Message transmission methods, apparatus and equipment

Abstract

This application provides a message transmission method, apparatus, and device, relating to the field of cloud computing technology. The method includes: receiving a service message from an OVS bridge on IP2 in VPC1; determining whether the destination CIDR of the service message overlaps with the CIDR network segment of VPC1 where VPCGW1 is located, where VPCGW1 is the gateway of VPC1; if they overlap, comparing the outer destination IP address of the service message with the Vtep address of VPCGW1; if they are the same, removing the outer layer of the service message and reading the inner destination IP address of the service message; if the inner destination IP address is IP1 of VPC2, reading the access control list corresponding to IP1 of VPC2; according to the access control list, reading the ABF forwarding table entry that matches the destination CIDR of the service message; and forwarding the service message according to the ABF forwarding table entry.

Description

Technical Field

[0001] This application relates to the field of cloud computing technology, and in particular to a message transmission method, apparatus and device. Background Technology

[0002] A peering connection refers to a network connection between two VPCs in a cloud network. Users can use private IP addresses to communicate between two VPCs as if they were in the same network. Within the same resource pool, users can create peering connections between their own tenant's VPCs, as well as between their own tenant's VPCs and other tenants' VPCs.

[0003] Figure 1 This is a schematic diagram of a VPC peering network shown in related technologies, such as... Figure 1 As shown, there are two VPCs in a cloud network region. These two VPCs are originally used for service isolation. However, some services want to communicate across VPCs, which requires establishing a VXLAN tunnel between the gateways of the two VPCs. This VXLAN tunnel across the VPCGW is called a VPC peer connection.

[0004] Figure 2 This is a business traffic architecture diagram in a peer-to-peer connection scenario in a cloud network, as shown in related technologies, such as Figure 2 As shown, traffic from IP1 within VPC1 to IP2 across network segments is forwarded to IP2 by the gateway VPCGW. For IP1 to access IP3 in VPC2, a VPC peering connection needs to be established between VPCGW1 and VPCGW2. Traffic from IP1 reaches VPC2 through a VXLAN tunnel between them, enabling cross-VPC traffic exchange.

[0005] 1. After analyzing the peering connection technology in related technologies, it was found that the current VPC peering connection has two limitations;

[0006] (1) The two VPCs creating a peering connection cannot have overlapping CIDR segments. This is because a VPC cannot have two routes with the same destination CIDR, which means that the two VPCs must have different CIDRs. This severely limits the use cases of peering technology, because the background of VPCs is virtual, private, and independent address spaces, and forwarding table entries can isolate users. Obviously, this limitation of peering is contrary to the purpose of VPCs.

[0007] (2) The VXLAN tunnel between two VPCs is a bare tunnel without any security protection mechanism. The introduction of regulations such as the Cybersecurity Classified Protection 2.0 signifies that network security is receiving increasing attention. The bare tunnel between VPCs poses security risks, and new methods are needed to solve the security problems between VPCs.

[0008] 2. Technologies in related fields that address this problem:

[0009] There is currently no good way to resolve the limitations of the two VPC peering connections mentioned above.

[0010] (1) If you want to enable certain traffic between two VPCs, the network management needs to plan the network segment addresses of the two VPCs in advance and manually intervene to avoid CIDR overlap between the two VPCs.

[0011] (2) The security of data transmission between VPCs mainly relies on the trustworthiness of the configuration provided by the controller to the VPCGW. If the configuration provided by the controller to the VPCGW is considered trustworthy, then the VXLAN tunnel between VPCGWs is considered trustworthy. There is no direct protection for the VXLAN tunnel.

[0012] 3. Problems existing in related technologies:

[0013] (1) The network administrator needs to manually plan the CIDRs of the two VPCs to avoid duplication of CIDRs in order to use VPC peering technology.

[0014] (2) There is no direct protection for the VXLAN tunnels between VPCs, and the VXLAN tunnels are considered secure based on the trusted configuration on the VPCGW. When packet sniffing occurs between VPCs for reverse engineering attacks, the security risk of VXLAN tunnel traffic is very high. Summary of the Invention

[0015] In view of the above, embodiments of this application provide a message transmission method, apparatus, and device to overcome or at least partially solve the above problems.

[0016] A first aspect of this application provides a message transmission method applied to VPCGW1, the method comprising:

[0017] Receive service packets from the OVS bridge in IP2 of VPC1, wherein the service packets have at least an inner destination IP address and an outer destination IP address;

[0018] Determine whether the destination CIDR of the service message overlaps with the CIDR network segment of VPC1 where VPCGW1 is located; VPCGW1 is the gateway of VPC1.

[0019] If the destination CIDR of the service packet overlaps with the CIDR network segment of VPC1 where VPCGW1 is located, the outer destination IP address of the service packet is compared with the Vtep address of VPCGW1. If the outer destination IP address of the service packet is the same as the Vtep address of VPCGW1, the outer layer of the service packet is removed and the inner destination IP address of the service packet is read.

[0020] When the inner destination IP address is IP1 of VPC2, the access control list corresponding to IP1 of VPC2 is read. The access control list indicates that IP2 is the source IP address and IP1 is the destination IP address.

[0021] According to the access control list, read the ABF forwarding table entry that matches the destination CIDR of the service packet. The ABF forwarding table entry indicates that the service packet with IP2 as the source IP address and IP1 as the destination IP address is forwarded.

[0022] According to the ABF forwarding table entry, the service message is forwarded to the Vtep address of VPCGW2 of VPC2, where VPCGW2 is the gateway of VPC2.

[0023] Optionally, the method further includes:

[0024] If the destination CIDR of the service packet does not overlap with the CIDR network segment of the VPC1 where the VPCGW1 is located, read the peer connection route that matches the destination CIDR of the service packet.

[0025] According to the peer connection route, the service packets are forwarded to the Vtep address of the VPCGW2.

[0026] Optionally, forwarding the service packet to the Vtep address of VPCGW2 according to the ABF forwarding table entry or the peer connection route includes:

[0027] Establish an IPsec tunnel for the underlay address between VPCGW1 and VPCGW2, wherein the underlay address of VPCGW1 is IPsec-Local-IP and the underlay address of VPCGW2 is IPsec-Peer-IP;

[0028] Read the static routes of the VPCGW1 and encapsulate the service packets using IPsec.

[0029] The service packets, after being encapsulated in IPsec, are sent to the Vtep address of the VPCGW2.

[0030] Optionally, the structure of the service message is a VXLAN structure;

[0031] The inner source IP address of the service packet is IP2, the inner destination IP address of the service packet is IP1 of VPC2, the inner source MAC address of the service packet is the MAC address of the VM of IP2, the inner destination MAC address of the service packet is the MAC address of VPCGW1, the outer source IP address of the service packet is the Vtep address of the OVS corresponding to the VM, and the outer destination IP address of the service packet is the Vtep address of VPCGW1.

[0032] Optionally, the structure of the service packets after IPsec encapsulation is the VXLAN over IPsec structure;

[0033] The source IP address of the outer IPsec tunnel of the service packet after IPsec encapsulation is IPsec-Lcoal-IP of VPCGW1, and the destination IP address of the outer IPsec tunnel of the service packet after IPsec encapsulation is IPsec-Peer-IP of VPCGW2.

