Message transmission method, device and equipment

Abstract

The invention provides a message transmission method, device and equipment, and relates to the technical field of cloud computing, and the method comprises the steps: receiving a service message from an OVS network bridge of an IP2 in a VPC1, and judging whether a target CIDR of the service message is overlapped with a CIDR network segment of the VPC1 where a VPCGW1 is located, and the VPCGW1 is a gateway of the VPC1; comparing the outer layer destination IP address of the service message with the Vtep address of the VPCGW1 under the overlapping condition, and removing the outer layer of the service message and reading the inner layer destination IP address of the service message under the same condition; and under the condition that the inner layer destination IP address is the IP1 of the VPC2, reading an access control list corresponding to the IP1 of the VPC2, reading an ABF forwarding table item matched with the destination CIDR of the service message according to the access control list, and forwarding the service message according to the ABF forwarding table item.

Description

Technical Field

[0001] The present application relates to the field of cloud computing technology, and in particular to a message transmission method, device and equipment. Background Art

[0002] A peer connection is a network connection between two VPCs in a cloud network. Users can use private IP addresses to communicate between two VPCs, just as if the two VPCs were in the same network. Within the same resource pool, users can create peer connections between their own tenants' VPCs, or between their own tenants' VPCs and other tenants' VPCs.

[0003] Figure 1 is a schematic diagram of a VPC peer connection network shown in the related art, such as Figure 1 As shown in the figure, there are two VPCs in a cloud network area. The two VPCs are originally used for business isolation. However, if some businesses want to communicate across VPCs, they need to establish a VXLAN tunnel between the gateways of the two VPCs. This VXLAN tunnel across the VPCGW is a VPC peer connection.

[0004] Figure 2 is a business traffic architecture diagram in a peer-to-peer connection scenario in a cloud network shown in the related art, such as Figure 2 As shown in the figure, the traffic from IP1 in VPC1 to IP2 across network segments is forwarded to IP2 by gateway VPCGW. For IP1 to access IP3 in VPC2, a VPC peering connection needs to be established between VPCGW1 and VPCGW2. The traffic from IP1 reaches VPC2 through the VXLAN tunnel between them, thus achieving traffic inter-VPC access.

[0005] 1. After analyzing the peer connection technology in related technologies, it is found that the current VPC peer connection has two limitations; (1) The two VPCs that create a peering connection cannot have overlapping CIDR segments. This is because there cannot be two routes with the same destination CIDR in a VPC, so the two VPCs must have different CIDRs. This will severely limit the use scenarios of peering connection technology, because VPC is created with the background of virtual, private, independent address space, and forwarding table entries can be isolated for users. Obviously, this usage restriction of peering connection is contrary to the purpose of VPC.

[0006] (2) The VXLAN tunnel between two VPCs is a bare tunnel with no security protection mechanism. The introduction of the Information Security Protection 2.0 system indicates that network security is increasingly valued. The bare tunnel between VPCs poses a security risk, and new methods are needed to solve the security issues between VPCs.

[0007] 2. Technologies for solving this problem in related technologies: There is currently no good solution to the above two limitations of VPC peering connections.

[0008] (1) If you want to connect certain traffic between two VPCs, the network management needs to plan the network segment addresses of the two VPCs in advance and manually intervene to avoid CIDR overlap in the two VPCs.

[0009] (2) The security of data transmission between VPCs mainly depends on the credibility of the configuration given by the controller to the VPCGW. If the configuration given by the controller to the VPCGW is considered credible, the VXLAN tunnel between the VPCGWs is considered credible. There is no direct protection for the VXLAN tunnel.

[0010] 3. Problems in related technologies: (1) The network administrator needs to manually plan the CIDRs of the two VPCs to avoid duplication of the CIDRs of the two VPCs before using the VPC peering connection technology.

[0011] (2) There is no direct protection for the VXLAN tunnels between VPCs, and the VXLAN tunnels are considered secure based on the trust configured on the VPCGW. When packet capture occurs between VPCs for reverse attacks, the security risk of VXLAN tunnel traffic is very high. Summary of the invention

[0012] In view of this, the embodiments of the present application provide a message transmission method, apparatus and device to overcome the above-mentioned problems or at least partially solve the above-mentioned problems.

[0013] A first aspect of an embodiment of the present application provides a message transmission method, which is applied to VPCGW1. The method includes: Receive a service message from the OVS bridge of IP2 in VPC1, where the service message has at least an inner destination IP address and an outer destination IP address; Determine whether the destination CIDR of the service message overlaps with the CIDR network segment of VPC1 where the VPCGW1 is located, and the VPCGW1 is the gateway of VPC1; When the destination CIDR of the service message overlaps with the CIDR network segment of VPC1 where VPCGW1 is located, compare the outer destination IP address of the service message with the Vtep address of VPCGW1. When the outer destination IP address of the service message is the same as the Vtep address of VPCGW1, remove the outer layer of the service message and read the inner destination IP address of the service message. When the inner destination IP address is IP1 of VPC2, the access control list corresponding to IP1 of VPC2 is read, and the access control list indicates that IP2 is used as the source IP address and IP1 is used as the destination IP address; According to the access control list, read the ABF forwarding table entry that matches the destination CIDR of the service message, the ABF forwarding table entry indicating that the service message with the IP2 as the source IP address and the IP1 as the destination IP address is forwarded; According to the ABF forwarding entry, the service message is forwarded to the Vtep address of VPCGW2 of the VPC2, where VPCGW2 is the gateway of VPC2.

[0014] Optionally, the method further comprises: When the destination CIDR of the service message does not overlap with the CIDR network segment of VPC1 where VPCGW1 is located, read the peer connection route matching the destination CIDR of the service message; According to the peer connection routing, the service message is forwarded to the Vtep address of the VPCGW2.

[0015] Optionally, forwarding the service message to a Vtep address of VPCGW2 according to the ABF forwarding table entry or the peer connection route includes: Establish an IPsec tunnel with an underlay address between the VPCGW1 and the VPCGW2, wherein the underlay address of the VPCGW1 is IPsec-Local-IP, and the underlay address of the VPCGW2 is IPsec-Peer-IP; Read the static route of the VPCGW1 and perform IPsec encapsulation on the service message; The service message encapsulated by IPsec is sent to the Vtep address of the VPCGW2.

[0016] Optionally, the structure of the service message is a VXLAN structure; The inner source IP address of the business message is IP2, the inner destination IP address of the business message is IP1 of VPC2, the inner source Mac of the business message is the Mac of the VM of IP2, the inner destination Mac of the business message is the Mac of the VPCGW1, the outer source IP address of the business message is the Vtep address of the OVS corresponding to the VM, and the outer destination IP address of the business message is the Vtep address of the VPCGW1.

[0017] Optionally, the structure of the service message after IPsec encapsulation is a VXLAN over IPsec structure; The source IP address of the outer IPsec tunnel of the service message after IPsec encapsulation is the IPsec-Lcoal-IP of VPCGW1, and the destination IP address of the outer IPsec tunnel of the service message after IPsec encapsulation is the IPsec-Peer-IP of VPCGW2; The inner source IP address of the service message after IPsec encapsulation is IP2, the inner destination IP address of the service message after IPsec encapsulation is IP1, the inner source MAC of the service message after IPsec encapsulation is the MAC of VPCGW1, the inner destination MAC of the service message after IPsec encapsulation is the MAC of VPCGW2 of VPC2, the outer source IP address of the service message after IPsec encapsulation is the Vtep address of VPCGW2, and the outer destination IP address of the service message after IPsec encapsulation is the Vtep address of VPCGW2.

