Tenant gateway migration method and device, electronic equipment and storage medium

Abstract

The embodiment of the invention provides a tenant gateway migration method and device, electronic equipment and a storage medium, and the method comprises the steps: determining a target input port and a target output port of a host machine according to the type of a target tenant gateway in a process of migrating an initial tenant gateway to the target tenant gateway, the target ingress port is used for receiving public network data or receiving public network data forwarded by the drainage gateway, and the target egress port is used for sending the public network data or the public network data forwarded by the drainage gateway to the virtual private network gateway, obtaining configuration data associated with the virtual private network gateway, and according to the configuration data, sending the configuration data to the virtual private network gateway; and adding port configuration information corresponding to the target input port and the target output port in the virtual switch. Through the embodiment of the invention, the situation that the public network data are discarded to cause VPN service cutoff is avoided, and the stability of the VPN service is effectively improved.

Description

Technical Field

[0001] The present invention relates to the field of cloud computing, and in particular to a method and device, electronic equipment, and storage medium for tenant gateway migration. Background Art

[0002] The tenant gateway is a key component in the cloud computing environment, which is mainly responsible for forwarding the data packets sent and received by the tenants to the correct destination address. For tenant gateways with VPN (Virtual Private Network) services, in order to adapt to different business needs, it is usually necessary to migrate the tenant gateway. Migrating a tenant gateway means migrating a tenant gateway of one mode to a tenant gateway of another mode. The network topology, network configuration, and data packet flow of tenant gateways of different modes are different.

[0003] The active-standby mode refers to a tenant gateway implemented by two network elements, one as the active node responsible for sending and receiving data packets, and the other as the standby node, which communicates with the external network through the VPN gateway; the cluster mode refers to a tenant gateway implemented by at least two network elements, each of which can send and receive data packets. Due to the large number of network elements, the data packets from the external network need to pass through the diversion gateway and the speed-limiting gateway first, and then be transmitted to the tenant gateway through the VPN gateway.

[0004] In the related art, when migrating a tenant gateway between the active-standby mode and the cluster mode, it is necessary to update the configuration of forwarding external network data on the diversion gateway according to the mode of the tenant gateway after migration, and update the port configuration on the host where the VPN gateway is located to adapt to the new data packet flow. However, there may be a delay in the effectiveness of the configuration. When the data packet has reached the host of the VPN gateway, the new port configuration has not taken effect, and the data packet cannot find the destination port to be forwarded in the host, resulting in the data packet being discarded and the VPN service being interrupted. Summary of the invention

[0005] In view of the above problems, a method and device, an electronic device, and a storage medium for tenant gateway migration are proposed to overcome the above problems or at least partially solve the above problems, including:

[0006] A method for tenant gateway migration, the method comprising:

[0007] In response to a migration request of the tenant gateway, the initial tenant gateway is migrated to the target tenant gateway; wherein both the initial tenant gateway and the target tenant gateway transmit data with the public network through a virtual private network gateway, and the host machine of the virtual private network gateway is also provided with a virtual switch;

[0008] In the process of migrating the initial tenant gateway to the target tenant gateway, the target inbound port and the target outbound port of the host machine are determined according to the type of the target tenant gateway; wherein the target inbound port is used to receive public network data or public network data forwarded by the diversion gateway, and the target outbound port is used to send the public network data or the public network data forwarded by the diversion gateway to the virtual private network gateway;

[0009] obtaining configuration data associated with the virtual private network gateway;

[0010] According to the configuration data, adding port configuration information corresponding to the target ingress port and the target egress port in the virtual switch;

[0011] According to the type of the target tenant gateway and the configuration data, the configuration of the diversion gateway forwarding public network data is updated, and in the virtual switch, the port configuration information corresponding to the initial tenant gateway is updated to the port configuration information corresponding to the target tenant gateway.

[0012] Optionally, the traffic diversion gateway is also communicated with a flow limiting gateway, the flow limiting gateway is communicated with the virtual private network gateway, and the flow limiting gateway is provided with a first port for receiving data sent by the virtual private network gateway. After the port configuration information corresponding to the initial tenant gateway is updated to the port configuration information corresponding to the target tenant gateway, the method further includes:

[0013] Obtaining a physical address of a public network gateway corresponding to the virtual private network gateway, or obtaining a physical address of the first port;

[0014] Address resolution protocol information is sent to the virtual private network gateway according to the public network gateway physical address or the physical address of the first port.

[0015] Optionally, determining a target inbound port and a target outbound port of the host machine according to the type of the target tenant gateway includes:

[0016] If the target tenant gateway receives the public network data forwarded by the traffic diversion gateway through the virtual private network gateway, determine a target inbound port for receiving the public network data forwarded by the traffic diversion gateway, and a target outbound port for sending the public network data forwarded by the traffic diversion gateway to the virtual private network gateway;

[0017] If the target tenant gateway receives public network data through the virtual private network gateway, determine a target inbound port for receiving the public network data and a target outbound port for sending the public network data to the virtual private network gateway.

[0018] Optionally, the configuration data includes a public IP address corresponding to the virtual private network gateway, a port name of the target inbound port, and a port name of the target outbound port, and adding port configuration information corresponding to the target inbound port and the target outbound port in the virtual switch according to the configuration data includes:

[0019] According to the public network IP address, the port name of the target inbound port, and the port name of the target outbound port, port configuration information corresponding to the target inbound port and the target outbound port is added in the virtual switch.

[0020] Optionally, updating the configuration of the traffic diversion gateway forwarding public network data according to the type of the target tenant gateway includes:

[0021] If the initial tenant gateway receives the public network data through the virtual private network gateway, and the target tenant gateway receives the public network data forwarded by the diversion gateway through the virtual private network gateway, obtain the public network IP address corresponding to the virtual private network gateway;

[0022] According to the public IP address, update the configuration of the traffic diversion gateway for forwarding public network data.

[0023] Optionally, updating the configuration of the traffic diversion gateway forwarding public network data according to the type of the target tenant gateway further includes:

[0024] If the target tenant gateway receives public network data through the virtual private network gateway, and the initial tenant gateway receives public network data forwarded by the diversion gateway through the virtual private network gateway, the target forwarding configuration information of the public IP address corresponding to the virtual private network gateway is determined in the diversion gateway, and the target forwarding configuration information is deleted.

[0025] Optionally, the traffic diversion gateway and the rate limiting gateway are clusters consisting of multiple nodes.

[0026] A tenant gateway migration device, the device comprising:

[0027] A migration module, configured to migrate the initial tenant gateway to the target tenant gateway in response to a migration request of the tenant gateway; wherein both the initial tenant gateway and the target tenant gateway transmit data with the public network through a virtual private network gateway, and the host machine of the virtual private network gateway is also provided with a virtual switch;

[0028] A target port determination module is used to determine the target inbound port and target outbound port of the host machine according to the type of the target tenant gateway during the process of migrating the initial tenant gateway to the target tenant gateway; wherein the target inbound port is used to receive public network data or public network data forwarded by the diversion gateway, and the target outbound port is used to send the public network data or the public network data forwarded by the diversion gateway to the virtual private network gateway;

[0029] A configuration data acquisition module, used to acquire configuration data associated with the virtual private network gateway;

[0030] A port configuration information adding module, used for adding port configuration information corresponding to the target inbound port and the target outbound port in the virtual switch according to the configuration data;

[0031] A configuration update module is used to update the configuration of the diversion gateway forwarding public network data according to the type of the target tenant gateway and the configuration data, and in the virtual switch, update the port configuration information corresponding to the initial tenant gateway to the port configuration information corresponding to the target tenant gateway.

[0032] An electronic device comprises a processor, a memory and a computer program stored in the memory and capable of running on the processor, wherein the computer program implements the tenant gateway migration method as described above when executed by the processor.