[0034] The inner source IP address of the IPsec-encapsulated service packet is IP2, the inner destination IP address of the IPsec-encapsulated service packet is IP1, the inner source MAC address of the IPsec-encapsulated service packet is the MAC address of VPCGW1, the inner destination MAC address of the IPsec-encapsulated service packet is the MAC address of VPCGW2, the outer source IP address of the IPsec-encapsulated service packet is the Vtep address of VPCGW2, and the outer destination IP address of the IPsec-encapsulated service packet is the Vtep address of VPCGW2.

[0035] A second aspect of this application provides a message transmission method applied to VPCGW2, the method comprising:

[0036] Receive service packets from VPCGW1, where VPCGW1 is the gateway for VPC1 and VPCGW2 is the gateway for VPC2;

[0037] The outer destination IP address of the service packet is compared with the Vtep address of the VPCGW2. If the outer destination IP address of the service packet is the same as the Vtep address of the VPCGW2, the outer layer of the service packet is removed and the inner destination IP address of the service packet is read.

[0038] If the inner destination IP address is IP1 of VPC2, the service packet is forwarded to IP1 of VPC2.

[0039] Optionally, the method further includes:

[0040] Receive service packets from VPCGW1 that have been encapsulated in IPsec;

[0041] The destination IP address of the outer IPsec tunnel of the service packet is compared with the underlay address of VPCGW2. If the destination IP address of the outer IPsec tunnel of the service packet is the same as the underlay address of VPCGW2, the outer IPsec tunnel of the service packet after IPsec encapsulation is removed, and the outer destination IP address of the service packet is read.

[0042] Compare the outer destination IP address of the service packet with the Vtep address of the VPCGW2. If the outer destination IP address of the service packet is the same as the Vtep address of the VPCGW2, remove the outer layer of the service packet and read the inner destination IP.

[0043] If the inner destination IP address is IP1 of VPC2, the service packet is forwarded to IP1 of VPC2.

[0044] A third aspect of this application provides a message transmission apparatus applied to a VPCGW1, the apparatus comprising:

[0045] The first receiving module is used to receive service packets from the OVS bridge of IP2 in VPC1, wherein the service packets have at least an inner destination IP address and an outer destination IP address.

[0046] The judgment module is used to determine whether the destination CIDR of the service packet overlaps with the CIDR network segment of VPC1 where VPCGW1 is located, and VPCGW1 is the gateway of VPC1;

[0047] The first comparison module is used to compare the outer destination IP address of the service packet with the Vtep address of the VPCGW1 when the destination CIDR of the service packet overlaps with the CIDR network segment of the VPCGW1. If the outer destination IP address of the service packet is the same as the Vtep address of the VPCGW1, the outer layer of the service packet is removed and the inner destination IP address of the service packet is read.

[0048] The access control list reading module is used to read the access control list corresponding to IP1 of VPC2 when the inner destination IP address is IP1 of VPC2.

[0049] The ABF forwarding table entry reading module is used to read the ABF forwarding table entry that matches the destination CIDR of the service message according to the access control list;

[0050] The first forwarding module is used to forward the service packet to the Vtep address of VPCGW2 of VPC2 according to the ABF forwarding table entry, wherein VPCGW2 is the gateway of VPC2.

[0051] A fourth aspect of this application provides a message transmission apparatus applied to VPCGW2, the apparatus comprising:

[0052] The second receiving module is used to receive service packets from VPCGW1, where VPCGW1 is the gateway of VPC1 and VPCGW2 is the gateway of VPC2.

[0053] The second comparison module is used to compare the outer destination IP address of the service packet with the Vtep address of the VPCGW2. If the outer destination IP address of the service packet is the same as the Vtep address of the VPCGW2, the outer layer of the service packet is removed and the inner destination IP address of the service packet is read.

[0054] The second forwarding module is used to forward the service packet to IP1 of VPC2 when the inner destination IP address is IP1 of VPC2.

[0055] A fifth aspect of this application provides an electronic device including a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the method as described in the first or second aspect.

[0056] According to a sixth aspect of this application, a computer program product is provided, including a computer program that, when executed by a processor, implements the method described in the first or second aspect.

[0057] A seventh aspect of this application provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the method described in the first or second aspect.

[0058] The beneficial effects of this application are:

[0059] This application provides a message transmission method, apparatus, and device. The method includes: receiving a service message from an OVS bridge on IP2 in VPC1, wherein the service message has at least an inner destination IP address and an outer destination IP address; determining whether the destination CIDR of the service message overlaps with the CIDR network segment of VPC1 where VPCGW1 is located, wherein VPCGW1 is the gateway of VPC1; if the destination CIDR of the service message overlaps with the CIDR network segment of VPC1 where VPCGW1 is located, comparing the outer destination IP address of the service message with the Vtep address of VPCGW1; if the outer destination IP address of the service message is the same as the Vtep address of VPCGW1, then... Remove the outer layer of the service packet and read the inner destination IP address of the service packet. If the inner destination IP address is IP1 of VPC2, read the access control list corresponding to IP1 of VPC2. The access control list indicates that IP2 is the source IP address and IP1 is the destination IP address. According to the access control list, read the ABF forwarding table entry that matches the destination CIDR of the service packet. The ABF forwarding table entry indicates that the service packet with IP2 as the source IP address and IP1 as the destination IP address should be forwarded. According to the ABF forwarding table entry, forward the service packet to the Vtep address of VPCGW2 of VPC2. VPCGW2 is the gateway of VPC2.

[0060] By configuring access control lists and ABF forwarding table entries on VPCGW1, even if the CIDR network segments of VPC1 and VPC2 overlap, it can ensure that service packets are correctly transmitted across VPCs, avoid routing conflicts in local VPCs, solve the problem that the CIDRs of two VPCs cannot conflict, reduce unnecessary network hops, and improve the efficiency and speed of data transmission. Thus, it effectively solves the problem of CIDR overlap in inter-VPC communication, while improving the flexibility, security and performance of the network. Attached Figure Description

[0061] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments of this application and their descriptions are used to explain this application and do not constitute an undue limitation of this application.

[0062] To more clearly illustrate the technical solution of this application, the drawings used in the description of this application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0063] Figure 1 This is a schematic diagram of a VPC peer-to-peer network shown in related technologies;

[0064] Figure 2 This is a diagram illustrating the business traffic architecture in a peer-to-peer connection scenario within a cloud network, as shown in related technologies.

[0065] Figure 3 This is a schematic flowchart of a message transmission method applied to VPCGW1 provided in an embodiment of this application;

[0066] Figure 4 This is a schematic diagram of an improved enhanced peer-to-peer connection traffic interaction architecture provided in an embodiment of this application;

[0067] Figure 5 This application shows a schematic diagram of a service packet encapsulated by IPsec;

[0068] Figure 6 This is a flowchart of a message transmission method applied to VPCGW2 provided in another embodiment of this application;

[0069] Figure 7 This is a flowchart illustrating the process of a VPCGW performing peer-to-peer services for enhanced peer-to-peer connections, as shown in an embodiment of this application.

[0070] Figure 8 This is a schematic diagram of the frame of a message transmission device applied to VPCGW1 according to an embodiment of this application;

[0071] Figure 9 This is a schematic diagram of the frame of a message transmission device applied to VPCGW2 according to an embodiment of this application. Detailed Implementation

[0072] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other.

[0073] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0074] IP (Internet Protocol): IP stands for Internet Protocol, and it is a network layer protocol in the TCP / IP architecture.

[0075] VPC (Virtual Private Cloud) is a logically isolated virtual network environment built for cloud resources such as cloud servers, cloud containers, and cloud databases. It is configured and managed by the user and aims to improve the security of user resources and simplify the user's network deployment.

