VNI resource on-demand generation method and device

Abstract

The invention relates to the technical field of network communication, and provides a VNI resource on-demand generation method and device. In the invention, a management platform plans first forwarding resource information and second forwarding resource information in advance, the first forwarding resource information is issued to an access vSwitch, and the access vSwitch issues the first forwarding resource information to network equipment connected with the access vSwitch on a local area network side; the management platform issues the second forwarding resource information to the vCPE, and the vCPE issues the second forwarding resource information to network equipment connected with the vCPE at the local area network side; the access vSwitch obtains a corresponding local area network side VNI according to the user terminal message and the first forwarding resource information; the vCPE initializes a local area network instance according to the DNS message and the second forwarding resource information; the problem of QinQ and VNI resource waste caused by indifference one-key issuing of all available VNI resources is solved.

Description

Technical Field

[0001] The present invention relates to the field of network communication technology, and in particular to a method and device for generating VNI resources on demand. Background Art

[0002] The public network is the Internet in the global scope, which is open to all users. Currently, operators generally combine QinQ information with VXLAN Network Identifier (VNI) to distinguish traffic from different users or services; QinQ information is generated by adding a layer of 802.1Q tag on the basis of the original 802.1Q message; VXLAN refers to Virtual Extensible Local Area Network (VXLAN), and VNI is used to identify different virtual networks in the VXLAN network.

[0003] When users access the Internet, when user traffic reaches the edge network device, the edge network device will add QinQ information to it. After passing through the edge network device, the user traffic will continue to flow to the device running VXLAN, that is, the Network Virtualization Edge (NVE) device, and configure the VXLAN tunnel and VNI in the NVE device; among them, NVE devices, such as Data Center Switches (DCSW), are usually located in a more core position of the network compared to edge network devices.

[0004] However, when configuring QinQ and VNI resources in a local area network, all available VNI resources are directly sent to the network at one time, that is, the actual usage, actual usage requirements and future scalability of QinQ and VNI resources are not considered at all, and the available VNI resources are not planned and allocated; in this way, although the configuration process is simplified, it is very likely to cause waste of resources. In actual application scenarios such as campus networks, different services or users have different requirements for network resources; after sending all available VNI resources indiscriminately with one click, the current cloud gateway network's ability to process network traffic is fully occupied, and the number of supported VXLANs is also fully used. When it is found that resource planning and allocation are unreasonable, even if the relevant network equipment of other schools is migrated, it is limited by the current cloud gateway network's ability to process network traffic and the number of supported VXLANs, and the QinQ links of other schools cannot be connected to the current cloud gateway network, so that resource planning and allocation cannot be adjusted in time.

[0005] In view of this, overcoming the defects of the prior art is an urgent problem to be solved in the field of this technology. Summary of the invention

[0006] The technical problem to be solved by the present invention is to provide a method and device for on-demand generation of VNI resources, the purpose of which is to obtain the corresponding LAN side VNI according to the pre-planned first forwarding resource information to configure the message forwarding path of the access vSwitch on the LAN side; initialize the LAN instance according to the pre-planned second forwarding resource information to configure the message forwarding path of the vCPE on the LAN side, and implement the pre-designed VNI resource planning to configure the corresponding VNI for the network equipment in the LAN on demand, thereby solving the problem of QinQ and VNI resource waste caused by the indiscriminate one-click delivery of all available VNI resources.

[0007] The present invention adopts the following technical solution:

[0008] In a first aspect, the present invention provides a method for generating VNI resources on demand, wherein a management platform pre-plans first forwarding resource information and second forwarding resource information, sends the first forwarding resource information to an access vSwitch, and sends the second forwarding resource information to a vCPE;

[0009] The method for generating VNI resources on demand includes:

[0010] The access vSwitch sends the first forwarding resource information to a network device connected to the access vSwitch on the local area network side; the vCPE sends the second forwarding resource information to a network device connected to the vCPE on the local area network side;

[0011] The access vSwitch receives a user terminal message, and obtains a corresponding LAN side VNI according to the user terminal message and the first forwarding resource information, so as to forward the corresponding message between a network device connected to the access vSwitch on the LAN side and the access vSwitch using the LAN side VNI;

[0012] The vCPE receives the DNS message, and initializes the LAN instance according to the DNS message and the second forwarding resource information; and uses the LAN instance to forward corresponding messages between the network device connected to the vCPE on the LAN side and the vCPE to enable the user terminal to access the Internet.

[0013] Furthermore, the first forwarding resource information includes a first configuration resource plan and a first EVPN plan; wherein the first configuration resource plan is: a mapping relationship between VNI, PVLAN and CVLAN;

[0014] The access vSwitch receives a user terminal message, and obtains a corresponding LAN-side VNI according to the user terminal message and the first forwarding resource information, including:

[0015] Acquire user network group information and user QinQ information from the user terminal message;

[0016] According to the first configuration resource plan and the first EVPN plan, find the LAN-side VNI corresponding to the user network group information and the user QinQ information, and obtain the user PVLAN information and the user CVLAN information based on the LAN-side VNI;

[0017] According to the found LAN side VNI, the user PVLAN information and the user CVLAN information, a tenant forwarding rule corresponding to the user terminal message is generated, and the tenant forwarding rule is configured to the access vSwitch and the network device connected to the access vSwitch, so as to forward the corresponding message generated based on the user terminal message according to the tenant forwarding rule.

[0018] Further, the searching, according to the first configuration resource planning and the first EVPN planning, for the LAN-side VNI corresponding to the user network group information and the user QinQ information, and obtaining the user PVLAN information and the user CVLAN information based on the LAN-side VNI includes:

[0019] Obtain QinQ configuration information of the current network; wherein the QinQ configuration information includes: device VNI of the port with QinQ function enabled;

[0020] Acquire an association mapping relationship from the first EVPN plan; wherein the association mapping relationship is: a mapping relationship between a device VNI, current network group information, and device QinQ information;

[0021] According to the association mapping relationship, match the current network group information with the user network group information, and match the device QinQ information with the user QinQ information to obtain a matched device VNI, and use the matched device VNI as the LAN side VNI;

[0022] The LAN-side VNI is used to find out the user PVLAN information and user CVLAN information to which the user terminal message belongs in the first configuration resource planning.

