Communication method, branch equipment and device

Abstract

The embodiment of the invention provides a communication method, branch equipment and a communication device, and relates to the technical field of networks, the communication method is applied to the branch equipment, the branch equipment is in communication connection with central equipment through a public network, and the method comprises the following steps: receiving a public network IP address sent by the central equipment after determining that an NAT gateway exists between the branch equipment and the public network, the public network IP address is an IP address of a target interface included by the target NAT gateway; a detection request message is sent to the target interface, the detection request message comprises a target IP address, and the target IP address and the public network IP address are different and are located in the same network segment; according to the detection result, obtaining the number of network devices in a forwarding path used for forwarding the detection request message; according to a preset period, an NAT keep-alive message is sent to the center device, the NAT keep-alive message comprises a first TTL, and the first TTL is the sum of the number and the first value. By applying the scheme provided by the embodiment of the invention, the influence of the NAT keep-alive message on the traffic forwarding of the central equipment can be avoided.

Description

Technical Field

[0001] The present application relates to the field of network technology, and in particular to a communication method, branch equipment and device. Background Art

[0002] In the current network architecture, there is often a NAT (Network Address Translation) gateway between the branch device and the central device. The NAT gateway performs NAT translation on the traffic sent by the branch device, that is, translates the IP address in the IP datagram header of the traffic, thereby enabling the devices in the internal network to access the external public network and allowing the external public network to access some internal network resources. Therefore, the traffic from the branch device visible to the central device is often sent by the NAT gateway.

[0003] See also Figure 1 , which is a schematic diagram of a network structure in the related technology.

[0004] In the figure, network device A is a branch device, network device B is a central device, the ISP (Internet Service Provider) between network device A and network device B is an external public network, and a NAT gateway exists between network device A and the ISP. Network device A is connected to a host, and only host A is shown in the figure. Network device B is connected to a host, and only host B is shown in the figure. As can be seen from the figure, the IP address of host A is 10.1.1.2 / 24, the IP address of interface GE1 / 0 / 2 of network device A is 10.1.1.1 / 24, the IP address of interface GE1 / 0 / 1 of network device A is 1.1.1.1 / 16, the IP address of the interface connected to NAT gateway and network device A is 1.1.1.2 / 16, and the IP address of the interface connected to NAT gateway and ISP is 3.3.3.1 / 16. It can be seen that the NAT gateway can convert the IP address in the IP datagram header. The IP address of GE1 / 0 / 1 of network device B is 2.2.2.2 / 16, and the IP address of GE1 / 0 / 2 of network device B is 10.1.2.1 / 24. The IP address of host B is 10.1.2.2 / 24.

[0005] IKE (Internet Key Exchange) technology supports NAT negotiation discovery, that is, both IKE parties (branch devices and central devices) support detecting whether there is a NAT gateway between the links. If there is a NAT gateway, after the branch device and the central device negotiate to establish an IKE and IPSec (Internet Protocol Security) tunnel, in common scenarios, the branch device needs to periodically send NAT keepalive messages to the central device to keep the NAT session on the NAT gateway alive. NAT keepalive messages are UDP (User Datagram Protocol) messages. According to the protocol, the destination port number of common NAT keepalive messages is 4500, and the payload is fixed to 0xFF. The central device does not need to respond after receiving the NAT keepalive message and needs to ignore it. In theory, the central device also needs to keep alive, but for UDP bidirectional messages, as long as there is a traffic message in one direction, the NAT session can be kept alive, so in most scenarios, the branch device initiates NAT keepalive. NAT keepalive can prevent IPSec and IKE messages from being re-converted to addresses and ports after NAT sessions age, causing the central device to be unable to identify or identify incorrectly, thereby affecting the communication between the branch devices and the central device.

[0006] However, in large-scale networking, the central device often connects to hundreds or even more branch devices, and each branch device needs to send NAT keepalive messages to the central device to keep the NAT session alive. For the central device, it needs to receive a large number of NAT keepalive messages and ignore them, which will occupy the traffic processing resources of the central device and affect the central device's reception of other traffic. Especially during peak traffic periods, the impact on the traffic forwarding of the central device is greater. Summary of the invention

[0007] The purpose of the embodiments of the present application is to provide a communication method, a branch device and an apparatus to prevent the NAT keep-alive message from affecting the traffic forwarding of the central device. The specific technical solution is as follows:

[0008] In a first aspect, an embodiment of the present application provides a communication method, which is applied to a branch device, wherein the branch device is connected to a central device through a public network, and the method includes:

[0009] Receiving a public IP address sent by the central device after determining that there is a NAT gateway between the branch device and the public network, the public IP address is the IP address of a target interface included in a target NAT gateway, the target interface is connected to the public network, and the target NAT gateway is the NAT gateway between the branch device and the public network that is closest to the public network;

[0010] Sending a probe request message to the target interface, wherein the probe request message includes a destination IP address, and the destination IP address is different from the public network IP address and is in the same network segment;

[0011] According to the detection result, the number of network devices in the forwarding path used to forward the detection request message is obtained;

[0012] According to a preset period, a NAT keep-alive message is sent to the central device, where the NAT keep-alive message includes a first lifetime TTL, and the first TTL is the sum of the number and the first value.

[0013] In one embodiment of the present application, the probe request message further includes a second TTL;

[0014] The obtaining, according to the detection result, the number of network devices in the forwarding path for forwarding the detection request message specifically includes:

[0015] If the probe response message corresponding to the probe request message is not received, a probe request message whose second TTL is less than the second TTL of the previous probe request message is sent to the target interface again; or, if the probe response message corresponding to the probe request message is received, a probe request message whose second TTL is greater than the second TTL of the previous probe request message is sent to the target interface again;

[0016] Repeat the steps of, if the probe response message corresponding to the probe request message is not received, then sending the probe request message with a second TTL less than the second TTL of the previous probe request message to the target interface again, or, if the probe response message corresponding to the probe request message is received, then sending the probe request message with a second TTL greater than the second TTL of the previous probe request message to the target interface again, until the number of network devices in the forwarding path for forwarding the probe request message is determined, wherein, when the second TTL of the probe request message is greater than the number, the probe response message corresponding to the probe request message is not received, and when the second TTL of the probe request message is less than the number, the probe response message corresponding to the probe request message is received.