[0076] VTEP (VXLAN Tunnel End Point): The starting and ending point of a VXLAN tunnel.

[0077] VXLAN (Virtual eXtensible LAN): The most important network virtualization technology in cloud computing, it is an overlay technology.

[0078] SDN (Software Defined Network): A network can be defined and controlled through software programming, featuring separation of the control plane and forwarding plane, as well as open programmability.

[0079] OVS (Open Vswitch): is a high-quality virtual switch that supports multi-layer data forwarding. It is mainly deployed on servers and has better programmability than traditional switches. It also has the network isolation and data forwarding functions that traditional switches provide. It runs on each virtualized physical machine and provides remote management.

[0080] VPCGW (Virtual Private Cloud Gateway): In a cloud network, each VPC has its own gateway.

[0081] CIDR (Classless Inter-Domain Routing) eliminates the traditional concepts of Class A, B, and C addresses and subnetting, thus allowing for more efficient allocation of IPv4 address space. It can combine several IP networks using a classless inter-domain routing algorithm, merging them into a single route and reducing the number of routing entries in the routing table, thereby alleviating the burden on Internet routers.

[0082] IPSEC (Internet Protocol Security): Provides security services for packets at the IP layer, ensuring the integrity, privacy, and authenticity of IP packets.

[0083] IKE (Internet Key Exchange Protocol): The key exchange protocol for IPSec;

[0084] ESP (Encapsulating Security Payload): An encryption method in IPsec that provides confidentiality, data source authentication, connectionless integrity, anti-replay service (a form of partial sequence integrity), and limited information flow confidentiality.

[0085] ACL (Access Control Lists): Access Control Lists (ACLs) are a packet filtering-based access control technology that can filter data packets on an interface based on set conditions, allowing them to pass or dropping them.

[0086] ABF (ACL Based Forwarding): Policy-based routing in VPP takes precedence over regular routing.

[0087] Based on the problems existing in related technologies, this application proposes a message transmission method based on Enhanced Virtual Private Cloud Peer Connection (EVPC). It mainly improves and enhances VPC peer connection technology in two aspects, and is defined as Enhanced VPC Peer Connection.

[0088] In traditional VPC peering connections, two VPCs cannot have overlapping CIDR segments, as this would lead to routing conflicts, meaning that packets in a message would not know which VPC to send to.

[0089] This application implements policy-based routing using access control lists and ABF forwarding entries to redirect packets from overlapping CIDR segments in peering connections. This sacrifices traffic from conflicting local CIDRs, avoids routing conflicts within the local VPC, and resolves the issue of CIDRs from two VPCs not conflicting. Even if the CIDR segments of two VPCs overlap, policy-based routing can correctly guide traffic (data packets in the packets), thus avoiding routing conflicts. The main process is as follows: when two VPCs have overlapping CIDR segments, and these overlapping CIDR segments need to communicate with other segments across VPCs, a policy-based route (i.e., an ABF forwarding entry) is issued on the local VCPGW of the source IP address sending the packet. The overlapping CIDR segment is matched using an ACL (Access Control List), and ABF forwarding is performed. Through ABF forwarding, cross-VPC communication of overlapping CIDRs is achieved before local routing queries.

[0090] Meanwhile, the technical solution of this application further enhances the tunnel security between VPCs in the enhanced virtual private cloud peering connection by changing the VXLAN tunnel to VXLAN over IPsec, thereby protecting the tunnel and achieving secure and stable transmission of service traffic between VPCs. The main process is as follows: when the EVPC function is enabled, VPCGWs negotiate IKE and SA through the underlay address to establish an IPsec tunnel, which adopts ESP encryption and IPsec tunnel mode; when the EVPC function is enabled, VCPGW issues a traffic redirection route to redirect VXLAN tunnel traffic to the IPsec tunnel, thereby protecting the tunnel traffic.

[0091] The technical solution of this application is as follows:

[0092] (1) The requirement to forward to the peer VPC when the local VPC has a directly connected route is realized by using forwarding based on access control list (ACL), which solves the restriction that the two VPCs establishing peer connection cannot have overlapping CIDRs.

[0093] (2) The VXLAN tunnel between VPCs is encrypted using the tunnel mode of IPsec, and VXLAN over IPsec is achieved by using static routing of VPCGW, which ensures the security of packet transmission between VPCs.

[0094] (3) An enhanced VPC peering solution was proposed, which optimized the CIDR overlap limitation of VPC, designed a traffic routing, and solved the security problem of VXLAN tunnel.

[0095] The technical solutions of this application will be described in detail below through various embodiments.

[0096] One embodiment of this application provides a message transmission method applied to VPCGW1. Figure 3 This is a schematic flowchart of a message transmission method applied to VPCGW1 according to an embodiment of this application. Figure 4 This is a schematic diagram of an improved enhanced peer-to-peer connection traffic interaction architecture provided in an embodiment of this application, as shown below. Figure 3 As shown, the method includes:

[0097] Step S101: Receive a service message from the OVS bridge of IP2 in VPC1, wherein the service message has at least an inner destination IP address and an outer destination IP address;

[0098] Step S102: Determine whether the destination CIDR of the service packet overlaps with the CIDR network segment of VPC1 where VPCGW1 is located, where VPCGW1 is the gateway of VPC1.

[0099] Step S103: If the destination CIDR of the service packet overlaps with the CIDR network segment of VPC1 where VPCGW1 is located, compare the outer destination IP address of the service packet with the Vtep address of VPCGW1. If the outer destination IP address of the service packet is the same as the Vtep address of VPCGW1, remove the outer layer of the service packet and read the inner destination IP address of the service packet.

[0100] Step S104: If the inner destination IP address is IP1 of VPC2, read the access control list corresponding to IP1 of VPC2. The access control list indicates that IP2 is the source IP address and IP1 is the destination IP address.

[0101] Step S105: According to the access control list, read the ABF forwarding table entry that matches the destination CIDR of the service packet. The ABF forwarding table entry indicates that the service packet with IP2 as the source IP address and IP1 as the destination IP address is forwarded.

[0102] Step S106: According to the ABF forwarding table entry, forward the service packet to the Vtep address of VPCGW2 of VPC2, where VPCGW2 is the gateway of VPC2.

[0103] like Figure 4 The overall architecture of the enhanced VPC peering connection EVPC shown is as follows: VPC1 and VPC2 are two virtual private clouds, VPCGW1 is the gateway of VPC1, and VPCGW2 is the gateway of VPC2. VPC1 and VPC2 have overlapping CIDR network segments. Among them, IP1 belongs to an IP address in this overlapping CIDR network segment, IP2 is an IP address of VPC1, IP3 is an IP address of VPC2, OVS1 is the virtual switch of VPC1, and OVS2 is the virtual switch of VPC2.

[0104] First, in step S101, VPCGW1, acting as the gateway of VPC1, receives a service message from a virtual machine (VM2) with IP address IP2 within VPC1. This service message is sent from IP2 and destined for a specific IP address within VPC2.

[0105] The service message contains at least an inner destination IP address (IP1) and an outer destination IP address (the VTEP address of VPCGW2).

