Binding method and device of intra-cloud gateway, equipment, storage medium and program product

Abstract

The invention relates to an intra-cloud gateway binding method and device, equipment, a storage medium and a program product. The method comprises: in response to a message that a target gateway is bound to a virtual private cloud gateway, starting a GAC function of a target interface, the target interface being an interface of a target network element logically direct to the target gateway; binding a hardware address corresponding to an internet protocol (IP) address under the target interface; when the hardware address in the ARP message received by the target interface is different from the bound hardware address, discarding the ARP message received by the target interface; and calling an SDN controller interface to bind the target gateway and the virtual private cloud gateway. By adopting the method, passive updating of the ARP table on the internet element in the binding process of the gateway in the cloud can be prevented.

Description

Technical Field

[0001] This application relates to the field of cloud computing technology, and in particular to a binding method, apparatus, device, storage medium, and program product for a cloud gateway. Background Technology

[0002] In cloud networks, cloud gateways are divided into tenant-level Tenant Gateways (TGWs) and Virtual Private Cloud Gateways (VPCGWs) at the Virtual Private Cloud (VPC) level. TGWs often need to carry the north-south and east-west traffic of the entire tenant. As the size of the VPC within the tenant or the size of a single VPC within the tenant increases, the pressure on the TGW also increases.

[0003] In related technologies, VPCs within a TGW are migrated to a VPCGW. To achieve a seamless migration for users, the VPCGW is first bound to the TGW before activation. However, when the VPCGW is bound, the Address Resolution Protocol (ARP) table on the Internet element is updated. For example, the physical address of the interconnection interface between other TGWs and the bound TGW in the ARP table is updated. This can cause return traffic from the bound TGW to other TGWs to be sent to the VPCGW cluster by those other TGWs, resulting in inconsistent traffic paths. Currently, there is no effective way to prevent passive updates to the ARP table on the Internet element during the binding process of cloud gateways. Summary of the Invention

[0004] Therefore, it is necessary to provide a cloud gateway binding method, apparatus, device, storage medium, and program product that can prevent passive updates of the ARP table on the Internet element during the cloud gateway binding process, in order to address the above-mentioned technical problems.

[0005] Firstly, this application provides a method for binding a cloud gateway, including:

[0006] In response to the message that the target gateway is bound to the virtual private cloud gateway, the GAC function of the target interface is enabled. The target interface is the interface of the target network element that is logically directly connected to the target gateway.

[0007] Bind the hardware address corresponding to the Internet Protocol IP address under the target interface;

[0008] If the hardware address in the ARP packet received by the target interface is different from the bound hardware address, the ARP packet received by the target interface shall be discarded.

[0009] Call the SDN controller interface to bind the target gateway to the virtual private cloud gateway.

[0010] In one embodiment, after binding the hardware address corresponding to the Internet Protocol IP address under the target interface, the method further includes:

[0011] If the hardware address in the ARP packet received by the target interface is the same as the bound hardware address, the information in the ARP packet is updated in the ARP table entry of the target interface.

[0012] In one embodiment, after enabling the GAC function of the target interface, the method further includes:

[0013] Generate the GAC entry corresponding to the target network element;

[0014] The GAC entry includes at least one of the following: the interface identifier of the target interface, the enabled state of the GAC function of the target interface, the IP address bound to the target interface, and the hardware address bound to the target interface.

[0015] In one embodiment, after enabling the GAC function of the target interface, the method further includes:

[0016] Start the GAC timer corresponding to the target interface;

[0017] If the GAC timer times out, an ARP request is sent to the bound IP address;

[0018] Receive the current hardware address corresponding to the bound IP address.

[0019] In one embodiment, after receiving the information of the current hardware address corresponding to the bound IP address, the method further includes:

[0020] If the current hardware address is different from the bound hardware address, then the GAC function of the target interface is disabled and an alarm message is triggered;

[0021] If the current hardware address is the same as the bound hardware address, refresh the GAC timer.

[0022] In one embodiment, the target interface includes at least one of the following: a virtual scalable LAN tunnel interface, a loopback interface, and a physical interface.

[0023] Secondly, this application also provides a binding device for a cloud gateway, comprising:

[0024] The enabling module is used to enable the GAC function of the target interface in response to the message that the target gateway is bound to the virtual private cloud gateway. The target interface is the interface of the target network element that is logically direct with the target gateway.