[0018] A second aspect of an embodiment of the present application provides a message transmission method, which is applied to VPCGW2. The method includes: Receive a service message from VPCGW1, where VPCGW1 is the gateway of VPC1 and VPCGW2 is the gateway of VPC2; Compare the outer destination IP address of the service message with the Vtep address of the VPCGW2. If the outer destination IP address of the service message is the same as the Vtep address of the VPCGW2, remove the outer layer of the service message and read the inner destination IP of the service message. When the inner destination IP address is IP1 of VPC2, the service message is forwarded to IP1 of VPC2.

[0019] Optionally, the method further comprises: Receive IPsec-encapsulated service packets from VPCGW1; Compare the destination IP address of the outer IPsec tunnel of the service message with the underlay address of VPCGW2. If the destination IP address of the outer IPsec tunnel of the service message is the same as the underlay address of VPCGW2, dismantle the outer IPsec tunnel of the service message after IPsec encapsulation, and read the outer destination IP address of the service message. Compare the outer destination IP address of the service message with the Vtep address of the VPCGW2. If the outer destination IP address of the service message is the same as the Vtep address of the VPCGW2, remove the outer layer of the service message and read the inner destination IP; When the inner destination IP address is IP1 of VPC2, the service message is forwarded to IP1 of VPC2.

[0020] A third aspect of an embodiment of the present application provides a message transmission device, which is applied to VPCGW1, and the device includes: A first receiving module is used to receive a service message from the OVS bridge of IP2 in VPC1, where the service message has at least an inner destination IP address and an outer destination IP address; A judgment module, used to judge whether the destination CIDR of the service message overlaps with the CIDR network segment of VPC1 where the VPCGW1 is located, and the VPCGW1 is the gateway of VPC1; A first comparison module is used to compare the outer destination IP address of the service message with the Vtep address of the VPCGW1 when the destination CIDR of the service message overlaps with the CIDR network segment of the VPC1 where the VPCGW1 is located, and to remove the outer layer of the service message and read the inner destination IP address of the service message when the outer destination IP address of the service message is the same as the Vtep address of the VPCGW1; An access control list reading module, used for reading the access control list corresponding to the IP1 of the VPC2 when the inner destination IP address is the IP1 of the VPC2; An ABF forwarding table entry reading module, configured to read an ABF forwarding table entry matching a destination CIDR of the service message according to the access control list; The first forwarding module is used to forward the service message to the Vtep address of VPCGW2 of the VPC2 according to the ABF forwarding table entry, where the VPCGW2 is the gateway of the VPC2.

[0021] A fourth aspect of the embodiment of the present application provides a message transmission device, which is applied to VPCGW2, and the device includes: A second receiving module is used to receive a service message from VPCGW1, where VPCGW1 is the gateway of VPC1 and VPCGW2 is the gateway of VPC2; A second comparison module is used to compare the outer destination IP address of the service message with the Vtep address of the VPCGW2. If the outer destination IP address of the service message is the same as the Vtep address of the VPCGW2, the outer layer of the service message is removed and the inner destination IP of the service message is read; The second forwarding module is used to forward the service message to IP1 of VPC2 when the inner destination IP address is IP1 of VPC2.

[0022] According to a fifth aspect of the embodiments of the present application, an electronic device is provided, comprising a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the method described in the first aspect or the second aspect.

[0023] In a sixth aspect of the embodiments of the present application, a computer program product is provided, including a computer program, which, when executed by a processor, implements the method described in the first aspect or the second aspect.

[0024] In a seventh aspect of the embodiments of the present application, a computer-readable storage medium is provided, on which a computer program is stored, wherein when the computer program is executed by a processor, the method described in the first aspect or the second aspect is implemented.

[0025] Beneficial effects of this application: The embodiment of the present application provides a message transmission method, apparatus and device, the method comprising: receiving a service message from an OVS bridge of IP2 in VPC1, the service message having at least an inner destination IP address and an outer destination IP address; judging whether the destination CIDR of the service message overlaps with the CIDR network segment of VPC1 where the VPCGW1 is located, the VPCGW1 being the gateway of VPC1; in the case where the destination CIDR of the service message overlaps with the CIDR network segment of VPC1 where the VPCGW1 is located, comparing the outer destination IP address of the service message with the Vtep address of the VPCGW1, and in the case where the outer destination IP address of the service message is the same as the Vtep address of the VPCGW1, Remove the outer layer of the business message and read the inner destination IP address of the business message; when the inner destination IP address is IP1 of VPC2, read the access control list corresponding to IP1 of VPC2, and the control access list indicates: use IP2 as the source IP address and IP1 as the destination IP address; according to the access control list, read the ABF forwarding table entry that matches the destination CIDR of the business message, and the ABF forwarding table entry indicates: forward the business message with IP2 as the source IP address and IP1 as the destination IP address; according to the ABF forwarding table entry, forward the business message to the Vtep address of VPCGW2 of VPC2, and VPCGW2 is the gateway of VPC2.

[0026] Through the technical solution of the present application, the access control list and ABF forwarding table entries are configured on VPCGW1. Even if the CIDR network segments of VPC1 and VPC2 overlap, it is possible to ensure that business messages are correctly transmitted across VPCs, thereby avoiding routing conflicts in the local VPC, solving the problem that the CIDRs of the two VPCs cannot conflict, reducing unnecessary network jumps, and improving the efficiency and speed of data transmission, thereby effectively solving the CIDR overlap problem in inter-VPC communications and improving the flexibility, security and performance of the network. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] The drawings constituting a part of the present application are used to provide a further understanding of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application.

[0028] In order to more clearly illustrate the technical solution of the present application, the drawings required for use in the description of the present application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0029] Figure 1 It is a schematic diagram of VPC peer connection networking shown in the related art; Figure 2 It is a business traffic architecture diagram in a peer-to-peer connection scenario in a cloud network shown in the related art; Figure 3 It is a flowchart of a message transmission method applied to VPCGW1 provided in an embodiment of the present application; Figure 4 It is a schematic diagram of an improved enhanced peer connection traffic interaction architecture provided by an embodiment of the present application; Figure 5 Schematic diagram of a service message after IPsec encapsulation shown in this application; Figure 6 is a flowchart of a message transmission method applied to VPCGW2 provided in another embodiment of the present application; Figure 7 It is a flowchart of a process of a VPCGW for peer connection services of an enhanced peer connection shown in an embodiment of the present application; Figure 8 It is a schematic diagram of a framework of a message transmission device applied to VPCGW1 provided in an embodiment of the present application; Fig. 9 It is a framework diagram of a message transmission device applied to VPCGW2 provided in one embodiment of the present application. DETAILED DESCRIPTION

[0030] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application may be combined with each other.

[0031] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0032] IP (Internet Protocol): IP refers to the Internet Protocol, the abbreviation of Internet Protocol, which is the network layer protocol in the TCP / IP system.

