work to the sending end of the VPN route, thereby improving resource utilization as a whole.

[0068] The present disclosure also provides a network device, Figure 4 Give a description.

[0069] Figure 4 FIG. 1 is a structural diagram of some embodiments of the network device disclosed in the present invention. Figure 4 As shown, the network device 40 of this embodiment includes: a generating module 420 and a sending module 430. In some embodiments, the network device 40 may further include a determining module 410.

[0070] The determination module 410 is used to determine the sending device of the stored virtual private network prefix export routing filter VPN Prefix ORF entry and the next hop address corresponding to the source operator equipment PE in the filtering condition, wherein the next hop address is the next hop address of the network device in the direction of sending to the source PE.

[0071] In some embodiments, the determination module 410 is used to determine the port field corresponding to the stored VPN Prefix ORF entry in the egress routing filter policy table; and determine the sending device of the stored VPN Prefix ORF entry according to the value of the port field corresponding to the stored VPN Prefix ORF entry.

[0072] In some embodiments, the filtering condition of the stored VPN Prefix ORF entry further includes: a routing identifier RD and a routing target RT of the source PE.

[0073] In some embodiments, the determination module 410 is used to search the forwarding information basic table for the next hop address corresponding to the source PE.

[0074] The generating module 420 is used to generate a VPN Prefix ORF entry when the sending device of the VPN Prefix ORF entry of the same filtering condition includes all internal border gateway IBGP neighbors of the network device other than the device of the next hop address, wherein the filtering condition in the generated VPN Prefix ORF entry includes the address of the source PE.

[0075] In some embodiments, in the option B scenario, the network device is a route reflector RR, and the device at the next hop address is an autonomous system border router ASBR within the autonomous system AS, or the network device is an ASBR, and the device at the next hop address is an ASBR within an adjacent AS, and the sending devices of the VPN Prefix ORF entries with the same filtering condition include all internal border gateway IBGP neighbors of the network device other than the device at the next hop address. The situations include: when the network device is RR, the sending devices of the VPN Prefix ORF entries with the same filtering condition include all PEs within the AS where the RR is located; or when the network device is ASBR, the sending device of the VPN Prefix ORF entries with the same filtering condition is the RR within the AS where the ASBR is located.

[0076] In some embodiments, in the option C scenario, the network device is a route reflector RR, the device of the next hop address is the RR within an adjacent autonomous system AS, and the sending devices of the VPN Prefix ORF entries with the same filtering condition include all internal Border Gateway Protocol IBGP neighbors of the network device other than the device of the next hop address. The situation includes: the sending devices of the VPN Prefix ORF entries with the same filtering condition include all PEs within the AS where the RR is located.

[0077] In some embodiments, the filtering condition in the generated VPN Prefix ORF entry further includes: a routing identifier RD and a routing target RT of the source PE.

[0078] The sending module 430 is used to send the generated VPN Prefix ORF entry to the device at the next hop address, so that the device at the next hop address filters the VPN route of the source PE.

[0079] In some embodiments, the sending module 430 is configured to send the generated VPNPrefix ORF entry to the device of the next hop address via a border gateway routing refresh message.

[0080] In some embodiments, the network device 40 further includes: a receiving module 440, configured to receive a VPNPrefix ORF entry sent by a sending device; a storage module 450, configured to determine whether the received VPN Prefix ORF entry has been stored; and if the received VPN Prefix ORF entry has not been stored, storing the received VPN Prefix ORF entry.

[0081] The network devices in the embodiments of the present disclosure may be implemented by various computing devices or computer systems. Figure 5 as well as Figure 6 Give a description.

[0082] Figure 5 FIG. 1 is a structural diagram of some embodiments of the network device disclosed in the present invention. Figure 5 As shown, the network device 50 of this embodiment includes: a memory 510 and a processor 520 coupled to the memory 510, and the processor 520 is configured to execute the control method of the virtual private network routing in any of some embodiments of the present disclosure based on the instructions stored in the memory 510.

[0083] The memory 510 may include, for example, a system memory, a fixed non-volatile storage medium, etc. The system memory may store, for example, an operating system, an application program, a boot loader, a database, and other programs.

[0084] Figure 6 FIG. 1 is a structural diagram of some other embodiments of the network device disclosed in the present invention. Figure 6 As shown, the network device 60 of this embodiment includes: a memory 610 and a processor 620, which are similar to the memory 510 and the processor 520 respectively. It can also include an input and output interface 630, a network interface 640, a storage interface 650, etc. These interfaces 630, 640, 650 and the memory 610 and the processor 620 can be connected, for example, through a bus 660. Among them, the input and output interface 630 provides a connection interface for input and output devices such as a display, a mouse, a keyboard, and a touch screen. The network interface 640 provides a connection interface for various networked devices, for example, it can be connected to a database server or a cloud storage server. The storage interface 650 provides a connection interface for external storage devices such as SD cards and USB flash drives.

[0085] The present disclosure also provides a communication system, Figure 7 Give a description.

[0086] Figure 7 FIG. 1 is a structural diagram of some embodiments of the communication device disclosed in the present invention. Figure 7As shown, the communication device 7 of this embodiment includes: the network device 40 / 50 / 60 of any of the aforementioned embodiments, as well as a sending device 72 and a receiving device 74.

[0087] The sending device 72 is used to send the VPN Prefix ORF entry to the network device.

[0088] The receiving device 74 is used to receive the VPN Prefix ORF entry sent by the network device, and filter the VPN route according to the received VPN Prefix ORF entry, wherein the receiving device is the device of the next hop address corresponding to the source operator device PE in the filtering condition in the VPN Prefix ORF entry sent by the network device, and the next hop address is the next hop address of the network device in the direction toward the source PE.

