Transparent access method, device and equipment for network traffic composer and medium

Abstract

The invention discloses a network traffic composer transparent access method and device, equipment and a medium, and relates to the technical field of networks. The method comprises the following steps: constructing a virtual network cable; the virtual network cable comprises an input interface and an output interface; the incoming interface is connected with a communication port of a previous-hop network device of a network traffic composer, and the outgoing interface is connected with a communication port of a next-hop network device of the network traffic composer; the last-hop network equipment and the next-hop network equipment belong to the same two-layer network; the input address resolution protocol flow is directly forwarded to the output interface through the input interface; and forwarding the input IP traffic to a network traffic composer through the incoming interface, so that the network traffic composer sends the IP traffic to a corresponding security device, and sends the IP traffic passing through the security device to the outgoing interface. Transparent access of the network traffic composer can be realized.

Description

Technical Field

[0001] The present invention relates to the field of network technology, and in particular to a method, device, equipment and medium for transparently accessing a network traffic scheduler. Background Art

[0002] ‌A network traffic orchestrator is a tool used to manage and optimize network traffic. It can achieve efficient management and utilization of network traffic through intelligent orchestration and resource scheduling. For example, SSLO (Secure Sockets Layer Orchestrator) can perform intelligent traffic orchestration to ensure that different types of application traffic are processed by different security devices, thereby improving the utilization rate of security devices and the stability and security of the network architecture.

[0003] In the prior art, network traffic orchestrators are mostly deployed in a three-layer routing mode, which requires configuring network segments separately on the orchestrator device to direct traffic to the orchestrator device; however, this will destroy the original network topology and increase additional workload such as re-planning network segments. Summary of the invention

[0004] In view of this, the purpose of the present invention is to provide a method, device, equipment and medium for transparent access to a network traffic orchestrator, which can realize transparent access to a network traffic orchestrator. The specific scheme is as follows:

[0005] In a first aspect, the present application discloses a method for transparently accessing a network traffic orchestrator, comprising:

[0006] Construct a virtual network cable; the virtual network cable includes an input interface and an output interface; the input interface is connected to the communication port of the previous hop network device of the network traffic scheduler, and the output interface is connected to the communication port of the next hop network device of the network traffic scheduler; the previous hop network device and the next hop network device belong to the same layer 2 network;

[0007] Forwarding the input address resolution protocol traffic directly to the output interface through the input interface;

[0008] The input IP traffic is forwarded to the network traffic orchestrator through the inbound interface, so that the network traffic orchestrator sends the IP traffic to the corresponding security device and sends the IP traffic passing through the security device to the outbound interface.

[0009] Optionally, the constructing a virtual network cable includes:

[0010] A virtual network cable is constructed based on two interfaces; the interfaces are physical interfaces or aggregate interfaces.

[0011] Optionally, before forwarding the input IP traffic to the network traffic orchestrator through the inbound interface, the method further includes:

[0012] The traffic inputted by the inbound interface is parsed by a three-layer protocol, and the type of the traffic is determined according to the parsing result; the traffic type includes IP traffic and address resolution protocol traffic.

[0013] Optionally, the network traffic orchestrator sends the IP traffic to a corresponding security device, including:

[0014] Determine the message header information of the IP traffic;

[0015] Determine whether the IP traffic meets the matching condition according to the message header information;

[0016] If the matching condition is met, the security device corresponding to the IP traffic is called from the security resource pool;

[0017] If the matching condition is not met, the IP traffic is directly forwarded to the outbound interface.

[0018] Optionally, calling a security device corresponding to the IP traffic from a security resource pool includes:

[0019] Determine all target security devices corresponding to the IP traffic;

[0020] Each of the target security devices is called from the security resource pool in turn to perform security detection on the IP traffic until all the target security devices have completed the execution.

[0021] Optionally, sending the IP traffic passing through the security device to the outbound interface includes:

[0022] Based on the message header information of the IP traffic, the IP traffic passing through the security device is restored to obtain a restored IP data packet;

[0023] The restored IP data packet is sent to the outgoing interface.