[0033] VPC (Virtual Private Cloud) is a logically isolated virtual network environment built for cloud resources such as cloud servers, cloud containers, and cloud databases. It is configured and managed by users. It aims to improve the security of user resources and simplify user network deployment.

[0034] VTEP (VXLAN Tunnel End Point): The starting point and end point of a VXLAN tunnel.

[0035] VXLAN (Virtual eXtensible LAN): The most important network virtualization technology in cloud computing, and an overlay technology.

[0036] SDN (Software Defined Network): The network can be defined and controlled through software programming, with the characteristics of separation of control plane and forwarding plane and open programmability.

[0037] OVS (Open Vswitch, virtual switch): is a high-quality virtual switch that supports multi-layer data forwarding. It is mainly deployed on servers. Compared with traditional switches, it has good programming scalability. At the same time, it has the network isolation and data forwarding functions implemented by traditional switches. It runs on each virtualized physical machine and provides remote management.

[0038] VPCGW (Virtual Private Cloud Gateway): In a cloud network, each VPC has its own gateway.

[0039] CIDR (Classless Inter-Domain Routing) eliminates the traditional Class A, Class B and Class C addresses and the concept of subnetting, so it can allocate IPv4 address space more efficiently. It can combine several IP networks together and use a classless inter-domain routing algorithm to merge them into one route, thereby reducing the number of routing entries in the routing table and reducing the burden on Internet routers.

[0040] IPSEC (Internet Protocol Security): provides security services for messages at the IP layer to ensure the integrity, privacy, and authenticity of IP messages.

[0041] IKE (Internet Key Exchange Protoco): key exchange protocol for IPSec; ESP (Encapsulating Security Payload): An encryption method in IPsec that provides confidentiality, data origin authentication, connectionless integrity, anti-replay service (a form of partial sequence integrity), and limited information flow confidentiality.

[0042] ACL (Access Control Lists): Access Control List (ACL) is an access control technology based on packet filtering. It can filter data packets on the interface according to the set conditions, allowing them to pass or discarding them.

[0043] ABF (ACL Based Forwarding): Policy routing in VPP takes precedence over routing.

[0044] Based on the problems existing in the related technology, this application proposes a message transmission method based on enhanced virtual private cloud peer connection (EVPC, Enhanced VPC Peer Connection), which mainly improves and enhances the VPC peer connection technology in two aspects and is defined as enhanced VPC peer connection.

[0045] In a traditional VPC peering connection, the two VPCs cannot have overlapping CIDR segments, because this will cause routing conflicts, that is, the data packets in the message will not know which VPC to send to.

[0046] Through the access control list and ABF forwarding table of this application, policy routing is implemented to divert the messages of the overlapping CIDR network segments of the peer connection, sacrificing the traffic of the local conflicting CIDR, avoiding the routing conflict of the local VPC, and solving the problem that the CIDR of the two VPCs cannot conflict. Even if the CIDR network segments of the two VPCs overlap, the policy routing can be used to correctly guide the traffic (data packets in the message), thereby avoiding routing conflicts. The main process of this process is: when there are overlapping CIDR network segments between the two VPCs, and this overlapping CIDR network segment needs to communicate with other network segments across VPCs, the local VCPGW of the source IP address of the message will issue policy routing (i.e. ABF forwarding), match this overlapping CIDR network segment through ACL (access control list), and perform ABF forwarding. Through ABF forwarding, the cross-VPC communication of overlapping CIDR is realized before querying the local route.

[0047] At the same time, the technical solution of the present application further enhances the tunnel security between VPCs in the peer-to-peer connection of the virtual private cloud, changes the VXLAN tunnel to VXLAN over IPsec, realizes the protection of the tunnel, and realizes the secure and stable transmission of business traffic between VPCs. The main process is: when the EVPC function is turned on, the VPCGWs negotiate ike and sa through the underLay address to establish an IPsec tunnel, where ESP encryption and IPsec tunnel mode are used; when the EVPC function is turned on, VCPGW sends down the diversion route to divert the VXLAN tunnel traffic to the IPsec tunnel to protect the tunnel traffic.

[0048] Through the technical solution of this application: (1) ACL-based forwarding is used to meet the requirement of forwarding to the peer VPC when the local VPC has a direct route, solving the limitation that the two VPCs establishing a peer connection cannot have overlapping CIDRs; (2) Use IPsec tunnel mode to encrypt the VXLAN tunnel between VPCs, and implement VXLAN over IPsec through static routing of VPCGW, thus ensuring the security of message transmission between VPCs; (3) An enhanced VPC peering connection solution was proposed, which optimized the CIDR overlap restrictions of VPC, designed diversion routing, and solved the security issues of VXLAN tunnels.

[0049] The technical solution of the present application is described in detail below through various embodiments.

[0050] An embodiment of the present application provides a message transmission method, which is applied to VPCGW1. Figure 3 is a flow chart of a message transmission method applied to VPCGW1 provided in an embodiment of the present application. Figure 4 is a schematic diagram of an improved enhanced peer connection traffic interaction architecture provided by an embodiment of the present application, such as Figure 3 As shown, the method includes: Step S101, receiving a service message from the OVS bridge of IP2 in VPC1, wherein the service message has at least an inner destination IP address and an outer destination IP address; Step S102, determining whether the destination CIDR of the service message overlaps with the CIDR network segment of VPC1 where the VPCGW1 is located, and the VPCGW1 is the gateway of VPC1; Step S103, when the destination CIDR of the service message overlaps with the CIDR network segment of VPC1 where the VPCGW1 is located, compare the outer destination IP address of the service message with the Vtep address of the VPCGW1, and when the outer destination IP address of the service message is the same as the Vtep address of the VPCGW1, remove the outer layer of the service message and read the inner destination IP address of the service message; Step S104, when the inner destination IP address is IP1 of VPC2, read the access control list corresponding to IP1 of VPC2, wherein the access control list indicates that IP2 is used as the source IP address and IP1 is used as the destination IP address; Step S105, reading an ABF forwarding table entry that matches the destination CIDR of the service message according to the access control list, wherein the ABF forwarding table entry indicates that the service message with the source IP address of IP2 and the destination IP address of IP1 is forwarded; Step S106: forward the service message to the Vtep address of VPCGW2 of the VPC2 according to the ABF forwarding entry, where the VPCGW2 is the gateway of the VPC2.

[0051] like Figure 4 The overall architecture of the enhanced VPC peering connection EVPC shown in the figure, VPC1 and VPC2 are two virtual private clouds respectively, VPCGW1 is the gateway of VPC1, VPCGW2 is the gateway of VPC2, VCP1 and VPC2 have overlapping CIDR network segments, among which IP1 is an IP address in the overlapping CIDR network segment, IP2 is an IP address of VPC1, IP3 is an IP address of VPC2, OVS1 is the virtual switch of VPC1, and OVS2 is the virtual switch of VPC2.

[0052] First, in step S101, VPCGW1, as the gateway of VPC1, receives a service message from a virtual machine (VM2) with an IP address of IP2 inside VPC1. This service message is sent from IP2 and is sent to a destination IP address in VPC2.

[0053] The service message contains at least an inner destination IP address (IP1) and an outer destination IP address (VTEP address of VPCGW2).

