SD-WAN deployment method and device, medium and equipment

Abstract

The invention relates to an SD-WAN deployment method, which comprises the following steps that: a plurality of physical network cards of a virtual network bridge receive request data, the request data are from a plurality of preset VLAN broadcast domains, and each VLAN broadcast domain comprises a preset I P network segment; the physical network cards are in one-to-one correspondence with the VLAN broadcast domains, and the physical network cards, VLANid of the VLAN broadcast domains and a preset IP network segment have a first mapping relation; the physical network card adds a VLANid attribute to the request data, packages the request data into a request data frame, and sends the request data frame to the two-layer forwarding unit; the two-layer forwarding unit receives the request data frame, depacks the request data frame into a data packet, and sends the data packet to a routing decision unit; and the routing decision unit receives the data packet, sends the data packet to the networking tunnel unit when determining that the destination address of the data packet is an external network address, and sends the data packet to the SD-WAN network through a pre-established encryption tunnel. A client network can realize SD-WAN networking under the condition that the original network topology is not changed, and a transparent deployment mode supporting VLAN division is realized.

Description

Technical Field

[0001] The present application relates to the field of SD-WAN, and in particular to a SD-WAN deployment method, device, medium and equipment. Background Art

[0002] The implementation of SD-WAN relies heavily on end-to-end tunnel technology, and its deployment is mainly based on CPE devices. CPE devices replace the enterprise's Internet gateway to achieve SD-WAN networking. In related technologies, CPE devices are based on routers. When a routing device is introduced into the customer network, the network topology will be modified and the network segments will be reallocated, resulting in the need to re-set devices with fixed IP addresses such as image printers and punch card systems, which involves a lot of work. Therefore, the existing SD-WAN networking method requires a lot of research in advance, takes a long time to deploy, is inefficient, and also brings a variety of inconveniences to customers. Summary of the invention

[0003] In order to overcome the problems existing in the related technology, the present application provides a SD-WAN deployment method, device, medium and equipment.

[0004] According to a first aspect of the present application, a SD-WAN deployment method is provided, which is applied to an SD-WAN branch networking device, wherein the SD-WAN branch networking device includes a virtual bridge, a layer 2 forwarding unit, a routing decision unit, and a networking tunnel unit, wherein the virtual bridge includes multiple physical network cards, and the SD-WAN deployment method includes:

[0005] Multiple physical network cards of the virtual network bridge receive request data, the request data comes from multiple preset VLAN broadcast domains, each of the VLAN broadcast domains includes a preset IP network segment; a first mapping relationship exists between the physical network card, the VLAN broadcast domain and the preset IP network segment;

[0006] The physical network card adds a VLAN_id identifier to the request data, encapsulates it into a request data frame, and sends it to the layer 2 forwarding unit;

[0007] The layer 2 forwarding unit receives the request data frame, removes the VLAN_id identifier of the request data frame, decapsulates the frame into a first data packet, and sends the first data packet to the routing decision unit;

[0008] The routing decision unit receives the first data packet, queries a preset forwarding strategy, and sends the first data packet to the networking tunnel unit when the five-tuple information of the first data packet satisfies the external forwarding strategy;

[0009] The networking tunnel unit receives the first data packet and sends the first data packet to the SD-WAN network through a pre-established encrypted tunnel.

[0010] In some embodiments of the present application, based on the aforementioned solution, the virtual network bridge further includes multiple virtual network cards, and there is a one-to-one corresponding second mapping relationship between the virtual network card, the VLAN broadcast domain, and the preset IP network segment. The virtual network card has the same VLAN_id attribute as the corresponding VLAN broadcast domain, and the SD-WAN deployment method further includes:

[0011] The routing decision unit determines that when the five-tuple information of the first data packet satisfies the internal forwarding policy, the first data packet is sent to the layer 2 forwarding unit;

[0012] The layer 2 forwarding unit determines the target virtual network card corresponding to the first data packet according to the second mapping relationship; and sends the first data packet to the target virtual network card;

[0013] The target virtual network card adds a VLAN_id identifier to the first data packet, converts the first data packet into a first data frame, and sends the first data frame to the physical network card corresponding to the VLAN_id according to the first mapping relationship;

[0014] The first data frame is converted into a data packet through the physical network card, and the data packet is sent to the target VLAN broadcast domain corresponding to the VLAN_id.

[0015] In some embodiments of the present application, based on the foregoing solution, the SD-WAN deployment method further includes:

[0016] The networking tunnel unit receives a second data packet through the SD-WAN network, and sends the second data packet to the routing decision unit;

[0017] The routing decision unit receives a second data packet; when the five-tuple information of the second data packet satisfies the internal forwarding strategy, the second data packet is sent to the layer 2 forwarding unit;

[0018] The layer 2 forwarding unit determines the target virtual network card corresponding to the second data packet according to the second mapping relationship; and sends the second data packet to the target virtual network card;

[0019] The target virtual network card adds a VLAN_id identifier to the second data packet, encapsulates the second data packet into a second data frame, and sends the second data frame to the physical network card corresponding to the VLAN_id according to the first mapping relationship;

[0020] The second data frame is converted into a data packet through the physical network card, and the data packet is sent to the target VLAN broadcast domain corresponding to the VLAN_id.

