Terminal configuration-free network access method and device, electronic equipment and storage medium
By automatically assigning standardized IP addresses and identifying MAC addresses through gateway devices, the challenges of manpower consumption and security strategies in terminal device network upgrades are solved, enabling terminals to access the network without configuration, reducing costs and improving efficiency.
Patent Information
- Application Number
- CN202511290772.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-09-10
- Publication Date
- 2025-12-19
AI Technical Summary
In enterprise network upgrades, traditional solutions require modifying the static IP addresses of thousands of terminal devices one by one, resulting in high manpower consumption, high costs, and difficulty in uniformly deploying network boundary security policies, creating blind spots in security control.
The gateway device obtains the ARP request packets from the terminal, automatically assigns a standard IP address, and sends ARP reply packets, enabling the terminal to identify the MAC address of the gateway device. It then uses the address mapping table to replace the IP address in the data packets, generates a session table, and forwards the data packets, thus enabling the terminal to access the network without configuration.
Network replanning and deployment can be achieved without terminal configuration modifications, reducing costs, shortening implementation time, improving project implementation efficiency, and enhancing the unified deployment and execution efficiency of security policies.
Smart Images
Figure CN121173784A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of network architecture technology, and in particular to a method, apparatus, electronic device, and storage medium for terminal access to a network without configuration. Background Technology
[0002] In the current enterprise network upgrade process, traditional solutions require modifying the static IP addresses of each existing network terminal to achieve address standardization. This approach has the following significant drawbacks: When dealing with thousands of terminal devices, manually configuring IP addresses for each one would consume a lot of human resources. Especially for widely distributed dumb terminal devices, the maintenance team often needs to work across regions, resulting in an exponential increase in labor costs and high implementation costs.
[0003] Furthermore, the chaotic planning of terminal IP addresses makes it difficult to replan and implement them, which makes it difficult to uniformly deploy network boundary security strategies, effectively respond to changes, and easily create blind spots in security control. Summary of the Invention
[0004] In view of this, it is necessary to provide a method, apparatus, electronic device and storage medium for terminal network access without configuration, so as to solve the problem of how to reduce the cost of terminal network access and improve implementation efficiency.
[0005] To address the aforementioned problems, in a first aspect, the present invention provides a method for terminal access to a network without configuration, applied to a gateway device, comprising: The system acquires an ARP request packet sent by the terminal based on its first IP address and sends an ARP reply packet to the terminal; the ARP request packet contains the terminal's first MAC address and VLAN ID; the ARP reply packet contains the gateway device's second MAC address. When a data packet is received from a terminal and sent to the second MAC address, the first IP address of the data packet is replaced with the second IP address based on the address mapping table to obtain a modified data packet. The address mapping table is constructed based on the IP address, the first MAC address, the VLAN ID, and the second IP address. The second IP address is determined based on a preset address allocation strategy. A session table is generated based on the modified data packets, and the modified data packets are forwarded to external services; Upon receiving a return message from an external service with the destination address being the second IP address, the system determines the first IP address, the first MAC address, and the VLAN ID based on the session table and the address mapping table, and forwards the return message to the terminal.
[0006] In one possible implementation, determining the first IP address, the first MAC address, and the VLAN ID based on the session table and the address mapping table, and forwarding the return message to the terminal, includes: The first IP address is matched in the session table based on the second IP address; Based on the first IP address, determine the first MAC address and the VLAN ID in the address mapping table; The return message is forwarded to the terminal based on the first IP address, the first MAC address, and the VLAN ID.
[0007] In one possible implementation, the gateway device connects sequentially to the core switch, aggregation switch, access switch, and terminal via a TRUNK link.
[0008] In one possible implementation, the session table includes: First IP address, second IP address, transport layer port, destination IP address, destination port, and protocol type.
[0009] In one possible implementation, the preset address allocation strategy is a DHCP allocation strategy.
[0010] Secondly, the present invention also provides a method for a terminal to access a network without configuration, applied to a terminal, comprising: The terminal sends an ARP request message to the gateway device based on its first IP address and receives an ARP reply message from the gateway device; the ARP request message contains the terminal's first MAC address and VLAN ID; the ARP reply message contains the gateway device's second MAC address. A data packet is sent to the second MAC address; the first IP address of the data packet is replaced with the second IP address through an address mapping table to obtain a modified data packet; the address mapping table is constructed based on the IP address, the first MAC address, the VLAN ID, and the second IP address; the second IP address is determined based on a preset address allocation policy; the modified data packet is used to generate a session table, and the modified data packet is also used to forward to external services; The gateway device forwards a return message sent by an external service with the destination address being the second IP address; the return message is sent based on the first IP address, the first MAC address, and the VLAN ID determined by the session table and the address mapping table.
