Butt-joint processing method and device of sub-interface, equipment and medium

Abstract

The invention relates to a sub-interface docking processing method and device, equipment and a medium. The docking processing method comprises the following steps: acquiring docking type information; determining a sub-interface docking mode of the gateway and the firewall according to the docking type information; according to the sub-interface docking mode, performing sub-interface parameter distribution in combination with preset sub-interface docking configuration information to obtain sub-interface docking parameters; and establishing sub-interface docking of the gateway and the firewall according to the sub-interface docking parameter, so as to realize sub-interface docking on the gateway and the firewall, thereby quickly realizing docking configuration of the gateway and the firewall sub-interface, and improving docking efficiency.

Description

Technical Field

[0001] This application relates to the technical field of telecommunications networks, and in particular, to a method, apparatus, device, and medium for docking and processing sub-interfaces. Background Art

[0002] A telecommunications network is a public facility of a telecommunications system, which refers to a set of nodes and links that provide connections between two or more specified points in order to establish telecommunications services and information between these points.

[0003] In a telecommunications network, communication between network elements deployed in different security domains needs to pass through a firewall. Due to reliability requirements, gateways and firewalls are generally configured in pairs and cross-connected, with four groups of interface docking relationships. When there is a need for a cross-wall service, based on the four groups of interface docking relationships, the gateway and the firewall need to allocate dedicated sub-interfaces for the cross-wall service on the four docking interfaces for communication. Currently, mainly the maintenance personnel of the gateway and the firewall configure and conduct joint debugging tests on the gateway device and the firewall device according to the docking method. However, this requires the maintenance personnel to configure the parameters required for the docking of the gateway and firewall sub-interfaces based on the professional knowledge of the gateway and the firewall, resulting in a large workload and a long time consumption for the maintenance personnel during the docking process of the gateway and firewall sub-interfaces. Summary of the Invention

[0004] To solve the above technical problems or at least partially solve the above technical problems, this application provides a docking processing method, apparatus, device, and medium.

[0005] In a first aspect, this application provides a method for docking and processing sub-interfaces, including:

[0006] Obtain docking type information;

[0007] Determine the sub-interface docking method of the gateway and the firewall according to the docking type information;

[0008] Allocate sub-interface parameters in combination with preset sub-interface docking configuration information according to the sub-interface docking method to obtain sub-interface docking parameters;

[0009] Establish the sub-interface docking of the gateway and the firewall according to the sub-interface docking parameters.

[0010] In a second aspect, this application provides a device for docking and processing sub-interfaces, including:

[0011] A docking type information acquisition module, configured to obtain the docking type information input by the user;

[0012] A docking method determination module, configured to determine the sub-interface docking method of the gateway and the firewall according to the docking type information;

[0013] The sub - interface parameter allocation processing module is used to perform sub - interface parameter allocation processing according to the sub - interface docking method and in combination with the preset sub - interface docking configuration information to obtain sub - interface docking parameters;

[0014] The sub - interface docking establishment module is used to establish the sub - interface docking between the gateway and the firewall according to the sub - interface docking parameters.

[0015] In a third aspect, the present application provides a sub - interface docking processing device, including: a processor, a communication interface, a memory, and a communication bus. Among them, the processor, the communication interface, and the memory complete mutual communication through the communication bus;

[0016] The memory is used to store computer programs;

[0017] The processor is used to implement the docking processing method as described in any one of the first aspects when executing the programs stored on the memory.

[0018] In a fourth aspect, the present application provides a computer - readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the docking processing method as described in any one of the first aspects are implemented.

[0019] In summary, in the embodiments of the present application, by obtaining the docking type information, and determining the sub - interface docking method between the gateway and the firewall according to the obtained docking type information, so as to perform sub - interface parameter allocation according to the sub - interface docking method and in combination with the preset sub - interface docking configuration information, the automatic allocation of docking parameters for the sub - interface docking between the gateway and the firewall is realized, and the sub - interface docking parameters are obtained. Subsequently, the sub - interface docking between the gateway and the firewall is established according to the sub - interface docking parameters to implement the sub - interface docking on the gateway and the firewall, thereby simplifying the complexity of the sub - interface docking between the gateway and the firewall, being able to quickly implement the docking configuration of the sub - interface between the gateway and the firewall, and improving the docking efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The accompanying drawings herein are incorporated into the specification and constitute a part of the specification, showing embodiments consistent with the present invention and used together with the specification to explain the principles of the present invention.

[0021] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the accompanying drawings required for use in the description of the embodiments or the prior art. Obviously, for those of ordinary skill in the art, other accompanying drawings can be obtained based on these drawings without creative efforts.