[0021] In some embodiments of the present application, based on the aforementioned solution, before the multiple physical network cards of the virtual bridge receive the request data, the SD-WAN deployment method further includes:

[0022] Divide the internal network address into multiple preset IP segments according to needs;

[0023] Add each preset IP network segment to a VLAN broadcast domain and set VLAN_id for each VLAN broadcast domain;

[0024] According to the number of VLAN broadcast domains, the same number of virtual network cards are set, the virtual network cards correspond to the VLAN broadcast domains one by one, the VLAN_id attribute of the virtual network card is set to be the same as the VLAN_id of the corresponding VLAN broadcast domain, and a second mapping relationship between the virtual network card, the VLAN broadcast domain, and the preset IP network segment is established;

[0025] A virtual network bridge is created, the multiple physical network cards are added to the virtual network bridge, and a first mapping relationship among the physical network cards, the VLAN broadcast domain, and the preset IP network segment is established.

[0026] According to another aspect of the present application, there is provided an SD-WAN deployment device, which is applied to an SD-WAN branch networking device, and the SD-WAN deployment device includes a virtual bridge, a layer 2 forwarding unit, a routing decision unit, and a networking tunnel unit;

[0027] The virtual network bridge includes multiple physical network cards, and the physical network cards are used to receive request data, the request data comes from multiple preset VLAN broadcast domains, and each of the VLAN broadcast domains includes a preset IP network segment; there is a first mapping relationship between the physical network card, the VLAN broadcast domain and the preset IP network segment; the request data is added with a VLAN_id identifier and encapsulated into a request data frame, and sent to a layer 2 forwarding unit;

[0028] The layer 2 forwarding unit is used to receive the request data frame, remove the VLAN_id identifier of the request data frame and then decapsulate it into a first data packet, and send the first data packet to the routing decision unit;

[0029] The routing decision unit is used to receive the first data packet, query the preset forwarding strategy, and send the first data packet to the networking tunnel unit when the five-tuple information of the first data packet meets the external forwarding strategy;

[0030] The networking tunnel unit is used to receive the first data packet and send the first data packet to the SD-WAN network through a pre-established encrypted tunnel.

[0031] In some embodiments of the present application, based on the aforementioned solution, the virtual network bridge further includes a plurality of virtual network cards, and there is a one-to-one corresponding second mapping relationship between the virtual network cards and the VLAN broadcast domain and the preset IP network segment, and the VLAN_id attribute of the virtual network card and the corresponding VLAN broadcast domain is the same;

[0032] The routing decision unit is further used to determine that when the five-tuple information of the first data packet satisfies the internal forwarding strategy, the first data packet is sent to the layer 2 forwarding unit;

[0033] The layer 2 forwarding unit is further configured to determine the target virtual network card corresponding to the first data packet according to the second mapping relationship; and send the first data packet to the target virtual network card;

[0034] The target virtual network card is used to add a VLAN_id identifier to the first data packet, convert the first data packet into a first data frame, and send it to the physical network card corresponding to the VLAN_id according to the first mapping relationship;

[0035] The physical network card is further configured to convert the first data frame into a data packet, and send the data packet to a target VLAN broadcast domain corresponding to the VLAN_id.

[0036] In some embodiments of the present application, based on the aforementioned solution, the networking tunnel unit is further used to receive a second data packet through the SD-WAN network and send the second data packet to the routing decision unit;

[0037] The routing decision unit is further configured to receive a second data packet; when the five-tuple information of the second data packet satisfies the internal forwarding strategy, send the second data packet to the layer 2 forwarding unit;

[0038] The layer 2 forwarding unit is further configured to determine the target virtual network card corresponding to the second data packet according to the second mapping relationship; and send the second data packet to the target virtual network card;

[0039] The target virtual network card adds a VLAN_id identifier to the second data packet, encapsulates the second data packet into a second data frame, and sends the second data frame to the physical network card corresponding to the VLAN_id according to the first mapping relationship;

[0040] The second data frame is converted into a data packet through the physical network card, and the data packet is sent to the target VLAN broadcast domain corresponding to the VLAN_id.

[0041] In some embodiments of the present application, based on the foregoing solution, the SD-WAN deployment device further includes a controller, and the controller is used to:

[0042] Divide the internal network address into multiple preset IP segments according to needs;

[0043] Add each preset IP network segment to a VLAN broadcast domain and set VLAN_id for each VLAN broadcast domain;

[0044] According to the number of VLAN broadcast domains, the same number of virtual network cards are set, the virtual network cards correspond to the VLAN broadcast domains one by one, and the VLAN_id attribute of the virtual network card is set to be the same as the VLAN_id of the corresponding VLAN broadcast domain;

[0045] Establishing a second mapping relationship of one-to-one correspondence between the virtual network card, the VLAN broadcast domain, and the preset IP network segment;

[0046] A virtual network bridge is created, the multiple physical network cards are added to the virtual network bridge, and a first mapping relationship among the physical network cards, the VLAN broadcast domain, and the preset IP network segment is established.

[0047] According to another aspect of the present application, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed, the steps of the SD-WAN deployment method are implemented.

[0048] According to another aspect of the present application, a computer device is provided, comprising a processor, a memory and a computer program stored on the memory, wherein the processor implements the steps of the SD-WAN deployment method when executing the computer program.