[0017] In one embodiment of the present application, sending a NAT keep-alive message to the central device according to a preset period includes:

[0018] According to a preset period, a NAT keep-alive message is sent to the central device within a period in which no data message is sent to the central device.

[0019] In one embodiment of the present application, the method further includes:

[0020] If it is determined that there is no NAT gateway between the branch device and the public network, no NAT keep-alive message is sent.

[0021] In a second aspect, an embodiment of the present application provides a branch device, wherein the branch device is communicatively connected to a central device via a public network, and the branch device includes:

[0022] processor;

[0023] Transceiver;

[0024] A machine-readable storage medium storing machine-executable instructions that can be executed by the processor, the machine-executable instructions causing the processor to perform the following steps:

[0025] Receiving a public IP address sent by the central device after determining that there is a NAT gateway between the branch device and the public network, the public IP address is the IP address of a target interface included in a target NAT gateway, the target interface is connected to the public network, and the target NAT gateway is the NAT gateway between the branch device and the public network that is closest to the public network;

[0026] Sending a probe request message to the target interface, wherein the probe request message includes a destination IP address, and the destination IP address is different from the public network IP address and is in the same network segment;

[0027] According to the detection result, the number of network devices in the forwarding path used to forward the detection request message is obtained;

[0028] According to a preset period, a NAT keep-alive message is sent to the central device, where the NAT keep-alive message includes a first lifetime TTL, and the first TTL is the sum of the number and the first value.

[0029] In one embodiment of the present application, the probe request message further includes a second TTL;

[0030] The obtaining, according to the detection result, the number of network devices in the forwarding path for forwarding the detection request message specifically includes:

[0031] If the probe response message corresponding to the probe request message is not received, a probe request message whose second TTL is less than the second TTL of the previous probe request message is sent to the target interface again; or, if the probe response message corresponding to the probe request message is received, a probe request message whose second TTL is greater than the second TTL of the previous probe request message is sent to the target interface again;

[0032] Repeat the steps of, if the probe response message corresponding to the probe request message is not received, then sending the probe request message with a second TTL less than the second TTL of the previous probe request message to the target interface again, or, if the probe response message corresponding to the probe request message is received, then sending the probe request message with a second TTL greater than the second TTL of the previous probe request message to the target interface again, until the number of network devices in the forwarding path for forwarding the probe request message is determined, wherein, when the second TTL of the probe request message is greater than the number, the probe response message corresponding to the probe request message is not received, and when the second TTL of the probe request message is less than the number, the probe response message corresponding to the probe request message is received.

[0033] In one embodiment of the present application, sending a NAT keep-alive message to the central device according to a preset period specifically includes:

[0034] According to a preset period, a NAT keep-alive message is sent to the central device within a period in which no data message is sent to the central device.

[0035] In one embodiment of the present application, the machine executable instructions further cause the processor to perform the following steps:

[0036] If it is determined that there is no NAT gateway between the branch device and the public network, no NAT keep-alive message is sent.

[0037] In a third aspect, an embodiment of the present application provides a NAT keep-alive device, which is applied to a branch device, wherein the branch device is connected to a central device through a public network, and the device includes:

[0038] An IP address receiving module is used to receive a public IP address sent by the central device after determining that there is a NAT gateway between the branch device and the public network, wherein the public IP address is the IP address of a target interface included in a target NAT gateway, the target interface is connected to the public network, and the target NAT gateway is the NAT gateway between the branch device and the public network that is closest to the public network;

[0039] A detection message sending module, used for sending a detection request message to the target interface, wherein the detection request message includes a destination IP address, and the destination IP address is different from the public network IP address and is in the same network segment;

[0040] A number determination module, used to obtain the number of network devices in the forwarding path used to forward the probe request message according to the detection result;

[0041] The keep-alive message sending module is used to send a NAT keep-alive message to the central device according to a preset period, wherein the NAT keep-alive message includes a first lifetime TTL, and the first TTL is the sum of the number and the first value.

[0042] In one embodiment of the present application, the probe request message further includes a second TTL;

[0043] The number determination module is specifically used for:

[0044] If the probe response message corresponding to the probe request message is not received, a probe request message whose second TTL is less than the second TTL of the previous probe request message is sent to the target interface again; or, if the probe response message corresponding to the probe request message is received, a probe request message whose second TTL is greater than the second TTL of the previous probe request message is sent to the target interface again;

[0045] Repeat the steps of, if the probe response message corresponding to the probe request message is not received, then sending the probe request message with a second TTL less than the second TTL of the previous probe request message to the target interface again, or, if the probe response message corresponding to the probe request message is received, then sending the probe request message with a second TTL greater than the second TTL of the previous probe request message to the target interface again, until the number of network devices in the forwarding path for forwarding the probe request message is determined, wherein, when the second TTL of the probe request message is greater than the number, the probe response message corresponding to the probe request message is not received, and when the second TTL of the probe request message is less than the number, the probe response message corresponding to the probe request message is received.

[0046] In one embodiment of the present application, the keep-alive message sending module is specifically used to:

[0047] According to a preset period, a NAT keep-alive message is sent to the central device within a period in which no data message is sent to the central device.

[0048] In one embodiment of the present application, the device further includes:

[0049] The keep-alive message rejecting module is used for not sending the NAT keep-alive message if it is determined that there is no NAT gateway between the branch device and the public network.

[0050] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, any method step described in the first aspect is implemented.

[0051] In a fifth aspect, an embodiment of the present application further provides a computer program product comprising instructions, which, when executed on a computer, enables the computer to execute any of the method steps described in the first aspect above.