[0054] Further, in step S102, VPCGW1 will receive the service message sent from IP2, and check whether the destination CIDR of the received service message (that is, the CIDR block where IP1 in VPC2 is located) overlaps with the CIDR network segment of VPC1 to determine whether special processing of the service message is required. If there is no overlap, the service message will be processed through conventional routing; if there is an overlap, further special processing is required to forward the service message to ensure that the service message can be correctly transmitted to IP1 of VPC2.

[0055] Further, in step S103, if the destination CIDR of the service message overlaps with the CIDR network segment of VPC1, first, VPCGW1 will compare whether the outer destination IP address of the service message is the same as the VTEP address of VPCGW1 itself. If the outer destination IP address of the service message is the same as the VTEP address of VPCGW1 itself, it is determined that the service message is processed by VPCGW1, so VPCGW1 will remove the outer encapsulation of the service message and read the inner destination IP address.

[0056] Referring to the related technology, when the CIDRs of VPC1 and VPC2 are repeated and the two VPCs have a communication requirement, there will be a direct route to the CIDR where IP1 is located in VPC1, where Table 1 is the direct route of the local VPC1.

[0057] Table 1

[0058] As shown in Table 1, when local VPC traffic accesses IP1, it will be directly forwarded by looking up the host table in the local VPC (that is, VPC1) and cannot reach VPC2. Therefore, in order to give priority to local routing forwarding, this application needs to issue an ACL matching the VPC2 destination CIDR on VPCGW1.

[0059] Further, in step S104, when the inner destination IP address is IP1 in VPC2, VPCGW1 will further read the access control list (ACL) related to IP1 to determine whether the service message with the destination IP address of IP1 needs special processing from the access control list.

[0060] Among them, Table 2 is the access control list related to IP1 shown in this application.

[0061] Table 2

[0062] As shown in Table 2. Among them: ID: Aclid, which is the unique identifier of this ACL rule.

[0063] src (source IP): IP2, indicating that this rule will match traffic with source IP address IP2.

[0064] src_mask (source IP mask): 32, which means a full match on the source IP address. In IPv4, a 32-bit mask exactly matches a specific IP address.

[0065] dst (destination IP): IP1, indicating that this rule will match traffic with a destination IP address of IP1.

[0066] dst_mask (destination IP mask): 32, indicating a complete match on the destination IP address.

[0067] Protocol: 0, usually means matching all protocols. In some ACL configurations, 0 may represent the default protocol, that is, not filtering based on protocol.

[0068] Sport (source port): 0, indicating that the source port number is not checked and all source ports are open.

[0069] Dport (destination port): 0, which means that the destination port number is not checked and all destination ports are open.

[0070] Priority: 100, indicating the processing priority of this rule among all rules. The smaller the value, the higher the priority.

[0071] Therefore, the access control list can match specific service packets, that is, service packets with a source IP address of IP2 and a destination IP address of IP1.

[0072] Further, in step S105 , VPCGW1 reads an ABF (ACL-based forwarding) forwarding table entry corresponding to the access control list according to the rule of the matched access control list and according to the ID of the access control list, that is, the unique identifier.

[0073] Table 3

[0074] Table 3 is an ABF forwarding table entry shown in this application, as shown in Table 3, where: The ABF forwarding table entries are shown in Table 3, where: Policyid (Policy ID): Id1, which is the unique identifier of this policy routing rule.

[0075] Ac1 (ACL rule ID): Aclid, which means that this policy routing rule is based on the ACL rule defined in Table 1. When traffic matches the ACL rule in Table 1, this policy routing rule will be applied.

[0076] Next_Hop_IP: Vpcgw2_Vtep_IP, which is the VTEP (VXLAN TunnelEndpoint) IP address of the VPC2 gateway. This means that packets matching the ACL rule will be forwarded to this IP address.

[0077] Nexthop_Interface: Vxlan_tunnel100, which is the interface name of the VXLAN tunnel. Packets will be forwarded to VPC2 through this VXLAN tunnel interface.

[0078] Attach_Interface: Loop100, which is the loopback interface of the VPC1 gateway. Bind the ABF policy to this interface to make it effective on the interface and ensure that the traffic matching the ACL rule is processed through this interface.

[0079] Therefore, the ABF forwarding table entry is used to guide VPCGW1 to process the next-hop address and next-hop interface of the service message that matches the source IP and destination IP in the access control list, that is, the service message is forwarded from VPC1 to VPC2 through the next-hop address and next-hop interface in the ABF forwarding table, ensuring that the service message can be accurately forwarded in the case of overlapping IP addresses.

[0080] Finally, in step S106, VPCGW1 forwards the service message to the VTEP address of VPCGW2 of VPC2 according to the ABF forwarding table entry by establishing a VXLAN tunnel between VPCGW1 and VPCGW2, so that VPCGW2 passes the service message to IP1 of VPC2, thereby completing the transmission of the service message from VPC1 to VPC2, ensuring that even in the case of CIDR overlap, the service message sent to the IP address in the CIDR overlap can be correctly transmitted.

[0081] Through the above embodiment, ACL and ABF rules are configured on VPCGW1. Even if the CIDR segments of VPC1 and VPC2 overlap, it is possible to ensure that service packets are correctly transmitted from IP2 to IP1. The use of access vacancy lists and AFB forwarding items allows network administrators to flexibly define and apply traffic rules to adapt to different network requirements and security policies. The application of such policy routing reduces unnecessary network jumps and improves the efficiency and speed of data transmission, thereby effectively solving the CIDR overlap problem in inter-VPC communication and improving the flexibility, security and performance of the network.

[0082] Optionally, the method further comprises: When the destination CIDR of the service message does not overlap with the CIDR network segment of VPC1 where VPCGW1 is located, read the peer connection route matching the destination CIDR of the service message; According to the peer connection routing, the service message is forwarded to the Vtep address of the VPCGW2.

[0083] Specifically, in one embodiment, when the destination CIDR of the service message does not overlap with the CIDR network segment of VPC1 where VPCGW1 is located, VPCGW1 will read the peer connection route that matches the destination CIDR of the service message. The peer connection route is a routing table entry that defines how to route the service message from VPC1 to VPC2. The peer connection route includes the destination, mask (Mask), next hop (Next_Hop), and next hop IP address (Next_Hop_IP). For example, when the target IP address is IP3 of VPC2, Table 4 is the peer connection route corresponding to IP3, as shown in Table 4.

[0084] Table 4

[0085] in: Destination: CIDR corresponding to IP3, which is a specific network segment within VPC2 and does not overlap; Mask: 24, indicating that the subnet mask is 255.255.255.0, which is a typical Class C network mask; Next_Hop (Next_Hop: VPC Peer, indicating that the next hop is through a VPC peer connection; Next_Hop_IP: Vpcgw2_Vtep_IP, which is the VTEP (VXLAN TunnelEndpoint) IP address of the VPC2 gateway, that is, the VXLAN tunnel endpoint of VPC2.

[0086] From the peer connection route in Table 4, we can see that the CIDR route to IP3 in VPC2 has a peer connection as the next hop, and the next hop address is the VTEP IP address of the peer VXLAN, which is Vpcgw2_Vtep_IP.

