Data center traffic forwarding method, program product, electronic device and storage medium

Abstract

The invention provides a data center traffic forwarding method, a program product, electronic equipment and a storage medium, and the method comprises the steps: receiving traffic data through a core switch, distributing the traffic data to at least one safety cluster switch, carrying out the safety monitoring of the traffic data through safety equipment corresponding to the safety cluster switch, and transmitting the traffic data to a server; the flow data after safety monitoring is returned to the core switch; the core switch forwards the flow data after safety monitoring to a plurality of first load balancing devices; the first load balancing equipment is used for carrying out flow distribution; the first load balancing device forwards the flow data to an intranet core switch through a dynamic or static route; and the intranet core switch forwards the flow data to the second load balancing device, and responds to the flow data by using the second load balancing device. Through step-by-step flow distribution, the flow scale which can be processed by the whole network architecture is improved, and massive service requests are dealt with. All the devices operate independently, and the overall stability of the network is guaranteed.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a data center traffic forwarding method, program product, electronic device, and storage medium. Background Art

[0002] Data centers often need to process massive amounts of service requests, including traffic from e-commerce transactions, video streaming, cloud computing services, and other scenarios. This traffic is characterized by high burstiness, and existing traffic forwarding methods are unable to cope with this traffic growth, which can lead to the risk of network architecture collapse and affect overall network stability. Summary of the Invention

[0003] The purpose of the embodiments of the present application is to provide a data center traffic forwarding method, program product, electronic device and storage medium to improve the above-mentioned problems.

[0004] In the first aspect, an embodiment of the present application provides a data center traffic forwarding method, including: receiving traffic data through a core switch, distributing the traffic data to at least one security cluster switch, using the security device corresponding to the security cluster switch to perform security monitoring on the traffic data, and returning the traffic data after security monitoring to the core switch; the core switch forwards the traffic data after security monitoring to multiple first load balancing devices; the first load balancing device is used to distribute traffic; the first load balancing device forwards the traffic data to the intranet core switch through dynamic or static routing; the intranet core switch forwards the traffic data to the second load balancing device, and uses the second load balancing device to respond to the traffic data.

[0005] In this implementation, traffic is distributed layer by layer, first from the core switch to the security cluster switch and its corresponding security devices, and then distributed to multiple servers via the primary load balancing device. This disperses the traffic processing pressure previously concentrated on a small number of devices. This reduces the load on individual network devices, allowing them to be distributed as needed to multiple Layer 4 load balancing devices, and then further distributed to a large number of Layer 7 load balancing devices. This significantly increases the traffic volume that the entire network architecture can handle, easily handling massive business requests. All devices operate independently, eliminating traditional clustering or stacking methods. Even if a single device fails, it will not affect other devices, ensuring overall network stability.

[0006] Optionally, in an embodiment of the present application, the security device corresponding to the security cluster switch is used to perform security monitoring on the traffic data, and the traffic data after security monitoring is returned to the core switch, including: the security device sends the security layer route to the corresponding security cluster switch; the security cluster switch learns the security layer route through the dynamic routing protocol, and forwards the traffic data to the corresponding security device based on the destination address of the traffic data using the five-tuple hash algorithm; the security device performs security monitoring on the received traffic data, and returns the traffic data after security monitoring to the core switch.

[0007] In this implementation, traffic is pre-diverted by the security cluster switch, allowing individual security devices to handle moderate traffic volumes. This improves monitoring efficiency and accuracy, avoids security monitoring omissions or delays due to traffic overload, and enhances the overall security of the data center. Dynamic routing relationships are established between the cluster switch, core switches, and security devices. When a link or security device fails, routing is rapidly adjusted to redirect traffic to other available paths and devices, reducing interruptions in traffic transmission during security monitoring and enhancing the robustness and reliability of the network architecture.

[0008] Optionally, in an embodiment of the present application, traffic data is received through a core switch and distributed to at least one security cluster switch, including: obtaining an operating mode; the operating mode includes a normal mode and an abnormal mode; the normal mode represents security monitoring of traffic data; the abnormal mode represents a safety device failure, and the traffic data is directly forwarded to the first load balancing device through the core switch; when the operating mode is a normal mode, the steps of receiving traffic data through the core switch and distributing the traffic data to at least one security cluster switch are executed.

[0009] In the above implementation, in normal mode, traffic data is distributed by the core switch to the secure cluster switch, where it is then monitored by security devices, ensuring the security of the traffic data. Security devices perform comprehensive inspection and filtering of traffic data, preventing malicious attacks, viruses, and other security threats from entering the data center network, thereby protecting the data center's business systems and data assets. Furthermore, in this model, the security monitoring of traffic data facilitates the timely identification and response to potential security risks, maintaining the overall secure and stable operation of the data center.

[0010] Optionally, in an embodiment of the present application, the routing table of the core switch includes security layer routing and load balancing layer routing; the security layer routing has a higher priority than the load balancing layer routing; the method also includes: in abnormal mode, the security layer routing is closed, and the core switch forwards the received traffic data to multiple first load balancing devices.

[0011] In the implementation described above, in abnormal mode, when a security device fails, traffic data can be forwarded directly to the first load balancing device via the core switch, ensuring business continuity. This prevents traffic transmission interruptions caused by security device failures, ensures the continuous operation of data center services, reduces the impact of failures on business, and improves system availability and reliability.