[0033] A computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method for tenant gateway migration as described above is implemented.

[0034] The embodiment of the present invention has the following advantages: the embodiment of the present invention determines the target inlet port and the target outlet port of the host machine according to the type of the target tenant gateway during the process of migrating the initial tenant gateway to the target tenant gateway, wherein the target inlet port is used to receive public network data or receive public network data forwarded by the diversion gateway, and the target outlet port is used to send the public network data or the public network data forwarded by the diversion gateway to the virtual private network gateway, obtains configuration data associated with the virtual private network gateway, and according to the configuration data, adds port configuration information corresponding to the target inlet port and the target outlet port in the virtual switch, so that the public network data transmitted under the target tenant gateway can find the corresponding transmission path in the virtual switch, thereby avoiding the public network data from being discarded, causing the VPN service to be disconnected, and effectively improving the stability of the VPN service. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the technical solution of the present invention, the accompanying drawings required for use in the description of the present invention will be briefly introduced below. Obviously, the accompanying drawings in the following description are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative labor.

[0036] Figure 1 This is a network topology diagram of a tenant gateway in active / standby mode;

[0037] Figure 2 It is a network topology diagram of a tenant gateway in cluster mode;

[0038] Figure 3 It is a schematic diagram of a service interruption that occurs when a tenant gateway in an active / standby mode is migrated to a cluster mode in a related art;

[0039] Figure 4 It is a schematic diagram of a service interruption that occurs when a tenant gateway in cluster mode is migrated to an active / standby mode in a related art;

[0040] Figure 5 It is a flowchart of the steps of a tenant gateway migration method provided by one embodiment of the present invention;

[0041] Figure 6 It is a structural block diagram of a tenant gateway migration device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0042] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below in conjunction with the accompanying drawings and specific embodiments. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0043] The following is an explanation of some terms used in the embodiments of the present invention:

[0044] Tenant: An entity that rents resources from a cloud service provider to meet computing, storage, network, and other needs, such as individual users and enterprises.

[0045] VPC (Virtual Private Cloud): Virtual private cloud network is a network mode used to isolate cloud hosts of different tenants on the public cloud.

[0046] VPN (Virtual Private Network): A virtual private network that uses a specific encryption method to establish a stable tunnel between two networks to achieve secure communication between the two networks.

[0047] Tenant gateway: One of the basic network elements in a cloud computing network. It is the default gateway for tenants and is used to forward service traffic in and out of the tenant's VPC, enabling interconnection between the tenant's VPC and other networks.

[0048] VPN gateway: One of the basic network elements in a cloud computing network, it is a gateway that implements VPN functions.

[0049] Speed-limiting gateway: One of the basic network elements in a cloud computing network, connected to the tenant gateway to implement bandwidth management and traffic speed limiting for tenants.

[0050] b-leaf (Border Leaf): A network design pattern used to build high-performance, high-availability data center networks. B-leaf nodes are located at the edge of the data center and are responsible for connecting the internal network of the data center with the external network (such as the public network).

[0051] BGP (Border Gateway Protocol): A protocol used to exchange routing information on the Internet. It is responsible for transmitting routing information between different systems to ensure that data packets can reach the destination address from the source address.

[0052] Traffic diversion gateway: One of the basic network elements in a cloud computing network, connected to the b-leaf node, used to synchronize BGP routes with the b-leaf node to divert public network traffic.

[0053] OVS (OpenvSwitch): is a high-quality virtual switch that supports multi-layer data forwarding. It is mainly deployed on computer nodes to manage virtual machines on the computer nodes.

[0054] ARP (Address Resolution Protocol): A protocol used in computer networks to map network layer addresses (such as IP addresses) to data link layer addresses (such as MAC addresses).

[0055] VTEP IP (Virtual Tunnel Endpoint IP): The IP address of the virtual tunnel endpoint, used to establish a virtual network tunnel between different physical networks.

[0056] The technical problems existing in the related technologies will be introduced in detail below.

[0057] 1. Active / standby mode

[0058] When the tenant gateway is in active-standby mode, it is implemented by two network elements (a basic component in the network, such as a device or system that can independently complete a specific function in the network), one of which is the primary node and the other is the backup node, to achieve high availability in the form of active-standby. The network topology is as follows: Figure 1 .

[0059] The following will be combined Figure 1 The following describes the data flow of the tenant gateway VPN service in the active / standby mode.

[0060] like Figure 1 As shown, for the outbound data packets of the VPN service, that is, from the virtual machine of the VPC ( Figure 1 After the data packet comes out, it is sent to the tenant gateway. Since the tenant gateway is in active-standby mode, only the master node will provide the data packet forwarding service. The master node of the tenant gateway queries the corresponding forwarding route according to the destination IP of the data packet and forwards the data packet to the intranet port (eth1) on the VPN gateway.

[0061] A VPN gateway is usually implemented in the form of a virtual gateway, which means that a VPN gateway is essentially a virtual machine that exists on a physical machine (i.e., a host machine) and communicates with the outside world through the OVS of the physical machine.

[0062] There are at least two network ports on the VPN gateway, one is the intranet port (eth1), which communicates with the tenant gateway and is used to forward the intranet business traffic in the cloud environment; the other is the extranet port (eth2), which communicates with the b-leaf switch, and a VPN tunnel is established between eth2 and the client-side VPN gateway of the extranet, which is used to forward the extranet business traffic connected to the cloud environment. Since the eth2 of the VPN gateway needs to communicate with the extranet (such as the public network), there is a floating IP on eth2 that can be accessed by the extranet, which is called the VPN extranet EIP. The OVS on the host where the VPN gateway is located has at least two ports related to the extranet, one of which is the port corresponding to eth2 ( Figure 1 The port named vhuxxxxxxxx-01 in the figure) and the port connected to the B-leaf switch ( Figure 1 port named bond2.xxx in the example above).

[0063] After the VPN intranet port receives the data packet sent by the tenant gateway, it encrypts the data packet using the specified VPN security protocol and sends it out from eth2. The encrypted data packet will then reach vhuxxxxxxxx-01 of OVS, and through the flow table forwarding rules in OVS (the rules that define which port the data traffic enters and exits from), it will reach bond2.xxx of OVS. The bond2.xxx port will then send the packet to the b-leaf switch, and finally to the public network through the VPN tunnel to the VPN gateway on the client side.

[0064] At this point, the outbound traffic path of the VPN service is complete. The inbound traffic path of the VPN service is completely opposite to the outbound traffic path, which will not be described in detail here.

[0065] 2. Cluster Mode

[0066] When the tenant gateway is in cluster mode, the tenant gateway is implemented by at least two network elements. Each network element has an equal status, which can more conveniently expand the number of tenant gateway nodes horizontally to meet higher business needs. The network topology is as follows: Figure 2 .

[0067] The following will be combined Figure 2 This section describes the data flow of tenant gateway VPN services in cluster mode.

[0068] like Figure 2 As shown in the figure, for the outbound data packets of the VPN service, they are sent to the tenant gateway after coming out of the VPC virtual machine (such as VM1, VM2, etc. in the figure). Since the tenant gateway is in cluster mode, each tenant gateway node has an equal status, so the data packet may be sent to any tenant gateway node. For example, when forwarding to tenant gateway node 1, tenant gateway node 1 queries the corresponding forwarding route according to the destination IP of the data packet and forwards the data packet to the intranet port (eth1) on the VPN gateway.

[0069] In cluster mode, the VPN gateway also has an intranet port (eth1) and an extranet port (eth2). After eth1 receives the data packet from the tenant gateway, it encrypts the data packet using the specified VPN security protocol and sends it out from eth2. The encrypted data packet will then reach the vhuxxxxxxxx-01 port of OVS, and through the flow table forwarding rules in OVS, reach the vxlan1 port of OVS. A vxlan tunnel is established between vxlan1 and the speed-limiting gateway, and the encrypted data packet will pass through the vxlan tunnel to reach the speed-limiting gateway. After the speed-limiting gateway node receives the data packet sent by the VPN gateway, it forwards the data packet to the b-leaf switch, and finally sends it to the public network through the VPN tunnel to the VPN gateway on the client side.

