A communication method, branch device and apparatus

Abstract

This application provides a communication method, branch device, and apparatus, relating to the field of network technology, and applied to a branch device that communicates with a central device via a public network. The method includes: receiving a public IP address sent by the central device after determining that a NAT gateway exists between the branch device and the public network; the public IP address being the IP address of a target interface included in the target NAT gateway; sending a probe request message to the target interface, the probe request message including a destination IP address, the destination IP address being different from the public IP address but located in the same network segment; obtaining the number of network devices in the forwarding path used to forward the probe request message based on the probe result; and sending NAT keep-alive messages to the central device according to a preset period, the NAT keep-alive message including a first TTL, the first TTL being the sum of the number and a first value. Applying the solution provided in this application can avoid the NAT keep-alive message affecting the traffic forwarding of the central device.

Description

Technical Field

[0001] This application relates to the field of network technology, and in particular to a communication method, branch device, and apparatus. Background Technology

[0002] In current network architectures, NAT (Network Address Translation) gateways often exist between branch devices and central devices. These gateways perform NAT translation on traffic originating from branch devices, specifically translating the IP addresses in the IP datagram headers. This allows devices within the internal network to access the external public network, and vice versa, enabling the external public network to access some internal network resources. Therefore, the traffic from branch devices that is visible to the central device is often sent by the NAT gateway.

[0003] See Figure 1 This is a schematic diagram of a network structure in related technologies.

[0004] In the diagram, network device A is a branch device, network device B is a central device, and the ISP (Internet Service Provider) between network devices A and B is an external public network. A NAT gateway exists between network device A and the ISP. Network device A connects to a host; only host A is shown in the diagram. Network device B connects to a host; only host B is shown in the diagram. As shown in the diagram, host A's IP address is 10.1.1.2 / 24, network device A's interface GE1 / 0 / 2 has an IP address of 10.1.1.1 / 24, network device A's interface GE1 / 0 / 1 has an IP address of 1.1.1.1 / 16, the NAT gateway's interface connected to network device A has an IP address of 1.1.1.2 / 16, and the NAT gateway's interface connected to the ISP has an IP address of 3.3.3.1 / 16. This demonstrates that the NAT gateway can translate the IP address in the IP datagram header. Network device B's GE1 / 0 / 1 IP address is 2.2.2.2 / 16, and network device B's GE1 / 0 / 2 IP address is 10.1.2.1 / 24. Host B's IP address is 10.1.2.2 / 24.

[0005] IKE (Internet Key Exchange) technology supports NAT negotiation and discovery, meaning that both IKE devices (branch device and central device) can detect whether a NAT gateway exists between their links. If a NAT gateway exists, the branch device and central device negotiate and establish an IKE / IPSec (Internet Protocol Security) tunnel. In common scenarios, the branch device needs to periodically send NAT keep-alive messages to the central device to keep the NAT session on the NAT gateway alive. The NAT keep-alive message is a UDP (User Datagram Protocol) message. According to the protocol, the common destination port number of the NAT keep-alive message is 4500, and the payload is fixed at 0xFF. The central device does not need to respond after receiving the NAT keep-alive message and should ignore it. Theoretically, the central device also needs to perform keep-alive, but for bidirectional UDP messages, as long as there is traffic in one direction, the NAT session can be kept alive. Therefore, in most scenarios, it is the branch device that initiates NAT keep-alive. NAT keep-alive can prevent IPSec and IKE packets from being re-translated in address and port after NAT session aging, which could cause the central device to be unable to recognize or to recognize them incorrectly, thus affecting communication between branch devices and the central device.

[0006] However, in large-scale networks, the central device often connects to hundreds or even more branch devices. Each branch device needs to send NAT keep-alive messages to the central device to keep the NAT session alive. For the central device, this means receiving a large number of NAT keep-alive messages, which it must then ignore. This consumes the central device's traffic processing resources and affects its ability to receive other traffic. The impact on the central device's traffic forwarding is even greater during peak traffic periods. Summary of the Invention

[0007] The purpose of this application is to provide a communication method, branch device, and apparatus to avoid the impact of NAT keep-alive messages on the traffic forwarding of the central device. The specific technical solution is as follows:

[0008] In a first aspect, embodiments of this application provide a communication method applied to a branch device, wherein the branch device is communicatively connected to a central device via a public network, the method comprising:

[0009] The central device receives a public IP address sent after determining that a NAT gateway exists between the branch device and the public network. The public IP address is the IP address of the target interface included in the target NAT gateway. The target interface is connected to the public network. The target NAT gateway is the NAT gateway between the branch device and the public network that is closest to the public network.

[0010] Send a probe request message to the target interface. The probe request message includes a destination IP address. The destination IP address is different from the public IP address and is in the same network segment.

[0011] Based on the detection results, the number of network devices in the forwarding path used to forward the detection request message is obtained;

[0012] According to a preset period, NAT keep-alive messages are sent to the central device. The NAT keep-alive message includes a first time-to-live (TTL), where the first TTL is the sum of the number of messages and a first value.

[0013] In one embodiment of this application, the probe request message further includes a second TTL;

[0014] The step of obtaining the number of network devices in the forwarding path used to forward the probe request message based on the probe results specifically includes:

[0015] If no probe response message is received corresponding to the probe request message, a probe request message with a second TTL less than the second TTL of the previous probe request message is sent to the target interface again; or, if a probe response message is received corresponding to the probe request message, a probe request message with a second TTL greater than the second TTL of the previous probe request message is sent to the target interface again.

[0016] The steps of sending a probe request message with a second TTL less than the second TTL of the previous probe request message to the target interface again if no probe response message is received, or sending a probe request message with a second TTL greater than the second TTL of the previous probe request message to the target interface again if a probe response message is received, are repeated until the number of network devices in the forwarding path used to forward the probe request message is determined. Specifically, if the second TTL of the probe request message is greater than this number, no probe response message is received; if the second TTL of the probe request message is less than this number, a probe response message is received.

