Network speed limiting method, apparatus, device, storage medium, and computer program product

Abstract

This invention discloses a network rate limiting method, apparatus, device, storage medium, and computer program product. The method is applied to a rate limiting gateway and includes: receiving current service traffic packets and determining the type of the current service traffic packets; if the current service traffic packets are overlay traffic packets, rate limiting is applied to the matching inner source IP and destination IP; if the current service traffic packets are underlay traffic packets, rate limiting is applied to the matching outer source IP and destination IP; receiving overlay traffic packets forwarded by a static VxLAN tunnel, and using route leakage technology to forward the overlay traffic packets to the underlay network. This invention employs a combined underlay and overlay rate limiting approach, decoupling service traffic from the underlying underlay network devices, effectively improving rate limiting accuracy and network traffic security.

Description

Technical Field

[0001] This invention relates to the field of communication network technology, and in particular to a network speed limiting method, apparatus, device, storage medium, and computer program product. Background Technology

[0002] A rate-limiting gateway is a critical device deployed at the network egress layer, designed to manage bandwidth limits for public IP addresses. It supports rate-limiting configuration for individual IPs and also allows for shared rate-limiting across multiple IPs to meet the needs of different business scenarios. However, current network rate-limiting methods suffer from low accuracy and poor network traffic security. Summary of the Invention

[0003] The purpose of this invention is to provide a network rate limiting method, apparatus, device, storage medium, and computer program product that adopts a combined underlay and overlay rate limiting approach to decouple service traffic from the underlying underlay network devices, thereby effectively improving rate limiting accuracy and network traffic security.

[0004] To achieve the above objectives, embodiments of the present invention provide a network rate limiting method applied to a rate limiting gateway, the method comprising:

[0005] Receive the current service traffic packet and determine the type of the current service traffic packet;

[0006] If the current service traffic packet is an overlay traffic packet, then rate limiting is applied to the matching inner source IP and destination IP.

[0007] If the current service traffic packet is an underlay traffic packet, then rate limiting is applied to the matching outer source IP and destination IP;

[0008] The system receives the overlay traffic packets forwarded by the static VxLAN tunnel and uses route leakage technology to forward the overlay traffic packets to the underlay network.

[0009] As an improvement to the above scheme, if the current service traffic packet is an overlay traffic packet, rate limiting is applied to the matching inner source IP and destination IP, including:

[0010] If the current service traffic packet is an overlay traffic packet, then the inner source IP matched by the overlay traffic packet is rate-limited according to the first Meter table;

[0011] Rate limiting is applied to the inner destination IP that matches the overlay traffic packets based on the second Meter table.

[0012] As an improvement to the above scheme, if the current service traffic packet is an underlay traffic packet, rate limiting is applied to the matching outer source IP and destination IP, including:

[0013] If the current service traffic packet is an underlay traffic packet, then the outer source IP matched by the underlay traffic packet is rate-limited according to the third Meter table;

[0014] Rate limiting is applied to the outer destination IP that matches the underlay traffic packets based on the fourth Meter table.

[0015] As an improvement to the above solution, the method further includes:

[0016] An intra-cloud overlay network is established between the rate-limiting gateway and the public network gateway, and different VRFs are used to isolate inbound and outbound traffic.

[0017] As an improvement to the above scheme, the overlay traffic packets forwarded by the static VxLAN tunnel are received using route leakage technology to forward the overlay traffic packets to the underlay network, including:

[0018] Receive the overlay traffic packets forwarded by the static VxLAN tunnel;

[0019] The routing information corresponding to the static VxLAN tunnel is leaked into the routing table of the underlay network;

[0020] Based on the routing information in the routing table of the underlay network, the overlay traffic packets are forwarded to the underlay network.

[0021] As an improvement to the above solution, the speed limiting gateway is connected to the uplink device in a fully interconnected manner, and the speed limiting gateway includes a primary speed limiting gateway and a backup speed limiting gateway. The AS path length in the BGP route published by the primary speed limiting gateway is less than the AS path length in the BGP route published by the backup speed limiting gateway.

[0022] As an improvement to the above solution, the method further includes:

[0023] Based on the BGP neighbor relationship of the uplink device, a corresponding BFD session is created;

[0024] Based on preset BFD detection parameters, detect whether the link between the main rate limiting gateway and the uplink device is faulty;

[0025] If the link failure is detected, the BGP neighbor relationship is triggered to become Down, and route convergence is accelerated to switch traffic to the backup rate-limiting gateway.