[0052] Beneficial effects of the embodiments of the present application:

[0053] In the scheme provided by the embodiment of the present application, after the branch device receives the public network IP address sent by the central device after determining that there is a NAT gateway between the branch device and the public network, the number of network devices in the forwarding path between the branch device and the target interface is determined. The target interface is the interface connected to the public network on the NAT gateway closest to the public network between the branch device and the public network. After determining the above number, a NAT keep-alive message is sent according to a preset period, and the first TTL of the NAT keep-alive message is the sum of the above number and the first value. That is, the first TTL is greater than the number of network devices between the branch device and the target interface, so the NAT keep-alive message can be sent to the target NAT gateway for reception. Since the target NAT gateway is the NAT gateway closest to the public network between the branch device and the public network, the NAT gateways between the branch device and the public network can all receive the NAT keep-alive message, thereby keeping it alive. However, the TTL of the NAT keep-alive message is only the sum of the above number and the first value, so the NAT message will be discarded soon after passing through the target interface, and will hardly be transmitted in the public network, and will not be transmitted to the central device. Therefore, the above NAT keep-alive message will not affect the traffic forwarding of the central device. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application, and for ordinary technicians in this field, other embodiments can also be obtained based on these drawings.

[0055] Figure 1 A schematic diagram of a network structure in the related art;

[0056] Figure 2 A schematic diagram of a process flow of a first NAT keep-alive method provided in an embodiment of the present application;

[0057] Figure 3 A schematic diagram of the distribution of the first NAT gateway provided in the embodiment of the present application;

[0058] Figure 4 A schematic diagram of the distribution of the second NAT gateway provided in the embodiment of the present application;

[0059] Figure 5A schematic diagram of the distribution of the third NAT gateway provided in the embodiment of the present application;

[0060] Figure 6 A schematic diagram of the distribution of the fourth NAT gateway provided in the embodiment of the present application;

[0061] Figure 7 A schematic diagram of the format of a NAT keep-alive message provided in an embodiment of the present application;

[0062] Figure 8 A schematic diagram of a second NAT keep-alive method provided in an embodiment of the present application;

[0063] Fig. 9 A schematic diagram of a flow chart of a third NAT keep-alive method provided in an embodiment of the present application;

[0064] Fig.10 A schematic diagram of the structure of a branch device provided in an embodiment of the present application;

[0065] Fig.11 A schematic diagram of the structure of a NAT keep-alive device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0066] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field based on the present application belong to the scope of protection of the present application.

[0067] During the NAT keep-alive process in the related art, the central device will receive a large number of NAT keep-alive messages, thereby affecting the normal traffic forwarding of the central device. In order to solve the above problem, the embodiment of the present application provides a NAT keep-alive method, branch device and apparatus.

[0068] See also Figure 2 , which is a flow chart of the first NAT keep-alive method provided in an embodiment of the present application, is applied to a branch device, and the branch device is connected to the central device through a public network. The method includes the following steps S201-S204. Specifically, the central device is often connected to multiple branch devices through a public network communication via IPsec VPN (Virtual Private Networks). For example, the central device is located at the corporate headquarters, and the branch devices are located in different branches of the enterprise. The network architecture can form a network interconnection between institutions in different regions within the enterprise. The branch devices and the central device are network devices, such as routers.

[0069] S201: Receive the public IP address sent by the central device after determining that there is a NAT gateway between the branch device and the public network.

[0070] Among them, the above-mentioned public network IP address is the IP address of the target interface included in the target NAT gateway, the above-mentioned target interface is connected to the above-mentioned public network, and the above-mentioned target NAT gateway is the NAT gateway between the above-mentioned branch device and the above-mentioned public network that is closest to the above-mentioned public network.

[0071] In one embodiment of the present application, the branch device and the central device perform hash operations on their own IP addresses, port numbers, cookies or spi (Serial Peripheral Interface) respectively, and send the operation results to the other end. The branch device and the central device compare their own operation results with the operation results sent by the other end to determine whether there is a NAT gateway between the two and the location of the existing NAT gateway.

[0072] Specifically, the branch device and the central device can determine whether there is a NAT gateway between the branch device and the central device and determine the location of the NAT gateway based on the NAT detection and NAT gateway location detection methods provided by IKE in the relevant technology. For details, please refer to RFC3498 (IKEv1) and RFC7296 (IKEv2), which will not be repeated here.

[0073] In addition, there are the following four situations for the distribution of NAT gateways between branch devices and central devices.

[0074] Case 1: See Figure 3 , which is a schematic diagram of the distribution of the first type of NAT gateway provided in an embodiment of the present application.

[0075] The diagram includes a branch device, a central device, and an ISP (indicating a public network) between the two. The branch device and the central device are connected to a LAN (Local Area Network) respectively. The dotted line between the two indicates that they are connected via an IPsec VPN tunnel. As can be seen from the diagram, in this case, there is no NAT gateway between the branch device and the central device.

[0076] In this case, both the branch device and the central device are exposed to the public network, both have stable public IP addresses or domain names, and there is no NAT gateway between them.

[0077] Case 2: See Figure 4 , which is a schematic diagram of the distribution of the second type of NAT gateway provided in an embodiment of the present application.

[0078] The diagram includes the branch device, the central device, the ISP (representing the public network) and the NAT gateway between them. The branch device and the central device are connected to the LAN respectively. The dotted line between them indicates that they are connected through an IPsec VPN tunnel. As can be seen from the figure, in this case, the NAT gateway is located between the central device and the public network.

[0079] The NAT gateway in this network often acts as a firewall in front of the central device (that is, between the central device and the ISP) to filter the traffic sent to the central device.

[0080] Case 3: See Figure 5 , which is a schematic diagram of the distribution of the third type of NAT gateway provided in an embodiment of the present application.

[0081] The diagram includes a branch device, a central device, an ISP (representing a public network) and a NAT gateway between the two. The branch device and the central device are connected to the LAN respectively. The dotted line between the two indicates that they are connected via an IPsec VPN tunnel. As can be seen from the diagram, in this case, the NAT gateway is located between the branch device and the public network.

