Route selection method and system under VPC network model based on Openstack and SDN technology

Abstract

The invention discloses a route selection method and system under a VPC network model based on Openstack and SDN technologies, and the method comprises the steps: creating a plurality of line public networks, and inputting an external access line of a corresponding external network by an SDN controller; creating a VPC network and a subnet of the VPC network, and issuing VPC network configuration by the SDN controller; a VPC network is used to create a virtual machine, and the SDN controller issues a virtual port configuration of the virtual machine to the serverleaf switch; creating a virtual firewall and binding a VPC network, and issuing firewall configuration to the virtual firewall by the SDN controller; a public network exit is added in a virtual router under a VPC network, a default gateway is set, and an SDN controller issues virtual port configuration of multiple exits of the router to a virtual firewall; and the virtual machine dynamically selects to access the extranet in an extranet direct connection mode or a firewall passing mode. According to the invention, the routing path can be dynamically adjusted according to the network condition, the service requirement and the security policy, the network performance is optimized, and the network security is ensured.

Description

Technical Field

[0001] The present invention relates to the field of network cloud technology, and in particular to a routing selection method and system under a VPC network model based on Openstack and SDN technologies. Background Art

[0002] OpenStack is an open-source cloud computing management platform project designed to provide a scalable Infrastructure as a Service (IaaS) layer for public and private clouds. It provides a toolkit for managing computing, storage, and networking resources, allowing enterprises and individuals to control and automate large-scale cloud environments through standardized APIs.

[0003] SDN (Software-Defined Networking): A network management approach that separates the network control plane from the data plane, enabling centralized control and dynamic configuration of network traffic. The core concept of SDN is to centrally manage and program network devices (such as routers and switches) through software, making networks more flexible, efficient, and easy to manage.

[0004] VRouter (virtual router) is a software-defined concept commonly used in cloud computing and virtualized environments. It is a virtualized network device that can perform the functions of a traditional physical router, such as routing, packet forwarding, network address translation (NAT), and firewall rule application. In the cloud platform, VRouter can provide network isolation and connection services for different virtual machines or containers, supporting network management and security policy enforcement in a multi-tenant environment. Vport (virtual port) is a concept used in virtualization and cloud computing environments. It refers to a logical port created on a virtual network device. Vports can be thought of as virtualized versions of ports on traditional physical network devices, but they exist in software-defined network architectures, such as OpenvSwitch or other virtual switches. Vports allow virtual machines or containers to connect to a virtual network through a specific network interface. Each Vport can be configured with different attributes, such as IP address, MAC address, security policy, traffic control, etc. In a multi-tenant environment, Vports can also be used to implement network isolation, ensuring that virtual machines of different users do not interfere with each other.

[0005] SNAT (Source Network Address Translation) is a form of Network Address Translation (NAT) that changes the source IP address of a packet. When a device on the internal network attempts to access the external network, SNAT replaces the packet's source IP address with a public IP address. This allows the external network to see the translated source address instead of the internal private address.

[0006] A VPC (Virtual Private Cloud) network is a user-configured and managed, logically isolated virtual network environment built for cloud resources such as cloud servers, cloud containers, and cloud databases. It aims to improve the security of user resources and simplify network deployment. The VPC network model includes logical units such as subnets, VRouters (virtual routers), and vFWs (virtual firewalls). Creating a VPC divides a physical network into logical networks. Each VPC is a virtual network environment. Using these logical units, users can flexibly define IP addresses, routing policies, and other features for hosts within the VPC.

[0007] LS (Logical Switch) logical switch is used to access the same business system resources, such as physical servers, virtual machines, etc., which are distributed and carried on the Server Leaf switch by the logical switch.

[0008] LR (Logical Router) is a Layer 3 routing network element used to interconnect logical switches and logical switches with virtual routers.

[0009] VRB (virtual router) is a virtual router device used for Layer 3 routing interconnection between logical routers and border network element devices (such as virtual gateways, virtual firewalls, etc.).