[0011] Thirdly, the present invention also provides an apparatus for terminal access to a network without configuration, comprising: The first sending unit is configured to acquire an ARP request packet sent by the terminal based on a first IP address, and send an ARP reply packet to the terminal; the ARP request packet contains the terminal's first MAC address and VLAN ID; the ARP reply packet contains the gateway device's second MAC address; The replacement unit is configured to, upon receiving a data packet sent by a terminal to the second MAC address, replace the first IP address of the data packet with the second IP address based on an address mapping table to obtain a modified data packet; the address mapping table is constructed based on the IP address, the first MAC address, the VLAN ID, and the second IP address; the second IP address is determined based on a preset address allocation strategy. The first forwarding unit is used to generate a session table based on the modified data packet and forward the modified data packet to an external service; The second forwarding unit is used to determine the first IP address, the first MAC address, and the VLAN ID based on the session table and the address mapping table when it receives a return message sent by an external service with the destination address being the second IP address, and then forwards the return message to the terminal.
[0012] Fourthly, the present invention also provides an apparatus for terminal access to a network without configuration, comprising: The second sending unit is configured to send an ARP request message to the gateway device based on the first IP address, and to receive an ARP reply message sent by the gateway device; the ARP request message contains the terminal's first MAC address and VLAN ID; the ARP reply message contains the gateway device's second MAC address. The third sending unit is used to send a data packet to the second MAC address; the data packet is modified by replacing the first IP address of the data packet with the second IP address through an address mapping table; the address mapping table is constructed based on the IP address, the first MAC address, the VLAN ID, and the second IP address; the second IP address is determined based on a preset address allocation policy; the modified data packet is used to generate a session table, and the modified data packet is also used to forward to external services; The receiving unit is used to receive a return message sent by an external service forwarded by the gateway device, with the destination address being the second IP address; the return message is sent based on the first IP address, the first MAC address, and the VLAN ID determined by the session table and the address mapping table.
[0013] Fifthly, the present invention also provides an electronic device, including a memory and a processor, wherein, The memory is used to store programs; The processor, coupled to the memory, is used to execute the program stored in the memory to implement the terminal configuration-free network access method described in any of the above implementations.
[0014] In a sixth aspect, the present invention also provides a computer-readable storage medium for storing a computer-readable program or instructions, which, when executed by a processor, can implement the steps of the terminal configuration-free network access method described in any of the above implementations.
[0015] The beneficial effects of this invention are as follows: The method, apparatus, electronic device, and storage medium for terminal network access without configuration provided by this invention involve a gateway device acquiring ARP request packets sent by the terminal, allocating a standardized second IP address to the terminal according to a preset address allocation strategy, and sending an ARP reply packet containing the second MAC address of the gateway device to the terminal. This enables the terminal to identify the second MAC address as the MAC address of the target service it needs to access. All subsequent access data packets are sent to this MAC address, allowing the gateway device to receive data packets sent by the terminal to this MAC address. The gateway device then uses an address mapping table to replace the first IP address of the data packet with the standardized second IP address, generates a session table based on the modified data packet, and forwards the modified data packet. Furthermore, when receiving a return packet with the destination address as the second IP address, the gateway device forwards the return packet to the terminal based on the session table. When using this method for network planning and transformation, the existing network can be re-planned and deployed without changing the original IP address on the terminal side. During implementation, only the relevant configuration of the gateway device needs to be adjusted. The terminal can access the network without any configuration modifications, avoiding large-scale equipment reconfiguration, reducing costs, greatly shortening the implementation period, and improving project implementation efficiency. Attached Figure Description
[0016] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0017] Figure 1 One of the schematic flowcharts of an embodiment of the terminal configuration-free network access method provided by the present invention; Figure 2 This is a schematic diagram of the system deployment environment provided by the present invention; Figure 3 A second schematic flowchart of an embodiment of the terminal configuration-free network access method provided by the present invention; Figure 4A schematic flowchart of an embodiment of the terminal configuration-free network access method provided by the present invention is shown in Figure 3. Figure 5 One of the structural schematic diagrams of an embodiment of the device for terminal network access without configuration provided by the present invention; Figure 6 A second schematic diagram of an embodiment of the device for terminal network access without configuration provided by the present invention; Figure 7 A schematic diagram of an embodiment of the electronic device provided by the present invention. Detailed Implementation
[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.
[0019] In the description of the embodiments of the present invention, unless otherwise stated, "multiple" means two or more. "And / or" describes the relationship between related objects, indicating that there can be three relationships. For example, A and / or B can represent three situations: A exists alone, A and B exist simultaneously, and B exists alone.
[0020] The terms "first," "second," etc., used in the embodiments of this invention are for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly specifying the number of technical features indicated. Therefore, a technical feature defined with "first" or "second" may explicitly or implicitly include at least one of that feature.
[0021] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of the invention. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.
[0022] This invention provides a method, apparatus, electronic device, and storage medium for terminal network access without configuration, which will be described below.