[0017] In one embodiment of this application, sending NAT keep-alive messages to the central device according to a preset period includes:

[0018] According to a preset period, during periods when no data packets are sent to the central device, NAT keep-alive packets are sent to the central device.

[0019] In one embodiment of this application, the method further includes:

[0020] If it is determined that there is no NAT gateway between the branch device and the public network, then no NAT keep-alive message will be sent.

[0021] Secondly, embodiments of this application provide a branch device, which is communicatively connected to a central device via a public network. The branch device includes:

[0022] processor;

[0023] transceiver;

[0024] A machine-readable storage medium storing machine-executable instructions that can be executed by the processor, the machine-executable instructions causing the processor to perform the following steps:

[0025] The central device receives a public IP address sent after determining that a NAT gateway exists between the branch device and the public network. The public IP address is the IP address of the target interface included in the target NAT gateway. The target interface is connected to the public network. The target NAT gateway is the NAT gateway between the branch device and the public network that is closest to the public network.

[0026] Send a probe request message to the target interface. The probe request message includes a destination IP address. The destination IP address is different from the public IP address and is in the same network segment.

[0027] Based on the detection results, the number of network devices in the forwarding path used to forward the detection request message is obtained;

[0028] According to a preset period, NAT keep-alive messages are sent to the central device. The NAT keep-alive message includes a first time-to-live (TTL), where the first TTL is the sum of the number of messages and a first value.

[0029] In one embodiment of this application, the probe request message further includes a second TTL;

[0030] The step of obtaining the number of network devices in the forwarding path used to forward the probe request message based on the probe results specifically includes:

[0031] If no probe response message is received corresponding to the probe request message, a probe request message with a second TTL less than the second TTL of the previous probe request message is sent to the target interface again; or, if a probe response message is received corresponding to the probe request message, a probe request message with a second TTL greater than the second TTL of the previous probe request message is sent to the target interface again.

[0032] The steps of sending a probe request message with a second TTL less than the second TTL of the previous probe request message to the target interface again if no probe response message is received, or sending a probe request message with a second TTL greater than the second TTL of the previous probe request message to the target interface again if a probe response message is received, are repeated until the number of network devices in the forwarding path used to forward the probe request message is determined. Specifically, if the second TTL of the probe request message is greater than this number, no probe response message is received; if the second TTL of the probe request message is less than this number, a probe response message is received.

[0033] In one embodiment of this application, sending NAT keep-alive messages to the central device according to a preset period specifically includes:

[0034] According to a preset period, during periods when no data packets are sent to the central device, NAT keep-alive packets are sent to the central device.

[0035] In one embodiment of this application, the machine-executable instructions further cause the processor to perform the following steps:

[0036] If it is determined that there is no NAT gateway between the branch device and the public network, then no NAT keep-alive message will be sent.

[0037] Thirdly, embodiments of this application provide a NAT keep-alive device applied to a branch device, wherein the branch device is communicatively connected to a central device via a public network, and the device includes:

[0038] The IP address receiving module is used to receive the public IP address sent by the central device after determining that there is a NAT gateway between the branch device and the public network. The public IP address is the IP address of the target interface included in the target NAT gateway. The target interface is connected to the public network. The target NAT gateway is the NAT gateway between the branch device and the public network that is closest to the public network.

[0039] The probe message sending module is used to send a probe request message to the target interface. The probe request message includes a destination IP address, which is different from the public IP address and is in the same network segment.

[0040] The number determination module is used to determine the number of network devices in the forwarding path used to forward the probe request message based on the probe results.

[0041] The keep-alive message sending module is used to send NAT keep-alive messages to the central device according to a preset period. The NAT keep-alive message includes a first time-to-live (TTL), where the first TTL is the sum of the number of messages and a first value.

[0042] In one embodiment of this application, the probe request message further includes a second TTL;

[0043] The quantity determination module is specifically used for:

[0044] If no probe response message is received corresponding to the probe request message, a probe request message with a second TTL less than the second TTL of the previous probe request message is sent to the target interface again; or, if a probe response message is received corresponding to the probe request message, a probe request message with a second TTL greater than the second TTL of the previous probe request message is sent to the target interface again.

[0045] The steps of sending a probe request message with a second TTL less than the second TTL of the previous probe request message to the target interface again if no probe response message is received, or sending a probe request message with a second TTL greater than the second TTL of the previous probe request message to the target interface again if a probe response message is received, are repeated until the number of network devices in the forwarding path used to forward the probe request message is determined. Specifically, if the second TTL of the probe request message is greater than this number, no probe response message is received; if the second TTL of the probe request message is less than this number, a probe response message is received.

[0046] In one embodiment of this application, the keep-alive message sending module is specifically used for:

[0047] According to a preset period, during periods when no data packets are sent to the central device, NAT keep-alive packets are sent to the central device.

[0048] In one embodiment of this application, the apparatus further includes:

[0049] The keep-alive message rejection module is used to prevent the sending of NAT keep-alive messages if it is determined that there is no NAT gateway between the branch device and the public network.

[0050] Fourthly, embodiments of this application provide a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of any of the methods described in the first aspect.

[0051] Fifthly, embodiments of this application also provide a computer program product containing instructions that, when run on a computer, cause the computer to perform any of the steps described in the first aspect above.