[0025] The address binding module is used to bind the hardware address corresponding to the Internet Protocol IP address under the target interface;

[0026] The comparison module is used to discard the ARP packet received by the target interface if the hardware address in the ARP packet received by the target interface is different from the bound hardware address.

[0027] The gateway binding module is used to call the SDN controller interface to bind the target gateway to the virtual private cloud gateway.

[0028] In one embodiment, the comparison module is further configured to update the information in the ARP packet in the ARP table entry of the target interface if the hardware address in the ARP packet received by the target interface is the same as the bound hardware address.

[0029] In one embodiment, the enabling module is further configured to generate a GAC ​​entry corresponding to the target network element;

[0030] The GAC entry includes at least one of the following: the interface identifier of the target interface, the enabled state of the GAC function of the target interface, the IP address bound to the target interface, and the hardware address bound to the target interface.

[0031] In one embodiment, the enabling module is further configured to start the GAC timer corresponding to the target interface; if the GAC timer times out, send an ARP request to the bound IP address; and receive the current hardware address corresponding to the bound IP address.

[0032] In one embodiment, the enabling module is further configured to, if the current hardware address is different from the bound hardware address, disable the GAC function of the target interface and trigger an alarm message; and refresh the GAC timer if the current hardware address is different from the bound hardware address.

[0033] In one embodiment, the target interface includes at least one of the following: a virtual scalable LAN tunnel interface, a loopback interface, and a physical interface.

[0034] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the cloud gateway binding method of the first aspect described above.

[0035] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the cloud gateway binding method described in the first aspect.

[0036] Fifthly, this application also provides a computer program product, including a computer program that, when executed by a processor, implements the cloud gateway binding method described in the first aspect.

[0037] The aforementioned cloud gateway binding method, device, equipment, storage medium, and program products, in response to a message indicating that a target gateway is binding to a virtual private cloud gateway, enable the GAC function of the target interface, where the target interface is the interface of the target network element logically directly connected to the target gateway; bind the hardware address corresponding to the Internet Protocol (IP) address under the target interface; discard the ARP packets received by the target interface if the hardware address is different from the bound hardware address; and call the SDN controller interface to bind the target gateway and the virtual private cloud gateway. Because the GAC function of the target interface of the target network element logically directly connected to the bound target gateway is enabled during cloud gateway binding, the target interface will discard ARP packets with addresses different from the bound hardware address, effectively preventing passive updates to the ARP table on the Internet element during the cloud gateway binding process. Attached Figure Description

[0038] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0039] Figure 1 This is a schematic diagram of the cloud network architecture in related technologies;

[0040] Figure 2 This is a traffic exchange path diagram for peer-to-peer connection services between two TGWs in related technologies;

[0041] Figure 3 This is a schematic diagram illustrating the passive updating of the ARP table on the Internet element when a VPCGW gateway is bound in related technologies.

[0042] Figure 4 A flowchart illustrating a cloud gateway binding method provided in an embodiment of this application;

[0043] Figure 5 A schematic diagram of a GAC ​​entry provided in an embodiment of this application;

[0044] Figure 6 A flowchart illustrating another cloud gateway binding method provided in this application embodiment;

[0045] Figure 7 A structural block diagram of a cloud gateway binding device provided in an embodiment of this application;

[0046] Figure 8 This is an internal structural diagram of a computer device provided in an embodiment of this application. Detailed Implementation

[0047] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0048] The name will be explained first.

[0049] The Internet Protocol (IP) is a network layer protocol in the Transmission Control Protocol (TCP) / IP architecture.

[0050] Software-defined networking (SDN) is a method of network virtualization. SDN's core technology, OpenFlow, separates the control plane from the data plane of network devices, thereby enabling flexible control of network traffic and making the network more intelligent as a conduit, providing a good platform for innovation in core networks and applications.

[0051] A virtual machine (VM) is a complete computer system simulated by software, possessing full hardware system functionality and running in a completely isolated environment.

[0052] A Media Access Control Address (MAC), LAN Address, Ethernet Address, or Physical Address is an address used to identify the location of a network device.