[0106] Furthermore, in step S102, VPCGW1 will receive the service packet sent from IP2 and check whether the destination CIDR of the received service packet (i.e., the CIDR block where IP1 in VPC2 is located) overlaps with the CIDR network segment of VPC1 to determine whether the service packet needs special processing. When they do not overlap, the service packet will be processed through normal routing; when they overlap, further special processing is required to forward the service packet to ensure that the service packet can be correctly transmitted to IP1 in VPC2.

[0107] Furthermore, in step S103, if the destination CIDR of the service packet overlaps with the CIDR network segment of VPC1, VPCGW1 first compares whether the outer destination IP address of the service packet is the same as the VTEP address of VPCGW1 itself. If the outer destination IP address of the service packet is the same as the VTEP address of VPCGW1 itself, it is determined that the service packet is processed by VPCGW1. Therefore, VPCGW1 will remove the outer encapsulation of the service packet and read the inner destination IP address.

[0108] According to relevant technologies, when VPC1 and VPC2 have duplicate CIDRs, and the two duplicate CIDRs have communication needs, a direct route to the CIDR containing IP1 will exist in VPC1. Table 1 shows the direct routes of local VPC1.

[0109] Table 1

[0110]

[0111] As shown in Table 1, when local VPC traffic accesses IP1, it will directly look up the host table in this VPC (i.e., VPC1) and forward it directly, and cannot reach VPC2. Therefore, in order to take priority over local routing forwarding, this application needs to issue an ACL matching the destination CIDR of VPC2 on VPCGW1.

[0112] Furthermore, in step S104, when the inner destination IP address is IP1 in VPC2, VPCGW1 will further read the access control list (ACL) associated with IP1. It will then determine from this ACL whether the service packet with the destination IP address IP1 requires special processing.

[0113] Table 2 is the access control list associated with IP1 shown in this application.

[0114] Table 2

[0115]

[0116] As shown in Table 2. Wherein:

[0117] ID: Aclid, this is the unique identifier for this ACL rule.

[0118] src(source IP): IP2, indicating that this rule will match traffic with source IP address IP2.

[0119] `src_mask` (source IP mask): 32, indicating an exact match of the source IP address. In IPv4, a 32-bit mask precisely matches a specific IP address.

[0120] dst (destination IP): IP1, indicating that this rule will match traffic destined for IP1.

[0121] dst_mask (destination IP mask): 32, indicating an exact match for the destination IP address.

[0122] Protocol: 0, usually indicates matching all protocols. In some ACL configurations, 0 may represent the default protocol, meaning no filtering is based on protocol.

[0123] Sport (Source Port): 0 indicates that the source port number is not checked and all source ports are open.

[0124] Dport (destination port): 0 indicates that the destination port number is not checked and all destination ports are open.

[0125] Priority: 100, indicating the processing priority of this rule among all rules. The smaller the value, the higher the priority.

[0126] Therefore, access control lists can match specific business messages, namely business messages with source IP address IP2 and destination IP address IP1.

[0127] Furthermore, in step S105, VPCGW1 reads the ABF (ACL-based forwarding) forwarding table entry corresponding to the access control list based on the rules of the matching access control list and the ID of the access control list, i.e., the unique identifier.

[0128] Table 3

[0129]

[0130] Table 3 shows the ABF forwarding table entries as illustrated in this application, where:

[0131] ABF forwarding entries are shown in Table 3, where:

[0132] Policyid (Policy ID): Id1, which is the unique identifier for this policy routing rule.

[0133] Ac1 (ACL Rule ID): Acid, indicating that this policy routing rule is based on the ACL rules defined in Table 1. This policy routing rule will be applied when traffic matches the ACL rules in Table 1.

[0134] Next_Hop_IP: Vpcgw2_Vtep_IP, this is the IP address of the VPC2 gateway's VTEP (VXLAN Tunnel Endpoint). This means that packets matching the ACL rules will be forwarded to this IP address.

[0135] Nexthop_Interface: Vxlan_tunnel100, this is the interface name of the VXLAN tunnel. Packets will be forwarded to VPC2 through this VXLAN tunnel interface.

[0136] Attach_Interface: Loop100, this is the loopback interface of the VPC1 gateway. Bind the ABF policy to this interface to make it effective, ensuring that traffic matching the ACL rules is processed through this interface.

[0137] Therefore, this ABF forwarding table entry is used to guide VPCGW1 to process the next-hop address and next-hop interface of service packets that match the source IP and destination IP in the access control list. That is, through the next-hop address and next-hop interface in the ABF forwarding table, the service packets are forwarded from VPC1 to VPC2, ensuring that the service packets can be accurately forwarded even when IP addresses overlap.

[0138] Finally, in step S106, VPCGW1 forwards the service packets to the VTEP address of VPCGW2 through the VXLAN tunnel established between VPCGW1 and VPCGW2 according to the ABF forwarding table entries, so that VPCGW2 can pass the service packets to IP1 of VPC2, thereby completing the transmission of service packets from VPC1 to VPC2, ensuring that even in the case of CIDR overlap, service packets sent to IP addresses in CIDR overlap can be correctly transmitted.

[0139] Through the above embodiments, configuring ACL and ABF rules on VPCGW1 ensures that service packets are correctly transmitted from IP2 to IP1 even if the CIDR segments of VPC1 and VPC2 overlap. Using access vacant lists and AFB forwarding entries allows network administrators to flexibly define and apply traffic rules to adapt to different network needs and security policies. The application of this policy routing reduces unnecessary network hops, improves the efficiency and speed of data transmission, and effectively solves the CIDR overlap problem in inter-VPC communication, while improving the flexibility, security and performance of the network.

[0140] Optionally, the method further includes:

[0141] If the destination CIDR of the service packet does not overlap with the CIDR network segment of the VPC1 where the VPCGW1 is located, read the peer connection route that matches the destination CIDR of the service packet.

[0142] According to the peer connection route, the service packets are forwarded to the Vtep address of the VPCGW2.

[0143] Specifically, in one embodiment, when the destination CIDR of the service packet does not overlap with the CIDR network segment of VPC1 where VPCGW1 is located, VPCGW1 will read the peer connection route that matches the destination CIDR of the service packet. The peer connection route is a routing table entry that defines how to route the service packet from VPC1 to VPC2. The peer connection route includes the destination, mask, next hop, and next hop IP address. For example, when the destination IP address is IP3 of VPC2, Table 4 shows the peer connection route corresponding to IP3.

[0144] Table 4

[0145]

[0146] in:

[0147] Destination: The CIDR corresponding to IP3 is a specific network segment within VPC2 and does not overlap;

[0148] Mask: 24, indicating that the subnet mask is 255.255.255.0, which is a typical Class C network mask;

[0149] Next_Hop (Next_Hop: VPC Peer, indicating that the next hop is made through a VPC peer connection);

[0150] Next_Hop_IP: Vpcgw2_Vtep_IP, which is the VTEP (VXLAN TunnelEndpoint) IP address of the VPC2 gateway, i.e., the VXLAN tunnel endpoint of VPC2.

[0151] As shown in Table 4, the CIDR route to IP3 in VPC2 has a peer connection as the next hop, and the next hop address is the VTEP IP address of the peer's VXLAN, which is Vpcgw2_Vtep_IP.

[0152] Therefore, after VPCGW1 reads the peering route that matches the destination CIDR of the service packet, it looks up the route entry in VPCGW1's peering routes that corresponds to the destination CIDR of the service packet. For example, if the destination CIDR of the service packet is 192.168.2.0 / 24 (belonging to a non-overlapping CIDR of VPC2), and according to the read peering route, VPCGW1 forwards the service packet to the VTEP address of VPCGW2, thereby ensuring that the service packet can be correctly transmitted to VPC2 through the established VPC peering connection and VXLAN tunnel.