[0052] Beneficial effects of the embodiments in this application:

[0053] In the solution provided in this application embodiment, after receiving the public IP address sent by the central device after determining that a NAT gateway exists between the branch device and the public network, the branch device determines the number of network devices in the forwarding path between the branch device and the target interface. The target interface is the interface connected to the public network on the NAT gateway that is closest to the public network between the branch device and the public network. After determining the above number, NAT keep-alive messages are sent according to a preset period. The first TTL of the NAT keep-alive message is the sum of the above number and a first value. That is, the first TTL is greater than the number of network devices between the branch device and the target interface, so the NAT keep-alive message can be sent to the target NAT gateway for reception. Since the target NAT gateway is the NAT gateway that is closest to the public network between the branch device and the public network, all NAT gateways between the branch device and the public network can receive the NAT keep-alive message, thus keeping the network alive. However, the TTL of the NAT keep-alive message is only the sum of the above number and the first value, so the NAT message will be discarded shortly after passing through the target interface and will hardly be transmitted in the public network, let alone transmitted to the central device. Therefore, the above NAT keep-alive message will not affect the traffic forwarding of the central device. Attached Figure Description

[0054] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other embodiments can be obtained based on these drawings.

[0055] Figure 1 This is a schematic diagram of a network structure in related technologies;

[0056] Figure 2 A flowchart illustrating the first NAT keep-alive method provided in this application embodiment;

[0057] Figure 3 A schematic diagram illustrating the distribution of the first type of NAT gateway provided in this application embodiment;

[0058] Figure 4 A schematic diagram illustrating the distribution of the second type of NAT gateway provided in this application embodiment;

[0059] Figure 5A schematic diagram illustrating the distribution of the third type of NAT gateway provided in this application embodiment;

[0060] Figure 6 A schematic diagram illustrating the distribution of the fourth type of NAT gateway provided in this application embodiment;

[0061] Figure 7 A schematic diagram illustrating the format of a NAT keepalive message provided in an embodiment of this application;

[0062] Figure 8 A flowchart illustrating the second NAT keep-alive method provided in this application embodiment;

[0063] Figure 9 A flowchart illustrating the third NAT keep-alive method provided in this application embodiment;

[0064] Figure 10 This is a schematic diagram of the structure of a branch device provided in an embodiment of this application;

[0065] Figure 11 This is a schematic diagram of a NAT keep-alive device provided in an embodiment of this application. Detailed Implementation

[0066] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art based on this application are within the scope of protection of this application.

[0067] During the NAT keep-alive process in related technologies, the central device receives a large number of NAT keep-alive packets, which affects the normal traffic forwarding of the central device. To solve the above problem, embodiments of this application provide a NAT keep-alive method, branch device, and apparatus.

[0068] See Figure 2 This is a flowchart illustrating the first NAT keep-alive method provided in this application embodiment, applied to branch devices, which communicate with the central device via a public network. The method includes steps S201-S204. Specifically, the central device often communicates with multiple branch devices via an IPsec VPN (Virtual Private Network) through a public network. For example, the central device may be located at the company headquarters, and the branch devices may be located in different branches of the company. This network architecture enables network interconnection between different locations within the company. The branch devices and the central device are network devices, such as routers.

[0069] S201: Receive the public IP address sent by the central device after determining that there is a NAT gateway between the branch device and the public network.

[0070] The aforementioned public IP address is the IP address of the target interface included in the target NAT gateway. The aforementioned target interface is connected to the aforementioned public network. The aforementioned target NAT gateway is the NAT gateway that is closest to the aforementioned public network between the aforementioned branch device and the aforementioned public network.

[0071] In one embodiment of this application, the branch device and the central device each perform hash operations on their own IP address, port number, cookie, or SPI (Serial Peripheral Interface), and send the results to the other end. The branch device and the central device compare their own hash results with the results sent by the other end to determine whether a NAT gateway exists between them and the location of any existing NAT gateway.

[0072] Specifically, branch devices and central devices can determine whether a NAT gateway exists between them and the central device based on the NAT detection and NAT gateway location detection methods provided by IKE in related technologies, and determine the location of the NAT gateway. For details, please refer to RFC3498 (IKEv1) and RFC7296 (IKEv2), which will not be repeated here.

[0073] In addition, there are four scenarios regarding the distribution of NAT gateways between branch devices and central devices.

[0074] Scenario 1: See Figure 3 This is a schematic diagram illustrating the distribution of the first type of NAT gateway provided in this application embodiment.

[0075] The diagram includes branch equipment, a central equipment, and an ISP (representing a public network) between them. Both the branch equipment and the central equipment are connected to a LAN (Local Area Network). The dashed line between them indicates a connection via an IPsec VPN tunnel. As shown in the diagram, there is no NAT gateway between the branch equipment and the central equipment in this configuration.

[0076] In this scenario, both the branch and central devices are exposed to the public network, each with a stable public IP address or domain name, and there is no NAT gateway between them.

[0077] Scenario 2: See Figure 4 This is a schematic diagram illustrating the distribution of the second type of NAT gateway provided in this application embodiment.

[0078] The diagram includes a branch device, a central device, an ISP (representing the public network) between them, and a NAT gateway. The branch device and the central device are each connected to a LAN. The dashed line between them indicates a connection via an IPsec VPN tunnel. As shown in the diagram, in this scenario, the NAT gateway is located between the central device and the public network.

[0079] In this network, the NAT gateway often acts as a firewall in front of the central device (i.e., between the central device and the ISP) to filter traffic destined for the central device.

[0080] Scenario 3: See Figure 5 This is a schematic diagram illustrating the distribution of the third type of NAT gateway provided in this application embodiment.

[0081] The diagram includes a branch device, a central device, an ISP (representing the public network) between them, and a NAT gateway. The branch device and the central device are each connected to a LAN. The dashed line between them indicates a connection via an IPsec VPN tunnel. As shown in the diagram, in this scenario, the NAT gateway is located between the branch device and the public network.

[0082] This type of network topology is common. In this case, the central device can obtain public IP information, but there may be one or more NAT gateways in front of the branch devices (i.e., between the branch devices and the public network). Figure 5 This shows the case with only one NAT gateway.