[0022] Figure 1 It is a communication schematic diagram provided in the related art for network elements deployed in different security domains;

[0023] Figure 2 It is a schematic cross - connection diagram of a paired configuration of a gateway and a firewall provided in the existing related technology;

[0024] Figure 3 It is a schematic diagram of centrally configuring and managing a gateway and a firewall in NFVO / MEO in the existing related technology;

[0025] Figure 4 It is a schematic step - flow diagram of a method for docking and processing sub - interfaces provided in an embodiment of the present application;

[0026] Figure 5 It is a schematic diagram of the physical port connection relationship information of a gateway and a firewall provided in an example of the present application;

[0027] Figure 6 It is a schematic cross - connection diagram of the sub - interface docking parameter range information provided in an example of the present application;

[0028] Figure 7 It is a schematic diagram of the physical port connection relationship information of a gateway and a firewall provided in an example of the present application;

[0029] Figure 8 It is a schematic diagram of the sub - interface docking parameter range information provided in an example of the present application;

[0030] Figure 9 It is a schematic diagram of the gateway docking parameters generated for the static route docking method in an example of the present application;

[0031] Figure 10 It is a schematic diagram of the firewall docking parameters generated for the static route docking method in an example of the present application;

[0032] Figure 11 It is a schematic diagram of the gateway docking parameters generated for the BGP docking method in an example of the present application;

[0033] Figure 12 It is a schematic diagram of the firewall docking parameters generated for the BGP docking method in an example of the present application;

[0034] Figure 13 It is a schematic diagram of an orchestration and management system introducing a sub - interface docking manager provided in an example of the present application;

[0035] Figure 14 It is a schematic diagram of the communication between a UPF passing through the firewall and an application APP deployed in the isolation area provided in an example of the present application;

[0036] Figure 15 It is a structural block diagram of a sub - interface docking processing device provided in an embodiment of the present application;

[0037] Figure 16 The structural schematic diagram of a docking processing device for a sub-interface provided for the examples of this application. Specific implementation manners

[0038] To make the objectives, technical solutions and advantages of the embodiments of this application clearer, the technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings in the embodiments of this application. Obviously, the described embodiments are some but not all of the embodiments of this application. All other embodiments obtained by those of ordinary skill in the art based on the embodiments in this application without making creative efforts shall fall within the protection scope of this application.

[0039] In a telecommunication network, based on security requirements, the communication between network elements deployed in different security regions usually needs to go through gateways and firewalls, as Figure 1 shown. Among them, the security regions can be divided into a trusted zone and a demilitarized zone (DMZ). For reliability requirements, gateways and firewalls are generally configured in pairs. In the case of cross-docking between gateways and firewalls, there are 4 groups of interface docking relationships, as Figure 2 shown. The docking methods include a static routing docking method and a dynamic routing docking method. The dynamic routing docking method is divided into a Border Gateway Protocol (BGP) method and an Open Shortest Path First (OSPF) method. The docking parameters include docking type, interconnected sub-interface address and network segment, virtual local area network number (VLAN ID), connected physical port, service virtual address, virtual router number (ID), etc. The docking configuration of the gateway and firewall sub-interfaces is relatively complex. In the existing related technologies, generally, the gateway and firewall maintenance personnel negotiate according to the docking method, and then perform configuration and joint debugging tests on their respective devices. This docking process has a large workload and takes a long time, generally about one week.

[0040] With the development of the network function virtualization orchestration management system, gateways and firewalls can be centrally configured and managed on a network function virtualization orchestrator (NFVO) or a multi-access edge orchestrator (MEO), as Figure 3As shown in the figure, the NFVO / MEO centrally configures gateway and firewall devices through the SND controller and the security controller. This can greatly simplify the sub-interface docking configuration of the gateway and the firewall. However, the docking parameters involve the configuration of 4 groups of sub-interface docking parameters, with complex design and requiring professional knowledge of the gateway and the firewall, posing extremely high requirements for NFVO maintenance personnel. How to automatically generate the docking parameters of the gateway and firewall configuration sub-interfaces is an urgent problem to be solved.

[0041] Based on the above, this application proposes a docking processing method, device, equipment and medium for sub-interfaces, realizing the automatic configuration of the docking parameters of the gateway and firewall sub-interfaces, thereby simplifying the docking complexity of the gateway and firewall sub-interfaces and improving the docking efficiency and maintainability.

[0042] To facilitate the understanding of the embodiments of this application, the following will further explain with specific embodiments in conjunction with the accompanying drawings. The embodiments do not constitute a limitation to the embodiments of this application.

[0043] Figure 4 It is a schematic flowchart of the steps of a docking processing method for sub-interfaces provided by an embodiment of this application. The docking processing method for sub-interfaces provided by this embodiment may include the following steps:

[0044] Step 410, obtain docking type information;

[0045] In this step, the docking type information may include various information for determining the sub-interface docking method. For example, it may be the docking type information input by the user, and this embodiment does not limit this. For example, in the case where the cross-connection relationship of the physical ports of the gateway and the firewall is pre-configured in the sub-interface docking manager, the user can, according to the need, select or input the sub-interface docking method on the operation interface of the sub-interface docking manager, so that the sub-interface docking manager can obtain the docking type information input by the user based on the selected or input sub-interface docking method. It should be noted that the user can choose the static route docking method or the dynamic route docking according to the need, or can also choose the BGP method or the OSPF method, and this embodiment does not limit this.