[0023] Figure 1 This is one of the flowcharts illustrating an embodiment of the terminal configuration-free network access method provided by the present invention, as shown below. Figure 1 As shown, the methods for terminal access to the network without configuration include: S101. Obtain the ARP request packet sent by the terminal based on the first IP address, and send an ARP reply packet to the terminal; the ARP request packet contains the terminal's first MAC address and VLAN ID; the ARP reply packet contains the gateway device's second MAC address; S102. Upon receiving a data packet sent by the terminal to the second MAC address, the first IP address of the data packet is replaced with the second IP address based on the address mapping table to obtain the modified data packet; the address mapping table is constructed based on the IP address, the first MAC address, the VLAN ID, and the second IP address; the second IP address is determined based on a preset address allocation strategy. S103. Generate a session table based on the modified data packet, and forward the modified data packet to an external service; S104. Upon receiving a return message from an external service with the destination address being the second IP address, determine the first IP address, the first MAC address, and the VLAN ID based on the session table and the address mapping table, and forward the return message to the terminal.
[0024] It should be noted that the execution subject of the terminal configuration-free access network method provided by the present invention can be a gateway device, also known as an inter-network connector or protocol converter, which is a computer system or device that provides data conversion services between multiple networks.
[0025] In S101, a dedicated gateway device is deployed in the core area of the network. This gateway device is interconnected with the core switch through a multi-VLAN trunk link (TRUNK) to ensure that the gateway device can identify the VLAN tag to which the terminal belongs and can receive broadcast messages sent by the terminal device.
[0026] When a terminal accesses the network using a static IP address (e.g., 192.168.1.100), the static IP address is the first IP address. It will broadcast an Address Resolution Protocol (ARP) request message, which carries its MAC address and VLAN tag, i.e., the first MAC address and VLAN ID.
[0027] The gateway device receives ARP request packets sent by the terminal through the TRUNK link and extracts the first MAC address and VLAN ID carried in the ARP request packet.
[0028] The gateway device automatically assigns a standardized IP address after network planning according to a preset address allocation policy. The standardized IP address is the second IP address.
[0029] The default address allocation policy can be a Dynamic Host Configuration Protocol (DHCP) allocation policy, which defines what IP address a terminal should be assigned. For example, a terminal originating from a certain VLAN range is assigned an address in the 192.168.1.0 / 24 range, or a terminal with a certain MAC address is bound to the fixed address 192.168.1.23, etc.
[0030] The gateway device establishes an address mapping table based on the first IP address, the first MAC address, the VLAN ID, and the second IP address. The address mapping table is used to indicate the mapping relationship between the first IP address, the first MAC address, the VLAN ID, and the second IP address.
[0031] The gateway device responds to the ARP request message with an active ARP reply message, returning an ARP reply message containing the second MAC address of the gateway device to the terminal.
[0032] By returning the second MAC address to the terminal, the terminal receives the ARP reply message and identifies the second MAC address of the gateway device as the MAC address of the target service it needs to access. All subsequent access data packets are sent to this MAC address.
[0033] In S102, the terminal sends the data packet to the second MAC address. The gateway device receives the data packet, queries the address mapping table, replaces the source IP of the data packet with the canonical IP, and obtains the modified data packet.
[0034] In S103, the modified data packets are forwarded from the gateway device via routing.
[0035] The gateway device generates a session table based on the modified data packets. This session table is a bidirectional session tracking table, which includes the first IP address, the second IP address, the transport layer port, the destination IP address, the destination port, and the protocol type.
[0036] In S104, when an external service returns a message with the destination address as the second IP address, the gateway device matches the associated original IP address through the session table, obtains the terminal's real MAC and VLAN information (i.e., the first MAC address and VLAN ID) by combining the address mapping table, restores the destination MAC address, and forwards the return message to the terminal.
[0037] In summary, the terminal configuration-free network access method provided by this embodiment of the invention involves a gateway device acquiring an ARP request packet sent by the terminal, allocating a standardized second IP address to the terminal according to a preset address allocation policy, and sending an ARP reply packet containing the second MAC address of the gateway device to the terminal. This enables the terminal to identify the second MAC address as the MAC address of the target service it needs to access. All subsequent access data packets are sent to this MAC address, allowing the gateway device to receive data packets sent by the terminal to this MAC address. The gateway device then uses an address mapping table to replace the first IP address of the data packet with the standardized second IP address, generates a session table based on the modified data packet, and forwards the modified data packet. Furthermore, when receiving a return packet with the destination address as the second IP address, the gateway device forwards the return packet to the terminal based on the session table. When using this method for network planning and transformation, the existing network can be re-planned and deployed without modifying the original IP address on the terminal side. Only the relevant configuration of the gateway device needs to be adjusted during implementation. The terminal can access the network without any configuration modifications, avoiding large-scale equipment reconfiguration, reducing costs, significantly shortening the implementation period, and improving project implementation efficiency.
