Method and apparatus for implementing service chain pseudo-proxy

Abstract

The application provides a method and device for implementing a service chain pseudo-proxy. The method comprises providing a corresponding relationship between a pseudo-proxy segment identifier (SID) and a virtual firewall IP address on an intelligent network card, the intelligent network card being located on a server carrying a virtual firewall; receiving an SRv6 packet from a service chain interface; identifying that the SID list of the received SRv6 packet contains a pseudo-proxy SID to generate a flow table item; wherein the matching item is the packet characteristic information of the outer MAC header of the SRv6 packet; the action item is the SRH header of the cached SRv6 packet; based on the SID list of the SRv6 packet containing the pseudo-proxy SID, the IP address of the virtual firewall is found; the SRH header of the SRv6 packet is stripped and cached, and the SRv6 packet is sent to the virtual firewall.

Description

Technical Field

[0001] This involves service chain technology, specifically a method and device for implementing a pseudo-proxy in a service chain. Background Technology

[0002] SRv6 SFC (Service Function Chain) uses SRv6 TE Policy to orchestrate the forwarding path of service packets. By encapsulating the path information of SRv6 TE Policy in the original packet, it guides the packet through each service node sequentially along the specified path. SRv6 SFC supports service nodes including firewalls (FW), intrusion prevention systems (IPS), load balancers (LB), and network address translation (NAT) devices.

[0003] The SRv6 SFC network consists of SC (Service Classifier), SFF (Service Function Forwarder), SF (Service Function), and TailEndpoint nodes. It is used to guide specific user service packets to designated service nodes for processing and forward them to their destination.

[0004] The SC (Source Node) is located at the edge of the SRv6 SFC (Simplified Component Node) network. It directs service packets to the SRv6 TE (Translation over Component) Policy for forwarding by creating the SRv6 TE Policy. The SF (Service Provider) provides certain application services, such as firewall, load balancing, and address translation. The SF can be a physical device or a virtual device. The SFF (Service Filtering Node), acting as a proxy for the SF, forwards received packets to the SF associated with the packet's SRv6 SID for processing. The SF returns the processed packet to the SFF, which then decides whether to continue forwarding the packet. The TailEndpoint is the tail node of the SRv6 SFC network, i.e., the destination node of the SRv6 TE Policy.

[0005] In an SRv6 SFC network, the virtual firewall, acting as the SF, performs security authentication on SRv6 packets sent from the source node to the tail node. However, the SC cannot detect when the virtual firewall migrates to other servers. Until the routing protocol notifies the SC of the virtual firewall, SRv6 packets destined for the virtual firewall are continuously dropped. Summary of the Invention

[0006] The purpose of this application is to provide a method and device for implementing a service chain pseudo proxy, which implements a service chain pseudo proxy on the smart network card of a server.

[0007] To achieve the above objectives, this application provides a method for implementing a service chain pseudo-proxy. The method includes: setting a mapping between a pseudo-proxy segment identifier (SID) and a virtual firewall IP address on a smart network interface card (NIC), wherein the smart NIC is located on a server hosting the virtual firewall; receiving SRv6 packets from a service link port; identifying that the SID list of the received SRv6 packets includes the pseudo-proxy SID and generating a flow table entry; wherein the matching item is the packet characteristic information of the outer MAC header of the SRv6 packet; the action item is the encapsulated and cached SRH header of the SRv6 packet; based on the SID list of the SRv6 packets containing the pseudo-proxy SID, finding the IP address of the virtual firewall; stripping the SRH header of the SRv6 packet and caching it; and sending the SRv6 packet to the virtual firewall.

[0008] To achieve the above objectives, this application also provides a device for implementing a service chain pseudo-proxy, the device including a processor and a memory; the memory is used to store processor-executable instructions; wherein, the processor executes the processor-executable instructions in the memory to perform the following operations: setting the correspondence between the pseudo-proxy segment identifier (SID) and the virtual firewall IP address, the smart network interface card being located on the server carrying the virtual firewall; receiving a first SRv6 packet from the service link port; identifying that the SID list of the received first SRv6 packet contains a pseudo-proxy SID; generating a first flow table entry; wherein the matching item is the packet characteristic information of the outer MAC header of the first SRv6 packet; the action item is the SRH header of the first SRv6 packet encapsulated and cached; based on the fact that the SID list of the first SRv6 packet contains a pseudo-proxy SID, finding the IP address of the virtual firewall; stripping the first SRH header of the first SRv6 packet and caching it, and sending the first SRv6 packet to the virtual firewall.