[0070] At this point, the outbound traffic path of the VPN service is completed.

[0071] For the data packets in the VPN service inbound direction, after they arrive at the b-leaf switch from the public network through the VPN tunnel, the b-leaf switch will forward the data packets to the traffic diversion gateway. In addition, the routing data of all floating IPs in the environment are synchronized between the traffic diversion gateway and b-leaf through the bgp routing protocol, so the traffic diversion gateway can provide the floating IP diversion function. Among them, all floating IPs include VPN external network EIP.

[0072] After receiving the incoming data packet of the VPN service, the traffic-diverting gateway sends it to the speed-limiting gateway for speed-limiting processing. The speed-limiting gateway then forwards the data packet to the vxlan1 port of the host machine where the VPN gateway is located through the vxlan tunnel.

[0073] After the vxlan1 port of the host machine where the VPN gateway is located receives the above data packet, it is processed by the OVS flow table rules and sent to the vhuxxxxxxxx-01 port, and the eth2 of the VPN gateway can also receive the data packet.

[0074] The VPN gateway decrypts the data packet and sends the decrypted data packet to a tenant gateway node in the tenant gateway cluster through the eth1 port. Finally, the tenant gateway node sends the data packet to the corresponding virtual machine (for example, VM1).

[0075] At this point, the inbound traffic path of the VPN service is completed.

[0076] 3. Tenant Migration

[0077] Because the VPN gateway's external network traffic path is different in different tenant gateway modes, when migrating the tenant gateway, at least the following needs to be addressed: 1. Update the VPN external network EIP on the traffic diversion gateway; 2. Replace the VPN gateway's external network OVS flow table.

[0078] Specifically, when migrating a tenant gateway from active / standby mode to cluster mode, the following steps are included:

[0079] 1. Update VPN external network EIP on the diversion gateway: Publish the routing data of VPN external network EIP to the diversion gateway. Then b-leaf will automatically learn the routing data of VPN external network EIP through the bgp routing protocol, so that b-leaf will forward the data packets (i.e. inbound traffic) whose destination address is VPN external network EIP to the diversion gateway.

[0080] 2. Replacement of the VPN gateway's external network OVS flow table: Update the OVS flow table rules on the physical machine where the VPN gateway is located. Specifically:

[0081] Update the outbound traffic path of VPN extranet EIP from "vhuxxxxxxxx-01 in, bond2.xxx out" to "vhuxxxxxxxx-01 in, vxlan1 out";

[0082] Update the inbound traffic path of the VPN extranet EIP from "bond2.xxx in, vhuxxxxxxxx-01 out" to "vxlan1 in, vhuxxxxxxxx-01 out";

[0083] To adapt to the network topology of the tenant gateway in cluster mode after migration.

[0084] Migrating a tenant gateway from cluster mode to active / standby mode involves the following steps:

[0085] 1. Update the VPN external network EIP on the diversion gateway: cancel the publication and delete the routing data of the VPN external network EIP on the diversion gateway. Then b-leaf will automatically delete the routing data of the VPN external network EIP through the bgp routing protocol, so that b-leaf will no longer forward the data packets (i.e., inbound traffic) whose destination address is the VPN external network EIP to the diversion gateway, but directly forward them to the host where the VPN gateway is located.

[0086] 2. Replacement of the VPN gateway's external network OVS flow table: Update the OVS flow table rules on the physical machine where the VPN gateway is located. Specifically:

[0087] Update the outbound traffic path of VPN extranet EIP from "vhuxxxxxxxx-01 in, vxlan1 out" to "vhuxxxxxxxx-01 in, bond2.xxx out";

[0088] Update the inbound traffic path of the VPN extranet EIP from "vxlan1 in, vhuxxxxxxxx-01 out" to "bond2.xxx in, vhuxxxxxxxx-01 out";

[0089] To adapt the network topology of the tenant gateway in active / standby mode after migration.

[0090] IV. Technical Problems in Related Technologies

[0091] 1. When migrating the tenant gateway from active-standby mode to cluster mode, there is a time difference between the two steps of "updating the VPN external network EIP on the drainage gateway" and "replacing the VPN gateway's external network OVS flow table". If the time difference is relatively long, the inbound traffic of the VPN service will enter the drainage gateway. When it reaches the host of the VPN gateway, the OVS flow table has not been replaced yet, causing the inbound traffic data packets to be discarded, resulting in VPN service packet loss and interruption, which leads to the interruption of customer VPN service during the tenant migration process. The VPN service traffic can only be restored after the "replacement of the VPN gateway's external network OVS flow table" is completed.

[0092] Specifically, see Figure 3 , which is a network topology diagram of VPN service traffic during the process of tenant gateway migration from active-standby mode to cluster mode.

[0093] like Figure 3 As shown in the figure, the step of "updating the VPN external network EIP on the traffic diversion gateway" has been completed during the migration process, that is, the bgp route of the VPN external network EIP has been published on the traffic diversion gateway, so that the b-leaf switch will automatically learn the route of the EIP synchronously. Therefore, the data packets from the b-leaf whose destination IP is the EIP (VPN service inbound traffic) will be forwarded to the traffic diversion gateway, and then the traffic diversion gateway will forward the data packets to the rate-limiting gateway, and then the rate-limiting gateway will forward the data packets to the host where the VPN gateway is located.

[0094] The vxlan1 port on the OVS of the host where the VPN gateway is located will receive the data packet, but the flow table related to the VPN external network EIP on the OVS has not been updated at this time, so that the data packet cannot be forwarded to vhuxxxxxxxx-01, resulting in packet loss and VPN service interruption, affecting the availability of customer services.

[0095] 2. When migrating the tenant gateway from "Cluster Mode Gateway" to "Active / Standby Mode Gateway", there is a time difference between the two steps of "Updating the VPN External Network EIP on the Drain Gateway" and "Replacing the External Network OVS Flow Table of the VPN Gateway". If the time difference is relatively long, the inbound traffic of the VPN service will enter from the b-leaf and reach the host where the VPN gateway is located. Because the OVS flow table has not been replaced, the inbound traffic data packets will be discarded, resulting in VPN service packet loss and interruption, which will cause the customer's VPN service to be interrupted during the tenant's gateway migration process. The VPN service traffic can only be restored after the "Replacement of the External Network OVS Flow Table of the VPN Gateway" is completed.

[0096] For details, see Figure 4, which is a network topology diagram of VPN service traffic during the migration of the tenant gateway from the "cluster mode gateway" to the "active / standby mode gateway".

[0097] like Figure 4 As shown in the figure, the step of "updating the VPN external network EIP on the drainage gateway" has been completed during the migration process, that is, the BGP route of the VPN external network EIP has been unpublished and deleted on the drainage gateway, so the route of the EIP will be automatically deleted on the b-leaf switch. Therefore, the data packets coming from the b-leaf with the destination IP of the EIP (VPN service inbound traffic) are no longer forwarded to the drainage gateway, but are directly forwarded to the host where the VPN gateway is located.

[0098] At this time, bond2.xxx on the OVS of the host where the VPN gateway is located will receive the data packet, but the flow table related to the VPN external network EIP on the OVS has not been updated, so that the data packet cannot be forwarded to vhuxxxxxxxx-01, resulting in packet loss and VPN service interruption, affecting the availability of customer services.

[0099] 3. Regardless of whether you migrate the tenant gateway from active / standby mode to cluster mode, or from cluster mode to active / standby mode, the external EIP of the VPN gateway will change its external next hop:

[0100] In the network topology of "Tenant gateway in active / standby mode", the next hop of the VPN external EIP is the MAC address (physical address) of the external gateway on the b-leaf.