[0026] This invention also provides a network rate limiting device applied to a rate limiting gateway, the device comprising:

[0027] The message judgment module is used to receive current service traffic messages and determine the type of the current service traffic messages;

[0028] The first rate limiting module is used to rate limit the matching inner source IP and destination IP if the current service traffic packet is an overlay traffic packet.

[0029] The second rate limiting module is used to rate limit the matching outer source IP and destination IP if the current service traffic packet is an underlay traffic packet.

[0030] The packet forwarding module is used to receive the overlay traffic packets forwarded by the static VxLAN tunnel, and to forward the overlay traffic packets to the underlay network using route leakage technology.

[0031] This invention also provides a terminal device, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor executes the computer program to implement the network rate limiting method described above.

[0032] This invention also provides a computer-readable storage medium, which includes a stored computer program, wherein the computer program, when running, controls the device where the computer-readable storage medium is located to execute any of the above-described network rate limiting methods.

[0033] This invention also provides a computer program product, which includes a computer program or computer instructions. When the computer program or computer instructions are executed by a processor, they implement the network rate limiting method described above.

[0034] Compared to existing technologies, the network rate limiting method, apparatus, device, storage medium, and computer program product provided in this invention offer the following advantages: Rate limiting control of outbound and inbound cloud traffic is achieved through a rate limiting gateway. Upon receiving a current service traffic packet, the rate limiting gateway first determines the type of the packet. If the packet is an overlay traffic packet, the gateway will rate-limit the matching inner source IP and destination IP. If the packet is an underlay traffic packet, the gateway will rate-limit the matching outer source IP and destination IP. When the gateway receives the overlay traffic packet forwarded by a static VxLAN tunnel, it uses route leakage technology to forward the overlay traffic packet to the underlay network. This invention designs a public network service traffic packet rate limiting and processing flow for the rate limiting gateway. This flow significantly improves the accuracy of public network traffic rate limiting through precise rate limiting algorithms and efficient packet processing logic, and optimizes the port blocking matching logic, thereby effectively improving the flexibility and security of network traffic management. Attached Figure Description

[0035] Figure 1 This is a flowchart illustrating a preferred embodiment of a network rate limiting method provided by the present invention;

[0036] Figure 2 This is an interactive schematic diagram of a preferred embodiment of a network rate limiting method provided by the present invention;

[0037] Figure 3 This is an interactive schematic diagram of another preferred embodiment of a network rate limiting method provided by the present invention;

[0038] Figure 4 This is a schematic diagram of a preferred embodiment of a network speed limiting device provided by the present invention;

[0039] Figure 5 This is a schematic diagram of a preferred embodiment of a terminal device provided by the present invention. Detailed Implementation

[0040] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0041] Before introducing the specific implementation methods, some concepts involved in the embodiments of the present invention will be explained first:

[0042] IP (Internet Protocol) address: It is a unified address format provided by the IP protocol. It assigns a logical address to every network and every host on the Internet to mask the differences in physical addresses.

[0043] Public network: also known as wide area network (WAN) or external network, is a remote network that connects computers in different local area networks or metropolitan area networks, and usually spans a large physical area.

[0044] Public IP address rate limiting refers to rate limiting policies set for public IP addresses. Rate limiting types include maximum bandwidth rate limiting, minimum bandwidth rate limiting, and DSCP (Differentiated Services Code Point). Public IP address rate limiting generally refers to maximum bandwidth rate limiting, which restricts the maximum public network bandwidth a user can use based on that public IP address. Users can subscribe to public IP addresses with different bandwidth specifications from the public cloud page, and then bind the public IP address to a specific network resource to achieve public network access rate limiting for that specific network resource.

[0045] Overlay networks are virtual networks built on top of existing physical networks (underlay networks). They use encapsulation technologies (such as VxLAN and NVGRE) to encapsulate raw data packets within new packets and add a virtual network identifier to the header of these new packets, thereby achieving logical isolation and communication across physical networks. Overlay networks offer flexible network topologies, support multi-tenant isolation, rapid deployment and migration, and are widely used in cloud computing, data centers, and other fields.

[0046] Underlay network: This is the physical network infrastructure that actually carries network traffic, including physical devices such as routers, switches, and fiber optic cables. Underlay network provides basic network connectivity and transmission capabilities and is the foundation for building overlay network.

[0047] Overlay traffic packets are data packets transmitted within an overlay network. These packets are encapsulated and contain information such as the original data packet and a virtual network identifier. Overlay traffic packets can be transmitted between different physical networks, achieving logical network isolation and communication.