[0010] VRF (Virtual Routing and Forwarding) is a technology that allows multiple routing tables to exist on the same device, isolating traffic between different networks. This technology achieves network isolation and enhanced security by creating one or more virtual router instances, each with its own routing table. VRF technology can be applied in scenarios such as data centers and enterprise networks to improve network scalability and security.

[0011] OpenStack is an open-source cloud computing management platform project, comprised of several key components. OpenStack supports nearly all cloud environments, aiming to provide a simple, scalable, and rich, standardized cloud computing management platform. The Neutron component handles the creation and management of virtual network infrastructure, including networks, subnets, virtual network cards, security groups, and routers. Advanced services such as firewalls (FWs) and virtual private networks (VPNs) are also available.

[0012] Implementing multiple egresses in an OpenStack environment typically means enabling virtual machines to access external networks through multiple physical network egresses. This is very common in data center networks. With the growth of cloud computing, Virtual Private Cloud (VPC) has become the preferred choice for enterprises building private cloud environments. However, multi-egress strategies within the VPC network model, particularly in mixed scenarios involving direct access to the external network and traffic passing through the firewall, pose challenges to intelligent routing of network traffic. Traditional static routing strategies cannot meet dynamically changing network requirements, resulting in wasted network resources and a poor user experience. Summary of the Invention

[0013] To address the shortcomings of the existing technology, the present invention provides a routing method and system for a VPC network model based on OpenStack and SDN technologies. In the OpenStack VPC network model, OpenStack is connected to the SDN hardware controller, enabling virtual machines to directly access the external network from an L3 router, addressing network latency and performance issues. This method also allows virtual machines to access the external network through a firewall, preventing malicious attacks and unauthorized access, and protecting the internal network from external threats. Routing paths can be dynamically adjusted based on network conditions, business needs, and security policies, optimizing network performance while ensuring network security.

[0014] To achieve the above object, the present invention adopts the following technical solutions: A routing selection method in a VPC network model based on OpenStack and SDN technology includes the following steps: Create multiple lines of public network, and the SDN controller enters the external access lines corresponding to the external network; Create a VPC network and its subnets, and the SDN controller delivers the VPC network configuration. Use the VPC network to create a virtual machine, and the SDN controller sends the virtual port configuration of the virtual machine to the ServerLeaf switch; Create a virtual firewall and bind it to the VPC network. The SDN controller sends the firewall configuration to the virtual firewall. Add a public network egress to the virtual router in the VPC network and set the default gateway. The SDN controller sends the virtual port configuration of the router's multiple egresses to the virtual firewall. The virtual machine dynamically chooses whether to access the external network directly or through the firewall.

[0015] To optimize the above technical solutions, specific measures taken also include: Furthermore, in the creation of a multi-line public network, the SDN controller enters the external access lines corresponding to the external network as follows: Create a public network and its subnets, and plan two types of external networks: one that connects directly to the external network and one that passes through the firewall. After receiving the message from OpenStack that a subnet has been created, the SDN controller configures all ServerLeaf switches, enters information about multiple external networks, and enters the external access lines for the corresponding external networks.

[0016] Furthermore, the VPC network and the subnet of the VPC network are created, and the SDN controller sends the VPC network configuration as follows: Create a VPC network and its subnets. When creating the VPC subnets, add the subnets to the virtual router VRouter. The SDN controller then sends VPC network-related configurations, completing the LS-LR-VRB network.

[0017] Furthermore, the specific process of using the VPC network to create a virtual machine and the SDN controller sending the virtual port configuration of the virtual machine to the serverleaf switch is as follows: Create a virtual machine on the OpenStack cloud platform and set its properties, including the number of virtual CPU cores and memory size, and associate the virtual network interface card with the subnet of the VPC network. The OpenStack Nova service schedules the virtual machine to a server based on a scheduling algorithm and creates the virtual machine on the server. The SDN controller then sends the virtual port configuration of the virtual machine to the ServerLeaf switch.