[0049] This application creates a virtual bridge in the SD-WAN branch networking device, creates multiple virtual network cards in the virtual bridge, and adds a broadcast domain based on an IP segment in the intranet, sets VLAN_id for each broadcast domain, and establishes a mapping relationship between the virtual network card and the broadcast domain. A physical network card is added to the virtual bridge, and the VLAN_id attribute is configured for the physical network card to establish a mapping relationship between the physical network card and the broadcast domain; based on the established mapping relationship, the data frame of the corresponding VLAN broadcast domain is received through the physical network card. After establishing a tunnel and connecting it to the SD-WAN network, the data frames accessing other branches are unpacked into data packets and sent to the SD-WAN network through the tunnel to realize SD-WAN networking. The branch networking device can perform SD-WAN networking and realize the function of CPE. At the same time, the branch networking device replaces the original Internet gateway in the form of a switch and is embedded in the customer network. The client network can maintain the original segment division and realize SD-WAN networking without changing the original network topology, realizing a transparent deployment method that supports VLAN division. Devices with fixed IP addresses, such as printers and time clock systems, do not need to be reconfigured, which simplifies SD-WAN deployment and facilitates customers.

[0050] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] The drawings constituting a part of the present application are used to provide a further understanding of the present application. The illustrative embodiments and descriptions of the present application are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0052] Figure 1 It is a flowchart of a SD-WAN deployment method according to an exemplary embodiment.

[0053] Figure 2 It is a block diagram of an SD-WAN deployment device according to an exemplary embodiment.

[0054] Figure 3 is a block diagram of a computer device for SD-WAN deployment according to an exemplary embodiment. DETAILED DESCRIPTION

[0055] In order to make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application. It should be noted that, in the absence of conflict, the embodiments in the present application and the features in the embodiments can be combined with each other arbitrarily.

[0056] In order to connect the existing enterprise network to the SD-WAN network, it is necessary to deploy CPE devices in the enterprise network to replace the original Internet gateway of the enterprise. Since the CPE device is based on the router, when a routing device is introduced into the enterprise network, the network topology will be modified and the network segment will be reallocated, resulting in the need to re-set devices with fixed IP addresses such as printers and punch-in systems, which involves a lot of work. A lot of research is required, the deployment time is long, the efficiency is low, and it also brings many inconveniences to customers.

[0057] In order to connect the enterprise network to the SD-WAN network without modifying the original network topology of the enterprise network and to enable various devices to maintain their original IP addresses, the present application provides an SD-WAN deployment method.

[0058] The SD-WAN deployment method provided in this application is applied to SD-WAN branch networking equipment. The SD-WAN branch networking equipment includes a virtual bridge, a layer 2 forwarding unit, a routing decision unit, and a networking tunnel unit, and the virtual bridge includes multiple physical network cards.

[0059] Figure 1 FIG. 1 is a flow chart of a method for deploying an SD-WAN according to an exemplary embodiment. Figure 1 The SD-WAN deployment method includes at least steps S11 to S15.

[0060] Step S11: multiple physical network cards of the virtual bridge receive request data, the request data comes from multiple preset VLAN broadcast domains, each VLAN broadcast domain includes a preset IP network segment; a first mapping relationship exists between the physical network card, the VLAN broadcast domain and the preset IP network segment.

[0061] The mapping relationship between the physical network card and the VLAN broadcast domain can be one-to-one or one-to-many. The number of physical network cards can be set according to actual needs. Each VLAN broadcast domain includes a preset IP network segment. A device in a preset IP network segment is connected to the corresponding physical network card and receives or sends data through the corresponding physical network card. There is a first mapping relationship between the physical network card, the VLAN broadcast domain, and the preset IP network segment. The first mapping relationship is established in advance according to network planning. Set the allowed list of the physical network card, and the allowed list includes the VLAN_id of the corresponding VLAN broadcast domain.

[0062] A plurality of physical network cards constitute a part of a virtual network bridge. The virtual network bridge receives request data through the plurality of physical network cards. The request data comes from a plurality of preset VLAN broadcast domains.

[0063] Step S12: The physical network card adds a VLAN_id identifier to the request data, encapsulates it into a request data frame, and sends it to the layer 2 forwarding unit.

[0064] When a device in each preset network segment needs to send data, it will be sent to the corresponding physical network card through the currently connected network. In order to distinguish data from different VLAN broadcast domains, the data transmitted in the Layer 2 network needs to carry the VLAN_id identifier corresponding to the corresponding VLAN broadcast domain. At this time, the physical network card can add its own configured VLAN_id attribute to the request data. The VLAN_id attribute of the physical network card can be the same as the VLAN_id identifier of any corresponding VLAN broadcast domain. The data frame encapsulated with the VLAN_id identifier is sent to the Layer 2 forwarding unit.

[0065] Step S13: The layer 2 forwarding unit receives the request data frame, removes the VLAN_id attribute of the request data frame, decapsulates the frame into a first data packet, and sends the first data packet to the routing decision unit.

[0066] To transmit data above the third layer of the network, the second layer forwarding unit needs to decapsulate the request data frame into the first data packet, remove the VLAN_id identifier of the data frame, and decapsulate the data frame into the first data packet. After the first data packet is sent to the routing decision unit, the routing decision unit can determine whether the first data packet meets the forwarding strategy based on the five-tuple information of the first data packet.

[0067] In step S14, the routing decision unit receives the first data packet and queries the preset forwarding strategy. When the five-tuple information of the first data packet meets the external forwarding strategy, the first data packet is sent to the networking tunnel unit, and the first data packet is sent to the SD-WAN network through the pre-established encrypted tunnel.

[0068] A forwarding strategy is preset in the routing decision unit, and the forwarding strategy identifies whether different destination addresses and destination ports correspond to an internal forwarding strategy or an external forwarding strategy. If the five-tuple information satisfies the external forwarding strategy, the data packet is sent to the networking tunnel unit, which forwards it to the external network; if the five-tuple information satisfies the internal forwarding strategy, the data packet is sent to the Layer 2 forwarding unit, which forwards it to the internal network.