[0048] Underlay traffic packets are raw data packets transmitted within the underlay network. These packets are not encapsulated by the overlay network. Underlay traffic packets are carried directly on the physical network and follow traditional network protocols and transmission mechanisms.

[0049] Meter tables are used in network devices (such as switches and routers) for traffic metering and control. They record traffic information passing through the device, such as traffic rate and volume. Meter tables are commonly used in scenarios such as traffic monitoring, traffic shaping, and traffic limiting to help network administrators better manage and control network traffic.

[0050] VRF (Virtual Routing Forwarding) is a network virtualization technology that allows the creation of multiple virtual router instances on a single physical router. Each virtual router instance has its own independent routing table, forwarding table, and interfaces, achieving routing isolation between different virtual networks. VRF is widely used in enterprise networks, data center networks, and other scenarios, supporting features such as multi-tenant isolation and network slicing.

[0051] VNI (Virtual Network Identifier): A unique identifier used to identify virtual networks within an overlay network. In encapsulation technologies such as VxLAN, the VNI is added to the header of the encapsulated data packet to distinguish between different virtual networks. The VNI achieves logical isolation between virtual networks, ensuring that traffic from different virtual networks does not interfere with each other.

[0052] VxLAN (Virtual eXtensible Local Area Network) is an overlay network encapsulation technology that extends the physical network by encapsulating raw Ethernet frames within UDP packets and adding a VNI identifier to the UDP header. VxLAN supports large-scale virtual network deployments and provides flexible network topologies and multi-tenant isolation capabilities.

[0053] BGP (Border Gateway Protocol) is an exterior gateway protocol used to exchange routing information between different Autonomous Systems (AS). It is one of the most important routing protocols on the Internet, responsible for maintaining the global Internet's routing tables. BGP supports advanced features such as route aggregation and routing policy control, and can handle large-scale network routing information.

[0054] An Autonomous System (AS) is a collection of networks managed by an organization or enterprise with a unified routing policy. Each AS has a unique AS number (ASN) for identification. ASs are the basic units of external gateway protocols such as BGP, used to enable the exchange and communication of routing information between different autonomous systems.

[0055] BFD (Bidirectional Forwarding Detection) is a protocol used for quickly detecting network faults. It detects network link connectivity by periodically sending detection packets and monitoring the round-trip time (RTT) of the packets. BFD has advantages such as fast detection speed and low overhead, and can quickly discover network faults and trigger mechanisms such as route convergence.

[0056] AZ (Availability Zone): An availability zone is a design feature in a cloud computing environment used to improve service availability and fault tolerance. It typically refers to a geographically isolated data center or server room area with its own power, cooling, and network infrastructure. By deploying services across multiple AZs, redundant backups and failover can be achieved, improving service reliability and availability.

[0057] PBR (Policy-Based Routing) is a routing technology that determines the forwarding path of data packets based on predefined policies. It allows network administrators to formulate different routing policies based on information such as the source address, destination address, and port number of data packets. PBR is widely used in scenarios such as traffic engineering, QoS assurance, and security policies, helping network administrators to more flexibly control the forwarding path of network traffic.

[0058] Please see Figure 1 , Figure 1 This is a flowchart illustrating a preferred embodiment of a network rate limiting method provided by the present invention. The network rate limiting method is applied to a rate limiting gateway, and the method includes:

[0059] S1, receive the current service traffic packet and determine the type of the current service traffic packet;

[0060] S2, If the current service traffic packet is an overlay traffic packet, then rate limit is applied to the matched inner source IP and destination IP.

[0061] S3, if the current service traffic packet is an underlay traffic packet, then rate limit is applied to the matching outer source IP and destination IP;

[0062] S4, receive the overlay traffic packets forwarded by the static VxLAN tunnel, and use route leakage technology to forward the overlay traffic packets to the underlay network.