[0018] Furthermore, the specific process of creating a virtual firewall and binding it to the VPC network, and the SDN controller sending the firewall configuration to the virtual firewall is as follows: The SDN controller creates a virtual firewall and parses the virtual firewall's associated resources, including virtual router port information. The SDN controller creates a firewall security policy, creates a VRF, creates a LAN port, and configures an IP address. The SDN controller also creates a static route from the virtual firewall to the virtual router and back to the VPC subnet. The SDN controller delivers VRF, LAN port configuration, virtual firewall security policy rules, and static routes from the virtual firewall to the virtual router and back to the VPC subnet to the managed virtual firewall, implementing networking of the virtual firewall and virtual router.

[0019] Furthermore, the specific process of adding a public network egress to the virtual router in the VPC network, setting a default gateway, and sending the virtual port configuration of the router's multiple egresses to the virtual firewall is as follows: Add multiple public networks to the router under the VPC network, select one external network port as the default gateway, and the other external network ports as non-default gateways; the agent on the SDN controller side receives the OpenStack VPC multi-egress request, and simultaneously creates a public network line VRF on the firewall, configures the WAN port IP, configures the SNAT policy under the WAN port, configures the default route based on the default gateway parameters of the public network egress on the OpenStack side, and configures the detailed route of the public network egress line for the non-default gateway.

[0020] Furthermore, the method of adding multiple public networks to the router under the VPC network and selecting one external network port as the default gateway and the other external network ports as non-default gateways is as follows: Call the Neutron component in OpenStack to add a public network to the virtual router, set the external-gateway field for this public network, store the external network information in the external_gateway_info field in the virtual router, and use this public network as the default gateway for multiple egresses. The default attribute of the default gateway in external_gateway_info is set to True. Neutron only supports a single default gateway port, whose device_owner attribute is network:router_gateway. To implement non-default gateway egresses, add the public network to the virtual router as a normal network, create a virtual port with the device_owner attribute set to router_interface, add the default attribute to the bind-profile of the virtual port, and set the default attribute of the virtual ports of other public network egresses to False, indicating non-default gateways. The SDN controller dynamically issues SNAT rules based on the default attribute of the virtual ports in the virtual router. The SDN controller configures a default route 0.0.0.0 / 0 and a specific route based on the default gateway, and configures specific routes for the public network egress lines based on the non-default gateway.

[0021] Furthermore, the virtual machine dynamically selects whether to access the external network directly or through the firewall as follows: By default, virtual machines in a VPC network need to pass through the firewall to access the external network, and the default gateway exit must pass through the firewall to access the external network. Based on the OpenStack cloud platform interface operation, the virtual firewall switch of the default gateway port under the virtual router of the VPC network is turned on by default and is not allowed to be turned off. All traffic passing through the default gateway port will be inspected by the firewall. The SDN controller dynamically updates the firewall rules of the non-default gateway. When the firewall of the virtual port of the non-default gateway is turned on, traffic going out of this virtual port needs to pass through the firewall. When the firewall of the virtual port of the non-default gateway is turned off, the SDN controller removes or disables the firewall rules related to the non-default gateway port and allows traffic to pass directly.

[0022] Furthermore, the SDN controller dynamically updates the firewall rules of the non-default gateway as follows: Based on the OpenStack cloud platform interface, add the firewall attribute fw_enabled to the virtual port of the non-default gateway egress in the VPC network's multi-egress. This operation calls the Neutron component in OpenStack to update the virtual port. The firewall attribute fw_enabled is introduced in the binding-profile of the virtual port. The firewall attribute fw_enabled of the non-default gateway virtual port is set to False, indicating that traffic going out of this public network port does not need to pass the firewall. The firewall attribute fw_enabled of the non-default gateway virtual port is set to True, indicating that traffic going out of this public network port needs to pass the firewall. Then, call the Neutron interface to notify the virtual router of the update. The SDN controller dynamically issues the corresponding network policy configuration to the virtual firewall of the non-default gateway based on the firewall attribute fw_enabled in the virtual port of the virtual router to control whether the firewall is enabled or disabled.