[0024] Optionally, before forwarding the input IP traffic to the network traffic orchestrator through the inbound interface, the method further includes:

[0025] Record the inbound interface information corresponding to the IP traffic;

[0026] Sending the IP traffic passing through the security device to the outbound interface includes:

[0027] Query virtual network cable information according to the input interface information to determine that the input interface information corresponds to the output interface information;

[0028] According to the outbound interface information, the IP traffic passing through the security device is sent to the outbound interface.

[0029] In a second aspect, the present application discloses a network traffic orchestrator transparent access device, comprising:

[0030] A virtual network cable construction module is used to construct a virtual network cable; the virtual network cable includes an input interface and an output interface; the input interface is connected to the communication port of the previous hop network device of the network traffic orchestrator, and the output interface is connected to the communication port of the next hop network device of the network traffic orchestrator; the previous hop network device and the next hop network device belong to the same layer 2 network;

[0031] An IP traffic processing module, configured to forward the input IP traffic to the network traffic orchestrator through the inbound interface, so that the network traffic orchestrator sends the IP traffic to the corresponding security device, and sends the IP traffic passing through the security device to the outbound interface;

[0032] The address resolution protocol traffic processing module is used to directly forward the input address resolution protocol traffic to the output interface through the input interface.

[0033] In a third aspect, the present application discloses an electronic device, comprising:

[0034] Memory, used to store computer programs;

[0035] A processor is used to execute the computer program to implement the aforementioned network traffic orchestrator transparent access method.

[0036] In a fourth aspect, the present application discloses a computer-readable storage medium for storing a computer program; wherein the computer program, when executed by a processor, implements the aforementioned network traffic orchestrator transparent access method.

[0037] In the present application, a virtual network cable is constructed; the virtual network cable includes an input interface and an output interface; the input interface is connected to the communication port of the previous-hop network device of the network traffic orchestrator, and the output interface is connected to the communication port of the next-hop network device of the network traffic orchestrator; the previous-hop network device and the next-hop network device belong to the same Layer 2 network; the input address resolution protocol traffic is directly forwarded to the output interface through the input interface, and the input IP traffic is forwarded to the network traffic orchestrator through the input interface, so that the network traffic orchestrator sends the IP traffic to the corresponding security device, and sends the IP traffic passing through the security device to the output interface. It can be seen that by constructing a virtual network cable, the network traffic orchestrator is between the input interface and the output interface between the virtual network cables, the input interface is connected to the communication port of the previous-hop network device of the network traffic orchestrator, and the output interface is connected to the communication port of the next-hop network device of the network traffic orchestrator. Therefore, without changing the network topology, the traffic is directed to the network traffic orchestrator, realizing transparent access of the network traffic orchestrator in the Layer 2 network; and the address resolution protocol traffic is directly and transparently forwarded to the output interface, and the input interface forwards the IP traffic to the security device for detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0039] Figure 1 A flow chart of a method for transparent access to a network traffic orchestrator provided in this application;

[0040] Figure 2 A specific network traffic orchestrator transparent access structure diagram provided for this application;

[0041] Figure 3 A flow chart of a specific network traffic determination method provided by this application;

[0042] Figure 4 A specific flow chart of the IP traffic processing method provided for this application;

[0043] Figure 5 A flow chart of a specific flow security detection method provided for this application;

[0044] Figure 6 A schematic diagram of the structure of a transparent access device for a network traffic orchestrator provided in this application;

[0045] Figure 7 A structural diagram of an electronic device provided for this application. DETAILED DESCRIPTION

[0046] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0047] In the prior art, network traffic orchestrators are mostly deployed in a three-layer routing mode, which requires configuring network segments separately on the orchestrator device to direct traffic to the orchestrator device; however, this will destroy the original network topology and increase additional workload such as re-planning network segments. In order to overcome the above technical problems, this application proposes a method for transparent access to a network traffic orchestrator, which can achieve transparent access to a network traffic orchestrator.