[0087] Therefore, after VPCGW1 reads the peer connection route that matches the destination CIDR of the service message, it searches for the route entry corresponding to the destination CIDR of the service message in the peer connection route of VPCGW1. For example, if the destination CIDR of the service message is 192.168.2.0 / 24 (a non-overlapping CIDR belonging to VPC2), and according to the read peer connection route, VPCGW1 forwards the service message to the VTEP address of VPCGW2, thereby ensuring that the service message can be correctly transmitted to VPC2 through the established VPC peer connection and VXLAN tunnel.

[0088] Through the above embodiments, when CIDRs do not overlap, routing conflicts and unnecessary complexity can be reduced by directly using peer connection routing, thereby improving routing efficiency.

[0089] Optionally, the structure of the service message is a VXLAN structure; The inner source IP address of the business message is IP2, the inner destination IP address of the business message is IP1 of VPC2, the inner source Mac of the business message is the Mac of the VM of IP2, the inner destination Mac of the business message is the Mac of the VPCGW1, the outer source IP address of the business message is the Vtep address of the OVS corresponding to the VM, and the outer destination IP address of the business message is the Vtep address of the VPCGW1.

[0090] Specifically, in one embodiment, the structure of the service message is a VXLAN structure. Figure 4 The VXLAN structured service message obtained by encapsulating the OVS1 in the VXLAN is shown in Table 5.

[0091] Table 5

[0092] By encapsulating the data packet into the VXLAN message format, OVS1 forwards the VXLAN structured service message to VPCGW1. In Table 5, the service message is encapsulated in the VXLAN header, which contains the necessary information to ensure that the message can be correctly transmitted in the VXLAN network.

[0093] In Table 5, the inner source IP address of the service message is IP, and the inner destination IP address of the service message is IP1 of VPC2. The inner source Mac of the service message is the Mac of the VM of IP2, the inner destination Mac of the service message is the Mac of VPCGW1, the outer source IP address of the service message is the Vtep address of the OVS corresponding to the VM of IP2, that is, OVS1-VTEP-IP, the outer destination IP address of the service message is the Vtep address of VPCGW1, and the outer destination IP address is the IP address of the VTEP of the VPC1 gateway VPCGW1, that is, VPCGW1-VTEP-IP, which is used for routing in the VXLAN tunnel.

[0094] Following the above step S103, the encapsulated service message shown in Table 5 received by VPCGW1 can be determined to be processed by VPCGW1 according to the outer destination IP address (VPCGW1-VTEP-IP). Therefore, VPCGW1 removes the outer encapsulation of the service message and reads the inner destination IP address (IP1). Then, according to Table 2 and Table 3, it matches the ABF forwarding table entry for policy routing and forwards the service message to the VXLAN tunnel of the VPC peer connection to achieve cross-VPC forwarding.

[0095] Among them, after receiving the encapsulated service message shown in Table 5, VPCGW1 will rewrite the encapsulated service message shown in Table 5 before sending it to the VXLAN tunnel to obtain the service message encapsulated by VPCGW1 as shown in Table 6.

[0096] Table 6

[0097] The difference between Table 6 and Table 5 is that the inner source IP address and destination IP address of the VXLAN message remain unchanged, VPCGW1 changes the source MAC address to the MAC address of VPCGW1, that is, VPCGM1-Mac, and the destination MAC address to the MAC address of VPCGW2, that is, VPCGM2-Mac. The outer source IP address is changed to the Vtep address of VPCGW1, that is, VPCGW1-VTEP-IP, and the outer destination IP address is changed to the Vtep address of VPCGW2, that is, VPCGW2-VTEP-IP, thereby ensuring that the data packet can be correctly routed from VPCGW1 to VPCGW2 in the Underlay network.

[0098] Optionally, forwarding the service message to a Vtep address of VPCGW2 according to the ABF forwarding table entry or the peer connection route includes: Establish an IPsec tunnel with an underlay address between the VPCGW1 and the VPCGW2, wherein the underlay address of the VPCGW1 is IPsec-Local-IP, and the underlay address of the VPCGW2 is IPsec-Peer-IP; Read the static route of the VPCGW1 and perform IPsec encapsulation on the service message; The service message encapsulated by IPsec is sent to the Vtep address of the VPCGW2.

[0099] Specifically, in one embodiment, for both of the above-mentioned situations of overlap or not, the VXLAN tunnel for transmitting the service message can be securely encrypted to ensure the security of the service message transmission process.

[0100] First, when security encryption is required, an IPsec tunnel with an underlay address between VPCGW1 and VPCGW2 is established. This secure encrypted channel created between the two VPC gateways can ensure the security and integrity of business message transmission. The underlay address of VPCGW1 is configured as IPsec-Local-IP, which serves as the local endpoint of the IPsec tunnel; the underlay address of VPCGW2 is configured as IPsec-Peer-IP, which serves as the peer endpoint of the IPsec tunnel.

[0101] Furthermore, the static route of VPCGW1 is read and the service message is encapsulated with IPsec. This step ensures that the service message can be securely transmitted through the IPsec tunnel before being sent to VPCGW2. Specifically, VPCGW1 determines the destination IP address of the service message (i.e., the VTEP address of VPCGW2) based on the entries in the static routing table, and performs IPsec encapsulation operations on the service message, including adding an IPsec header and encrypting the data packet content.

[0102] Finally, the IPsec-encapsulated service message is transmitted to the VTEP address of VPCGW2 through the established IPsec tunnel. This completes the secure transmission process of the service message, and the service message is encrypted and protected during the transmission process to prevent the data packets in the service message from being stolen or tampered with during the transmission process. After reaching VPCGW2, the IPsec encapsulation is decapsulated by VPCGW2, the original service message is restored, and then forwarded to the destination IP address of the inner layer of the service message.

[0103] For example, the static route of VPCGW1 is shown in Table 7, which is used to introduce the service messages of the VXLAN tunnel into the IPsec tunnel for encrypted transmission.

[0104] Table 7

[0105] Here, the overlapping case (that is, the case where the destination IP address is IP1) is used as an example for explanation. The static route configuration of VPCGW1 shown in Table 7 is as follows: The destination IP address of the VXLAN outer layer (Destination): is set to the VTEP IP address of VPCGW2 (Vpcgw2_Vtep_IP). When VPCGW1 receives a service message with the outer destination IP address of Vpcgw2_Vtep_IP, it will process it according to the static route in Table 7.

[0106] Next hop address (Nexthot_IP): Set to the peer address of the IPsec tunnel, i.e. IPsec_Peer_IP. This is the IP address of VPCGW2, which is the other end point of the IPsec tunnel relative to VPCGW1.

[0107] Nexthop_Interface: Set to the IPsec tunnel interface, that is, IPsec_Tunnel100. This is the interface configured on VPCGW1 and is used to establish an IPsec tunnel with VPCGW2.

[0108] When IP2 in VPC1 needs to send data to IP1 in VPC2, the service message is first sent to VPCGW1. VPCGW1 encapsulates these service messages in the VXLAN header according to the static route configured above and sends them to the VTEP address (Vpcgw2_Vtep_IP) of VPCGW2.

[0109] In the case of an IPsec tunnel, VPCGW1 matches the destination IP address (Vpcgw2_Vtep_IP) of the service message with the static routing configuration of VPCGW1. Therefore, VPCGW1 performs IPsec encapsulation on the service message in the VXLAN format shown in Table 6 to obtain Figure 5 The following figure shows a service message after IPsec encapsulation.