[0083] Scenario 4: See Figure 6 This is a schematic diagram illustrating the distribution of the fourth type of NAT gateway provided in this application embodiment.

[0084] The diagram includes a branch device, a central device, an ISP (representing the public network) between them, and a NAT gateway. The branch device and the central device are each connected to a LAN. The dashed line between them indicates a connection via an IPsec VPN tunnel. As shown in the diagram, in this scenario, NAT gateway 2 is located between the branch device and the public network, and NAT gateway 1 is located between the central device and the public network. That is, in this case, there is a NAT gateway between the branch device and the public network, and also between the central device and the public network.

[0085] Specifically, the situation where there is a NAT gateway between the branch device and the public network corresponds to the aforementioned situations three and four.

[0086] In one embodiment of this application, the aforementioned public IP address is included in a message sent by the central device to the branch device. This message is sent by the central device to the branch device after successful IKE negotiation and confirmation that a NAT gateway exists between the branch device and the public network. The message can be encrypted and authenticated using IPsec services to ensure its security.

[0087] Additionally, it should be noted that if there is only one NAT gateway between the branch device and the public network, then that NAT gateway is the target NAT gateway. If there are multiple NAT gateways between the branch device and the public network, then the NAT gateway closest to the public network is the target NAT gateway. The IP address of the target interface connecting the target NAT gateway to the public network is actually the IP address exposed to the public network by the branch device. From the perspective of the central device, it communicates with the branch device through this IP address.

[0088] S202: Send a probe request message to the target interface mentioned above.

[0089] The aforementioned probe request message includes a destination IP address, which is different from the aforementioned public IP address but is located in the same network segment.

[0090] The probe request message can be a random address within the same network segment as the public IP address, different from the public IP address itself. For example, if the public IP address is 1.0.0.1, the destination IP address of the probe message can be any value other than 1.0.0.1 from 1.0.0.0 / 24, such as 1.0.0.3. However, theoretically, the smaller the chosen destination IP address, the more accurate the number of network devices in the subsequent forwarding path used to forward the probe request message will be. Therefore, the smallest possible IP address can be chosen as the destination IP address.

[0091] In one embodiment of this application, the aforementioned probe request message may be an ICMP (Internet Control Message Protocol) request message.

[0092] S203: Based on the detection results, obtain the number of network devices in the forwarding path used to forward the above-mentioned probe request message.

[0093] In one embodiment of this application, multiple candidate numbers can be preset, and the difference between adjacent candidate numbers is a preset fixed value. The branch device sends probe request messages with a second TTL (Time To Live) for each candidate number, and determines whether a probe response message is received after sending the probe request message for each candidate number, using this as the probe result. A final number is determined from the candidate numbers; no probe response message is received for this number, but probe response messages are received for all other candidate numbers smaller than this number.

[0094] The aforementioned probe response message can be an ICMP TTL timeout message.

[0095] In another embodiment of this application, it can be described as follows: Figure 9 Steps S203A-S203C, as shown, determine the aforementioned number, which will not be detailed here.

[0096] Since the target NAT gateway is located between the branch device and the public network, that is, relative to the branch device, the target NAT gateway is located in front of the public network, the above number is equivalent to the distance from the branch device to the public network.

[0097] S204: Send NAT keep-alive messages to the aforementioned central device according to the preset cycle.

[0098] The aforementioned NAT keep-alive message includes a first TTL, which is the sum of the aforementioned number and a first value.

[0099] Since the first TTL of a NAT keepalive packet is the aforementioned number plus a first value, the NAT keepalive packet will reach the target NAT gateway after being forwarded through the aforementioned number of network devices. After being forwarded through the first value of network devices, it will be discarded. Because the target NAT gateway is the NAT gateway with the closest record to the public network between the branch device and the public network, if the NAT keepalive packet can be forwarded to the target NAT gateway, it means that all NAT gateways between the branch device and the public network can receive the NAT keepalive packet and thus keep it alive. Therefore, to save forwarding resources, the NAT keepalive packet should be discarded as soon as possible after being forwarded by the target NAT gateway. Thus, the first TTL of the NAT packet only needs to be greater than the aforementioned number, and the value of the first TTL can be as small as possible, meaning the first value can be as small as possible, less than a preset value, such as 1, 2, or 3.

[0100] In addition, the above-mentioned preset period can be 20s, 30s, 40s, 1 minute, etc., and the specific value is not limited in the embodiments of this application.

[0101] See Figure 7This is a schematic diagram of the format of a NAT keepalive message provided in an embodiment of this application.

[0102] As shown in the diagram, the NAT keepalive message contains the source port number, destination port number, message length, checksum, and 0xFF. 0xFF is the fixed payload of the NAT keepalive message. Additionally, a common destination port number for NAT keepalive messages is UDP 4500. The topmost number indicates the bit sequence number.

[0103] As can be seen from the above, in the solution provided by this application embodiment, after the branch device receives the public IP address sent by the central device after determining that a NAT gateway exists between the branch device and the public network, it determines the number of network devices in the forwarding path between the branch device and the target interface. The target interface is the interface connected to the public network on the NAT gateway that is closest to the public network between the branch device and the public network. After determining the above number, NAT keep-alive messages are sent according to a preset period. The first TTL of the NAT keep-alive message is the sum of the above number and a first value. That is, the first TTL is greater than the above number of network devices between the branch device and the target interface, so the NAT keep-alive message can be sent to the target NAT gateway for reception. Since the target NAT gateway is the NAT gateway that is closest to the public network between the branch device and the public network, all NAT gateways between the branch device and the public network can receive the NAT keep-alive message, thus keeping it alive. However, the TTL of the NAT keep-alive message is only the sum of the above number and the first value, so the NAT message will be discarded shortly after passing through the target interface and will hardly be transmitted in the public network, let alone transmitted to the central device. Therefore, the aforementioned NAT keep-alive messages will not affect the traffic forwarding of the central device.