[0053] Address Resolution Protocol (ARP) is a TCP / IP protocol that obtains the physical address based on the IP address.

[0054] A Virtual Private Cloud Gateway (VPCGW) is a VPC gateway that allows users to create a logically isolated, private network space in a public cloud environment.

[0055] A Tenant Gateway (TGW) is a gateway shared by a single tenant in a cloud network.

[0056] Virtual Extensible Local Area Network (VXLAN) is a network virtualization technology that improves scalability during large-scale cloud deployments. It is an extension of Virtual Local Area Network (VLAN). VXLAN is a powerful tool that can extend Layer 2 networks by penetrating Layer 3.

[0057] A virtual switch (Open vSwitch, OVS) is a type of switch that exists as software in a virtual network.

[0058] The relevant technologies are explained below.

[0059] In cloud networks, cloud gateways are divided into tenant-level Tenant Gateways (TGW) and Virtual Private Cloud Gateways (VPCGW) at the Virtual Private Cloud (VPC) level. Figure 1 This is a schematic diagram of the cloud network architecture in related technologies, such as... Figure 1 As shown, TGW often needs to carry the north-south and east-west traffic of the entire tenant. As the size of the VPC within the tenant or the size of a single VPC within the tenant increases, the pressure on TGW also increases.

[0060] In related technologies, VPCs within a TGW are migrated to a VPCGW. To achieve a seamless migration for users, the VPCGW is first bound to the TGW, and then the VPCGW is activated. For example, binding the VPCGW to the TGW essentially means that the SDN controller assigns the same service configuration to both the VPCGW and the TGW, but the OVS traffic is not refreshed at this point; the traffic still goes through the TGW. Activating the VPCGW, on the other hand, allows the controller to refresh the flow tables from the OVS to the gateway, directing traffic to the VPCGW.

[0061] Figure 2 This is a traffic exchange path diagram for peer-to-peer connections between two TGWs in related technologies, such as... Figure 2As shown, VM 1 resides on TGW1, and VM 2 resides on TGW2. The VPCs hosting the two VMs establish a cross-tenant VPC peering connection, enabling cross-tenant and cross-VPC traffic communication. The traffic path can be as follows: VM 1 reaches gateway TGW1, then through the interconnect VXLAN tunnel established between TGW1 and TGW2, it is logically directly forwarded to TGW2, and subsequently, TGW2 looks up a table to forward it to VM 2. The logical direct connection between TGW1 and TGW2 results in interconnect addresses being issued on their respective gateways.

[0062] For example, Figure 3 This is a diagram illustrating the passive updating of the ARP table on the Internet element when a VPCGW gateway is bound in related technologies. For example... Figure 3 As shown, TGW1's interconnect interface is loopback interface (Loop) 1, with an address of 100.92.0.10; TGW2's interconnect interface is Loop2, with an address of 100.92.0.11. A VXLAN tunnel is established between the loopback interface and TGW2. When performing VPCGW gateway cluster binding operations, the same interface address will be issued on the VPCGW. For example, the Loop3 address issued on the VPCGW is also 100.92.0.10. At the same time, a peer connection route to TGW2 will be issued on the VPCGW, with the next hop being TGW2's interface address 100.92.0.11. After issuing the route, the VPCGW will find that the next hop is 100.92.0.11, and will actively resolve the MAC address of this address by sending an ARP packet requesting the MAC address of 100.92.0.11. After TGW2 receives the ARP packet, it finds that the source address of the packet is 100.92.0.10. It will then update the local ARP table for 100.92.0.10, associating the MAC address of 100.92.0.10 with the MAC address of Loop3 on the VPCGW gateway.

[0063] However, when VPCGW is bound, it updates the MAC address of the interconnect port on TGW2 to TGW1. This causes return traffic from VM1 to VM2 to be sent to the VPCGW cluster by TGW2, resulting in inconsistent traffic paths. Similarly, this problem occurs not only with peering services but also with other services that were originally logically directly connected to TGW1, such as VPN services and load balancer services.

[0064] In related technologies, maintenance can be performed manually using scripts to harden the MAC address of the interconnecting address to TGW1 on the internet element before binding, essentially writing it as a static ARP entry. This prevents ARP requests during VPCGW binding from updating the statically hardened entry. However, manually writing ARP entries to static entries before binding is cumbersome, and deleting them is inefficient and inefficient in terms of stability and manpower. Therefore, currently, there is no effective way to prevent passive updates to the ARP table on the internet element during the cloud gateway binding process.

