Private virtual local area network message forwarding method and device, equipment and medium

Abstract

The invention relates to the technical field of communication, and discloses a message forwarding method and device for a private virtual local area network, equipment and a medium, and the method comprises the steps: obtaining a target message according to a target virtual switch in the private virtual local area network; the target virtual switch is a virtual switch created for a target VLAN of the private virtual local area network, and the target VLAN is a main VLAN or an auxiliary VLAN of the private virtual local area network; under the condition that the target message comes from the virtual machine of the target VLAN, forwarding is carried out according to the destination address of the target message; and under the condition that the target message comes from the service virtual switch of the private virtual local area network, modifying the VLAN identifier of the target message into the identifier of the target VLAN, and forwarding according to the destination address of the target message. According to the invention, the private virtual local area network can be configured without using an OpenFlow controller, the message forwarding can be realized, and the realization mode is simple and has universality.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a message forwarding method, device, equipment and medium for a private virtual local area network. Background Art

[0002] A virtual switch can perform most of the functions of a physical switch, providing network connectivity for virtual machines (VMs). It can also be used with a virtual local area network (VLAN) to achieve network isolation.

[0003] PVLAN (Private VLAN) technology efficiently utilizes limited VLAN and IP address resources while achieving refined Layer 2 isolation. Open vSwitch (OVS) is a powerful and currently popular open-source software for implementing virtual switches, allowing for on-demand virtual switch creation. However, Open vSwitch does not support PVLAN, which significantly limits its deployment in virtualization scenarios. Summary of the Invention

[0004] In view of this, the present invention provides a private virtual local area network message forwarding method, apparatus, device and medium to solve the problem that OVS is difficult to implement PVLAN.

[0005] In a first aspect, the present invention provides a method for forwarding a message in a private virtual local area network, comprising:

[0006] Acquire a target message according to a target virtual switch in the private virtual local area network; the target virtual switch is a virtual switch created for a target VLAN of the private virtual local area network, and the target VLAN is a primary VLAN or a secondary VLAN of the private virtual local area network;

[0007] When the target message comes from a virtual machine of the target VLAN, forwarding the target message according to the destination address of the target message;

[0008] In the case where the target message comes from the service virtual switch of the private virtual LAN, the VLAN identifier of the target message is modified to the identifier of the target VLAN, and forwarded according to the destination address of the target message; the service virtual switch and the target virtual switch communicate based on paired interconnected ports.

[0009] In some optional implementations, the process of configuring the private virtual local area network includes:

[0010] Configuring corresponding identifiers for the primary VLAN and each auxiliary VLAN of the private virtual local area network;

[0011] Creating corresponding virtual switches for the primary VLAN and the auxiliary VLAN respectively, and creating paired interconnection ports between the virtual switches and the preset service virtual switches;

[0012] Setting each of the interconnected ports to a multi-VLAN mode, and configuring a supported VLAN identifier list according to the identifier of the primary VLAN and the identifier of the auxiliary VLAN;

[0013] A corresponding flow table is issued to each of the virtual switches; the flow table is used to modify the VLAN identifier in the message from the corresponding interconnected port to the identifier of the VLAN to which the virtual switch belongs.

[0014] In some optional implementations, creating corresponding virtual switches for the primary VLAN and the auxiliary VLAN, respectively, and creating paired interconnection ports with a preset service virtual switch, includes:

[0015] Create a primary virtual switch corresponding to the primary VLAN, and create a primary interconnection port for the primary virtual switch;

[0016] Creating an auxiliary virtual switch corresponding to the auxiliary VLAN, and creating an auxiliary interconnection port for the auxiliary virtual switch;

[0017] A first interconnection port and a second interconnection port are created for a preset service virtual switch; the first interconnection port corresponds to the primary interconnection port, and the second interconnection port corresponds to the auxiliary interconnection port.

[0018] In some optional implementations, setting each of the interconnected ports to a multi-VLAN mode and configuring a supported VLAN ID list according to the ID of the primary VLAN and the ID of the auxiliary VLAN includes:

[0019] Setting the primary interconnection port and the first interconnection port to a multi-VLAN mode, and configuring a first VLAN identifier list supported by the primary interconnection port and the first interconnection port; the first VLAN identifier list includes an identifier of the primary VLAN and identifiers of all the auxiliary VLANs;

[0020] The auxiliary interconnect port and the second interconnect port are set to a multi-VLAN mode, and a second VLAN identifier list supported by the auxiliary interconnect port and the second interconnect port is configured; the second VLAN identifier list includes the identifier of the primary VLAN and the identifiers of the auxiliary VLANs corresponding to the auxiliary interconnect port and the second interconnect port.

[0021] In some optional implementations, the auxiliary VLAN includes: an isolation VLAN and / or a community VLAN;

[0022] The step of creating an auxiliary virtual switch corresponding to the auxiliary VLAN and creating an auxiliary interconnection port for the auxiliary virtual switch includes:

[0023] In the case where the auxiliary VLAN includes the isolated VLAN, creating an isolated virtual switch corresponding to the isolated VLAN, and creating an isolated interconnect port for the isolated virtual switch;

[0024] In a case where the auxiliary VLAN includes the community VLAN, a community virtual switch corresponding to the community VLAN is created, and a community interconnection port is created for the community virtual switch.

[0025] In some optional implementations, configuring corresponding identifiers for the primary VLAN and each auxiliary VLAN of the private virtual local area network includes:

[0026] Setting a main configuration file corresponding to the primary VLAN of the private virtual local area network and auxiliary configuration files corresponding to each auxiliary VLAN belonging to the main VLAN; the main configuration file includes an identifier of the primary VLAN, and the auxiliary configuration file includes an identifier of the auxiliary VLAN;

[0027] The process of configuring the private virtual local area network further includes:

[0028] Bind the virtual machine to the corresponding matching profile and associate it with the corresponding matching VLAN and matching virtual switch;

[0029] Wherein, in the case where the virtual machine belongs to a primary VLAN, the matching configuration file is the primary configuration file, the matching VLAN is the primary VLAN, and the matching virtual switch is the primary virtual switch created for the primary VLAN;

[0030] In a case where the virtual machine belongs to a secondary VLAN, the matching profile is the secondary profile, the matching VLAN is the secondary VLAN, and the matching virtual switch is the secondary virtual switch created for the secondary VLAN.

[0031] In some optional implementations, the auxiliary VLAN includes: an isolation VLAN and / or a community VLAN;

[0032] The sending of the corresponding flow table to each of the virtual switches includes:

[0033] Sending a first flow table to the primary virtual switch created for the primary VLAN; the first flow table is used to modify the identifier of the isolated VLAN or the identifier of the community VLAN in the first message to the identifier of the primary VLAN, wherein the first message is a message from the primary interconnection port created for the primary virtual switch;

[0034] In a case where the auxiliary VLAN includes the isolated VLAN, a second flow table is issued to the isolated virtual switch created for the isolated VLAN; the second flow table is used to modify the identifier of the primary VLAN in the second message to the identifier of the isolated VLAN, and discard messages with VLAN identifiers other than the identifier of the primary VLAN, wherein the second message is a message from the isolated interconnect port created for the isolated virtual switch;

[0035] When the auxiliary VLAN includes the group VLAN, a third flow table is sent to the group virtual switch created for the group VLAN; the third flow table is used to modify the identifier of the primary VLAN in the third message to the identifier of the group VLAN, and the third message is a message from the group interconnection port created for the group virtual switch.

[0036] In some optional embodiments, the method further comprises:

[0037] When the target message is received through the source port, determine the source MAC address and the first VLAN identifier in the target message, and generate a first MAC forwarding table entry; the first MAC forwarding table entry is used to indicate the correspondence between the source MAC address, the first VLAN identifier and the source port;

[0038] A second VLAN identifier corresponding to the first VLAN identifier is determined, and a second MAC forwarding table entry is additionally generated; the second MAC forwarding table entry is used to indicate a correspondence between the source MAC address, the second VLAN identifier, and the source port.

[0039] In some optional implementations, when the first VLAN identifier is an identifier of a primary VLAN, identifiers of all auxiliary VLANs belonging to the same private virtual local area network as the first VLAN identifier are used as the second VLAN identifier;

[0040] In a case where the first VLAN identifier is an identifier of an auxiliary VLAN, an identifier of a primary VLAN belonging to the same private virtual local area network as the first VLAN identifier is used as the second VLAN identifier.

[0041] In a second aspect, the present invention provides a message forwarding device for a private virtual local area network, comprising:

[0042] an acquisition module, configured to acquire a target message according to a target virtual switch in the private virtual local area network; the target virtual switch is a virtual switch created for a target VLAN of the private virtual local area network, and the target VLAN is a primary VLAN or a secondary VLAN of the private virtual local area network;

[0043] A first processing module, configured to forward the target message according to the destination address of the target message when the target message comes from the virtual machine of the target VLAN;

[0044] The second processing module is used to modify the VLAN identifier of the target message to the identifier of the target VLAN when the target message comes from the service virtual switch of the private virtual local area network, and forward it according to the destination address of the target message; the service virtual switch and the target virtual switch communicate based on paired interconnected ports.