[0082] This type of networking is common. In this case, the central device can obtain public IP information, but there may be one or more NAT gateways in front of the branch device (that is, between the branch device and the public network). Figure 5 The example shown here is a case where only one NAT gateway is included.

[0083] Case 4: See Figure 6 , which is a schematic diagram of the distribution of the fourth type of NAT gateway provided in an embodiment of the present application.

[0084] The figure includes the branch device, the central device, and the ISP (representing the public network) and NAT gateway between them. The branch device and the central device are connected to the LAN respectively. The dotted line between them indicates that they are connected through an IPsec VPN tunnel. As can be seen from the figure, in this case, NAT gateway 2 is located between the branch device and the public network, and NAT gateway 1 is located between the central device and the public network. That is, in this case, there is a NAT gateway between the branch device and the public network, and there is also a NAT gateway between the central device and the public network.

[0085] Specifically, the situation where a NAT gateway exists between the branch device and the public network corresponds to the aforementioned situation three and situation four.

[0086] In one embodiment of the present application, the public network IP address is included in a message sent by the central device to the branch device, and the message is sent by the central device to the branch device when the two successfully conduct IKE negotiation and determine that there is a NAT gateway between the branch device and the public network. The message can be encrypted and authenticated by the IPsec service to ensure its security.

[0087] In addition, it should be noted that if there is only one NAT gateway between the branch device and the public network, then this NAT gateway is the target NAT gateway. If there are multiple NAT gateways between the branch device and the public network, then the NAT gateway closest to the public network is the target NAT gateway. The IP address of the target interface of the target NAT gateway connected to the public network is actually the IP address of the branch device exposed to the public network. For the central device, it communicates with the branch device through this IP address.

[0088] S202: Send a probe request message to the target interface.

[0089] The detection request message includes a destination IP address, and the destination IP address is different from the public network IP address and is in the same network segment.

[0090] The above-mentioned probe request message can be a random address different from the above-mentioned public IP address in the network segment where the public IP address is located. For example, if the above-mentioned public IP is 1.0.0.1, the destination IP address of the probe message can be any value other than 1.0.0.1 in 1.0.0.0 / 24, such as 1.0.0.3. However, in theory, the smaller the value of the selected destination IP address, the more accurate the number of network devices in the forwarding path for forwarding the probe request message can be determined later, so the smallest possible IP address can be selected as the destination IP address.

[0091] In one embodiment of the present application, the above-mentioned probe request message may be an ICMP (Internet Control Message Protocol) request message.

[0092] S203: According to the detection result, the number of network devices in the forwarding path used to forward the detection request message is obtained.

[0093] In one embodiment of the present application, multiple candidate numbers can be preset, and the difference between adjacent candidate numbers is a preset fixed value. The branch devices respectively send probe request messages with the second TTL (Time To Live) being each candidate number, and respectively determine whether a probe response message is received after sending the probe request message corresponding to each candidate number, as the detection result. A number is finally determined from the candidate numbers, for which no probe response message is received, but for other candidate numbers less than this number, probe response messages are received.

[0094] The above-mentioned probe response message may be an ICMP TTL timeout message.

[0095] In another embodiment of the present application, the following Fig. 9 Steps S203A to S203C shown determine the above number, which will not be described in detail here.

[0096] Since the target NAT gateway is located between the branch device and the public network, that is, relative to the branch device, the target NAT gateway is located in front of the public network, the above number is equivalent to the distance from the branch device to the public network.

[0097] S204: Sending a NAT keep-alive message to the central device according to a preset period.

[0098] The NAT keep-alive message includes a first TTL, and the first TTL is the sum of the number and the first value.

[0099] Since the first TTL of the NAT keep-alive message is the above number + the first value, the NAT keep-alive message will reach the target NAT gateway after being forwarded through the above number of network devices, and will be discarded after being forwarded through the first value of network devices. Since the target NAT gateway is the NAT gateway between the branch device and the public network that is closest to the public network record, as long as the NAT keep-alive message can be forwarded to the target NAT gateway, it means that all NAT gateways between the branch device and the public network can receive the NAT keep-alive message and can all be kept alive. Therefore, in order to save forwarding resources, the NAT keep-alive message can be discarded as soon as possible after being forwarded by the target NAT gateway, so the first TTL of the NAT message only needs to be greater than the above number, and the value of the first TTL can be as small as possible, that is, the first value can be as small as possible, and the first value is less than the preset value, for example, the first value is 1, 2, 3, etc.

[0100] In addition, the above-mentioned preset period can be 20s, 30s, 40s, 1 minute, etc., and the embodiment of the present application does not limit its specific value.

[0101] See also Figure 7, is a schematic diagram of the format of a NAT keep-alive message provided in an embodiment of the present application.

[0102] As can be seen from the figure, the NAT keep-alive message contains the source port number, destination port number, message length, checksum, and 0xFF. 0xFF is the fixed payload of the NAT keep-alive message. In addition, the common destination port number of the NAT keep-alive message is UDP 4500. The top number indicates the sequence number of the bit.

[0103] As can be seen from the above, in the scheme provided by the embodiment of the present application, after the branch device receives the public network IP address sent by the central device after determining that there is a NAT gateway between the branch device and the public network, the number of network devices in the forwarding path between the branch device and the target interface is determined. The target interface is the interface connected to the public network on the NAT gateway that is closest to the public network between the branch device and the public network. After determining the above number, a NAT keep-alive message is sent according to a preset period, and the first TTL of the NAT keep-alive message is the sum of the above number and the first value. That is, the first TTL is greater than the number of network devices between the branch device and the target interface, so the NAT keep-alive message can be sent to the target NAT gateway for reception. Since the target NAT gateway is the NAT gateway that is closest to the public network between the branch device and the public network, the NAT gateways between the branch device and the public network can all receive the NAT keep-alive message, thereby keeping it alive. However, the TTL of the NAT keep-alive message is only the sum of the above number and the first value, so the NAT message will be discarded soon after passing through the target interface, and will hardly be transmitted in the public network, and will not be transmitted to the central device. Therefore, the above NAT keep-alive message will not affect the traffic forwarding of the central device.