[0023] Furthermore, the forwarding of the corresponding message between the network device connected to the access vSwitch on the LAN side and the access vSwitch using the LAN side VNI also includes:

[0024] The access vSwitch adds the LAN side VNI, the user PVLAN information and the user CVLAN information to the user terminal message to obtain a configuration information message; and forwards the configuration information message to the vCPE so that the vCPE loads the terminal configuration on the LAN side.

[0025] Further, the second forwarding resource information includes a second configuration resource planning, a gateway MAC address and address pool information; wherein the second configuration resource planning is: a mapping relationship between VNI, PVLAN and CVLAN;

[0026] The initializing the local area network instance according to the DNS message and the second forwarding resource information includes:

[0027] Obtain the IP address to be accessed and the client IP address from the DNS message; find out the IP address range corresponding to the IP address to be accessed and the client IP address in the gateway MAC address and the address pool information;

[0028] Based on the second configuration resource planning, obtain the instance VNI, instance PVLAN information and instance CVLAN information corresponding to the IP address range;

[0029] The instance VNI, the instance PVLAN information and the instance CVLAN information are used to initialize the LAN instance, the terminal table and the instance address pool, so as to allocate instance addresses to corresponding user terminals based on the LAN instance, and to identify and forward messages from the user terminals using the terminal table and the instance address pool.

[0030] Furthermore, the user QinQ information on the LAN side of the vCPE is consistent with the user QinQ information on the WAN side; the VNI and MAC addresses of the network devices on the WAN side of the vCPE are both unique;

[0031] The method for generating VNI resources on demand further includes:

[0032] Based on the VNI of the network device and the QinQ information of the user, configure the tenant forwarding rule of the access vSwitch, so as to find the forwarding rule corresponding to the VNI of the network device and the QinQ information of the user received in the tenant forwarding rule to obtain the corresponding message forwarding path;

[0033] The vCPE receives a DNS message, and initializes a local area network instance according to the second forwarding resource information according to the DNS message; and forwarding corresponding messages using the local area network instance between a network device connected to the vCPE on the local area network side and the vCPE further includes:

[0034] When the user terminal accesses the Internet, the vCPE obtains the account information bound to the user terminal from the received DNS message; based on the account information, obtains the VNI and user QinQ information of the network device on the WAN side of the vCPE;

[0035] The vCPE encapsulates the VNI and user QinQ information of the network device on the WAN side into the DNS message, obtains a WAN message, and sends the WAN message to the Internet; on the Internet, forwards and processes the WAN message according to the VNI and user QinQ information of the network device on the WAN side;

[0036] When the access vSwitch receives the return message corresponding to the WAN message, it obtains the unique VNI of the network device on the WAN side of the access vSwitch according to the account WAN MAC address corresponding to the account information, and forwards the return message to the vCPE according to the unique VNI to transmit the corresponding message back to the user terminal.

[0037] Furthermore, it also includes:

[0038] When the access vSwitch matches a value-added service, the user QinQ information on the LAN side of the access vSwitch is mapped to the unique service QinQ information of the value-added service;

[0039] The service gateway uses the unique service QinQ information to configure its own service forwarding rules to activate the value-added service, so that when the service gateway receives the message of the value-added service, the service gateway processes the message of the value-added service according to the service forwarding rules.

[0040] Furthermore, before the access vSwitch receives the user terminal message and obtains the corresponding LAN side VNI according to the user terminal message and the first forwarding resource information, it also includes:

[0041] The access vSwitch configures the corresponding service route according to the first configuration resource planning, so that the access vSwitch forwards the received message to the service path corresponding to the service route according to the received LAN side VNI and user PVLAN information.

[0042] In a second aspect, the present invention further provides a device for generating VNI resources on demand, comprising:

[0043] At least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the processor to execute the method for on-demand generation of VNI resources described in the first aspect.

[0044] In a third aspect, the present invention further provides a non-volatile computer storage medium, wherein the computer storage medium stores computer executable instructions, which are executed by one or more processors to complete the method for on-demand generation of VNI resources described in the first aspect.

[0045] In a fourth aspect, a computer program product comprising instructions is provided, which, when executed on a computer or a processor, enables the computer or the processor to execute a method for on-demand generation of VNI resources as described in the first to third aspects and any one of the aspects.

[0046] In a fifth aspect, the present invention further provides a system for generating VNI resources on demand, comprising an apparatus for generating VNI resources on demand as in the second aspect, and using the method for generating VNI resources on demand as described in the first aspect to complete the interaction of the apparatus for generating VNI resources on demand as in the second aspect.

[0047] Different from the prior art, the present invention has at least the following beneficial effects:

[0048] The present invention pre-plans VNI resources, so it can ensure the rationality of resource planning and allocation in combination with the actual usage and demand of VNI resources; in order to configure VNI resources according to the plan, the corresponding LAN side VNI is obtained according to the pre-planned first forwarding resource information, and the LAN side VNI is used to configure the message forwarding path of the access vSwitch on the LAN side; the LAN instance is initialized according to the pre-planned second forwarding resource information, and the message forwarding path of the vCPE on the LAN side is configured based on the LAN instance, and then the corresponding VNI is configured for the network equipment in the LAN on demand, and the corresponding message forwarding path is generated; while simplifying the configuration process, the waste of VNI resources is avoided as much as possible, and the problem of QinQ and VNI resource waste caused by indiscriminate one-click delivery of all available VNI resources is solved. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments of the present invention. Obviously, the drawings described below are only some embodiments of the present invention, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0050] Figure 1It is a structural diagram of a specific example of an edge gateway in a campus network scenario provided by an embodiment of the present invention;

[0051] Figure 2 It is a flowchart of a method for generating VNI resources on demand provided by an embodiment of the present invention;

[0052] Figure 3 is a flow chart of step 20 provided in an embodiment of the present invention;

[0053] Figure 4 is a flow chart of step 202 provided in an embodiment of the present invention;

[0054] Figure 5 This is a schematic diagram of a specific example of a Portal server performing account login provided by an embodiment of the present invention;

[0055] Figure 6 is a flow chart of step 30 provided in an embodiment of the present invention;

[0056] Figure 7 This is a schematic diagram of a specific example of a message forwarding process for a user terminal to access the Internet provided by an embodiment of the present invention;

[0057] Figure 8 It is a schematic diagram of a process of opening a value-added service provided by an embodiment of the present invention;

[0058] Fig. 9 It is a schematic diagram of the architecture of a device for on-demand generation of VNI resources provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0059] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0060] Unless the context requires otherwise, throughout the specification and claims, the term "including" is to be interpreted as open inclusion, that is, "including, but not limited to". In the description of the specification, the terms "one embodiment", "some embodiments", "exemplary embodiments", "examples", "specific examples" or "some examples" and the like are intended to indicate that specific features, structures, materials or characteristics associated with the embodiment or example are included in at least one embodiment or example of the present disclosure. The schematic representation of the above terms does not necessarily refer to the same embodiment or example. In addition, the specific features, structures, materials or characteristics may be included in any one or more embodiments or examples in any appropriate manner, that is, although they may be carried in the embodiments or examples of the above terms due to reasons such as the order and position of appearance, it is not limited to that they can be carried in combination by one embodiment or example.