[0038] In some embodiments of the present invention, determining the first IP address, the first MAC address, and the VLAN ID based on the session table and the address mapping table, and forwarding the return message to the terminal, includes: The first IP address is matched in the session table based on the second IP address; Based on the first IP address, determine the first MAC address and the VLAN ID in the address mapping table; The return message is forwarded to the terminal based on the first IP address, the first MAC address, and the VLAN ID.
[0039] When the gateway device receives a return message with a destination address that is a canonical IP address, it matches the corresponding original IP address through the session table entry, restores the destination MAC address by combining the four-dimensional mapping table, and forwards the message to the terminal.
[0040] For example, when an external service returns a return message with a destination address of the second IP address to the gateway device, the gateway device receives the return message.
[0041] The second IP address is used to match the associated original IP address, i.e., the first IP address, in the session table.
[0042] By combining the address mapping table, the terminal's real MAC and VLAN information, namely the first MAC address and VLAN ID, is obtained using the first IP address.
[0043] The second IP address is restored to the first IP address, and the destination MAC address is rewritten before being forwarded to the terminal, thus restoring the inbound traffic.
[0044] In some embodiments of the present invention, the gateway device is connected to the core switch, aggregation switch, access switch and terminal in sequence via a TRUNK link.
[0045] Figure 2 As shown in Figure 2, the system deployment environment provided by this invention is illustrated in the diagram. The gateway device is connected to the core switch, aggregation switch, access switch and terminal in sequence via the TRUNK link.
[0046] By deploying a dedicated gateway device in the core area of the network, which is interconnected with the core switch via a multi-VLAN trunk link (TRUNK), the gateway device can identify the VLAN tag to which the terminal belongs and receive broadcast messages sent by the terminal device.
[0047] In some embodiments of the present invention, the preset address allocation strategy is a DHCP allocation strategy.
[0048] The DHCP protocol simplifies network management by automatically assigning IP addresses and network parameters (such as subnet mask, default gateway, DNS server, etc.) and is suitable for large network environments.
[0049] Figure 3 A second schematic flowchart of an embodiment of the terminal configuration-free network access method provided by the present invention is shown below. Figure 3 As shown, the methods for terminal access to the network without configuration include: S301. Send an ARP request message to the gateway device based on the first IP address, and receive an ARP reply message sent by the gateway device; the ARP request message contains the terminal's first MAC address and VLAN ID; the ARP reply message contains the gateway device's second MAC address; S302. A data packet is sent to the second MAC address; the data packet is modified by replacing the first IP address of the data packet with the second IP address through an address mapping table; the address mapping table is constructed based on the IP address, the first MAC address, the VLAN ID, and the second IP address; the second IP address is determined based on a preset address allocation policy; the modified data packet is used to generate a session table, and the modified data packet is also used to forward to external services; S303. Receive a return message forwarded by the gateway device from an external service whose destination address is the second IP address; the return message is sent based on the first IP address, the first MAC address, and the VLAN ID determined by the session table and the address mapping table.
[0050] It should be noted that the execution subject of the terminal configuration-free network access method provided by the present invention can be a terminal.
[0051] In S301, a dedicated gateway device is deployed in the core area of the network. This gateway device is interconnected with the core switch through a multi-VLAN trunk link (TRUNK) to ensure that the gateway device can identify the VLAN tag to which the terminal belongs and can receive broadcast messages sent by the terminal device.
[0052] When a terminal accesses the network using a static IP address (e.g., 192.168.1.100), the static IP address is the first IP address. It will broadcast an Address Resolution Protocol (ARP) request message, which carries its MAC address and VLAN tag, i.e., the first MAC address and VLAN ID.
[0053] The gateway device receives ARP request packets sent by the terminal through the TRUNK link and extracts the first MAC address and VLAN ID carried in the ARP request packet.
[0054] The gateway device automatically assigns a standardized IP address based on the network planning according to a preset address allocation policy. This standardized IP address is the second IP address. The preset address allocation policy can be a DHCP allocation policy.
[0055] The gateway device establishes an address mapping table based on the first IP address, the first MAC address, the VLAN ID, and the second IP address. The address mapping table is used to indicate the mapping relationship between the first IP address, the first MAC address, the VLAN ID, and the second IP address.
[0056] The gateway device responds to the ARP request message with an active ARP reply message, returning an ARP reply message containing the second MAC address of the gateway device to the terminal.
[0057] By returning the second MAC address to the terminal, the terminal receives the ARP reply message and identifies the second MAC address of the gateway device as the MAC address of the target service it needs to access. All subsequent access data packets are sent to this MAC address.
[0058] In S302, the terminal sends a data packet to the second MAC address. The gateway device receives the data packet, queries the address mapping table, replaces the source IP of the data packet with the canonical IP, and obtains the modified data packet. The modified data packet is then forwarded from the gateway device via routing.