[0046] Step 420, determine the sub-interface docking method of the gateway and the firewall according to the docking type information;

[0047] In this step, the sub-interface docking method between the gateway and the firewall can be determined according to the keyword of the docking method included in the obtained docking type information. For example, when the keyword of the docking method included in the docking type information is BGP, it can be determined that the sub-interface docking method between the gateway and the firewall is the BGP docking method; when the keyword of the docking method included in the docking type information is OSPF, it can be determined that the sub-interface docking method between the gateway and the firewall is the OSPF docking method; when the keyword of the docking method included in the docking type information is static, it can be determined that the sub-interface docking method between the gateway and the firewall is the static routing docking method.

[0048] Step 430: According to the sub-interface docking method, combined with the preset sub-interface docking configuration information, perform sub-interface parameter allocation to obtain sub-interface docking parameters.

[0049] In this step, the preset sub-interface docking configuration information may refer to the sub-interface docking parameter information pre-configured for sub-interface docking, which may specifically include sub-interface docking parameters and the available range of sub-interface docking parameters. After determining the sub-interface docking method between the gateway and the firewall, the sub-interface docking parameters can be allocated according to this sub-interface docking method, combined with the sub-interface docking configuration information, so as to automatically generate the sub-interface docking parameters for the gateway and the firewall configuration, and obtain the sub-interface docking parameters, achieving the purpose of automatically allocating docking parameters for the sub-interface docking between the gateway and the firewall. Among them, the sub-interface docking parameters may include the docking parameters automatically allocated for the sub-interface docking between the gateway and the firewall, which may specifically include parameters such as the interconnected sub-interface address network segment parameter, virtual local area network identifier parameter, service virtual address parameter, and virtual router identifier parameter, etc. This embodiment does not make specific limitations on this.

[0050] Step 440: Establish the sub-interface docking between the gateway and the firewall based on the sub-interface docking parameters.

[0051] Specifically, in this embodiment, after obtaining the sub-interface docking parameters, the sub-interface docking between the gateway and the firewall can be established by using the sub-interface docking parameters, thereby realizing the interconnection of the sub-interfaces of the gateway and the firewall. For example, based on the allocated sub-interface docking parameters, commands can be sent to the SDN controller and the security controller respectively to create the sub-interfaces of the gateway and the firewall, and associate the corresponding virtual router (Virtual Routing and Forwarding, VRF) and virtual firewall (Virtual System, vSys), establish the sub-interface docking between the gateway and the firewall, so as to realize the sub-interface docking on the gateway and the firewall, and realize the intercommunication of the sub-interfaces of the gateway and the firewall.

[0052] It can be seen that in the embodiment of the present application, by obtaining the docking type information and determining the sub-interface docking method of the gateway and the firewall according to the obtained docking type information, and then allocating sub-interface parameters according to the sub-interface docking method in combination with the preset sub-interface docking configuration information, it realizes automatically allocating docking parameters for the sub-interfaces of the gateway and the firewall to obtain the sub-interface docking parameters. Subsequently, based on the sub-interface docking parameters, the sub-interface docking of the gateway and the firewall is established to implement the sub-interface docking on the gateway and the firewall, thereby simplifying the complexity of the sub-interface docking of the gateway and the firewall, being able to quickly implement the docking configuration of the sub-interfaces of the gateway and the firewall, and improving the docking efficiency.

[0053] In an embodiment of the present application, the sub-interface docking configuration information can be pre-configured. After obtaining the docking type information input by the user, the sub-interface docking method of the gateway and the firewall can be determined according to the obtained docking type information, and then docking parameters are automatically allocated for the sub-interfaces of the gateway and the firewall according to the sub-interface docking method in combination with the pre-set sub-interface docking configuration information. Among them, the sub-interface docking configuration information can include physical port connection relationship information and sub-interface docking parameter range information. The physical port connection relationship information can be used to determine the physical port connection relationship between the gateway and the firewall, and the sub-interface docking parameter range information can be used to determine the available range of the sub-interface docking parameters.

[0054] In an alternative embodiment, when allocating sub-interface parameters according to the sub-interface docking method in combination with the preset sub-interface docking configuration information to obtain the sub-interface docking parameters, it specifically can include: extracting target available parameters from the sub-interface docking parameter range information according to the sub-interface docking method and the physical port connection relationship information; and allocating sub-interface parameters using the target available parameters according to the sub-interface docking method to obtain the sub-interface docking parameters.

[0055] Exemplarily, the sub-interface docking configuration information can be pre-configured on the sub-interface docking manager in advance, so that the sub-interface docking manager can automatically generate sub-interface docking parameters according to the user's needs, achieving the purpose of automatically allocating docking parameters for the sub-interfaces of the gateway and the firewall.