[0063] Specifically, this embodiment of the invention implements rate limiting control for outbound and inbound cloud traffic through a rate limiting gateway. Upon receiving a current service traffic packet, the rate limiting gateway first determines the type of the packet. By parsing the packet encapsulation format: if a tunnel header (such as the 24-bit VNI field of VxLAN or the TNI field of NVGRE) is detected, it is determined to be overlay traffic; if no tunnel header is detected and the packet conforms to IP direct connection characteristics (such as TTL=255), it is determined to be underlay traffic. If the current service traffic packet is an overlay traffic packet, the rate limiting gateway will rate-limit the matching inner source IP and destination IP. If the current service traffic packet is an underlay traffic packet, the rate limiting gateway will rate-limit the matching outer source IP and destination IP. When the rate limiting gateway receives an overlay traffic packet forwarded through an outbound static VxLAN tunnel, it needs to match the default route within the VRF to effectively forward the traffic to the uplink device. However, in the prior art, the configuration of the default route relies on static routes, making it impossible to achieve linkage with underlay BGP and automatic route optimization. To overcome the aforementioned technical limitations, this invention employs route leakage technology to forward overlay traffic packets forwarded through a static VxLAN tunnel to the underlay network. This technology allows the rate-limiting gateway to dynamically match the default routes published by uplink devices via BGP, thereby achieving route linkage between the static VxLAN tunnel and the underlay BGP, resolving communication issues between the overlay and underlay networks, and ensuring packet transmission across different network layers. The overlay traffic packets forwarded through the static VxLAN tunnel refer to overlay traffic originating from within the cloud and transmitted to the rate-limiting gateway via a pre-configured (static) VxLAN tunnel. Service traffic packets encompass all service-related packets currently being transmitted in the network, potentially originating from various service sources, including but not limited to internal business systems and external clients. They are generated and transmitted anywhere in the network, without specific generation scenarios, only at the moment they are being processed and judged.

[0064] This invention employs a combined underlay and overlay rate limiting approach to decouple service traffic from the underlying underlay network devices, effectively improving rate limiting accuracy and network traffic security.

[0065] In another preferred embodiment, the step of rate limiting the matching inner source IP and destination IP if the current service traffic packet is an overlay traffic packet includes:

[0066] If the current service traffic packet is an overlay traffic packet, then the inner source IP matched by the overlay traffic packet is rate-limited according to the first Meter table;

[0067] Rate limiting is applied to the inner destination IP that matches the overlay traffic packets based on the second Meter table.

[0068] Specifically, to meet the requirement of simultaneously rate limiting the source IP and destination IP in scenarios where public IPs within the same availability zone interact, this embodiment of the invention designs a two-layer Meter table rate limiting architecture, optimizing the matching and forwarding logic of service traffic. If the current service traffic packet received by the rate limiting gateway is an overlay traffic packet, for example, an overlay traffic packet during public IP interaction within the same availability zone, then the rate limiting is first applied to the inner source IP matched by the overlay traffic packet according to the first Meter table, and then the rate limiting is applied to the inner destination IP matched by the overlay traffic packet according to the second Meter table.

[0069] The embodiments of this invention adopt a two-layer Meter table architecture, which enables mutual access with the public network of the AZ. Furthermore, the two-layer rate limiting architecture configures rate limiting for source IP and destination IP through independent Meter tables, ensuring that both can be effectively managed simultaneously during traffic control.

[0070] In another preferred embodiment, the step of rate limiting the matching outer source IP and destination IP if the current service traffic packet is an underlay traffic packet includes:

[0071] If the current service traffic packet is an underlay traffic packet, then the outer source IP matched by the underlay traffic packet is rate-limited according to the third Meter table;

[0072] Rate limiting is applied to the outer destination IP that matches the underlay traffic packets based on the fourth Meter table.

[0073] Specifically, in this embodiment of the invention, if the current service traffic packet received by the rate-limiting gateway is an underlay traffic packet, it first limits the rate of the outer source IP matched by the underlay traffic packet according to the third Meter table, and then limits the rate of the outer destination IP matched by the underlay traffic packet according to the fourth Meter table. This two-layer rate-limiting architecture configures rate limiting for both source and destination IPs through independent Meter tables, ensuring that both can be effectively managed simultaneously during traffic control.

[0074] In yet another preferred embodiment, the method further includes:

[0075] An intra-cloud overlay network is established between the rate-limiting gateway and the public network gateway, and different VRFs are used to isolate inbound and outbound traffic.

[0076] For details, please refer to Figure 2 , Figure 2 This is an interactive schematic diagram of a preferred embodiment of a network rate limiting method provided by the present invention. Addressing the problem that when there are detailed routes for two public IPs on a public network gateway, it is impossible to rate limit traffic between public IPs within the same availability zone. This embodiment of the invention establishes an intra-cloud overlay network between the rate limiting gateway and the public network gateway, using different VRFs to isolate inbound traffic (VRF is 1018, VNI is 1018) and outbound traffic (VRF is 1017, VNI is 1017), thereby achieving precise rate limiting for traffic between public IPs within the same availability zone. The intra-cloud overlay network refers to a logical network built on top of the physical network (underlay) using tunneling technology (such as VxLAN). The implementation steps of this embodiment include designing the overlay network architecture, configuring VRFs to handle different types of traffic, setting traffic rate limiting policies to ensure that inbound and outbound traffic are processed at a predetermined rate, and deploying monitoring tools to monitor traffic in real time to ensure the effectiveness of the rate limiting policies.