[0101] In the "tenant gateway in cluster mode" network topology, the next hop of the VPN external network EIP is the MAC address of the network port on the rate-limiting gateway that receives traffic from the VPN gateway.

[0102] Therefore, when the tenant gateway is migrated, the default gateway MAC address of the external network port in the VPN gateway needs to be changed, that is, the corresponding ARP configuration needs to be changed. The ARP configuration in the operating system has a cache validity period. If the corresponding ARP configuration in the VPN gateway is not updated in time after the migration, the outbound traffic path will be blocked, resulting in packet loss and VPN service interruption, affecting the availability of customer services. It is necessary to wait for the ARP cache in the VPN gateway to expire and re-learn ARP to restore the service.

[0103] The embodiments of the present invention are described in detail below.

[0104] Reference Figure 5 , shows a flowchart of a tenant gateway migration method provided by an embodiment of the present invention, which may specifically include the following steps:

[0105] Step 501, in response to a migration request of a tenant gateway, migrate the initial tenant gateway to the target tenant gateway; wherein both the initial tenant gateway and the target tenant gateway transmit data with the public network through a virtual private network gateway, and the host machine of the virtual private network gateway is also provided with a virtual switch;

[0106] In step 501, the initial tenant gateway is the tenant gateway to be migrated, and the target tenant gateway is the tenant gateway after migration.

[0107] Both the initial tenant gateway and the target tenant gateway have VPN services, and transmit data with the public network through a virtual private network gateway (VPN gateway). The host of the VPN gateway is also equipped with a virtual switch. The virtual switch is used to forward data packets received by the host to the VPN gateway, for example, an OSV virtual switch.

[0108] In some examples, the initial tenant gateway may be a tenant gateway in active-standby mode, and the target tenant gateway may be a tenant gateway in cluster mode; or, the initial tenant gateway may be a tenant gateway in cluster mode, and the target tenant gateway may be a tenant gateway in active-standby mode.

[0109] Step 502, in the process of migrating the initial tenant gateway to the target tenant gateway, determining the target inbound port and the target outbound port of the host machine according to the type of the target tenant gateway; wherein the target inbound port is used to receive public network data or receive public network data forwarded by the diversion gateway, and the target outbound port is used to send the public network data or the public network data forwarded by the diversion gateway to the virtual private network gateway;

[0110] In step 502, after the initial tenant gateway is migrated to the target tenant gateway, the network topology structure of different types of target tenant gateways will also change, resulting in changes in the transmission path of the public network data. Therefore, it is necessary to determine the target inbound port and the target outbound port in the host machine according to the type of the target tenant gateway, so that the public network data that reaches the host machine through different types of target tenant gateways can find the path corresponding to the migrated target tenant gateway in the host machine, and then forward the data to the VPN gateway normally.

[0111] In some embodiments of the present invention, determining the target inbound port and the target outbound port of the host machine according to the type of the target tenant gateway includes:

[0112] If the target tenant gateway receives the public network data forwarded by the traffic diversion gateway through the virtual private network gateway, determine a target inbound port for receiving the public network data forwarded by the traffic diversion gateway, and a target outbound port for sending the public network data forwarded by the traffic diversion gateway to the virtual private network gateway;

[0113] If the target tenant gateway receives public network data through the virtual private network gateway, determine a target inbound port for receiving the public network data and a target outbound port for sending the public network data to the virtual private network gateway.

[0114] In some examples, the target tenant gateway can be a tenant gateway in cluster mode. In this mode, in the inflow direction of VPN service data, the public network data is first forwarded by the diversion gateway, then reaches the host of the VPN gateway, and then is forwarded to the VPN gateway after being scheduled by the OSV flow table rules in the virtual switch in the host. Therefore, it is necessary to determine the target inlet port of the host for receiving the public network data forwarded by the diversion gateway, and the target outlet port for sending the public network data forwarded by the diversion gateway to the virtual private network gateway, so that the public network data has a clear forwarding path in the virtual switch;

[0115] The target tenant gateway can also be a tenant gateway in active / standby mode. In this mode, the host machine where the VPN gateway is located directly receives the public network data in the inflow direction of the VPN service data, and then forwards the public network data to the VPN gateway after scheduling according to the OSV flow table rules in the virtual switch in the host machine. Therefore, it is necessary to determine the target inbound port for the public network data received by the host machine, and the target outbound port for sending the public network data to the virtual private network gateway, so that the public network data has a clear forwarding path in the virtual switch.

[0116] Step 503, obtaining configuration data associated with the virtual private network gateway;

[0117] In step 503, the configuration data is associated with the virtual private network gateway, that is, network configuration data related to the VPN service, such as network configuration data of the type of IP address, physical address, port name, etc.

[0118] In some examples, configuration data associated with a virtual private network gateway may include the following:

[0119] The public IP address of the VPN gateway, recorded as VPN_EXT_EIP, which is the IP address of the external network port (such as eth2)

[0120] The physical address of the VPN gateway's external network port is recorded as VPN_EXT_MAC.

[0121] The port name of the VPN gateway's external network port on the OVS of the host machine where it is located is recorded as VPN_EXT_PORT. Since the VPN gateway is essentially a virtual machine, it is managed by a virtual switch on the host machine, and all the network ports of the virtual machines managed by the virtual switch will have a port corresponding to it. For example, the above eth1 port and eth2 port have a corresponding port on OVS, and the port name of the port corresponding to eth2 in OSV is vhuxxxxxxxx-01.

[0122] Step 504: adding port configuration information corresponding to the target inbound port and the target outbound port in the virtual switch according to the configuration data;

[0123] In step 504, specific information of the target inbound port and the target outbound port, such as the port number, port name, and the public IP address of the VPN, can be determined from the configuration data, and the port configuration information is then added based on the specific information.

[0124] When the port configuration information corresponding to the target inbound port and the target outbound port is added to the virtual switch, the public network data can have a clear forwarding path when it reaches the virtual switch under the network topology of the target tenant gateway.

[0125] In some embodiments of the present invention, the configuration data includes a public IP address corresponding to the virtual private network gateway, a port name of the target inbound port, and a port name of the target outbound port, and step 504 includes:

[0126] According to the public network IP address, the port name of the target inbound port, and the port name of the target outbound port, port configuration information corresponding to the target inbound port and the target outbound port is added in the virtual switch.

[0127] In some examples, the OSV flow table may be sent to the host machine of the VPN gateway to add port configuration information corresponding to the target inbound port and the target outbound port.

[0128] Specifically, the initial tenant gateway may be a tenant gateway in active-standby mode, and the target tenant gateway may be a tenant gateway in cluster mode; or, the initial tenant gateway may be a tenant gateway in cluster mode, and the target tenant gateway may be a tenant gateway in active-standby mode.

[0129] The network topology of the tenant gateway in active / standby mode is as follows: Figure 1 As shown in the figure, the network topology of the target tenant gateway is as follows Figure 2 shown.

[0130] In both modes of tenant gateway, there are at least two network ports on the VPN gateway, one for communicating with the tenant gateway in the cloud environment, namely the internal network port (eth1), and the other for communicating with the public network, namely the external network port (eth). The IP address on eth2 is the public network IP address, such as 100.126.16.16 (subnet mask 24 bits), which is accessible to the public network.

[0131] When the target tenant gateway is a tenant gateway in active / standby mode and the initial tenant gateway is a tenant gateway in cluster mode, such as Figure 1 As shown in the figure, the bond2.xxx port on the OSV of the target tenant gateway is the target inbound port for receiving public network data, and vhuxxxxxxxx-01 is the target outbound port for forwarding public network data to the VPN gateway. The added port configuration information, i.e. the new OSV flow table TB1, is as follows: 1.