[0056] Specifically, before implementing the docking parameter allocation, the physical port connection relationship information of the gateway and the firewall and the sub-interface docking parameter range information can be pre-set in the sub-interface docking manager as the preset sub-interface docking configuration information. Among them, the physical port connection relationship information of the gateway and the firewall is as Figure 5 shown, and can include the gateway device identifier, the gateway physical port identifier, the firewall device identifier, and the firewall physical port identifier, etc.; the sub-interface docking parameter range information can be used to determine the available range of the sub-interface docking parameters, and specifically can include the sub-interface docking parameters and the parameter available range, such asFigure 6 As shown, the sub-interface docking parameters may include: interconnected sub-interface address and network segment, VLAN ID, service virtual address, virtual router ID, etc.

[0057] After the sub-interface docking configuration information is configured, the sub-interface docking manager can automatically generate sub-interface docking parameters according to user needs. Specifically, after the user inputs the docking type information according to needs, based on the preset physical port connection relationship and the docking type information input by the user, the sub-interface docking parameter management can automatically allocate sub-interface docking parameters from each parameter range, that is, extract target available parameters from the sub-interface docking parameter range information, and according to the sub-interface docking method, use the extracted target available parameters for sub-interface parameter allocation, so as to obtain the sub-interface docking parameters automatically allocated by the sub-interface docking manager.

[0058] It can be seen that in this embodiment, after determining the sub-interface docking method of the gateway and the firewall according to the obtained docking type information, target available parameters can be extracted from the sub-interface docking parameter range information according to this sub-interface docking method and the pre-configured physical port connection relationship information, so as to complete the automatic allocation of sub-interface docking parameters by using the extracted target available parameters according to the sub-interface docking method, achieving the purpose of automatically generating the sub-interface docking configuration parameters of the gateway and the firewall, enabling the sub-interface docking manager to automatically generate the sub-interface docking configuration parameters of the gateway and the firewall when the user only inputs the docking type, greatly reducing the workload of the user in designing the docking configuration parameters of the gateway and the firewall, and quickly realizing the on-demand docking configuration of the gateway and the firewall sub-interface.

[0059] In an optional implementation manner, after obtaining the docking type information in this embodiment, routing docking parameters can be extracted from the docking type information to determine the sub-interface docking method of the gateway and the firewall according to the routing docking parameters. Optionally, the step of determining the sub-interface docking method of the gateway and the firewall according to the docking type information may specifically include: extracting routing docking parameters from the docking type information; determining the docking method corresponding to the routing docking parameters as the sub-interface docking method. Among them, the routing docking parameters can be determined according to the routing docking method, such as may include BGP dynamic routing docking parameters, static routing docking parameters, OSPF dynamic routing docking parameters, etc., and this embodiment does not limit this. For example, in the case where BGP dynamic routing docking parameters and static routing docking parameters are extracted from the docking type information, the BGP docking method corresponding to the BGP dynamic routing docking parameters and the docking method corresponding to the static routing docking parameters can be determined as the sub-interface docking method.

[0060] After determining the sub-interface docking method in this embodiment, the target available parameters can be extracted from the sub-interface docking parameter range information according to the sub-interface docking method and the pre-configured physical port connection relationship information, so as to complete the automatic allocation of sub-interface docking parameters by using the extracted target available parameters according to the sub-interface docking method. In an alternative embodiment, when this embodiment extracts the target available parameters from the sub-interface docking parameter range information according to the sub-interface docking method and the physical port connection relationship information, it may specifically include: using the physical port connection relationship information to determine the physical port connection relationship between the gateway and the firewall; based on the sub-interface docking parameter range information, determining the available range of sub-interface docking parameters; and extracting the target available parameters from the available range of sub-interface docking parameters according to the sub-interface docking method and the physical port connection relationship.

[0061] Exemplarily, the docking processing method of the sub-interface can be used to introduce a sub-interface manager into the orchestration management system, so that the orchestration management system can automatically allocate and generate sub-interface docking parameters through the sub-interface docking manager, realizing the sub-interface docking between the gateway and the firewall. Specifically, before implementation, the connection relationship between the physical ports of the gateway and the firewall can be configured on the sub-interface docking manager according to the physical port connection relationship information as shown in Figure 7 and the available range of sub-interface docking parameters can be configured according to the sub-interface docking parameter range information as shown in Figure 8 . After the sub-interface docking manager configures the sub-interface docking parameter range information and the physical port connection relationship information, the sub-interface docking manager can be used to automatically generate sub-interface docking parameters according to user needs, so as to automatically allocate docking parameters for the sub-interface docking between the gateway and the firewall. Among them, the parameter allocation method can be to allocate in ascending or descending order within the parameter range; for the physical ports of the interconnected gateway and firewall, the network segments and VLAN IDs allocated to their sub-interfaces must be the same, the sub-interface addresses are on the same network segment, and the sub-interface addresses are different.