[0023] The present invention also proposes a routing selection system under a VPC network model based on Openstack and SDN technology, comprising: a network creation module, an SDN controller, a virtual machine creation module, a serverleaf switch, a virtual firewall creation module and a virtual router; The network creation module creates a multi-line public network, and the SDN controller enters the external access lines corresponding to the external network; The network creation module creates a VPC network and a subnet of the VPC network, and the SDN controller issues the VPC network configuration; The virtual machine creation module uses the VPC network to create a virtual machine, and the SDN controller sends the virtual port configuration of the virtual machine to the serverleaf switch; The virtual firewall creation module creates a virtual firewall and binds it to the VPC network, and the SDN controller sends the firewall configuration to the virtual firewall; Add a public network egress to the virtual router in the VPC network and set the default gateway. The SDN controller sends the virtual port configuration of the router's multiple egresses to the virtual firewall. The virtual machine dynamically selects whether to access the external network directly or through the firewall.

[0024] The beneficial effects of the present invention are: The present invention adds a new attribute to the public network gateway port under the router of the VPC network, and introduces the fw_enabled attribute in the binding-profile of the Vport to control the opening and closing of the firewall.

[0025] The SDN controller dynamically distributes network policy configurations based on the value of the fw_enabled attribute in the router's non-default network Vport. This primarily involves enabling or disabling firewall rules. When fw_enabled is True, the SDN controller generates and distributes firewall rules to ensure that all traffic passing through the virtual port is inspected by the firewall. When fw_enabled is False, the SDN controller removes or disables the firewall rules associated with the virtual port, allowing traffic to pass through without firewall inspection. This means that traffic is no longer subject to the aforementioned firewall rules, potentially improving network performance. Except for designated external network access via specific routes, all external network access via the default route must pass through the firewall, thereby enhancing network security.

[0026] It is mainly reflected in the flexible control of VPC network egress policies. Specifically, by combining the two access modes of direct access to the external network and through the firewall, it realizes the refined management and security control of virtual machine access to the external network traffic, and provides a flexible, efficient and secure VPC network egress management mechanism. It can dynamically adjust network access policies according to different business needs, and at the same time use SDN technology to realize the automatic configuration and optimization of network policies.

[0027] VPC (Virtual Private Cloud) has a multi-egress design that supports accessing the external network through both direct access and through the firewall. This has the following benefits: (1) Enhanced security: When traffic is selected to pass through the firewall egress, the firewall rules can be used to perform in-depth inspection and filtering of traffic in and out of the VPC, effectively preventing malicious attacks and unauthorized access, and protecting the security of internal network resources. (2) Flexible traffic control: By configuring different firewall rules, different types of traffic can be flexibly controlled according to business needs, such as allowing or denying communication with specific IPs, ports, or protocols, to implement refined network access policies. (3) Optimized network performance: The egress directly to the external network can bypass firewall inspection, reducing network latency and processing time, and is suitable for scenarios with high requirements for real-time performance and response speed, such as online games, live video streaming, object storage, file storage, etc. (4) Cost-effectiveness: For a large amount of non-sensitive traffic, you can choose the egress directly to the external network to avoid the additional computing load and cost brought by the firewall, saving resources. (5) Compliance: In accordance with industry standards and regulatory requirements, for businesses that require strict auditing and compliance, detailed logging and audit tracking can be provided through the firewall outlet to meet the needs of compliance review. (6) Failover and redundancy: The multi-export design provides network redundancy. Even if one of the outlets fails, the traffic can be automatically switched to another outlet to ensure network continuity and reliability. (7) Policy isolation: Different businesses or departments can choose different outlet policies based on their security levels and network requirements to achieve isolation and independent management of network policies. (8) The present invention is applicable to various OpenStack-based cloud platforms, especially in scenarios where multiple outlets are required, such as finance, medical care, e-commerce, and other industries with high requirements for network reliability and high availability. Through the system and method of the present invention, more stable and efficient network services can be achieved in these application scenarios, improving business continuity and user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 This is a flowchart of the routing method under the VPC network model based on Openstack and SDN technology proposed by the present invention.