[0045] In a third aspect, the present invention provides a computer device comprising: a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing the computer instructions to execute the message forwarding method for a private virtual local area network of the first aspect or any corresponding embodiment thereof.

[0046] In a fourth aspect, the present invention provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to enable a computer to execute the message forwarding method for a private virtual local area network of the above-mentioned first aspect or any corresponding embodiment thereof.

[0047] In a fifth aspect, the present invention provides a computer program product comprising computer instructions for causing a computer to execute the message forwarding method for a private virtual local area network according to the first aspect or any corresponding embodiment thereof.

[0048] The present invention creates a corresponding virtual switch for each VLAN in a private virtual local area network (VPN), achieving intercommunication with a service VPN through interconnected ports. After receiving a target message, the target VPN forwards the target message within the same VLAN according to the destination address. For messages across VLANs, the target VPN modifies the VLAN ID of the target message to the ID of the target VLAN, enabling the target message to be forwarded within the target VLAN, thereby achieving cross-VLAN communication. This method does not require an OpenFlow controller, but only uses OVS to implement PVLAN. It is simple to configure, has high PVLAN forwarding efficiency, and can achieve fine-grained isolation and access control in a LAN. Furthermore, the implementation method is versatile and has a wider range of application scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] In order to more clearly illustrate the specific embodiments of the present invention or the technical solutions in related technologies, the following briefly introduces the drawings required for use in the specific embodiments or related technical descriptions. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0050] Figure 1 This is a configuration diagram of PVLAN;

[0051] Figure 2 1 is a flow chart of a method for forwarding messages in a private virtual local area network according to an embodiment of the present invention;

[0052] Figure 3 is a schematic diagram of interconnecting two virtual switches according to an embodiment of the present invention;

[0053] Figure 4 is a schematic diagram of a process for configuring a private virtual local area network according to an embodiment of the present invention;

[0054] Figure 5 is a flow chart of another method for forwarding messages in a private virtual local area network according to an embodiment of the present invention;

[0055] Figure 6 This is a schematic diagram of a structure for setting interconnection ports according to an embodiment of the present invention;

[0056] Figure 7 is another structural diagram of setting interconnection ports according to an embodiment of the present invention;

[0057] Figure 8 2 is a schematic diagram of the principle of PVLAN implemented based on OVS according to an embodiment of the present invention;

[0058] Figure 9 is a structural block diagram of a message forwarding device for a private virtual local area network according to an embodiment of the present invention;

[0059] Figure 10 Schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0060] To make the purpose, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without making creative efforts shall fall within the scope of protection of the present invention.

[0061] To connect virtual machine networks, virtual switches have emerged. These implement most of the functionality of physical switches and can provide network connectivity for virtual machines (VMs). Each virtual switch environment is a bridge (abbreviated as br), which connects multiple VMs and the host's external network.

[0062] PVLAN (Private VLAN) technology can solve the problem of requiring a large amount of isolation within the network but insufficient VLAN IDs. PVLAN can divide the same VLAN domain into more subdomains and implement isolation and access control between subdomains.

[0063] Specifically, PVLAN uses two layers of VLAN isolation technology: an upstream primary VLAN and a downstream secondary VLAN. Secondary VLANs come in two types: isolated VLANs and group VLANs (or community VLANs). Upstream devices only see the primary VLAN, not the secondary VLANs.

[0064] There are three types of ports for virtual machines configured with PVLAN: isolated port, group port, and promiscuous port; they correspond to isolated VLAN, group VLAN, and primary VLAN respectively.

[0065] In an isolated VLAN, isolated ports cannot communicate with each other and can only communicate with promiscuous ports.

[0066] In a community VLAN, community ports can communicate with each other and with promiscuous ports.

[0067] There is no restriction on promiscuous port communication.

[0068] like Figure 1As shown, the virtual switch is equipped with a promiscuous port P1, two community ports G1 and G2 for the community VLAN, and two isolated ports S1 and S2 for the isolated VLAN. A solid line between the ports indicates communication is possible, while a dotted line indicates no communication. See Table 1 below for details.

[0069] Table 1

[0070]

[0071] Open vSwitch (OVS) is a powerful and currently the most popular open-source software for implementing virtual switches, allowing for on-demand virtual switch deployment. However, Open vSwitch does not natively support PVLANs, which significantly limits its deployment in virtualization scenarios.

[0072] Some solutions can implement PVLAN based on OpenFlow (a network communication protocol) controllers, but this method is highly dependent on OpenFlow controllers and has limited usage scenarios. It cannot be used in scenarios where OpenvSwitch exists but there is no OpenFlow controller.

[0073] Furthermore, this approach is cumbersome and complex to configure, making it difficult to scale and maintain. In the PVLAN forwarding process, the OpenFlow controller first receives packets from a VEPA (virtual edge port aggregator) switch, constructs a flow table based on the packet characteristics, and then sends it to the VEPA switch. The VEPA switch then forwards the packet based on the flow table. This results in a cumbersome and inefficient PVLAN forwarding process.

[0074] The embodiment of the present invention provides a method for forwarding packets in a private virtual local area network (PVLAN). By using only OVS (i.e., OpenvSwitch, open virtual switch) and configuring and modifying the VLAN identifier of the packet, a private virtual local area network (PVLAN) can be implemented, and packets are forwarded based on the PVLAN. The method does not require an OpenFlow controller, is simple to configure, and has universality.

[0075] According to an embodiment of the present invention, an embodiment of a message forwarding method for a private virtual local area network is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0076] This embodiment provides a private virtual local area network message forwarding method, which can be applied to hosts that need to configure a private virtual local area network. Figure 2 Flowchart of a method for forwarding a message in a private virtual local area network according to an embodiment of the present invention. Figure 2 As shown, the process includes the following steps.

[0077] Step S201 , obtaining a target message according to a target virtual switch in a private virtual local area network; the target virtual switch is a virtual switch created for a target VLAN of the private virtual local area network, and the target VLAN is a primary VLAN or a secondary VLAN of the private virtual local area network.

[0078] In this embodiment, as shown above, a PVLAN includes a primary VLAN and one or more secondary VLANs. The secondary VLANs may specifically include an isolated VLAN and / or a community VLAN. Whether to configure an isolated VLAN or a community VLAN can be determined as needed. The number of isolated VLANs and / or community VLANs is also unlimited. Generally, there is one isolated VLAN, and multiple community VLANs can be used.

[0079] To implement PVLAN, this embodiment creates additional virtual switches. Specifically, corresponding virtual switches are created for the primary VLAN and the auxiliary VLAN, respectively. The virtual switches corresponding to these VLANs are created based on OVS, for example, by using the ovs-vsctl command.

[0080] Packets within a private virtual local area network (VLAN) are forwarded based on the virtual switches created for each VXLAN. For ease of description, this packet is referred to as the target packet, and the virtual switch that forwards it is called the target virtual switch. Accordingly, the target virtual switch is the virtual switch created for the primary or secondary VLAN of the private VLAN, and the VLAN corresponding to the target virtual switch is called the target VLAN.

[0081] Step S202: When the target message comes from a virtual machine in the target VLAN, forwarding is performed according to the destination address of the target message.

[0082] In this embodiment, each VLAN may contain one or more virtual machines. If the target message comes from a virtual machine in the target VLAN, that is, the target message and the target virtual switch belong to the same VLAN, the target virtual switch can be controlled to forward the message directly according to the destination address of the target message.

[0083] For example, if the destination address of the target message is another virtual machine A in the target VLAN, the target virtual switch forwards the target message to virtual machine A. Internal message forwarding is allowed only when the target VLAN is a primary VLAN or a community VLAN. If the target VLAN is an isolated VLAN, internal VLAN forwarding of the target message is prohibited, which will be explained later.

[0084] If the destination address of the target message is virtual machine B in another VLAN, the target virtual switch needs to forward the target message to the service virtual switch, which then forwards the target message to virtual machine B in another VXLAN. The service virtual switch will be explained later.

[0085] Step S203, when the target message comes from the service virtual switch of the private virtual LAN, the VLAN ID of the target message is modified to the ID of the target VLAN, and forwarded according to the destination address of the target message; the service virtual switch and the target virtual switch communicate based on paired interconnected ports.

[0086] In this embodiment, a virtual switch required for the service is pre-created in the host, namely the service virtual switch. This service virtual switch can be bound to multiple virtual machines (VMs) and implement message forwarding between virtual machines. In addition, to implement PVLAN, corresponding virtual switches are created for the primary VLAN and auxiliary VLAN respectively. These virtual switches need to communicate with the service virtual switch.

[0087] A virtualized environment can have multiple virtual switches. By default, these virtual switches are disconnected. However, OVS provides ports that interconnect virtual switches, known as patch ports. By configuring interconnected patch ports on two virtual switches, traffic between different virtual switches can be communicated. For standardization, in this embodiment, patch ports are referred to as interconnection ports.