[0069] A first data packet is received, where the source of the first data packet is the internal network, and the destination address may be an external network address or an internal website address.

[0070] The routing decision unit reads the five-tuple information of the first data packet, and when the five-tuple information satisfies the external forwarding strategy, sends the first data packet to the networking tunnel unit.

[0071] The networking tunnel unit receives the first data packet and sends the first data packet to the SD-WAN network through a pre-established encrypted tunnel.

[0072] Through the above description, the SD-WAN branch networking device provided by this application, the virtual bridge and the layer 2 forwarding unit perform the function of the switch, and the routing decision unit and the networking tunnel unit perform the function of the CPE. When an enterprise needs to connect to the SD-WAN network, the SD-WAN networking device provided by this application is used to replace the enterprise's original Internet gateway. For the internal network, it is equivalent to introducing a switch. There is no need to modify the original network topology, and the original IP network segment can be maintained, so that devices in different network segments can connect to the network without changing their own IP addresses and provide network services. For example, devices with fixed IP addresses (printers, punch-in systems) can continue to provide services. At the same time, through the SD-WAN branch networking device, the data of other branches accessed by the intranet can be sent to the SD-WAN network through an encrypted tunnel to realize the networking of each branch. It avoids the problems of the existing SD-WAN networking method, which requires a lot of research in advance, long deployment time and low efficiency.

[0073] In an exemplary embodiment, the virtual network bridge further includes a plurality of virtual network cards, and a one-to-one corresponding second mapping relationship exists between the virtual network card, the VLAN broadcast domain, and the preset IP network segment. The VLAN_id attribute of the virtual network card and the corresponding VLAN broadcast domain is the same, and the SD-WAN deployment method further includes:

[0074] The routing decision unit determines that when the five-tuple information of the first data packet satisfies the internal forwarding policy, the first data packet is sent to the layer 2 forwarding unit;

[0075] The layer 2 forwarding unit determines the target virtual network card corresponding to the first data packet according to the second mapping relationship; and sends the first data packet to the target virtual network card;

[0076] The target virtual network card adds a VLAN_id identifier to the first data packet, converts the first data packet into a first data frame, and sends the first data frame to the corresponding physical network card;

[0077] The first data frame is converted into a data packet through the physical network card, and the data packet is sent to the corresponding target VLAN broadcast domain.

[0078] The first data packet received by the routing decision unit is a data packet sent by the internal network through multiple physical network cards. When the routing decision unit determines that the five-tuple information of the first data packet meets the internal forwarding strategy, the first data packet is sent to the layer 2 forwarding unit according to the static route.

[0079] The Layer 2 forwarding unit determines the destination address of the first data packet by reading the five-tuple information of the first data packet, and determines the IP network segment corresponding to the destination address of the first data packet by querying the second mapping relationship, and determines the target virtual network card for receiving the first data packet based on the determined IP network segment.

[0080] Send the first data packet to the target virtual network card.

[0081] The target virtual network card adds a VLAN_id identifier to the data packet and converts the data packet into a data frame. According to the first mapping relationship, the physical network card corresponding to the VLAN_id is determined to send the data packet to the physical network card corresponding to the VLAN_id. Since the data frame carries the VLAN_id identifier of the virtual network card, after the physical network card receives the data frame, it reads the VLAN_id identifier carried by the data frame. If the VLAN_id is included in the allowed list configured by itself, the physical network card receives the data frame, removes the VLAN_id identifier, converts the data frame into a data packet, and sends it to the target VLAN broadcast domain corresponding to the VLAN_id to find the target device.

[0082] By setting up virtual network cards that correspond one to one with VLAN broadcast domains, the virtual bridge can realize the functions of a real switch.

[0083] In an exemplary embodiment, the networking tunnel unit receives a second data packet through the SD-WAN network and sends the second data packet to the routing decision unit.

[0084] The routing decision unit receives a second data packet from the networking tunnel unit; when the five-tuple information of the second data packet satisfies the internal forwarding strategy, the second data packet is sent to the layer 2 forwarding unit;

[0085] The layer 2 forwarding unit determines the target virtual network card corresponding to the second data packet according to the second mapping relationship; and sends the second data packet to the target virtual network card.

[0086] The target virtual network card adds the identifier of VLAN_id to the second data packet, encapsulates the second data packet into a second data frame, and sends it to the physical network card corresponding to VLAN_id according to the first mapping relationship.

[0087] The second data frame is converted into a data packet through the physical network card, and the data packet is sent to the target VLAN broadcast domain corresponding to the VLAN_id.

[0088] The second data packet can be the response information of the external network in response to the request of the internal network, or it can be the request information sent by the external network through the SD-WAN. When it is determined that the five-tuple information of the second data packet meets the internal forwarding strategy, the second data packet is sent to the layer 2 forwarding unit; if the five-tuple information of the second data packet does not meet the internal forwarding strategy, the data packet is directly discarded.

[0089] The process of the layer 2 forwarding unit processing the second data packet is completely consistent with the process of processing the first data packet, which will not be repeated here.

[0090] In an exemplary embodiment, before the multiple physical network cards of the virtual bridge receive the request data, the SD-WAN deployment method further includes:

[0091] Divide the internal network address into multiple preset IP segments according to needs;

[0092] Add each preset IP network segment to a VLAN broadcast domain and set VLAN_id for each VLAN broadcast domain;

[0093] According to the number of VLAN broadcast domains, set the same number of virtual network cards, the virtual network cards correspond to the VLAN broadcast domains one by one, and set the VLAN_id attribute of the physical network card to be the same as the VLAN_id of the corresponding VLAN broadcast domain;

[0094] Create a virtual network bridge, add multiple physical network cards to the virtual network bridge, and establish a first mapping relationship between the physical network card, the VLAN broadcast domain, and the preset IP network segment.