[0009] In this application, the smart network card of the virtual firewall server acts as an application service node capable of recognizing SRv6 packets. The virtual firewall does not need to support SRV6 or the service chain to perform secure packet exchange, and there is no need to change the SFF processing flow in the service chain. Attached Figure Description

[0010] Figure 1 A schematic diagram illustrating an embodiment of the method for implementing a service chain pseudo-proxy provided in this application;

[0011] Figure 2 A service chain diagram provided for this application;

[0012] Figure 3 A schematic diagram of the security authentication of the virtual firewall for the service chain provided in this application;

[0013] Figure 4 A schematic diagram of the security authentication of the virtual firewall after the migration of the service chain provided in this application;

[0014] Figure 5 A schematic diagram of the device for implementing a service chain pseudo-proxy provided in this application. Detailed Implementation

[0015] The following detailed description will be provided with reference to several examples illustrated in the accompanying figures. In this detailed description, numerous specific details are used to provide a comprehensive understanding of the present application. Known methods, steps, components, and circuits are not described in detail in the examples to avoid obscuring their meaning.

[0016] In the terminology used, the term "including" means including but not limited to; the term "containing" means including but not limited to; the terms "above," "within," and "below" include the number itself; the terms "greater than" and "less than" mean not including the number itself. The term "based on" means based on at least a portion of them.

[0017] Figure 1 This is a schematic diagram illustrating an embodiment of the method for implementing a service chain pseudo-proxy provided in this application; this embodiment is used to implement a service chain pseudo-proxy by the server's smart network interface card, and includes,

[0018] Step 101: Configure the mapping between the pseudo proxy segment identifier (SID) and the virtual firewall IP address on the smart network interface card (NIC). The smart NIC is located on the server hosting the virtual firewall.

[0019] Step 102: The smart network interface card receives SRv6 packets from the service link port;

[0020] Step 103: The smart network card identifies the SID list of the received SRv6 packets and generates a flow table entry containing the pseudo-proxy SID; the matching item is the packet feature information of the outer MAC header of the SRv6 packet; the action item is the SRH header of the encapsulated and cached SRv6 packet.

[0021] Step 104, Step 101: The smart network card finds the IP address of the virtual firewall by using the SID list of SRv6 packets, which contains the pseudo-proxy SID.

[0022] Step 105: Remove the SRH header from the SRv6 packet and cache it, then send the SRv6 packet to the virtual firewall.

[0023] Figure 1 The beneficial effect of the embodiment is that the smart network card of the virtual firewall server acts as an application service node that can recognize SRv6 packets. The virtual firewall does not need to support SRV6 or the service chain to perform secure packet exchange without changing the SFF processing flow in the service chain.

[0024] Figure 2 A service chain diagram provided for this application;

[0025] Figure 2 In the above, the smart network interface card 21a of server 21 and the smart network interface card 22b of server 22 are service nodes that can identify application service nodes.

[0026] Virtualization management platform for servers 21 and 22 ( Figure 2 (Not shown in the image) SID a1 is configured as the redirection SID for smart network card 21a, and SID b1 is configured as the redirection SID for smart network card 22b, which are used to encapsulate the outer redirection SRH header respectively.

[0027] The virtualization management platform will notify smart network interface cards 21a and 22b of SID a1 and SID b1.

[0028] The virtualization management platform will advertise the IP address (IP27) and corresponding End.AM SID (24) of the virtual firewall (27) to the smart network interface card (NIC) (21a). The smart NIC (21a) records the mapping between End.AM SID (24) and the IP address of the virtual firewall (27).