[0012] Optionally, in an embodiment of the present application, the core switch forwards the traffic data after security monitoring to multiple first load balancing devices, including: the core switch forwards the traffic data after security monitoring to the second core switch through a five-tuple hash algorithm; the second core switch distributes the traffic data to the first load balancing device through equal-cost routing; the first load balancing device is a four-layer load balancing device.

[0013] In this implementation, the core switch's five-tuple hashing algorithm ensures that traffic from the same session is always forwarded to the second core switch via the same path, enhancing session integrity. The second core switch distributes traffic to multiple first-tier load balancing devices using equal-cost routing, achieving load balancing and redundancy. Layer 4 load balancing devices distribute traffic based on IP and port information, enabling more precise distribution of traffic to backend servers and ensuring load balancing for each server.

[0014] Optionally, in an embodiment of the present application, the intranet core switch forwards the traffic data to the second load balancing device, including: the intranet core switch forwards the traffic data to the second load balancing device through a five-tuple hash algorithm; the second load balancing device is a seven-layer load balancing device.

[0015] In the above implementation process, the seven-layer load balancing device distributes traffic based on application layer information, more accurately allocating traffic to backend servers and improving the load balancing capabilities of each server. This improves the overall system performance and resource utilization, and avoids server overload or idleness caused by concentrated traffic.

[0016] Optionally, in an embodiment of the present application, the traffic data is forwarded to the corresponding security device using a quintuple hash algorithm, including: extracting a quintuple from the traffic data; the quintuple includes the source address, destination address, source port, destination port and protocol type; calculating a hash value based on the quintuple; the hash value is used to determine the security device corresponding to the traffic data; and forwarding the traffic data to the corresponding security device based on the hash value.

[0017] In the above implementation, a hash algorithm distributes traffic across multiple security devices, preventing a single security device from being overloaded by excessive traffic. Each security device can handle a portion of the traffic, improving the overall system's processing capacity and performance. Multiple security devices operate in parallel, fully utilizing the data center's hardware resources and improving resource utilization. When business growth necessitates the addition of new security devices, simply add them to the security cluster switch and update the mapping between hash values ​​and devices to redirect some traffic to the new devices. This flexible expansion approach eliminates the need for large-scale modifications to the existing system, reducing expansion costs and complexity.

[0018] In the second aspect, an embodiment of the present application also provides a data center network architecture, including: a core switch, a security cluster switch, a security device, a first load balancing device, a second load balancing device, and an intranet core switch; the core switch is used to receive traffic data and perform first-layer routing to the security cluster switch; the security cluster switch is used to forward traffic data to the security device and achieve load balancing of the security device through dynamic routing; the security device is used to perform security monitoring of traffic data and publish routes; the first load balancing device is used to distribute traffic; the intranet core switch is used to connect the first load balancing device and the second load balancing device to build an intranet architecture; the second load balancing device is used to parse the application protocol and perform secondary load balancing on the traffic data; the core switch is connected to the security cluster switch and the first load balancing device; the security cluster switch is connected to each component in the corresponding security device respectively; the intranet core switch is connected to the first load balancing device and the second load balancing device respectively.

[0019] In the above implementation, multi-level load balancing (primary and secondary load balancing) distributes traffic efficiently across multiple servers and devices, mitigating single point overloads and improving overall processing capacity and response speed. A five-tuple hashing algorithm ensures that packets within the same session are processed along the same path, reducing out-of-order distribution time and enhancing user experience. Core switches connect to multiple devices, ensuring network stability even if one fails while others remain operational. New load balancing devices, security appliances, or servers can be easily added, enabling linear scalability of network processing capacity to accommodate business growth.

[0020] In a third aspect, an embodiment of the present application further provides a computer program product, including computer program instructions, which, when executed by a processor, execute the method provided by the first aspect or any one of the implementations of the first aspect.

[0021] In a fourth aspect, an embodiment of the present application further provides an electronic device comprising: a processor and a memory, wherein the memory stores computer program instructions, and when the computer program instructions are executed by the processor, the method provided by the first aspect or any one of the implementations of the first aspect is executed.

[0022] In a fifth aspect, an embodiment of the present application further provides a computer-readable storage medium, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the method provided by the first aspect or any one of the implementations of the first aspect is executed.

[0023] The data center traffic forwarding method, program product, electronic device, and storage medium provided by this application are used to distribute the traffic step by step, first by the core switch to the security cluster switch and the corresponding security device, and then distributed to multiple servers through the first load balancing device, so that the traffic processing pressure originally concentrated on a few devices can be dispersed. The load on a single network device is reduced, and it can be distributed to multiple four-layer load balancing devices as needed, and then diverted to a large number of seven-layer load balancing devices, greatly improving the scale of traffic that the entire network architecture can handle, and easily handling massive business requests. All devices operate independently, abandoning the traditional clustering or stacking method. Even if a device fails, it will not involve other devices, ensuring the overall stability of the network. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments of the present application. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other relevant drawings can be obtained based on these drawings without creative work.