[0062] For example, for the sub-interface docking of static routes, the sub-interface docking manager can generate two sets of docking parameters for the gateway and the firewall respectively. For example, the gateway docking parameters can be as shown in Figure 9 and the firewall docking parameters can be as shown in Figure 10 ; for the sub-interface docking of dynamic routes, the sub-interface docking manager can generate four sets of docking parameters for the gateway and the firewall respectively. For example, when the sub-interface docking method between the gateway and the firewall is the BGP docking method, the gateway docking parameters can be as shown in Figure 11 and the firewall docking parameters can be as shown in Figure 12 .

[0063] After the sub-interface docking manager automatically allocates and generates sub-interface docking parameters, as shown inFigure 13 As shown, through the NFVO / MEO, the sub-interface docking parameters occurring under the SDN control and security controller can be called, the corresponding virtual gateway VRF and vSys virtual firewall can be associated, and the sub-interface docking between the gateway and the firewall can be established. When the docking between the gateway and the firewall needs to be revoked, the sub-interface docking manager can automatically recycle the allocated sub-interface docking parameters for reuse when there are new docking requirements in the future.

[0064] In an alternative embodiment, based on the sub-interface docking parameter range information, the available range of the sub-interface docking parameters is determined, which may specifically include: using the sub-interface docking parameter range information to determine the parameter range of the docking parameters; determining the status tags corresponding to each docking parameter in the parameter range, where the status tags include the usage status tag and the available status tag; determining the docking parameters corresponding to the available status tag as the available docking parameters; and using the parameter values of the available docking parameters to determine the available range of the sub-interface docking parameters.

[0065] After determining the available range of the sub-interface docking parameters, the target available parameters can be extracted from the sub-interface docking parameter range information according to the sub-interface docking method and the pre-configured physical port connection relationship information, so as to automatically allocate the sub-interface docking parameters according to the sub-interface docking method using the target available parameters. In an alternative embodiment, the present application uses the target available parameters to allocate the sub-interface parameters to obtain the sub-interface docking parameters, which may specifically include: extracting the target allocation parameters from the target available parameters; allocating the target allocation parameters as the sub-interface docking parameters; and setting the status tag corresponding to the sub-interface docking parameters to the usage status tag. Among them, the target allocation parameters may refer to the automatically allocated parameters, which may specifically include the interconnected sub-interface address network segment parameters, virtual local area network identification parameters, service virtual address parameters, and virtual router identification parameters. In this embodiment, while allocating target allocation parameters such as the interconnected sub-interface address network segment parameters, virtual local area network identification parameters, service virtual address parameters, and virtual router identification parameters as the sub-interface docking parameters, the status tag corresponding to the target allocation parameters can be set to the usage status tag, that is, the status tag corresponding to the sub-interface docking parameters is set to the usage status tag to prevent repeated use.

[0066] For example, after the sub-interface docking manager determines the sub-interface docking method according to the docking type information input by the user, it can sequentially select the interconnected sub-interface address and network segment, VLAN ID, service virtual address, and virtual router ID from the sub-interface docking parameter range as the target available parameters according to the sub-interface docking method and the physical port connection relationship, and can label the selected parameters as already used, so as to set the status tag that has been allocated as the sub-interface docking parameter to the usage status tag to prevent repeated use.

[0067] It can be seen that after the sub-interface docking manager pre-configures the physical port connection relationship information and the sub-interface docking parameter range information, when the user only inputs the docking type information, it can determine the sub-interface docking methods of the gateway and the firewall according to the docking type information, and allocate sub-interface parameters using the target available parameters according to the sub-interface docking methods, so as to automatically generate the sub-interface docking configuration parameters of the gateway and the firewall, thereby greatly reducing the workload of the user in designing the docking configuration parameters of the gateway and the firewall, and quickly realizing the on-demand docking configuration of the gateway and the firewall sub-interfaces.

[0068] In an alternative embodiment of the present application, allocating sub-interface parameters using the target available parameters according to the sub-interface docking method to obtain the sub-interface docking parameters may specifically include: when the sub-interface docking method includes a dynamic docking method, determining a target gateway and a target firewall connected to the target gateway; using the target available parameters, allocating the same virtual local area network identifier and the same sub-interface network segment to the sub-interfaces of the target gateway and the target firewall, and allocating different sub-interface addresses to the sub-interfaces of the target gateway and the target firewall; using the virtual local area network identifier, the sub-interface network segment, and the sub-interface address as the sub-interface docking parameters. Among them, the target gateway may refer to a gateway device that needs to configure sub-interface docking parameters; the target firewall may refer to a firewall that needs to perform sub-interface docking with the target gateway.