[0104] In addition, since the load carried in the NAT keep-alive message is only 0xFF and the data volume is small, the NAT keep-alive message belongs to a UDP packet. If the solution in the related art is used for NAT keep-alive, the central device will receive a large number of UDP packets. For the central device that forwards messages based on the CPU, processing UDP packets consumes more CPU resources, so it will further affect the normal forwarding of traffic. However, in this application, the NAT keep-alive message will not be sent to the central device, so it will not affect the central device.

[0105] Furthermore, in another embodiment of the present application, before executing the embodiment of the present application, when the central device and the branch device perform IKE negotiation for the first time, both parties can inform each other whether they support the solution provided by the embodiment of the present application for NAT keep-alive. If both ends support it, the solution provided by the embodiment of the present application is used by default for NAT keep-alive after the IKE negotiation is successful. If one end does not support the solution provided by the embodiment of the present application, the solution in the related art can continue to be used for NAT keep-alive.

[0106] In one embodiment of the present application, the above method also includes the following steps A.

[0107] Step A: If it is determined that there is no NAT gateway between the branch device and the public network, no NAT keep-alive message is sent.

[0108] Specifically, the situation where there is no NAT gateway between the branch device and the public network includes the aforementioned situation one, that is, there is no NAT gateway between the branch device and the central device, and the aforementioned situation two, that is, there is a NAT gateway between the branch device and the central device, but the NAT gateway is located between the public network and the central device.

[0109] If it is case 1, there is no NAT gateway, so NAT keepalive is not required. If it is case 2, theoretically, the central device should perform NAT keepalive, but since the configuration of the NAT gateway before the central device is often fixed, there is no need for additional NAT keepalive. The NAT gateway will keep alive by default, so neither the branch device nor the central device needs to perform keepalive.

[0110] From the above, it can be seen that in the embodiment of the present application, the branch device only needs to perform NAT keep-alive operation when there is a NAT gateway between the branch device and the public network. If there is no NAT gateway between the branch device and the public network, the branch device does not need to perform additional NAT keep-alive operation, thereby saving the resource overhead of the branch device.

[0111] See also Figure 8 , is a flow chart of a second NAT keep-alive method provided in an embodiment of the present application, which is similar to the aforementioned Figure 2 Compared with the embodiment shown, the above step S204 can be implemented by the following step S204A.

[0112] S204A: According to a preset period, during a period in which no data message is sent to the central device, a NAT keep-alive message is sent to the central device.

[0113] In one embodiment of the present application, if the branch device sends a data message to the central device within a preset period, the NAT gateway located between the branch device and the public network can receive the data message and determine that the branch device is still in operation, so it will not disconnect the connection with the branch device, which can achieve the effect of keeping alive, and the branch device does not need to send additional NAT keep alive messages. On the contrary, the branch device needs to send additional NAT keep alive messages only during the period when the branch device does not send data messages to the central device.

[0114] From the above, it can be seen that in the embodiment of the present application, the branch device only sends NAT keep-alive messages during the period when no data messages are sent to the central device, thereby reducing the number of NAT keep-alive messages that the branch device actually needs to send, thereby reducing the resource consumption of the branch device for sending NAT keep-alive messages.

[0115] In one embodiment of the present application, the above-mentioned detection request message also includes a second TTL. Fig. 9 , is a flow chart of a third NAT keep-alive method provided in an embodiment of the present application, which is similar to the aforementioned Figure 2 Compared with the embodiment shown, the above step S203 can be implemented by the following steps S203A-S203C.

[0116] S203A: If the probe response message corresponding to the probe request message is not received, a probe request message whose second TTL is smaller than the second TTL of the previous probe request message is sent to the target interface again.

[0117] For example, the second TTL of the first probe request message may be 100, 50, etc., and may be specifically set according to actual needs.

[0118] If the probe response message is not received, it means that the probe request message has been sent to the destination IP address within the current second TTL. This means that the second TTL is greater than or equal to the number of network devices in the forwarding path from the branch device to the destination IP address, which also means that the current second TTL is greater than or equal to the number of network devices in the forwarding path from the branch device to the target interface.

[0119] In this case, in order to accurately determine the number of network devices in the forwarding path from the branch device to the target interface, the second TTL is lowered and a new probe request message is sent again.

[0120] S203B: If a probe response message corresponding to the probe request message is received, a probe request message whose second TTL is greater than the second TTL of the previous probe request message is sent to the target interface again.

[0121] In contrast to the situation in the aforementioned step S203A, if a probe response message is received, it means that the current second TTL is greater than the number of network devices in the forwarding path from the branch device to the target interface. In this case, in order to accurately determine the number of network devices in the forwarding path from the branch device to the target interface, the second TTL is increased and a new probe request message is sent again.

[0122] In addition, in one embodiment of the present application, when the probe request message is continuously sent, the adjustment range of the second TTL is gradually reduced. For example, when the second TTL is adjusted for the first time, the range of reducing the second TTL is 50, and when the second TTL is adjusted for the second time, the range of increasing the second TTL is 30, etc.

[0123] In one case, the second TTL can be adjusted by using the binary method. For example, the second TTL of the first probe request message sent is 100, and then the second TTL is lowered. The binary method is used, and the second TTL of the second probe request message sent is half of 100, that is, the reduction is 50, and the adjustment is 50. Then the second TTL is increased, and the second TTL of the third probe request message sent should be between 50 and 100. The binary method is used, and the second TTL is increased by (100-50) / 2=25, that is, the second TTL of the third probe request message sent is 75, and so on.

[0124] If the number of network devices in the forwarding path for forwarding the detection request message cannot be determined, the process returns to step S203A or step S203B to continue detecting the above number, otherwise the process executes step S203C.

[0125] S203C: Determine the number of network devices in the forwarding path used to forward the probe request message.

[0126] When the second TTL of the probe request message is greater than the number, the probe response message corresponding to the probe request message is not received; when the second TTL of the probe request message is less than the number, the probe response message corresponding to the probe request message is received.