[0095] Before using SD-WAN branch networking equipment for networking, divide the internal network address into multiple preset IP segments according to actual needs. If different IP segments have been planned for the internal network, the existing IP segment division can be retained so that the devices in each IP segment can still connect to the network without changing the IP address, and the SD-WAN branch networking can be completed without the users of each IP segment being aware of it. The original internal network can also be re-planned and the network segments re-divided to achieve a certain purpose.

[0096] For example, in an enterprise's internal LAN, you can use subnet division to divide the devices of different departments or floors into different network segments to achieve network isolation and resource management. For example, you can divide the devices of the finance department into one network segment, the devices of the sales department into another network segment, and the devices of the production department into other network segments to improve network security and management efficiency. Assume that the original enterprise network includes 3 network segments, network segment 1: 192.168.1.0 / 24, network segment 2: 192.168.2.0 / 24, network segment 3: 192.168.3.0 / 24.

[0097] Add each preset IP network segment to a VLAN broadcast domain, and set VLAN_ID for each VLAN broadcast domain. Set VLAN_id to id1 for the VLAN broadcast domain of network segment 192.168.1.0 / 24; set VLAN_id to id2 for the VLAN broadcast domain of network segment 192.168.2.0 / 24; set VLAN_id to id3 for the VLAN broadcast domain of network segment 192.168.3.0 / 24;

[0098] According to the number of VLAN broadcast domains, set the same number of virtual network cards; establish a second mapping relationship between virtual network cards, VLAN broadcast domains, and preset IP network segments. Make the virtual network cards correspond to the VLAN broadcast domains one by one, that is, the virtual network cards correspond to the preset IP network segments one by one. Set the VLAN_id attribute of the virtual network card to be the same as the VLAN_id of the corresponding VLAN broadcast domain. For example, virtual network card 1 corresponds to network segment 1, and the VLAN_id attribute of virtual network card 1 is set to id1. Virtual network card 2 corresponds to network segment 2, and the VLAN_id attribute of virtual network card 2 is set to id2. Virtual network card 3 corresponds to network segment 3, and the VLAN_id attribute of virtual network card 3 is set to id3.

[0099] Create a virtual bridge for the CPE device, and add multiple physical network cards and virtual network cards to the virtual bridge. You can use OpenvSwitch (open virtual switching standard) technology to create a virtual bridge and add multiple physical network cards to the virtual bridge. OpenvSwitch technology logically combines the added physical network cards into a switch. Establish a first mapping relationship between the physical network card, VLAN broadcast domain, and preset IP network segment. According to the first mapping relationship, set the physical network card, such as setting physical network card 1 to connect to network segment 1 and network segment 2, and the VLAN_id attribute is id1. Add VLAN identifiers id1 and id2 to the allowed list so that network card 1 can receive data frames with VLAN identifiers id1 and id2;

[0100] Set physical network card 2 to connect to network segment 3, set the VLAN_id attribute to id2, and add VLAN ID id3 to the allowed list so that physical network card 2 can receive data frames with VLAN ID id3.

[0101] Different traffic frames can be filtered according to the allowed list set by the physical network card, so that multiple physical network cards in the virtual bridge can be used to receive data frames from different broadcast domains.

[0102] According to the first mapping relationship, each physical network card only receives data requests from the corresponding IP network segment; the physical network card is configured with an allowed list so that the physical network card only receives data frames with the same VLAN_id identifier as that added to the allowed list. The first mapping relationship can be sent to the layer 2 forwarding unit so that the layer 2 forwarding unit determines which physical network card the data packet or data frame comes from according to the first mapping relationship, thereby achieving data isolation between different IP network segments and improving management efficiency.

[0103] In order to better understand the SD-WAN deployment method provided in this application, a specific embodiment is used for illustration. Specific embodiment 1:

[0105] The original enterprise network consists of three network segments: Network Segment 1: 192.168.1.0 / 24, Network Segment 2: 192.168.2.0 / 24, and Network Segment 3: 192.168.3.0 / 24.

[0106] The address of the printing device is 192.168.1.1.

[0107] In order to realize SD-WAN networking without changing the original network topology, each preset IP network segment is added to a VLAN broadcast domain, and VLAN_ID is set for each VLAN broadcast domain. For the VLAN broadcast domain of network segment 192.168.1.0 / 24, VLAN_id is set to id1; for the VLAN broadcast domain of network segment 192.168.2.0 / 24, VLAN_id is set to id2; for the VLAN broadcast domain of network segment 192.168.3.0 / 24, VLAN_id is set to id3;

[0108] Set up three virtual network cards and establish a second mapping relationship among the virtual network card, VLAN broadcast domain, and preset IP network segment, as shown in Table 1.

[0109] Table 1:

[0110]

[0111] In Table 1, the virtual network cards and VLAN broadcast domains correspond one to one, and the VLAN broadcast domains and the preset IP network segments correspond one to one.

[0112] Create a virtual bridge, add 3 virtual network cards and 2 physical network cards to the virtual bridge, and establish the first mapping relationship between physical network card, VLAN broadcast domain, and preset IP network segment, as shown in Table 2.