[0153] Through the above embodiments, in the case of non-overlapping CIDRs, routing conflicts and unnecessary complexity can be reduced and routing efficiency can be improved by directly using peer-to-peer connection routes.

[0154] Optionally, the structure of the service message is a VXLAN structure;

[0155] The inner source IP address of the service packet is IP2, the inner destination IP address of the service packet is IP1 of VPC2, the inner source MAC address of the service packet is the MAC address of the VM of IP2, the inner destination MAC address of the service packet is the MAC address of VPCGW1, the outer source IP address of the service packet is the Vtep address of the OVS corresponding to the VM, and the outer destination IP address of the service packet is the Vtep address of VPCGW1.

[0156] Specifically, in one embodiment, the service packet structure is a VXLAN structure. The OVS of the VM of IP2 (i.e., Figure 4 The service packets of the VXLAN structure obtained by OVS1 encapsulation are shown in Table 5.

[0157] Table 5

[0158]

[0159] By encapsulating data packets into VXLAN message format, OVS1 forwards VXLAN structured service messages to VPCGW1. In Table 5, the service messages are encapsulated in the VXLAN header, which contains the necessary information to ensure that the messages can be correctly transmitted in the VXLAN network.

[0160] In Table 5, the inner source IP address of the service packet is IP, and the inner destination IP address is IP1 of VPC2. The inner source MAC address of the service packet is the MAC address of the VM of IP2, and the inner destination MAC address is the MAC address of VPCGW1. The outer source IP address of the service packet is the VTEP address of the OVS corresponding to the VM of IP2, i.e., OVS1-VTEP-IP. The outer destination IP address of the service packet is the VTEP address of VPCGW1, and the outer destination IP address is the IP address of the VTEP of the VPC1 gateway VPCGW1, i.e., VPCGW1-VTEP-IP, which is used for routing in the VXLAN tunnel.

[0161] Following step S103 above, the encapsulated service packet received by VPCGW1 as shown in Table 5 can be determined to be processed by VPCGW1 based on the outer destination IP address (VPCGW1-VTEP-IP). Therefore, VPCGW1 will remove the outer encapsulation of the service packet, read the inner destination IP address (IP1), and then perform policy routing by matching ABF forwarding table entries according to Tables 2 and 3, forwarding the service packet to the VXLAN tunnel of the VPC peering connection to achieve cross-VPC forwarding.

[0162] After receiving the encapsulated service packets shown in Table 5, VPCGW1 will rewrite the encapsulated service packets shown in Table 5 before sending them to the VXLAN tunnel, resulting in the service packets encapsulated by VPCGW1 shown in Table 6.

[0163] Table 6

[0164]

[0165] The difference between Table 6 and Table 5 is that the inner source IP address and destination IP address of the VXLAN packet remain unchanged. VPCGW1 changes the source MAC address to its own MAC address, VPCGM1-Mac, and the destination MAC address to VPCGW2's MAC address, VPCGM2-Mac. The outer source IP address changes to VPCGW1's VTEP address, VPCGW1-VTEP-IP, and the outer destination IP address changes to VPCGW2's VTEP address, VPCGW2-VTEP-IP. This ensures that packets can be correctly routed from VPCGW1 to VPCGW2 in the Underlay network.

[0166] Optionally, forwarding the service packet to the Vtep address of VPCGW2 according to the ABF forwarding table entry or the peer connection route includes:

[0167] Establish an IPsec tunnel for the underlay address between VPCGW1 and VPCGW2, wherein the underlay address of VPCGW1 is IPsec-Local-IP and the underlay address of VPCGW2 is IPsec-Peer-IP;

[0168] Read the static routes of the VPCGW1 and encapsulate the service packets using IPsec.

[0169] The service packets, after being encapsulated in IPsec, are sent to the Vtep address of the VPCGW2.

[0170] Specifically, in one embodiment, for both cases where there is overlap, the VXLAN tunnel for transmitting service messages can be securely encrypted to ensure the security of the service message transmission process.

[0171] First, when secure encryption is required, an IPsec tunnel is established between the underlay addresses of VPCGW1 and VPCGW2. This secure encrypted channel between the two VPC gateways ensures the security and integrity of service packet transmission. Specifically, the underlay address of VPCGW1 is configured as IPsec-Local-IP, serving as the local endpoint of the IPsec tunnel; the underlay address of VPCGW2 is configured as IPsec-Peer-IP, serving as the peer endpoint of the IPsec tunnel.

[0172] Next, the static routes of VPCGW1 are read, and the service packets are encapsulated with IPsec. This step ensures that the service packets can be securely transmitted through the IPsec tunnel before being sent to VPCGW2. Specifically, VPCGW1 determines the destination IP address of the service packets (i.e., the VTEP address of VPCGW2) based on the entries in the static routing table, and performs IPsec encapsulation on the service packets, including adding an IPsec header and encrypting the packet content.

[0173] Finally, the IPsec-encapsulated service message is transmitted to the VTEP address of VPCGW2 through the established IPsec tunnel. This completes the secure transmission of the service message, which is encrypted during transmission to prevent data packets from being stolen or tampered with. Upon arrival at VPCGW2, the IPsec encapsulation is decapsulated, restoring the original service message, which is then forwarded to the destination IP address within the service message.

[0174] For example, the static routes for VPCGW1 are shown in Table 7, which are used to introduce service packets from the VXLAN tunnel into the IPsec tunnel for encrypted transmission.

[0175] Table 7

[0176]

[0177] This example illustrates the case of overlapping routes (i.e., the destination IP address is IP1). The static route configuration for VPCGW1 shown in Table 7 is as follows:

[0178] The outer destination IP of the VXLAN is set to the VTEP IP address of VPCGW2 (Vpcgw2_Vtep_IP). When VPCGW1 receives a service packet with the outer destination IP address Vpcgw2_Vtep_IP, it will process it according to the static route in Table 7.

[0179] Next-hop address (Nexthot_IP): Set to the peer address of the IPsec tunnel, i.e., IPsec_Peer_IP. This is the IP address of VPCGW2, which is the other endpoint of the IPsec tunnel relative to VPCGW1.

[0180] Nexthop Interface: Set to the IPsec tunnel interface, i.e., IPsec_Tunnel100. This is the interface configured on VPCGW1, used to establish an IPsec tunnel with VPCGW2.

[0181] When IP2 in VPC1 needs to send data to IP1 in VPC2, the service packet is first sent to VPCGW1. VPCGW1 encapsulates these service packets in a VXLAN header according to the static route configured above, and sends them to the VTEP address (Vpcgw2_Vtep_IP) of VPCGW2.

[0182] In the presence of an IPsec tunnel, VPCGW1 will match the destination IP address (Vpcgw2_Vtep_IP) of the service packet with its static route configuration. Therefore, VPCGW1 will encapsulate the VXLAN format service packet shown in Table 6 with IPsec, resulting in... Figure 5 The image shows a service packet encapsulated using IPsec.