[0029] End.AM SID is a pseudo-proxy SID and the corresponding forwarding action is: SFF24 first modifies the destination address of the SRv6 packet to the first SID value in SRH, i.e., SRH[0], and then forwards it according to the outgoing interface associated with End.AM SID; SFF receives the SRv6 from the application service node (smart network card 21a, 22b in this application), restores the outer destination IP address according to the SID list in the SRH header of the SRv6 packet and SL (Segment Left), and forwards the packet according to the normal SRv6 packet forwarding process.

[0030] Figure 3 A schematic diagram of the security authentication of the virtual firewall for the service chain provided in this application;

[0031] Source node 23 receives the original IP packet from the user network and encapsulates it into an SRv6 packet according to the matching SRv6 TE Policy; the outer destination IP address of the SRv6 packet is the End.AM SID of SFF24, and the SID list in the SRH header includes: Segment list [0] = End.DT4 SID 26, Segment list [1] = End.X SID 25, Segment list [2] = End.AM SID 24; SL = 2.

[0032] When SFF24 receives the SRv6 message, it finds the destination address as End.AM SID 24 by looking up the Local SID table. It replaces the outer destination IP address of the SRv6 message with the last SID in the SRH SID list: End.DT4 SID 26. At the same time, it decrements SL by 1 to obtain the Segment list [1]. The message is sent from the outgoing interface bound to End.AM SID24 to the smart network card 21a.

[0033] The smart NIC 21a receives an SRv6 packet from the service link port of the VLAN to which the outer destination IP address belongs. It identifies that the SID list in the SRH header of the SRv6 packet contains the pseudo-proxy SID End.AM SID 24.

[0034] When the smart NIC 21a receives an SRv6 packet, it sends out flow table entries; the matching entry is the packet characteristic information of the outer MAC header of the SRv6 packet; the action entry is the encapsulated buffered SRH header.

[0035] The smart network card 21a finds the IP address of the virtual firewall 27, IP27, based on the Segment list [2] = End.AM SID 24 of the SID list of the SRv6 packet.

[0036] The smart network interface card 21a removes the SRH header from the SRv6 packet and caches the removed SRH header. It then sends the SRv6 packet with the SRH header removed to the IP address IP27 of the virtual firewall 27.

[0037] The virtual firewall 27 performs a security check on the received SRv6 packets. If it determines that there is no threat, it returns the SRv6 packets to the smart network interface card 21a.

[0038] When the smart NIC 21a receives an SRv6 packet, it finds a matching flow table entry, encapsulates the cached SRH header into the SRv6 packet, re-encapsulates it into an SRv6 packet, and sends the SRv6 packet through the service connection port.

[0039] SFF24 receives the SRv6 packet through the service link port of the VLAN to which the outer IP address belongs. Based on the SL value = 1 in the SRH, it restores the destination address of the SRv6 packet to End.X SID 25; thus, it sends the SRv6 packet to SFF25 and tail node 26 along the path of SRv6 Policy.

[0040] Figure 4 A schematic diagram of the security authentication of the virtual firewall after the migration of the service chain provided in this application.

[0041] The virtual firewall 27 is hot-migrated to the server 22, and the virtualization management platform notifies the smart network card 21a through a remote call channel (such as an RPC channel).

[0042] Smart NIC 21a will Figure 3 In this embodiment, the action of restoring the SRH flow table entry is modified to redirect to the redirection reserved SID of the smart network interface card 22b.

[0043] The smart network interface card 22b records the mapping between End.AM SID 24 and the IP address of the virtual firewall 27.

[0044] The virtualization management platform will advertise the IP address IP27 and the corresponding End.AM SID 24 of the virtual firewall 27 to the smart network interface card 22b.

[0045] Source node 23 receives the original IP packet from the user network and encapsulates it into an SRv6 packet according to the matching SRv6 TE Policy; the outer destination IP address of the SRv6 packet is the End.AM SID of SFF24, and the SID list in the SRH header includes: Segment list [0] = End.DT4 SID 26, Segment list [1] = End.X SID 25, Segment list [2] = End.AM SID 24; SL = 2.