[0029] Figure 2 This is a diagram of a VPC network with multiple public network egresses connected directly and through a firewall.

[0030] Figure 3 This is a simplified diagram of a VPC network with multi-egress intelligent routing. DETAILED DESCRIPTION

[0031] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0032] Example 1 The present invention proposes a routing method under the VPC network model based on Openstack and SDN technology. The overall process of the method is as follows: Figure 1 As shown, the following steps are included: Step 1: Create multiple public networks on the cloud platform interface or through the API. The SDN controller enters the external access lines corresponding to the external network. Specifically: The OpenStack-based cloud platform provides the ability to create public networks and subnets. This allows you to create public networks and subnets within them, and plan two types of external networks: those with direct access to the external network and those that pass through the firewall. Upon receiving the subnet creation message from OpenStack, the SDN controller configures all ServerLeaf switches, registers information for multiple external networks, and adds external access lines to the corresponding networks. When mapped to the SDN controller, the public network of the OpenStack cloud platform is referred to as an external network.

[0033] Step 2: Create a VPC network and subnets on the cloud platform interface or through the API. The SDN controller will deliver the VPC network configuration. The OpenStack-based cloud platform provides the function of creating VPC networks and subnets. Use the cloud platform to create VPC networks and VPC network subnets. When creating the VPC network subnet, add the subnet to the virtual router VRouter. The SDN controller sends the VPC network-related configuration, and the LS-LR-VRB network is completed.

[0034] Step 3: Create a virtual machine using the VPC network in the cloud platform interface or through the API. The SDN controller sends the virtual port configuration of the virtual machine to the ServerLeaf switch. The specific process is as follows: Create a virtual machine on the OpenStack cloud platform and set its properties, including the number of virtual CPU cores and memory size, and the subnet of the VPC network associated with the virtual network card. The OpenStack Nova service schedules the virtual machine to a server based on the scheduling algorithm and creates the virtual machine on the server. The SDN controller sends the virtual port Vport configuration of the virtual machine to the serverleaf switch.

[0035] Step 4: Create a virtual firewall on the cloud platform interface or through the API and bind it to the VPC network. The SDN controller will send the firewall configuration to the virtual firewall (all VPC egresses pass through the firewall by default). The specific process is as follows: The SDN controller creates a virtual firewall and parses the virtual firewall's associated resources, including virtual router port information. The SDN controller creates a firewall security policy, creates a VRF, creates a LAN port, and configures an IP address. The SDN controller also creates a static route from the virtual firewall to the virtual router and back to the VPC subnet. The SDN controller delivers VRF, LAN port configuration, virtual firewall security policy rules, and static routes from the virtual firewall to the virtual router and back to the VPC subnet to the managed virtual firewall, implementing networking of the virtual firewall and virtual router.

[0036] Step 5: Add a public network egress to the virtual router in the VPC network in the cloud platform interface or through the API, and set the default gateway. The SDN controller sends the virtual port configuration of the router's multiple egresses to the virtual firewall (there is only one default gateway, and the rest are non-default gateways). The specific process is as follows: Add multiple public networks to the router under the VPC network, select one external network port as the default gateway, and the other external network ports as non-default gateways; the agent on the SDN controller side receives the OpenStack VPC multi-egress request, and simultaneously creates a public network line VRF on the firewall, configures the WAN port IP, configures the SNAT policy under the WAN port, configures the default route based on the default gateway parameters of the public network egress on the OpenStack side, and configures the detailed route of the public network egress line for the non-default gateway.