[0065] To address the aforementioned issues, this application provides a method, apparatus, device, storage medium, and program product for binding cloud gateways. During cloud gateway binding, the Gateway ARP Check (GAC) function is enabled on the target interface of the target network element directly connected to the target gateway. This ensures that when the target interface receives an ARP packet, it discards ARP packets with addresses different from the bound hardware address, effectively preventing passive updates to the ARP table on the Internet element during the cloud gateway binding process.

[0066] It should be understood that the cloud gateway binding method provided in this application embodiment can be applied to the cloud gateway binding device, which may include network devices or cloud server devices, and this application embodiment does not limit this.

[0067] In one exemplary embodiment, such as Figure 4 As shown, a binding method for a cloud gateway is provided. Taking the application of this method to a binding device for a cloud gateway as an example, the method includes the following steps S201 to S204. Wherein:

[0068] S201. In response to the message that the target gateway is bound to the virtual private cloud gateway, enable the GAC function of the target interface.

[0069] The target interface is the interface of the target network element that is logically directly connected to the target gateway.

[0070] In some embodiments, the target gateway can be any tenant gateway. The target network element logically connected to the target gateway can include any network element, such as other tenant gateways. For example, the target gateway is TGW1, and the target network element logically connected to the target gateway is TGW2.

[0071] It should be understood that the embodiments of this application do not limit the interface of the target network element. In some embodiments, the target interface includes at least one of the following: Virtual Extensible LAN Tunnel (vxlantunnel) interface, loopback interface, and physical interface.

[0072] It should be understood that the embodiments of this application do not limit the message of binding the target gateway to the virtual private cloud gateway. In some embodiments, the message of binding the target gateway to the virtual private cloud gateway can be triggered after detecting the work order of binding the target gateway to the virtual private cloud gateway and receiving the confirmation instruction message of the administrator for the work order.

[0073] In some embodiments, the GAC function is used to detect and verify updates to the ARP table.

[0074] For example, if the target gateway is TGW1 and the target network element logically directly connected to the target gateway is TGW2, then when VPCGW is bound to TGW1 as a backup cluster for TGW, VPCGW and TGW1 will be given the same configuration, including the same direct connection address 100.92.0.10 and peering connection routing configuration as TGW2. VPCGW will resolve the MAC address of the next hop of the route, resulting in sending an ARP request to TGW2, which in turn triggers an ARP table update on TGW2. Therefore, when binding a Virtual Private Cloud Gateway to a target gateway, the GAC function of the target interface can be enabled to detect and verify ARP table updates, preventing passive ARP table updates.

[0075] It should be understood that the embodiments of this application do not limit how to enable the GAC function of the target interface. In some embodiments, the GAC function can be enabled under the target interface through the Layer 2 security configuration command (arp-checkenable) of the network device (e.g., router, switch, firewall, etc.).

[0076] S202. Bind the hardware address corresponding to the Internet Protocol IP address under the target interface.

[0077] In this step, once the binding device of the cloud gateway enables the GAC function of the target interface, it can bind the hardware address corresponding to the Internet Protocol IP address under the target interface.

[0078] The aforementioned hardware address can be a MAC address.

[0079] In some embodiments, after receiving the instruction to enable the GAC function of the target interface, the status information of the GAC function of the target interface can be updated to the enabled state, and then the IP address entry and MAC address entry can be bound in the ARP table.

[0080] In some embodiments, after enabling the GAC function of the target interface, the binding device of the cloud gateway can also generate a GAC ​​entry corresponding to the target network element. The GAC entry includes at least one of the following: the interface identifier of the target interface, the enabled status of the GAC function of the target interface, the IP address bound to the target interface, and the hardware address bound to the target interface.

[0081] For example, Figure 5 This is a schematic diagram of a GAC ​​entry provided in an embodiment of this application, as shown below. Figure 5 As shown, the GAC entry includes the GAC function's enabled status, the bound IP address, the bound MAC address, and the interface identifier. Specifically, the GAC function is enabled (on), the bound IP address is 100.92.0.10, the bound MAC address is 0011.0011.0011, and the interface identifier is Tunnel100.