[0046] The smart network interface card 21a received the SRv6 message and found the modified redirection flow table entry.

[0047] The smart network card 21a encapsulates the SRv6 packet with an outer SRH header. Knowing that the virtual firewall has been migrated to server B, it adds an SRH header to the packet. The SID list includes: Segment list [0] = SID 22b1, SL = 0. The outer destination IP address of the SRv6 packet is also modified to the SID 22b1 of the smart network card 22b. The VLAN of the SRv6 packet is modified to the redirected VLAN and sent to SFF24 through the service connection port in the redirected VLAN. This is to prevent SFF24 from receiving the SRv6 packet and misjudging that the virtual firewall 27 has completed the security processing.

[0048] SFF24 sends the SRv6 message to SFF25, which then forwards it to the smart network interface card 22b according to the outer destination IP address of the SRv6 message (SID22b1 of the smart network interface card 22b).

[0049] The SRv6 packets redirected by smart network interface card 21a are forwarded by ordinary routers and sent to smart network interface card 22b via SFF24 and SFF25.

[0050] The smart network card 22b receives an SRv6 packet through the service connection port of the redirected VLAN. Based on the SID list of the outer SRH header, Segment list [0] = SID 22b1 reserves the redirected SID locally, generates a redirected flow table entry, the matching item is the packet feature information of the outer MAC header of the outer SRv6 packet, and the action item is to encapsulate the inner SRH header of the buffer and encapsulate the outer redirected SRH header.

[0051] The smart network card 22b finds the IP address of the virtual firewall 27, IP27, based on the Segment list [2] = End.AMSID 24 of the SID list in the inner SRH header of the SRv6 packet.

[0052] The smart network interface card 22b removes the outer SRH header of the SRv6 packet, removes the inner SRH header and caches the removed inner SRH header, and sends the SRv6 packet with the SRH header removed to the IP address IP27 of the virtual firewall 27.

[0053] The virtual firewall 27 performs a security check on the received SRv6 packets and returns the SRv6 packets to the smart network card 22b if it determines that there is no threat.

[0054] When the smart network card 22b receives the SRv6 packet, it finds a matching redirection flow table entry, first encapsulates the inner SRH header of the SRv6 packet with the cached inner header, and then encapsulates the outer SRH header. The SID list includes: Segment list [0] = SID 22a1, SL = 0; the outer destination IP address of the SRv6 packet is modified to SID22a1 of the smart network card 21a, and sent to SFF25 in the redirection VLAN.

[0055] SFF25 sends the SRv6 message to SFF25, and then SFF25 forwards the SRv6 message to smart network card 21a according to the outer destination IP address (SID22b1 of smart network card 22b).

[0056] When the smart network card 21a receives an SRV6 packet with a double SRH header at the redirection VLAN service interface, it determines that the SID reserved in the outer SRH header is the local redirection reserved SID, identifies the SRv6 packet returned from redirection, removes the outer SRH header, and modifies the outer destination IP address of the SRv6 packet according to the last SID of the inner SRH, Segment list [0]= End.DT4 SID 26; it modifies the VLAN of the SRv6 packet to the VLAN where the outer destination IP address is located, and sends it to SFF24.

[0057] When SFF24 receives the SRv6 message, it restores the destination address of the SRv6 message to End.XSID 25 based on the SL value = 1 in the SRH; thus, it sends the SRv6 message to SFF25 and tail node 26 along the path of the SRv6 Policy.

[0058] After the route is refreshed, in the SID list of the SRv6 packet encapsulated by source node 23, Segment list [2] = End.AM SID 25. When SFF25 receives the SRv6 packet, it finds the destination address as End.AM SID25 by looking up the Local SID table. It replaces the outer destination IP address of the SRv6 packet with the last SID in the SRH SID list: End.DT4 SID26, and decrements SL by 1 to get Segment list [0]. The packet is then sent from the outgoing interface bound to End.AM SID25 to the smart network card 22b. The processing of smart network card 22b and SFF25 is as follows: Figure 3 The same applies to the intelligent network card 21a and SFF24.