[0025] Figure 1 A flow chart of a data center traffic forwarding method provided in an embodiment of the present application; Figure 2 A schematic diagram of a data center network architecture provided in an embodiment of the present application; Figure 3 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0026] The following embodiments of the technical solution of the present application will be described in detail with reference to the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solution of the present application and are therefore only examples and are not intended to limit the scope of protection of the present application.

[0027] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing specific embodiments and are not intended to limit this application.

[0028] In the description of the embodiments of this application, the technical terms "first" and "second" are used only to distinguish different objects and should not be understood to indicate or imply relative importance or implicitly specify the quantity, specific order, or primary and secondary relationship of the indicated technical features. In the description of the embodiments of this application, the meaning of "plurality" is two or more, unless otherwise specifically defined.

[0029] Before introducing the embodiments of the present application, the components of the data center network architecture are introduced: Core Switch: Located at the core of the data center network, it is mainly responsible for high-speed data exchange and forwarding. It is the backbone of the data center network, connecting the external network with the internal network of the data center and providing a high-bandwidth, low-latency data transmission channel for the data center.

[0030] Security Cluster Switch (SecSw): Serves as the access point and traffic distribution center for security devices. It is connected to the core switch and is responsible for distributing traffic forwarded by the core switch to multiple security devices for security monitoring. It also collects traffic processed by the security devices and returns it to the core switch.

[0031] Security devices (Sec): Deployed on security cluster switches, they monitor and filter traffic data, checking for security threats such as malicious attacks, viruses, and intrusions, ensuring data center network security.

[0032] The first load balancing device (L4-Loadb): Based on the four-layer load balancing technology, it is responsible for distributing the traffic forwarded by the core switch to multiple servers or service nodes according to a specific load balancing algorithm (such as polling, least connections, etc.) to achieve reasonable distribution of traffic and balance of server loads.

[0033] Internal-Core Switch: Connects the first load balancing device and the internal network access switch (TOR), plays the role of core switching in the internal network of the data center, and is responsible for forwarding and exchanging data between different areas of the internal network.

[0034] The second load balancing device (L7-Loadb): Based on the seven-layer load balancing technology, it is located after the intranet access switch. It distributes and schedules traffic more finely based on application layer information (such as URL, Cookie, etc.), improving application availability and performance.

[0035] See Figure 1 The flow chart of a data center traffic forwarding method provided by an embodiment of the present application is shown. The data center traffic forwarding method provided by an embodiment of the present application can be applied to electronic devices, which may include physical devices such as servers, PCs, tablets, or smartphones, or virtual devices such as virtual machines or containers. The electronic device can be a single device, a combination of multiple devices, or a cluster of a large number of devices. The data center traffic forwarding method may include: Step S110: Receive traffic data through the core switch, distribute the traffic data to at least one security cluster switch, perform security monitoring on the traffic data using security devices corresponding to the security cluster switch, and return the traffic data after security monitoring to the core switch.

[0036] Step S120: The core switch forwards the traffic data after security monitoring to multiple first load balancing devices; the first load balancing devices are used to distribute traffic.

[0037] Step S130: The first load balancing device forwards the traffic data to the intranet core switch through static routing.

[0038] Step S140: the intranet core switch forwards the traffic data to the second load balancing device, and uses the second load balancing device to respond to the traffic data.

[0039] In step S110 , the core switch receives traffic data from the external network and forwards the traffic data to the secure cluster switch according to preset policies (such as access control lists, ACLs, etc.) and routing rules.

[0040] After receiving traffic data, the security cluster switch distributes the traffic to multiple connected security devices based on its configured load balancing strategy (such as equal-cost multi-path routing, ECMP). For example, you can choose to distribute the traffic evenly or use other distribution methods.

[0041] Each security device performs security monitoring on the assigned traffic data. Security monitoring includes intrusion detection, firewall filtering and / or virus scanning, etc., to identify and filter out potential security threats.

[0042] After security monitoring, traffic data is returned by the security device to the secure cluster switch, which then forwards it back to the core switch. In this way, traffic entering the data center is security-checked, ensuring the security of the data center's internal network to a certain extent.

[0043] As an implementation, before traffic reaches the switch (such as secsw) connected to the Layer 4 load balancer, a single logical network device (such as core1) is responsible for centrally forwarding all traffic along the entire traffic path, rather than having multiple devices share the load. A logical network device refers to a logical forwarding unit. This can be a single physical switch (such as core1) or a virtualized logical unit composed of multiple switches (such as an M-LAG or stacking system), but it appears to be a unified forwarding entity. All traffic from the external network is first aggregated to this logical device (core1), which then makes the final decision on the next forwarding path.

[0044] In step S120, after receiving the traffic data after security monitoring, the core switch distributes the traffic data to multiple first load balancing devices based on routing information learned by a dynamic routing protocol (such as Open Shortest Path First, OSPF) and a pre-configured load balancing policy.

[0045] After receiving traffic data, the first load balancing device distributes it to multiple backend servers or service nodes, such as an intranet core switch, based on its Layer 4 load balancing algorithm. This distribution mechanism allows multiple servers to share the traffic load, improving the system's concurrent processing capabilities and availability.

[0046] In step S130, a static route is pre-configured between the first load balancing device and the intranet core switch, which clarifies the forwarding path of traffic data from the first load balancing device to the intranet core switch.