[0082] In some embodiments, after enabling the GAC function of the target interface, a GAC ​​timer corresponding to the target interface can also be started. Subsequently, if the GAC timer times out, an ARP request is sent to the bound IP address, and the current hardware address corresponding to the bound IP address is received.

[0083] The timeout period of the aforementioned timer can be set according to the actual situation; for example, it can be set to 30 seconds.

[0084] For example, after enabling the GAC function, a GAC ​​timer is started under the target interface. The timer expires after 30 seconds. At this time, an arping operation is performed on the bound IP address. By sending an ARP request and receiving the current MAC address corresponding to the bound IP address, it is possible to check whether the address exists and whether the MAC address of the address has been updated.

[0085] In some embodiments, if the current hardware address is different from the bound hardware address, the GAC function of the target interface is disabled and an alarm message is triggered. If the current hardware address is the same as the bound hardware address, the GAC timer is refreshed.

[0086] For example, if the current MAC address returned by the bound IP address is still the original bound MAC address, there will be no change and the GAC timer will be refreshed. Monitoring will continue after another 30 seconds. If the current MAC address returned by the bound IP address has changed and is no longer the original bound MAC address, the status information of the target interface's GAC function will be set to invalid, thereby disabling the GAC function. At the same time, alarm logs and other alarm information will be triggered to notify the administrator.

[0087] S203. If the hardware address in the ARP packet received by the target interface is different from the bound hardware address, discard the ARP packet received by the target interface.

[0088] In this step, once the cloud gateway's binding device binds the hardware address corresponding to the Internet Protocol IP address under the target interface, the ARP packet received by the target interface will be discarded if the hardware address in the ARP packet received by the target interface is different from the bound hardware address.

[0089] The ARP packets received by the target interface can be either ARP packets sent by the virtual private cloud gateway or ARP packets sent by the target gateway; this embodiment of the application does not impose any restrictions on this.

[0090] In other embodiments, if the hardware address in the ARP packet received by the target interface is the same as the bound hardware address, the information in the ARP packet is updated in the ARP table entry of the target interface.

[0091] For example, if the target gateway is TGW1 and the target network element logically connected to TGW1 is TGW2, then when the target interface of TGW2 enables the GAC function and binds the MAC address corresponding to the IP address of TGW1 to its ARP table entry, when an ARP packet is received, it will be compared with the bound table entry. If the MAC address in the received ARP packet does not match the bound MAC address, the ARP packet will be discarded. If the MAC address in the received ARP packet matches the bound MAC address, TGW2 can update other contents of the ARP table entry.

[0092] S204. Call the SDN controller interface to bind the target gateway to the virtual private cloud gateway.

[0093] In this embodiment, upon receiving a message indicating that the target gateway is bound to a virtual private cloud gateway, it can be checked whether the GAC policy is enabled. If the GAC policy is enabled, the binding device of the cloud gateway (e.g., an SDN controller) enables the GAC function on the target interfaces of all logically directly connected target network elements of the target gateway, binds the hardware address corresponding to the Internet Protocol IP address under the target interface, and simultaneously starts a GAC ​​timer, allowing the target network elements to perform ARP ing on the directly connected address on the target gateway. Subsequently, the Client URL (Curl) command is executed to call the SDN controller interface to bind the target gateway to the virtual private cloud gateway. After waiting for a period of time, the configuration of the virtual private cloud gateway can be queried to confirm that the configuration on the virtual private cloud gateway has been successfully distributed. On all target network elements interconnected with the target gateway, the MAC address of the directly connected address of the target gateway is dynamically learned to remain unchanged.

[0094] For example, if the GAC policy is not enabled, the Curl command is executed to call the SDN controller interface to bind the target gateway to the virtual private cloud gateway. After a period of time, the interface completes the binding of the target gateway and the virtual private cloud gateway. On all target network elements interconnected with the target gateway, the MAC address of the directly connected address of the target gateway is dynamically learned and passively updated to the MAC address of the interface on the virtual private cloud gateway.