[0133] table=20,priority=200,ip,in_port=bond2.xxx,nw_dst=100.126.16.16actions=NORMAL 2.

[0135] table=20,priority=200,arp,in_port=bond2.xxx,arp_tpa=100.126.16.16actions=NORMAL

[0136] In the OSV flow table, the items before actions are the matching conditions for the data packets. ip means that the protocol of the data packet is ip protocol; arp means that the data packet is arp protocol; in_port = bond2.xxx means that the data packet enters the host from bond2.xxx port, for example, bond2.xxx can be a specific port name such as bond2.100, bond2.200, etc. The bond2.xxx of the host is connected to the b-leaf switch. nw_dst = 100.126.16.16 means that the destination IP of the data packet is 100.126.16.16 (that is, the public IP address of the VPN gateway). arp_tpa = 100.126.16.16 means that the target IP of the ARP request is 100.126.16.16. actions = NORMAL means that the data packet is forwarded in the default mode of the switch.

[0137] In the original network topology of the initial tenant gateway (i.e., the tenant gateway in cluster mode), the data packets from the external network entering the VPN gateway come from the speed-limited gateway. After the data packets from the speed-limited gateway enter the host where the VPN gateway is located through the VXLAN tunnel, they will first reach the vxlan1 port of the host's OVS instead of the bond2.xxx port. Therefore, the data packets from the speed-limited gateway still match the original OVS flow table, and will not match the above flow table TB1, nor will they affect the traffic of the original VPN service.

[0138] In this way, by sending the above OVS flow table, if a data packet comes in from bond2.xxx and matches the above rule, OVS will forward the data packet in the default mode of the switch, and the external network port of the VPN gateway will also be able to receive the data packet.

[0139] When the target tenant gateway is a cluster mode tenant gateway and the initial tenant gateway is a primary / secondary mode tenant gateway, such as Figure 2 As shown in the figure, the vxlan1 port on the OSV of the target tenant gateway is the target inbound port. The public network data is forwarded by the diversion gateway, and then enters vxlan1 after passing through the speed-limiting gateway; the vhuxxxxxxxx-01 port on the OSV is the target outbound port. The public network data is forwarded to the VPN gateway through vhuxxxxxxxx-01. The added port configuration information, that is, the new OSV flow table TB2 is sent as follows: 1.

[0141] table=20,priority=200,ip,in_port=vxlan1,nw_dst=100.126.16.16actions=set_field:fa:00:00:00:00:01->eth_dst,output:"vhuxxxxxxxxx-01" 2.

[0143] table=20,priority=200,arp,in_port=vxlan1,nw_dst=100.126.16.16actions=set_field:fa:00:00:00:00:01->eth_dst,output:"vhuxxxxxxxxx-01"

[0144] In the OSV flow table, the items before actions are the matching conditions for data packets. ip means that the protocol of the data packet is ip protocol; arp means that the data packet is arp protocol; in_port = vxlan1 means that the data packet enters the host from the vxlan1 port (the host communicates with other network elements outside through the VXLAN tunnel, and the vxlan1 port is the port on the host for receiving data packets from the VXLAN tunnel).

[0145] nw_dst=100.126.16.16 means the destination IP of the data packet is 100.126.16.16. actions=set_field:fa:00:00:00:00:01->eth_dst,output:"vhuxxxxxxxx-01" means if there is a data packet matching the above three conditions, the destination MAC address of the data packet will be changed to fa:00:00:00:00:01 (that is, changed to VPN_EXT_MAC), and the data packet will be sent to the vhuxxxxxxxx-01 port. The vhuxxxxxxxxx-01 port corresponds to the eth2 port of the VPN gateway, so the external network port of the VPN gateway can receive this data packet.

[0146] In the network topology of the initial tenant gateway (i.e., the tenant gateway in active-standby mode), the data packets from the external network entering the VPN gateway come from the b-leaf switch. The ingress port of the data packets from the b-leaf switch on the host OVS is bond2.xxx, not vxlan1. Therefore, the data packets from the b-leaf switch still match the original OVS flow table, and will not match the above-mentioned flow table TB2, nor will they affect the traffic of the original VPN service.

[0147] In some examples, when sending flow table TB2 to the OVS of the host where the VPN gateway is located, another flow table TB3 as follows may be sent:

[0148] table=20,priority=200,arp,in_port=vhuxxxxxxxx-01,arp_op=2actions=NORMAL

[0149] In the flow table TB3, in_port=vhuxxxxxxxx-01 indicates that the matching data packet comes from the eth2 port of the VPN gateway, and arp_op=2 indicates that the matching data packet is an ARP reply packet. Using this flow table means that if an ARP reply packet coming from the eth2 port of the VPN gateway is matched, OVS will forward it in the default switch mode.

[0150] The usage scenario of this flow table is as follows: In some business scenarios, the eth2 port of the VPN gateway needs to communicate with other network element nodes in the same network segment, and the eth2 port of the VPN gateway needs to reply to them with ARP reply packets. This flow table is used to allow such packets to pass, so that the eth2 port of the VPN gateway can communicate with other network element nodes in the same network segment in normal Layer 2 protocol.

[0151] Step 505, according to the type of the target tenant gateway and the configuration data, update the configuration of the diversion gateway forwarding public network data, and in the virtual switch, update the port configuration information corresponding to the initial tenant gateway to the port configuration information corresponding to the target tenant gateway.

[0152] In step 505, in order to adapt to the network topology structure of the target tenant gateway, it is necessary to update the configuration of the diversion gateway forwarding external network data, such as setting or canceling the setting of the diversion gateway forwarding external network data. At this time, the public network data is transmitted according to the transmission path of the network topology structure of the target tenant gateway.

[0153] At this time, since the port configuration information corresponding to the target inlet port and the target outlet port has been added to the virtual switch in step 504, the public network data, whether received directly by the host machine or received after forwarding by the diversion gateway, can find the corresponding path in the virtual switch, that is, enter from the target inlet port and transfer out from the target outlet port to the virtual private network gateway without causing data loss.

[0154] Then, in the virtual switch, the port configuration information corresponding to the initial tenant gateway is updated to the port configuration information corresponding to the target tenant gateway, so that the data flow direction adapts to the network topology structure of the target tenant gateway. For example, the data flow direction in the outbound direction of the VPN service is updated from the data flow direction corresponding to the network topology structure of the initial tenant gateway to the data flow direction corresponding to the network topology structure of the target tenant gateway.

[0155] In some embodiments of the present invention, updating the configuration of the traffic diversion gateway forwarding public network data according to the type of the target tenant gateway includes:

[0156] If the initial tenant gateway receives the public network data through the virtual private network gateway, and the target tenant gateway receives the public network data forwarded by the diversion gateway through the virtual private network gateway, obtain the public network IP address corresponding to the virtual private network gateway;

[0157] According to the public IP address, update the configuration of the traffic diversion gateway for forwarding public network data.

[0158] In some examples, when the initial tenant gateway is in active-standby mode and the target tenant gateway is in cluster mode, since the cluster mode requires the diversion gateway to forward public network data, it is necessary to update the configuration of the diversion gateway forwarding public network data based on the public IP address corresponding to the virtual private network gateway so that the diversion gateway forwards data packets with the destination address being the public IP address.

[0159] Specifically, the route of the public IP address can be published on the drainage gateway. Since BGP synchronization is enabled between the drainage gateway and the b-leaf switch, after the route of the public IP address is published on the drainage gateway, the b-leaf switch will also synchronize to the route through BGP. After the b-leaf switch has a route with a public IP address, when a data packet is received on the b-leaf, and the destination IP of the data packet is a public IP address, the b-leaf switch will forward the data packet to the drainage gateway through the route. Subsequently, the drainage gateway forwards the data packet to the speed-limiting gateway, which then forwards it to the vxlan1 port of the VPN gateway through the VXLAN tunnel. That is, the inbound traffic path of the VPN service follows the new network topology.