[0047] The first load balancing device forwards traffic data to the intranet core switch based on the static routing configuration. Using static routing improves the stability of traffic data transmission between the intranet core switch and the first load balancing device, reduces the overhead and uncertainty of dynamic routing protocols, and prevents routing oscillations from affecting session persistence.

[0048] As an implementation, in addition to using static routing to forward traffic to the internal core switch (internal-core), the first load balancing device (L4-Load Balancer) can also accomplish this forwarding via dynamic routing protocols (such as OSPF / BGP). For example, the first load balancing device and the internal core switch run the same dynamic routing protocol. The first load balancing device advertises its local virtual service address or backend server network segment to the internal core switch via the routing protocol. After completing Layer 4 load balancing, the first load balancing device encapsulates the traffic into new packets and forwards it to the internal core switch using the dynamic routing protocol to select the optimal path. The introduction of dynamic routing makes traffic forwarding between the first load balancing device and the internal core switch more intelligent and flexible, making it particularly suitable for large-scale, highly dynamic data center environments.

[0049] In step S140, after receiving the traffic data forwarded by the first load balancing device, the intranet core switch forwards the traffic data to the second load balancing device according to its internal routing policy and configuration.

[0050] The second load balancing device, based on seven-layer load balancing technology, further analyzes and processes traffic data based on application-layer information (such as URLs and host headers), and the backend server responds. It forwards the traffic data to the appropriate server and returns the server's response data to the intranet core switch. The intranet core switch then sends the response data back to the core switch, which then returns it to the user. This process enables refined management and scheduling of application-layer services, improving application performance and user experience.

[0051] During the implementation of the above-mentioned embodiment, traffic is distributed step by step, first from the core switch to the security cluster switch and corresponding security devices, and then distributed to multiple servers via the first load balancing device. This disperses the traffic processing pressure originally concentrated on a small number of devices. This reduces the load on a single network device, allowing traffic to be distributed as needed to multiple Layer 4 load balancing devices, and then further distributed to a large number of Layer 7 load balancing devices. This significantly increases the traffic volume that the entire network architecture can handle, making it easy to handle massive business requests. All devices operate independently, eliminating traditional clustering or stacking methods. Even if a device fails, it will not affect other devices, ensuring the overall stability of the network.

[0052] For example, when a single security device or load balancing device fails, traffic can continue to be forwarded and processed through other normal devices, and the entire data center service will not be interrupted due to a single point of failure.

[0053] Optionally, in an embodiment of the present application, using a security device corresponding to a secure cluster switch to perform security monitoring on traffic data and returning the traffic data after security monitoring to a core switch includes: The security device sends the security layer route to the corresponding security cluster switch. The security device is configured with a routing protocol to establish a dynamic routing relationship with the security cluster switch. For example, the security device can run the OSPF protocol and send its routing information, such as its IP address and subnet mask, to the security cluster switch via an OSPF Hello message. Assuming the IP address of the security device is 192.168.1.10 and the subnet mask is 255.255.255.0, it will encapsulate this information in an OSPF message and send it to the multicast address 224.0.0.5 of the network segment where the security cluster switch resides, informing the security cluster switch of its existence and reachable network range.

[0054] When a security device sends a security layer route, it publishes specific routing information based on its own service requirements and network configuration. For example, it might publish a host route pointing to its own IP address, instructing the security cluster switch that all traffic destined for that IP address should be handled by it. Alternatively, it might publish a network route encompassing multiple IP address ranges, indicating that it can handle traffic within those network ranges.

[0055] The secure cluster switch learns security layer routes through dynamic routing protocols and forwards traffic data to the corresponding security device based on the destination address of the traffic data using a five-tuple hash algorithm.

[0056] A dynamic routing protocol is a network protocol used to automatically exchange routing information between different network devices, enabling them to dynamically learn and update routing tables. Common dynamic routing protocols include Open Shortest Path First (OSPF) and Border Gateway Protocol (BGP). Dynamic routing protocols allow network devices to automatically adapt to changes in network topology and select the optimal path for data transmission.

[0057] The quintuple hash algorithm performs a hash calculation based on the five-tuple structure of an IP packet (source IP address, destination IP address, source port number, destination port number, and protocol type). In network traffic forwarding, the quintuple hash algorithm can hash multiple IP packets belonging to the same data flow to the same next-hop device, ensuring that multiple IP packets from the same user request are processed along the same path, reducing issues such as packet out-of-order processing.

[0058] The security cluster switch runs the same dynamic routing protocol as the security device (such as OSPF), receives routing information from the security device, and adds it to its own routing table. Upon receiving the OSPF Hello message from the security device, the security cluster switch parses the routing information and updates its routing table, recording the network range to which the security device is connected and the corresponding next-hop address (i.e., the IP address of the security device).

[0059] When the security cluster switch receives traffic data forwarded from the core switch, it first queries the routing table to find a matching route entry based on the traffic data's destination IP address. For example, if the destination IP address of the traffic data received is 192.168.1.10, the security cluster switch finds the next hop corresponding to this IP address in the routing table as the IP address of security device A, and then forwards the traffic data to security device A.