[0059] The gateway device generates a session table based on the modified data packets. This session table is a bidirectional session tracking table, which includes the first IP address, the second IP address, the transport layer port, the destination IP address, the destination port, and the protocol type.
[0060] In S303, when an external service returns a message with the destination address as the second IP address, the gateway device matches the associated original IP address through the session table, obtains the terminal's real MAC and VLAN information (i.e., the first MAC address and VLAN ID) by combining the address mapping table, restores the destination MAC address, and forwards the return message to the terminal.
[0061] In summary, the terminal configuration-free network access method provided by this embodiment of the invention involves a gateway device acquiring an ARP request packet sent by the terminal, allocating a standardized second IP address to the terminal according to a preset address allocation policy, and sending an ARP reply packet containing the second MAC address of the gateway device to the terminal. This enables the terminal to identify the second MAC address as the MAC address of the target service it needs to access. All subsequent access data packets are sent to this MAC address, allowing the gateway device to receive data packets sent by the terminal to this MAC address. The gateway device then uses an address mapping table to replace the first IP address of the data packet with the standardized second IP address, generates a session table based on the modified data packet, and forwards the modified data packet. Furthermore, when receiving a return packet with the destination address as the second IP address, the gateway device forwards the return packet to the terminal based on the session table. When using this method for network planning and transformation, the existing network can be re-planned and deployed without modifying the original IP address on the terminal side. Only the relevant configuration of the gateway device needs to be adjusted during implementation. The terminal can access the network without any configuration modifications, avoiding large-scale equipment reconfiguration, reducing costs, significantly shortening the implementation period, and improving project implementation efficiency.
[0062] Figure 4 A schematic flowchart of an embodiment of the terminal configuration-free network access method provided by the present invention is shown below. Figure 4 As shown, a method for a terminal to access a network without configuration includes the following steps: S401. The gateway device receives ARP request packets sent by the terminal through the TRUNK link and extracts the terminal source MAC address and VLAN tag carried in the packet. S402. Based on the preset address allocation strategy, dynamically allocate a standard IP address to the terminal and establish a terminal address mapping table entry containing the original IP address, MAC address, VLAN ID, and standard IP address; S403. Send an ARP reply message to the terminal, so that the terminal will send subsequent data packets to the MAC address of the gateway device; S404. Receive data packets sent by the terminal, replace the source IP address of the packet with the canonical IP address according to the terminal address mapping table, generate a session table entry containing the original IP, canonical IP, transport layer port, destination IP, destination port and protocol type, and forward the modified packet. S405. Receive a return message with a destination address of a canonical IP address, match the corresponding original IP address through the session table entry, restore the destination MAC address by combining the four-dimensional mapping table, and forward the message to the terminal.
[0063] This invention proposes a gateway-level transparent address translation mechanism, which has the following advantages: (1) Zero modification to the terminal, retaining the original static IP settings of the terminal and avoiding large-scale device reconfiguration. (2) Dynamic address standardization, through intelligent gateways automatically generating IP addresses that conform to network planning based on terminal identity, type and other policies. (3) Unified policies across the entire domain, implementing cross-network segment access control based on the standardized IP after conversion, solving the problem of policy fragmentation.
[0064] For example, the method for terminal network access without configuration provided by the present invention will be described in detail below with reference to specific scenarios: 1. System deployment environment.
[0065] Dedicated gateway devices are deployed in the core area of the network. These devices are interconnected with the core switches via multi-VLAN trunk links (TRUNK) to ensure that the gateway devices can identify the VLAN tags of the terminals and receive broadcast messages sent by the terminal devices.
[0066] 2. Implement process analysis.
[0067] 2.1 Terminal network access initialization.
[0068] When a terminal using a static IP (e.g., 192.168.1.100) accesses the network, it broadcasts an ARP request message, which carries its MAC address and VLAN tag.
[0069] 2.2 Automatic address mapping.
[0070] After the gateway device detects the ARP request, it extracts the terminal's source MAC address (e.g., AA:AA:AA:AA:AA:AA). Automatically assign standardized IP addresses (such as 10.100.20.50) based on pre-set policies (which can be based on terminal MAC or DHCP address policies) after network planning. Pre-configured policies refer to DHCP allocation policies, which define what IP address a terminal should be assigned. For example, a terminal originating from a certain VLAN range is assigned an address in the 192.168.1.0 / 24 range, or a terminal with a certain MAC address is bound to the fixed address 192.168.1.23, etc.
[0071] A terminal address mapping table (ARP table) is established, and the records in this table are shown in Table 1.
[0072] Table 1: Address Mapping Table
[0073] 2.3 Traffic forwarding processing mechanism.
[0074] The gateway responds to this ARP request with an active ARP reply, returning the gateway device's MAC address to the terminal. This operation enables the terminal to recognize the gateway's MAC address as the MAC address of the target service it needs to access, and all subsequent access data packets are sent to that MAC address.
