Communication method and device

Abstract

The invention provides a communication method and device, and the method comprises the steps: receiving a first DNS response message sent by third network equipment, and enabling the first DNS response message to comprise a source port number and a target MAC address; if the cache record of the first DNS request message does not exist locally, identifying whether the source port number is a first value and whether the destination MAC address is the same as the MAC address of a first interface included in the first network device; and if the source port number is a first value and the destination MAC address is the same as the MAC address of the first interface, sending the first DNS response message to the second network device through a Peer link, so that the second network device sends a second DNS response message to a DNS client through a fourth network device.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a communication method and device. Background Art

[0002] Multichassis link aggregation (MLAG) is the process of virtualizing two physical devices into one network device at the aggregation level, thereby achieving cross-device link aggregation. MLAG provides device-level redundancy protection and traffic load sharing.

[0003] See also Figure 1 , Figure 1 The following is a schematic diagram of the existing MLAG networking model. Figure 1 In the example, network device 1 and network device 2 share the load and forward service traffic together. When any network device in the MLAG network fails, service traffic can be quickly switched to another network device to ensure the normal operation of the service.

[0004] As an application scenario, MLAG networking can deploy Domain Name System (DNS) proxy technology. Both network devices in the MLAG network can be deployed as DNS proxies or DNS transparent proxies. Figure 1 As shown in the figure, when the DNS client initiates a DNS request for the host.com domain name, the DNS request message arrives at switch B. Since the link aggregation between Switch B and network device 1 and network device 2 forms load balancing, the DNS request message can be hashed to any network device.

[0005] When network device 1 receives the DNS request message, it sends the DNS request message to the DNS server through SwitchA. The DNS server processes the DNS request message and sends a DNS response message to SwitchA, which includes the IP address corresponding to the host.com domain name. Similarly, since the link aggregation between SwitchA and network devices 1 and 2 forms load balancing, the DNS response message can be hashed to any network device.

[0006] When network device 2 receives the DNS response message, since the DNS request message was not sent by network device 2, there is no relevant information of the corresponding DNS request message in network device 2, resulting in network device 2 being unable to correctly resolve the DNS response message and unable to generate the corresponding DNS domain name resolution table entry. Network device 2 is also unable to continue to send DNS response messages to the DNS client.

[0007] Further, when network device 1 receives the DNS response message, since the DNS request message is sent by network device 1, the relevant information of the corresponding DNS request message exists in network device 1. According to the relevant information of the DNS request message, network device 1 parses the DNS response message, and generates a corresponding DNS domain name resolution table entry according to the DNS request message and the DNS response message. Network device 1 sends the DNS response message to the DNS client, so that the DNS client initiates access to the host according to the IP address included in the DNS response message.

[0008] When the service message sent by the DNS client is sent by SwitchB to network device 2, if an object group with the host name host.com is configured in network device 2 and the object group is referenced by the security policy or access control list (ACL). From the above process, it can be seen that the DNS domain name resolution table entry is generated by network device 1, and there is no DNS domain name resolution table entry in network device 2, and the object group cannot obtain the Internet Protocol (IP) address corresponding to host.com, resulting in the network device discarding the service message and the DNS client failing to access the host.

[0009] In summary, when DNS proxy technology is deployed in MLAG networking, the following problems will be exposed: 1) Path inconsistency causes the DNS client to be unable to obtain the IP address corresponding to the domain name; 2) The object group cannot obtain the IP address corresponding to the domain name, causing the DNS client to be unable to access the domain name. Summary of the invention

[0010] In view of this, the present application provides a communication method and device to solve the problem that when the DNS proxy technology is deployed in the existing MLAG network, the path inconsistency occurs, resulting in the DNS client being unable to obtain the IP address corresponding to the domain name and the object group being unable to obtain the IP address corresponding to the domain name, resulting in the DNS client being unable to access the domain name.

[0011] In a first aspect, the present application provides a communication method, the method being applied to a first network device, the first network device being in an MLAG network, the MLAG network further comprising a second network device, the second network device having sent a first DNS request message to a DNS server through a third network device, the method comprising:

[0012] Receive a first DNS response message sent by the third network device, where the first DNS response message includes a source port number and a destination MAC address;

[0013] If there is no cache record of the first DNS request message locally, identifying whether the source port number is a first value and whether the destination MAC address is the same as the MAC address of the first interface included in the first network device;

[0014] If the source port number is the first value and the destination MAC address is the same as the MAC address of the first interface, the first DNS response message is sent to the second network device through the Peer link, so that the second network device sends the second DNS response message to the DNS client through the fourth network device.

[0015] In a second aspect, the present application provides a communication device, the device is applied to a first network device, the first network device is in an MLAG network, the MLAG network also includes a second network device, the second network device has sent a first DNS request message to a DNS server through a third network device, the device includes:

[0016] A receiving unit, configured to receive a first DNS response message sent by the third network device, wherein the first DNS response message includes a source port number and a destination MAC address;

[0017] an identification unit, configured to identify whether the source port number is a first value and whether the destination MAC address is the same as the MAC address of the first interface included in the first network device if no cache record of the first DNS request message exists locally;

[0018] A sending unit is used to send the first DNS response message to the second network device through a Peer link if the source port number is a first value and the destination MAC address is the same as the MAC address of the first interface, so that the second network device sends a second DNS response message to the DNS client through a fourth network device.