[0048] The present application embodiment discloses a method for transparently accessing a network traffic scheduler. Figure 1 As shown, the method may include the following steps:

[0049] Step S11: construct a virtual network cable; the virtual network cable includes an input interface and an output interface; the input interface is connected to the communication port of the previous-hop network device of the network traffic orchestrator, and the output interface is connected to the communication port of the next-hop network device of the network traffic orchestrator; the previous-hop network device and the next-hop network device belong to the same Layer 2 network.

[0050] In this embodiment, a virtual network cable is first constructed. Specifically, a virtual network cable is constructed based on two interfaces, which can be physical ports or aggregated ports (bond); a virtual network cable including an input interface and an output interface is obtained, that is, the virtual network cable is an abstraction of the physical port. Two physical ports or aggregated ports are selected, and the virtual network cable binds and associates them. The data packets entering from one of the ports are forwarded from the other port, thereby achieving the network cable effect. Among them, the input interface is connected to the communication port of the previous hop network device of the network traffic orchestrator, and the output interface is connected to the communication port of the next hop network device of the network traffic orchestrator.

[0051] It should be noted that the previous-hop network device and the next-hop network device are in the same Layer 2 network, and the network traffic orchestrator is directly connected in series between the previous-hop network device and the next-hop network device, one port in the virtual network cable is connected to the communication port of the previous-hop network device, and the other port is connected to the communication port of the server. The above-mentioned network traffic orchestrator can be a SSLO device, which can be connected in series through Layer 2 transparent access without changing the original network topology.

[0052] For example Figure 2 As shown in the figure, by associating the NET4 and NET5 interfaces to form a virtual network, the DDoS (Distributed Denial-of-Service Attack) protection device and the WAF (Web Application Firewall) device are in the same Layer 2 network; the traffic coming in from the NET4 port is decrypted by the SSLO device and transmitted to the security device in plain text, and the traffic passing through the security device returns to the SSLO device, and then the SSLO device encrypts the traffic, and then forwards the encrypted traffic to the server through the NET5 interface, achieving the effect of transparency to the server; that is, Layer 2 transparent access of the SSLO device is achieved without changing the original network topology.

[0053] In addition, an identifier is added to the interface associated with the virtual network cable so that the business processing can determine whether it is in virtual network cable mode based on whether the interface receiving the data packet is identified. If so, it enters the corresponding processing logic, otherwise it follows the original three-layer forwarding logic.

[0054] Step S12: directly forwarding the input ARP traffic to the output interface via the input interface.

[0055] That is, the arp packet will be directly forwarded from another port through the virtual network cable without passing through the network traffic orchestrator and security devices. By transparently forwarding the arp packet, the media access control address (MAC address) of the server learned by the previous hop network device is still the real MAC of the server.

[0056] Step S13: forwarding the input IP traffic to the network traffic orchestrator through the inbound interface, so that the network traffic orchestrator sends the IP traffic to the corresponding security device and sends the IP traffic passing through the security device to the outbound interface.

[0057] The traffic input to the inbound interface is first judged by type. Specifically, the traffic input to the inbound interface is parsed at layer 3 protocol, and the type of traffic is judged based on the parsing result. The traffic types include IP traffic and address resolution protocol traffic. It is understandable that not all traffic needs to pass through security devices. Therefore, the traffic type is obtained through parsing, and traffic such as address resolution protocol traffic (ARP, Address Resolution Protocol) can be transparently forwarded directly from the inbound interface to the outbound interface. The network traffic orchestrator can determine which security devices need to detect the acquired traffic, and then forward the traffic to the corresponding security device. Security devices include but are not limited to firewalls, WAFs, mirror devices, etc.

[0058] like Figure 3 As shown, when processing business, it is first determined whether the interface is a virtual network cable interface. If so, the traffic is input into the interface, and the traffic type is further determined by analysis. Security device-based detection is performed on the IP traffic. Otherwise, it is directly forwarded to the next network device.