[0060] The security devices monitor the traffic data they receive and return it to the core switch. After receiving the traffic data, the security devices monitor it based on pre-configured security policies and rules. For example, the firewall checks whether the traffic data complies with the preset access control list (ACL) rules and determines whether to allow the traffic to pass. The intrusion detection system analyzes the traffic data for known attack signatures or abnormal behavior patterns, such as SQL injection and XSS attacks.

[0061] After the security device performs security monitoring on the received traffic, it can also record the monitoring process and results through logs, etc., and then return the traffic data after security monitoring to the core switch.

[0062] In the implementation of the above embodiment, because traffic is pre-diverted by the security cluster switch, the traffic volume handled by a single security device is moderate, improving monitoring efficiency and accuracy, avoiding security monitoring omissions or delays due to traffic overload, and enhancing the overall security level of the data center. Dynamic routing relationships are established between the cluster switch, core switches, and security devices. When a link or security device fails, routing can be rapidly adjusted to forward traffic to other available paths and devices, reducing interruptions in traffic transmission during security monitoring and enhancing the robustness and reliability of the network architecture.

[0063] Optionally, in an embodiment of the present application, receiving traffic data through a core switch and distributing the traffic data to at least one security cluster switch includes: Obtain the operating mode; the operating mode includes normal mode and abnormal mode; the normal mode indicates security monitoring of traffic data; the abnormal mode indicates a safety device failure, and the traffic data is directly forwarded to the first load balancing device through the core switch.

[0064] Refers to the operating status of the data center network system, which is divided into normal mode and abnormal mode. Normal mode indicates that the security devices are operating normally, and the system can perform standard security monitoring procedures on traffic data. In this mode, traffic data is received by the core switch and distributed to the security cluster switch according to the established policy, and then security monitoring is carried out by the security devices. Abnormal mode indicates that the security device has failed, and the system switches to the backup traffic processing mechanism. In this mode, traffic data bypasses the security device detection and is forwarded directly to the primary load balancing device through the core switch, ensuring that traffic transmission is not interrupted by security device failure.

[0065] The system uses a monitoring module to monitor the operational status of security devices in real time, including metrics such as device health, response time, and resource utilization. The monitoring module periodically (for example, every minute) sends heartbeat signals to the security devices to verify their normal response. It also detects fault alarms from security devices, such as hardware failures and software crashes. Based on this monitoring data, the system determines whether it is currently operating in normal or abnormal mode. For example, if a security device fails to respond to a heartbeat signal within a specified timeframe or issues a fault alarm, the system determines that it is operating in abnormal mode.

[0066] When the operating mode is normal, the steps of receiving traffic data through the core switch and distributing the traffic data to at least one secure cluster switch are performed. Traffic distribution in normal mode: The core switch, as the core node of the data center network, receives traffic data from the external network. This traffic data may come from various user requests, such as web page access, video streaming, and e-commerce transactions. Distributing traffic data to the secure cluster switch: The core switch forwards the traffic data to at least one secure cluster switch based on preset policies (such as access control lists and policy-based routing) and routing information learned from dynamic routing protocols (such as BGP and OSPF).

[0067] In the implementation of the above embodiment, in normal mode, traffic data is distributed by the core switch to the secure cluster switch, where it is then monitored by the security device, ensuring the security of the traffic data. The security device performs comprehensive inspection and filtering on the traffic data, preventing malicious attacks, viruses, and other security threats from entering the data center's internal network, thereby protecting the data center's business systems and data assets. Furthermore, in this mode, the security monitoring of traffic data facilitates the timely identification and response to potential security risks, maintaining the overall secure and stable operation of the data center.

[0068] Optionally, in an embodiment of the present application, the routing table of the core switch includes a security layer route and a load balancing layer route; the security layer route has a higher priority than the load balancing layer route; and the method further includes: In abnormal mode, the security layer routing is closed, and the core switch forwards the received traffic data to multiple first load balancing devices.

[0069] In abnormal mode, when a security device fails, SecSw detects the Sec failure through dynamic routing protocols (such as OSPF DeadInterval), automatically withdraws the corresponding route, and shuts down the security layer route. Specifically, after the core switch and security cluster switch detect the failure state of the security device through dynamic routing protocols (such as OSPF, BGP, etc.), they will remove the route entries related to the security device from the routing table. For example, the core switch's routing table originally contained a route pointing to the security cluster switch, which was used to forward traffic to the security device. When the security device fails, the security cluster switch will send a route withdrawal message. After receiving the message, the core switch will delete the route entry related to the security device, thereby shutting down the security layer route. In addition, static route configuration can also be used to manually or automatically delete the relevant static route configuration when a security device failure is detected.

[0070] In the implementation of the above embodiment, in abnormal mode, when a security device fails, traffic data can be directly forwarded to the first load balancing device via the core switch, ensuring service continuity. This avoids traffic transmission interruptions caused by security device failures, ensures the continuous operation of data center services, reduces the impact of failures on services, and improves system availability and reliability.

[0071] Optionally, in an embodiment of the present application, the core switch forwards the traffic data after security monitoring to multiple first load balancing devices, including: The core switch forwards the traffic data after security monitoring to the second core switch through the five-tuple hash algorithm; the second core switch distributes the traffic data to the first load balancing device through equal-cost routing; the first load balancing device is a four-layer load balancing device.