[0061] In the description of the present invention, it is necessary to understand that the terms "center", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside", etc., indicating orientations or positional relationships, are based on the orientations or positional relationships shown in the accompanying drawings, and are only for the convenience of describing the present disclosure and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore should not be understood as a limitation on the present disclosure.

[0062] In the description of the present invention, the terms "first" and "second" are used only for descriptive purposes, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of indicated technical features. Thus, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features. In the description of the embodiments of the present disclosure, unless otherwise specified, the meaning of "multiple" is two or more. In addition, for example, the same type of nouns may be described as two independent individuals by adding "A" and "B" at the end. In this case, the corresponding features defined as "A" and "B" are only used to distinguish the same type of individuals for description purposes, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of indicated technical features.

[0063] When describing some embodiments, the expressions "coupling", "coupling" and "connection" and their derivatives may be used. For example, when describing some embodiments, the term "connection" may be used to indicate that two or more components are in direct physical or electrical contact with each other. For another example, when describing some embodiments, the term "coupling" may be used to indicate that two or more components are in direct physical or electrical contact. However, the terms "connection" or "coupling" may also refer to two or more components that are not in direct contact with each other, but still cooperate or interact with each other, such as "optical path coupling", "wireless connection", etc. The embodiments disclosed herein are not necessarily limited to the contents of the present invention.

[0064] In the description of the present invention, the expression "A and / or B" (where A and B are used to formally represent specific characteristic contents) will be involved, and the corresponding expressions include the following three combinations: only A, only B, and a combination of A and B.

[0065] As used herein, "about," "substantially," or "approximately" includes the stated value and an average value that is within an acceptable range of deviation from the particular value as determined by one of ordinary skill in the art taking into account the measurements in question and the errors associated with the measurement of the particular quantity (i.e., the limitations of the measurement system).

[0066] Embodiment 1:

[0067] First, an application scenario of an embodiment of the present invention is described below:

[0068] like Figure 1 The diagram shows a structural diagram of a specific instance of an edge gateway in a campus network scenario; the edge gateway of an embodiment of the present invention includes at least a management platform (Integrated Operation Management Platform, abbreviated as IOMP), an access gateway and a business gateway; the management platform is connected to the access gateway and the business gateway respectively, and the access gateway is connected to multiple business gateways. Among them, the management platform is used to manage the input and output traffic between network devices; the access gateway is the access server, which is responsible for accessing the Internet and is the first node server for all user traffic to flow into; the business gateway is the server through which the east-west mobile edge computing (Mobile Edge Computing, abbreviated as MEC) business flows, and the east-west MEC business refers to the data exchange and communication between MEC nodes within one or more data centers.

[0069] The access gateway includes an access virtualized switch (Virtualised Switch, abbreviated as vSwitch) and multiple virtual customer terminal equipment (virtual Customer Premise Equipment, abbreviated as vCPE); the access vSwitch connects multiple vCPEs.

[0070] like Figure 1 There are multiple network devices between the user terminal and the access vSwitch, the access vSwitch is connected to N service gateways, and there are multiple network devices between each service gateway and the Internet; the specific number of service gateways connected to the access vSwitch, the multiple network devices between the user terminal and the access vSwitch, and the specific configuration of the multiple network devices between the service gateway and the Internet are configured by technical personnel in this field according to specific usage scenarios and experience, and are not limited here.

[0071] In one embodiment, the multiple network devices between the user terminal and the access vSwitch can be: the user terminal is connected to the optical network unit (Optical Network Unit, abbreviated as ONU); the ONU is connected to the optical cable terminal (Optical Line Terminal, abbreviated as OLT); the OLT is connected to the data center switch (Data Center Switches, abbreviated as DCSW); the DCSW is connected to the access vSwitch through VXLAN; the OLT and DCSW are used to forward user traffic to the access vSwitch. Among them, the user traffic (i.e., message) processed by the OLT carries QinQ information. After the user traffic processed by the OLT enters the DCSW, the DCSW encapsulates the VXLAN header for the corresponding message, and the VXLAN header includes the VNI. The QinQ information and the VNI constitute the identification information of the user traffic.

[0072] Among them, QinQ is a layer 2 VPN technology, which encapsulates the user's private network message with an outer VLAN tag (Tag) on ​​the operator's edge network equipment, so that the message containing QinQ information carries two layers of VLAN tags through the operator's backbone network (i.e., the public network); wherein, QinQ information includes an inner VLAN Tag (representing the user's private network VLAN) and an outer VLAN Tag (representing the public network VLAN assigned to the user by the operator). The network equipment in the public network only forwards the message according to the outer VLAN tag, and learns the source Media Access Control (MAC) address table of the message into the MAC address table of the VLAN where the outer tag is located, and the user's private network VLAN tag will be transmitted as the data part of the message during the transmission process.

[0073] The access vSwitch is used to receive and forward user traffic through the LAN (Local Area Network, abbreviated as LAN) side and the WAN (Wide Area Network, abbreviated as WAN) side; the vCPE is used to process user service requirements. User traffic carries QinQ information and VNI. The access vSwitch identifies user traffic on its LAN side and WAN side based on QinQ information and VNI. It should be noted that if Figure 1 The connections to the vSwitch and vCPE are on the LAN side, and the WAN side is connected to the Internet. Figure 1 An internet connection is not shown.