[0104] Furthermore, since the payload carried in the NAT keep-alive message is only 0xFF, and the data volume is small, the NAT keep-alive message belongs to UDP small packets. If the NAT keep-alive solution in related technologies is used, the central device will receive a large number of UDP small packets. For a central device that forwards packets based on CPU, processing UDP small packets consumes more CPU resources, thus further affecting the normal forwarding of traffic. However, in this application, the NAT keep-alive message is not sent to the central device, so it will not affect the central device.

[0105] Furthermore, in another embodiment of this application, before executing the embodiments of this application, when the central device and the branch device conduct their first IKE negotiation, both parties can inform each other whether they support using the NAT keep-alive scheme provided in the embodiments of this application. If both parties support it, the NAT keep-alive scheme provided in the embodiments of this application will be used by default after successful IKE negotiation. If one party does not support the scheme provided in the embodiments of this application, the NAT keep-alive scheme in related technologies can continue to be used.

[0106] In one embodiment of this application, the above method further includes step A.

[0107] Step A: If it is determined that there is no NAT gateway between the above branch device and the above public network, then no NAT keep-alive message will be sent.

[0108] Specifically, the situation where there is no NAT gateway between the branch device and the public network includes the aforementioned situation one, that is, there is no NAT gateway between the branch device and the central device, and the aforementioned situation two, where there is a NAT gateway between the branch device and the central device, but the NAT gateway is located between the public network and the central device.

[0109] In scenario one, since there is no NAT gateway, NAT keep-alive is not required. In scenario two, theoretically, the central device should perform NAT keep-alive. However, since the NAT gateway configuration of the central device is often fixed, no additional NAT keep-alive is needed. The NAT gateway will continue to keep alive by default, so neither the branch device nor the central device needs to perform keep-alive.

[0110] As can be seen from the above, in this embodiment of the application, the branch device only needs to perform NAT keep-alive when there is a NAT gateway between the branch device and the public network. If there is no NAT gateway between the branch device and the public network, the branch device does not need to perform additional NAT keep-alive operations, thereby saving the branch device's resource consumption.

[0111] See Figure 8 This is a flowchart illustrating the second NAT keep-alive method provided in this application embodiment, which is consistent with the aforementioned... Figure 2 Compared to the illustrated embodiment, step S204 can be implemented by step S204A.

[0112] S204A: During a preset period, if no data packets are sent to the aforementioned central device, send NAT keep-alive packets to the aforementioned central device.

[0113] In one embodiment of this application, if a branch device sends a data packet to the central device within a preset period, the NAT gateway located between the branch device and the public network can receive the data packet, determine that the branch device is still running, and therefore will not disconnect from the branch device, thus achieving a keep-alive effect. The branch device then does not need to send additional NAT keep-alive packets. Conversely, if the branch device does not send a data packet to the central device, it needs to send additional NAT keep-alive packets.

[0114] As can be seen from the above, in this embodiment of the application, the branch device only sends NAT keep-alive messages during the period when it does not send data packets to the central device, thereby reducing the number of NAT keep-alive messages that the branch device actually needs to send, and thus reducing the resource consumption of the branch device for sending NAT keep-alive messages.

[0115] In one embodiment of this application, the probe request message further includes a second TTL. See also Figure 9 This is a flowchart illustrating the third NAT keep-alive method provided in this application embodiment, which is consistent with the aforementioned... Figure 2 Compared to the embodiment shown, step S203 can be implemented by the following steps S203A-S203C.

[0116] S203A: If no probe response message corresponding to the above probe request message is received, then send another probe request message with a second TTL less than the second TTL of the previous probe request message to the above target interface.

[0117] For example, the second TTL of the first probe request message can be 100, 50, etc., and the specific settings can be configured according to actual needs.

[0118] If no probe response message is received, it means that the probe request message was sent to the destination IP address within the current second TTL. This indicates that the second TTL is greater than or equal to the number of network devices in the forwarding path from the branch device to the destination IP address, which in turn means that the current second TTL is greater than or equal to the number of network devices in the forwarding path from the branch device to the target interface.

[0119] In this case, in order to accurately determine the number of network devices in the forwarding path from the branch device to the target interface, the second TTL is reduced, and a new probe request message is sent again.

[0120] S203B: If a probe response message corresponding to the above probe request message is received, a probe request message with a second TTL greater than the second TTL of the previous probe request message is sent again to the above target interface.

[0121] In contrast to step S203A, if a probe response message is received, it indicates that the current second TTL is greater than the number of network devices in the forwarding path from the branch device to the target interface. In this case, to accurately determine the number of network devices in the forwarding path from the branch device to the target interface, the second TTL is increased, and a new probe request message is sent again.

[0122] In another embodiment of this application, when continuously sending probe request messages, the adjustment range of the second TTL is gradually reduced. For example, during the first adjustment, the second TTL is reduced by 50, and during the second adjustment, the second TTL is increased by 30, etc.

[0123] In one scenario, a binary search approach can be used to adjust the second TTL. For example, if the second TTL of the first probe request message is 100, and then the second TTL is decreased, using the binary search approach, the second TTL of the second probe request message will be half of 100, i.e., decreased by 50, adjusted to 50. Then, if the second TTL is increased, the second TTL of the third probe request message should be between 50 and 100. Using the binary search approach, the second TTL is increased by (100-50) / 2 = 25, meaning the second TTL of the third probe request message will be 75, and so on.

[0124] If the number of network devices in the forwarding path used to forward the probe request message cannot be determined, return to step S203A or step S203B to continue probing the number of devices; otherwise, proceed to step S203C.

[0125] S203C: Determine the number of network devices in the forwarding path used to forward the above probe request message.