[0113] Table 2:

[0114]

[0115] In Table 2, network segments 1 and 2 are connected to physical network card 1, and network segment 3 is connected to physical network card 2. The VLAN_id attribute of physical network card 1 is id1, and VLAN identifiers id1 and id2 are added to the allowed list, so that network card 1 receives data frames with VLAN identifiers id1 and id2; the VLAN_id attribute of physical network card 2 is id2, and VLAN identifier id3 is added to the allowed list, so that physical network card 2 can receive data frames with VLAN identifier id3.

[0116] When a user in network segment 3 needs to access a branch office, he sends request data, which is sent to physical network card 2. Physical network card 2 receives the request data in network segment 3 without carrying a VLAN ID. Physical network card 2 adds a VLAN_id ID (id3) to the request data, encapsulates it into a request data frame, and sends it to the Layer 2 forwarding unit.

[0117] The layer 2 forwarding unit receives the request frame, removes the VLAN_id identifier of the request frame, decapsulates the frame into a first data packet, and sends the first data packet to the routing decision unit.

[0118] The routing decision unit obtains the five-tuple information of the first data packet and queries the preset forwarding strategy. When the five-tuple information of the first data packet satisfies the external forwarding strategy, the first data packet is sent to the networking tunnel unit. The networking tunnel unit sends the first data packet to the SD-WAN network through a pre-established encrypted tunnel.

[0119] When a user in network segment 3 needs to access an intranet device, such as using an existing printing device, the data request is also sent to the routing decision unit in the form of a first data packet through physical network card 2. When the routing decision unit determines that the five-tuple information of the first data packet meets the internal forwarding policy, assuming that the address of the printing device is 192.168.1.11 and the destination address of the data packet belongs to network segment 1, the routing decision unit sends the first data packet to the layer 2 forwarding unit.

[0120] The layer 2 forwarding unit determines the target address according to the five-tuple information of the first data packet, and queries table 1 to determine that network segment 1 corresponds to virtual network card 1. The first data packet is sent to virtual network card 1.

[0121] Virtual NIC 1 adds VLAN_id identifier id1 to the first data packet according to its own VLAN_id attribute and encapsulates it into a first data frame. Virtual NIC 1 queries Table 2 to determine that VLAN_id identifier id1 of the first data frame corresponds to physical NIC 1. Virtual NIC 1 sends the first data frame to physical NIC 1.

[0122] After receiving the first data frame, physical network card 1 obtains the VLAN_id identifier id1 carried in the first data frame, and the physical network card 1's allowed list includes id1 and id2, allowing the data with VLAN_id identifier id1 to pass. The first data frame is converted into a data packet, and the data packet is sent to the target VLAN broadcast domain corresponding to the VLAN_id.

[0123] According to the above embodiments, the SD-WAN deployment method provided by the present application can realize SD-WAN networking without changing the topology of the original enterprise internal network. Users of the enterprise internal network can access external networks or branches through the SD-WAN network, and can also use various fixed IP devices as before. Before and after networking, devices with fixed IP addresses do not need to be reset, which simplifies the deployment of SD-WAN and facilitates customers.

[0124] Figure 2 FIG. 1 is a block diagram of an SD-WAN deployment device according to an exemplary embodiment. Figure 2 , SD-WAN deployment device, applied to SD-WAN branch networking equipment, the SD-WAN deployment device includes a virtual bridge, a layer 2 forwarding unit, a routing decision unit, and a networking tunnel unit.

[0125] The virtual bridge includes multiple physical network cards, which are used to receive request data. The request data comes from multiple preset VLAN broadcast domains, each VLAN broadcast domain includes a preset IP network segment; a first mapping relationship exists between the physical network card, the VLAN broadcast domain and the preset IP network segment; the request data is encapsulated into a request data frame by adding a VLAN_id identifier, and sent to a layer 2 forwarding unit.

[0126] The layer 2 forwarding unit is configured to receive a request data frame, remove the VLAN_id identifier of the request data frame, decapsulate the frame into a first data packet, and send the first data packet to the routing decision unit.

[0127] The routing decision unit is configured to receive a first data packet, query a preset forwarding strategy, and send the first data packet to the networking tunnel unit when the five-tuple information of the first data packet meets the external forwarding strategy.

[0128] The networking tunnel unit is configured to receive a first data packet and send the first data packet to the SD-WAN network through a pre-established encrypted tunnel.

[0129] In an exemplary embodiment, the virtual network bridge further includes multiple virtual network cards, and there is a one-to-one second mapping relationship between the virtual network cards and the VLAN broadcast domain and the preset IP network segment. The VLAN_id attribute of the virtual network card and the corresponding VLAN broadcast domain is the same.

[0130] The routing decision unit is further configured to determine that when the five-tuple information of the first data packet satisfies the internal forwarding policy, the first data packet is sent to the layer-2 forwarding unit.

[0131] The layer 2 forwarding unit is further configured to determine a target virtual network card corresponding to the first data packet according to the second mapping relationship; and send the first data packet to the target virtual network card.

[0132] The target virtual network card is further configured to add a VLAN_id identifier to the first data packet, convert the first data packet into a first data frame, and send the first data frame to the physical network card corresponding to the VLAN_id according to the first mapping relationship;

[0133] The physical network card is further configured to convert the first data frame into a data packet, and send the data packet to a target VLAN broadcast domain corresponding to the VLAN_id.

[0134] In an exemplary embodiment,

[0135] The networking tunnel unit is also configured to receive a second data packet through the SD-WAN network and send the second data packet to the routing decision unit.

[0136] The routing decision unit is further configured to receive a second data packet from the networking tunnel unit; when the five-tuple information of the second data packet satisfies the internal forwarding strategy, send the second data packet to the layer 2 forwarding unit.