[0019] In a third aspect, the present application provides a network device, including a processor and a machine-readable storage medium, the machine-readable storage medium storing machine-executable instructions that can be executed by the processor, and the processor is prompted by the machine-executable instructions to execute the method provided in the first aspect of the present application.

[0020] Therefore, by applying the communication method and device provided by the present application, the first network device receives a first DNS response message sent by a third network device, and the first DNS response message includes a source port number and a destination MAC address; if there is no cache record of the first DNS request message locally, the first network device identifies whether the source port number is a first value and whether the destination MAC address is the same as the MAC address of the first interface included in the first network device; if the source port number is the first value and the destination MAC address is the same as the MAC address of the first interface, the first network device sends the first DNS response message to the second network device through the Peer link, so that the second network device sends the second DNS response message to the DNS client through the fourth network device.

[0021] In this way, a network device in the MLAG network that has not received a DNS request message but has received a DNS response message identifies the source port number and the destination MAC address, and synchronizes the DNS response message that meets the conditions to another network device that has received the DNS request message, so that the other network device sends a DNS response message to the DNS client. The MLAG network is combined with the DNS proxy technology, and the network architecture formed can also achieve more efficient operation, and also ensure the reliability and performance improvement of the DNS service. At the same time, it also solves the problem of inconsistent paths when the DNS proxy technology is deployed in the existing MLAG, which causes the DNS client to be unable to obtain the IP address corresponding to the domain name and the object group to be unable to obtain the IP address corresponding to the domain name, causing the DNS client to be unable to access the domain name. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 This is a schematic diagram of the existing MLAG networking model;

[0023] Figure 2 A flow chart of a communication method provided in an embodiment of the present application;

[0024] Figure 3 A schematic diagram of the MLAG network deployment of the DNS proxy provided in the embodiment of the present application;

[0025] Figure 4 A structural diagram of a communication device provided in an embodiment of the present application;

[0026] Figure 5 The network device hardware structure provided in the embodiment of the present application. DETAILED DESCRIPTION

[0027] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0028] The terms used in this application are only for the purpose of describing specific embodiments and are not intended to limit this application. The singular forms of "a", "said" and "the" used in this application and the appended claims are also intended to include plural forms unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used in this article refers to and includes any or all possible combinations of one or more corresponding listed items.

[0029] It should be understood that although the terms first, second, third, etc. may be used in the present application to describe various information, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of the present application, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0030] The communication method provided in the embodiment of the present application is described in detail below. Figure 2 , Figure 2 A flow chart of a communication method provided in an embodiment of the present application. The method is applied to a first network device, the first network device is in an MLAG network, and the MALG system also includes a second network device. The communication method provided in an embodiment of the present application may include the following steps.

[0031] Step 210: Receive a first DNS response message sent by the third network device, where the first DNS response message includes a source port number and a destination MAC address;

[0032] Specifically, the MLAG network is composed of a first network device and a second network device. The uplink ports of the first network device and the second network device form an aggregation group 1 and are connected to the third network device. The third network device is connected to the DNS server. The downlink ports of the first network device and the second network device form an aggregation group 2 and are connected to the fourth network device. The fourth network device is connected to the DNS client.

[0033] The link between the first network device and the third network device and the link between the second network device and the third network device form an equivalent path; similarly, the link between the first network device and the fourth network device and the link between the second network device and the fourth network device also form an equivalent path.

[0034] In the embodiment of the present application, the DNS proxy function has been deployed in the first network device and the second network device. When a DNS client wants to access a domain name, the DNS client generates an original DNS request message, which includes the first domain name to be accessed by the DNS client.

[0035] The DNS client sends the original DNS request message to the fourth network device. After receiving the original DNS request message, the fourth network device performs table lookup and forwarding according to the destination address (i.e., the address of the virtual local area network (English: Virtual Local Area Network, abbreviated as: VLAN) virtual interface 101 of the first network device or the second network device). After the fourth network device determines that the outgoing interface for forwarding the original DNS request message is aggregation group 2, it selects a member port to forward the original DNS request message according to the aggregation load sharing strategy.

[0036] It can be understood that the fourth network device selects a member port to forward the original DNS request message through a hash algorithm based on the source IP address, destination IP address, source port number, destination port number and other information included in the original DNS request message.

[0037] In an embodiment of the present application, the fourth network device sends an original DNS request message to the second network device. After receiving the original DNS request message, the second network device determines that the destination address is the address of its own VLAN virtual interface 101. The second network device obtains the first domain name from the original DNS request message. According to the first domain name, the second network device searches the DNS domain name resolution table locally. If the DNS domain name resolution table entry that matches the first domain name is not obtained in the DNS domain name resolution table, the second network device caches and records the original DNS request message (records the correspondence between the source and destination in the original DNS request message, domain name, VLAN information, etc.), and uses itself as a new DNS client to generate a first DNS request message according to the original DNS request message. The first DNS request message includes a destination media access control address (English: Media Access Control Address, abbreviated as: MAC) address and a destination IP address, which are the MAC address and IP address of a reachable DNS server. The source MAC address and source IP address included in the first DNS request message are the MAC address and IP address of the VLAN virtual interface 101 included in the second network device.