[0059] In some embodiments, the network traffic orchestrator sends the IP traffic to the corresponding security device, which may include: determining the message header information of the IP traffic; judging whether the IP traffic meets the matching conditions according to the message header information; if it meets the matching conditions, calling the security device corresponding to the IP traffic from the security resource pool; if it does not meet the matching conditions, forwarding the IP traffic directly to the output interface. Specifically, it can be judged whether the traffic needs to pass through the security device according to the destination IP and destination port in the message header information. It can be understood that the user configures which traffic needs to be detected. If it meets the matching conditions, the corresponding security device is called from the security resource pool. Otherwise, it can be directly output through the output interface. IP traffic may include traffic of tcp, udp and https protocols. For https traffic, it needs to be decrypted before determining the message header information, and the message header information is obtained by querying after decryption.

[0060] Before forwarding the IP traffic through the network traffic orchestrator, it is first determined whether the current traffic already has a corresponding session (i.e., connection tracking). If so, the traffic is forwarded directly along the fast path; otherwise, the slow path is used, for example Figure 4As shown, the following steps are included: the data packet coming in from the virtual network cable entrance records the original data packet message header information, that is, the second layer, third layer header, and the input interface information; it is determined whether the IP traffic meets the matching conditions, that is, whether it matches the virtual service. The main function of the virtual service is to set rules to match the application traffic, and then the application traffic can be processed differently according to the service type; if the data packet does not hit the virtual service, the routing mode of the data packet is set to the virtual network line routing mode. If it hits, it is necessary to determine whether the traffic needs to be scheduled in the security resource pool first. If it does not need to pass through the security device, the virtual service is directly scheduled; the security device resource pool is an abstraction of a security capability. Each security device resource pool represents a security capability, which can unify the management of multiple security devices with the same security capability.

[0061] In some embodiments, calling the security device corresponding to the IP traffic from the security resource pool includes: determining all target security devices corresponding to the IP traffic; calling each of the target security devices from the security resource pool in turn to perform security detection on the IP traffic until all the target security devices have completed the execution. Figure 5 As shown, it is understandable that there may be multiple types of security checks for traffic. If the data packet enters a non-security device, that is, the data packet does not pass through the security device, the routing mode of the corresponding session can be directly set to the virtual network cable mode, that is, the data packet is directly forwarded through the outbound interface. After the traffic is orchestrated to the security device, the data packet will return to the network traffic orchestrator. If the security device has been scheduled, the routing mode must also be set to the virtual network cable mode so that the data can continue to go down; if it has not been scheduled, continue to schedule the traffic to other security devices.

[0062] In some embodiments, sending the IP traffic passing through the security device to the outbound interface may include: based on the message header information of the IP traffic, restoring the IP traffic passing through the security device to obtain a restored IP data packet; and sending the restored IP data packet to the outbound interface. It is understandable that the message header information when the traffic enters the virtual network cable is used to update the traffic passing through the security device, so that the traffic is restored to the state when it enters the virtual network cable, and then the restored traffic is sent out through the outbound interface, so that the server cannot detect it after receiving the traffic, thereby realizing an upper-layer non-sensing network traffic orchestrator.

[0063] In some embodiments, it may also include: using a preset hook point of a fast and slow path, and calling a preset function through the hook point to achieve shielding of the target function. That is, different processing modules on the fast and slow paths can shield some unwanted functions for virtual network cable traffic; for example, shielding the quintuple modification function or the protocol sequence number modification function.

[0064] In some embodiments, before forwarding the input IP traffic to the network traffic orchestrator through the input interface, it may also include: recording the input interface information corresponding to the IP traffic; accordingly, sending the IP traffic passing through the security device to the output interface, including: querying the virtual network cable information according to the input interface information, determining the output interface information corresponding to the input interface information; and sending the IP traffic passing through the security device to the output interface according to the output interface information. That is, the input interface information corresponding to the IP traffic is recorded in advance, and when forwarding, the virtual network cable input interface of the data packet is first obtained from the information recorded in the session, and the opposite end interface of the virtual network cable, that is, the output interface, can be obtained through the input interface, and this interface is set as the routing output interface of the session, and the lower layer packet sending interface is called to send the packet.