[0074] When a user terminal wants to access the Internet, it sends a message to the access vSwitch. After receiving the message from the user terminal, the access vSwitch forwards the received message to the vCPE according to the QinQ information and VNI. After receiving the message, the vCPE cooperates with other network devices to complete the forwarding and routing of the message, and finally access the Internet. Among them, other network devices are determined by the specific network configuration, such as Broadband Remote Access Server (BRAS) devices, etc. The access gateway implements dial-up Internet access through the BRAS device.

[0075] In the course of campus network iteration, in the process of enabling user terminals to access the Internet, we have used the VNI resource orchestration solution and the VNI resource non-orchestration solution. Specifically:

[0076] In the VNI resource arrangement scheme, firstly, a section of QinQ information and LAN-side VNI resources are planned as needed, and after sending it to the relevant access forwarding device (for example, cloud gateway) with one click, the user terminal applies for an Internet Protocol Address (IP address) from the cloud gateway through the Dynamic Host Configuration Protocol (DHCP protocol). When the user terminal needs to access the Internet, the management platform will randomly assign a specific WAN VNI and WAN-side QinQ information to the WAN account according to the resource planning; the WAN account operator assigns it when providing Internet access services, and the WAN account is a unique identifier used to identify a specific user in the operator's authentication system. Before connecting to the WAN, network devices (e.g., routers) need to verify the WAN account; when accessing resources or services within the LAN, users need to authenticate their identities through the Portal authentication server to ensure that only authorized users can access protected resources; after both of the above verifications are passed, a binding relationship will be established between the WAN and LAN for the user account to correctly route the user's network requests to the target server according to the binding relationship and prevent unauthorized access.

[0077] However, the VNI resource arrangement solution only supports the automatic arrangement of VNI and QinQ information resources on the WAN side. For the traditional campus network architecture, once the user account uses the redial method to connect to the network (for example, the account and password need to be re-entered for dial-up connection each time the user goes online), the QinQ information on the WAN side is very likely to be reallocated each time the dial-up connection is made, which in turn causes the VNI on the WAN side to change, and it is impossible to ensure that the QinQ information on the LAN side and the WAN side remain consistent. QinQ information and VNI constitute the identification information of the user traffic. When the user traffic is transmitted between the LAN and the WAN, the QinQ information and VNI are very likely to not remain the same, so it is impossible to use the precise binding mode of the Authentication Authorization Accounting (AAA) server to authenticate the identity, access control and billing of each user; wherein, the precise binding mode refers to the precise binding of the authentication information of the user account with a specific network resource (for example, QinQ information) to ensure that only authenticated user accounts can access specific network resources.

[0078] The difference between the VNI resource non-orchestration solution and the VNI resource orchestration solution is that WAN resource planning does not require the specification of the VNI and QinQ information on the WAN side. When the user terminal performs WAN account verification and identity authentication, since the VNI range is from 0 to 16777215, the management platform will automatically allocate a very large (for example, 1000000) VNI resource from the WAN side resource pool to the account, thereby ensuring that the QinQ information on the WAN side is consistent with the QinQ on the LAN side.

[0079] However, in the campus network scenario, multiple users in the same dormitory often share the same optical modem (i.e., optical modem), so the QinQ information of each user account using the campus network in the dormitory is the same on the LAN side. It is impossible to distinguish users in the same dormitory, and it is impossible to charge each user account, causing great economic losses to the operator.

[0080] And no matter whether the VNI resource arrangement scheme or the VNI resource non-arrangement scheme is adopted, the VNI and QinQ information on the LAN side are issued indiscriminately with one click, which is very likely to cause resource waste. For example, when an access gateway is designed to support up to 24,000 users to access at the same time, there are 6 planned private VLANs (PrivateVLAN, abbreviated as PVLAN), and the planned customer VLAN (Customer VLAN, abbreviated as CVLAN) ranges from 2 to 4094, because the QinQ information of each dormitory actually deployed in the same campus network is not continuous, that is, not all dormitories are configured according to the same virtual local area network (Virtual Local Area Network, abbreviated as VLAN) planning, resulting in some PVLANs actually carrying only 300 to 500 users, and the actual number of users carried is far lower than the maximum carrying capacity of the cloud gateway. Since all available VNI resources have been sent to the network at one time, the specifications of the cloud gateway are fully occupied in the early stage, and the capacity cannot be expanded later. It is impossible to adjust the planning and allocation of VNI resources by cutting over QinQ links from other schools (for example, migrating related network equipment from other schools). Among them, PVLAN is used to distinguish different user groups or services at the physical network level, and CVLAN is used to further subdivide users or business flows logically.

[0081] In order to solve the above problems, an embodiment of the present invention provides a method for on-demand generation of VNI resources. Specifically, a management platform pre-plans first forwarding resource information and second forwarding resource information, sends the first forwarding resource information to the access vSwitch, and sends the second forwarding resource information to the vCPE; wherein the first forwarding resource information and the second forwarding resource information are: a specific allocation plan for VNI resources on the LAN side; in one embodiment, the first forwarding resource information may include an identifier of an instance group to which the VNI, PVLAN, CVLAN and EVPN (Ethernet Virtual Private Network) on the LAN side belong; wherein EVPN is a Layer 2 VPN technology, the control plane uses MP-BGP to announce EVPN routing information, and the data plane uses VXLAN or MPLS encapsulation to forward packets; the second forwarding resource information may include the VNI, PVLAN, CVLAN, gateway MAC address and IPv4 address pool information on the LAN side, and the IPv4 address pool information refers to a set of IPv4 addresses of network devices on the LAN side.

[0082] After the first forwarding resource information is sent to the access vSwitch of the access gateway and the second forwarding resource information is sent to the vCPE of the access gateway, the access gateway saves the first forwarding resource information and the second forwarding resource information to the database to record the current VNI resource configuration; in order to implement the on-demand delivery of VNI resources and initiate the message forwarding process, such as Figure 2 As shown, the method for generating VNI resources on demand includes:

[0083] Step 10: The access vSwitch sends the first forwarding resource information to the network device connected to the access vSwitch on the local area network side; the vCPE sends the second forwarding resource information to the network device connected to the vCPE on the local area network side.

[0084] Among them, Figure 1 As shown in FIG. 1 , the network device connected to the access vSwitch on the LAN side refers to: the network device between the user terminal and the access vSwitch, for example, ONU; for example, the network device connected to the vCPE on the LAN side includes the access vSwitch and the router (such as Figure 1 After receiving the specific allocation plan of VNI resources from the management platform, the access vSwitch and vCPE respectively configure the received specific allocation plan to the network devices located on their own LAN side.