[0095] The cloud gateway binding method provided in this application, in response to a message indicating that a target gateway is binding to a virtual private cloud gateway, enables the GAC function of the target interface, where the target interface is the interface of the target network element logically directly connected to the target gateway; binds the hardware address corresponding to the Internet Protocol (IP) address under the target interface; discards the ARP packets received by the target interface if the hardware address in the received ARP packets is different from the bound hardware address; and calls the SDN controller interface to bind the target gateway and the virtual private cloud gateway. Because the GAC function of the target interface of the target network element logically directly connected to the bound target gateway is enabled during cloud gateway binding, the target interface will discard ARP packets with addresses different from the bound hardware address, thereby effectively preventing passive updates to the ARP table on the Internet element during the cloud gateway binding process.

[0096] In one exemplary embodiment, such as Figure 6 As shown, another binding method for cloud gateways is provided. Taking the application of this method to a binding device for cloud gateways as an example, the method includes the following steps S301 to S307. Wherein:

[0097] S301. In response to the message that the target gateway is bound to the virtual private cloud gateway, enable the GAC function of the target interface. The target interface is the interface of the target network element that is logically direct with the target gateway.

[0098] S302. Bind the hardware address corresponding to the Internet Protocol IP address under the target interface.

[0099] S303. Generate the GAC table entry corresponding to the target network element and start the GAC timer corresponding to the target interface.

[0100] The GAC entry includes at least one of the following: the interface identifier of the target interface, the enabled status of the GAC function of the target interface, the IP address bound to the target interface, and the hardware address bound to the target interface.

[0101] In some embodiments, if the GAC timer times out, an ARP request is sent to the bound IP address. The current hardware address corresponding to the bound IP address is received.

[0102] In some embodiments, if the current hardware address is different from the bound hardware address, the GAC function of the target interface is disabled and an alarm message is triggered; if the current hardware address is the same as the bound hardware address, the GAC timer is refreshed.

[0103] S304. Determine whether the hardware address in the ARP packet received by the target interface is the same as the bound hardware address.

[0104] If yes, then execute S305; otherwise, execute S306.

[0105] S305. Update the information in the ARP message in the ARP table entry of the target interface.

[0106] S306. Discard ARP packets received by the target interface.

[0107] S307. Call the SDN controller interface to bind the target gateway to the virtual private cloud gateway.

[0108] The cloud gateway binding method provided in this application, in response to a message indicating that a target gateway is binding to a virtual private cloud gateway, enables the GAC function of the target interface, where the target interface is the interface of the target network element logically directly connected to the target gateway; binds the hardware address corresponding to the Internet Protocol (IP) address under the target interface; discards the ARP packets received by the target interface if the hardware address in the received ARP packets is different from the bound hardware address; and calls the SDN controller interface to bind the target gateway and the virtual private cloud gateway. Because the GAC function of the target interface of the target network element logically directly connected to the bound target gateway is enabled during cloud gateway binding, the target interface will discard ARP packets with addresses different from the bound hardware address, thereby effectively preventing passive updates to the ARP table on the Internet element during the cloud gateway binding process.

[0109] It should be understood that although the steps in the flowcharts of the above embodiments are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the above embodiments may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0110] Based on the same inventive concept, this application also provides a cloud gateway binding device for implementing the cloud gateway binding method described above. The solution provided by this device is similar to the solution described in the above method; therefore, the specific limitations in one or more cloud gateway binding device embodiments provided below can be found in the limitations of the cloud gateway binding method described above, and will not be repeated here.

[0111] In one exemplary embodiment, such as Figure 7 As shown, a cloud gateway binding device 400 is provided, including: an enabling module 401, an address binding module 402, a comparison module 403, and a gateway binding module 404, wherein:

[0112] Module 401 is used to enable the GAC function of the target interface in response to the message that the target gateway is bound to the virtual private cloud gateway. The target interface is the interface of the target network element that is logically direct with the target gateway.

[0113] Address binding module 402 is used to bind the hardware address corresponding to the Internet Protocol IP address under the target interface.

[0114] The comparison module 403 is used to discard ARP packets received by the target interface if the hardware address in the ARP packet received by the target interface is different from the bound hardware address.

[0115] Gateway binding module 404 is used to call the SDN controller interface to bind the target gateway to the virtual private cloud gateway.