[0110] Optionally, in one embodiment, the structure of the service message after IPsec encapsulation is the structure of VXLAN overIPsec; wherein, the source IP address of the outer IPsec tunnel of the service message after IPsec encapsulation is the IPsec-Lcoal-IP of VPCGW1, and the destination IP address of the outer IPsec tunnel of the service message after IPsec encapsulation is the IPsec-Peer-IP of VPCGW2; the inner source IP address of the service message after IPsec encapsulation is IP2, the inner destination IP address of the service message after IPsec encapsulation is IP1, the inner source MAC of the service message after IPsec encapsulation is the MAC of VPCGW1, the inner destination MAC of the service message after IPsec encapsulation is the MAC of VPCGW2 of VPC2, the outer source IP address of the service message after IPsec encapsulation is the Vtep address of VPCGW2, and the outer destination IP address of the service message after IPsec encapsulation is the Vtep address of VPCGW2.

[0111] Among them, Figure 5 In the example, the structure of the entire service message after IPsec encapsulation is the structure of VXLAN over IPsec. In the IPsec tunnel, VPCGW1 encapsulates the service message encapsulated by VPCGW1 in Table 6 through IPsec to obtain the ESP encrypted payload, that is, encrypts the VXLAN message into the ESP payload. The source IP address of the outer IPsec tunnel is the IPsec-Lcoal-IP of VPCGW1, and the destination IP address is the IPsec-Peer-IP of VPCGW2. The ESP encrypted payload contains the encrypted VXLAN service message.

[0112] Then, through the IPsec tunnel interface (IPsec_Tunnel100), Figure 5The service message is sent to the Vtep address of VPCGW2. In this process, the IPsec tunnel provides encryption and authentication for the service message to ensure the transmission security of the data packets in the service message. Figure 5 After receiving the service message, it is first decapsulated through the IPsec tunnel, and then the VXLAN header is decapsulated to restore the original data packet of the service message, and the data packet in the service message is forwarded to IP1 in VPC2 according to the destination IP address in the service message. In this way, the VXLAN tunnel traffic between VPC1 and VPC2 is securely encapsulated in the IPsec tunnel, ensuring the security and integrity of the data during transmission. Even if the data packet is transmitted in the public network, it can maintain confidentiality and integrity.

[0113] Through the above embodiment, an IPsec tunnel is established between VPC gateways. The IPsec tunnel provides a stable encryption function, reduces the risk of communication interruption due to network attacks, ensures the security of business messages during transmission, and prevents data leakage and tampering. It effectively improves the security and reliability of cross-VPC communication.

[0114] Based on the same inventive concept, another embodiment of the present application further provides a message transmission method, which is applied to VPCGW2. Figure 6 is a flowchart of a message transmission method applied to VPCGW2 provided in another embodiment of the present application, such as Figure 6 As shown, the method includes: Step S201, receiving a service message from VPCGW1, wherein VPCGW1 is the gateway of VPC1, and VPCGW2 is the gateway of VPC2; Step S202: compare the outer destination IP address of the service message with the Vtep address of the VPCGW2. If the outer destination IP address of the service message is the same as the Vtep address of the VPCGW2, remove the outer layer of the service message and read the inner destination IP of the service message. Step S203: When the inner destination IP address is IP1 of VPC2, the service message is forwarded to IP1 of VPC2.

[0115] First, in step S201, VPCGW2 receives a service message from VPCGW1. Here, VPCGW1 is the gateway of VPC1, responsible for the communication between the devices in VPC1 and the external network (including VPC2); while VPCGW2 is the gateway of VPC2, responsible for the communication between the devices in VPC2 and the external network (including VPC1).

[0116] Further, in step S202, VPCGW2 compares the outer destination IP address of the received service message with its own VTEP address. The VTEP address is a specific IP address used in a virtual network environment to identify the interface of a virtual network device. When the outer destination IP address is the same as the VTEP address of VPCGW2, it means that the service message is sent to VPCGW2. VPCGW2 will remove the outer encapsulation of the service message in order to read the inner destination IP address.

[0117] Further, in step S203, after removing the outer layer, VPCGW2 will check the inner destination IP address of the service message. When the inner destination IP address is a specific IP address in VPC2 (such as IP1), VPCGW2 will forward the service message to the corresponding IP1 device in VPC2. This process ensures that the message can be correctly transmitted from VPC1 to the designated device of VPC2.

[0118] By comparing the destination IP address and the VTEP address, it is determined whether the outer encapsulation needs to be removed, and then the message is forwarded according to the inner destination IP address. This mechanism can be used to achieve communication between different virtual private clouds, such as transmitting data between different VPCs of a cloud service provider.

[0119] Optionally, the method further comprises: Receive IPsec-encapsulated service packets from VPCGW1; Compare the destination IP address of the outer IPsec tunnel of the service message with the underlay address of VPCGW2. If the destination IP address of the outer IPsec tunnel of the service message is the same as the underlay address of VPCGW2, dismantle the outer IPsec tunnel of the service message after IPsec encapsulation, and read the outer destination IP address of the service message. Compare the outer destination IP address of the service message with the Vtep address of the VPCGW2. If the outer destination IP address of the service message is the same as the Vtep address of the VPCGW2, remove the outer layer of the service message and read the inner destination IP; When the inner destination IP address is IP1 of VPC2, the service message is forwarded to IP1 of VPC2.

[0120] Specifically, in one embodiment, when VPCGW2 receives a service message from VPCGW1, and the service message has been encapsulated by the IPsec protocol, VPCGW2 needs to compare the destination IP address of the outer IPsec tunnel of the received service message after IPsec encapsulation with the underlay address of VPCGW2 itself, that is, with the IP address of VPCGW2 in the physical network.

[0121] When the destination IP address of the outer IPsec tunnel of the IPsec-encapsulated service message is the same as the underlay address of VPCGW2, it means that the IPsec-encapsulated service message is sent to VPCGW2. VPCGW2 will remove the outer IPsec tunnel of the IPsec-encapsulated service message to read the inner destination IP address.

[0122] After removal, VPCGW2 will compare the outer destination IP address of the service message after IPsec encapsulation with its own VTEP address. The VTEP address is the IP address of the interface used by VPCGW2 to identify the virtual network device in the virtual network environment.

[0123] When the outer destination IP address of the service message is the same as the VTEP address of VPCGW2, VPCGW2 will remove the outer encapsulation of the message and read the inner destination IP address.

[0124] When the inner destination IP address is a specific IP address in VPC2 (for example, IP1), VPCGW2 will forward the service message to the corresponding IP1 device in VPC2.

[0125] This ensures that the IPsec-encrypted service messages can be securely transmitted from VPCGW1 to VPCGW2 and ultimately reach the target device in VPC2, thus enhancing the security of data transmission.

[0126] Next, in combination with the above embodiments, the process of the enhanced peer-to-peer connection VPCGW for peer connection services is described. Figure 7 FIG. 1 is a flowchart of a process of a VPCGW for an enhanced peer connection to a peer connection service shown in an embodiment of the present application. Figure 7 As shown, VPCGW represents the gateway of the VPC that sends business messages, not limited to VPCGW1 and VPCGW2.