[0059] The virtual firewall was migrated from server 22 back to server 21, and the smart network interface card 22b and SFF25 were processed and... Figure 4 The processing of the Smart NIC 21a and SFF24 is the same. Figure 4 The smart network cards 22b and SFF25 are mentioned.

[0060] Figure 5 This is a schematic diagram of the device 50 for implementing a service chain pseudo-proxy provided in this application. The device 50 is a smart network interface card (NIC) of a server, and includes a processor 51 and a memory 52. ​​The memory 52 stores processor-executable instructions. The processor 51 executes the processor-executable instructions in the memory 52 to perform the following operations: setting the mapping between the pseudo-proxy segment identifier (SID) and the virtual firewall IP address; the smart NIC is located on the server hosting the virtual firewall; receiving a first SRv6 packet from the service link port; identifying that the SID list of the received first SRv6 packet contains a pseudo-proxy SID; generating a first flow table entry; wherein the matching item is the packet characteristic information of the outer MAC header of the first SRv6 packet; the action item is the encapsulated and cached SRH header of the first SRv6 packet; based on the fact that the SID list of the first SRv6 packet contains a pseudo-proxy SID, finding the IP address of the virtual firewall; stripping the first SRH header of the first SRv6 packet and caching it, and sending the first SRv6 packet to the virtual firewall.

[0061] Processor 51 also performs the following operations by running processor-executable instructions in memory 52: receiving a first SRv6 packet returned by the virtual firewall and finding a matching first flow table entry; encapsulating a buffered first SRH header in the first SRv6 packet; and sending the first SRv6 packet through the service link port.

[0062] Processor 51 further performs the following operations by running processor-executable instructions in memory 52: Based on the remote smart NIC redirection reserved SID of the migrated server using the virtual firewall, modify the action item of the first flow table entry to redirect to the remote redirection reserved SID; receive a second SRv6 packet from the service link port; find that the second SRv6 packet matches the first flow table entry, and encapsulate the second SRv6 packet with a second outer SRH header; set only the remote redirection reserved SID in the second outer SRH header; modify the outer destination IP address of the second SRv6 packet to its corresponding remote redirection reserved SID; modify the initial VLAN of the second SRv6 packet to the redirection VLAN; and send the second SRv6 packet through the service link port of the redirection VLAN.

[0063] Processor 51 also performs the following operations by running processor-executable instructions in memory 52: receiving a second SRv6 packet returned by redirection through the service connection port of the redirected VLAN; identifying that the second outer SRH header of the second SRv6 packet returned by redirection carries a local redirection reserved SID; stripping the second outer SRH header and modifying the outer destination IP address of the second SRv6 packet according to the last SID of the SRH header of the second SRv6 packet; replacing the redirected VLAN based on the outer destination IP address of the second SRv6 packet; and sending the second SRv6 packet through the service connection port.

[0064] Processor 51 also performs the following operations through processor-executable instructions in memory 52: setting the mapping between pseudo-proxy SID and the IP address of the migrated virtual firewall on the smart network card; receiving the third SRv6 packet through the service connection port of the redirected VLAN; identifying the SID list of the outer SRH header of the third SRv6 packet carrying the locally reserved redirected SID, generating a second redirected flow table entry, the matching item being the packet feature information of the outer MAC header of the third SRv6 packet, the action item being the encapsulation of the third SRH header of the cached third SRv6 packet, and encapsulating the outer redirected SRH header; finding the IP address of the migrated virtual firewall according to the pseudo-proxy SID in the SID list of the inner SRH header of the third SRv6 packet, stripping the outer SRH header and the third SRH header of the third SRv6 packet, caching the third SRH header, and sending the SRv6 packet to the migrated virtual firewall; Upon receiving the third SRv6 packet returned by the migrated virtual firewall, the system finds a matching second flow entry and encapsulates the third SRv6 packet with a cached third SRH header. It then encapsulates a new outer SRH header and sets only the peer redirect reserved SID. The smart NIC modifies the outer destination IP address of the third SRv6 packet to the peer redirect reserved SID and sends it through the redirected VLAN service link port.