[0077] For example, isolation can be achieved through different VRFs and VNIs.

[0078] Inbound traffic: Create a VRF (e.g., VRF_IN, VNI 1018): All traffic coming from the Internet and destined for a public IP address within the cloud is tagged with VNI 1018 on both the rate limiting gateway and the public gateway.

[0079] Outbound traffic: Create another VRF (e.g., VRF_OUT, VNI 1017): All traffic originating from the cloud and destined for the Internet is tagged with VNI 1017 on both the rate limiting gateway and the public network gateway.

[0080] These two VRFs are route-isolated on the rate-limiting gateway, just like two completely independent routers.

[0081] After isolation, traffic between IPs is forced to be directional. For example, if IP-A accesses IP-B:

[0082] Traffic originating from IP-A is considered outbound traffic, enters VRF 1017, and is matched with IP-A's outbound rate limiting policy.

[0083] After the traffic reaches the node where IP-B is located, it is sent to the VRF 1018 of the inbound traffic and matched with IP-B's inbound rate limiting policy.

[0084] In this way, a single mutual access will consume the outbound bandwidth of the source IP and the inbound bandwidth of the destination IP respectively, thus achieving precise bidirectional rate limiting.

[0085] In yet another preferred embodiment, the step of receiving the overlay traffic packets forwarded by the static VxLAN tunnel, employing route leakage technology, forwards the overlay traffic packets to the underlay network, including:

[0086] Receive the overlay traffic packets forwarded by the static VxLAN tunnel;

[0087] The routing information corresponding to the static VxLAN tunnel is leaked into the routing table of the underlay network;

[0088] Based on the routing information in the routing table of the underlay network, the overlay traffic packets are forwarded to the underlay network.

[0089] Specifically, in this embodiment of the invention, when the rate-limiting gateway receives overlay traffic packets forwarded by a static VxLAN tunnel, it leaks the routing information corresponding to the static VxLAN tunnel into the routing table of the underlay network. This enables direct information copying and injection from one VRF routing table to another, ultimately allowing the chip to achieve high-performance cross-VRF data forwarding. Based on the routing information in the routing table of the underlay network, the overlay traffic packets are forwarded to the underlay network. For example, in a cloud outbound scenario, traffic needs to exit the cloud at the rate-limiting gateway. The VRF is leaked from the cloud outbound Vrf1017 to the default Vrf (default virtual route forwarding instance), which corresponds to the underlay network. The cloud outbound traffic then looks up a route in the default Vrf and exits the cloud based on the default route learned from the uplink device, thus achieving routing linkage between the cloud outbound static VxLAN tunnel and the underlay BGP.

[0090] In another preferred embodiment, the rate limiting gateway is connected to the uplink device in a fully interconnected manner, and the rate limiting gateway includes a primary rate limiting gateway and a backup rate limiting gateway, wherein the AS path length in the BGP route published by the primary rate limiting gateway is less than the AS path length in the BGP route published by the backup rate limiting gateway.

[0091] Specifically, in this embodiment of the invention, the rate-limiting gateway and the uplink device (i.e., the uplink egress device) are connected in a full mesh manner, and the rate-limiting gateway includes a primary rate-limiting gateway and a backup rate-limiting gateway, constructing a primary-backup architecture within the cluster. The primary-backup logic between devices is determined by the difference in the AS path length published by the BGP protocol. The backup rate-limiting gateway's BGP route AS path has one more local AS number than the primary rate-limiting gateway's AS path. According to the BGP AS routing principle, the route with the shortest AS path length is selected first. Here, an AS path refers to a list of all ASs that a data packet passes through from the source AS to the destination AS; the shorter the path, the higher the priority. This design effectively ensures that, under normal circumstances, public network traffic is forwarded and rate-limited only on the primary rate-limiting gateway, thereby improving network stability and traffic management efficiency. Furthermore, this primary-backup architecture also has failover capability. When the primary rate-limiting gateway fails, the backup rate-limiting gateway can quickly take over traffic forwarding and rate-limiting functions, ensuring the continuity and reliability of network services.

[0092] For example,

[0093] 1. Master device announcement: When the master rate limiting gateway publishes routes to the cloud intranet segment to the upstream egress device, it uses the normal AS_PATH, such as [AS_Limit_GW].

[0094] 2. Backup device announcement: When the backup rate-limiting gateway advertises routes in the same network segment, it pre-pends an additional AS number of itself in AS_PATH, for example, [AS_Limit_GW_Backup,AS_Limit_GW].