[0127] When VPCGW receives the service message of the peer connection, it first determines whether the enhanced VPC peer connection (EVPC) function is enabled. If it is not enabled, it follows the conventional peer connection service process, that is, it matches the static route of the destination CIDR for the service message, and refers to Table 1 to guide the service message of the destination CIDR to the VXLAN tunnel of the peer connection, and then forwards it normally after entering the VXLAN tunnel without IPsec encryption protection.

[0128] When the EVPC function in the technical solution of this application is enabled, it is determined whether the destination IP address of the service message overlaps with the CIDR network segment in the VPC where the VPCGW is located. If there is no overlap, the service message matches the static route of the destination IP address, and refers to Table 4 to divert it to the VXLAN tunnel of the peer connection. After encapsulating the VXLAN tunnel, the VXLAN tunnel traffic is diverted to the IPsec tunnel through static routing, and the peer connection service traffic is encrypted and protected by IPsec. If the destination CIDR has a duplicate network segment with the local VPC, the service message undergoes the ABF process, obtains the destination IP address and matches the access control chain table, and then forwards based on the ABF forwarding table. Refer to Tables 2 and 3 to divert the service message to the VXLAN tunnel of the peer connection. After encapsulating it into VXLAN tunnel traffic, the static route of the outer destination IP address is searched, and Table 7 is referred to, and the VXLAN message is encapsulated with IPsec to encrypt and protect the tunnel between the two VPCs with IPsec. This optimizes and enhances the traditional VPC peering connection technology. Through the policy routing of access control lists and ABF forwarding table items, combined with the IPsec diversion of static routes, the limitation of CIDR overlap across VPCs is solved, and stable, encrypted and secure transmission of traffic between VPCs is achieved.

[0129] Through the above embodiments, the technical solution of the present application can achieve the following technical effects: (1) Forwarding based on the access control list is used to forward traffic to the peer VPC when the local VPC has a direct route (i.e., when there are overlapping CIDR network segments). This solves the limitation that the two VPCs that establish a peer connection cannot have overlapping CIDRs. There is a need for traffic interoperability between VPCs, and this interoperability requirement has a higher priority than the traffic interoperability requirement between local VPCs. Therefore, overlapping CIDRs are diverted through policy routing to achieve cross-VPC interoperability of CIDR network segments that overlap with the local VPC. (2) Use IPsec tunnel mode to encrypt the VXLAN tunnel between VPCs, and implement VXLAN over IPsec through static routing of VPCGW, thus ensuring the security of message transmission between VPCs. The underlay negotiation between VPCGWs establishes an IPsec tunnel. Here, the IPsec solution of ESP tunnel mode is selected to protect VXLAN messages. This can meet the network's needs for network security and improve the security level of the resource pool; (3) An enhanced VPC peering connection solution was proposed, which optimized the CIDR overlap restrictions of VPC, designed traffic routing, and solved the security issues of VXLAN tunnels. The functions and security defects of traditional peering connections were optimized, and the peering connection technology was improved, making the cross-VPC technology more widely used.

[0130] Based on the same inventive concept, another embodiment of the present application further provides a message transmission device, which is applied to VPCGW1. Figure 8 is a schematic diagram of a framework of a message transmission device applied to VPCGW1 provided in an embodiment of the present application, such as Figure 8 As shown, the device comprises: The first receiving module 11 is used to receive a service message from the OVS bridge of IP2 in VPC1, where the service message has at least an inner destination IP address and an outer destination IP address; A judgment module 12 is used to judge whether the destination CIDR of the service message overlaps with the CIDR network segment of VPC1 where the VPCGW1 is located, and the VPCGW1 is the gateway of VPC1; A first comparison module 13 is configured to compare the outer destination IP address of the service message with the Vtep address of the VPCGW1 when the destination CIDR of the service message overlaps with the CIDR network segment of the VPC1 where the VPCGW1 is located, and to remove the outer layer of the service message and read the inner destination IP address of the service message when the outer destination IP address of the service message is the same as the Vtep address of the VPCGW1; An access control list reading module 14, configured to read the access control list corresponding to the IP1 of the VPC2 when the inner destination IP address is the IP1 of the VPC2; An ABF forwarding table entry reading module 15, configured to read an ABF forwarding table entry matching the destination CIDR of the service message according to the access control list; The first forwarding module 16 is used to forward the service message to the Vtep address of VPCGW2 of the VPC2 according to the ABF forwarding table entry, where the VPCGW2 is the gateway of the VPC2.

[0131] Optionally, the device further comprises: A peer connection route reading module, configured to read a peer connection route matching the destination CIDR of the service message when the destination CIDR of the service message does not overlap with the CIDR network segment of the VPC1 where the VPCGW1 is located; The third forwarding module is used to forward the service message to the Vtep address of the VPCGW2 according to the peer connection routing.

[0132] Optionally, the device further comprises: An IPsec tunnel establishment module, used to establish an IPsec tunnel of an underlay address between the VPCGW1 and the VPCGW2, wherein the underlay address of the VPCGW1 is IPsec-Local-IP, and the underlay address of the VPCGW2 is IPsec-Peer-IP; A static route reading module, used to read the static route of the VPCGW1 and perform IPsec encapsulation on the service message; The sending module is used to send the service message encapsulated by IPsec to the Vtep address of the VPCGW2.

[0133] Based on the same inventive concept, another embodiment of the present application further provides a message transmission device, which is applied to VPCGW2. Fig. 9 is a schematic diagram of a framework of a message transmission device applied to VPCGW2 provided in an embodiment of the present application, such as Fig. 9 As shown, the device comprises: The second receiving module 21 is used to receive a service message from VPCGW1, where VPCGW1 is the gateway of VPC1 and VPCGW2 is the gateway of VPC2; A second comparison module 22 is used to compare the outer destination IP address of the service message with the Vtep address of the VPCGW2. If the outer destination IP address of the service message is the same as the Vtep address of the VPCGW2, remove the outer layer of the service message and read the inner destination IP of the service message; The second forwarding module 23 is used to forward the service message to IP1 of VPC2 when the inner destination IP address is IP1 of VPC2.

[0134] Optionally, the device further comprises: The third receiving module is used to receive the IPsec-encapsulated service message from VPCGW1; A third comparison module is used to compare the destination IP address of the outer IPsec tunnel of the service message with the underlay address of VPCGW2. When the destination IP address of the outer IPsec tunnel of the service message is the same as the underlay address of VPCGW2, the outer IPsec tunnel of the service message after IPsec encapsulation is removed, and the outer destination IP address of the service message is read; A fourth comparison module is used to compare the outer destination IP address of the service message with the Vtep address of the VPCGW2. When the outer destination IP address of the service message is the same as the Vtep address of the VPCGW2, the outer layer of the service message is removed and the inner destination IP is read; The fourth forwarding module is used to forward the service message to IP1 of VPC2 when the inner destination IP address is IP1 of VPC2.

[0135] Based on the same inventive concept, another embodiment of the present application further provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the message transmission method as described in any of the above embodiments.

[0136] Based on the same inventive concept, another embodiment of the present application further provides a computer program product, including a computer program, which is executed by a processor to implement the message transmission method described in any of the above embodiments.