[0127] As can be seen from the above, in the embodiment of the present application, the second TTL of the probe request message is gradually adjusted, and the probe request message is continuously sent. According to whether the probe response message is received when the second TTL value is different, the relationship between the current second TTL and the number of network devices between the branch device and the target interface to be detected is judged, thereby accurately determining the specific value of the number to be detected.

[0128] Corresponding to the aforementioned NAT keep-alive method applied to a branch device, an embodiment of the present application further provides a branch device.

[0129] See also Fig.10 , is a schematic diagram of the structure of a branch device provided in an embodiment of the present application, wherein the branch device is connected to a central device through a public network, and the branch device includes:

[0130] Processor 1001;

[0131] transceiver 1004;

[0132] A machine-readable storage medium 1002, wherein the machine-readable storage medium 1002 stores machine-executable instructions that can be executed by the processor 1001, and the machine-executable instructions prompt the processor 1001 to perform the following steps:

[0133] Receiving a public IP address sent by the central device after determining that there is a network address translation NAT gateway between the branch device and the public network, the public IP address is the IP address of a target interface included in a target NAT gateway, the target interface is connected to the public network, and the target NAT gateway is the NAT gateway between the branch device and the public network that is closest to the public network;

[0134] Sending a probe request message to the target interface, wherein the probe request message includes a destination IP address, and the destination IP address is different from the public network IP address and is in the same network segment;

[0135] According to the detection result, the number of network devices in the forwarding path used to forward the detection request message is obtained;

[0136] According to a preset period, a NAT keep-alive message is sent to the central device, where the NAT keep-alive message includes a first lifetime TTL, and the first TTL is the sum of the number and the first value.

[0137] like Fig.10 As shown, the network device may further include a communication bus 1003. The processor 1001, the machine-readable storage medium 1002, and the transceiver 1004 communicate with each other through the communication bus 1003. The communication bus 1003 may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus. The communication bus 1003 may be divided into an address bus, a data bus, a control bus, and the like.

[0138] The transceiver 1004 may be a wireless communication module. Under the control of the processor 1001 , the transceiver 1004 exchanges data with other devices.

[0139] The machine-readable storage medium 1002 may include a random access memory (RAM) or a non-volatile memory (NVM), such as at least one disk storage. In addition, the machine-readable storage medium 1002 may also be at least one storage device located away from the aforementioned processor.

[0140] Processor 1001 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0141] As can be seen from the above, in the scheme provided by the embodiment of the present application, after the branch device receives the public network IP address sent by the central device after determining that there is a NAT gateway between the branch device and the public network, the number of network devices in the forwarding path between the branch device and the target interface is determined. The target interface is the interface connected to the public network on the NAT gateway that is closest to the public network between the branch device and the public network. After determining the above number, a NAT keep-alive message is sent according to a preset period, and the first TTL of the NAT keep-alive message is the sum of the above number and the first value. That is, the first TTL is greater than the number of network devices between the branch device and the target interface, so the NAT keep-alive message can be sent to the target NAT gateway for reception. Since the target NAT gateway is the NAT gateway that is closest to the public network between the branch device and the public network, the NAT gateways between the branch device and the public network can all receive the NAT keep-alive message, thereby keeping it alive. However, the TTL of the NAT keep-alive message is only the sum of the above number and the first value, so the NAT message will be discarded soon after passing through the target interface, and will hardly be transmitted in the public network, and will not be transmitted to the central device. Therefore, the above NAT keep-alive message will not affect the traffic forwarding of the central device.

[0142] In one embodiment of the present application, the probe request message further includes a second TTL;

[0143] The obtaining, according to the detection result, the number of network devices in the forwarding path for forwarding the detection request message specifically includes:

[0144] If the probe response message corresponding to the probe request message is not received, a probe request message whose second TTL is less than the second TTL of the previous probe request message is sent to the target interface again; or, if the probe response message corresponding to the probe request message is received, a probe request message whose second TTL is greater than the second TTL of the previous probe request message is sent to the target interface again;

[0145] Repeat the steps of, if the probe response message corresponding to the probe request message is not received, then sending the probe request message whose second TTL is less than the second TTL of the previous probe request message to the target interface again, or, if the probe response message corresponding to the probe request message is received, then sending the probe request message whose second TTL is greater than the second TTL of the previous probe request message to the target interface again;

[0146] Until the number of network devices in the forwarding path used to forward the probe request message is determined, wherein, when the second TTL of the probe request message is greater than the number, the probe response message corresponding to the probe request message is not received, and when the second TTL of the probe request message is less than the number, the probe response message corresponding to the probe request message is received.

[0147] As can be seen from the above, in the embodiment of the present application, the second TTL of the probe request message is gradually adjusted, and the probe request message is continuously sent. According to whether the probe response message is received when the second TTL value is different, the relationship between the current second TTL and the number of network devices between the branch device and the target interface to be detected is judged, thereby accurately determining the specific value of the number to be detected.

[0148] In one embodiment of the present application, sending a NAT keep-alive message to the central device according to a preset period specifically includes:

[0149] According to a preset period, a NAT keep-alive message is sent to the central device within a period in which no data message is sent to the central device.

[0150] From the above, it can be seen that in the embodiment of the present application, the branch device only sends NAT keep-alive messages during the period when no data messages are sent to the central device, thereby reducing the number of NAT keep-alive messages that the branch device actually needs to send, thereby reducing the resource consumption of the branch device for sending NAT keep-alive messages.

[0151] In one embodiment of the present application, the machine executable instructions further cause the processor 1001 to perform the following steps:

[0152] If it is determined that there is no NAT gateway between the branch device and the public network, no NAT keep-alive message is sent.

[0153] From the above, it can be seen that in the embodiment of the present application, the branch device only needs to perform NAT keep-alive operation when there is a NAT gateway between the branch device and the public network. If there is no NAT gateway between the branch device and the public network, the branch device does not need to perform additional NAT keep-alive operation, thereby saving the resource overhead of the branch device.