[0085] Step 20: The access vSwitch receives a user terminal message, and obtains a corresponding LAN side VNI based on the user terminal message and the first forwarding resource information, so as to use the LAN side VNI to forward the corresponding message between the network device connected to the access vSwitch on the LAN side and the access vSwitch.

[0086] After the LAN-side network device accessing the vSwitch is configured according to the specific allocation plan, when the user traffic (ie, message) from the user terminal reaches the network device between the user terminal and the access vSwitch, the LAN-side VNI can be used to identify the user traffic.

[0087] Step 30: The vCPE receives the DNS message, and initializes the LAN instance according to the second forwarding resource information based on the DNS message; between the network device connected to the vCPE on the LAN side and the vCPE, the LAN instance is used to forward the corresponding message to enable the user terminal to access the Internet.

[0088] Among them, the Domain Name System (DNS) message is a protocol message used to implement the mapping of domain names to IP addresses. The user terminal requests to access the Internet by sending a DNS message. After the LAN side network device of the vCPE is configured according to the specific allocation plan, when the user traffic (i.e., message) from the user terminal reaches the network device connected to the vCPE, the EVPN instance (i.e., LAN instance) on the LAN side is generated according to the VNI, PVLAN, CVLAN, gateway MAC address and Internet Protocol version 4 (IPv4) address pool information on the LAN side in the second forwarding resource information; in one embodiment, the LAN instance can be a terminal table, which includes terminal device information and network connection information (IP address assigned to the terminal device, MAC address of the terminal device), etc.; at this point, the VNI resources pre-planned on demand are issued, and the corresponding message forwarding path is generated, the message forwarding process is opened, and the user traffic can be transmitted based on the LAN instance to achieve the purpose of the user terminal accessing the Internet.

[0089] The present invention pre-plans VNI resources, so it can ensure the rationality of resource planning and allocation in combination with the actual usage and demand of VNI resources; in order to configure VNI resources according to the plan, the corresponding LAN side VNI is obtained according to the pre-planned first forwarding resource information, and the LAN side VNI is used to configure the message forwarding path of the access vSwitch on the LAN side; the LAN instance is initialized according to the pre-planned second forwarding resource information, and the message forwarding path of the vCPE on the LAN side is configured based on the LAN instance, and then the corresponding VNI is configured for the network equipment in the LAN on demand, and the corresponding message forwarding path is generated; while simplifying the configuration process, the waste of VNI resources is avoided as much as possible, and the problem of QinQ and VNI resource waste caused by indiscriminate one-click delivery of all available VNI resources is solved.

[0090] The following is a detailed description of the method for generating VNI resources on demand according to an embodiment of the present invention:

[0091] The first forwarding resource information includes a first configuration resource plan and a first EVPN plan; wherein, the first configuration resource plan is: a mapping relationship between VNI, PVLAN and CVLAN; the second forwarding resource information includes a second configuration resource plan, a gateway MAC address and an address pool information; wherein, the second configuration resource plan is: a mapping relationship between VNI, PVLAN and CVLAN.

[0092] Among them, VNI is used to identify the VXLAN layer 2 network, each VNI represents a tenant, and VNI can be used to achieve large-scale tenant isolation, solving the problem of limited traditional VLAN resources; on this basis, PVLAN is used to use two-layer VLAN isolation technology to achieve port isolation to improve network security; on this basis, CVLAN is used to achieve isolation and communication between different users or departments within the enterprise network, improving network security and management efficiency. The embodiment of the present invention uses VXLAN to create a virtual network (that is, each virtual network has a unique VNI), and then uses PVLAN inside the virtual network to further enhance security, and uses CVLAN to isolate the traffic of different customers or services; wherein, the first configuration resource planning and the second configuration resource planning both use a combination of VNI, PVLAN and CVLAN to identify the user terminal, and the difference between the first configuration resource planning and the second configuration resource planning is that the first configuration resource planning is issued by the management platform to the access vSwitch, and the second configuration resource planning is issued by the management platform to the vCPE, and the two have different uses.

[0093] MAC address is the media access control address, also known as the physical address, which is used to define the location of a network device. In a local area network, each network device has a unique MAC address, which is used to identify the location of the network device in the network. The gateway MAC address is the physical address of the hardware interface of the gateway device.

[0094] In one embodiment, the address pool information may be IPv4 address pool information.

[0095] Before step 20, it also includes: the access vSwitch configures the corresponding service route according to the first configuration resource planning, so that the access vSwitch forwards the received message to the service path corresponding to the service route according to the received LAN side VNI and user PVLAN information. In the campus network scenario, when matching and issuing routes according to the first configuration resource planning, Portal authentication and campus intranet authentication need to be performed; wherein, Portal authentication is a Web authentication method, and users can log in to their accounts and pass the identity authentication through the Portal authentication service before they can access the campus intranet; campus intranet service refers to the service for accessing campus internal network resources provided by the network accessed by the access vSwitch, and users can log in to their accounts and pass the campus intranet authentication. After the operator provides the user with access to the campus intranet service. Among them, the service path corresponding to the service route can be: a message forwarding path composed of multiple service routes for Portal authentication services. When a user terminal accesses the campus intranet, when the corresponding user traffic (ie, message) reaches the access vSwitch, the access vSwitch forwards the user traffic according to the received LAN side VNI and user PVLAN information.

[0096] To illustrate the process of obtaining the VNI on the LAN side, Figure 3 As shown, in step 20, the access vSwitch receives a user terminal message, and obtains the corresponding LAN side VNI according to the user terminal message and the first forwarding resource information, including:

[0097] Step 201: Acquire user network group information and user QinQ information from the user terminal message.

[0098] The user network group information is: unique identification information of the LAN instance of the user terminal (ie, the EVPN instance on the LAN side); and the user QinQ information is: QinQ information of the user terminal.

[0099] Step 202: According to the first configuration resource plan and the first EVPN plan, find the LAN side VNI corresponding to the user network group information and the user QinQ information, and obtain the user PVLAN information and the user CVLAN information based on the LAN side VNI.