[0088] Figure 3 A schematic diagram showing the interconnection of two virtual switches is shown. Figure 3 As shown in the figure, two virtual switches, virtual switch 0 and virtual switch 1, are created for the host based on OVS. Virtual switch 0's virtual port vport 0 is connected to the host's physical network card eth 0, and virtual switch 1's virtual port vport 1 is connected to the host's physical network card eth 1. Furthermore, interconnection port Patch 0 is configured for virtual switch 0, and interconnection port Patch 1 is configured for virtual switch 1. These two interconnection ports are paired, enabling intercommunication between the two virtual switches.

[0089] For ease of description, the virtual switch created for the primary VLAN is referred to as the primary virtual switch, and the virtual switch created for the secondary VLAN is referred to as the secondary virtual switch. Furthermore, a set of paired interconnection ports is created between the primary virtual switch and the service virtual switch, enabling intercommunication between the primary and service virtual switches. Similarly, another set of paired interconnection ports can be created between the secondary virtual switch and the service virtual switch, enabling intercommunication between the secondary and service virtual switches. It will be appreciated that if there are multiple secondary VLANs, a corresponding secondary virtual switch must be created for each secondary VLAN, and each secondary virtual switch must have a pair of interconnection ports created with the service virtual switch.

[0090] If the target message comes from the service virtual switch, it means that the target message comes from another VLAN and the VLAN ID of the target message is the ID of another VLAN, so the target message cannot be forwarded in the target VLAN. In this embodiment, the target virtual switch will modify the VLAN ID of the target message to the ID of the target VLAN, and the modified target message can be forwarded in the target VLAN. Therefore, the target message is then forwarded according to the destination address of the target message, so that the modified target message can be forwarded to the virtual machine of the target VLAN.

[0091] The message forwarding method for a private virtual local area network provided in this embodiment creates a corresponding virtual switch for each VLAN in the private virtual local area network, and achieves intercommunication with the service virtual switch through the interconnected port. After the target virtual switch receives the target message, it forwards the target message within the same VLAN according to the destination address. For messages across VLANs, the target virtual switch modifies the VLAN ID of the target message to the ID of the target VLAN, so that the target message can be forwarded within the target VLAN, thereby achieving cross-VLAN communication. This method does not require the use of an OpenFlow controller, but only requires the use of OVS to implement PVLAN. It has simple configuration, high PVLAN forwarding efficiency, and can achieve fine-grained isolation and access control in the local area network. In addition, the implementation method is universal and has a wider range of application scenarios.

[0092] In this embodiment, a private virtual local area network message forwarding method is provided, which requires pre-configuration of the private virtual local area network. Figure 4 As shown, the process of configuring a private virtual local area network includes the following steps.

[0093] Step S401: configuring corresponding identifiers for the primary VLAN and each auxiliary VLAN of the private virtual local area network.

[0094] In this embodiment, a corresponding identifier is pre-set for each VLAN corresponding to each subdomain in the PVLAN. The identifier is specifically the VLAN ID. For example, if the PVLAN includes a primary VLAN, an isolated VLAN, and a community VLAN, the identifier of the primary VLAN can be set to 100, the identifier of the isolated VLAN can be set to 101, the identifier of the community VLAN can be set to 102, and so on.

[0095] It is understandable that multiple PVLANs may be set, and the VLAN identifiers of different PVLANs are also different; for example, in another PVLAN, the identifier of the primary VLAN is 200, the identifier of the isolated VLAN is 201, and so on.

[0096] Step S402: Create corresponding virtual switches for the primary VLAN and the auxiliary VLAN respectively, and create paired interconnection ports between the virtual switches and the preset service virtual switches.

[0097] As shown above, in order to implement PVLAN, corresponding virtual switches are created for the primary VLAN and auxiliary VLAN respectively, and each virtual switch is interconnected with the service virtual switch through the interconnection port (Patch port) to achieve data communication.

[0098] Step S403: Set each interconnected port to a multi-VLAN mode, and configure a supported VLAN ID list according to the primary VLAN ID and the auxiliary VLAN ID.

[0099] Among them, the virtual switch created based on OVS supports single VLAN mode (i.e., Access mode) and multi-VLAN mode (i.e., Trunk mode). In this embodiment, each interconnected port is set to multi-VLAN mode, that is, each interconnected port operates in Trunk mode, so that it is possible to specify which VLANs' messages can pass through the interconnected port in Trunk mode, that is, the supported VLAN ID list can be configured.

[0100] Specifically, the VLAN identifier list supported by the corresponding interconnected port is configured according to actual requirements of the primary VLAN and the auxiliary VLAN, and the VLAN identifier list includes the identifier of the primary VLAN and the identifier of the corresponding auxiliary VLAN.

[0101] For example, a VM in the primary VLAN needs to be able to communicate with VMs in any other secondary VLAN. Therefore, the VLAN ID list for the interconnect port corresponding to the primary VLAN includes the ID of the primary VLAN and the IDs of all secondary VLANs. The configuration of the remaining secondary VLANs can be determined based on the connectivity of each VLAN in the PVLAN.

[0102] Step S404: Send a corresponding flow table to each virtual switch; the flow table is used to modify the VLAN identifier in the message from the corresponding interconnected port to the identifier of the VLAN to which the virtual switch belongs.

[0103] In this embodiment, it is also necessary to create corresponding virtual switches for the primary VLAN and the auxiliary VLAN and send corresponding flow tables respectively; for example, the flow table can be sent based on the ovs-ofctl command of OVS.

[0104] The flow table is used to modify the VLAN identifier in the message from the corresponding interconnection port to the identifier of the VLAN to which the virtual switch belongs.

[0105] For example, the flow table sent to the primary virtual switch created for the primary VLAN is used to modify the VLAN ID in messages from the interconnected ports of the primary virtual switch to the ID of the VLAN to which the primary virtual switch belongs, thereby enabling the message to be forwarded within the primary VLAN. The flow table sent to the secondary VLAN is similar and will not be repeated here.

[0106] After the above configuration and flow table are issued, the virtual machines added to the primary virtual switch belong to the primary VLAN, and the virtual machines added to the secondary virtual switch belong to the secondary VLAN. In addition, virtual machines in different VLANs can communicate with each other through the service virtual switch, achieving the same isolation effect as PVLAN, that is, PVLAN can be implemented.

[0107] This embodiment provides a method for forwarding packets in a private virtual local area network (PVLAN). This method configures interconnected ports in multi-VLAN mode and sets a VLAN ID list, allowing virtual switches in different VLANs to communicate with each other according to PVLAN requirements. Furthermore, a flow table with modified VLAN IDs is issued to each virtual switch to ensure normal packet forwarding. This method does not require an OpenFlow controller; it only uses OVS and the OpenFlow protocol to implement PVLANs. This method simplifies configuration and has a wider range of applications.

[0108] This embodiment provides a private virtual local area network message forwarding method, which can be applied to hosts that need to configure a private virtual local area network. Figure 5 Flowchart of a method for forwarding a message in a private virtual local area network according to an embodiment of the present invention. Figure 5 As shown, the process includes the following steps.

[0109] Step S501, setting a primary configuration file corresponding to the primary VLAN of the private virtual local area network and auxiliary configuration files corresponding to each auxiliary VLAN belonging to the primary VLAN; the primary configuration file includes the identifier of the primary VLAN, and the auxiliary configuration file includes the identifier of the auxiliary VLAN.

[0110] In this embodiment, a corresponding configuration file is set for each VLAN of the private virtual local area network, and the identifier of each VLAN is determined by the configuration file. If the auxiliary VLAN includes an isolation VLAN and / or a community VLAN, the auxiliary configuration file may include an isolation configuration file corresponding to the isolation VLAN and / or a community configuration file corresponding to the community VLAN. Accordingly, the isolation configuration file includes the identifier of the isolation VLAN, and the community configuration file includes the identifier of the community VLAN.

[0111] In addition, each isolation profile and community profile also includes the primary VLAN to which it belongs, so as to indicate the relationship between each auxiliary VLAN and the primary VLAN.

[0112] For example, the VLAN configuration file may specifically be a network configuration file (netprofile). If the primary VLAN ID is 100 and the isolated VLAN ID is 101, then the isolation configuration file corresponding to the isolated VLAN may have the following content:

[0113]

[0114]

[0115] VS_P100_S101 represents the name of the isolation profile. These profiles are used to bind virtual machines and specify the specific rules used by the virtual machines, as described later.

[0116] Step S502: Create corresponding virtual switches for the primary VLAN and the auxiliary VLAN respectively, and create paired interconnection ports between the virtual switches and the preset service virtual switches.

[0117] For details, please see Figure 4 Step S402 of the illustrated embodiment will not be described in detail here.

[0118] In some optional implementations, the above step S502 of "creating corresponding virtual switches for the primary VLAN and the auxiliary VLAN, respectively, and creating paired interconnection ports with the preset service virtual switches" specifically includes steps A1 to A3.