[0072] The second core switch is connected to the first load balancing device. The second core switch (a redundant node of the border core switch) and the intranet core switch indirectly collaborate through the first load balancing layer. This relationship essentially forms a functionally decoupled cascade architecture. This fault isolation design is designed for two scenarios: Scenario 1: If the second core switch fails, traffic automatically switches to the first core switch, without affecting the intranet core layer. Scenario 2: If the intranet core switch fails, a dynamic routing protocol (such as OSPF) automatically redirects traffic to the surviving intranet core switch, without affecting the border core layer. This design decouples the load balancing layer, isolates fault domains, and prevents the spread of single-point failures.

[0073] The core switch extracts the five-tuple information of the traffic data (source IP, destination IP, source port, destination port, protocol type) and uses a preset hash algorithm to calculate a hash value. This hash value is used to determine the forwarding path of the traffic data.

[0074] Based on the calculated hash value, the core switch forwards the traffic data to the secondary core switch. This ensures that traffic data for the same session is always forwarded along the same path, maintaining session consistency. For example, if all packets in a user session have the same five-tuple, they will be hashed to the same path and ultimately forwarded to the same secondary core switch.

[0075] Equal-cost routing refers to multiple routing paths within a network that have the same destination but different next hops. These paths are equal in cost or priority. When network devices (such as switches or routers) forward traffic, they evenly distribute the traffic across these equal-cost paths based on the equal-cost routing configuration to achieve load balancing and redundancy.

[0076] The second core switch checks its routing table to find an equal-cost route entry that matches the destination address of the traffic data. Equal-cost routes typically refer to multiple routing paths with the same destination but different next hops.

[0077] Based on the configuration of equal-cost routing, the second core switch evenly distributes traffic data to multiple first load balancing devices. This can be achieved through various load balancing algorithms, such as polling, random, hash, etc.

[0078] The four-layer load balancing device distributes traffic data to multiple servers or service nodes on the backend using a preset load balancing algorithm (such as polling, least number of connections, hashing, etc.) based on information such as the IP address and port number of the traffic data.

[0079] In the implementation of the above embodiment, the core switch's five-tuple hashing algorithm ensures that traffic data for the same session is always forwarded to the second core switch via the same path, improving session integrity. The second core switch distributes traffic to multiple first load balancing devices using equal-cost routing, achieving load balancing and redundancy. Layer 4 load balancing devices distribute traffic based on IP and port information, enabling more precise distribution of traffic to backend servers and ensuring load balancing for each server.

[0080] Optionally, in an embodiment of the present application, the intranet core switch forwards the traffic data to the second load balancing device, including: The intranet core switch forwards the traffic data to the second load balancing device through the five-tuple hash algorithm; the second load balancing device is a seven-layer load balancing device.

[0081] The intranet core switch parses the traffic data header and extracts five key features: source IP address, destination IP address, source port, destination port, and protocol type. It then uses a pre-defined hashing algorithm (such as consistent hashing or FNV hashing) to calculate the five-tuple information and generate a hash value. This hash value is used to determine the forwarding path for the traffic data. Based on the hash value, the intranet core switch forwards the traffic data to a specific secondary load balancing device.

[0082] It should be noted that multiple IP packets of the same session must be hashed to the same second load balancing device, otherwise the second load balancing device cannot identify the application layer request.

[0083] The seven-layer load balancing device parses the application layer information of the traffic data, such as the URL, host header, and cookies of the HTTP request. According to the preset seven-layer load balancing strategy (such as URL polling, URL hashing, cookie hashing, least requests, etc.), the traffic data is distributed to multiple servers or service nodes on the backend.

[0084] In the implementation of the above embodiment, the seven-layer load balancing device distributes traffic based on application layer information, more accurately allocating traffic to backend servers and improving the load balancing capabilities of each server. This improves the overall system performance and resource utilization, and avoids server overload or idleness caused by concentrated traffic.

[0085] Optionally, in an embodiment of the present application, using a five-tuple hash algorithm to forward traffic data to a corresponding security device includes: Extract the five-tuple from the traffic data; the five-tuple includes the source address, destination address, source port, destination port, and protocol type. Calculate a hash value based on the five-tuple. The hash value is used to determine the security device corresponding to the traffic data. Based on the hash value, the traffic data is forwarded to the corresponding security device.

[0086] The following example illustrates the five-tuple hashing algorithm. Suppose a user uses a local browser (IP address 192.168.1.100) to access the HTTP service of a website (server IP address 203.0.113.50). This website uses TCP port 80. The browser randomly selects a source port, such as 54321. The five-tuple information in this traffic data is as follows: Source address: 192.168.1.100 (the IP address of the user device initiating the request). Destination address: 203.0.113.50 (the IP address of the target website server). Source port: 54321 (the random port used by the application on the user device initiating the request). Destination port: 80 (the port on which the website server listens for the HTTP service). Protocol type: TCP (transport layer protocol).

[0087] These five parts are hashed using a specific hash algorithm. For example, a simple FNV hash algorithm (a more appropriate hash algorithm can be selected in actual scenarios) is used to combine the above five-tuple into a string "192.168.1.100:54321:203.0.113.50:80:TCP". The hash value of this string is then calculated to obtain a hash result, such as 0x3A5B78.