[0183] Optionally, in one embodiment, the structure of the service packet after IPsec encapsulation is a VXLAN over IPsec structure; wherein, the source IP address of the outer IPsec tunnel of the service packet after IPsec encapsulation is IPsec-Lcoal-IP of VPCGW1, and the destination IP address of the outer IPsec tunnel of the service packet after IPsec encapsulation is IPsec-Peer-IP of VPCGW2; the inner source IP address of the service packet after IPsec encapsulation is IP2, the inner destination IP address of the service packet after IPsec encapsulation is IP1, the inner source MAC of the service packet after IPsec encapsulation is the MAC of VPCGW1, the inner destination MAC of the service packet after IPsec encapsulation is the MAC of VPCGW2, the outer source IP address of the service packet after IPsec encapsulation is the Vtep address of VPCGW2, and the outer destination IP address of the service packet after IPsec encapsulation is the Vtep address of VPCGW2.

[0184] Among them, Figure 5 In this structure, the entire service packet after IPsec encapsulation is a VXLAN over IPsec structure. Within the IPsec tunnel, VPCGW1 encapsulates the service packets (as shown in Table 6) using IPsec to obtain the ESP encrypted payload, effectively encrypting the VXLAN packets into an ESP payload. The source IP address of the outer IPsec tunnel is VPCGW1's IPsec-Local-IP, and the destination IP address is VPCGW2's IPsec-Peer-IP. The ESP encrypted payload contains the encrypted VXLAN service packets.

[0185] Then, through the IPsec tunnel interface (IPsec_Tunnel100), Figure 5The service messages are sent to the Vtep address of VPCGW2. During this process, the IPsec tunnel provides encryption and authentication for the service messages, ensuring the security of data packet transmission within the service messages. This allows VPCGW2 to receive... Figure 5 After the service message is received, it is first decapsulated through the IPsec tunnel, then the VXLAN header is decapsulated to recover the original service message data packet. Based on the destination IP address in the service message, the data packet is forwarded to IP1 in VPC2. In this way, the VXLAN tunnel traffic between VPC1 and VPC2 is securely encapsulated within the IPsec tunnel, ensuring the security and integrity of the data during transmission. Even if the data packet is transmitted over a public network, confidentiality and integrity are maintained.

[0186] Through the above embodiments, IPsec tunnels are established between VPC gateways. These IPsec tunnels provide stable encryption, reducing the risk of communication interruptions due to network attacks, ensuring the security of business messages during transmission, and preventing data leakage and tampering. This effectively improves the security and reliability of cross-VPC communication.

[0187] Based on the same inventive concept, another embodiment of this application also provides a message transmission method applied to VPCGW2. Figure 6 This is a flowchart of a message transmission method applied to VPCGW2 provided in another embodiment of this application, as shown below. Figure 6 As shown, the method includes:

[0188] Step S201: Receive a service message from VPCGW1, where VPCGW1 is the gateway of VPC1 and VPCGW2 is the gateway of VPC2.

[0189] Step S202: Compare the outer destination IP address of the service packet with the Vtep address of the VPCGW2. If the outer destination IP address of the service packet is the same as the Vtep address of the VPCGW2, remove the outer layer of the service packet and read the inner destination IP address of the service packet.

[0190] Step S203: If the inner destination IP address is IP1 of VPC2, forward the service packet to IP1 of VPC2.

[0191] First, in step S201, VPCGW2 receives service messages from VPCGW1. Here, VPCGW1 is the gateway of VPC1, responsible for communication between devices in VPC1 and external networks (including VPC2); while VPCGW2 is the gateway of VPC2, responsible for communication between devices in VPC2 and external networks (including VPC1).

[0192] Further, in step S202, VPCGW2 compares the outer destination IP address of the received service packet with its own VTEP address. The VTEP address is a specific IP address used in a virtual network environment to identify the interface of a virtual network device. When the outer destination IP address is the same as VPCGW2's VTEP address, it indicates that the service packet is intended for VPCGW2. VPCGW2 will then remove the outer encapsulation of this service packet to read the inner destination IP address.

[0193] Furthermore, in step S203, after removing the outer layer, VPCGW2 checks the inner destination IP address of the service packet. If this inner destination IP address is a specific IP address in VPC2 (such as IP1), then VPCGW2 forwards the service packet to the corresponding IP1 device in VPC2. This process ensures that the packet can be correctly transmitted from VPC1 to the designated device in VPC2.

[0194] By comparing the destination IP address and the VTEP address, it is determined whether the outer encapsulation needs to be removed, and then the packet is forwarded based on the inner destination IP address. This mechanism can be used to enable communication between different Virtual Private Clouds, such as transferring data between different VPCs of a cloud service provider.

[0195] Optionally, the method further includes:

[0196] Receive service packets from VPCGW1 that have been encapsulated in IPsec;

[0197] The destination IP address of the outer IPsec tunnel of the service packet is compared with the underlay address of VPCGW2. If the destination IP address of the outer IPsec tunnel of the service packet is the same as the underlay address of VPCGW2, the outer IPsec tunnel of the service packet after IPsec encapsulation is removed, and the outer destination IP address of the service packet is read.

[0198] Compare the outer destination IP address of the service packet with the Vtep address of the VPCGW2. If the outer destination IP address of the service packet is the same as the Vtep address of the VPCGW2, remove the outer layer of the service packet and read the inner destination IP.

[0199] If the inner destination IP address is IP1 of VPC2, the service packet is forwarded to IP1 of VPC2.

[0200] Specifically, in one embodiment, when VPCGW2 receives a service packet from VPCGW1, and the service packet has been encapsulated using the IPsec protocol, VPCGW2 needs to compare the destination IP address of the outer IPsec tunnel of the received IPsec-encapsulated service packet with VPCGW2's own underlay address, that is, compare it with VPCGW2's IP address in the physical network.

[0201] When the destination IP address of the outer IPsec tunnel of a service packet encapsulated in IPsec is the same as the underlay address of VPCGW2, it indicates that the encapsulated service packet is intended for VPCGW2. VPCGW2 will then dismantle the outer IPsec tunnel of this encapsulated service packet to read the inner destination IP address.

[0202] After the removal, VPCGW2 compares the outer destination IP address of the IPsec-encapsulated service packet with its own VTEP address. The VTEP address is the IP address that VPCGW2 uses to identify the interface of the virtual network device in the virtual network environment.

[0203] When the outer destination IP address of a service message is the same as the VTEP address of VPCGW2, VPCGW2 will remove the outer encapsulation of the message and read the inner destination IP address.

[0204] When the inner destination IP address is a specific IP address in VPC2 (e.g., IP1), VPCGW2 will forward this service packet to the corresponding IP1 device in VPC2.

[0205] This ensures that IPsec-encrypted service packets can be securely transmitted from VPCGW1 to VPCGW2 and ultimately reach the target device in VPC2, thus enhancing the security of data transmission.

[0206] The process of the enhanced peer-to-peer VPCGW for peer-to-peer services will be described below with reference to the above embodiments. Figure 7 This is a flowchart illustrating the process of a VPCGW providing peer-to-peer services for enhanced peer-to-peer connections, as shown in one embodiment of this application. Figure 7 As shown, VPCGW represents the gateway of the VPC that sends service messages, and is not limited to VPCGW1 and VPCGW2.

[0207] When the VPCGW receives a peering service packet, it first determines whether the Enhanced VPC Peering (EVPC) function is enabled. If it is not enabled, it follows the normal peering service process, that is, it matches the static route of the destination CIDR to the service packet. Referring to Table 1, the service packet of the destination CIDR is redirected to the VXLAN tunnel of the peering connection. After entering the VXLAN tunnel, it is forwarded normally without IPsec encryption protection.