[0154] Corresponding to the aforementioned NAT keep-alive method applied to a branch device, an embodiment of the present application further provides a NAT keep-alive device applied to a branch device.

[0155] See also Fig.11 , is a structural diagram of a NAT keep-alive device provided in an embodiment of the present application, wherein the branch device is connected to the central device through a public network, and the device includes:

[0156] The IP address receiving module 1101 is used to receive the public IP address sent by the central device after determining that there is a network address translation NAT gateway between the branch device and the public network, wherein the public IP address is the IP address of the target interface included in the target NAT gateway, the target interface is connected to the public network, and the target NAT gateway is the NAT gateway between the branch device and the public network that is closest to the public network;

[0157] A detection message sending module 1102 is used to send a detection request message to the target interface, wherein the detection request message includes a destination IP address, and the destination IP address is different from the public network IP address and is in the same network segment;

[0158] A number determination module 1103 is used to obtain the number of network devices in the forwarding path used to forward the probe request message according to the detection result;

[0159] The keep-alive message sending module 1104 is used to send a NAT keep-alive message to the central device according to a preset period, wherein the NAT keep-alive message includes a first lifetime TTL, and the first TTL is the sum of the number and the first value.

[0160] As can be seen from the above, in the scheme provided by the embodiment of the present application, after the branch device receives the public network IP address sent by the central device after determining that there is a NAT gateway between the branch device and the public network, the number of network devices in the forwarding path between the branch device and the target interface is determined. The target interface is the interface connected to the public network on the NAT gateway that is closest to the public network between the branch device and the public network. After determining the above number, a NAT keep-alive message is sent according to a preset period, and the first TTL of the NAT keep-alive message is the sum of the above number and the first value. That is, the first TTL is greater than the number of network devices between the branch device and the target interface, so the NAT keep-alive message can be sent to the target NAT gateway for reception. Since the target NAT gateway is the NAT gateway that is closest to the public network between the branch device and the public network, the NAT gateways between the branch device and the public network can all receive the NAT keep-alive message, thereby keeping it alive. However, the TTL of the NAT keep-alive message is only the sum of the above number and the first value, so the NAT message will be discarded soon after passing through the target interface, and will hardly be transmitted in the public network, and will not be transmitted to the central device. Therefore, the above NAT keep-alive message will not affect the traffic forwarding of the central device.

[0161] In one embodiment of the present application, the detection request message further includes a second TTL; the number determination module 1103 is specifically used to:

[0162] If the probe response message corresponding to the probe request message is not received, a probe request message whose second TTL is less than the second TTL of the previous probe request message is sent to the target interface again; or, if the probe response message corresponding to the probe request message is received, a probe request message whose second TTL is greater than the second TTL of the previous probe request message is sent to the target interface again;

[0163] Repeat the steps of, if the probe response message corresponding to the probe request message is not received, then sending the probe request message with a second TTL less than the second TTL of the previous probe request message to the target interface again, or, if the probe response message corresponding to the probe request message is received, then sending the probe request message with a second TTL greater than the second TTL of the previous probe request message to the target interface again, until the number of network devices in the forwarding path for forwarding the probe request message is determined, wherein, when the second TTL of the probe request message is greater than the number, the probe response message corresponding to the probe request message is not received, and when the second TTL of the probe request message is less than the number, the probe response message corresponding to the probe request message is received.

[0164] As can be seen from the above, in the embodiment of the present application, the second TTL of the probe request message is gradually adjusted, and the probe request message is continuously sent. According to whether the probe response message is received when the second TTL value is different, the relationship between the current second TTL and the number of network devices between the branch device and the target interface to be detected is judged, thereby accurately determining the specific value of the number to be detected.

[0165] In one embodiment of the present application, the keep-alive message sending module 1104 is specifically used to:

[0166] According to a preset period, a NAT keep-alive message is sent to the central device within a period in which no data message is sent to the central device.

[0167] From the above, it can be seen that in the embodiment of the present application, the branch device only sends NAT keep-alive messages during the period when no data messages are sent to the central device, thereby reducing the number of NAT keep-alive messages that the branch device actually needs to send, thereby reducing the resource consumption of the branch device for sending NAT keep-alive messages.

[0168] In one embodiment of the present application, the device further includes:

[0169] The keep-alive message rejecting module is used for not sending the NAT keep-alive message if it is determined that there is no NAT gateway between the branch device and the public network.

[0170] From the above, it can be seen that in the embodiment of the present application, the branch device only needs to perform NAT keep-alive operation when there is a NAT gateway between the branch device and the public network. If there is no NAT gateway between the branch device and the public network, the branch device does not need to perform additional NAT keep-alive operation, thereby saving the resource overhead of the branch device.

[0171] In another embodiment provided by the present application, a computer-readable storage medium is provided, in which a computer program is stored. When the computer program is executed by a processor, the steps of any of the above-mentioned NAT keep-alive methods are implemented.

[0172] In another embodiment provided by the present application, a computer program product including instructions is also provided, and when the computer is run on the computer, the computer executes any one of the NAT keep-alive methods in the above embodiments.

[0173] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from a website site, a computer, a server or a data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or a data center that includes one or more available media integrated. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive Solid State Disk (SSD)), etc.

[0174] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0175] Each embodiment in this specification is described in a related manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for branch devices, apparatuses, computer-readable storage media, and computer program product embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiments.

[0176] The above description is only a preferred embodiment of the present application and is not intended to limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application are included in the protection scope of the present application.

Claims

1. A communication method, characterized in that: Applied to a branch device, the branch device is connected to a central device through a public network, and the method includes: Receiving a public IP address sent by the central device after determining that there is a network address translation NAT gateway between the branch device and the public network, the public IP address is the IP address of a target interface included in a target NAT gateway, the target interface is connected to the public network, and the target NAT gateway is the NAT gateway between the branch device and the public network that is closest to the public network; Sending a probe request message to the target interface, wherein the probe request message includes a destination IP address, and the destination IP address is different from the public network IP address and is in the same network segment; According to the detection result, the number of network devices in the forwarding path used to forward the detection request message is obtained; According to a preset period, a NAT keep-alive message is sent to the central device, where the NAT keep-alive message includes a first lifetime TTL, and the first TTL is the sum of the number and the first value.