[0119] Step A1: Create a primary virtual switch corresponding to the primary VLAN, and create a primary interconnection port for the primary virtual switch.

[0120] Step A2: Create an auxiliary virtual switch corresponding to the auxiliary VLAN, and create an auxiliary interconnection port for the auxiliary virtual switch.

[0121] Step A3: Create a first interconnection port and a second interconnection port for the preset service virtual switch; the first interconnection port corresponds to the primary interconnection port, and the second interconnection port corresponds to the auxiliary interconnection port.

[0122] Figure 6 A schematic diagram of the structure of setting interconnection ports is shown. Figure 6 As shown, a corresponding primary virtual switch is created for the primary VLAN, and a primary interconnection port, namely, a primary patch port, is set; similarly, a corresponding secondary virtual switch is created for the secondary VLAN, and a secondary interconnection port, namely, a secondary patch port, is set.

[0123] In addition, a first interconnection port corresponding to the primary interconnection port and a second interconnection port corresponding to the auxiliary interconnection port are created for the service virtual switch, that is, the primary interconnection port and the first interconnection port are a pair of interconnection ports, and the auxiliary interconnection port and the second interconnection port are another pair of interconnection ports, so as to realize traffic interconnection between virtual switches.

[0124] Optionally, as shown above, the auxiliary VLAN may include: an isolation VLAN and / or a community VLAN. Accordingly, the above step A2 of "creating an auxiliary virtual switch corresponding to the auxiliary VLAN and creating an auxiliary interconnect port for the auxiliary virtual switch" may specifically include the following steps A21 to A22.

[0125] Step A21: When the auxiliary VLAN includes an isolated VLAN, an isolated virtual switch corresponding to the isolated VLAN is created, and an isolated interconnection port is created for the isolated virtual switch.

[0126] Step A22: When the auxiliary VLAN includes a community VLAN, a community virtual switch corresponding to the community VLAN is created, and a community interconnection port is created for the community virtual switch.

[0127] In this embodiment, if the auxiliary VLANs of the PVLAN specifically include an isolated VLAN and a community VLAN, a corresponding virtual switch and interconnection port need to be created for each auxiliary VLAN.

[0128] Figure 7 Another structural diagram of setting interconnection ports is shown. Figure 7 As shown, an isolation virtual switch and a group virtual switch are created for the isolation VLAN and the group VLAN respectively, and an interconnection port is set for each virtual switch, namely, an isolation interconnection port and a group interconnection port; and multiple second interconnection ports are set for the service virtual switch, and each second interconnection port corresponds to an auxiliary virtual switch.

[0129] by Figure 7In the figure, VS represents a service virtual switch, VS_P100 represents a primary virtual switch, VS_S101 represents an isolation virtual switch, and VS_G102 represents a community virtual switch.

[0130] You can use the ovs-vsctl command of OVS to set the primary interconnection port for the created primary virtual switch VS_P100 and open the first interconnection port of the service virtual switch VS. The specific implementation method can be as follows:

[0131] ovs-vsctl add-port VS peVS_P100--set interface peVS_P100 type=patchoptions:peer=peP100_VS

[0132] ovs-vsctl add-port VS_P100 peP100_VS--set interface peP100_VS type=patch options:peer=peVS_P100

[0133] Among them, peVS_P100 represents the first interconnection port, and peP100_VS represents the main interconnection port.

[0134] Similarly, if an isolation interconnection port is set for the isolation virtual switch VS_S101 and the second interconnection port of the service virtual switch VS is opened, the specific implementation method can be as follows:

[0135] ovs-vsctl add-port VS peVS_S101--set interface peVS_S101 type=patchoptions:peer=peS101_VS

[0136] ovs-vsctl add-port VS_S101 peS101_VS--set interface peS101_VS type=patch options:peer=peVS_S101

[0137] Among them, peVS_S101 represents the second interconnection port set for the isolated virtual switch, and peS101_VS represents the isolated interconnection port.

[0138] The principles for setting up and connecting community interconnection ports for the community virtual switch VS_G102 are similar to those described above and are not described in detail here.

[0139] In addition, when creating a master virtual switch, isolated virtual switch, or community virtual switch, you can first delete the corresponding virtual switch and then recreate it to ensure that the created virtual switch is clean. For example, if you need to create a master virtual switch named VS_P100, you can first execute the command to delete the virtual switch named VS_P100, and then create a virtual switch named VS_P100. The newly created virtual switch will serve as the master virtual switch.

[0140] In this embodiment, virtual switches can be created for the primary VLAN and the auxiliary VLAN based on OVS, and interconnected with the service virtual switch using patch ports. This can be achieved based on simple OVS commands, and the configuration method is simple.

[0141] Step S503: Set each interconnected port to a multi-VLAN mode, and configure a supported VLAN ID list according to the primary VLAN ID and the auxiliary VLAN ID.

[0142] For details, please see Figure 4 Step S403 of the illustrated embodiment will not be described in detail here.

[0143] In some optional implementations, the above step S503 of "setting each interconnected port to a multi-VLAN mode and configuring a supported VLAN ID list according to the primary VLAN ID and the auxiliary VLAN ID" specifically includes steps B1 to B2.

[0144] Step B1: Set the primary interconnection port and the first interconnection port to multi-VLAN mode, and configure the primary interconnection port and the first interconnection port with a supported first VLAN identifier list; the first VLAN identifier list includes the identifier of the primary VLAN and identifiers of all auxiliary VLANs.

[0145] Step B2: Set the auxiliary interconnection port and the second interconnection port to multi-VLAN mode, and configure a second VLAN identifier list supported by the auxiliary interconnection port and the second interconnection port; the second VLAN identifier list includes the identifier of the primary VLAN and the identifier of the auxiliary VLAN corresponding to the auxiliary interconnection port and the second interconnection port.

[0146] In this embodiment, the first interconnect port of the service virtual switch is equivalent to the promiscuous port of the primary VLAN, and the second interconnect port is equivalent to the auxiliary port of the auxiliary VLAN. Specifically, the auxiliary VLAN can include an isolated VLAN or a community VLAN. Accordingly, the second interconnect port can be equivalent to the isolated port of the isolated VLAN or the community port of the community VLAN. As shown in Table 1 above, each port has certain communication permissions. Therefore, a VLAN ID list corresponding to each interconnect port can be set based on the communication permissions configured for each port in the PVLAN.

[0147] Specifically, for the primary interconnect port and the first interconnect port, the corresponding first VLAN ID list must include the IDs of all VLANs in the PVLAN, that is, the ID of the primary VLAN and the IDs of all auxiliary VLANs, to ensure that all VLANs can communicate with the primary VLAN. However, since auxiliary VLANs cannot communicate with each other, the corresponding second VLAN ID list for the auxiliary interconnect port and the second interconnect port only needs to include the ID of the primary VLAN and the IDs of the auxiliary VLANs corresponding to the auxiliary interconnect port and the second interconnect port, and cannot include the IDs of other auxiliary VLANs.

[0148] For example, for the isolated interconnected port and the second interconnected port corresponding to the isolated VLAN, the VLAN ID list only includes the ID of the primary VLAN and the ID of the isolated VLAN. Similarly, for the community interconnected port and the second interconnected port corresponding to the community VLAN, the VLAN ID list only includes the ID of the primary VLAN and the ID of the community VLAN.

[0149] In this embodiment, the mode of the interconnected port and the VLAN ID list can also be set based on the ovs-vsctl command of OVS. Figure 7 As shown, 100 represents the identifier of the primary VLAN (primary VLAN ID), 101 represents the identifier of the isolated VLAN (isolated VLAN ID), and 102 represents the identifier of the community VLAN (community VLAN ID).

[0150] For example, for the primary interconnection port and the first interconnection port, the specific implementation method of configuring the VLAN ID can be as follows:

[0151] ovs-vsctl set port peVS_P100 vlan_mode=trunk trunks=100,101,102

[0152] ovs-vsctl set port peP100_VS vlan_mode=trunk trunks=100,101,102

[0153] peVS_P100 represents the first interconnect port, and peP100_VS represents the primary interconnect port. After the above configuration, the first VLAN ID list of the primary interconnect port and the first interconnect port is configured to include 100, 101, and 102 (i.e., trunks = 100, 101, 102), so that the two can communicate with each other.

[0154] Similarly, for the isolated interconnection port and the second interconnection port, the specific implementation method of configuring the VLAN ID can be as follows:

[0155] ovs-vsctl set port peVS_S101 vlan_mode=trunk trunks=100,101

[0156] ovs-vsctl set port peS101_VS vlan_mode=trunk trunks=100,101

[0157] peVS_S101 represents the second interconnect port set up for the isolated virtual switch, and peS101_VS represents the isolated interconnect port. After the above configuration, the VLAN ID list of the isolated interconnect port and the second interconnect port is configured to include 100 and 101 (i.e., trunks = 100, 101), so that the two can transmit packets with VLAN IDs 100 and 101, but cannot transmit packets with VLAN ID 102, that is, packets of the community VLAN.