[0208] When the EVPC function in this application's technical solution is enabled, the system continues to determine whether the destination IP address of the service packet overlaps with the CIDR network segment within the VPC where the VPCGW resides. If they do not overlap, the service packet matches the static route of the destination IP address (referring to Table 4), redirects the traffic to the peering VXLAN tunnel, encapsulates the VXLAN tunnel, and then redirects the VXLAN tunnel traffic to the IPsec tunnel via static routing, thus protecting the peering service traffic with IPsec encryption. If the destination CIDR has a duplicate network segment with the local VPC, the service packet undergoes the ABF (Advanced Bypass, Advancement, and Forward) process. After obtaining the destination IP address and matching it with the access control list, it is forwarded based on the ABF forwarding table (referring to Tables 2 and 3), redirecting the service packet to the peering VXLAN tunnel. After encapsulating it into VXLAN tunnel traffic, the system looks up the static route of the outer destination IP address (referring to Table 7) and encapsulates the VXLAN packet with IPsec to protect the tunnel between the two VPCs with IPsec encryption. This optimizes and enhances traditional VPC peering technology. By using access control lists and ABF forwarding table entries for policy routing, combined with static routing for IPsec traffic redirection, it solves the limitation that CIDR overlap cannot occur across VPCs, and achieves stable, encrypted, and secure transmission of traffic between VPCs.

[0209] Through the above embodiments, the technical solution of this application can achieve the following technical effects:

[0210] (1) The forwarding based on the access control list is used to realize the requirement of forwarding from the local VPC to the peer VPC when there is a direct route (i.e. there is an overlapping CIDR network segment). This solves the restriction that the two VPCs establishing a peer connection cannot have overlapping CIDRs. There is a traffic communication requirement between VPCs. The priority of this communication requirement is higher than the traffic communication requirement between local VPCs. Therefore, the overlapping CIDRs are redirected through policy routing to realize cross-VPC communication of CIDR network segments that overlap with the local VPC.

[0211] (2) Encrypting the VXLAN tunnels between VPCs using IPsec tunneling mode, and implementing VXLAN over IPsec through static routing in the VPCGW, ensures the security of packet transmission between VPCs. Underlay negotiations between VPCGWs establish IPsec tunnels; here, the IPsec scheme using ESP tunneling mode is selected to protect VXLAN packets. This meets the network's network security requirements and improves the security level of the resource pool.

[0212] (3) An enhanced VPC peering solution was proposed, which optimized the CIDR overlap limitation of VPC, designed a traffic routing system, and solved the security problem of VXLAN tunnels. The functionality and security defects of traditional peering were optimized, and the peering technology was improved, making cross-VPC technology more widely applicable.

[0213] Based on the same inventive concept, another embodiment of this application also provides a message transmission device applied to VPCGW1. Figure 8 This is a schematic diagram of the frame of a message transmission device applied to VPCGW1 according to an embodiment of this application, as shown below. Figure 8 As shown, the device includes:

[0214] The first receiving module 11 is used to receive service packets from the OVS bridge of IP2 in VPC1, wherein the service packets have at least an inner destination IP address and an outer destination IP address.

[0215] The judgment module 12 is used to determine whether the destination CIDR of the service packet overlaps with the CIDR network segment of the VPC1 where the VPCGW1 is located, and the VPCGW1 is the gateway of the VPC1.

[0216] The first comparison module 13 is used to compare the outer destination IP address of the service packet with the Vtep address of the VPCGW1 when the destination CIDR of the service packet overlaps with the CIDR network segment of the VPCGW1. If the outer destination IP address of the service packet is the same as the Vtep address of the VPCGW1, the outer layer of the service packet is removed and the inner destination IP address of the service packet is read.

[0217] Access control list reading module 14 is used to read the access control list corresponding to IP1 of VPC2 when the inner destination IP address is IP1 of VPC2.

[0218] ABF forwarding table entry reading module 15 is used to read ABF forwarding table entries that match the destination CIDR of the service message according to the access control list;

[0219] The first forwarding module 16 is used to forward the service packet to the Vtep address of VPCGW2 of VPC2 according to the ABF forwarding table entry, wherein VPCGW2 is the gateway of VPC2.

[0220] Optionally, the device further includes:

[0221] The peer connection route reading module is used to read the peer connection route that matches the destination CIDR of the service packet when the destination CIDR of the service packet does not overlap with the CIDR network segment of the VPC1 where the VPCGW1 is located.

[0222] The third forwarding module is used to forward the service packets to the Vtep address of the VPCGW2 according to the peer connection route.

[0223] Optionally, the device further includes:

[0224] The IPsec tunnel establishment module is used to establish an IPsec tunnel between VPCGW1 and VPCGW2 using the underlay address, wherein the underlay address of VPCGW1 is IPsec-Local-IP and the underlay address of VPCGW2 is IPsec-Peer-IP.

[0225] The static route reading module is used to read the static routes of the VPCGW1 and encapsulate the service packets using IPsec.

[0226] The sending module is used to send the service packets, which are encapsulated in IPsec, to the Vtep address of the VPCGW2.

[0227] Based on the same inventive concept, another embodiment of this application also provides a message transmission device applied to VPCGW2. Figure 9 This is a schematic diagram of the frame of a message transmission device applied to VPCGW2 according to an embodiment of this application, as shown below. Figure 9 As shown, the device includes:

[0228] The second receiving module 21 is used to receive service packets from VPCGW1, where VPCGW1 is the gateway of VPC1 and VPCGW2 is the gateway of VPC2.

[0229] The second comparison module 22 is used to compare the outer destination IP address of the service packet with the Vtep address of the VPCGW2. If the outer destination IP address of the service packet is the same as the Vtep address of the VPCGW2, the outer layer of the service packet is removed and the inner destination IP address of the service packet is read.

[0230] The second forwarding module 23 is used to forward the service packet to IP1 of VPC2 when the inner destination IP address is IP1 of VPC2.

[0231] Optionally, the device further includes:

[0232] The third receiving module is used to receive service packets from VPCGW1 after being encapsulated in IPsec.

[0233] The third comparison module is used to compare the destination IP address of the outer IPsec tunnel of the service packet with the underlay address of VPCGW2. If the destination IP address of the outer IPsec tunnel of the service packet is the same as the underlay address of VPCGW2, the outer IPsec tunnel of the service packet after IPsec encapsulation is removed and the outer destination IP address of the service packet is read.

[0234] The fourth comparison module is used to compare the outer destination IP address of the service packet with the Vtep address of the VPCGW2. If the outer destination IP address of the service packet is the same as the Vtep address of the VPCGW2, the outer layer of the service packet is removed and the inner destination IP is read.

[0235] The fourth forwarding module is used to forward the service packet to IP1 of VPC2 when the inner destination IP address is IP1 of VPC2.

[0236] Based on the same inventive concept, another embodiment of this application provides an electronic device, including a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the message transmission method as described in any of the above embodiments.

[0237] Based on the same inventive concept, another embodiment of this application also provides a computer program product, including a computer program that is executed by a processor using the message transmission method as described in any of the above embodiments.

[0238] Based on the same inventive concept, another embodiment of this application provides a computer-readable storage medium having a computer program stored thereon, wherein the program, when executed by a processor, implements the message transmission method as described in any of the above embodiments.

[0239] As the apparatus is basically similar to the method embodiment, it is described in a relatively simple way. For relevant details, please refer to the description of the method embodiment.

[0240] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.