2. The method according to claim 1, characterized in that The detection request message also includes a second TTL; The obtaining, according to the detection result, the number of network devices in the forwarding path for forwarding the detection request message specifically includes: If the probe response message corresponding to the probe request message is not received, a probe request message whose second TTL is less than the second TTL of the previous probe request message is sent to the target interface again; or, if the probe response message corresponding to the probe request message is received, a probe request message whose second TTL is greater than the second TTL of the previous probe request message is sent to the target interface again; Repeat the steps of, if the probe response message corresponding to the probe request message is not received, then sending the probe request message whose second TTL is less than the second TTL of the previous probe request message to the target interface again, or, if the probe response message corresponding to the probe request message is received, then sending the probe request message whose second TTL is greater than the second TTL of the previous probe request message to the target interface again; Until the number of network devices in the forwarding path used to forward the probe request message is determined, wherein, when the second TTL of the probe request message is greater than the number, the probe response message corresponding to the probe request message is not received, and when the second TTL of the probe request message is less than the number, the probe response message corresponding to the probe request message is received.

3. The method according to claim 1, characterized in that The sending of a NAT keep-alive message to the central device according to a preset period includes: According to a preset period, a NAT keep-alive message is sent to the central device within a period in which no data message is sent to the central device.

4. The method according to any one of claims 1 to 3, characterized in that The method further comprises: If it is determined that there is no NAT gateway between the branch device and the public network, no NAT keep-alive message is sent.

5. A branch device, characterized in that: The branch device is connected to the central device through a public network, and the branch device includes: processor; Transceiver; A machine-readable storage medium storing machine-executable instructions that can be executed by the processor, the machine-executable instructions causing the processor to perform the following steps: Receiving a public IP address sent by the central device after determining that there is a network address translation NAT gateway between the branch device and the public network, the public IP address is the IP address of a target interface included in a target NAT gateway, the target interface is connected to the public network, and the target NAT gateway is the NAT gateway between the branch device and the public network that is closest to the public network; Sending a probe request message to the target interface, wherein the probe request message includes a destination IP address, and the destination IP address is different from the public network IP address and is in the same network segment; According to the detection result, the number of network devices in the forwarding path used to forward the detection request message is obtained; According to a preset period, a NAT keep-alive message is sent to the central device, where the NAT keep-alive message includes a first lifetime TTL, and the first TTL is the sum of the number and the first value.

6. The branching device according to claim 5, characterized in that: The detection request message also includes a second TTL; The obtaining, according to the detection result, the number of network devices in the forwarding path for forwarding the detection request message specifically includes: If the probe response message corresponding to the probe request message is not received, a probe request message whose second TTL is less than the second TTL of the previous probe request message is sent to the target interface again; or, if the probe response message corresponding to the probe request message is received, a probe request message whose second TTL is greater than the second TTL of the previous probe request message is sent to the target interface again; Repeat the steps of, if the probe response message corresponding to the probe request message is not received, then sending the probe request message whose second TTL is less than the second TTL of the previous probe request message to the target interface again, or, if the probe response message corresponding to the probe request message is received, then sending the probe request message whose second TTL is greater than the second TTL of the previous probe request message to the target interface again; Until the number of network devices in the forwarding path used to forward the probe request message is determined, wherein, when the second TTL of the probe request message is greater than the number, the probe response message corresponding to the probe request message is not received, and when the second TTL of the probe request message is less than the number, the probe response message corresponding to the probe request message is received.

7. The branching device according to claim 5, characterized in that: The sending of a NAT keep-alive message to the central device according to a preset period specifically includes: According to a preset period, a NAT keep-alive message is sent to the central device within a period in which no data message is sent to the central device.

8. The branching device according to any one of claims 5 to 7, characterized in that: The machine executable instructions further cause the processor to perform the following steps: If it is determined that there is no NAT gateway between the branch device and the public network, no NAT keep-alive message is sent.

9. A NAT keep-alive device, characterized in that: Applied to a branch device, the branch device is connected to a central device through a public network, and the device includes: An IP address receiving module is used to receive a public IP address sent by the central device after determining that there is a network address translation NAT gateway between the branch device and the public network, wherein the public IP address is the IP address of a target interface included in a target NAT gateway, the target interface is connected to the public network, and the target NAT gateway is the NAT gateway between the branch device and the public network that is closest to the public network; A detection message sending module, used for sending a detection request message to the target interface, wherein the detection request message includes a destination IP address, and the destination IP address is different from the public network IP address and is in the same network segment; A number determination module, used to obtain the number of network devices in the forwarding path used to forward the probe request message according to the detection result; The keep-alive message sending module is used to send a NAT keep-alive message to the central device according to a preset period, wherein the NAT keep-alive message includes a first lifetime TTL, and the first TTL is the sum of the number and the first value.

10. The device according to claim 9, characterized in that The detection request message also includes a second TTL; The number determination module is specifically used for: If the probe response message corresponding to the probe request message is not received, a probe request message whose second TTL is less than the second TTL of the previous probe request message is sent to the target interface again; or, if the probe response message corresponding to the probe request message is received, a probe request message whose second TTL is greater than the second TTL of the previous probe request message is sent to the target interface again; Repeat the steps of, if the probe response message corresponding to the probe request message is not received, then sending the probe request message with a second TTL less than the second TTL of the previous probe request message to the target interface again, or, if the probe response message corresponding to the probe request message is received, then sending the probe request message with a second TTL greater than the second TTL of the previous probe request message to the target interface again, until the number of network devices in the forwarding path for forwarding the probe request message is determined, wherein, when the second TTL of the probe request message is greater than the number, the probe response message corresponding to the probe request message is not received, and when the second TTL of the probe request message is less than the number, the probe response message corresponding to the probe request message is received.

Images