[0126] Specifically, if the second TTL of the probe request message is greater than the specified number, no probe response message corresponding to the probe request message is received; if the second TTL of the probe request message is less than the specified number, the probe response message corresponding to the probe request message is received.

[0127] As can be seen from the above, in this embodiment of the application, by gradually adjusting the second TTL of the probe request message and continuously sending probe request messages, the relationship between the current second TTL and the number of network devices between the branch device and the target interface to be probed is determined based on whether probe response messages are received under different second TTL values, thereby accurately determining the specific value of the number of devices to be probed.

[0128] Corresponding to the aforementioned NAT keep-alive method applied to branch devices, this application also provides a branch device.

[0129] See Figure 10 This is a schematic diagram of a branch device provided in an embodiment of this application. The branch device is communicatively connected to a central device via a public network. The branch device includes:

[0130] Processor 1001;

[0131] Transceiver 1004;

[0132] A machine-readable storage medium 1002 stores machine-executable instructions that can be executed by the processor 1001, the machine-executable instructions causing the processor 1001 to perform the following steps:

[0133] The central device receives a public IP address sent after determining that a Network Address Translation (NAT) gateway exists between the branch device and the public network. The public IP address is the IP address of the target interface included in the target NAT gateway. The target interface is connected to the public network. The target NAT gateway is the NAT gateway between the branch device and the public network that is closest to the public network.

[0134] Send a probe request message to the target interface. The probe request message includes a destination IP address. The destination IP address is different from the public IP address and is in the same network segment.

[0135] Based on the detection results, the number of network devices in the forwarding path used to forward the detection request message is obtained;

[0136] According to a preset period, NAT keep-alive messages are sent to the central device. The NAT keep-alive message includes a first time-to-live (TTL), where the first TTL is the sum of the number of messages and a first value.

[0137] like Figure 10 As shown, the network device may also include a communication bus 1003. The processor 1001, machine-readable storage medium 1002, and transceiver 1004 communicate with each other via the communication bus 1003. The communication bus 1003 can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. This communication bus 1003 can be divided into an address bus, a data bus, a control bus, etc.

[0138] The transceiver 1004 can be a wireless communication module, which interacts with other devices under the control of the processor 1001.

[0139] The machine-readable storage medium 1002 may include random access memory (RAM) or non-volatile memory (NVM), such as at least one disk storage device. Alternatively, the machine-readable storage medium 1002 may also be at least one storage device located remotely from the aforementioned processor.

[0140] The processor 1001 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0141] As can be seen from the above, in the solution provided by this application embodiment, after the branch device receives the public IP address sent by the central device after determining that a NAT gateway exists between the branch device and the public network, it determines the number of network devices in the forwarding path between the branch device and the target interface. The target interface is the interface connected to the public network on the NAT gateway that is closest to the public network between the branch device and the public network. After determining the above number, NAT keep-alive messages are sent according to a preset period. The first TTL of the NAT keep-alive message is the sum of the above number and a first value. That is, the first TTL is greater than the above number of network devices between the branch device and the target interface, so the NAT keep-alive message can be sent to the target NAT gateway for reception. Since the target NAT gateway is the NAT gateway that is closest to the public network between the branch device and the public network, all NAT gateways between the branch device and the public network can receive the NAT keep-alive message, thus keeping it alive. However, the TTL of the NAT keep-alive message is only the sum of the above number and the first value, so the NAT message will be discarded shortly after passing through the target interface and will hardly be transmitted in the public network, let alone transmitted to the central device. Therefore, the aforementioned NAT keep-alive messages will not affect the traffic forwarding of the central device.

[0142] In one embodiment of this application, the probe request message further includes a second TTL;

[0143] The step of obtaining the number of network devices in the forwarding path used to forward the probe request message based on the probe results specifically includes:

[0144] If no probe response message is received corresponding to the probe request message, a probe request message with a second TTL less than the second TTL of the previous probe request message is sent to the target interface again; or, if a probe response message is received corresponding to the probe request message, a probe request message with a second TTL greater than the second TTL of the previous probe request message is sent to the target interface again.

[0145] Repeat the steps of sending a probe request message with a second TTL less than the second TTL of the previous probe request message to the target interface again if no probe response message is received, or sending a probe request message with a second TTL greater than the second TTL of the previous probe request message to the target interface again if a probe response message is received;

[0146] The process continues until the number of network devices in the forwarding path used to forward the probe request message is determined. If the second TTL of the probe request message is greater than the number of devices, no probe response message corresponding to the probe request message is received. If the second TTL of the probe request message is less than the number of devices, a probe response message corresponding to the probe request message is received.

[0147] As can be seen from the above, in this embodiment of the application, by gradually adjusting the second TTL of the probe request message and continuously sending probe request messages, the relationship between the current second TTL and the number of network devices between the branch device and the target interface to be probed is determined based on whether probe response messages are received under different second TTL values, thereby accurately determining the specific value of the number of devices to be probed.

[0148] In one embodiment of this application, sending NAT keep-alive messages to the central device according to a preset period specifically includes:

[0149] According to a preset period, during periods when no data packets are sent to the central device, NAT keep-alive packets are sent to the central device.

[0150] As can be seen from the above, in this embodiment of the application, the branch device only sends NAT keep-alive messages during the period when it does not send data packets to the central device, thereby reducing the number of NAT keep-alive messages that the branch device actually needs to send, and thus reducing the resource consumption of the branch device for sending NAT keep-alive messages.

[0151] In one embodiment of this application, the machine-executable instructions further cause the processor 1001 to perform the following steps:

[0152] If it is determined that there is no NAT gateway between the branch device and the public network, then no NAT keep-alive message will be sent.