[0038] Among them, since under the MLAG networking, the fourth network device uses a Layer 2 physical port to access the MLAG networking, and the Layer 2 physical port is added to the aggregation group, it also needs to be added to the VLAN virtual interface 101. The reason is that the DNS technology is a service based on Layer 3 forwarding or IP forwarding. Therefore, a Layer 3 interface is required to realize the forwarding of DNS messages.

[0039] The second network device sends a first DNS request message to the third network device. The third network device sends the first DNS request message to the DNS server according to the destination address included in the first DNS request message.

[0040] After receiving the first DNS request message, the DNS server obtains the first domain name from it. According to the first domain name, the DNS server searches the DNS domain name resolution table locally. If a DNS domain name resolution table entry matching the first domain name is obtained in the DNS domain name resolution table, the DNS server obtains the first IP address corresponding to the first domain name. The DNS server generates a first DNS response message, which includes the first IP address, the source port number, and the destination MAC address.

[0041] It is understandable that the DNS server sends the first DNS response message to the third network device. After receiving the first DNS response message, the third network device also performs table lookup and forwarding according to the destination address (i.e., the address of VLAN virtual interface 101) included in the first DNS response message. After the third network device determines that the outgoing interface for forwarding the first DNS response message is aggregation group 1, it selects a member port to forward the first DNS response message according to the aggregation load sharing strategy.

[0042] It is understandable that the third network device selects a member port to forward the first DNS response message through a hash algorithm based on the source IP address, destination IP address, source port number, destination port number and other information included in the first DNS response message.

[0043] In the embodiment of the present application, the third network device sends a first DNS response message to the first network device. After receiving the first DNS response message, the first network device obtains the first IP address, source port number and destination MAC address therefrom.

[0044] Step 220: If there is no cache record of the first DNS request message locally, identify whether the source port number is a first value and whether the destination MAC address is the same as the MAC address of the first interface included in the first network device;

[0045] Specifically, according to the description of step 210, after receiving the first DNS response message, the first network device first searches locally for a cache record of the first DNS request message.

[0046] If there is no cache record of the first DNS request message locally, the first network device continues to identify whether the source port number (the source port number may be specifically the source port number included in the User Datagram Protocol (UDP) header or the source port number may be specifically the source port number included in the Transmission Control Protocol (TCP) header) is a first value (for example, the first value is specifically 53) and whether the destination MAC address is the same as the MAC address of the first interface included in the first network device.

[0047] The first interface is the VLAN virtual interface 101 .

[0048] If the source port number is the first value and the destination MAC address is the same as the MAC address of the first interface, the first network device executes step 230 .

[0049] If the source port number is not the first value or the destination MAC address is different from the MAC address of the first interface, the first network device discards the first DNS response message.

[0050] Step 230: If the source port number is the first value and the destination MAC address is the same as the MAC address of the first interface, the first DNS response message is sent to the second network device through the Peer link, so that the second network device sends a second DNS response message to the DNS client through the fourth network device.

[0051] Specifically, according to the description of step 220, if the source port number is the first value and the destination MAC address is the same as the MAC address of the first interface, the first network device sends a first DNS response message to the second network device through the Peer link.

[0052] After receiving the first DNS response message, the second network device first searches locally for a cache record of the first DNS request message.

[0053] If there is a cache record of the first DNS request message locally, the second network device can obtain the first domain name from the first DNS request message according to the existing DNS domain name resolution process. The second network device locally generates a first DNS domain name resolution table entry, which includes the first domain name and the first IP address.

[0054] The first DNS domain name resolution table entry also includes information such as the domain name resolution type, the remaining validity time of the domain name resolution information, and the query type.

[0055] After the second network device generates the first DNS domain name resolution table entry, it uses itself as a new DNS server and generates a second DNS response message according to the first DNS response message (the source MAC address and source IP address included in the second DNS response message are the MAC address and IP address of its own VLAN virtual interface 101, and the destination MAC address and destination IP address included in the second DNS response message are the destination MAC address and destination IP address updated from the destination MAC address and destination IP address included in the first DNS response message to the destination MAC address and destination IP address of the DNS client). The second DNS response message also includes the first domain name and the first IP address. The second network device sends the second DNS response message to the DNS client.

[0056] After receiving the second DNS response message, the DNS client obtains the first domain name and the first IP address from the second DNS response message. According to the first IP address, the DNS client can access the network device indicated by the first IP address.

[0057] It is understandable that when there is another DNS client requesting the first domain name from the DNS server, after the second network device receives the DNS request message again, the second network device can obtain the first IP address from the first DNS domain name resolution table generated locally and return it to the other DNS client. At this time, the second network device does not need to send the DNS request message to the DNS server again, thus achieving the effect of DNS proxy.