[0069] Exemplarily, after configuring the physical port cross-connection relationship between the gateway and the firewall and the available range of sub-interface docking parameters on the sub-interface docking manager, the sub-interface manager can be used to determine the sub-interface docking method according to the docking type information selected or input by the user, and can automatically allocate sub-interface docking parameters for the docking of the sub-interface between the firewall and the User Plane Function (UPF) device according to the sub-interface docking method. Specifically, taking the communication between a UPF deployed in the trusted area passing through the firewall to an application APP deployed in the DMZ area as an example, when the user deploys a UPF in the trusted area and an application APP in the DMZ, the UPF communicates with the application APP through the firewall, as Figure 14As shown in the figure; among them, the UPF to the firewall can be connected through BGP dynamic routing, and the firewall to the application APP can be connected through static routing. The user can respectively input the BGP dynamic routing connection information and the static routing connection information in the operation interface of the sub-interface connection manager as the connection type information and submit it to the sub-interface connection manager, so that the sub-interface connection manager can generate the following two sets of sub-interface connection parameters based on the input BGP dynamic routing connection information and the static routing connection information: The first set of sub-interface connection parameters is the sub-interface connection parameters used for the UPF to the gateway to the firewall to be connected in accordance with the BGP connection method, which can specifically include the gateway connection parameters as shown in Figure 11 and the firewall connection parameters as shown in Figure 12 ; The second set of sub-interface connection parameters is the sub-interface connection parameters used for the firewall to the application APP to be connected in accordance with the static routing connection, which can specifically include the gateway connection parameters as shown in Figure 9 and the firewall connection parameters as shown in Figure 10 .

[0070] After the sub-interface connection parameters are generated, the sub-interface connection manager can trigger the MEO to respectively call the interfaces controlled by the SDN and the interfaces of the firewall security controller, send down the sub-interface connection parameters, and associate the corresponding VRF and vSys to realize the interconnection of the gateway and firewall sub-interfaces, thereby realizing the automatic configuration of the UPF to the firewall to the APP, and further realizing the communication of the UPF through the firewall to the application APP.

[0071] In the case of the configuration recovery of the UPF to the firewall to the APP, such as when the user cancels the firewall communication for deploying the application APP from the UPF to the DMZ, the MEO can call the interfaces of the SDNC and the security control interface to respectively delete the BGP connection sub-interface connection parameters of the UPF to the firewall and the sub-interface connection parameters of the static connection of the firewall to the application APP, and the recovered sub-interface connection parameters can be recovered by the sub-interface connection manager for the subsequent addition of sub-interface connections of the gateway and the firewall.

[0072] It can be seen that in this example, by integrating the sub-interface connection manager for automatically allocating sub-interface connection parameters for the gateway and the firewall into the NFVO / MEO, the function of the NFVO / MEO can be extended, the security controller can be connected, and the configuration management of the firewall including sub-interfaces can be realized. At the same time, the configuration management of the gateway including sub-interfaces can be realized from the NFVO / MEO to the SDN controller through the VIM, enabling the NFVO / MEO to have the ability to send down the sub-interface connection parameter configurations to both the gateway and the firewall simultaneously, realizing the connection of the sub-interfaces of the gateway and the firewall in the NFVO / MEO, greatly reducing the workload of the user in designing the connection configuration parameters of the gateway and the firewall, and enabling the on-demand connection configuration of the gateway and firewall sub-interfaces to be quickly realized.

[0073] In an embodiment of the present application, a docking processing device for sub-interfaces is provided. As Figure 15 shown, the docking processing device for sub-interfaces may include the following modules:

[0074] A docking type information acquisition module 1510, configured to acquire the docking type information input by a user;

[0075] A docking method determination module 1520, configured to determine the sub-interface docking method between a gateway and a firewall according to the docking type information;

[0076] A sub-interface parameter allocation and processing module 1530, configured to perform sub-interface parameter allocation and processing according to the sub-interface docking method, in combination with preset sub-interface docking configuration information, to obtain sub-interface docking parameters;

[0077] A sub-interface docking establishment module 1540, configured to establish the sub-interface docking between the gateway and the firewall according to the sub-interface docking parameters.

[0078] In an alternative embodiment, the sub-interface docking configuration information includes physical port connection relationship information and sub-interface docking parameter range information. The sub-interface parameter allocation and processing module 1530 may include the following sub-modules:

[0079] An available parameter extraction sub-module, configured to extract target available parameters from the sub-interface docking parameter range information according to the sub-interface docking method and the physical port connection relationship information;

[0080] A sub-interface parameter allocation sub-module, configured to perform sub-interface parameter allocation using the target available parameters according to the sub-interface docking method to obtain the sub-interface docking parameters.

[0081] In an alternative embodiment, the available parameter extraction sub-module includes:

[0082] A physical port connection relationship determination unit, configured to determine the physical port connection relationship between the gateway and the firewall using the physical port connection relationship information;

[0083] A docking parameter available range determination unit, configured to determine the available range of sub-interface docking parameters based on the sub-interface docking parameter range information;

[0084] A target available parameter extraction unit, configured to extract the target available parameters from the available range of sub-interface docking parameters according to the sub-interface docking method and the physical port connection relationship.