[0100] Since the access gateway has saved the first forwarding resource information and the second forwarding resource information to the database, the user network group information and the LAN side VNI corresponding to the user QinQ information are found from the database, and the user PVLAN information and the user CVLAN information are further found, so as to determine the message forwarding path of the user terminal according to the combination of the LAN side VNI, the user PVLAN information and the user CVLAN information.

[0101] Step 203: Generate a tenant forwarding rule corresponding to the user terminal message according to the found LAN side VNI, the user PVLAN information and the user CVLAN information, and configure the tenant forwarding rule to the access vSwitch and the network device connected to the access vSwitch, so as to forward the corresponding message generated based on the user terminal message according to the tenant forwarding rule.

[0102] The tenant forwarding rule is the forwarding rule of the access vSwitch on the LAN side for the packets from the user terminal. After generating the tenant forwarding rule, it is also necessary to update or reconfigure the detailed information of the service route according to the VNI on the LAN side and the user QinQ information to ensure that the network configuration is updated to the latest status.

[0103] In order to illustrate the process of obtaining the LAN side VNI, user PVLAN information and user CVLAN information, as shown in the following example: Figure 4 As shown, step 202 includes:

[0104] Step 2021: Obtain QinQ configuration information of the current network; wherein the QinQ configuration information includes: device VNI of the port with QinQ function enabled.

[0105] Step 2022: Obtain an association mapping relationship from the first EVPN plan; wherein the association mapping relationship is: a mapping relationship between device VNI, current network group information and device QinQ information.

[0106] Step 2023: According to the association mapping relationship, match the current network group information with the user network group information, and match the device QinQ information with the user QinQ information to obtain a matching device VNI, and use the matching device VNI as the LAN side VNI.

[0107] Step 2024: Use the LAN-side VNI to find out the user PVLAN information and user CVLAN information to which the user terminal message belongs in the first configuration resource planning.

[0108] Among them, according to the mapping relationship between VNI, PVLAN and CVLAN in the first configuration resource planning, the PVLAN corresponding to the VNI on the LAN side is found, and the PVLAN is used as the user PVLAN information, and the CVLAN corresponding to the VNI on the LAN side is found, and the CVLAN is used as the user CVLAN information.

[0109] In step 20, the use of the LAN side VNI to forward the corresponding message between the network device connected to the access vSwitch on the LAN side and the access vSwitch also includes: the access vSwitch adds the LAN side VNI, the user PVLAN information and the user CVLAN information to the user terminal message to obtain a configuration information message; forwards the configuration information message to the vCPE so that the vCPE loads the terminal configuration on the LAN side. Among them, the specific encapsulation rules for the access vSwitch to add the LAN side VNI, user PVLAN information and user CVLAN information to the user terminal message are selected by those skilled in the art according to the specific usage scenario and are not limited here. In one embodiment, according to the default rules, all messages that do not specify specific forwarding rules will be forwarded to the vCPE for processing to ensure that the user traffic of all user terminals can be managed and monitored, while also providing a unified network entry point for each tenant. After receiving the configuration information message, the vCPE uses the LAN side VNI, user PVLAN information and user CVLAN information to configure the network devices on its LAN side; in one embodiment, the vCPE can allocate addresses to each network device according to the DHCP protocol.

[0110] Next, if a user terminal using the campus network wants to access the Internet, it must first log in to the Portal server of the edge network, that is, pass the user authentication; the user's account can only be used to access the Internet after it passes the login verification. The embodiment of the present invention uses a combination of the LAN side VNI and the user's PVLAN information to perform user authentication. Figure 5As shown, in one embodiment, the management platform can send the message forwarding rules of the LAN side VNI and user PVLAN information to the access vSwitch according to the LAN side VNI resource planning, and the access gateway will forward it to the Portal server according to the message forwarding rules, execute account login, and perform authentication verification; when the authentication is passed, the management platform sends the message forwarding rules, service routes, and terminal account information of each network device on the LAN side and the WAN side to the access vSwitch.

[0111] In an embodiment of the present invention, the user QinQ information on the LAN side of the vCPE is consistent with the user QinQ information on the WAN side; that is, on the vCPE, both the LAN side and the WAN side use the same VLAN tag (that is, QinQ information) configuration. The VNI and MAC address of the network device on the WAN side of the vCPE remain unique. During the user authentication process of an embodiment of the present invention, the management platform does not need to specify the VNI on the WAN side and the QinQ information on the WAN side, thereby avoiding the need to program the VNI and keeping the QinQ information on the WAN side and the LAN side consistent. At the same time, combined with the aforementioned steps 10 to 30, it is possible to distinguish different users under the same optical modem, and then the precise binding mode of the AAA server can be used to achieve accurate billing for each user.

[0112] Next, in order to explain the process of vCPE initializing the LAN instance, Figure 6 As shown, in step 30, initializing the local area network instance according to the DNS message and the second forwarding resource information includes:

[0113] Step 301: Obtain the IP address to be accessed and the client IP address from the DNS message; and find out the IP address range corresponding to the IP address to be accessed and the client IP address in the gateway MAC address and the address pool information.

[0114] The DNS message carries the domain name of the Internet that the user terminal requests to access. The vCPE requests the DNS server to resolve the DNS message and obtains the resolution result (that is, the IP address corresponding to the domain name) and information such as LAN_EVPN_GROUP (Ethernet Virtual Private Network Group).

[0115] Step 302: Based on the second configuration resource planning, obtain the instance VNI, instance PVLAN information and instance CVLAN information corresponding to the IP address range.

[0116] The vCPE then searches for the VNI associated with the IP address range and uses it as the instance VNI. Then, according to the mapping relationship between VNI, PVLAN, and CVLAN in the second configuration resource planning, the PVLAN corresponding to the instance VNI is searched and used as the instance PVLAN information, and the CVLAN corresponding to the instance VNI is searched and used as the instance CVLAN information.

[0117] Step 303: Use the instance VNI, the instance PVLAN information and the instance CVLAN information to initialize the LAN instance, terminal table and instance address pool, so as to allocate instance addresses to corresponding user terminals based on the LAN instance, and use the terminal table and the instance address pool to identify and forward messages from the user terminals.

[0118] Among them, the instance address pool is: a collection of IP address ranges dynamically allocated to network devices accessing the LAN instance; the instance address pool is pre-configured; the vCPE will update the status of the instance address pool, record the allocated IP addresses, and ensure that the IP addresses in the instance address pool will not be allocated repeatedly.