[0058] Therefore, by applying the communication method provided by the present application, the first network device receives a first DNS response message sent by the third network device, and the first DNS response message includes a source port number and a destination MAC address; if there is no cache record of the first DNS request message locally, the first network device identifies whether the source port number is a first value and whether the destination MAC address is the same as the MAC address of the first interface included in the first network device; if the source port number is the first value and the destination MAC address is the same as the MAC address of the first interface, the first network device sends the first DNS response message to the second network device through the Peer link, so that the second network device sends the second DNS response message to the DNS client through the fourth network device.

[0059] In this way, a network device in the MLAG network that has not received a DNS request message but has received a DNS response message identifies the source port number and the destination MAC address, and synchronizes the DNS response message that meets the conditions to another network device that has received the DNS request message, so that the other network device sends a DNS response message to the DNS client. The MLAG network is combined with the DNS proxy technology, and the network architecture formed can also achieve more efficient operation, and also ensure the reliability and performance improvement of the DNS service. At the same time, it also solves the problem of inconsistent paths when the DNS proxy technology is deployed in the existing MLAG, which causes the DNS client to be unable to obtain the IP address corresponding to the domain name and the object group to be unable to obtain the IP address corresponding to the domain name, causing the DNS client to be unable to access the domain name.

[0060] Optionally, in the embodiment of the present application, an object group with the first domain name as its name may be configured in the first network device, and the object group may be referenced by a security policy or ACL configured in the first network device.

[0061] Specifically, after generating the first DNS domain name resolution table entry, the second network device will also generate a first synchronization message, where the first synchronization message includes the first DNS domain name resolution table entry. The second network device sends the first synchronization message to the first network device via the Peer link.

[0062] After receiving the first synchronization message, the first network device obtains the first DNS domain name resolution table entry, and obtains the first domain name and the first IP address from the first DNS domain name resolution table entry. The first network device associates and binds the object group with the DNS domain name resolution table entry so that the object group obtains the first IP address.

[0063] Furthermore, the first network device includes a DNS function module. After the DNS function module obtains the first domain name and the first IP address through the aforementioned process, it generates a notification message, and the notification message includes the first domain name and the first IP address. The DNS function module sends the notification message to the object group. After receiving the notification message, the object group obtains the first domain name and the first IP address from it, so that the security policy or ACL takes effect.

[0064] It should be noted that in the embodiment of the present application, since the object group is referenced by the security policy or ACL, after the object group obtains the first domain name and the first IP address, the first IP address can be used to perform a conditional matching process on the service message. That is, when the first network device receives a service message from the network device indicated by the DNS client accessing the first IP address, and the destination address included in the service message is the first IP address, then according to the security policy or ACL, the first network device releases the service message, otherwise, the first network device intercepts and discards the service message.

[0065] In the embodiment of the present application, the first synchronization message may be specifically an rlink message. The rlink message includes a destination MAC address field, a source MAC address field, an ethtype field, a flag field, and a data field.

[0066] The destination MAC field stores a special multicast MAC address, the source MAC field stores the MAC address of the IPP port (the interface used to establish the Peer link), the ethtype field stores the protocol type, which is the currently unassigned protocol type number, for example, a value in the private 8840-8843, and the Flag field stores the message identifier to define the message reception (RLINK_INIT 0x01) or confirmation (RLINK_ACK 0x02) (used for three-way handshake). The data field stores the data synchronized between network devices, for example, DNS domain name resolution table entries.

[0067] It is understandable that the format of the first synchronization message is the existing standard message format, which also includes other fields. For example, the version field (protocol version number (currently 1.0)), the message length field (total message length), the message identification field, the r field (reserved), the m field (more, whether there are more fragments), the offset field (offset, fragment offset), the domain ID field (domain ID), the connection destination MAC address field, the connection destination MAC source MAC address field, the connection destination port number field, the connection source port number field, the message sending sequence number field, the destination LIP node field, the source LIP node field, and the ACK confirmation sequence number field.

[0068] Optionally, in the embodiment of the present application, the first network device will also perform the following process.

[0069] Specifically, after obtaining the first IP address, the DNS client can access the network device (eg, host) indicated by the first IP address. The DNS client generates a service message, and the destination address included in the service message is the first IP address.

[0070] The DNS client sends a service message to the fourth network device, so that the fourth network device sends the service message to the first network device or the second network device according to the aforementioned process of forwarding the original DNS request message.

[0071] In an embodiment of the present application, the first network device receives a service message and obtains a destination address therefrom, where the destination address is a first IP address.

[0072] According to the security policy or ACL of the referenced object group, the first network device performs condition matching on the service message and determines that the first IP address satisfies the condition matching, and the first network device forwards the service message to the network device indicated by the first IP address.

[0073] Optionally, in the embodiment of the present application, the first network device and the second network device may also exchange roles and execute the steps of the other end.

[0074] Specifically, the first network device receives a second DNS request message sent by the fourth network device, the second DNS request message includes a second domain name, and the first network device caches and records the second DNS request message; the first network device sends the second DNS request message to the third network device, so that the third network device sends the second DNS request message to the DNS server.

[0075] Through the Peer link, the first network device receives a third DNS response message sent by the second network device, and the third DNS response message includes a second IP address corresponding to the second domain name; according to the cache record of the second DNS request message and the third DNS response message, the first network device generates a second DNS domain name resolution table entry, and the DNS domain name resolution table entry includes the second domain name and the second IP address; through the Peer link, the first network device sends a second synchronization message to the second network device, and the second synchronization message includes the second DNS domain name resolution table entry.