[0158] For the community interconnection port and the second interconnection port, the specific implementation method of configuring the VLAN ID can be as follows:

[0159] ovs-vsctl set port peVS_G102 vlan_mode=trunk trunks=100,102

[0160] ovs-vsctl set port peG102_VS vlan_mode=trunk trunks=100,102

[0161] peVS_G102 represents the second interconnect port set for the community virtual switch, and peG102_VS represents the community interconnect port. After the above configuration, the VLAN ID list of the community interconnect port and the second interconnect port is configured to include 100 and 102 (i.e., trunks = 100, 102), so that the two can transmit packets with VLAN IDs 100 and 102, but cannot transmit packets with VLAN ID 101, that is, packets from the isolated VLAN.

[0162] In this embodiment, based on the commands provided by OVS, the interconnected ports can be set to Trunk mode supporting multiple VLAN identifiers, and the VLAN identifier list can be adaptively set. The setting method is simple and can meet the requirements of PVLAN.

[0163] Step S504: Bind the virtual machine to the corresponding matching configuration file and associate it with the corresponding matching VLAN and matching virtual switch.

[0164] If the virtual machine belongs to the primary VLAN, the matching profile is the primary profile, the matching VLAN is the primary VLAN, and the matching virtual switch is the primary virtual switch created for the primary VLAN. If the virtual machine belongs to a secondary VLAN, the matching profile is the secondary profile, the matching VLAN is the secondary VLAN, and the matching virtual switch is the secondary virtual switch created for the secondary VLAN.

[0165] In traditional architectures, each virtual machine communicates through a service virtual switch. However, in this embodiment, by setting up each VLAN, each virtual machine can be bound to a corresponding VLAN as needed, so that each virtual machine can communicate according to the requirements of the PVLAN.

[0166] Each virtual machine will be bound to a configuration file corresponding to the PVLAN, ie, a matching configuration file. It can be understood that the matching configuration file can be a primary configuration file or an auxiliary configuration file (specifically, it can be divided into an isolation configuration file and a community configuration file).

[0167] As shown above, if the PVLAN profile is a network profile (netprofile), you can add the network profile to the corresponding port profile (portprofile), that is, use the portprofile to bind the PVLAN profile, and then bind the port profile to the corresponding virtual machine to achieve the binding between the virtual machine and the matching profile.

[0168] For example, taking the above isolation profile VS_P100_S101 as an example, binding it to the port profile can be implemented as follows:

[0169] <portprofile name="AAAAA_1"type="compose">

[0170] <netprofile name="VS_P100_S101"type="pvlan" / >

[0171]

[0172] Then, the port configuration file AAAAA_1 is bound to a file of the virtual machine (generally in XML format), which can be implemented as follows:

[0173] <virtualport type='openvswitch'>

[0174] <parameters profileid='6cecd756-a719-4ed6-9679-a19c38461d43_1' / >

[0175]

[0176] Through the above configuration, the virtual machine can be bound to the isolation profile VS_P100_S101, that is, the virtual machine is a virtual machine in the isolated VLAN.

[0177] In addition, after the virtual machine is bound to the PVLAN configuration file, you can use the OVS ovs-vsctl command to configure the following information on the virtual interface vnet of the virtual machine to associate the virtual machine with the corresponding matching VLAN.

[0178] For VMs in the primary VLAN:

[0179] ovs-vsctl set interface vnet0 other_config:primary_vlan=100

[0180] For VMs in isolated VLANs:

[0181] ovs-vsctl set interface vnet0 other_config:primary_vlan=100other_config:isolated_vlan=101

[0182] For VMs in a community VLAN:

[0183] ovs-vsctl set interface vnet0 other_config:primary_vlan=100other_config:group_vlan=102

[0184] Among them, such as Figure 7 As shown, 100 represents the identifier of the primary VLAN, 101 represents the identifier of the isolated VLAN, and 102 represents the identifier of the community VLAN.

[0185] In addition, after binding the PVLAN configuration file, you can also use the OVS ovs-vsctl command to delete the virtual machine's vnet from the business virtual switch and add it to the virtual switch of the corresponding VLAN. This is not described in detail here.

[0186] Step S505 : Sending a corresponding flow table to each virtual switch; the flow table is used to modify the VLAN identifier in the message from the corresponding interconnected port to the identifier of the VLAN to which the virtual switch belongs.

[0187] For details, please see Figure 4 Step S404 of the illustrated embodiment will not be described in detail here.

[0188] In some optional implementations, the auxiliary VLAN includes: an isolation VLAN and / or a community VLAN; the above step S505 of "issuing a corresponding flow table to each virtual switch" may specifically include steps C1 to C3.

[0189] Step C1, sending a first flow table to the primary virtual switch created for the primary VLAN; the first flow table is used to modify the isolation VLAN identifier or the community VLAN identifier in the first message to the primary VLAN identifier, and the first message is a message from the primary interconnection port created for the primary virtual switch.

[0190] Step C2: If the auxiliary VLAN includes the isolated VLAN, a second flow table is issued to the isolated virtual switch created for the isolated VLAN; the second flow table is used to modify the primary VLAN identifier in the second message to the isolated VLAN identifier, and discard messages with VLAN identifiers other than the primary VLAN identifier, where the second message is from the isolated interconnect port created for the isolated virtual switch;

[0191] In step C3, when the auxiliary VLAN includes the group VLAN, a third flow table is sent to the group virtual switch created for the group VLAN; the third flow table is used to modify the primary VLAN identifier in the third message to the group VLAN identifier, and the third message is a message from the group interconnection port created for the group virtual switch.

[0192] In this embodiment, for the primary virtual switch, Figure 8 As described above, it can send messages with VLAN ID 100 to the service virtual switch, but it can receive messages with VLAN IDs 100, 101, and 102. To ensure that messages with VLAN IDs 101 and 102 can be properly forwarded in the primary VLAN (which has ID 100), the VLAN IDs in the messages need to be uniformly modified to the primary VLAN ID, i.e., 100. In this embodiment, this is achieved by issuing a corresponding first flow table to the primary virtual switch. When the primary virtual switch receives a first message from the primary interconnect port, it can modify the original isolation VLAN ID or community VLAN ID in the message to the primary VLAN ID based on the first flow table.

[0193] The flow table configuration can be implemented based on the ovs-ofctl command of OVS. Specifically, the first flow table can be sent to the primary virtual switch in the following ways:

[0194] ovs-ofctl add-flow VS_P100"cookie=0x80 priority=1001table=100in_port=peP100_VS dl_vlan=101actions=mod_vlan_vid:100,resubmit(,120)"

[0195] ovs-ofctl add-flow VS_P100"cookie=0x80 priority=1001table=100in_port=peP100_VS dl_vlan=102actions=mod_vlan_vid:100,resubmit(,120)"

[0196] Among them, VS_P100 represents the primary virtual switch, peP100_VS represents the primary interconnection port; if the VLAN ID in the message is 101 (isolation VLAN ID) or 102 (group VLAN ID), it will be modified to the primary VLAN ID, that is, actions = mod_vlan_vid:100.

[0197] Since multiple virtual machines connected to the same virtual switch can communicate with each other, Figure 8As shown in the example, virtual machines VM1 and VM2 are both connected to the primary virtual switch. Under normal circumstances, they are interconnected and no additional configuration is required. Similarly, virtual machines VM5 and VM6 are both connected to the group virtual switch. They are also interconnected. Therefore, for the group virtual switch, after receiving the third message from the group interconnection port, if the VLAN ID in the third message is the primary VLAN ID (for example, 100), that is, the third message is a virtual machine of the primary VLAN (for example, Figure 8 Therefore, the VLAN ID is modified to the group VLAN ID (for example, 102), and no other additional configuration is required; therefore, the above requirements can be achieved by issuing a suitable third flow table to the group virtual switch, which can also be implemented based on the ovs-ofctl command of OVS, which will not be described here.

[0198] Since the community interconnect port is in multi-VLAN mode (Trunk mode), the VLAN ID list it supports, in addition to the primary VLAN ID, only includes the ID of the community VLAN corresponding to the community interconnect port. Even if it contains multiple community VLANs, the community interconnect port in Trunk mode will block messages from other community VLANs (and also blocks messages from isolated VLANs), so that the VLAN ID in the third message can only be the primary VLAN ID or the ID of its own community VLAN. After the above configuration, the community interconnect port can communicate with the primary VLAN and its own community VLAN, but cannot communicate with other community VLANs or isolated VLANs, meeting the PVLAN requirements for community ports.

[0199] However, for isolated virtual switches, the virtual switches inside them cannot communicate with each other. Figure 8 For example, virtual machines VM3 and VM4 cannot communicate with each other. Therefore, for the second message from the isolated interconnect port, if the VLAN ID in the second message is the ID of the primary VLAN (e.g., 100), similar to the third flow table described above, the VLAN ID is modified to the ID of the isolated VLAN (e.g., 101). Furthermore, if the VLAN ID in the second message is a VLAN ID other than the ID of the primary VLAN, generally the ID of the isolated VLAN (e.g., 101), the message is discarded, thereby preventing communication between different virtual machines in the isolated virtual switch and achieving virtual machine isolation.