[0119] Embodiment 2:

[0120] On the basis of Embodiment 1 of the present invention, this embodiment further provides a specific example of a message forwarding process for a user terminal to access the Internet.

[0121] According to Example 1 of the present invention, the user QinQ information on the LAN side of the vCPE is consistent with the user QinQ information on the WAN side, and the VNI and MAC address of the network device on the WAN side of the vCPE remain unique; on this basis, the method for generating VNI resources on demand also includes: configuring the tenant forwarding rules of the access vSwitch based on the VNI and user QinQ information of the network device, so as to find the forwarding rules corresponding to the received VNI and user QinQ information of the network device in the tenant forwarding rules to obtain the corresponding message forwarding path.

[0122] like Figure 7 As shown, the vCPE receives a DNS message, and initializes a local area network instance according to the second forwarding resource information according to the DNS message; between the network device connected to the vCPE on the local area network side and the vCPE, forwarding the corresponding message using the local area network instance also includes:

[0123] Step 401: When the user terminal accesses the Internet, the vCPE obtains the account information bound to the user terminal from the received DNS message; based on the account information, obtains the VNI and user QinQ information of the network device on the WAN side of the vCPE.

[0124] The account information bound to the user terminal refers to the account information used by the user to log in when performing Portal authentication.

[0125] Step 402: The vCPE encapsulates the VNI and user QinQ information of the network device on the WAN side into the DNS message, obtains a WAN message, and sends the WAN message to the Internet; on the Internet, the WAN message is forwarded and processed according to the VNI and user QinQ information of the network device on the WAN side.

[0126] Step 403: When the access vSwitch receives the return message corresponding to the WAN message, it obtains the unique VNI of the network device on the WAN side of the access vSwitch according to the account WAN MAC address corresponding to the account information, and forwards the return message to the vCPE according to the unique VNI to transmit the corresponding message back to the user terminal.

[0127] In one embodiment, according to the default rules, all messages that do not specify specific forwarding rules will be forwarded to the vCPE for processing according to the unique VNI; the vCPE will perform a subsequent destination network address translation (DNAT) process, and the specific implementation method of the DNAT process will be selected by technical personnel in this field according to the specific usage scenario; finally, the message after address conversion will be returned to the user terminal to enable the user terminal to access the Internet.

[0128] Embodiment 3:

[0129] On the basis of Embodiment 1 and Embodiment 2 of the present invention, in order to support value-added services, such as Figure 8 As shown, it also includes:

[0130] Step 501: When the access vSwitch matches a value-added service, the user QinQ information on the LAN side of the access vSwitch is mapped to the unique service QinQ information of the value-added service.

[0131] Step 502: The service gateway uses the unique service QinQ information to configure its own service forwarding rules to activate the value-added service, so that when the service gateway receives the message of the value-added service, the service gateway processes the message of the value-added service according to the service forwarding rules.

[0132] When a value-added service is matched to the access vSwitch side, it will be processed by QinQ mapping; since the unique service QinQ information is unique on the LAN side of the access vSwitch, after the value-added service is activated, when the user traffic (i.e., message) of the value-added service reaches the corresponding service gateway, the service gateway can identify and correctly process the user traffic of the activated value-added service.

[0133] Embodiment 4:

[0134] like Fig. 9 , which is a schematic diagram of the architecture of the apparatus for generating VNI resources on demand according to an embodiment of the present invention. The apparatus for generating VNI resources on demand according to this embodiment includes one or more processors 21 and a memory 22. Fig. 9 A processor 21 is taken as an example.

[0135] The processor 21 and the memory 22 may be connected via a bus or other means. Fig. 9 The example of connecting through bus is taken in the following.

[0136] The memory 22 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs and non-volatile computer executable programs, such as the method for generating VNI resources on demand in this embodiment. The processor 21 executes the method for generating VNI resources on demand by running the non-volatile software programs and instructions stored in the memory 22.

[0137] The memory 22 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage devices. In some embodiments, the memory 22 may optionally include a memory remotely arranged relative to the processor 21, and these remote memories may be connected to the processor 21 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0138] The program instructions / modules are stored in the memory 22, and when executed by the one or more processors 21, the method for on-demand generation of VNI resources in the above-mentioned embodiment is executed, for example, each step of the method for on-demand generation of VNI resources in the embodiment of the present invention described above is executed.

[0139] An embodiment of the present invention further provides a non-volatile computer storage medium, wherein the computer storage medium stores computer executable instructions, and the computer executable instructions are executed by one or more processors, such as Fig. 9 A processor 21 can enable the one or more processors to execute the method for generating VNI resources on demand in the specific implementation manner of the present invention, for example, to execute each step of the method for generating VNI resources on demand in the embodiment of the present invention described above; it can also implement Fig. 9 The modules and units described above; or executing the method for generating VNI resources on demand in a specific embodiment of the present invention, for example, executing the steps of the method for generating VNI resources on demand in the embodiment of the present invention described above; it can also be implemented Fig. 9 The various modules and units described.

[0140] It is worth noting that the information interaction, execution process, etc. between the modules and units within the above-mentioned devices and systems are based on the same concept as the processing method embodiment of the present invention. The specific contents can be found in the description of the method embodiment of the present invention and will not be repeated here.

[0141] A person skilled in the art may understand that all or part of the steps in the various methods of the embodiments may be completed by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, and the storage medium may include: a read-only memory (ROM), a random access memory (RAM), a disk or an optical disk, etc.

[0142] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for generating VNI resources on demand, characterized in that: The management platform pre-plans the first forwarding resource information and the second forwarding resource information, sends the first forwarding resource information to the access vSwitch, and sends the second forwarding resource information to the vCPE; The method for generating VNI resources on demand includes: The access vSwitch sends the first forwarding resource information to a network device connected to the access vSwitch on the local area network side; the vCPE sends the second forwarding resource information to a network device connected to the vCPE on the local area network side; The access vSwitch receives a user terminal message, and obtains a corresponding LAN side VNI according to the user terminal message and the first forwarding resource information, so as to forward the corresponding message between a network device connected to the access vSwitch on the LAN side and the access vSwitch using the LAN side VNI; The vCPE receives the DNS message, and initializes the LAN instance according to the DNS message and the second forwarding resource information; and uses the LAN instance to forward corresponding messages between the network device connected to the vCPE on the LAN side and the vCPE to enable the user terminal to access the Internet.