[0137] Based on the same inventive concept, another embodiment of the present application further provides a computer-readable storage medium on which a computer program is stored, wherein when the program is executed by a processor, the message transmission method as described in any of the above embodiments is implemented.

[0138] As for the device, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0139] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0140] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, devices, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0141] The embodiments of the present application are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0142] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0143] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable terminal device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0144] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present application.

[0145] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0146] The above is a detailed introduction to a message transmission method, device and equipment provided by the present application. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea; at the same time, for general technical personnel in this field, according to the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A message transmission method, characterized in that: Applied to VPCGW1, the method includes: Receive a service message from the OVS bridge of IP2 in VPC1, where the service message has at least an inner destination IP address and an outer destination IP address; Determine whether the destination CIDR of the service message overlaps with the CIDR network segment of VPC1 where the VPCGW1 is located, and the VPCGW1 is the gateway of VPC1; When the destination CIDR of the service message overlaps with the CIDR network segment of VPC1 where VPCGW1 is located, compare the outer destination IP address of the service message with the Vtep address of VPCGW1. When the outer destination IP address of the service message is the same as the Vtep address of VPCGW1, remove the outer layer of the service message and read the inner destination IP address of the service message. When the inner destination IP address is IP1 of VPC2, the access control list corresponding to IP1 of VPC2 is read, and the access control list indicates that IP2 is used as the source IP address and IP1 is used as the destination IP address; According to the access control list, read the ABF forwarding table entry that matches the destination CIDR of the service message, the ABF forwarding table entry indicating that the service message with the IP2 as the source IP address and the IP1 as the destination IP address is forwarded; According to the ABF forwarding entry, the service message is forwarded to the Vtep address of VPCGW2 of the VPC2, where VPCGW2 is the gateway of VPC2.

2. The message transmission method according to claim 1, characterized in that: The method further comprises: When the destination CIDR of the service message does not overlap with the CIDR network segment of VPC1 where VPCGW1 is located, read the peer connection route matching the destination CIDR of the service message; According to the peer connection routing, the service message is forwarded to the Vtep address of the VPCGW2.

3. The message transmission method according to claim 2, characterized in that: The forwarding the service message to the Vtep address of VPCGW2 according to the ABF forwarding table entry or the peer connection route includes: Establish an IPsec tunnel with an underlay address between the VPCGW1 and the VPCGW2, wherein the underlay address of the VPCGW1 is IPsec-Local-IP, and the underlay address of the VPCGW2 is IPsec-Peer-IP; Read the static route of the VPCGW1 and perform IPsec encapsulation on the service message; The service message encapsulated by IPsec is sent to the Vtep address of the VPCGW2.

4. The message transmission method according to any one of claims 1 to 3, characterized in that: The structure of the service message is a VXLAN structure; The inner source IP address of the business message is IP2, the inner destination IP address of the business message is IP1 of VPC2, the inner source Mac of the business message is the Mac of the VM of IP2, the inner destination Mac of the business message is the Mac of the VPCGW1, the outer source IP address of the business message is the Vtep address of the OVS corresponding to the VM, and the outer destination IP address of the business message is the Vtep address of the VPCGW1.

5. The message transmission method according to claim 4, characterized in that: The structure of the service message after IPsec encapsulation is the structure of VXLAN over IPsec. The source IP address of the outer IPsec tunnel of the service message after IPsec encapsulation is the IPsec-Lcoal-IP of VPCGW1, and the destination IP address of the outer IPsec tunnel of the service message after IPsec encapsulation is the IPsec-Peer-IP of VPCGW2; The inner source IP address of the service message after IPsec encapsulation is IP2, the inner destination IP address of the service message after IPsec encapsulation is IP1, the inner source MAC of the service message after IPsec encapsulation is the MAC of VPCGW1, the inner destination MAC of the service message after IPsec encapsulation is the MAC of VPCGW2 of VPC2, the outer source IP address of the service message after IPsec encapsulation is the Vtep address of VPCGW2, and the outer destination IP address of the service message after IPsec encapsulation is the Vtep address of VPCGW2.

6. A message transmission method, characterized in that: Applied to VPCGW2, the method includes: Receive a service message from VPCGW1, where VPCGW1 is the gateway of VPC1 and VPCGW2 is the gateway of VPC2; Compare the outer destination IP address of the service message with the Vtep address of the VPCGW2. If the outer destination IP address of the service message is the same as the Vtep address of the VPCGW2, remove the outer layer of the service message and read the inner destination IP of the service message. When the inner destination IP address is IP1 of VPC2, the service message is forwarded to IP1 of VPC2.

7. The message transmission method according to claim 6, characterized in that: The method further comprises: Receive IPsec-encapsulated service packets from VPCGW1; Compare the destination IP address of the outer IPsec tunnel of the service message with the underlay address of VPCGW2. If the destination IP address of the outer IPsec tunnel of the service message is the same as the underlay address of VPCGW2, dismantle the outer IPsec tunnel of the service message after IPsec encapsulation, and read the outer destination IP address of the service message. Compare the outer destination IP address of the service message with the Vtep address of the VPCGW2. If the outer destination IP address of the service message is the same as the Vtep address of the VPCGW2, remove the outer layer of the service message and read the inner destination IP; When the inner destination IP address is IP1 of VPC2, the service message is forwarded to IP1 of VPC2.

8. A message transmission device, characterized in that: Applied to VPCGW1, the device includes: A first receiving module is used to receive a service message from the OVS bridge of IP2 in VPC1, where the service message has at least an inner destination IP address and an outer destination IP address; A judgment module, used to judge whether the destination CIDR of the service message overlaps with the CIDR network segment of VPC1 where the VPCGW1 is located, and the VPCGW1 is the gateway of VPC1; A first comparison module is used to compare the outer destination IP address of the service message with the Vtep address of the VPCGW1 when the destination CIDR of the service message overlaps with the CIDR network segment of the VPC1 where the VPCGW1 is located, and to remove the outer layer of the service message and read the inner destination IP address of the service message when the outer destination IP address of the service message is the same as the Vtep address of the VPCGW1; An access control list reading module, used for reading the access control list corresponding to the IP1 of the VPC2 when the inner destination IP address is the IP1 of the VPC2; An ABF forwarding table entry reading module, configured to read an ABF forwarding table entry matching a destination CIDR of the service message according to the access control list; The first forwarding module is used to forward the service message to the Vtep address of VPCGW2 of the VPC2 according to the ABF forwarding table entry, where the VPCGW2 is the gateway of the VPC2.

9. A message transmission device, characterized in that: Applied to VPCGW2, the device includes: A second receiving module is used to receive a service message from VPCGW1, where VPCGW1 is the gateway of VPC1 and VPCGW2 is the gateway of VPC2; A second comparison module is used to compare the outer destination IP address of the service message with the Vtep address of the VPCGW2. If the outer destination IP address of the service message is the same as the Vtep address of the VPCGW2, the outer layer of the service message is removed and the inner destination IP of the service message is read; The second forwarding module is used to forward the service message to IP1 of VPC2 when the inner destination IP address is IP1 of VPC2.

10. An electronic device, characterized in that: The method comprises a memory, a processor and a computer program stored in the memory, wherein the processor executes the computer program to implement the message transmission method according to any one of claims 1 to 7.

Images