[0075] 2.4 Outbound traffic conversion.
[0076] The gateway received the original data packet from the terminal (source IP=192.168.1.100). Query the address mapping table and replace the source IP with the canonical IP 10.100.20.50; Generate a two-way session tracking table; typical entries are shown in Table 2.
[0077] Table 2: Session Table
[0078] The converted message is forwarded from the gateway via routing.
[0079] 2.5. Inbound traffic restoration.
[0080] When the external service returns a data packet (destination IP=10.100.20.50) to the gateway; Match the associated original IP address (192.168.1.100) through the session table. The terminal's actual MAC address and VLAN information are obtained by combining the address mapping table (ARP table); Restore the destination IP to 192.168.1.100, rewrite the destination MAC address, and then forward it to the terminal.
[0081] The method for terminal network access without configuration provided by this invention is a method for achieving configuration-free adaptive access of terminal devices in a flat network architecture. It is particularly suitable for the rapid network transformation of large-scale dumb terminal devices in scenarios such as Industrial Internet of Things (IIoT), medical equipment, and production control systems. It effectively solves the implementation problem of terminal IP address standardization in traditional solutions and has the following beneficial effects: 1. Improved project efficiency: When using this method for network planning and transformation, the existing network can be re-planned and deployed without changing the original IP address on the terminal side. Only the relevant configuration of the gateway device needs to be adjusted during implementation. No configuration modification is required on the terminal, which greatly shortens the implementation period and improves the efficiency of project implementation.
[0082] 2. Enhanced security management: Through standardized IP address management, administrators can uniformly plan and deploy the network based on terminal identity, classification, location, and other characteristics. This enables the boundary side to formulate and manage security policies more efficiently according to the planned IPs, greatly ensuring the continued effectiveness and environmental adaptability of security policies.
[0083] To better implement the terminal configuration-free network access method in this embodiment of the invention, based on the terminal configuration-free network access method, correspondingly, as follows: Figure 5 As shown, this embodiment of the invention also provides a device for terminal network access without configuration. The device 500 for terminal network access without configuration includes: The first sending unit 501 is used to acquire an ARP request packet sent by the terminal based on the first IP address, and send an ARP reply packet to the terminal; the ARP request packet contains the terminal's first MAC address and VLAN ID; the ARP reply packet contains the gateway device's second MAC address; The replacement unit 502 is used to replace the first IP address of the data packet with the second IP address based on the address mapping table when a data packet sent by the terminal to the second MAC address is received, thereby obtaining a modified data packet; the address mapping table is constructed based on the IP address, the first MAC address, the VLAN ID, and the second IP address; the second IP address is determined based on a preset address allocation strategy. The first forwarding unit 503 is used to generate a session table based on the modified data packet and forward the modified data packet to an external service; The second forwarding unit 504 is configured to, upon receiving a return message from an external service with a destination address of the second IP address, determine the first IP address, the first MAC address, and the VLAN ID based on the session table and the address mapping table, and forward the return message to the terminal. The terminal-configuration-free network access device 500 provided in the above embodiments can implement the technical solutions described in the embodiments where the execution subject of the terminal-configuration-free network access method is a gateway device. The specific implementation principles of each of the above units or units can be found in the corresponding content of the above embodiments of the terminal-configuration-free network access method, and will not be repeated here.
[0084] To better implement the terminal configuration-free network access method in this embodiment of the invention, based on the terminal configuration-free network access method, correspondingly, as follows: Figure 6 As shown, this embodiment of the invention also provides a device for terminal network access without configuration. The device 600 for terminal network access without configuration includes: The second sending unit 601 is configured to send an ARP request message to the gateway device based on the first IP address, and receive an ARP reply message sent by the gateway device; the ARP request message contains the terminal's first MAC address and VLAN ID; the ARP reply message contains the gateway device's second MAC address. The third sending unit 602 is used to send a data packet to the second MAC address; the data packet is modified by replacing the first IP address of the data packet with the second IP address through an address mapping table; the address mapping table is constructed based on the IP address, the first MAC address, the VLAN ID, and the second IP address; the second IP address is determined based on a preset address allocation policy; the modified data packet is used to generate a session table, and the modified data packet is also used to forward to external services; The receiving unit 603 is used to receive a return message sent by an external service forwarded by the gateway device, with the destination address being the second IP address; the return message is sent based on the first IP address, the first MAC address, and the VLAN ID determined by the session table and the address mapping table.
[0085] The device 600 for terminal access to the network without configuration provided in the above embodiments can implement the technical solutions described in the embodiments where the execution subject of the method for terminal access to the network without configuration is the terminal. The specific implementation principles of each unit or unit can be found in the corresponding content in the embodiments of the method for terminal access to the network without configuration, and will not be repeated here.