[0088] Assume that a data center has multiple security devices (such as Sec1, Sec2, and Sec3), each corresponding to a specific hash value range. Based on the calculated hash value 0x3A5B78, the traffic data is determined to be forwarded to the corresponding security device, Sec2. The core switch forwards the traffic data to the security cluster switch, which, based on the preconfigured mapping between hash values ​​and security devices, forwards the traffic data to the corresponding security device, Sec2.

[0089] In the implementation of the above embodiment, traffic is distributed across multiple security devices using a hash algorithm, preventing a single security device from being overloaded by excessive traffic. Each security device can handle a portion of the traffic, improving the processing power and performance of the entire system. Multiple security devices operate in parallel, fully utilizing the data center's hardware resources and improving resource utilization. When business growth necessitates the addition of new security devices, they are simply added to the security cluster switch and the mapping between hash values ​​and devices is updated to forward some traffic to the new devices. This flexible expansion approach eliminates the need for large-scale modifications to the existing system, reducing expansion costs and complexity.

[0090] See Figure 2 The diagram of the data center network architecture provided by the embodiment of the present application is shown; the data center network architecture includes: a core switch, a security cluster switch, a security device, a first load balancing device, a second load balancing device, and an intranet core switch.

[0091] The core switch is used to receive traffic data and perform first-layer routing to the security cluster switch; the security cluster switch is used to forward traffic data to the security device and achieve load balancing of the security device through dynamic routing; the security device is used to perform security monitoring of traffic data and publish routes; the first load balancing device is used to distribute traffic; the intranet core switch is used to connect the first load balancing device and the second load balancing device to build an intranet architecture; the second load balancing device is used to parse the application protocol and perform secondary load balancing on the traffic data.

[0092] The core switch is connected to the security cluster switch and the first load balancing device; the security cluster switch is connected to each component in the corresponding security device; the intranet core switch is connected to the first load balancing device and the second load balancing device respectively.

[0093] As the gateway to the data center network, the core switch primarily receives traffic from external networks. It possesses high-performance routing capabilities, enabling rapid first-layer routing of traffic data. Core switches connect to secure cluster switches and primary load balancing devices via high-speed links, ensuring rapid data forwarding. Core switches typically utilize multi-link connectivity to provide redundancy and prevent single points of failure from causing network disruptions.

[0094] The security cluster switch is connected to the core switch and its primary responsibility is to forward traffic data to security devices. Independent links are used between the security cluster switch and each security device to ensure stable and reliable data transmission. The security cluster switch utilizes dynamic routing protocols to maintain real-time visibility into the status and load of each security device. When traffic data arrives at the security cluster switch, it uses this information to distribute it appropriately to each security device, minimizing overload on individual devices and ensuring efficient flow of traffic through security monitoring links.

[0095] The first load balancing device is connected to the core switch and performs preliminary load balancing on traffic data. It receives traffic data from the core switch through static or dynamic routing and distributes it to multiple backend servers or service nodes based on a pre-set load balancing algorithm (such as round-robin or least connections).

[0096] The connection between the components can be connected using high-speed Ethernet links, such as 10GE or 40GE links, to meet the needs of large data volume transmission.

[0097] The intranet core switch is connected to the first and second load balancing devices using multiple links, creating a redundant network topology and reducing network outages caused by single link failures. Link aggregation technology can be used to aggregate multiple physical links into a single logical link, improving link bandwidth and reliability.

[0098] In the implementation of the above embodiment, multi-level load balancing (primary and secondary load balancing) effectively distributes traffic to multiple servers and devices, mitigating single-point overload and improving overall processing capacity and response speed. A five-tuple hashing algorithm ensures that packets within the same session are processed along the same path, reducing out-of-order distribution time and enhancing user experience. Core switches connect to multiple devices, ensuring that even if one device fails, the others remain operational, ensuring network stability. New load balancing devices, security devices, or servers can be easily added, enabling linear expansion of network processing capacity to accommodate business growth.

[0099] In an optional embodiment, the data center network framework may include multiple components. For example, there may be multiple core switches. Traffic collected by the remaining core switches may be forwarded to one core switch, A, which then distributes the traffic to multiple security cluster switches. Each security cluster switch has multiple corresponding security devices, and each security device is connected to its corresponding security cluster switch. There may also be multiple first load balancing devices. After receiving traffic data from security monitoring, the core switch may distribute it to multiple first load balancing devices. Each first load balancing device is connected to an intranet core switch and forwards the received traffic data to multiple second load balancing devices.

[0100] It should be understood that this device corresponds to the aforementioned data center traffic forwarding method embodiment and is capable of executing each of the steps involved in the aforementioned method embodiment. The specific functions of this device can be found in the description above; to avoid repetition, a detailed description is omitted here. The device includes at least one software functional module that can be stored in a memory in the form of software or firmware or embedded in the device's operating system (OS).

[0101] See Figure 3 The electronic device 300 provided in the embodiment of the present application includes a processor 310 and a memory 320, wherein the memory 320 stores machine-readable instructions executable by the processor 310, and when the machine-readable instructions are executed by the processor 310, the method described above is performed.

[0102] Figure 3 Each component shown in the figure can be implemented using hardware, software, or a combination thereof. Electronic device 300 may be a physical device, such as a server or a PC, or a virtual device, such as a virtual machine or a virtualized container. Furthermore, electronic device 300 is not limited to a single device and may also be a combination of multiple devices or a cluster consisting of a large number of devices.