[0037] Add multiple public networks to the router under the VPC network and select one external network port as the default gateway. The other external network ports are non-default gateways. Call the Neutron component in OpenStack to add a public network to the virtual router (L3 router), set the external-gateway field of this public network, store the external network information in the external_gateway_info field of the virtual router, and use this public network as the default gateway for multiple exits. The default attribute of the external_gateway_info field is set to True for the default gateway. The Neutron component only supports the case of a single default gateway port, and the device_owner attribute of this default gateway port is network:router_gateway. To implement other non-default gateway exits, the public network is added to the virtual router as a common network, the device_owner attribute of the created virtual port is set to router_interface, the default attribute is added to the bind-profile of the virtual port, and the default attribute of the virtual port of other public network exits is set to False, indicating a non-default gateway. The SDN controller dynamically issues SNAT rules based on the default attribute of the virtual port in the virtual router. The SDN controller configures a default route of 0.0.0.0 / 0 and a detailed route based on the default gateway, and configures the detailed route of the public network exit line based on the non-default gateway.

[0038] Step 6: The virtual machine dynamically chooses whether to access the external network directly or through the firewall. By default, virtual machines in a VPC network need to pass through the firewall to access the external network, and the default gateway exit must pass through the firewall to access the external network. Based on the OpenStack cloud platform interface operation, the virtual firewall switch of the default gateway port under the virtual router of the VPC network is turned on by default and is not allowed to be turned off. All traffic passing through the default gateway port will be inspected by the firewall. The SDN controller dynamically updates the firewall rules of the non-default gateway. When the firewall of the virtual port of the non-default gateway is turned on, traffic going out of this virtual port needs to pass through the firewall. When the firewall of the virtual port of the non-default gateway is turned off, the SDN controller removes or disables the firewall rules related to the non-default gateway port and allows traffic to pass directly.

[0039] The SDN controller dynamically updates the firewall rules for non-default gateways as follows: Based on the OpenStack cloud platform interface operation, add the firewall attribute fw_enabled to the virtual port of the non-default gateway exit in the VPC network's multi-exit. This operation calls the Neutron component in OpenStack to implement the update of the virtual port, introduces the firewall attribute fw_enabled in the binding-profile of the virtual port, and sets the firewall attribute fw_enabled of the non-default gateway virtual port to False, indicating that traffic does not need to pass through the firewall when going out from this public network port. Set the firewall attribute fw_enabled of the non-default gateway virtual port to True, indicating that traffic needs to pass through the firewall when going out from this public network port. Then call the neutron interface to notify the virtual router to update. The SDN controller dynamically sends the corresponding network policy configuration to the virtual firewall of the non-default gateway based on the firewall attribute fw_enabled in the virtual port in the virtual router to control the enabling or disabling of the firewall. The VPC multi-exit design combines the two methods of direct access to the external network and through the firewall, which can provide more comprehensive, flexible and secure network access control to meet business needs in different scenarios. The network diagram of direct access and through the firewall for multiple public network exits of the VPC network is as follows Figure 2 As shown in the figure, FW represents the firewall, and the red line represents the default gateway accessing the external network through the firewall. The blue line represents the non-default gateway directly connected to the external network, and the green line represents the non-default gateway accessing the external network through the firewall. The VPC network multi-exit intelligent routing network diagram is as follows Figure 3 shown.

[0040] Example 2 The present invention proposes a routing system under a VPC network model based on Openstack and SDN technology corresponding to the method of embodiment 1, including: a network creation module, an SDN controller, a virtual machine creation module, a serverleaf switch, a virtual firewall creation module and a virtual router; The network creation module creates a multi-line public network, and the SDN controller enters the external access lines corresponding to the external network; The network creation module creates a VPC network and a subnet of the VPC network, and the SDN controller issues the VPC network configuration; The virtual machine creation module uses the VPC network to create a virtual machine, and the SDN controller sends the virtual port configuration of the virtual machine to the serverleaf switch; The virtual firewall creation module creates a virtual firewall and binds it to the VPC network, and the SDN controller sends the firewall configuration to the virtual firewall; Add a public network egress to the virtual router in the VPC network and set the default gateway. The SDN controller sends the virtual port configuration of the router's multiple egresses to the virtual firewall. The virtual machine dynamically selects whether to access the external network directly or through the firewall.

[0041] The implementation of each module and module function in the system is completely consistent with the steps of the method in Example 1, so it will not be repeated here.