[0160] After the new route is published on the traffic diversion gateway, the outbound traffic of the VPN gateway goes from the VPN gateway to the b-leaf node; the inbound traffic goes from the rate-limiting gateway to the VPN gateway.

[0161] At this time, since in the previous steps, new flow tables have been issued on OVS, such as the above-mentioned flow table TB2, that is, the path of public network data in the virtual switch is from the target inlet port to the target outlet port, for example, the data with the target address as the public network IP address in the above-mentioned flow table TB2 is from the vxlan1 port to the vhuxxxxxxxx-01 port. Therefore, after the target inlet port of the host machine receives the data packet of the inlet flow of the above-mentioned VPN service, it can match the above-mentioned newly added flow table, and the data packet will not be discarded. Instead, the newly added flow table rules are used to send the data packet to the external network port (such as eth2 port) of the VPN gateway through the target outlet port, thereby ensuring the continuous flow of VPN service.

[0162] In actual applications, after publishing a new route on the diversion gateway, you can add an OVS flow table related to the VPN external network port to adapt to the network topology of the target tenant gateway, and delete the OVS flow table related to the initial tenant gateway VPN external network port to update the port configuration information corresponding to the initial tenant gateway in the virtual switch to the port configuration information corresponding to the target tenant gateway.

[0163] Specifically, after publishing the new route on the traffic diversion gateway, the inbound traffic of all VPN services will follow the new network topology path, that is, from b-leaf to the traffic diversion gateway, the speed limit gateway, and then to the VPN gateway, and will no longer be forwarded directly from b-leaf to the VPN gateway. And the outbound traffic of the VPN service should also follow the new network topology path. Therefore, at this time, a new flow table for the public IP address of the VPN gateway can be issued on the host where the VPN gateway is located to adapt to the new network topology, and the original flow table for the public IP address can be deleted on the host where the VPN gateway is located. Usually, the matching items of the new and old flow tables are different and do not conflict with each other, so the new flow table can be added first and then the old flow table can be deleted to ensure that the VPN service traffic will not be interrupted. In specific practice, the flow table that adapts to the new network topology can be designed according to the business model of the specific cloud environment.

[0164] In some embodiments of the present invention, updating the configuration of the traffic diversion gateway forwarding public network data according to the type of the target tenant gateway further includes:

[0165] If the target tenant gateway receives public network data through the virtual private network gateway, and the initial tenant gateway receives public network data forwarded by the diversion gateway through the virtual private network gateway, the target forwarding configuration information of the public IP address corresponding to the virtual private network gateway is determined in the diversion gateway, and the target forwarding configuration information is deleted.

[0166] In some examples, when the initial tenant gateway is in cluster mode and the target tenant gateway is in active-standby mode, since the active-standby mode does not require the drainage gateway to forward public network data, but directly receives public network data, it is necessary to update the configuration of the drainage gateway to forward public network data based on the public IP address corresponding to the virtual private network gateway, so that the drainage gateway cancels the forwarding of data packets whose destination address is the public IP address.

[0167] Specifically, the route for the public IP address can be deleted on the drainage gateway. Since BGP synchronization is enabled between the drainage gateway and the b-leaf switch, after deleting the route for the public IP address on the drainage gateway, the b-leaf switch will also delete the route synchronously through BGP. Afterwards, when a data packet is received on the b-leaf, and the destination IP of the data packet is the public IP address of the VPN gateway, since there is no corresponding route, the b-leaf switch will use the new network topology and directly forward the data packet to the target ingress port of the host machine where the VPN gateway is located.

[0168] After deleting the route for the public IP address on the traffic diversion gateway, the outbound traffic of the VPN gateway goes from the VPN gateway to the rate-limiting gateway; the inbound traffic goes from the b-leaf node to the VPN gateway.

[0169] At this time, since a new OSV flow table (such as the above-mentioned flow table TB1) has been issued in the above steps, that is, the path of the public network data in the virtual switch is from the target inlet port to the target outlet port (for example, the data with the target address as the public network IP address in the above-mentioned flow table TB1 is from the bond2.xxx port to the vhuxxxxxxxx-01 port), after the target inlet port of the host machine receives the data packet of the inbound traffic of the above-mentioned VPN service, it can match the above-mentioned newly added flow table, and the data packet will not be discarded, but the newly added flow table rules will be used to send the data packet to the external network port (such as eth2) of the VPN gateway through the target outlet port, thereby ensuring the uninterrupted flow of VPN service.

[0170] In actual applications, after deleting the route for the public IP address on the diversion gateway, you can add an OVS flow table related to the VPN external port to adapt to the network topology of the target tenant gateway, and delete the OVS flow table related to the VPN external port of the initial tenant gateway to update the port configuration information corresponding to the initial tenant gateway in the virtual switch to the port configuration information corresponding to the target tenant gateway.

[0171] Specifically, after deleting the route for the public IP address on the traffic diversion gateway, the inbound traffic of all VPN services will follow the new network topology path, that is, it will be forwarded directly from the b-leaf to the VPN gateway, and will no longer be forwarded from the b-leaf to the traffic diversion gateway, the speed limit gateway, and then to the VPN gateway. And the outbound traffic of the VPN service should also follow the new network topology path. Therefore, at this time, a new flow table for the public IP address of the VPN gateway can be issued on the host machine where the VPN gateway is located to adapt to the new network topology, and the original flow table for the public IP address can be deleted on the host machine where the VPN gateway is located. Usually, the matching items of the new and old flow tables are different and do not conflict with each other, so the new flow table can be added first and then the old flow table can be deleted to ensure that the VPN service traffic will not be interrupted. Here, the flow table that adapts to the new network topology can be designed according to the specific business model of the cloud environment.

[0172] In some embodiments of the present invention, the traffic diversion gateway is also communicated with the current limiting gateway, the current limiting gateway is communicated with the virtual private network gateway, and the current limiting gateway is provided with a first port for receiving data sent by the virtual private network gateway. After the port configuration information corresponding to the initial tenant gateway is updated to the port configuration information corresponding to the target tenant gateway, the method further includes:

[0173] Obtaining a physical address of a public network gateway corresponding to the virtual private network gateway, or obtaining a physical address of the first port;

[0174] Address resolution protocol information is sent to the virtual private network gateway according to the public network gateway physical address or the physical address of the first port.

[0175] The first port of the current limiting gateway, denoted as SGW_MAC, is used to receive data sent by the virtual private network gateway. As an example, Figure 2 As shown in FIG. 1 , bond-LAN is the first port, and the physical address of the first port is the MAC address of bond-LAN, such as fe:00:00:00:00:02.

[0176] The physical address of the public network gateway corresponding to the virtual private network gateway is the physical address corresponding to the public network gateway IP address, recorded as VPN_EXT_EIP_GW_MAC. For example: aa:aa:aa:aa:aa:aa.

[0177] The public network gateway IP address is recorded as VPN_EXT_EIP_GW. Since the public network IP address of the VPN gateway is accessible to the public network, it must have its own public network gateway IP address to communicate with the public network, that is, it needs to communicate with the public network through the public network gateway IP address. Usually, the public network gateway IP address is an IP address in the same network segment as the public network IP address. For example, if the public network IP address is 100.126.16.16, the public network gateway IP address is 100.126.16.254 (subnet mask 24 bits).

[0178] Specifically, the physical address of the first port and the physical address of the public network gateway corresponding to the virtual private network gateway may be obtained from configuration data associated with the virtual private gateway.