[0089] The receiving device 74 is an upstream device of the network device in the direction from the source PE to the network device. The network device, the sending device, and the receiving device may be different for different scenarios. For details, please refer to the description of the above embodiment, which will not be repeated here.

[0090] Those skilled in the art will appreciate that the embodiments of the present disclosure may be provided as methods, systems, or computer program products. Therefore, the present disclosure may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present disclosure may take the form of a computer program product implemented on one or more computer-usable non-transient storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0091] The present disclosure is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present disclosure. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0092] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0093] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0094] The above description is only a preferred embodiment of the present disclosure and is not intended to limit the present disclosure. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present disclosure should be included in the protection scope of the present disclosure.

Claims

1. A method for controlling virtual private network routing, executed by a network device, comprising: In the case where the sending device of the stored virtual private network prefix export routing filter VPN Prefix ORF entry of the same filtering condition includes all internal border gateway IBGP neighbors of the network device other than the device of the next hop address, generating a VPN Prefix ORF entry, wherein the next hop address is the next hop address of the network device in the direction of the source operator device PE in the same filtering condition, and the filtering condition in the generated VPN Prefix ORF entry includes the address of the source PE; The generated VPN Prefix ORF entry is sent to the device at the next hop address, so that the device at the next hop address filters the VPN route sent by the source PE.

2. The control method according to claim 1, further comprising: Determine the sending device of the stored VPN Prefix ORF entry and the next hop address corresponding to the source PE in the filter condition.

3. The control method according to claim 2, wherein: The sending device for determining the stored VPN Prefix ORF entry includes: In the egress routing filter policy table, determining the port field corresponding to the stored VPN Prefix ORF entry; A sending device of the stored VPNPrefix ORF entry is determined according to a value of a port field corresponding to the stored VPNPrefix ORF entry.

4. The control method according to claim 2, wherein: The filtering condition of the stored VPN Prefix ORF entry also includes: the routing identifier RD and the routing target RT of the source PE.

5. The control method according to claim 2, wherein: Determining the next hop address of the address of the source PE in the filtering condition of the stored VPN Prefix ORF entry includes: The next hop address corresponding to the source PE is searched in the forwarding information basic table.

6. The control method according to claim 1, wherein: In the Option B scenario, the network device is a route reflector RR, and the device at the next hop address is an autonomous system boundary router ASBR in the autonomous system AS, or the network device is an ASBR, and the device at the next hop address is an ASBR in an adjacent AS. The case where the sending device of the VPN Prefix ORF entry of the same filtering condition includes all the internal border gateway IBGP neighbors of the network device other than the device of the next hop address includes: In the case where the network device is a RR, the sending devices of the VPN Prefix ORF entry of the same filtering condition include all PEs in the AS where the RR is located; or In the case that the network device is an ASBR, the sending device of the VPN Prefix ORF entry of the same filtering condition is the RR in the AS where the ASBR is located.

7. The control method according to claim 1, wherein: In the Option C scenario, the network device is a route reflector RR, and the device of the next hop address is an RR in an adjacent autonomous system AS. The case where the sending device of the VPN Prefix ORF entry of the same filtering condition includes all internal Border Gateway Protocol (IBGP) neighbors of the network device other than the device of the next hop address includes: The sending devices of the VPN Prefix ORF entry with the same filtering condition include all PEs in the AS where the RR is located.

8. The control method according to claim 1, wherein: The filtering conditions in the generated VPN Prefix ORF entry also include: the routing identifier RD and the routing target RT of the source PE.

9. The control method according to claim 1, wherein: The device for sending the generated VPN Prefix ORF entry to the next hop address includes: The generated VPN Prefix ORF entry is sent to the device of the next hop address via a border gateway routing refresh message.

10. The control method according to any one of claims 1 to 9, further comprising: Receiving the VPN Prefix ORF entry sent by the sending device; Determine whether the received VPN Prefix ORF entry is stored; If the received VPN Prefix ORF entry is not stored, the received VPN Prefix ORF entry is stored.

11. A network device comprising: A generating module, configured to generate a VPN Prefix ORF entry when a sending device of a stored virtual private network prefix export routing filter VPNPrefix ORF entry of the same filtering condition includes all internal border gateway IBGP neighbors of the network device other than the device of the next hop address, wherein the next hop address is the next hop address of the network device in the direction of the source operator device PE in the same filtering condition, and the filtering condition in the generated VPN Prefix ORF entry includes the address of the source PE; The sending module is used to send the generated VPN Prefix ORF entry to the device of the next hop address, so that the device of the next hop address filters the VPN route sent by the source PE.

12. A network device comprising: processor; as well as A memory coupled to the processor is used to store instructions, and when the instructions are executed by the processor, the processor executes the control method for virtual private network routing as described in any one of claims 1-10.

13. A non-transitory computer-readable storage medium having a computer program stored thereon, wherein: When the program is executed by a processor, the steps of the method according to any one of claims 1 to 10 are implemented.

14. A communication system comprising: The network device according to claim 11 or 12; as well as A sending device, used for sending a VPN Prefix ORF entry to the network device; A receiving device is used to receive the VPN Prefix ORF entry sent by the network device, and filter the VPN route according to the received VPNPrefix ORF entry, wherein the receiving device is a device of the next hop address corresponding to the source operator device PE in the filtering condition in the VPNPrefix ORF entry sent by the network device, and the next hop address is the next hop address of the network device in the direction toward the source PE.

Images