[0042] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed in this application can be implemented in electronic hardware or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0043] The above are merely preferred embodiments of the present invention. The scope of protection of the present invention is not limited to the above embodiments. All technical solutions based on the principles of the present invention are within the scope of protection of the present invention. It should be noted that for those skilled in the art, various improvements and modifications that do not depart from the principles of the present invention should be considered within the scope of protection of the present invention.

Claims

1. A routing selection method under a VPC network model based on Openstack and SDN technology, characterized in that: The following steps are involved: Create multiple lines of public network, and the SDN controller enters the external access lines corresponding to the external network; Create a VPC network and its subnets, and the SDN controller delivers the VPC network configuration. Use the VPC network to create a virtual machine, and the SDN controller sends the virtual port configuration of the virtual machine to the ServerLeaf switch; Create a virtual firewall and bind it to the VPC network. The SDN controller sends the firewall configuration to the virtual firewall. Add a public network egress to the virtual router in the VPC network and set the default gateway. The SDN controller sends the virtual port configuration of the router's multiple egresses to the virtual firewall. The virtual machine dynamically chooses whether to access the external network directly or through the firewall.

2. The routing method under the VPC network model based on Openstack and SDN technology according to claim 1, characterized in that: When creating a multi-line public network, the SDN controller enters the external access lines corresponding to the external network as follows: Create a public network and its subnets, and plan two types of external networks: one that connects directly to the external network and one that passes through the firewall. After receiving the message from OpenStack that a subnet has been created, the SDN controller configures all ServerLeaf switches, enters information about multiple external networks, and enters the external access lines for the corresponding external networks.

3. The routing method under the VPC network model based on Openstack and SDN technology according to claim 1, characterized in that: The VPC network and subnet are created, and the SDN controller sends the VPC network configuration as follows: Create a VPC network and its subnets. When creating the VPC subnets, add the subnets to the virtual router VRouter. The SDN controller then sends VPC network-related configurations, completing the LS-LR-VRB network.

4. The routing method under the VPC network model based on Openstack and SDN technology according to claim 1, characterized in that: The specific process of using the VPC network to create a virtual machine and the SDN controller sending the virtual port configuration of the virtual machine to the ServerLeaf switch is as follows: Create a virtual machine on the OpenStack cloud platform and set its properties, including the number of virtual CPU cores and memory size, and associate the virtual network interface card with the subnet of the VPC network. The OpenStack Nova service schedules the virtual machine to a server based on a scheduling algorithm and creates the virtual machine on the server. The SDN controller then sends the virtual port configuration of the virtual machine to the ServerLeaf switch.

5. The routing method under the VPC network model based on Openstack and SDN technology according to claim 1, characterized in that: The specific process of creating a virtual firewall and binding it to the VPC network, and the SDN controller sending the firewall configuration to the virtual firewall is as follows: The SDN controller creates a virtual firewall and parses the virtual firewall's associated resources, including virtual router port information. The SDN controller creates a firewall security policy, creates a VRF, creates a LAN port, and configures an IP address. The SDN controller also creates a static route from the virtual firewall to the virtual router and back to the VPC subnet. The SDN controller delivers VRF, LAN port configuration, virtual firewall security policy rules, and static routes from the virtual firewall to the virtual router and back to the VPC subnet to the managed virtual firewall, implementing networking of the virtual firewall and virtual router.

6. The routing method under the VPC network model based on Openstack and SDN technology according to claim 1, characterized in that: The specific process of adding a public network egress to the virtual router in the VPC network, setting the default gateway, and sending the virtual port configuration of the router's multiple egresses to the virtual firewall is as follows: Add multiple public networks to the router under the VPC network, select one external network port as the default gateway, and the other external network ports as non-default gateways; the agent on the SDN controller side receives the OpenStack VPC multi-egress request, and simultaneously creates a public network line VRF on the firewall, configures the WAN port IP, configures the SNAT policy under the WAN port, configures the default route based on the default gateway parameters of the public network egress on the OpenStack side, and configures the detailed route of the public network egress line for the non-default gateway.