[0179] In this embodiment, since the default gateway of the external network port in the VPN gateway needs to be changed when the tenant migrates, the physical address of the default gateway also needs to be changed, that is, the corresponding ARP configuration needs to be changed. However, the ARP configuration in the operating system has a cache time limit. If the corresponding ARP in the VPN gateway is not updated in time after the migration, the outbound traffic path will be blocked, resulting in packet loss and VPN service interruption, affecting the availability of customer services. Therefore, according to the physical address of the public network gateway or the physical address of the first port, the address resolution protocol information is sent to the virtual private network gateway to enable the virtual private network gateway to update the physical address of the default gateway of the external network port.

[0180] In some examples, when the initial tenant gateway is a tenant gateway in active / standby mode and the target tenant gateway is a tenant gateway in cluster mode, the default gateway of the VPN external network port is usually the public gateway IP address (VPN_EXT_EIP_GW). Before the migration, there will be an ARP entry for the public gateway IP address in the VPN gateway, for example:

[0181] 100.126.16.254aa:aa:aa:aa:aa:aa

[0182] The above ARP entries have a certain timeliness in the system. Under normal circumstances, the ARP cache in the system needs to expire before it can be re-learned and updated.

[0183] After the migration, the VPN service needs to use a new network topology. For the VPN external network port, the next hop of its outbound traffic needs to be changed from b-leaf to the rate-limited gateway. Therefore, the physical address of the next hop in the outbound direction needs to be updated from the public network gateway physical address (VPN_EXT_EIP_GW_MAC) to the physical address of the first port (SGW_MAC).

[0184] Therefore, at this time, an address resolution protocol message (ARP message) can be sent to the VPN gateway. In the ARP message, the IP address of the default gateway is the public network gateway IP address (VPN_EXT_EIP_GW), and the physical address is the physical address of the first port (SGW_MAC), so that the above ARP table entry in the VPN gateway is changed to:

[0185] 100.126.16.254fe:00:00:00:00:02

[0186] By sending the above-mentioned free ARP message to the VPN gateway, it is possible to avoid the delay in updating the old ARP entries in the VPN gateway, so that the corresponding ARP entries can be refreshed in time, thereby ensuring the normal delivery of the outbound traffic of the VPN service and ensuring the stability of the customer's VPN service.

[0187] In actual applications, the ARP message may be free information, that is, the tenant is exempted from information charges.

[0188] In some examples, when the initial tenant gateway is a cluster mode tenant gateway and the target tenant gateway is a mainboard mode tenant gateway, the default gateway of the VPN gateway's external network port is the public network gateway IP address (VPN_EXT_EIP_GW). Before the migration, there will be an ARP entry for the public network gateway IP address in the VPN gateway, for example:

[0189] 100.126.16.254fe:00:00:00:00:02

[0190] The above ARP entries have a certain timeliness in the system. Under normal circumstances, the ARP cache in the system needs to expire before it can be re-learned and updated.

[0191] After the migration, the VPN service needs to use a new network topology. For the VPN external network port, the next hop of its outbound traffic needs to be changed from the rate-limited gateway to the b-leaf switch. Therefore, the MAC address of the next hop in the outbound direction needs to be updated from the physical address of the first port (SGW_MAC) to the physical address of the public network gateway (VPN_EXT_EIP_GW).

[0192] Therefore, an address resolution protocol message (ARP message) can be sent to the VPN gateway. In the ARP message, the IP address of the default gateway is the public network gateway IP address (VPN_EXT_EIP_GW), and the physical address is the public network gateway physical address (VPN_EXT_EIP_GW_MAC), so that the above ARP entry in the VPN gateway is changed to:

[0193] 100.126.16.254aa:aa:aa:aa:aa:aa

[0194] By sending the above-mentioned free ARP message to the VPN gateway, it is possible to avoid the delay in updating the old ARP entries in the VPN gateway, so that the corresponding ARP entries can be refreshed in time, thereby ensuring the normal delivery of the outbound traffic of the VPN service and ensuring the stability of the customer's VPN service.

[0195] In actual applications, after completing the sending of address resolution protocol information to the virtual private network gateway, other steps for migrating the tenant gateway can be performed, such as updating the configuration data of other services of the tenant on the relevant network elements, such as updating the Vtep Ip address on the cloud dedicated line switch, updating the service flow table corresponding to the virtual machine in the VPC, etc., until the migration from the initial tenant gateway to the target tenant gateway is completed.

[0196] In some embodiments of the present invention, the traffic diversion gateway and the rate limiting gateway are clusters consisting of multiple nodes.

[0197] In this example, both the speed limiting gateway and the traffic diversion gateway are implemented in a cluster manner. For example, the speed limiting gateway and the traffic diversion gateway each use at least two servers to form a cluster, which improves the redundancy of the speed limiting gateway and the traffic diversion gateway, thereby improving the availability and reliability of the speed limiting gateway and the traffic diversion gateway.

[0198] The embodiment of the present invention has the following advantages: the embodiment of the present invention determines the target inlet port and the target outlet port of the host machine according to the type of the target tenant gateway during the process of migrating the initial tenant gateway to the target tenant gateway, wherein the target inlet port is used to receive public network data or receive public network data forwarded by the diversion gateway, and the target outlet port is used to send the public network data or the public network data forwarded by the diversion gateway to the virtual private network gateway, obtains configuration data associated with the virtual private network gateway, and according to the configuration data, adds port configuration information corresponding to the target inlet port and the target outlet port in the virtual switch, so that the public network data transmitted under the target tenant gateway can find the corresponding transmission path in the virtual switch, thereby avoiding the public network data from being discarded, causing the VPN service to be disconnected, and effectively improving the stability of the VPN service.

[0199] It should be noted that, for the sake of simplicity, the method embodiments are described as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present invention are not limited by the order of the actions described, because according to the embodiments of the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present invention.

[0200] Reference Figure 6 , shows a schematic diagram of the structure of a tenant gateway migration device provided by an embodiment of the present invention, which may specifically include the following modules:

[0201] Migration module 601, used to migrate the initial tenant gateway to the target tenant gateway in response to the migration request of the tenant gateway; wherein the initial tenant gateway and the target tenant gateway both transmit data with the public network through a virtual private network gateway, and the host machine of the virtual private network gateway is also provided with a virtual switch;

[0202] The target port determination module 602 is used to determine the target inbound port and the target outbound port of the host machine according to the type of the target tenant gateway during the process of migrating the initial tenant gateway to the target tenant gateway; wherein the target inbound port is used to receive public network data or receive public network data forwarded by the diversion gateway, and the target outbound port is used to send the public network data or the public network data forwarded by the diversion gateway to the virtual private network gateway;

[0203] The configuration data acquisition module 603 is used to acquire configuration data associated with the virtual private network gateway;

[0204] A port configuration information adding module 604, configured to add port configuration information corresponding to the target ingress port and the target egress port in the virtual switch according to the configuration data;

[0205] The configuration update module 605 is used to update the configuration of the diversion gateway forwarding public network data according to the type of the target tenant gateway and the configuration data, and in the virtual switch, update the port configuration information corresponding to the initial tenant gateway to the port configuration information corresponding to the target tenant gateway.

[0206] In some embodiments of the present invention, the traffic diversion gateway is also communicated with the current limiting gateway, the current limiting gateway is communicated with the virtual private network gateway, and the current limiting gateway is provided with a first port for receiving data sent by the virtual private network gateway. After the port configuration information corresponding to the initial tenant gateway is updated to the port configuration information corresponding to the target tenant gateway, the device further includes:

[0207] A physical address acquisition module, used to acquire the physical address of the public network gateway corresponding to the virtual private network gateway, or to acquire the physical address of the first port;

[0208] The address resolution protocol information sending module is used to send the address resolution protocol information to the virtual private network gateway according to the physical address of the public network gateway or the physical address of the first port.