[0065] By binding and associating two physical ports, the virtual network cable function is realized, and the traffic is transparently forwarded on the two ports; the physical network port is abstracted through the virtual network cable, and the virtual network cable port allows the address resolution protocol traffic to be passed. Without changing the network topology, the traffic is directed to the network traffic orchestrator, and the original packet header information of the data packet is recorded, and the traffic is restored and sent to the real server after passing through the security device, thereby achieving the effect of transparent access to the second layer of the network traffic orchestrator. The pain point that the third-layer deployment of the network traffic orchestrator requires the modification of the network topology is solved. The second-layer transparent access of the network traffic orchestrator is realized through the virtual network cable solution, without modifying the network topology, which greatly reduces the complexity of deployment.

[0066] As can be seen from the above, a virtual network cable is constructed in this embodiment; the virtual network cable includes an input interface and an output interface; the input interface is connected to the communication port of the previous-hop network device of the network traffic orchestrator, and the output interface is connected to the communication port of the next-hop network device of the network traffic orchestrator; the previous-hop network device and the next-hop network device belong to the same Layer 2 network; the input address resolution protocol traffic is directly forwarded to the output interface through the input interface, and the input IP traffic is forwarded to the network traffic orchestrator through the input interface, so that the network traffic orchestrator sends the IP traffic to the corresponding security device, and sends the IP traffic passing through the security device to the output interface. It can be seen that by constructing a virtual network cable, the network traffic orchestrator is between the inbound interface and the outbound interface between the virtual network cables, the inbound interface is connected to the communication port of the previous-hop network device of the network traffic orchestrator, and the outbound interface is connected to the communication port of the next-hop network device of the network traffic orchestrator. Thus, without changing the network topology, the traffic is directed to the network traffic orchestrator to achieve transparent access to the network traffic orchestrator; and the inbound interface forwards the IP traffic to the security device for detection, and the address resolution protocol traffic is directly and transparently forwarded to the outbound interface.

[0067] Correspondingly, the embodiment of the present application also discloses a network traffic orchestrator transparent access device, see Figure 6 As shown, the device comprises:

[0068] A virtual network cable construction module 11 is used to construct a virtual network cable; the virtual network cable includes an input interface and an output interface; the input interface is connected to the communication port of the previous hop network device of the network traffic scheduler, and the output interface is connected to the communication port of the next hop network device of the network traffic scheduler; the previous hop network device and the next hop network device belong to the same layer 2 network;

[0069] An IP traffic processing module 12, configured to forward the input IP traffic to a network traffic scheduler through the inbound interface, so that the network traffic scheduler sends the IP traffic to a corresponding security device, and sends the IP traffic passing through the security device to the outbound interface;

[0070] The ARP traffic processing module 13 is used to directly forward the input ARP traffic to the output interface through the input interface.

[0071] As can be seen from the above, a virtual network cable is constructed in this embodiment; the virtual network cable includes an input interface and an output interface; the input interface is connected to the communication port of the previous-hop network device of the network traffic orchestrator, and the output interface is connected to the communication port of the next-hop network device of the network traffic orchestrator; the previous-hop network device and the next-hop network device belong to the same Layer 2 network; the input address resolution protocol traffic is directly forwarded to the output interface through the input interface; the input IP traffic is forwarded to the network traffic orchestrator through the input interface, so that the network traffic orchestrator sends the IP traffic to the corresponding security device, and sends the IP traffic passing through the security device to the output interface. It can be seen that by constructing a virtual network cable, the network traffic orchestrator is between the input interface and the output interface between the virtual network cables, the input interface is connected to the communication port of the previous-hop network device of the network traffic orchestrator, and the output interface is connected to the communication port of the next-hop network device of the network traffic orchestrator. Thus, without changing the network topology, the traffic is directed to the network traffic orchestrator to achieve transparent access to the network traffic orchestrator; and the address resolution protocol traffic is directly and transparently forwarded to the output interface, and the input interface forwards the IP traffic to the security device for detection.