[0116] In one embodiment, the comparison module 403 is further configured to update the information in the ARP packet in the ARP table entry of the target interface if the hardware address in the ARP packet received by the target interface is the same as the bound hardware address.

[0117] In one embodiment, the enabling module 401 is further configured to generate a GAC ​​entry corresponding to the target network element;

[0118] The GAC entry includes at least one of the following: the interface identifier of the target interface, the enabled status of the GAC function of the target interface, the IP address bound to the target interface, and the hardware address bound to the target interface.

[0119] In one embodiment, the enabling module 401 is further configured to start the GAC timer corresponding to the target interface; if the GAC timer times out, send an ARP request to the bound IP address; and receive the current hardware address corresponding to the bound IP address.

[0120] In one embodiment, the enabling module 401 is further configured to disable the GAC function of the target interface and trigger an alarm message if the current hardware address is different from the bound hardware address; and to refresh the GAC timer if the current hardware address is different from the bound hardware address.

[0121] In one embodiment, the target interface includes at least one of the following: a virtual scalable LAN tunnel interface, a loopback interface, and a physical interface.

[0122] The modules in the aforementioned cloud gateway binding device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the operations corresponding to each module.

[0123] In one exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 8 As shown, this computer device includes a processor, memory, input / output interfaces (I / O), and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operating system and computer programs stored in the non-volatile storage media. The database stores data. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communicating with external terminals via a network connection. When the computer program is executed by the processor, it implements a cloud gateway binding method.

[0124] Those skilled in the art will understand that Figure 8 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0125] In one exemplary embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the above-described cloud gateway binding method.

[0126] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the binding method of the cloud gateway described above.

[0127] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the above-described binding method for an intra-cloud gateway.

[0128] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0129] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0130] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0131] The above embodiments are merely illustrative of several implementation methods of this application, and their descriptions are relatively specific and detailed. However, they should not be construed as limiting the scope of this application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for binding a cloud gateway, characterized in that, The method includes: In response to the message that the target gateway is bound to the virtual private cloud gateway, the GAC function of the target interface is enabled. The target interface is the interface of the target network element that is logically directly connected to the target gateway. Bind the hardware address corresponding to the Internet Protocol IP address under the target interface; If the hardware address in the ARP packet received by the target interface is different from the bound hardware address, the ARP packet received by the target interface shall be discarded. Call the SDN controller interface to bind the target gateway to the virtual private cloud gateway.

2. The method according to claim 1, characterized in that, After binding the hardware address corresponding to the Internet Protocol IP address under the target interface, the method further includes: If the hardware address in the ARP packet received by the target interface is the same as the bound hardware address, the information in the ARP packet is updated in the ARP table entry of the target interface.

3. The method according to claim 1, characterized in that, After enabling the GAC function of the target interface, the method further includes: Generate the GAC entry corresponding to the target network element; The GAC entry includes at least one of the following: the interface identifier of the target interface, the enabled state of the GAC function of the target interface, the IP address bound to the target interface, and the hardware address bound to the target interface.

4. The method according to claim 1, characterized in that, After enabling the GAC function of the target interface, the method further includes: Start the GAC timer corresponding to the target interface; If the GAC timer times out, an ARP request is sent to the bound IP address; Receive the current hardware address corresponding to the bound IP address.

5. The method according to claim 4, characterized in that, After receiving the information of the current hardware address corresponding to the bound IP address, the method further includes: If the current hardware address is different from the bound hardware address, then the GAC function of the target interface is disabled and an alarm message is triggered; If the current hardware address is the same as the bound hardware address, refresh the GAC timer.

6. The method according to claim 1, characterized in that, The target interface includes at least one of the following: a virtual scalable LAN tunnel interface, a loopback interface, and a physical interface.

7. A binding device for a cloud gateway, characterized in that, The device includes: The enabling module is used to enable the GAC function of the target interface in response to the message that the target gateway is bound to the virtual private cloud gateway. The target interface is the interface of the target network element that is logically direct with the target gateway. The address binding module is used to bind the hardware address corresponding to the Internet Protocol IP address under the target interface; The comparison module is used to discard the ARP packet received by the target interface if the hardware address in the ARP packet received by the target interface is different from the bound hardware address. The gateway binding module is used to call the SDN controller interface to bind the target gateway to the virtual private cloud gateway.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

Images