[0076] The message format of the second synchronization message is the same as the message format of the aforementioned first synchronization message, and will not be repeated here.

[0077] Optionally, in the embodiment of the present application, the following process will also be performed.

[0078] Specifically, the first network device sends a fourth DNS response message to the fourth network device, so that the fourth network device sends a fourth DNS response message to the DNS client, and the fourth DNS response message includes the second domain name and the second IP address.

[0079] The communication method provided in the embodiment of the present application is described in detail below. Figure 3 , Figure 3 A schematic diagram of the MLAG network deployment of the DNS proxy provided in an embodiment of the present application.

[0080] exist Figure 3In the figure, the MLAG network consists of network device 1 and network device 2. A Peer link and a Keepalive link have been established between network device 1 and network device 2. The downstream ports of network device 1 and network device 2 form aggregation group 1 (BAGG100). Aggregation port 1 of aggregation group 1 is VLAN virtual interface 100 included in network device 1 and network device 2. They are connected to Switch B together. Switch B is connected to the DNS client.

[0081] The uplink ports 1 of network device 1 and network device 2 form aggregation group 2 (BAGG101), and the aggregation port 2 of aggregation group 2 is the VLAN virtual interface 101 included in network device 1 and network device 2. The uplink ports 1 of network device 1 and network device 2 are both member ports of aggregation port 2 and are connected to Switch A together. Switch A is connected to the DNS server.

[0082] The uplink ports 2 of network device 1 and network device 2 form aggregation group 3 (BAGG102), and the aggregation port 4 of aggregation group 3 is the VLAN virtual interface 102 included in network device 1 and network device 2. The uplink ports 2 of network device 1 and network device 2 are both member ports of aggregation port 3 and are connected to Switch C together. Switch C is connected to the host.

[0083] It can be understood that the link between SwitchB and network device 1 and the link between SwitchB and network device 2 form an equal-cost path; similarly, the link between network device 1 and SwitchC and the link between network device 2 and SwitchC form an equal-cost path; similarly, the link between network device 1 and SwitchC and the link between network device 2 and SwitchC also form an equal-cost path.

[0084] In the embodiment of the present application, the DNS proxy function is deployed in both network device 1 and network device 2. When a DNS client wants to access a domain name (i.e., the host's domain name), the DNS client first generates an original DNS request message, which includes the domain name 1 to be accessed by the DNS client.

[0085] The DNS client sends an original DNS request message to SwitchB (such as Figure 3 After SwitchB receives the original DNS request message, it performs table lookup and forwarding according to the destination address (i.e., the address of VLAN virtual interface 101 of network device 1 or network device 2). After SwitchB determines that the outbound interface for forwarding the original DNS request message is aggregation group 1, it selects a member port to forward the original DNS request message according to the aggregation load sharing policy.

[0086] It can be understood that the fourth network device selects a member port to forward the original DNS request message through a hash algorithm based on the source IP address, destination IP address, source port number, destination port number and other information included in the original DNS request message.

[0087] In one example, Switch B sends an original DNS request message (such as Figure 3 (shown by the solid line in the middle). After receiving the original DNS request message, network device 1 determines that the destination address is the address of its own VLAN virtual interface 101. Network device 1 obtains domain name 1 from the original DNS request message. Based on domain name 1, network device 1 searches the DNS domain name resolution table locally. If a DNS domain name resolution table entry matching domain name 1 is not obtained in the DNS domain name resolution table, network device 1 caches the original DNS request message and uses itself as a new DNS client to generate DNS request message 1 based on the original DNS request message.

[0088] The destination MAC address and destination IP address included in the DNS request message 1 are the MAC address and IP address of a reachable DNS server. The source MAC address and source IP address included in the DNS request message 1 are the MAC address and IP address of the VLAN virtual interface 101 included in the network device 1.

[0089] Network device 1 sends a DNS request message 1 to SwitchA (such as Figure 3 SwitchA sends a DNS request message 1 to the DNS server according to the destination address included in the DNS request message 1 (as shown by the solid line 3 in the figure).

[0090] After receiving the DNS request message 1, the DNS server obtains the domain name 1 from it. Based on the domain name 1, the DNS server searches the local DNS domain name resolution table. If the DNS domain name resolution table entry 1 matching the domain name 1 is obtained in the DNS domain name resolution table, the DNS server obtains the IP address 1 (i.e. the IP address of the host) corresponding to the domain name 1. The DNS server generates a DNS response message 1, which includes the IP address 1, the source port number, and the destination MAC address.

[0091] It is understandable that the DNS server sends a DNS response message 1 (such as Figure 3 After SwitchA receives the DNS response message 1, it also performs table lookup and forwarding according to the destination address (i.e., the address of VLAN virtual interface 101) included in the DNS response message 1. After SwitchA determines that the outbound interface for forwarding the DNS response message 1 is aggregation group 2, it selects a member port to forward the DNS response message 1 according to the aggregation load sharing policy.

[0092] It can be understood that SwitchA selects a member port to forward DNS response message 1 through a hash algorithm according to information such as the source IP address, the destination IP address, the source port number, and the destination port number included in DNS response message 1.