[0153] As can be seen from the above, in this embodiment of the application, the branch device only needs to perform NAT keep-alive when there is a NAT gateway between the branch device and the public network. If there is no NAT gateway between the branch device and the public network, the branch device does not need to perform additional NAT keep-alive operations, thereby saving the branch device's resource consumption.

[0154] Corresponding to the aforementioned NAT keep-alive method applied to branch devices, this application also provides a NAT keep-alive device applied to branch devices.

[0155] See Figure 11 This is a schematic diagram of a NAT keep-alive device provided in an embodiment of this application. The branch device is communicatively connected to the central device via a public network. The device includes:

[0156] IP address receiving module 1101 is used to receive a public IP address sent by the central device after determining that there is a Network Address Translation (NAT) gateway between the branch device and the public network. The public IP address is the IP address of the target interface included in the target NAT gateway. The target interface is connected to the public network. The target NAT gateway is the NAT gateway between the branch device and the public network that is closest to the public network.

[0157] The probe message sending module 1102 is used to send a probe request message to the target interface. The probe request message includes a destination IP address, which is different from the public IP address and is in the same network segment.

[0158] The number determination module 1103 is used to obtain the number of network devices in the forwarding path used to forward the probe request message based on the probe results;

[0159] The keep-alive message sending module 1104 is used to send NAT keep-alive messages to the central device according to a preset period. The NAT keep-alive message includes a first time-to-live (TTL), where the first TTL is the sum of the number of messages and a first value.

[0160] As can be seen from the above, in the solution provided by this application embodiment, after the branch device receives the public IP address sent by the central device after determining that a NAT gateway exists between the branch device and the public network, it determines the number of network devices in the forwarding path between the branch device and the target interface. The target interface is the interface connected to the public network on the NAT gateway that is closest to the public network between the branch device and the public network. After determining the above number, NAT keep-alive messages are sent according to a preset period. The first TTL of the NAT keep-alive message is the sum of the above number and a first value. That is, the first TTL is greater than the above number of network devices between the branch device and the target interface, so the NAT keep-alive message can be sent to the target NAT gateway for reception. Since the target NAT gateway is the NAT gateway that is closest to the public network between the branch device and the public network, all NAT gateways between the branch device and the public network can receive the NAT keep-alive message, thus keeping it alive. However, the TTL of the NAT keep-alive message is only the sum of the above number and the first value, so the NAT message will be discarded shortly after passing through the target interface and will hardly be transmitted in the public network, let alone transmitted to the central device. Therefore, the aforementioned NAT keep-alive messages will not affect the traffic forwarding of the central device.

[0161] In one embodiment of this application, the probe request message further includes a second TTL; the number determination module 1103 is specifically used for:

[0162] If no probe response message is received corresponding to the probe request message, a probe request message with a second TTL less than the second TTL of the previous probe request message is sent to the target interface again; or, if a probe response message is received corresponding to the probe request message, a probe request message with a second TTL greater than the second TTL of the previous probe request message is sent to the target interface again.

[0163] The steps of sending a probe request message with a second TTL less than the second TTL of the previous probe request message to the target interface again if no probe response message is received, or sending a probe request message with a second TTL greater than the second TTL of the previous probe request message to the target interface again if a probe response message is received, are repeated until the number of network devices in the forwarding path used to forward the probe request message is determined. Specifically, if the second TTL of the probe request message is greater than this number, no probe response message is received; if the second TTL of the probe request message is less than this number, a probe response message is received.

[0164] As can be seen from the above, in this embodiment of the application, by gradually adjusting the second TTL of the probe request message and continuously sending probe request messages, the relationship between the current second TTL and the number of network devices between the branch device and the target interface to be probed is determined based on whether probe response messages are received under different second TTL values, thereby accurately determining the specific value of the number of devices to be probed.

[0165] In one embodiment of this application, the keep-alive message sending module 1104 is specifically used for:

[0166] According to a preset period, during periods when no data packets are sent to the central device, NAT keep-alive packets are sent to the central device.

[0167] As can be seen from the above, in this embodiment of the application, the branch device only sends NAT keep-alive messages during the period when it does not send data packets to the central device, thereby reducing the number of NAT keep-alive messages that the branch device actually needs to send, and thus reducing the resource consumption of the branch device for sending NAT keep-alive messages.

[0168] In one embodiment of this application, the apparatus further includes:

[0169] The keep-alive message rejection module is used to prevent the sending of NAT keep-alive messages if it is determined that there is no NAT gateway between the branch device and the public network.

[0170] As can be seen from the above, in this embodiment of the application, the branch device only needs to perform NAT keep-alive when there is a NAT gateway between the branch device and the public network. If there is no NAT gateway between the branch device and the public network, the branch device does not need to perform additional NAT keep-alive operations, thereby saving the branch device's resource consumption.

[0171] In another embodiment provided in this application, a computer-readable storage medium is also provided, which stores a computer program that, when executed by a processor, implements the steps of any of the above-described NAT keep-alive methods.

[0172] In another embodiment provided in this application, a computer program product containing instructions is also provided, which, when run on a computer, causes the computer to execute any of the NAT keep-alive methods described above.

[0173] In the above embodiments, implementation can be achieved entirely or partially through software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented entirely or partially as a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid state disk (SSD)).

[0174] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0175] The various embodiments in this specification are described in a related manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the embodiments for branch devices, apparatuses, computer-readable storage media, and computer program products are basically similar to the method embodiments, and therefore the descriptions are relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0176] The above description is merely a preferred embodiment of this application and is not intended to limit the scope of protection of this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application are included within the scope of protection of this application.