[0209] In some embodiments of the present invention, the target port determination module 602 includes:

[0210] A first target port determination submodule is used to determine a target inbound port for receiving the public network data forwarded by the diversion gateway if the target tenant gateway receives the public network data forwarded by the diversion gateway through the virtual private network gateway, and a target outbound port for sending the public network data forwarded by the diversion gateway to the virtual private network gateway;

[0211] The second target port determination submodule is used to determine the target inbound port for receiving the public network data and the target outbound port for sending the public network data to the virtual private network gateway if the target tenant gateway receives the public network data through the virtual private network gateway.

[0212] In some embodiments of the present invention, the configuration data includes the public IP address corresponding to the virtual private network gateway, the port name of the target inbound port, and the port name of the target outbound port, and the port configuration information adding module 604 includes:

[0213] The port configuration information adding submodule is used to add port configuration information corresponding to the target inlet port and the target outlet port in the virtual switch according to the public network IP address, the port name of the target inlet port and the port name of the target outlet port.

[0214] In some embodiments of the present invention, the configuration update module 605 includes:

[0215] A first configuration update submodule, configured to obtain a public IP address corresponding to a virtual private network gateway if the initial tenant gateway receives public network data through the virtual private network gateway and the target tenant gateway receives public network data forwarded by the diversion gateway through the virtual private network gateway;

[0216] Update the configuration of the traffic gateway forwarding public network data according to the public network IP address

[0217] In some embodiments of the present invention, the configuration update module 605 further includes:

[0218] The second configuration update submodule is used to determine the target forwarding configuration information of the public IP address corresponding to the virtual private network gateway in the diversion gateway if the target tenant gateway receives public network data through the virtual private network gateway, and the initial tenant gateway receives public network data forwarded by the diversion gateway through the virtual private network gateway, and delete the target forwarding configuration information.

[0219] In some embodiments of the present invention, the traffic diversion gateway and the rate limiting gateway are clusters consisting of multiple nodes.

[0220] Some embodiments of the present invention also provide an electronic device, which may include a processor, a memory, and a computer program stored in the memory and capable of running on the processor, and when the computer program is executed by the processor, the above tenant gateway migration method is implemented.

[0221] Some embodiments of the present invention further provide a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the above tenant gateway migration method is implemented.

[0222] Some embodiments of the present invention further provide a computer program product, including a computer program, which implements the above tenant gateway migration method when executed by a processor.

[0223] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0224] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0225] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0226] Those skilled in the art will appreciate that the embodiments of the present invention may be provided as methods, devices, or computer program products. Therefore, the embodiments of the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the embodiments of the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0227] The embodiments of the present invention are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0228] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0229] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable terminal device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0230] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present invention.

[0231] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "including one..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the above elements.

[0232] The above provides a detailed introduction to the provided tenant gateway migration method and device, electronic device, and storage medium. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea; at the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A tenant gateway migration method, characterized in that: The method comprises: In response to a migration request of the tenant gateway, the initial tenant gateway is migrated to the target tenant gateway; wherein both the initial tenant gateway and the target tenant gateway transmit data with the public network through a virtual private network gateway, and the host machine of the virtual private network gateway is also provided with a virtual switch; In the process of migrating the initial tenant gateway to the target tenant gateway, the target inbound port and the target outbound port of the host machine are determined according to the type of the target tenant gateway; wherein the target inbound port is used to receive public network data or public network data forwarded by the diversion gateway, and the target outbound port is used to send the public network data or the public network data forwarded by the diversion gateway to the virtual private network gateway; obtaining configuration data associated with the virtual private network gateway; According to the configuration data, adding port configuration information corresponding to the target ingress port and the target egress port in the virtual switch; According to the type of the target tenant gateway and the configuration data, the configuration of the diversion gateway forwarding public network data is updated, and in the virtual switch, the port configuration information corresponding to the initial tenant gateway is updated to the port configuration information corresponding to the target tenant gateway.

2. The method according to claim 1, characterized in that The traffic diversion gateway is also in communication with the current limiting gateway, the current limiting gateway is in communication with the virtual private network gateway, the current limiting gateway is provided with a first port for receiving data sent by the virtual private network gateway, and after the port configuration information corresponding to the initial tenant gateway is updated to the port configuration information corresponding to the target tenant gateway, the method further includes: Obtaining a physical address of a public network gateway corresponding to the virtual private network gateway, or obtaining a physical address of the first port; Address resolution protocol information is sent to the virtual private network gateway according to the public network gateway physical address or the physical address of the first port.

3. The method according to claim 1 or 2, characterized in that: The determining, according to the type of the target tenant gateway, a target inbound port and a target outbound port of the host machine includes: If the target tenant gateway receives the public network data forwarded by the traffic diversion gateway through the virtual private network gateway, determine a target inbound port for receiving the public network data forwarded by the traffic diversion gateway, and a target outbound port for sending the public network data forwarded by the traffic diversion gateway to the virtual private network gateway; If the target tenant gateway receives public network data through the virtual private network gateway, determine a target inbound port for receiving the public network data and a target outbound port for sending the public network data to the virtual private network gateway.

4. The method according to claim 1, characterized in that The configuration data includes a public IP address corresponding to the virtual private network gateway, a port name of the target inbound port, and a port name of the target outbound port, and adding port configuration information corresponding to the target inbound port and the target outbound port in the virtual switch according to the configuration data includes: According to the public network IP address, the port name of the target inbound port, and the port name of the target outbound port, port configuration information corresponding to the target inbound port and the target outbound port is added in the virtual switch.

5. The method according to claim 1, characterized in that The updating of the configuration of the traffic diversion gateway forwarding public network data according to the type of the target tenant gateway includes: If the initial tenant gateway receives the public network data through the virtual private network gateway, and the target tenant gateway receives the public network data forwarded by the diversion gateway through the virtual private network gateway, obtain the public network IP address corresponding to the virtual private network gateway; According to the public IP address, update the configuration of the traffic diversion gateway for forwarding public network data.

6. The method according to claim 1, characterized in that The updating of the configuration of the traffic diversion gateway forwarding public network data according to the type of the target tenant gateway also includes: If the target tenant gateway receives public network data through the virtual private network gateway, and the initial tenant gateway receives public network data forwarded by the diversion gateway through the virtual private network gateway, the target forwarding configuration information of the public IP address corresponding to the virtual private network gateway is determined in the diversion gateway, and the target forwarding configuration information is deleted.

7. The method according to claim 2, characterized in that The traffic diversion gateway and the speed limiting gateway are clusters consisting of multiple nodes.

8. A tenant gateway migration device, characterized in that: The device comprises: A migration module, configured to migrate the initial tenant gateway to the target tenant gateway in response to a migration request of the tenant gateway; wherein both the initial tenant gateway and the target tenant gateway transmit data with the public network through a virtual private network gateway, and the host machine of the virtual private network gateway is also provided with a virtual switch; A target port determination module is used to determine the target inbound port and target outbound port of the host machine according to the type of the target tenant gateway during the process of migrating the initial tenant gateway to the target tenant gateway; wherein the target inbound port is used to receive public network data or public network data forwarded by the diversion gateway, and the target outbound port is used to send the public network data or the public network data forwarded by the diversion gateway to the virtual private network gateway; A configuration data acquisition module, used to acquire configuration data associated with the virtual private network gateway; A port configuration information adding module, used for adding port configuration information corresponding to the target inbound port and the target outbound port in the virtual switch according to the configuration data; A configuration update module is used to update the configuration of the diversion gateway forwarding public network data according to the type of the target tenant gateway and the configuration data, and in the virtual switch, update the port configuration information corresponding to the initial tenant gateway to the port configuration information corresponding to the target tenant gateway.

9. An electronic device, characterized in that: The method comprises a processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein when the computer program is executed by the processor, the method for tenant gateway migration as described in any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method for tenant gateway migration according to any one of claims 1 to 7 is implemented.

Images