[0093] In one example, Switch A sends a DNS response message 1 (eg, Figure 3 After receiving the DNS response message 1, the network device 2 obtains the IP address 1, the source port number and the destination MAC address.

[0094] After receiving the DNS response message 1, the network device 2 first searches locally to see whether there is a cache record of the DNS request message 1.

[0095] If there is no cache record of DNS request message 1 locally, network device 2 continues to identify whether the source port number is the first value (for example, the first value is specifically 53) and whether the destination MAC address is the same as the MAC address of VLAN virtual interface 101 included in network device 2.

[0096] If the source port number is not 53 or the destination MAC address is different from the MAC address of the VLAN virtual interface 101 , the network device 2 discards the DNS response message 1 .

[0097] If the source port number is 53 and the destination MAC address is the same as the MAC address of the VLAN virtual interface 101, network device 2 sends a DNS response message 1 to SwitchB through the Peerlink link (such as Figure 3 (shown by the dashed line).

[0098] After receiving the DNS response message 1, the network device 1 first searches locally for a cache record of the DNS request message 1.

[0099] If there is a cache record of DNS request message 1 locally, network device 1 can obtain domain name 1 from DNS request message 1 according to the existing DNS domain name resolution process. Network device 1 generates DNS domain name resolution table entry 2 locally, and DNS domain name resolution table entry 2 includes domain name 1 and IP address 1.

[0100] After the network device 2 generates the DNS domain name resolution table entry 2, it generates the DNS response message 2 according to the original DNS request message. The DNS response message 2 includes the domain name 1 and the IP address 1. The network device 1 sends the DNS response message 2 to the DNS client.

[0101] After receiving the DNS response message 2, the DNS client obtains the domain name 1 and the IP address 1 therefrom. According to the IP address 1, the DNS client can access the host indicated by the IP address 1.

[0102] It is understandable that when there is another DNS client requesting the domain name 1 from the DNS server, after the network device 1 receives the DNS request message again, the network device 1 can obtain the IP address 1 from the locally generated DNS domain name resolution table 2 and return it to the other DNS client. At this time, the network device 1 does not need to send the DNS request message to the DNS server again, thus achieving the effect of DNS proxy.

[0103] At the same time, after generating the DNS domain name resolution table entry 2, the network device 1 will also generate a synchronization message 1, which includes the DNS domain name resolution table entry 2. Through the Peer link, the network device 1 sends the synchronization message 1 (such as Figure 3 midpoint solid line).

[0104] After receiving the synchronization message 1, the network device 2 obtains the DNS domain name resolution table entry 2 therefrom, and obtains the domain name 1 and the IP address 1 from the DNS domain name resolution table entry 2. In the embodiment of the present application, an object group with the domain name 1 as the name may also be configured in the network device 2. The object group may be referenced by the security policy or ACL configured in the network device 2.

[0105] Network device 2 associates and binds the object group with DNS domain name resolution table entry 2, so that the object group obtains IP address 1.

[0106] Furthermore, the network device 2 includes a DNS function module. After the DNS function module obtains the domain name 1 and the IP address 1 through the above process, it generates a notification message 1, which includes the domain name 1 and the IP address 1. The DNS function module sends a notification message to the object group. After receiving the notification message 1, the object group obtains the domain name 1 and the IP address 1 therefrom, so that the security policy or ACL takes effect.

[0107] According to the above, after the DNS client obtains IP address 1, it can access the host indicated by IP address 1. The DNS client generates a service message 1, and the destination address included in the service message 1 is IP address 1.

[0108] The DNS client sends service message 1 to SwitchB again (such as Figure 3 In the example shown in the dashed and solid lines in the figure, SwitchB can send service message 1 (as shown in the dashed and solid lines in the figure) to network device 1 or network device 2 according to the process of forwarding the original DNS request message mentioned above. Figure 3 (shown by the dashed line in the middle).

[0109] In an example, network device 2 receives service message 1 and obtains a destination address therefrom, which is IP address 1.

[0110] According to the security policy or ACL of the referenced object group, network device 2 performs condition matching on the service message and determines that IP address 1 meets the condition matching. Network device 2 sends service message 1 to Switch C (such as Figure 3 After receiving service message 1, SwitchC obtains the destination address from it, which is IP address 1. Based on IP address 1, SwitchC forwards service message 1 to Host (as shown in Figure 1). Figure 3 (shown by the dashed line in the middle).

[0111] Based on the same inventive concept, the present application embodiment also provides a communication device corresponding to the communication method. Figure 4 , Figure 4 A communication device is provided in an embodiment of the present application, the device is applied to a first network device, the first network device is in an MLAG network, the MLAG network also includes a second network device, the second network device has sent a first DNS request message to a DNS server through a third network device, and the device includes:

[0112] The receiving unit 410 is configured to receive a first DNS response message sent by the third network device, where the first DNS response message includes a source port number and a destination MAC address;

[0113] an identification unit 420, configured to identify whether the source port number is a first value and whether the destination MAC address is the same as a MAC address of a first interface included in the first network device if no cache record of the first DNS request message exists locally;

[0114] The sending unit 430 is used to send the first DNS response message to the second network device through the Peer link if the source port number is a first value and the destination MAC address is the same as the MAC address of the first interface, so that the second network device sends the second DNS response message to the DNS client through the fourth network device.