Claims

1. A communication method, characterized in that, Applied to branch equipment, which communicates with central equipment via a public network, the method includes: The central device receives a public IP address sent after determining that a Network Address Translation (NAT) gateway exists between the branch device and the public network. The public IP address is the IP address of the target interface included in the target NAT gateway. The target interface is connected to the public network. The target NAT gateway is the NAT gateway between the branch device and the public network that is closest to the public network. Send a probe request message to the target interface. The probe request message includes a destination IP address. The destination IP address is different from the public IP address and is in the same network segment. Based on the detection results, the number of network devices in the forwarding path used to forward the detection request message is obtained; According to a preset period, a NAT keep-alive message is sent to the central device. The NAT keep-alive message includes a first time-to-live (TTL), where the first TTL is the sum of the number of messages and a first value. The probe request message also includes a second TTL; The step of obtaining the number of network devices in the forwarding path used to forward the probe request message based on the probe results specifically includes: If no probe response message is received corresponding to the probe request message, a probe request message with a second TTL less than the second TTL of the previous probe request message is sent to the target interface again; or, if a probe response message is received corresponding to the probe request message, a probe request message with a second TTL greater than the second TTL of the previous probe request message is sent to the target interface again. Repeat the steps of sending a probe request message with a second TTL less than the second TTL of the previous probe request message to the target interface again if no probe response message is received, or sending a probe request message with a second TTL greater than the second TTL of the previous probe request message to the target interface again if a probe response message is received; The process continues until the number of network devices in the forwarding path used to forward the probe request message is determined. If the second TTL of the probe request message is greater than the number of devices, no probe response message corresponding to the probe request message is received. If the second TTL of the probe request message is less than the number of devices, a probe response message corresponding to the probe request message is received.

2. The method according to claim 1, characterized in that, The step of sending NAT keep-alive messages to the central device according to a preset period includes: According to a preset period, during periods when no data packets are sent to the central device, NAT keep-alive packets are sent to the central device.

3. The method according to any one of claims 1-2, characterized in that, The method further includes: If it is determined that there is no NAT gateway between the branch device and the public network, then no NAT keep-alive message will be sent.

4. A branching device, characterized in that, The branch device communicates with the central device via a public network, and the branch device includes: processor; transceiver; A machine-readable storage medium storing machine-executable instructions that can be executed by the processor, the machine-executable instructions causing the processor to perform the following steps: The central device receives a public IP address sent after determining that a Network Address Translation (NAT) gateway exists between the branch device and the public network. The public IP address is the IP address of the target interface included in the target NAT gateway. The target interface is connected to the public network. The target NAT gateway is the NAT gateway between the branch device and the public network that is closest to the public network. Send a probe request message to the target interface. The probe request message includes a destination IP address. The destination IP address is different from the public IP address and is in the same network segment. Based on the detection results, the number of network devices in the forwarding path used to forward the detection request message is obtained; According to a preset period, a NAT keep-alive message is sent to the central device. The NAT keep-alive message includes a first time-to-live (TTL), where the first TTL is the sum of the number of messages and a first value. The probe request message also includes a second TTL; The step of obtaining the number of network devices in the forwarding path used to forward the probe request message based on the probe results specifically includes: If no probe response message is received corresponding to the probe request message, a probe request message with a second TTL less than the second TTL of the previous probe request message is sent to the target interface again; or, if a probe response message is received corresponding to the probe request message, a probe request message with a second TTL greater than the second TTL of the previous probe request message is sent to the target interface again. Repeat the steps of sending a probe request message with a second TTL less than the second TTL of the previous probe request message to the target interface again if no probe response message is received, or sending a probe request message with a second TTL greater than the second TTL of the previous probe request message to the target interface again if a probe response message is received; The process continues until the number of network devices in the forwarding path used to forward the probe request message is determined. If the second TTL of the probe request message is greater than the number of devices, no probe response message corresponding to the probe request message is received. If the second TTL of the probe request message is less than the number of devices, a probe response message corresponding to the probe request message is received.

5. The branching device according to claim 4, characterized in that, The step of sending NAT keep-alive messages to the central device according to a preset period specifically includes: According to a preset period, during periods when no data packets are sent to the central device, NAT keep-alive packets are sent to the central device.

6. The branch equipment according to any one of claims 4-5, characterized in that, The machine-executable instructions also cause the processor to perform the following steps: If it is determined that there is no NAT gateway between the branch device and the public network, then no NAT keep-alive message will be sent.

7. A NAT keep-alive device, characterized in that, Applied to branch equipment, which communicates with central equipment via a public network, the device includes: The IP address receiving module is used to receive the public IP address sent by the central device after determining that there is a Network Address Translation (NAT) gateway between the branch device and the public network. The public IP address is the IP address of the target interface included in the target NAT gateway, the target interface is connected to the public network, and the target NAT gateway is the NAT gateway between the branch device and the public network that is closest to the public network. The probe message sending module is used to send a probe request message to the target interface. The probe request message includes a destination IP address, which is different from the public IP address and is in the same network segment. The number determination module is used to determine the number of network devices in the forwarding path used to forward the probe request message based on the probe results. The keep-alive message sending module is used to send NAT keep-alive messages to the central device according to a preset period. The NAT keep-alive message includes a first time-to-live (TTL), where the first TTL is the sum of the number of messages and a first value. The probe request message also includes a second TTL; The quantity determination module is specifically used for: If no probe response message is received corresponding to the probe request message, a probe request message with a second TTL less than the second TTL of the previous probe request message is sent to the target interface again; or, if a probe response message is received corresponding to the probe request message, a probe request message with a second TTL greater than the second TTL of the previous probe request message is sent to the target interface again. The steps of sending a probe request message with a second TTL less than the second TTL of the previous probe request message to the target interface again if no probe response message is received, or sending a probe request message with a second TTL greater than the second TTL of the previous probe request message to the target interface again if a probe response message is received, are repeated until the number of network devices in the forwarding path used to forward the probe request message is determined. Specifically, if the second TTL of the probe request message is greater than this number, no probe response message is received; if the second TTL of the probe request message is less than this number, a probe response message is received.

Images