[0200] In addition, similar to the group interconnect port, the isolated interconnect port also operates in multi-VLAN mode (Trunk mode). Its supported VLAN ID list includes only the ID of the isolated VLAN corresponding to the isolated interconnect port, in addition to the ID of the primary VLAN. The isolated interconnect port in Trunk mode blocks messages from any other group VLAN, so that the VLAN ID in the second message can only be the ID of the primary VLAN or the ID of its own isolated VLAN. Furthermore, second messages from the same isolated VLAN are also discarded, so that the isolated interconnect port can only communicate with the primary VLAN. Even virtual machines within the same isolated VLAN cannot communicate, which meets the PVLAN requirements for isolated ports.

[0201] In this embodiment, the flow table configuration can ensure that the primary virtual switch and each auxiliary virtual switch communicate according to the requirements of the PVLAN, and can achieve communication between different virtual machines in the isolated virtual switch, and the implementation method is simple.

[0202] Step S506 , obtaining a target message according to a target virtual switch in the private virtual LAN; the target virtual switch is a virtual switch created for a target VLAN of the private virtual LAN, and the target VLAN is a primary VLAN or a secondary VLAN of the private virtual LAN.

[0203] For details, please see Figure 2 Step S201 of the illustrated embodiment will not be described in detail here.

[0204] Step S507: forward the target message.

[0205] For details, please see Figure 2 Step S202 and step S203 of the illustrated embodiment will not be described in detail here.

[0206] In some optional embodiments, the method further includes steps D1 and D2.

[0207] Step D1, when a target message is received through a source port, the source MAC address, source port and first VLAN identifier in the target message are determined, and a first MAC forwarding table entry is generated; the first MAC forwarding table entry is used to indicate the correspondence between the source MAC address, the first VLAN identifier and the source port.

[0208] Step D2: Determine a second VLAN identifier corresponding to the first VLAN identifier, and additionally generate a second MAC forwarding table entry; the second MAC forwarding table entry is used to indicate a correspondence between the source MAC address, the second VLAN identifier, and the source port.

[0209] In this embodiment, if a virtual switch such as a service virtual switch receives a message through a certain port (i.e., a source port), it can perform self-learning based on the source information therein, thereby dynamically generating a MAC (Media Access Control) forwarding table entry. For ease of description, the message is referred to as the target message, and the generated MAC forwarding table entry is the first MAC forwarding table entry.

[0210] The target message includes a source MAC address and a corresponding VLAN identifier, i.e., a first VLAN identifier, based on which a first MAC forwarding table entry indicating the correspondence between the source MAC address, the first VLAN identifier, and the source port can be established. If another first message is received later, and the VLAN identifier in the first message is the first VLAN identifier and its destination MAC address is the source MAC address, then the first message hits the first MAC forwarding table entry, and based on the first MAC forwarding table entry, the destination port of the first message can be determined to be the source port, and the first message can be forwarded through the source port.

[0211] Furthermore, in a PVLAN, each VLAN has a communication relationship with the other. Based on this, it can be determined that the second VLAN ID corresponding to the first VLAN ID has a communication relationship with the VLAN corresponding to the second VLAN ID, that is, the two can communicate. Therefore, a second MAC forwarding table entry can be additionally learned, indicating the correspondence between the source MAC address, the second VLAN ID, and the source port.

[0212] If another second message is received later, and the VLAN identifier in the second message is the second VLAN identifier, and its destination MAC address is the source MAC address, then the second message hits the second MAC forwarding table entry. Based on the second MAC forwarding table entry, it can be determined that the destination port of the second message is also the source port, and then the second message can be forwarded through the source port.

[0213] Optionally, the method further includes: sending configuration information of corresponding MAC forwarding entries to the physical network card and each interconnected port of the service virtual switch respectively.

[0214] The configuration information for the physical network card includes the VLAN information for all private virtual local area networks (VLANs) under the service virtual switch. The configuration information for the interconnected ports of the service virtual switch includes the primary VLAN information and related secondary VLAN information. Based on this configuration information, the relationship between the various VLANs can be determined, thereby determining which VLAN IDs correspond to the first VLAN ID and, therefore, the second VLAN ID.

[0215] As shown above, the first interconnect port of the service virtual switch is equivalent to the promiscuous port of the primary VLAN, and the second interconnect port is equivalent to the auxiliary port of the auxiliary VLAN. Specifically, the second interconnect port can be equivalent to the isolated port of the isolated VLAN or the community port of the community VLAN. You can use the ovs-vsctl command of OVS to configure each interconnect port of the service virtual switch.

[0216] Specifically, for the promiscuous port of the primary VLAN (i.e., the first interconnected port), it is necessary to configure the information of the primary VLAN and all corresponding auxiliary VLANs under the service virtual switch, which is specifically implemented as follows:

[0217] ovs-vsctl set port peVS_P100 other_config:private_vlan="(100:101:102)"

[0218] For isolated ports in an isolated VLAN, you only need to configure the isolated VLAN information and the corresponding primary VLAN information. The specific implementation is as follows:

[0219] ovs-vsctl set port peVS_S101 other_config:private_vlan="(100:101:0)"

[0220] For a community port in a community VLAN, you only need to configure its own community VLAN information and the corresponding primary VLAN information. The specific implementation is as follows:

[0221] ovs-vsctl set port peVS_G102 other_config:private_vlan="(100:0:102)"

[0222] For the physical network card, you need to configure the VLAN information of all private virtual LANs under the service virtual switch. For example, if the host corresponding to the service virtual switch has a physical network card eth3, the service virtual switch has Figure 8 In addition to the PVLAN shown, another PVLAN is configured based on the method provided in this embodiment, and the identifiers of the primary VLAN, isolated VLAN, and group VLAN are 200, 201, and 202, respectively, and another group VLAN 204 is provided, that is, there are two group VLANs. The physical network card can be configured by the ovs-vsctl command of OVS as follows:

[0223] ovs-vsctl set port eth3 other_config:private_vlan="(100:101:102,103),(200:201:202,204)"

[0224] Among them, for the aggregation scenario, that is, when multiple physical network cards are bound to the same PVLAN, if the active-standby aggregation method is adopted, only the MAC corresponding to the active physical network card can be learned. For other aggregation methods, the MACs of all physical network cards are learned, and the port number uses the port number of the aggregated port.

[0225] Optionally, in a case where the first VLAN identifier is an identifier of a primary VLAN, identifiers of all auxiliary VLANs belonging to the same private virtual local area network as the first VLAN identifier are used as second VLAN identifiers.

[0226] When the first VLAN identifier is an auxiliary VLAN identifier, the identifiers of the primary VLANs belonging to the same private virtual local area network as the first VLAN identifier are used as the second VLAN identifier. For example, when the first VLAN identifier is an isolated VLAN or a community VLAN identifier, the identifiers of the primary VLANs belonging to the same private virtual local area network as the first VLAN identifier are used as the second VLAN identifier.

[0227] In this embodiment, for the target message of the primary VLAN, additional MAC forwarding table entries are learned for the isolated VLAN and the group VLAN, that is, the second MAC forwarding table entries; for the target message of the isolated VLAN, only the second MAC forwarding table entry of the primary VLAN is additionally learned; for the target message of the group VLAN, only the second MAC forwarding table entry of the primary VLAN is additionally learned.

[0228] For example, taking the service virtual switch VS as an example, it mainly includes the following six situations of learning MAC forwarding entries.

[0229] Case 1: The target packet enters the service virtual switch VS from the physical network card eth (bond), the VLAN ID is 100, and the packet comes from the primary VLAN port across hosts.

[0230] The first MAC forwarding table entry A 100 is learned normally.

[0231] The second MAC forwarding table entry is additionally learned: for the isolated VLAN: A 101; for the community VLAN: A 102.

[0232] Case 2: The target packet enters the service virtual switch VS from the physical network card eth (bond). The VLAN ID is 101. The packet comes from the cross-host isolated VLAN port.

[0233] The first MAC forwarding table entry A 101 is learned normally.

[0234] Additionally learn the second MAC forwarding table entry: for the primary VLAN: A 100, not for the community VLAN.

[0235] Case 3: The target packet enters the service virtual switch VS from the physical network card eth (bond), the VLAN ID is 102, and the packet comes from the group VLAN port across hosts.

[0236] The first MAC forwarding table entry A 102 is learned normally.

[0237] An additional second MAC forwarding entry is learned: for primary VLAN: A 100.

[0238] Case 4: The target packet enters the service virtual switch VS from the primary virtual switch peVS_P100, and the VLAN ID is 100 (the packet sent by the primary VLAN).

[0239] The first MAC forwarding table entry A 100 is learned normally.

[0240] Additionally, a second MAC forwarding table entry is learned: for the isolated VLAN: A101; for the community VLAN: A102.

[0241] Case 5: The target packet enters the service virtual switch VS from the isolation virtual switch peVS_S101, and the VLAN ID is 101 (the packet is sent from the isolation VLAN).