[0095] 3. BGP Routing: The uplink egress device receives both routes simultaneously. According to BGP routing rules, the route with the shorter AS_PATH takes precedence. Therefore, the route advertised by the master device (shorter path) is preferred, and all traffic is sent to the master rate-limiting gateway.

[0096] 4. Failover: When the primary device fails and the BGP session is interrupted, its advertised routes will disappear from the routing tables of the upstream devices. At this time, only the routes with longer paths advertised by the standby device remain, and traffic will automatically switch to the standby device.

[0097] The embodiments of the present invention adopt a primary-backup architecture, which can realize the switching of service traffic in seconds in the case of a single point of failure.

[0098] In yet another preferred embodiment, the method further includes:

[0099] Based on the BGP neighbor relationship of the uplink device, a corresponding BFD session is created;

[0100] Based on preset BFD detection parameters, detect whether the link between the main rate limiting gateway and the uplink device is faulty;

[0101] If the link failure is detected, the BGP neighbor relationship is triggered to become Down, and route convergence is accelerated to switch traffic to the backup rate-limiting gateway.

[0102] For details, please refer to Figure 3 , Figure 3 This is an interactive schematic diagram of another preferred embodiment of a network rate limiting method provided by the present invention. In this embodiment of the present invention, when the rate limiting gateway and the uplink device establish a BGP neighbor relationship, an additional corresponding BFD session is created, and the BFD session is bound to the corresponding BGP neighbor, so that BFD detection in both directions can be run simultaneously between the rate limiting gateway and the uplink egress device.

[0103] Gateway → Egress Device: Detects the uplink (such as the physical link from the gateway to the core router);

[0104] Outbound device → Gateway: Detects downlink (such as the return path from the core router to the gateway).

[0105] Then, based on preset BFD detection parameters, the link between the primary rate-limiting gateway and the uplink device is checked for failure. For example, the two parties negotiate the detection interval (e.g., 100ms) and the allowed number of packet losses (e.g., 3 times). If no BFD message is received for 3 consecutive times, the link is considered to be faulty. If a link failure is detected, the BGP neighbor relationship is triggered to become Down, route convergence is accelerated, the route of the primary rate-limiting gateway is revoked, the uplink egress device recalculates the route, and the traffic is switched to the backup rate-limiting gateway. Compared with native BGP, BFD reduces the fault detection time from 60 seconds to milliseconds and the route convergence time from seconds to sub-seconds.

[0106] This invention establishes a BGP + BFD fast fault detection mechanism between the rate limiting gateway and the uplink egress device. By introducing the BFD and BGP linkage function, a bidirectional status detection link is established between the two rate limiting gateway devices. Then, control messages are sent periodically at the negotiated time interval to detect the connectivity of the link, realizing second-level switching of service traffic in single-point failure scenarios.

[0107] Accordingly, the present invention also provides a network speed limiting device that can implement all the processes of the network speed limiting method in the above embodiments.

[0108] Please see Figure 4 , Figure 4 This is a schematic diagram of a preferred embodiment of a network speed limiting device provided by the present invention. The network speed limiting device is applied to a speed limiting gateway, and the device includes:

[0109] The message judgment module 401 is used to receive the current service traffic message and determine the type of the current service traffic message;

[0110] The first rate limiting module 402 is used to rate limit the matching inner source IP and destination IP if the current service traffic packet is an overlay traffic packet.

[0111] The second rate limiting module 403 is used to rate limit the matching outer source IP and destination IP if the current service traffic packet is an underlay traffic packet.

[0112] The packet forwarding module 404 is used to receive the overlay traffic packets forwarded by the static VxLAN tunnel, and to forward the overlay traffic packets to the underlay network using route leakage technology.

[0113] Preferably, if the current service traffic packet is an overlay traffic packet, then rate limiting is applied to the matched inner source IP and destination IP, including:

[0114] If the current service traffic packet is an overlay traffic packet, then the inner source IP matched by the overlay traffic packet is rate-limited according to the first Meter table;

[0115] Rate limiting is applied to the inner destination IP that matches the overlay traffic packets based on the second Meter table.

[0116] Preferably, if the current service traffic packet is an underlay traffic packet, then rate limiting is applied to the matching outer source IP and destination IP, including:

[0117] If the current service traffic packet is an underlay traffic packet, then the outer source IP matched by the underlay traffic packet is rate-limited according to the third Meter table;

[0118] Rate limiting is applied to the outer destination IP that matches the underlay traffic packets based on the fourth Meter table.