[0065] In this application, a machine-readable storage medium can be any electronic, magnetic, optical, or other physical storage device used to store or contain information (such as executable instructions, data, etc.). For example, any machine-readable storage medium described herein can be any type of random access memory (RAM), volatile memory, non-volatile memory, flash memory, storage drive (such as a hard disk drive), solid-state drive, any type of optical disc (such as an optical disc, DVD, etc.), and similar devices, or combinations thereof. Furthermore, any machine-readable storage medium described herein can be a non-transitory machine-readable storage medium.

[0066] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A method for implementing a pseudo-proxy in a service chain, characterized in that, The method includes, A mapping relationship between a pseudo proxy segment identifier (SID) and a virtual firewall IP address is set on the smart network interface card (NIC), wherein the smart NIC is located on the server that hosts the virtual firewall. The smart network interface card receives the first SRv6 message from the service link port; The smart network interface card identifies that the SID list of the first SRv6 packet received includes the pseudo-proxy SID; The smart network interface card generates a first-flow entry; The matching item is the message feature information of the outer MAC header of the first SRv6 message; The action item is the SRH header of the first SRv6 message encapsulated in the cache; The smart network interface card finds the IP address of the virtual firewall based on the SID list of the first SRv6 packet, which includes the pseudo-proxy SID. The first SRH header of the first SRv6 packet is stripped and cached, and the first SRv6 packet is sent to the virtual firewall; The smart network interface card (NIC) modifies the action item of the first flow table entry to redirect to the peer-end redirection reserved SID based on the remote smart NIC redirection reserved SID of the migrated server after the virtual firewall. The smart network interface card receives a second SRv6 message from the service link port; The smart network interface card finds that the second SRv6 packet matches the first flow table entry, and the second SRv6 packet is encapsulated with a second outer SRH header; The second outer SRH header only sets the peer redirection reserved SID; The smart network interface card modifies the outer destination IP address of the second SRv6 packet to the SID reserved for redirection of the peer end; The smart network interface card modifies the initial VLAN of the second SRv6 packet to the redirected VLAN; The smart network interface card sends the second SRv6 message through the service link port of the redirected VLAN.

2. The method according to claim 1, characterized in that, The method also includes, The smart network interface card receives the first SRv6 packet returned by the virtual firewall and finds a matching first flow table entry; The smart network interface card is used to encapsulate and cache the first SRH header of the first SRv6 message. The smart network interface card sends the first SRv6 message through the service link port.

3. The method according to claim 1, characterized in that, The method also includes, The smart network interface card receives the second SRv6 message returned by redirection through the service connection port of the redirected VLAN; The smart network interface card identifies that the second outer SRH header of the second SRv6 packet returned by the redirection carries the local redirection reserved SID; The smart network card strips the second outer SRH header and modifies the outer destination IP address of the second SRv6 packet according to the last SID of the SRH header of the second SRv6 packet. The smart network interface card replaces the redirected VLAN based on the outer destination IP address of the second SRv6 packet; The smart network interface card sends the second SRv6 message through the service link port.

4. The method according to claim 1, characterized in that, The method further includes: The smart network interface card (NIC) is configured with a mapping relationship between the pseudo proxy SID and the IP address of the migrated virtual firewall. The smart network interface card receives a third SRv6 message through the service connection port of the redirected VLAN; The smart network interface card identifies the SID list of the outer SRH header of the third SRv6 packet that carries the locally reserved redirection SID, generates a second redirection flow table entry, the matching item is the packet feature information of the outer MAC header of the third SRv6 packet, and the action item is to encapsulate the cached third SRH header of the third SRv6 packet and encapsulate the outer redirection SRH header. The smart network interface card (NIC) finds the IP address of the migrated virtual firewall based on the pseudo proxy SID in the SID list of the inner SRH header of the third SRv6 packet, strips the outer SRH header and the third SRH header of the third SRv6 packet, caches the third SRH header, and sends the SRv6 packet to the migrated virtual firewall. The smart network interface card receives the third SRv6 packet returned by the migrated virtual firewall, finds a matching second flow table entry, encapsulates the cached third SRH header for the third SRv6 packet, and encapsulates a new outer SRH header and only sets the peer redirection reserved SID; The smart network card modifies the outer destination IP address of the third SRv6 packet to the peer-end redirected reserved SID and sends it through the redirected VLAN service link port.