[0242] The first MAC forwarding table entry A 101 is learned normally.

[0243] An additional second MAC forwarding entry is learned: for primary VLAN: A 100.

[0244] Case 6: The target packet enters the service virtual switch VS from the community virtual switch peVS_G102, and the VLAN ID is 102 (the packet sent by the community VLAN).

[0245] The first MAC forwarding table entry A 102 is learned normally.

[0246] An additional second MAC forwarding entry is learned: for primary VLAN: A 100.

[0247] In this embodiment, the target message is used to self-learn the MAC forwarding table entries, and more MAC forwarding table entries are additionally learned based on the characteristics of the PVLAN. Multiple MAC forwarding table entries can be learned at one time, which can enrich the MAC forwarding table as much as possible, facilitating the rapid forwarding of subsequent other messages.

[0248] In this embodiment, a message forwarding device for a private virtual local area network is also provided. The device is used to implement the above-mentioned embodiments and preferred embodiments. The details already described will not be repeated here. As used below, the term "module" can refer to a combination of software and / or hardware that implements a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, implementation using hardware, or a combination of software and hardware, is also possible and contemplated.

[0249] This embodiment provides a private virtual local area network message forwarding device, such as Figure 9 Shown, including:

[0250] An acquisition module 901 is configured to acquire a target message according to a target virtual switch in the private virtual local area network; the target virtual switch is a virtual switch created for a target VLAN of the private virtual local area network, and the target VLAN is a primary VLAN or a secondary VLAN of the private virtual local area network;

[0251] A first processing module 902 is configured to forward the target message according to the destination address of the target message when the target message comes from the virtual machine of the target VLAN;

[0252] The second processing module 903 is used to modify the VLAN identifier of the target message to the identifier of the target VLAN when the target message comes from the service virtual switch of the private virtual local area network, and forward it according to the destination address of the target message; the service virtual switch and the target virtual switch communicate based on paired interconnected ports.

[0253] In some optional implementations, the process of configuring the private virtual local area network includes:

[0254] Configuring corresponding identifiers for the primary VLAN and each auxiliary VLAN of the private virtual local area network;

[0255] Creating corresponding virtual switches for the primary VLAN and the auxiliary VLAN respectively, and creating paired interconnection ports between the virtual switches and the preset service virtual switches;

[0256] Setting each of the interconnected ports to a multi-VLAN mode, and configuring a supported VLAN identifier list according to the identifier of the primary VLAN and the identifier of the auxiliary VLAN;

[0257] A corresponding flow table is issued to each of the virtual switches; the flow table is used to modify the VLAN identifier in the message from the corresponding interconnected port to the identifier of the VLAN to which the virtual switch belongs.

[0258] In some optional implementations, creating corresponding virtual switches for the primary VLAN and the auxiliary VLAN, respectively, and creating paired interconnection ports with a preset service virtual switch, includes:

[0259] Create a primary virtual switch corresponding to the primary VLAN, and create a primary interconnection port for the primary virtual switch;

[0260] Creating an auxiliary virtual switch corresponding to the auxiliary VLAN, and creating an auxiliary interconnection port for the auxiliary virtual switch;

[0261] A first interconnection port and a second interconnection port are created for a preset service virtual switch; the first interconnection port corresponds to the primary interconnection port, and the second interconnection port corresponds to the auxiliary interconnection port.

[0262] In some optional implementations, setting each of the interconnected ports to a multi-VLAN mode and configuring a supported VLAN ID list according to the ID of the primary VLAN and the ID of the auxiliary VLAN includes:

[0263] Setting the primary interconnection port and the first interconnection port to a multi-VLAN mode, and configuring a first VLAN identifier list supported by the primary interconnection port and the first interconnection port; the first VLAN identifier list includes an identifier of the primary VLAN and identifiers of all the auxiliary VLANs;

[0264] The auxiliary interconnect port and the second interconnect port are set to a multi-VLAN mode, and a second VLAN identifier list supported by the auxiliary interconnect port and the second interconnect port is configured; the second VLAN identifier list includes the identifier of the primary VLAN and the identifiers of the auxiliary VLANs corresponding to the auxiliary interconnect port and the second interconnect port.

[0265] In some optional implementations, the auxiliary VLAN includes: an isolation VLAN and / or a community VLAN;

[0266] The step of creating an auxiliary virtual switch corresponding to the auxiliary VLAN and creating an auxiliary interconnection port for the auxiliary virtual switch includes:

[0267] In the case where the auxiliary VLAN includes the isolated VLAN, creating an isolated virtual switch corresponding to the isolated VLAN, and creating an isolated interconnect port for the isolated virtual switch;

[0268] In a case where the auxiliary VLAN includes the community VLAN, a community virtual switch corresponding to the community VLAN is created, and a community interconnection port is created for the community virtual switch.

[0269] In some optional implementations, configuring corresponding identifiers for the primary VLAN and each auxiliary VLAN of the private virtual local area network includes:

[0270] Setting a main configuration file corresponding to the primary VLAN of the private virtual local area network and auxiliary configuration files corresponding to each auxiliary VLAN belonging to the main VLAN; the main configuration file includes an identifier of the primary VLAN, and the auxiliary configuration file includes an identifier of the auxiliary VLAN;

[0271] The process of configuring the private virtual local area network further includes:

[0272] Bind the virtual machine to the corresponding matching profile and associate it with the corresponding matching VLAN and matching virtual switch;

[0273] Wherein, in the case where the virtual machine belongs to a primary VLAN, the matching configuration file is the primary configuration file, the matching VLAN is the primary VLAN, and the matching virtual switch is the primary virtual switch created for the primary VLAN;

[0274] In a case where the virtual machine belongs to a secondary VLAN, the matching profile is the secondary profile, the matching VLAN is the secondary VLAN, and the matching virtual switch is the secondary virtual switch created for the secondary VLAN.

[0275] In some optional implementations, the auxiliary VLAN includes: an isolation VLAN and / or a community VLAN;

[0276] The sending of the corresponding flow table to each of the virtual switches includes:

[0277] Sending a first flow table to the primary virtual switch created for the primary VLAN; the first flow table is used to modify the identifier of the isolated VLAN or the identifier of the community VLAN in the first message to the identifier of the primary VLAN, wherein the first message is a message from the primary interconnection port created for the primary virtual switch;

[0278] In a case where the auxiliary VLAN includes the isolated VLAN, a second flow table is issued to the isolated virtual switch created for the isolated VLAN; the second flow table is used to modify the identifier of the primary VLAN in the second message to the identifier of the isolated VLAN, and discard messages with VLAN identifiers other than the identifier of the primary VLAN, wherein the second message is a message from the isolated interconnect port created for the isolated virtual switch;

[0279] When the auxiliary VLAN includes the group VLAN, a third flow table is sent to the group virtual switch created for the group VLAN; the third flow table is used to modify the identifier of the primary VLAN in the third message to the identifier of the group VLAN, and the third message is a message from the group interconnection port created for the group virtual switch.

[0280] In some optional embodiments, a learning module is further included for:

[0281] When the target message is received through the source port, determine the source MAC address and the first VLAN identifier in the target message, and generate a first MAC forwarding table entry; the first MAC forwarding table entry is used to indicate the correspondence between the source MAC address, the first VLAN identifier and the source port;

[0282] A second VLAN identifier corresponding to the first VLAN identifier is determined, and a second MAC forwarding table entry is additionally generated; the second MAC forwarding table entry is used to indicate a correspondence between the source MAC address, the second VLAN identifier, and the source port.

[0283] In some optional implementations, when the first VLAN identifier is an identifier of a primary VLAN, identifiers of all auxiliary VLANs belonging to the same private virtual local area network as the first VLAN identifier are used as the second VLAN identifier;

[0284] In a case where the first VLAN identifier is an identifier of an auxiliary VLAN, an identifier of a primary VLAN belonging to the same private virtual local area network as the first VLAN identifier is used as the second VLAN identifier.

[0285] The further functional description of each of the above modules and units is the same as that of the above corresponding embodiments and will not be repeated here.

[0286] The message forwarding device of the private virtual local area network in this embodiment is presented in the form of a functional unit, where the unit refers to an ASIC (Application Specific Integrated Circuit) circuit, including a processor and memory that executes one or more software or fixed programs, and / or other devices that can provide the above functions.

[0287] The embodiment of the present invention also provides a computer device having the above Figure 9 The message forwarding device of the private virtual local area network shown.

[0288] See also Figure 10 , Figure 10is a structural diagram of a computer device provided by an optional embodiment of the present invention, such as Figure 10 As shown, the computer device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components utilize different buses to communicate with each other and can be installed on a common mainboard or installed in other ways as needed. The processor can process the instructions executed in the computer device, including instructions stored in or on the memory to display the graphical information of a GUI on an external input / output device (such as, a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories. Equally, multiple computer devices can be connected, and each device provides part of the necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 10 A processor 10 is taken as an example.