[0115] Optionally, an object group has been configured in the first network device;

[0116] The receiving unit 410 is further configured to receive, through the Peer link, a first synchronization message sent by the second network device, where the first synchronization message includes a first DNS domain name resolution table entry, where the first DNS domain name resolution table entry is generated by the second network device according to the first DNS request message and the first DNS response message, where the first DNS domain name resolution table entry includes a first domain name and a first IP address corresponding to the first domain name;

[0117] The device further includes: an association unit (not shown in the figure), configured to associate and bind the object group with the DNS domain name resolution table entry, so that the object group obtains the first IP address;

[0118] The object group is referenced by a security policy or an ACL.

[0119] Optionally, the receiving unit 410 is further configured to receive a service message sent by the fourth network device, wherein the destination address included in the service message is the first IP address;

[0120] The sending unit 430 is further configured to forward the service message to the network device indicated by the first IP address according to the security policy or ACL that references the object group.

[0121] Optionally, the receiving unit 410 is further configured to receive a second DNS request message sent by the fourth network device, where the second DNS request message includes a second domain name;

[0122] The sending unit 430 is further configured to send the second DNS request message to the third network device, so that the third network device sends the second DNS request message to the DNS server;

[0123] The receiving unit 410 is further configured to receive, through the Peer link, a third DNS response message sent by the second network device, wherein the third DNS response message includes a second IP address corresponding to the second domain name;

[0124] The device further includes: a generating unit (not shown in the figure), configured to generate a second DNS domain name resolution table entry according to the cache record of the second DNS request message and the third DNS response message, wherein the DNS domain name resolution table entry includes the second domain name and the second IP address;

[0125] The sending unit 430 is further configured to send a second synchronization message to the second network device through the Peer link, where the second synchronization message includes the second DNS domain name resolution table entry.

[0126] Optionally, the sending unit 430 is further used to send a fourth DNS response message to the fourth network device, so that the fourth network device sends the fourth DNS response message to the DNS client, and the fourth DNS response message includes the second domain name and the second IP address.

[0127] Therefore, by applying the communication device provided by the present application, the first network device receives a first DNS response message sent by the third network device, and the first DNS response message includes a source port number and a destination MAC address; if there is no cache record of the first DNS request message locally, the first network device identifies whether the source port number is a first value and whether the destination MAC address is the same as the MAC address of the first interface included in the first network device; if the source port number is the first value and the destination MAC address is the same as the MAC address of the first interface, the first network device sends the first DNS response message to the second network device through the Peer link, so that the second network device sends the second DNS response message to the DNS client through the fourth network device.

[0128] In this way, a network device in the MLAG network that has not received a DNS request message but has received a DNS response message identifies the source port number and the destination MAC address, and synchronizes the DNS response message that meets the conditions to another network device that has received the DNS request message, so that the other network device sends a DNS response message to the DNS client. The MLAG network is combined with the DNS proxy technology, and the network architecture formed can also achieve more efficient operation, and also ensure the reliability and performance improvement of the DNS service. At the same time, it also solves the problem of inconsistent paths when the DNS proxy technology is deployed in the existing MLAG, which causes the DNS client to be unable to obtain the IP address corresponding to the domain name and the object group to be unable to obtain the IP address corresponding to the domain name, causing the DNS client to be unable to access the domain name.

[0129] Based on the same inventive concept, the embodiment of the present application also provides a network device, such as Figure 5 As shown, it includes a processor 510, a transceiver 520 and a machine-readable storage medium 530, the machine-readable storage medium 530 stores machine-executable instructions that can be executed by the processor 510, and the processor 510 is prompted by the machine-executable instructions to execute the communication method provided in the embodiment of the present application. Figure 4 The communication device shown can be used as Figure 5 The network device hardware structure shown is implemented.

[0130] The computer-readable storage medium 530 may include a random access memory (RAM) or a non-volatile memory (NVM), such as at least one disk storage. Optionally, the computer-readable storage medium 530 may also be at least one storage device located away from the processor 510.

[0131] The processor 510 may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it may also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0132] In the embodiment of the present application, the processor 510 reads the machine executable instructions stored in the machine readable storage medium 530, and the machine executable instructions enable the processor 510 itself and call the transceiver 520 to execute the communication method described in the aforementioned embodiment of the present application.

[0133] In addition, an embodiment of the present application provides a machine-readable storage medium 530, which stores machine-executable instructions. When called and executed by the processor 510, the machine-executable instructions prompt the processor 510 itself and the calling transceiver 520 to execute the communication method described in the aforementioned embodiment of the present application.

[0134] The implementation process of the functions and effects of each unit in the above-mentioned device is specifically described in the implementation process of the corresponding steps in the above-mentioned method, and will not be repeated here.

[0135] For the device embodiment, since it basically corresponds to the method embodiment, the relevant parts can refer to the partial description of the method embodiment. The device embodiment described above is only schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the present application scheme. A person of ordinary skill in the art can understand and implement it without paying any creative work.