[0072] In some specific embodiments, the virtual network cable construction module 11 may specifically include:

[0073] The virtual network cable construction unit is used to construct a virtual network cable based on two interfaces; the interfaces are physical ports or aggregation ports.

[0074] In some specific embodiments, the network traffic orchestrator transparent access device may specifically include:

[0075] A parsing unit is used to perform three-layer protocol parsing on the traffic input by the input interface before forwarding the input IP traffic to the network traffic orchestrator through the input interface, and determine the type of traffic according to the parsing result; the traffic type includes IP traffic and address resolution protocol traffic.

[0076] In some specific embodiments, the IP traffic processing module 12 may specifically include:

[0077] A message header information determination unit, used to determine the message header information of the IP traffic;

[0078] A judging unit, configured to judge whether the IP traffic meets a matching condition according to the message header information;

[0079] A security device calling unit, configured to call the security device corresponding to the IP traffic from a security resource pool if a matching condition is met;

[0080] The forwarding unit is used to forward the IP traffic directly to the outbound interface if the matching condition is not met.

[0081] In some specific embodiments, the security device calling unit may specifically include:

[0082] A target security device determining unit, used to determine all target security devices corresponding to the IP traffic;

[0083] The target security device calling unit is used to call each of the target security devices from the security resource pool in turn to perform security detection on the IP traffic until all the target security devices have completed the execution.

[0084] In some specific embodiments, the IP traffic processing module 12 may specifically include:

[0085] A recovery unit, configured to recover the IP traffic passing through the security device based on the message header information of the IP traffic, and obtain a recovered IP data packet;

[0086] A sending unit is used to send the restored IP data packet to the outgoing interface.

[0087] In some specific embodiments, the network traffic orchestrator transparent access device may specifically include:

[0088] A recording unit, configured to record the inbound interface information corresponding to the IP traffic before forwarding the input IP traffic to the network traffic orchestrator through the inbound interface;

[0089] The IP traffic processing module 12 may specifically include:

[0090] An outbound interface information determining unit, configured to query virtual network cable information according to the inbound interface information, and determine that the inbound interface information corresponds to the outbound interface information;

[0091] The IP traffic sending unit is used to send the IP traffic passing through the security device to the outbound interface according to the outbound interface information.

[0092] Furthermore, the present application also discloses an electronic device, see Figure 7 As shown, the contents in the drawings should not be considered as any limitation on the scope of use of the present application.

[0093] Figure 7 A schematic diagram of the structure of an electronic device 20 provided in an embodiment of the present application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the network traffic orchestrator transparent access method disclosed in any of the aforementioned embodiments.

[0094] In this embodiment, the power supply 23 is used to provide working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device, and the communication protocol it follows is any communication protocol that can be applied to the technical solution of the present application, and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0095] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, a random access memory, a disk or an optical disk, etc. The resources stored thereon include an operating system 221, a computer program 222, and data 223 including message header information, etc. The storage method can be temporary storage or permanent storage.

[0096] The operating system 221 is used to manage and control the hardware devices and computer programs 222 on the electronic device 20, so as to realize the operation and processing of the massive data 223 in the memory 22 by the processor 21, and it can be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program that can be used to complete the network traffic orchestrator transparent access method performed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 can further include a computer program that can be used to complete other specific tasks.

[0097] Furthermore, an embodiment of the present application also discloses a computer storage medium, in which computer executable instructions are stored. When the computer executable instructions are loaded and executed by a processor, the steps of the network traffic orchestrator transparent access method disclosed in any of the aforementioned embodiments are implemented.