[0289] The processor 10 may be a central processing unit, a network processor, or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be an application-specific integrated circuit, a programmable logic device, or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic, or any combination thereof.

[0290] The memory 20 stores instructions that can be executed by at least one processor 10, so that the at least one processor 10 executes the method shown in the above embodiment.

[0291] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and application programs required for at least one function; the data storage area may store data created based on the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely located relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0292] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid-state drive; the memory 20 may also include a combination of the above types of memory.

[0293] The computer device further includes a communication interface 30 for the computer device to communicate with other devices or a communication network.

[0294] The embodiment of the present invention also provides a computer-readable storage medium. The above-mentioned method according to the embodiment of the present invention can be implemented in hardware, firmware, or implemented as a computer code that can be recorded in a storage medium, or implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and downloaded through a network and will be stored in a local storage medium, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state drive, etc.; further, the storage medium can also include a combination of the above-mentioned types of memory. It can be understood that a computer, a processor, a microprocessor controller or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor or hardware, the method shown in the above embodiment is implemented.

[0295] A portion of the present invention may be applied as a computer program product, such as a computer program instruction, which, when executed by a computer, can call or provide the method and / or technical solution according to the present invention through the operation of the computer. Those skilled in the art should understand that the form in which the computer program instruction exists in a computer-readable medium includes, but is not limited to, a source file, an executable file, an installation package file, etc. Accordingly, the way in which the computer program instruction is executed by the computer includes, but is not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Here, the computer-readable medium may be any available computer-readable storage medium or communication medium that can be accessed by the computer.

[0296] Although the embodiments of the present invention have been described with reference to the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations should all be included in the scope of protection of the present invention.

Claims

1. A method for forwarding messages in a private virtual local area network, characterized in that: The method comprises: Obtaining a target message according to a target virtual switch in the private virtual local area network; the target virtual switch is a virtual switch created for a target VLAN of the private virtual local area network, and the target VLAN is a primary VLAN or a secondary VLAN of the private virtual local area network; When the target message comes from a virtual machine of the target VLAN, forwarding the target message according to the destination address of the target message; In the case where the target message comes from the service virtual switch of the private virtual LAN, the VLAN identifier of the target message is modified to the identifier of the target VLAN, and forwarded according to the destination address of the target message; the service virtual switch and the target virtual switch communicate based on paired interconnected ports.

2. The method according to claim 1, characterized in that The process of configuring the private virtual local area network includes: Configuring corresponding identifiers for the primary VLAN and each auxiliary VLAN of the private virtual local area network; Creating corresponding virtual switches for the primary VLAN and the auxiliary VLAN respectively, and creating paired interconnection ports between the virtual switches and the preset service virtual switches; Setting each of the interconnected ports to a multi-VLAN mode, and configuring a supported VLAN identifier list according to the identifier of the primary VLAN and the identifier of the auxiliary VLAN; A corresponding flow table is issued to each of the virtual switches; the flow table is used to modify the VLAN identifier in the message from the corresponding interconnected port to the identifier of the VLAN to which the virtual switch belongs.

3. The method according to claim 2, characterized in that The step of creating corresponding virtual switches for the primary VLAN and the auxiliary VLAN, and creating paired interconnection ports with the preset service virtual switches, includes: Create a primary virtual switch corresponding to the primary VLAN, and create a primary interconnection port for the primary virtual switch; Creating an auxiliary virtual switch corresponding to the auxiliary VLAN, and creating an auxiliary interconnection port for the auxiliary virtual switch; A first interconnection port and a second interconnection port are created for a preset service virtual switch; the first interconnection port corresponds to the primary interconnection port, and the second interconnection port corresponds to the auxiliary interconnection port.

4. The method according to claim 3, characterized in that The step of setting each interconnected port to a multi-VLAN mode and configuring a supported VLAN identifier list according to the identifier of the primary VLAN and the identifier of the auxiliary VLAN includes: Setting the primary interconnection port and the first interconnection port to a multi-VLAN mode, and configuring a first VLAN identifier list supported by the primary interconnection port and the first interconnection port; the first VLAN identifier list includes an identifier of the primary VLAN and identifiers of all the auxiliary VLANs; The auxiliary interconnect port and the second interconnect port are set to a multi-VLAN mode, and a second VLAN identifier list supported by the auxiliary interconnect port and the second interconnect port is configured; the second VLAN identifier list includes the identifier of the primary VLAN and the identifiers of the auxiliary VLANs corresponding to the auxiliary interconnect port and the second interconnect port.

5. The method according to claim 3, characterized in that The auxiliary VLAN includes: an isolation VLAN and / or a group VLAN; The step of creating an auxiliary virtual switch corresponding to the auxiliary VLAN and creating an auxiliary interconnection port for the auxiliary virtual switch includes: In the case where the auxiliary VLAN includes the isolated VLAN, creating an isolated virtual switch corresponding to the isolated VLAN, and creating an isolated interconnect port for the isolated virtual switch; In a case where the auxiliary VLAN includes the community VLAN, a community virtual switch corresponding to the community VLAN is created, and a community interconnection port is created for the community virtual switch.

6. The method according to claim 2, characterized in that The configuring corresponding identifiers for the primary VLAN and each auxiliary VLAN of the private virtual local area network respectively includes: Setting a main configuration file corresponding to the primary VLAN of the private virtual local area network and auxiliary configuration files corresponding to each auxiliary VLAN belonging to the main VLAN; the main configuration file includes an identifier of the primary VLAN, and the auxiliary configuration file includes an identifier of the auxiliary VLAN; The process of configuring the private virtual local area network further includes: Bind the virtual machine to the corresponding matching profile and associate it with the corresponding matching VLAN and matching virtual switch; Wherein, in the case where the virtual machine belongs to a primary VLAN, the matching configuration file is the primary configuration file, the matching VLAN is the primary VLAN, and the matching virtual switch is the primary virtual switch created for the primary VLAN; In a case where the virtual machine belongs to a secondary VLAN, the matching profile is the secondary profile, the matching VLAN is the secondary VLAN, and the matching virtual switch is the secondary virtual switch created for the secondary VLAN.

7. The method according to claim 2, characterized in that The auxiliary VLAN includes: an isolation VLAN and / or a group VLAN; The sending of the corresponding flow table to each of the virtual switches includes: Sending a first flow table to the primary virtual switch created for the primary VLAN; the first flow table is used to modify the identifier of the isolated VLAN or the identifier of the community VLAN in the first message to the identifier of the primary VLAN, wherein the first message is a message from the primary interconnection port created for the primary virtual switch; In a case where the auxiliary VLAN includes the isolated VLAN, a second flow table is issued to the isolated virtual switch created for the isolated VLAN; the second flow table is used to modify the identifier of the primary VLAN in the second message to the identifier of the isolated VLAN, and discard messages with VLAN identifiers other than the identifier of the primary VLAN, wherein the second message is a message from the isolated interconnect port created for the isolated virtual switch; When the auxiliary VLAN includes the group VLAN, a third flow table is sent to the group virtual switch created for the group VLAN; the third flow table is used to modify the identifier of the primary VLAN in the third message to the identifier of the group VLAN, and the third message is a message from the group interconnection port created for the group virtual switch.

8. The method according to claim 1, characterized in that The method further comprises: When the target message is received through the source port, determine the source MAC address and the first VLAN identifier in the target message, and generate a first MAC forwarding table entry; the first MAC forwarding table entry is used to indicate the correspondence between the source MAC address, the first VLAN identifier and the source port; A second VLAN identifier corresponding to the first VLAN identifier is determined, and a second MAC forwarding table entry is additionally generated; the second MAC forwarding table entry is used to indicate a correspondence between the source MAC address, the second VLAN identifier, and the source port.

9. The method according to claim 8, characterized in that In a case where the first VLAN identifier is an identifier of a primary VLAN, identifiers of all auxiliary VLANs belonging to the same private virtual local area network as the first VLAN identifier are used as the second VLAN identifier; In a case where the first VLAN identifier is an identifier of an auxiliary VLAN, an identifier of a primary VLAN belonging to the same private virtual local area network as the first VLAN identifier is used as the second VLAN identifier.

10. A message forwarding device for a private virtual local area network, characterized in that: The device comprises: an acquisition module, configured to acquire a target message according to a target virtual switch in the private virtual local area network; the target virtual switch is a virtual switch created for a target VLAN of the private virtual local area network, and the target VLAN is a primary VLAN or a secondary VLAN of the private virtual local area network; A first processing module, configured to forward the target message according to the destination address of the target message when the target message comes from the virtual machine of the target VLAN; The second processing module is used to modify the VLAN identifier of the target message to the identifier of the target VLAN when the target message comes from the service virtual switch of the private virtual local area network, and forward it according to the destination address of the target message; the service virtual switch and the target virtual switch communicate based on paired interconnected ports.

11. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the message forwarding method for a private virtual local area network according to any one of claims 1 to 9 by executing the computer instructions.

12. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the message forwarding method for a private virtual local area network according to any one of claims 1 to 9.

Images