[0103] An embodiment of the present application further provides a storage medium, on which a computer program is stored. When the computer program is run by a processor, the above method is executed.

[0104] The storage medium may be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk or optical disk.

[0105] An embodiment of the present application also provides a computer program product, including computer program instructions, which execute the above method when executed by a processor.

[0106] In the several embodiments provided in the embodiments of the present application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely illustrative. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architectures, functions, and operations of the devices, methods, and computer program products according to the multiple embodiments of the embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment, or a portion of code, and the module, program segment, or a portion of code contains one or more executable instructions for implementing the specified logical functions. It should also be noted that in some alternative implementations, the functions marked in the boxes can also occur in a different order than the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart, can be implemented using a dedicated hardware-based system that performs the specified function or action, or can be implemented using a combination of dedicated hardware and computer instructions.

[0107] In addition, the functional modules in each embodiment of the present application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0108] The above description is only an optional implementation method of the embodiment of the present application, but the protection scope of the embodiment of the present application is not limited to this. Any technician familiar with this technical field can easily think of changes or replacements within the technical scope disclosed in the embodiment of the present application, and they should all be covered by the protection scope of the embodiment of the present application.

Claims

1. A data center traffic forwarding method, characterized in that: Applied to data center network architecture; including: receiving flow data through a core switch, distributing the flow data to at least one security cluster switch, performing security monitoring on the flow data using security devices corresponding to the security cluster switches, and returning the flow data after security monitoring to the core switch; The core switch forwards the traffic data after security monitoring to multiple first load balancing devices; the first load balancing devices are used to distribute traffic; The first load balancing device forwards the traffic data to the intranet core switch; The intranet core switch forwards the traffic data to a second load balancing device, and uses the second load balancing device to respond to the traffic data.

2. The method according to claim 1, characterized in that Performing security monitoring on the traffic data using a security device corresponding to the security cluster switch and returning the traffic data after security monitoring to the core switch includes: The security device sends a security layer route to the corresponding security cluster switch; The security cluster switch learns the security layer route through a dynamic routing protocol and forwards the traffic data to the corresponding security device using a five-tuple hash algorithm according to the destination address of the traffic data; The security device performs security monitoring on the received traffic data and returns the traffic data after security monitoring to the core switch.

3. The method according to claim 1, characterized in that The receiving of traffic data through the core switch and distributing the traffic data to at least one security cluster switch includes: Obtaining an operating mode; the operating mode includes a normal mode and an abnormal mode; the normal mode indicates that the traffic data is securely monitored; the abnormal mode indicates that the security device fails, and the traffic data is directly forwarded to the first load balancing device through the core switch; When the operating mode is the normal mode, the steps of receiving flow data through a core switch and distributing the flow data to at least one security cluster switch are performed.

4. The method according to claim 3, characterized in that The routing table of the core switch includes security layer routing and load balancing layer routing; The priority of the security layer routing is higher than that of the load balancing layer routing; the method further includes: In the abnormal mode, the security layer routing is closed, and the core switch forwards the received traffic data to multiple first load balancing devices.

5. The method according to claim 1, wherein The core switch forwards the traffic data after security monitoring to multiple first load balancing devices, including: The core switch forwards the traffic data after security monitoring to the second core switch through a five-tuple hash algorithm; the second core switch distributes the traffic data to the first load balancing device through equal-cost routing; the first load balancing device is a four-layer load balancing device.

6. The method according to claim 1, characterized in that The intranet core switch forwards the traffic data to the second load balancing device, including: The intranet core switch forwards the traffic data to the second load balancing device through a five-tuple hash algorithm; the second load balancing device is a seven-layer load balancing device.

7. The method according to claim 2, characterized in that The forwarding of the traffic data to the corresponding security device by using a five-tuple hash algorithm includes: Extracting a quintuple from the traffic data; the quintuple includes a source address, a destination address, a source port, a destination port, and a protocol type; Calculating a hash value based on the quintuple; the hash value is used to determine the security device corresponding to the traffic data; The traffic data is forwarded to the corresponding security device according to the hash value.

8. A data center network architecture, characterized in that: include: Core switch, security cluster switch, security device, first load balancing device, second load balancing device, intranet core switch; The core switch is used to receive traffic data and perform first-layer routing to the security cluster switch; The security cluster switch is used to forward the traffic data to the security device and achieve load balancing of the security device through dynamic routing; The security device is used to perform security monitoring on the traffic data and publish routes; The first load balancing device is used to distribute traffic; The intranet core switch is used to connect the first load balancing device and the second load balancing device to build an intranet architecture; The second load balancing device is used to parse the application protocol and perform secondary load balancing on the traffic data; The core switch is connected to the security cluster switch and the first load balancing device; the security cluster switch is connected to each component in the corresponding security device; the intranet core switch is connected to the first load balancing device and the second load balancing device respectively.

9. A computer program product, characterized in that The method comprises computer program instructions, which are used to execute the method according to any one of claims 1 to 7 when the computer program instructions are executed by a processor.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer program instructions, and when the computer program instructions are executed by a processor, the method according to any one of claims 1 to 7 is executed.

Images