[0086] like Figure 7As shown, the present invention also provides an electronic device 700. The electronic device 700 includes a processor 701, a memory 702, and a display 703. Figure 7 Only some components of the electronic device 700 are shown, but it should be understood that it is not required to implement all the components shown, and more or fewer components may be implemented instead.
[0087] In some embodiments, processor 701 may be a central processing unit (CPU), microprocessor, or other data processing chip, used to run program code stored in memory 702 or process data, such as the terminal configuration-free access network method of the present invention.
[0088] In some embodiments, processor 701 may be a single server or a group of servers. The server group may be centralized or distributed. In some embodiments, processor 701 may be local or remote. In some embodiments, processor 701 may be implemented on a cloud platform. In some embodiments, the cloud platform may include a private cloud, public cloud, hybrid cloud, community cloud, distributed cloud, internal cloud, multi-cloud, or any combination thereof.
[0089] In some embodiments, memory 702 may be an internal storage unit of electronic device 700, such as a hard disk or memory of electronic device 700. In other embodiments, memory 702 may also be an external storage device of electronic device 700, such as a plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, etc. equipped on electronic device 700.
[0090] Furthermore, the memory 702 may include both internal storage units of the electronic device 700 and external storage devices. The memory 702 is used to store application software and various types of data installed on the electronic device 700.
[0091] In some embodiments, display 703 may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, or an organic light-emitting diode (OLED) touchscreen. Display 703 is used to display information from electronic device 700 and to display a visual user interface. Components 701-703 of electronic device 700 communicate with each other via a system bus.
[0092] In one embodiment, when the processor 701 executes the program for terminal network access without configuration stored in the memory 702, the following steps can be implemented: The system acquires an ARP request packet sent by the terminal based on its first IP address and sends an ARP reply packet to the terminal; the ARP request packet contains the terminal's first MAC address and VLAN ID; the ARP reply packet contains the gateway device's second MAC address. When a data packet is received from a terminal and sent to the second MAC address, the first IP address of the data packet is replaced with the second IP address based on the address mapping table to obtain a modified data packet. The address mapping table is constructed based on the IP address, the first MAC address, the VLAN ID, and the second IP address. The second IP address is determined based on a preset address allocation strategy. A session table is generated based on the modified data packets, and the modified data packets are forwarded to external services; Upon receiving a return message from an external service with the destination address being the second IP address, the system determines the first IP address, the first MAC address, and the VLAN ID based on the session table and the address mapping table, and forwards the return message to the terminal.
[0093] or, The terminal sends an ARP request message to the gateway device based on its first IP address and receives an ARP reply message from the gateway device; the ARP request message contains the terminal's first MAC address and VLAN ID; the ARP reply message contains the gateway device's second MAC address. A data packet is sent to the second MAC address; the first IP address of the data packet is replaced with the second IP address through an address mapping table to obtain a modified data packet; the address mapping table is constructed based on the IP address, the first MAC address, the VLAN ID, and the second IP address; the second IP address is determined based on a preset address allocation policy; the modified data packet is used to generate a session table, and the modified data packet is also used to forward to external services; The gateway device forwards a return message sent by an external service with the destination address being the second IP address; the return message is sent based on the first IP address, the first MAC address, and the VLAN ID determined by the session table and the address mapping table.
[0094] It should be understood that when the processor 701 executes the program for terminal network access without configuration in the memory 702, in addition to the functions mentioned above, it can also perform other functions, as can be found in the description of the corresponding method embodiments above.
[0095] Furthermore, the embodiments of the present invention do not specifically limit the type of electronic device 700 mentioned. Electronic device 700 can be a mobile phone, tablet computer, personal digital assistant (PDA), wearable device, laptop computer, or other portable electronic device. Exemplary embodiments of portable electronic devices include, but are not limited to, portable electronic devices running iOS, Android, Microsoft, or other operating systems. The aforementioned portable electronic device can also be other portable electronic devices, such as a laptop computer with a touch-sensitive surface (e.g., a touch panel). It should also be understood that in some other embodiments of the present invention, electronic device 700 may not be a portable electronic device, but rather a desktop computer with a touch-sensitive surface (e.g., a touch panel).
[0096] Accordingly, embodiments of the present invention also provide a computer-readable storage medium for storing computer-readable programs or instructions. When the programs or instructions are executed by a processor, they can implement the steps or functions of the terminal configuration-free network access methods provided in the above-described method embodiments.
[0097] Those skilled in the art will understand that all or part of the processes of the methods described in the above embodiments can be implemented by a computer program instructing related hardware (such as a processor, controller, etc.), and the computer program can be stored in a computer-readable storage medium. The computer-readable storage medium may be a disk, optical disk, read-only memory, or random access memory, etc.
[0098] The method, apparatus, electronic device, and storage medium for terminal network access without configuration provided by the present invention have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.