[0137] The layer 2 forwarding unit is further configured to determine a target virtual network card corresponding to the second data packet according to the second mapping relationship; and send the second data packet to the target virtual network card.

[0138] The target virtual network card adds the identifier of VLAN_id to the second data packet, encapsulates the second data packet into a second data frame, and sends it to the physical network card corresponding to VLAN_id according to the first mapping relationship.

[0139] The second data frame is converted into a data packet through the physical network card, and the data packet is sent to the target VLAN broadcast domain corresponding to the VLAN_id.

[0140] In an exemplary embodiment, the SD-WAN deployment device further includes a controller, which is configured to: divide the internal network address into a plurality of preset IP network segments according to demand;

[0141] Add each preset IP network segment to a VLAN broadcast domain and set VLAN_id for each VLAN broadcast domain;

[0142] According to the number of VLAN broadcast domains, set the same number of virtual network cards, the virtual network cards correspond to the VLAN broadcast domains one by one, and set the VLAN_id attribute of the virtual network card to be the same as the VLAN_id of the corresponding VLAN broadcast domain.

[0143] A second mapping relationship among the virtual network card, the VLAN broadcast domain, and the preset IP network segment is established in a one-to-one correspondence.

[0144] Create a virtual network bridge, add multiple physical network cards to the virtual network bridge, and establish a first mapping relationship between the physical network card, the VLAN broadcast domain, and the preset IP network segment.

[0145] In an exemplary embodiment, the controller is further used to configure a second mapping relationship between the physical network card and the virtual network card; and to issue forwarding rules to the layer 2 forwarding unit and the routing decision unit.

[0146] Figure 3 is a block diagram of a computer device 300 for a SD-WAN deployment method according to an exemplary embodiment. Figure 3 The computer device 300 includes a processor 301, and the number of processors can be set to one or more as needed. The computer device 300 also includes a memory 302 for storing instructions executable by the processor 301, such as applications. The number of memories can be set to one or more as needed. The application stored therein can be one or more. The processor 301 is configured to execute instructions to execute the above-mentioned SD-WAN deployment method.

[0147] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, devices (equipment), or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media containing computer-usable program codes. Computer storage media include volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules or other data), including but not limited to RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disk (DVD) or other optical disk storage, magnetic cassette, magnetic tape, disk storage or other magnetic storage device, or any other medium that can be used to store desired information and can be accessed by a computer, etc. In addition, it is well known to those of ordinary skill in the art that communication media generally include computer-readable instructions, data structures, program modules or other data in modulated data signals such as carrier waves or other transmission mechanisms, and may include any information delivery medium.

[0148] The present application is described with reference to the flowcharts and / or block diagrams of the methods, apparatuses (devices) and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0149] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 Functions specified in one or more boxes

[0150] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0151] In this application, the terms "comprises", "comprising" or any other variations thereof are intended to cover non-exclusive inclusion, so that an article or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such article or device. In the absence of more restrictions, the elements defined by the sentence "comprising..." do not exclude the presence of other identical elements in the article or device comprising the elements.

[0152] Although the preferred embodiments of the present application have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0153] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the intention of the present application also includes these modifications and variations.

Claims

1. A SD-WAN deployment method, applied to SD-WAN branch networking equipment, characterized in that: The SD-WAN branch networking device includes a virtual bridge, a layer 2 forwarding unit, a routing decision unit, and a networking tunnel unit. The virtual bridge includes multiple physical network cards. The SD-WAN deployment method includes: Multiple physical network cards of the virtual network bridge receive request data, the request data comes from multiple preset VLAN broadcast domains, each of the VLAN broadcast domains includes a preset IP network segment; a first mapping relationship exists between the physical network card, the VLAN broadcast domain and the preset IP network segment; The physical network card adds a VLAN_id identifier to the request data, encapsulates it into a request data frame, and sends it to the layer 2 forwarding unit; The layer 2 forwarding unit receives the request data frame, removes the VLAN_id identifier of the request data frame, decapsulates the frame into a first data packet, and sends the first data packet to the routing decision unit; The routing decision unit receives the first data packet, queries a preset forwarding strategy, and sends the first data packet to the networking tunnel unit when the five-tuple information of the first data packet satisfies the external forwarding strategy; The networking tunnel unit receives the first data packet and sends the first data packet to the SD-WAN network through a pre-established encrypted tunnel.

2. The SD-WAN deployment method according to claim 1, characterized in that: The virtual network bridge further includes a plurality of virtual network cards, and a second mapping relationship exists between the virtual network cards, the VLAN broadcast domain, and the preset IP network segment in a one-to-one correspondence. The virtual network card has the same VLAN_id attribute as the corresponding VLAN broadcast domain. The SD-WAN deployment method further includes: The routing decision unit determines that when the five-tuple information of the first data packet satisfies the internal forwarding policy, the first data packet is sent to the layer 2 forwarding unit; The layer 2 forwarding unit determines the target virtual network card corresponding to the first data packet according to the second mapping relationship; and sends the first data packet to the target virtual network card; The target virtual network card adds a VLAN_id identifier to the first data packet, converts the first data packet into a first data frame, and sends the first data frame to the physical network card corresponding to the VLAN_id according to the first mapping relationship; The first data frame is converted into a data packet through the physical network card, and the data packet is sent to the target VLAN broadcast domain corresponding to the VLAN_id.