5. A device for implementing a pseudo-proxy in a service chain, characterized in that, A smart network interface card (NIC) for server applications includes a processor and a memory; the memory stores processor-executable instructions; wherein the processor executes the processor-executable instructions in the memory to perform the following operations: The mapping relationship between the pseudo proxy segment identifier (SID) and the virtual firewall IP address is set, and the smart network card is located on the server that hosts the virtual firewall; Receive the first SRv6 message from the service link port; The SID list for identifying the first received SRv6 message includes the pseudo-proxy SID; Generate a first stream entry; wherein the matching item is the message feature information of the outer MAC header of the first SRv6 message; and the action item is the SRH header of the first SRv6 message encapsulated and buffered. Based on the SID list of the first SRv6 message, which includes the pseudo-proxy SID, the IP address of the virtual firewall is found. The first SRH header of the first SRv6 packet is stripped and cached, and the first SRv6 packet is sent to the virtual firewall; The processor also performs the following operations by executing processor-executable instructions in the memory: Based on the migrating server's peer smart NIC redirection reserved SID based on the virtual firewall, the action item of the first flow table entry is modified to redirect to the peer redirection reserved SID. Receive a second SRv6 message from the service link port; The second SRv6 packet is found to match the first flow table entry, and the second SRv6 packet is encapsulated with a second outer SRH header; the second outer SRH header only sets the peer redirection reserved SID; Modify the outer destination IP address of the second SRv6 message to the reserved SID of the peer redirection; Change the initial VLAN of the second SRv6 message to the redirected VLAN; The second SRv6 message is sent through the service link port of the redirected VLAN.

6. The device according to claim 5, characterized in that, The processor also performs the following operations by executing processor-executable instructions in the memory: Receive the first SRv6 packet returned by the virtual firewall and find the matching first flow table entry; Encapsulate the first SRv6 message with a cached first SRH header; The first SRv6 message is sent through the service link port.

7. The device according to claim 5, characterized in that, The processor also performs the following operations by executing processor-executable instructions in the memory: Receive the second SRv6 message returned by the redirection through the service connection port of the redirected VLAN; The second outer SRH header of the second SRv6 message returned by the redirection carries the local redirection reserved SID; Remove the second outer SRH header and modify the outer destination IP address of the second SRv6 packet according to the last SID of the SRH header of the second SRv6 packet; The redirected VLAN is replaced based on the outer destination IP address of the second SRv6 message; The second SRv6 message is sent through the service link port.

8. The device according to claim 5, characterized in that, The processor also performs the following operations by executing processor-executable instructions in the memory: Configure the mapping relationship between the pseudo proxy SID and the IP address of the migrated virtual firewall on the smart network card; A third SRv6 message was received through the service connection port of the redirected VLAN; The SID list of the outer SRH header of the third SRv6 packet is identified, carrying the locally reserved redirection SID. A second redirection flow table entry is generated. The matching item is the packet feature information of the outer MAC header of the third SRv6 packet. The action item is to encapsulate the cached third SRH header of the third SRv6 packet and encapsulate the outer redirection SRH header. Based on the pseudo-proxy SID in the SID list of the inner SRH header of the third SRv6 packet, the IP address of the migrated virtual firewall is found, the outer SRH header and the third SRH header of the third SRv6 packet are stripped, the third SRH header is cached, and the SRv6 packet is sent to the migrated virtual firewall. Upon receiving the third SRv6 packet returned by the inbound virtual firewall, a matching second flow entry is found, and the cached third SRH header is encapsulated in the third SRv6 packet; a new outer SRH header is encapsulated and only the peer redirection reserved SID is set; The smart network card modifies the outer destination IP address of the third SRv6 packet to the peer-end redirected reserved SID and sends it through the redirected VLAN service link port.

Images