[0241] Those skilled in the art will understand that embodiments of this application can be provided as methods, apparatus, or computer program products. Therefore, embodiments of this application can take the form of entirely hardware embodiments, entirely software embodiments, or embodiments combining software and hardware aspects. Furthermore, embodiments of this application can take the form of computer program products implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0242] This application describes embodiments with reference to flowchart illustrations and / or block diagrams of methods, terminal devices (systems), and computer program products according to embodiments of this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing terminal device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing terminal device, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0243] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing terminal device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0244] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal equipment, causing a series of operational steps to be performed on the computer or other programmable terminal equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable terminal equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0245] Although preferred embodiments of the present application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the embodiments of the present application.

[0246] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or terminal device. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or terminal device that includes the element.

[0247] The above provides a detailed description of a message transmission method, apparatus, and device provided in this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The description of the above embodiments is only for the purpose of helping to understand the method and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A message transmission method, characterized in that, Applied to VPCGW1, the method includes: Receive service packets from the OVS bridge in IP2 of VPC1, wherein the service packets have at least an inner destination IP address and an outer destination IP address; Determine whether the destination CIDR of the service message overlaps with the CIDR network segment of VPC1 where VPCGW1 is located; VPCGW1 is the gateway of VPC1. If the destination CIDR of the service packet overlaps with the CIDR network segment of VPC1 where VPCGW1 is located, the outer destination IP address of the service packet is compared with the Vtep address of VPCGW1. If the outer destination IP address of the service packet is the same as the Vtep address of VPCGW1, the outer layer of the service packet is removed and the inner destination IP address of the service packet is read. When the inner destination IP address is IP1 of VPC2, the access control list corresponding to IP1 of VPC2 is read. The access control list indicates that IP2 is the source IP address and IP1 is the destination IP address. According to the access control list, read the ABF forwarding table entry that matches the destination CIDR of the service packet. The ABF forwarding table entry indicates that the service packet with IP2 as the source IP address and IP1 as the destination IP address is forwarded. According to the ABF forwarding table entry, the service message is forwarded to the Vtep address of VPCGW2 of VPC2, where VPCGW2 is the gateway of VPC2.

2. The message transmission method according to claim 1, characterized in that, The method further includes: If the destination CIDR of the service packet does not overlap with the CIDR network segment of the VPC1 where the VPCGW1 is located, read the peer connection route that matches the destination CIDR of the service packet. According to the peer connection route, the service packets are forwarded to the Vtep address of the VPCGW2.

3. The message transmission method according to claim 2, characterized in that, The step of forwarding the service packet to the Vtep address of VPCGW2 according to the ABF forwarding table entry or the peer connection route includes: Establish an IPsec tunnel for the underlay address between VPCGW1 and VPCGW2, wherein the underlay address of VPCGW1 is IPsec-Local-IP and the underlay address of VPCGW2 is IPsec-Peer-IP; Read the static routes of the VPCGW1 and encapsulate the service packets using IPsec. The service packets, after being encapsulated in IPsec, are sent to the Vtep address of the VPCGW2.

4. The message transmission method according to any one of claims 1-3, characterized in that, The structure of the service message is a VXLAN structure; The inner source IP address of the service packet is IP2, the inner destination IP address of the service packet is IP1 of VPC2, the inner source MAC address of the service packet is the MAC address of the VM of IP2, the inner destination MAC address of the service packet is the MAC address of VPCGW1, the outer source IP address of the service packet is the Vtep address of the OVS corresponding to the VM, and the outer destination IP address of the service packet is the Vtep address of VPCGW1.

5. The message transmission method according to claim 4, characterized in that, The structure of the service packet after IPsec encapsulation is the VXLAN over IPsec structure; The source IP address of the outer IPsec tunnel of the service packet after IPsec encapsulation is IPsec-Lcoal-IP of VPCGW1, and the destination IP address of the outer IPsec tunnel of the service packet after IPsec encapsulation is IPsec-Peer-IP of VPCGW2. The inner source IP address of the IPsec-encapsulated service packet is IP2, the inner destination IP address of the IPsec-encapsulated service packet is IP1, the inner source MAC address of the IPsec-encapsulated service packet is the MAC address of VPCGW1, the inner destination MAC address of the IPsec-encapsulated service packet is the MAC address of VPCGW2, the outer source IP address of the IPsec-encapsulated service packet is the Vtep address of VPCGW2, and the outer destination IP address of the IPsec-encapsulated service packet is the Vtep address of VPCGW2.

6. A message transmission method, characterized in that, Applied to VPCGW2, the method includes: Receive service packets encapsulated in IPsec from VPCGW1; VPCGW1 is the gateway of VPC1, and VPCGW2 is the gateway of VPC2. The destination IP address of the outer IPsec tunnel of the service packet is compared with the underlay address of VPCGW2. If the destination IP address of the outer IPsec tunnel of the service packet is the same as the underlay address of VPCGW2, the outer IPsec tunnel of the service packet after IPsec encapsulation is removed, and the outer destination IP address of the service packet is read. Compare the outer destination IP address of the service packet with the Vtep address of the VPCGW2. If the outer destination IP address of the service packet is the same as the Vtep address of the VPCGW2, remove the outer layer of the service packet and read the inner destination IP. If the inner destination IP address is IP1 of VPC2, the service packet is forwarded to IP1 of VPC2.

7. A message transmission device, characterized in that, Applied to VPCGW1, the device includes: The first receiving module is used to receive service packets from the OVS bridge of IP2 in VPC1, wherein the service packets have at least an inner destination IP address and an outer destination IP address. The judgment module is used to determine whether the destination CIDR of the service packet overlaps with the CIDR network segment of VPC1 where VPCGW1 is located, and VPCGW1 is the gateway of VPC1; The first comparison module is used to compare the outer destination IP address of the service packet with the Vtep address of the VPCGW1 when the destination CIDR of the service packet overlaps with the CIDR network segment of the VPCGW1. If the outer destination IP address of the service packet is the same as the Vtep address of the VPCGW1, the outer layer of the service packet is removed and the inner destination IP address of the service packet is read. The access control list reading module is used to read the access control list corresponding to IP1 of VPC2 when the inner destination IP address is IP1 of VPC2. The ABF forwarding table entry reading module is used to read the ABF forwarding table entry that matches the destination CIDR of the service message according to the access control list; The first forwarding module is used to forward the service packet to the Vtep address of VPCGW2 of VPC2 according to the ABF forwarding table entry, wherein VPCGW2 is the gateway of VPC2.

8. A message transmission device, characterized in that, Applied to VPCGW2, the device includes: The third receiving module is used to receive service packets from VPCGW1 after being encapsulated in IPsec. The third comparison module is used to compare the destination IP address of the outer IPsec tunnel of the service packet with the underlay address of VPCGW2. If the destination IP address of the outer IPsec tunnel of the service packet is the same as the underlay address of VPCGW2, the outer IPsec tunnel of the service packet after IPsec encapsulation is removed and the outer destination IP address of the service packet is read. The fourth comparison module is used to compare the outer destination IP address of the service packet with the Vtep address of the VPCGW2. If the outer destination IP address of the service packet is the same as the Vtep address of the VPCGW2, the outer layer of the service packet is removed and the inner destination IP is read. The fourth forwarding module is used to forward the service packet to IP1 of VPC2 when the inner destination IP address is IP1 of VPC2.

9. An electronic device, characterized in that, It includes a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the message transmission method as described in any one of claims 1-6.

Images