3. The SD-WAN deployment method according to claim 2, characterized in that: SD-WAN deployment methods also include: The networking tunnel unit receives a second data packet through the SD-WAN network, and sends the second data packet to the routing decision unit; The routing decision unit receives a second data packet; when the five-tuple information of the second data packet satisfies the internal forwarding strategy, the second data packet is sent to the layer 2 forwarding unit; The layer 2 forwarding unit determines the target virtual network card corresponding to the second data packet according to the second mapping relationship; and sends the second data packet to the target virtual network card; The target virtual network card adds a VLAN_id identifier to the second data packet, encapsulates the second data packet into a second data frame, and sends the second data frame to the physical network card corresponding to the VLAN_id according to the first mapping relationship; The second data frame is converted into a data packet through the physical network card, and the data packet is sent to the target VLAN broadcast domain corresponding to the VLAN_id.

4. The SD-WAN deployment method according to claim 1, wherein: Before multiple physical network cards of the virtual bridge receive the request data, the SD-WAN deployment method also includes: Divide the internal network address into multiple preset IP segments according to needs; Add each preset IP network segment to a VLAN broadcast domain and set VLAN_id for each VLAN broadcast domain; According to the number of VLAN broadcast domains, the same number of virtual network cards are set, the virtual network cards correspond to the VLAN broadcast domains one by one, the VLAN_id attribute of the virtual network card is set to be the same as the VLAN_id of the corresponding VLAN broadcast domain, and a second mapping relationship between the virtual network card, the VLAN broadcast domain, and the preset IP network segment is established; A virtual network bridge is created, the multiple physical network cards are added to the virtual network bridge, and a first mapping relationship among the physical network cards, the VLAN broadcast domain, and the preset IP network segment is established.

5. An SD-WAN deployment device, applied to SD-WAN branch networking equipment, characterized in that: The SD-WAN deployment device includes a virtual bridge, a layer 2 forwarding unit, a routing decision unit, and a networking tunnel unit; The virtual network bridge includes a plurality of physical network cards, and the physical network cards are used to receive request data, and the request data comes from a plurality of preset VLAN broadcast domains, and each of the VLAN broadcast domains includes a preset IP network segment; There is a first mapping relationship between the physical network card, the VLAN broadcast domain and the preset IP network segment; Add the VLAN_id identifier to the request data, encapsulate it into a request data frame, and send it to the layer 2 forwarding unit; The layer 2 forwarding unit is used to receive the request data frame, remove the VLAN_id identifier of the request data frame and then decapsulate it into a first data packet, and send the first data packet to the routing decision unit; The routing decision unit is used to receive the first data packet, query the preset forwarding strategy, and send the first data packet to the networking tunnel unit when the five-tuple information of the first data packet meets the external forwarding strategy; The networking tunnel unit is used to receive the first data packet and send the first data packet to the SD-WAN network through a pre-established encrypted tunnel.

6. The SD-WAN deployment device according to claim 5, characterized in that: The virtual network bridge further includes a plurality of virtual network cards, wherein a second mapping relationship exists between the virtual network cards and the VLAN broadcast domain and the preset IP network segment in a one-to-one correspondence, and the VLAN_id attribute of the virtual network cards and the corresponding VLAN broadcast domain is the same; The routing decision unit is further used to determine that when the five-tuple information of the first data packet satisfies the internal forwarding strategy, the first data packet is sent to the layer 2 forwarding unit; The layer 2 forwarding unit is further used to determine the target virtual network card corresponding to the first data packet according to the second mapping relationship; and send the first data packet to the target virtual network card; The target virtual network card is used to add a VLAN_id identifier to the first data packet, convert the first data packet into a first data frame, and send it to the physical network card corresponding to the VLAN_id according to the first mapping relationship; The physical network card is further configured to convert the first data frame into a data packet, and send the data packet to a target VLAN broadcast domain corresponding to the VLAN_id.

7. The SD-WAN deployment device according to claim 6, characterized in that: The networking tunnel unit is also used to receive a second data packet through the SD-WAN network and send the second data packet to the routing decision unit; The routing decision unit is further configured to receive a second data packet; when the five-tuple information of the second data packet satisfies the internal forwarding strategy, send the second data packet to the layer 2 forwarding unit; The layer 2 forwarding unit is further used to determine the target virtual network card corresponding to the second data packet according to the second mapping relationship; Sending the second data packet to the target virtual network card; The target virtual network card adds a VLAN_id identifier to the second data packet, encapsulates the second data packet into a second data frame, and sends the second data frame to the physical network card corresponding to the VLAN_id according to the first mapping relationship; The second data frame is converted into a data packet through the physical network card, and the data packet is sent to the target VLAN broadcast domain corresponding to the VLAN_id.

8. The SD-WAN deployment device according to claim 5, characterized in that: The SD-WAN deployment device also includes a controller, wherein the controller is used to: Divide the internal network address into multiple preset IP segments according to needs; Add each preset IP network segment to a VLAN broadcast domain and set VLAN_id for each VLAN broadcast domain; According to the number of VLAN broadcast domains, the same number of virtual network cards are set, the virtual network cards correspond to the VLAN broadcast domains one by one, and the VLAN_id attribute of the virtual network card is set to be the same as the VLAN_id of the corresponding VLAN broadcast domain; Establishing a second mapping relationship of one-to-one correspondence between the virtual network card, the VLAN broadcast domain, and the preset IP network segment; A virtual network bridge is created, the multiple physical network cards are added to the virtual network bridge, and a first mapping relationship among the physical network cards, the VLAN broadcast domain, and the preset IP network segment is established.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed, the steps of the method according to any one of claims 1 to 4 are implemented.

10. A computer device comprising a processor, a memory and a computer program stored in the memory, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 4 are implemented.

Images