2. The method for generating VNI resources on demand according to claim 1, characterized in that: The first forwarding resource information includes a first configuration resource plan and a first EVPN plan; wherein the first configuration resource plan is: a mapping relationship between VNI, PVLAN and CVLAN; The access vSwitch receives a user terminal message, and obtains a corresponding LAN-side VNI according to the user terminal message and the first forwarding resource information, including: Acquire user network group information and user QinQ information from the user terminal message; According to the first configuration resource plan and the first EVPN plan, find the LAN-side VNI corresponding to the user network group information and the user QinQ information, and obtain the user PVLAN information and the user CVLAN information based on the LAN-side VNI; According to the found LAN side VNI, the user PVLAN information and the user CVLAN information, a tenant forwarding rule corresponding to the user terminal message is generated, and the tenant forwarding rule is configured to the access vSwitch and the network device connected to the access vSwitch, so as to forward the corresponding message generated based on the user terminal message according to the tenant forwarding rule.

3. The method for generating VNI resources on demand according to claim 2, characterized in that: The step of finding the LAN-side VNI corresponding to the user network group information and the user QinQ information according to the first configuration resource planning and the first EVPN planning, and obtaining the user PVLAN information and the user CVLAN information based on the LAN-side VNI includes: Obtain QinQ configuration information of the current network; wherein the QinQ configuration information includes: device VNI of the port with QinQ function enabled; Acquire an association mapping relationship from the first EVPN plan; wherein the association mapping relationship is: a mapping relationship between a device VNI, current network group information, and device QinQ information; According to the association mapping relationship, match the current network group information with the user network group information, and match the device QinQ information with the user QinQ information to obtain a matched device VNI, and use the matched device VNI as the LAN side VNI; The LAN-side VNI is used to find out the user PVLAN information and user CVLAN information to which the user terminal message belongs in the first configuration resource planning.

4. The method for generating VNI resources on demand according to claim 2, characterized in that: The method of forwarding the corresponding message between the access vSwitch and the network device connected to the access vSwitch on the LAN side using the VNI on the LAN side further includes: The access vSwitch adds the LAN side VNI, the user PVLAN information and the user CVLAN information to the user terminal message to obtain a configuration information message; and forwards the configuration information message to the vCPE so that the vCPE loads the terminal configuration on the LAN side.

5. The method for generating VNI resources on demand according to claim 4, characterized in that: The second forwarding resource information includes a second configuration resource plan, a gateway MAC address, and address pool information; wherein the second configuration resource plan is: a mapping relationship between VNI, PVLAN, and CVLAN; The initializing the local area network instance according to the DNS message and the second forwarding resource information includes: Obtain the IP address to be accessed and the client IP address from the DNS message; find out the IP address range corresponding to the IP address to be accessed and the client IP address in the gateway MAC address and the address pool information; Based on the second configuration resource planning, obtain the instance VNI, instance PVLAN information and instance CVLAN information corresponding to the IP address range; The instance VNI, the instance PVLAN information and the instance CVLAN information are used to initialize the LAN instance, the terminal table and the instance address pool, so as to allocate instance addresses to corresponding user terminals based on the LAN instance, and to identify and forward messages from the user terminals using the terminal table and the instance address pool.

6. The method for generating VNI resources on demand according to claim 1, characterized in that: The user QinQ information on the LAN side of the vCPE is consistent with the user QinQ information on the WAN side; the VNI and MAC addresses of the network devices on the WAN side of the vCPE are both unique; The method for generating VNI resources on demand further includes: Based on the VNI of the network device and the QinQ information of the user, configure the tenant forwarding rule of the access vSwitch, so as to find the forwarding rule corresponding to the VNI of the network device and the QinQ information of the user received in the tenant forwarding rule to obtain the corresponding message forwarding path; The vCPE receives a DNS message, and initializes a local area network instance according to the second forwarding resource information according to the DNS message; and forwarding corresponding messages using the local area network instance between a network device connected to the vCPE on the local area network side and the vCPE further includes: When the user terminal accesses the Internet, the vCPE obtains the account information bound to the user terminal from the received DNS message; based on the account information, obtains the VNI and user QinQ information of the network device on the WAN side of the vCPE; The vCPE encapsulates the VNI and user QinQ information of the network device on the WAN side into the DNS message, obtains a WAN message, and sends the WAN message to the Internet; on the Internet, forwards and processes the WAN message according to the VNI and user QinQ information of the network device on the WAN side; When the access vSwitch receives the return message corresponding to the WAN message, it obtains the unique VNI of the network device on the WAN side of the access vSwitch according to the account WAN MAC address corresponding to the account information, and forwards the return message to the vCPE according to the unique VNI to transmit the corresponding message back to the user terminal.

7. The method for generating VNI resources on demand according to any one of claims 1 to 6, characterized in that: Also includes: When the access vSwitch matches a value-added service, the user QinQ information on the LAN side of the access vSwitch is mapped to the unique service QinQ information of the value-added service; The service gateway uses the unique service QinQ information to configure its own service forwarding rules to activate the value-added service, so that when the service gateway receives the message of the value-added service, the service gateway processes the message of the value-added service according to the service forwarding rules.

8. The method for generating VNI resources on demand according to any one of claims 1 to 6, characterized in that: Before the access vSwitch receives the user terminal message and obtains the corresponding LAN-side VNI according to the user terminal message and the first forwarding resource information, the method further includes: The access vSwitch configures the corresponding service route according to the first configuration resource planning, so that the access vSwitch forwards the received message to the service path corresponding to the service route according to the received LAN side VNI and user PVLAN information.

9. A device for generating VNI resources on demand, characterized in that: The device for generating VNI resources on demand includes at least one processor and a memory, and the at least one processor and the memory are connected via a data bus. The memory stores instructions that can be executed by the at least one processor. After being executed by the processor, the instructions are used to implement the method for generating VNI resources on demand as described in any one of claims 1-8.

10. A non-volatile computer storage medium, characterized in that: The computer storage medium stores computer executable instructions, and the computer executable instructions are executed by one or more processors to complete the method for on-demand generation of VNI resources as described in any one of claims 1-8.

Images