[0119] Preferably, the device further includes a flow isolation module, the flow isolation module being used for:

[0120] An intra-cloud overlay network is established between the rate-limiting gateway and the public network gateway, and different VRFs are used to isolate inbound and outbound traffic.

[0121] Preferably, the step of receiving the overlay traffic packets forwarded by the static VxLAN tunnel employs route leakage technology to forward the overlay traffic packets to the underlay network, including:

[0122] Receive the overlay traffic packets forwarded by the static VxLAN tunnel;

[0123] The routing information corresponding to the static VxLAN tunnel is leaked into the routing table of the underlay network;

[0124] Based on the routing information in the routing table of the underlay network, the overlay traffic packets are forwarded to the underlay network.

[0125] Preferably, the speed limiting gateway is connected to the uplink device in a fully interconnected manner, and the speed limiting gateway includes a primary speed limiting gateway and a backup speed limiting gateway, wherein the AS path length in the BGP route published by the primary speed limiting gateway is less than the AS path length in the BGP route published by the backup speed limiting gateway.

[0126] Preferably, the device further includes a fault detection module, the fault detection module being used for:

[0127] Based on the BGP neighbor relationship of the uplink device, a corresponding BFD session is created;

[0128] Based on preset BFD detection parameters, detect whether the link between the main rate limiting gateway and the uplink device is faulty;

[0129] If the link failure is detected, the BGP neighbor relationship is triggered to become Down, and route convergence is accelerated to switch traffic to the backup rate-limiting gateway.

[0130] In specific implementation, the working principle, control process and technical effects of the network speed limiting device provided in the embodiments of the present invention are the same as those of the network speed limiting method in the above embodiments, and will not be repeated here.

[0131] Please see Figure 5 , Figure 5 This is a schematic diagram of a preferred embodiment of a terminal device provided by the present invention. The terminal device includes a processor 501, a memory 502, and a computer program stored in the memory 502 and configured to be executed by the processor 501. When the processor 501 executes the computer program, it implements the network rate limiting method described in any of the above embodiments.

[0132] Preferably, the computer program can be divided into one or more modules / units (such as computer program 1, computer program 2, ...), and the one or more modules / units are stored in the memory 502 and executed by the processor 501 to complete the present invention. The one or more modules / units can be a series of computer program instruction segments capable of performing specific functions, and the instruction segments are used to describe the execution process of the computer program in the terminal device.

[0133] The processor 501 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor, or the processor 501 may be any conventional processor. The processor 501 is the control center of the terminal device, connecting various parts of the terminal device through various interfaces and lines.

[0134] The memory 502 mainly includes a program storage area and a data storage area. The program storage area can store the operating system, applications required for at least one function, etc., and the data storage area can store related data, etc. In addition, the memory 502 can be a high-speed random access memory, or a non-volatile memory, such as a plug-in hard disk, a smart media card (SMC), a secure digital card (SD), and a flash card, etc., or the memory 502 can also be other volatile solid-state storage devices.

[0135] It should be noted that the aforementioned terminal devices may include, but are not limited to, processors and memory, as will be understood by those skilled in the art. Figure 5 The structural diagram is merely an example of the terminal device described above and does not constitute a limitation on the terminal device described above. It may include more or fewer components than shown in the diagram, or combine certain components, or use different components.

[0136] This invention also provides a computer-readable storage medium, which includes a stored computer program, wherein the computer program, when running, controls the device where the computer-readable storage medium is located to execute the network rate limiting method described in any of the above embodiments.

[0137] This invention also provides a computer program product, which includes a computer program or computer instructions. When the computer program or computer instructions are executed by a processor, they implement the network rate limiting method described in any of the above embodiments.

[0138] This invention provides a network rate limiting method, apparatus, device, storage medium, and computer program product. It implements rate limiting control for outbound and inbound cloud traffic through a rate limiting gateway. Upon receiving a current service traffic packet, the rate limiting gateway first determines the type of the packet. If the packet is an overlay traffic packet, the gateway limits the rate of the matching inner source and destination IPs. If the packet is an underlay traffic packet, the gateway limits the rate of the matching outer source and destination IPs. When the gateway receives an overlay traffic packet forwarded via a static VxLAN tunnel, it uses route leakage technology to forward the packet to the underlay network. This invention designs a rate limiting and processing flow for public network service traffic packets. This flow significantly improves the accuracy of public network traffic rate limiting through precise rate limiting algorithms and efficient packet processing logic, and optimizes the port blocking matching logic, thereby effectively improving the flexibility and security of network traffic management.