[0098] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0099] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0100] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0101] The above is a detailed introduction to a network traffic orchestrator transparent access method, device, equipment and medium provided by the present invention. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea; at the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A method for transparently accessing a network traffic scheduler, characterized in that: include: Constructing a virtual network cable; the virtual network cable includes an input interface and an output interface; The inbound interface is connected to a communication port of a previous-hop network device of the network traffic orchestrator, and the outbound interface is connected to a communication port of a next-hop network device of the network traffic orchestrator; The previous-hop network device and the next-hop network device belong to the same layer-2 network; Forwarding the input address resolution protocol traffic directly to the output interface through the input interface; The input IP traffic is forwarded to the network traffic orchestrator through the inbound interface, so that the network traffic orchestrator sends the IP traffic to the corresponding security device and sends the IP traffic passing through the security device to the outbound interface.

2. The method for transparently accessing a network traffic scheduler according to claim 1, characterized in that: The step of constructing a virtual network cable includes: A virtual network cable is constructed based on two interfaces; the interfaces are physical interfaces or aggregate interfaces.

3. The method for transparently accessing a network traffic scheduler according to claim 1, characterized in that: Before forwarding the input IP traffic to the network traffic orchestrator through the inbound interface, the method further includes: The traffic inputted by the inbound interface is parsed by a three-layer protocol, and the type of the traffic is determined according to the parsing result; the traffic type includes IP traffic and address resolution protocol traffic.

4. The method for transparently accessing a network traffic scheduler according to claim 1, characterized in that: The network traffic scheduler sends the IP traffic to the corresponding security device, including: Determine the message header information of the IP traffic; Determine whether the IP traffic meets the matching condition according to the message header information; If the matching condition is met, the security device corresponding to the IP traffic is called from the security resource pool; If the matching condition is not met, the IP traffic is directly forwarded to the outbound interface.

5. The method for transparently accessing a network traffic scheduler according to claim 4, characterized in that: The calling of the security device corresponding to the IP traffic from the security resource pool includes: Determine all target security devices corresponding to the IP traffic; Each of the target security devices is called from the security resource pool in turn to perform security detection on the IP traffic until all the target security devices have completed the execution.

6. The method for transparently accessing a network traffic scheduler according to claim 4, characterized in that: The sending the IP traffic passing through the security device to the outgoing interface includes: Based on the message header information of the IP traffic, the IP traffic passing through the security device is restored to obtain a restored IP data packet; The restored IP data packet is sent to the outgoing interface.

7. The method for transparently accessing a network traffic scheduler according to any one of claims 1 to 6, characterized in that: Before forwarding the input IP traffic to the network traffic orchestrator through the inbound interface, the method further includes: Record the inbound interface information corresponding to the IP traffic; Sending the IP traffic passing through the security device to the outbound interface includes: Query virtual network cable information according to the input interface information to determine that the input interface information corresponds to the output interface information; According to the outbound interface information, the IP traffic passing through the security device is sent to the outbound interface.

8. A network traffic scheduler transparent access device, characterized in that: include: A virtual network cable construction module, used to construct a virtual network cable; the virtual network cable includes an input interface and an output interface; The inbound interface is connected to a communication port of a previous-hop network device of the network traffic orchestrator, and the outbound interface is connected to a communication port of a next-hop network device of the network traffic orchestrator; The previous-hop network device and the next-hop network device belong to the same layer-2 network; An address resolution protocol traffic processing module, used for directly forwarding the input address resolution protocol traffic to the output interface through the input interface; The IP traffic processing module is used to forward the input IP traffic to the network traffic orchestrator through the input interface, so that the network traffic orchestrator sends the IP traffic to the corresponding security device and sends the IP traffic passing through the security device to the output interface.

9. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to execute the computer program to implement the network traffic orchestrator transparent access method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: Used to store computer programs; wherein when the computer program is executed by a processor, the network traffic orchestrator transparent access method as described in any one of claims 1 to 7 is implemented.

Images