Claims
1. A method for terminal access to a network without configuration, characterized in that, Applied to gateway devices, including: The system acquires an ARP request packet sent by the terminal based on its first IP address and sends an ARP reply packet to the terminal; the ARP request packet contains the terminal's first MAC address and VLAN ID; the ARP reply packet contains the gateway device's second MAC address. When a data packet is received from a terminal and sent to the second MAC address, the first IP address of the data packet is replaced with the second IP address based on the address mapping table to obtain a modified data packet. The address mapping table is constructed based on the IP address, the first MAC address, the VLAN ID, and the second IP address. The second IP address is determined based on a preset address allocation strategy. A session table is generated based on the modified data packets, and the modified data packets are forwarded to external services; Upon receiving a return message from an external service with the destination address being the second IP address, the system determines the first IP address, the first MAC address, and the VLAN ID based on the session table and the address mapping table, and forwards the return message to the terminal.
2. The method for terminal access to the network without configuration according to claim 1, characterized in that, The step of determining the first IP address, the first MAC address, and the VLAN ID based on the session table and the address mapping table, and forwarding the return message to the terminal, includes: The first IP address is matched in the session table based on the second IP address; Based on the first IP address, determine the first MAC address and the VLAN ID in the address mapping table; The return message is forwarded to the terminal based on the first IP address, the first MAC address, and the VLAN ID.
3. The method for terminal access to the network without configuration according to claim 1, characterized in that, The gateway device connects to the core switch, aggregation switch, access switch and terminal in sequence via TRUNK links.
4. The method for terminal access to the network without configuration according to claim 1, characterized in that, The session table contains: First IP address, second IP address, transport layer port, destination IP address, destination port, and protocol type.
5. The method for terminal access to the network without configuration according to claim 1, characterized in that, The preset address allocation strategy is the DHCP allocation strategy.
6. A method for terminal access to a network without configuration, characterized in that, Applied to terminals, including: The terminal sends an ARP request message to the gateway device based on its first IP address and receives an ARP reply message from the gateway device; the ARP request message contains the terminal's first MAC address and VLAN ID; the ARP reply message contains the gateway device's second MAC address. A data packet is sent to the second MAC address; the first IP address of the data packet is replaced with the second IP address through an address mapping table to obtain a modified data packet; the address mapping table is constructed based on the IP address, the first MAC address, the VLAN ID, and the second IP address; the second IP address is determined based on a preset address allocation policy; the modified data packet is used to generate a session table, and the modified data packet is also used to forward to external services; The gateway device forwards a return message sent by an external service with the destination address being the second IP address; the return message is sent based on the first IP address, the first MAC address, and the VLAN ID determined by the session table and the address mapping table.
7. A device for enabling terminal to access a network without configuration, characterized in that, include: The first sending unit is used to acquire the ARP request message sent by the terminal based on the first IP address, and send the ARP reply message to the terminal. The ARP request message contains the terminal's first MAC address and VLAN ID; the ARP reply message contains the gateway device's second MAC address. The replacement unit is configured to, upon receiving a data packet sent by a terminal to the second MAC address, replace the first IP address of the data packet with the second IP address based on an address mapping table to obtain a modified data packet; the address mapping table is constructed based on the IP address, the first MAC address, the VLAN ID, and the second IP address; the second IP address is determined based on a preset address allocation strategy. The first forwarding unit is used to generate a session table based on the modified data packet and forward the modified data packet to an external service; The second forwarding unit is used to determine the first IP address, the first MAC address, and the VLAN ID based on the session table and the address mapping table when it receives a return message sent by an external service with the destination address being the second IP address, and then forwards the return message to the terminal.
8. A device for terminal network access without configuration, characterized in that, include: The second sending unit is used to send an ARP request message to the gateway device based on the first IP address, and to receive an ARP reply message sent by the gateway device. The ARP request message contains the terminal's first MAC address and VLAN ID; the ARP reply message contains the gateway device's second MAC address. The third sending unit is used to send data packets to the second MAC address; The data packet is modified by replacing the first IP address of the data packet with the second IP address through an address mapping table; the address mapping table is constructed based on the IP address, the first MAC address, the VLAN ID, and the second IP address; the second IP address is determined based on a preset address allocation policy; the modified data packet is used to generate a session table, and the modified data packet is also used to forward to external services; The receiving unit is used to receive a return message sent by an external service forwarded by the gateway device, with the destination address being the second IP address; The return message is sent based on the first IP address, the first MAC address, and the VLAN ID determined by the session table and the address mapping table.
9. An electronic device, characterized in that, Including memory and processor, among which, The memory is used to store programs; The processor, coupled to the memory, is used to execute the program stored in the memory to implement the steps in the terminal configuration-free access network method as described in any one of claims 1 to 6.
10. A computer-readable storage medium, characterized in that, Used to store computer-readable programs or instructions, which, when executed by a processor, can implement the steps of the terminal configuration-free access network method according to any one of claims 1 to 6.