[0085] In an alternative embodiment, the docking parameter available range determination unit includes:

[0086] A parameter range determination subunit, configured to determine the parameter range of the docking parameter by docking the parameter range information using the sub-interface;

[0087] A status label determination subunit, configured to determine a status label corresponding to each docking parameter in the parameter range, where the status label includes a usage status label and an available status label;

[0088] An available docking parameter determination subunit, configured to determine the docking parameter corresponding to the available status label as an available docking parameter;

[0089] A parameter available range determination subunit, configured to determine the available range of the sub-interface docking parameter by using the parameter value of the available docking parameter.

[0090] In an optional implementation manner, the sub-interface parameter allocation sub-module includes:

[0091] A target available parameter extraction unit, configured to extract a target allocation parameter from the target available parameters;

[0092] A sub-interface docking parameter allocation unit, configured to allocate the target allocation parameter as the sub-interface docking parameter;

[0093] A usage status label setting unit, configured to set the status label corresponding to the sub-interface docking parameter as the usage status label.

[0094] In an optional implementation manner, the sub-interface parameter allocation sub-module includes:

[0095] A connected device determination unit, configured to determine a connected device when the sub-interface docking method includes a dynamic docking method, where the connected device includes a target gateway and a target firewall connected to the target gateway;

[0096] A dynamic docking allocation unit, configured to use the target available parameters to allocate the same virtual local area network identifier and the same sub-interface network segment to the sub-interfaces of the target gateway and the target firewall, and allocate different sub-interface addresses to the sub-interfaces of the target gateway and the target firewall;

[0097] A sub-interface docking parameter determination unit, configured to use the virtual local area network identifier, the sub-interface network segment, and the sub-interface address as the sub-interface docking parameter.

[0098] In an optional implementation manner, the docking method determination module 1520 may include the following sub-modules:

[0099] A routing docking parameter extraction sub-module, configured to extract a routing docking parameter from the docking type information;

[0100] The sub-interface docking method determination sub-module is used to determine the docking method corresponding to the routing docking parameter as the sub-interface docking method.

[0101] In an embodiment of the present application, a docking processing device for a sub-interface is provided. As a sub-interface docking manager, it is used to automatically allocate docking parameters for the gateway and firewall to dock the sub-interface. It can automatically generate the sub-interface docking configuration parameters for the gateway and firewall when the user inputs the docking type information, greatly reducing the workload of the user in designing the docking configuration parameters for the gateway and firewall, and can quickly implement the on-demand docking configuration of the gateway and firewall sub-ports. For example, as Figure 16 shown, the docking processing device for the sub-interface may include a processor 1110, a communication interface 1120, a memory 1130, and a communication bus 1140; wherein, the processor 1110, the communication interface 1120, and the memory 1130 can complete mutual communication through the communication bus 1140; the memory 1130 is used to store computer programs; when the processor 1110 is used to execute the programs stored on the memory 1130, it realizes the steps of the sub-interface docking processing method described in any of the above embodiments, so that the docking processing device for the sub-interface can automatically generate the sub-interface docking configuration parameters for the gateway and firewall when the user inputs the docking type information, greatly reducing the workload of the user in designing the docking configuration parameters for the gateway and firewall, and thus being able to quickly implement the on-demand docking configuration of the gateway and firewall sub-ports and improving the docking efficiency.

[0102] The docking processing device provided by the embodiment of the present invention, when the processor executes the programs stored on the memory, can determine the sub-interface docking method of the gateway and firewall according to the obtained docking type information, and allocate sub-interface parameters according to the sub-interface docking method in combination with the preset sub-interface docking configuration information, realizing the automatic allocation of docking parameters for the gateway and firewall to dock the sub-interface, obtaining the sub-interface docking parameters, and then establishing the sub-interface docking of the gateway and firewall according to the sub-interface docking parameters to implement the sub-interface docking on the gateway and firewall, thereby simplifying the complexity of the sub-interface docking of the gateway and firewall, being able to quickly implement the docking configuration of the sub-interface of the gateway and firewall, and improving the docking efficiency and maintainability.

[0103] In an embodiment of the present application, a computer-readable storage medium is provided. A computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, it realizes the steps of the sub-interface docking processing method described in any of the above embodiments.

[0104] The communication bus 1140 mentioned in the above docking processing device may be a Peripheral Component Interconnect (PCI) bus, an Extended Industry Standard Architecture (EISA) bus, or the like. The communication bus 1140 can be divided into an address bus, a data bus, a control bus, etc. For the sake of convenience of representation, Figure 8 it is only represented by a thick line in Figure 8 , but it does not mean that there is only one bus or one type of bus.

[0105] The communication interface 1120 is used for communication between the above docking processing device and other devices.

[0106] The memory 1130 may include a Random Access Memory (RAM), or may also include a Non-Volatile Memory (NVM), such as at least one disk memory. Optionally, the memory may also be at least one storage device located far from the aforementioned processor.