[0136] As for the communication device and machine-readable storage medium embodiments, since the method contents involved are basically similar to the aforementioned method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiments.

[0137] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

Claims

1. A communication method, characterized in that: The method is applied to a first network device, the first network device is in an MLAG network, the MLAG network also includes a second network device, the second network device has sent a first DNS request message to a DNS server through a third network device, the method includes: Receive a first DNS response message sent by the third network device, where the first DNS response message includes a source port number and a destination MAC address; If there is no cache record of the first DNS request message locally, identifying whether the source port number is a first value and whether the destination MAC address is the same as the MAC address of the first interface included in the first network device; If the source port number is the first value and the destination MAC address is the same as the MAC address of the first interface, the first DNS response message is sent to the second network device through the Peer link, so that the second network device sends the second DNS response message to the DNS client through the fourth network device.

2. The method according to claim 1, characterized in that The object group has been configured in the first network device, and the method further includes: Receiving, through the Peer link, a first synchronization message sent by the second network device, where the first synchronization message includes a first DNS domain name resolution table entry, where the first DNS domain name resolution table entry is generated by the second network device according to the first DNS request message and the first DNS response message, where the first DNS domain name resolution table entry includes a first domain name and a first IP address corresponding to the first domain name; Associating and binding the object group with the DNS domain name resolution table entry so that the object group obtains the first IP address; The object group is referenced by a security policy or an ACL.

3. The method according to claim 2, characterized in that The method further comprises: receiving a service message sent by the fourth network device, wherein the destination address included in the service message is the first IP address; Forward the service message to the network device indicated by the first IP address according to the security policy or ACL that references the object group.

4. The method according to claim 1, characterized in that: The method further comprises: receiving a second DNS request message sent by the fourth network device, wherein the second DNS request message includes a second domain name; Sending the second DNS request message to the third network device, so that the third network device sends the second DNS request message to the DNS server; Receiving, through the Peerlink link, a third DNS response message sent by the second network device, wherein the third DNS response message includes a second IP address corresponding to the second domain name; Generate a second DNS domain name resolution table entry according to the cache record of the second DNS request message and the third DNS response message, wherein the DNS domain name resolution table entry includes the second domain name and the second IP address; A second synchronization message is sent to the second network device through the Peer link, where the second synchronization message includes the second DNS domain name resolution table entry.

5. The method according to claim 4, characterized in that The method further comprises: A fourth DNS response message is sent to the fourth network device, so that the fourth network device sends the fourth DNS response message to the DNS client, where the fourth DNS response message includes the second domain name and the second IP address.

6. A communication device, characterized in that: The apparatus is applied to a first network device, the first network device is in an MLAG network, the MLAG network further includes a second network device, the second network device has sent a first DNS request message to a DNS server through a third network device, and the apparatus includes: A receiving unit, configured to receive a first DNS response message sent by the third network device, wherein the first DNS response message includes a source port number and a destination MAC address; an identification unit, configured to identify whether the source port number is a first value and whether the destination MAC address is the same as the MAC address of the first interface included in the first network device if no cache record of the first DNS request message exists locally; A sending unit is used to send the first DNS response message to the second network device through a Peerlink link if the source port number is a first value and the destination MAC address is the same as the MAC address of the first interface, so that the second network device sends a second DNS response message to the DNS client through a fourth network device.

7. The device according to claim 6, characterized in that The object group has been configured in the first network device; The receiving unit is further configured to receive, through the Peer link, a first synchronization message sent by the second network device, wherein the first synchronization message includes a first DNS domain name resolution table entry, the first DNS domain name resolution table entry is generated by the second network device according to the first DNS request message and the first DNS response message, and the first DNS domain name resolution table entry includes a first domain name and a first IP address corresponding to the first domain name; The device further includes: an associating unit, configured to associate and bind the object group with the DNS domain name resolution table entry, so that the object group obtains the first IP address; The object group is referenced by a security policy or an ACL.

8. The device according to claim 7, characterized in that The receiving unit is further configured to receive a service message sent by the fourth network device, wherein the destination address included in the service message is the first IP address; The sending unit is further configured to forward the service message to the network device indicated by the first IP address according to the security policy or ACL that references the object group.

9. The device according to claim 6, characterized in that The receiving unit is further configured to receive a second DNS request message sent by the fourth network device, wherein the second DNS request message includes a second domain name; The sending unit is further used to send the second DNS request message to the third network device, so that the third network device sends the second DNS request message to the DNS server; The receiving unit is further configured to receive, through the Peer link, a third DNS response message sent by the second network device, wherein the third DNS response message includes a second IP address corresponding to the second domain name; The device further includes: a generating unit, configured to generate a second DNS domain name resolution table entry according to the cache record of the second DNS request message and the third DNS response message, wherein the DNS domain name resolution table entry includes the second domain name and the second IP address; The sending unit is further configured to send a second synchronization message to the second network device through the Peer link, where the second synchronization message includes the second DNS domain name resolution table entry.

10. The device according to claim 9, characterized in that The sending unit is further configured to send a fourth DNS response message to the fourth network device, so that the fourth network device sends the fourth DNS response message to the DNS client, wherein the fourth DNS response message includes the second domain name and the second IP address.

Images