7. The routing selection method under the VPC network model based on Openstack and SDN technology according to claim 6, characterized in that: The steps to add multiple public networks to the router under the VPC network and select one external network port as the default gateway and the other external network ports as non-default gateways are as follows: Call the Neutron component in OpenStack to add a public network to the virtual router, set the external-gateway field for this public network, store the external network information in the external_gateway_info field in the virtual router, and use this public network as the default gateway for multiple egresses. The default attribute of the default gateway in external_gateway_info is set to True. Neutron only supports a single default gateway port, whose device_owner attribute is network:router_gateway. To implement non-default gateway egresses, add the public network to the virtual router as a normal network, create a virtual port with the device_owner attribute set to router_interface, add the default attribute to the bind-profile of the virtual port, and set the default attribute of the virtual ports of other public network egresses to False, indicating non-default gateways. The SDN controller dynamically issues SNAT rules based on the default attribute of the virtual ports in the virtual router. The SDN controller configures a default route 0.0.0.0 / 0 and a specific route based on the default gateway, and configures specific routes for the public network egress lines based on the non-default gateway.

8. The routing method under the VPC network model based on Openstack and SDN technology according to claim 1, characterized in that: The virtual machine dynamically selects whether to access the external network directly or through the firewall as follows: By default, virtual machines in a VPC network need to pass through the firewall to access the external network, and the default gateway exit must pass through the firewall to access the external network. Based on the OpenStack cloud platform interface operation, the virtual firewall switch of the default gateway port under the virtual router of the VPC network is turned on by default and is not allowed to be turned off. All traffic passing through the default gateway port will be inspected by the firewall. The SDN controller dynamically updates the firewall rules of the non-default gateway. When the firewall of the virtual port of the non-default gateway is turned on, traffic going out of this virtual port needs to pass through the firewall. When the firewall of the virtual port of the non-default gateway is turned off, the SDN controller removes or disables the firewall rules related to the non-default gateway port and allows traffic to pass directly.

9. The routing method under the VPC network model based on Openstack and SDN technology according to claim 8, characterized in that: The SDN controller dynamically updates the firewall rules for non-default gateways as follows: Based on the OpenStack cloud platform interface, add the firewall attribute fw_enabled to the virtual port of the non-default gateway egress in the VPC network's multi-egress. This operation calls the Neutron component in OpenStack to update the virtual port. The firewall attribute fw_enabled is introduced in the binding-profile of the virtual port. The firewall attribute fw_enabled of the non-default gateway virtual port is set to False, indicating that traffic going out of this public network port does not need to pass the firewall. The firewall attribute fw_enabled of the non-default gateway virtual port is set to True, indicating that traffic going out of this public network port needs to pass the firewall. Then, call the Neutron interface to notify the virtual router of the update. The SDN controller dynamically issues the corresponding network policy configuration to the virtual firewall of the non-default gateway based on the firewall attribute fw_enabled in the virtual port of the virtual router to control whether the firewall is enabled or disabled.

10. A routing system under a VPC network model based on Openstack and SDN technology, characterized in that: include: Network creation module, SDN controller, virtual machine creation module, serverleaf switch, virtual firewall creation module and virtual router; The network creation module creates a multi-line public network, and the SDN controller enters the external access lines corresponding to the external network; The network creation module creates a VPC network and a subnet of the VPC network, and the SDN controller issues the VPC network configuration; The virtual machine creation module uses the VPC network to create a virtual machine, and the SDN controller sends the virtual port configuration of the virtual machine to the serverleaf switch; The virtual firewall creation module creates a virtual firewall and binds it to the VPC network, and the SDN controller sends the firewall configuration to the virtual firewall; Add a public network egress to the virtual router in the VPC network and set the default gateway. The SDN controller sends the virtual port configuration of the router's multiple egresses to the virtual firewall. The virtual machine dynamically selects whether to access the external network directly or through the firewall.

Images