[0139] It should be noted that the system embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Furthermore, in the accompanying drawings of the system embodiments provided by this invention, the connection relationships between modules indicate that they have communication connections, which can be specifically implemented as one or more communication buses or signal lines. Those skilled in the art can understand and implement this without any creative effort.

[0140] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A network speed limiting method, characterized in that, Applied to a rate-limiting gateway, the method includes: Receive the current service traffic packet and determine the type of the current service traffic packet; If the current service traffic packet is an overlay traffic packet, then rate limiting is applied to the matching inner source IP and destination IP. If the current service traffic packet is an underlay traffic packet, then rate limiting is applied to the matching outer source IP and destination IP; The overlay traffic packets forwarded by the static VxLAN tunnel are received, and the routing leakage technology is used to forward the overlay traffic packets to the underlay network. Specifically, the step of receiving the overlay traffic packets forwarded by the static VxLAN tunnel and using route leakage technology to forward the overlay traffic packets to the underlay network includes: Receive the overlay traffic packets forwarded by the static VxLAN tunnel; The routing information corresponding to the static VxLAN tunnel is leaked into the routing table of the underlay network; Based on the routing information in the routing table of the underlay network, the overlay traffic packets are forwarded to the underlay network.

2. The network rate limiting method as described in claim 1, characterized in that, If the current service traffic packet is an overlay traffic packet, then rate limiting is applied to the matched inner source IP and destination IP, including: If the current service traffic packet is an overlay traffic packet, then the inner source IP matched by the overlay traffic packet is rate-limited according to the first Meter table; Rate limiting is applied to the inner destination IP that matches the overlay traffic packets based on the second Meter table.

3. The network rate limiting method as described in claim 1, characterized in that, If the current service traffic packet is an underlay traffic packet, then rate limiting is applied to the matching outer source IP and destination IP, including: If the current service traffic packet is an underlay traffic packet, then the outer source IP matched by the underlay traffic packet is rate-limited according to the third Meter table; Rate limiting is applied to the outer destination IP that matches the underlay traffic packets based on the fourth Meter table.

4. The network rate limiting method as described in claim 2 or 3, characterized in that, The method further includes: An intra-cloud overlay network is established between the rate-limiting gateway and the public network gateway, and different VRFs are used to isolate inbound and outbound traffic.

5. The network rate limiting method as described in claim 1, characterized in that, The speed limiting gateway is connected to the uplink device in a fully interconnected manner, and the speed limiting gateway includes a primary speed limiting gateway and a backup speed limiting gateway. The AS path length in the BGP route published by the primary speed limiting gateway is less than the AS path length in the BGP route published by the backup speed limiting gateway.

6. The network rate limiting method as described in claim 5, characterized in that, The method further includes: Based on the BGP neighbor relationship of the uplink device, a corresponding BFD session is created; Based on preset BFD detection parameters, detect whether the link between the main rate limiting gateway and the uplink device is faulty; If the link failure is detected, the BGP neighbor relationship is triggered to become Down, and route convergence is accelerated to switch traffic to the backup rate-limiting gateway.

7. A network speed limiting device, characterized in that, The device, applied to a rate-limiting gateway, includes: The message judgment module is used to receive current service traffic messages and determine the type of the current service traffic messages; The first rate limiting module is used to rate limit the matching inner source IP and destination IP if the current service traffic packet is an overlay traffic packet. The second rate limiting module is used to rate limit the matching outer source IP and destination IP if the current service traffic packet is an underlay traffic packet. The packet forwarding module is used to receive the overlay traffic packets forwarded by the static VxLAN tunnel, and to forward the overlay traffic packets to the underlay network using route leakage technology; Specifically, the step of receiving the overlay traffic packets forwarded by the static VxLAN tunnel and using route leakage technology to forward the overlay traffic packets to the underlay network includes: Receive the overlay traffic packets forwarded by the static VxLAN tunnel; The routing information corresponding to the static VxLAN tunnel is leaked into the routing table of the underlay network; Based on the routing information in the routing table of the underlay network, the overlay traffic packets are forwarded to the underlay network.

8. A terminal device, characterized in that, The device includes a processor and a memory, the memory storing a computer program configured to be executed by the processor, wherein the processor, when executing the computer program, implements the network rate limiting method as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, wherein when the device containing the computer-readable storage medium executes the computer program, it implements the network rate limiting method as described in any one of claims 1 to 6.

10. A computer program product, characterized in that, The computer program product includes a computer program or computer instructions, which, when executed by a processor, implement the network rate limiting method as described in any one of claims 1 to 6.

Images