[0107] The above-mentioned processor 1110 may be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc.; it may also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0108] It should be noted that in this article, relational terms such as "first" and "second" are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the term "comprising", "including" or any other variant thereof is intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements not only includes those elements, but also includes other elements not expressly listed, or also includes elements inherent to such process, method, article or device. Without further limitation, an element defined by the statement "including a..." does not exclude the existence of additional identical elements in the process, method, article or device including the said element.

[0109] The above are only specific embodiments of the present invention, enabling those skilled in the art to understand or implement the present invention. Various modifications to these embodiments will be obvious to those skilled in the art, and the general principles defined herein can be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to these embodiments shown herein, but rather to the broadest scope consistent with the principles and novel features claimed herein.

Claims

1. A docking processing method for a sub-interface, characterized in that, Including: Obtain docking type information; Determine the sub-interface docking method of the gateway and the firewall according to the docking type information; According to the sub-interface docking method, combine the preset sub-interface docking configuration information to allocate sub-interface parameters and obtain sub-interface docking parameters; Establish the sub-interface docking of the gateway and the firewall according to the sub-interface docking parameters.

2. The docking processing method according to claim 1, wherein The sub-interface docking configuration information includes physical port connection relationship information and sub-interface docking parameter range information. The step of combining the preset sub-interface docking configuration information according to the sub-interface docking method to allocate sub-interface parameters and obtain sub-interface docking parameters includes: Extract target available parameters from the sub-interface docking parameter range information according to the sub-interface docking method and the physical port connection relationship information; Allocate sub-interface parameters using the target available parameters according to the sub-interface docking method to obtain the sub-interface docking parameters.

3. The docking processing method according to claim 2, wherein The step of extracting target available parameters from the sub-interface docking parameter range information according to the sub-interface docking method and the physical port connection relationship information includes: Use the physical port connection relationship information to determine the physical port connection relationship between the gateway and the firewall; Based on the sub-interface docking parameter range information, determine the available range of sub-interface docking parameters; Extract the target available parameters from the available range of sub-interface docking parameters according to the sub-interface docking method and the physical port connection relationship.

4. The docking processing method according to claim 3, wherein The step of determining the available range of sub-interface docking parameters based on the sub-interface docking parameter range information includes: Use the sub-interface docking parameter range information to determine the parameter range of the docking parameters; Determine the status label corresponding to each docking parameter in the parameter range. The status label includes a usage status label and an available status label; Determine the docking parameters corresponding to the available status label as available docking parameters; Use the parameter values of the available docking parameters to determine the available range of the sub-interface docking parameters.

5. The docking processing method according to claim 2, wherein The step of allocating sub-interface parameters using the target available parameters to obtain the sub-interface docking parameters includes: Extract target allocation parameters from the target available parameters; Allocate the target allocation parameters as the sub-interface docking parameters; Set the status label corresponding to the sub-interface docking parameters to the usage status label.

6. The docking processing method according to claim 2, wherein The step of allocating sub-interface parameters using the target available parameters according to the sub-interface docking method to obtain the sub-interface docking parameters includes: In the case where the sub-interface docking method includes a dynamic docking method, determine a target gateway and a target firewall connected to the target gateway; Use the target available parameters to allocate the same virtual local area network identifier and the same sub-interface network segment to the sub-interfaces of the target gateway and the target firewall, and allocate different sub-interface addresses to the sub-interfaces of the target gateway and the target firewall; Use the virtual local area network identifier, the sub-interface network segment, and the sub-interface address as the sub-interface docking parameters.

7. The docking processing method according to any one of claims 1 to 6, characterized in that, The step of determining the sub-interface docking method of the gateway and the firewall according to the docking type information includes: Extract routing docking parameters from the docking type information; Determine the docking method corresponding to the routing docking parameters as the sub-interface docking method.

8. A docking processing device for a sub-interface, characterized in that, It includes: A docking type information acquisition module, configured to acquire the docking type information input by the user; A docking method determination module, configured to determine the sub-interface docking method of the gateway and the firewall according to the docking type information; A sub-interface parameter allocation processing module, configured to perform sub-interface parameter allocation processing according to the sub-interface docking method in combination with the preset sub-interface docking configuration information to obtain sub-interface docking parameters; A sub-interface docking establishment module, configured to establish the sub-interface docking between the gateway and the firewall according to the sub-interface docking parameters.

9. A docking processing device for a sub-interface, characterized in that It includes: A processor, a communication interface, a memory, and a communication bus. Among them, the processor, the communication interface, and the memory complete mutual communication through the communication bus; The memory is used to store computer programs; The processor is configured to implement the docking processing method according to any one of claims 1 to 7 when executing the program stored on the memory.

10. A computer-readable storage medium, characterized in that, A computer program is stored on the computer-readable storage medium, and when the computer program is executed by the processor, the steps of the docking processing method according to any one of claims 1-7 are implemented.

Images