WO2018028606A1 - 转发策略配置 - Google Patents

转发策略配置 Download PDF

Info

Publication number
WO2018028606A1
WO2018028606A1 PCT/CN2017/096648 CN2017096648W WO2018028606A1 WO 2018028606 A1 WO2018028606 A1 WO 2018028606A1 CN 2017096648 W CN2017096648 W CN 2017096648W WO 2018028606 A1 WO2018028606 A1 WO 2018028606A1
Authority
WO
WIPO (PCT)
Prior art keywords
network device
virtual machine
identifier
mapping relationship
physical server
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2017/096648
Other languages
English (en)
French (fr)
Inventor
金小艇
王伟
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
New H3C Technologies Co Ltd
Original Assignee
New H3C Technologies Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by New H3C Technologies Co Ltd filed Critical New H3C Technologies Co Ltd
Priority to EP17838736.1A priority Critical patent/EP3499799B1/en
Priority to JP2019506706A priority patent/JP6789376B2/ja
Priority to US16/318,311 priority patent/US11086653B2/en
Publication of WO2018028606A1 publication Critical patent/WO2018028606A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0894—Policy-based network configuration management
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/46—Multiprogramming arrangements
    • G06F9/54—Interprogram communication
    • G06F9/542—Event management; Broadcasting; Multicasting; Notifications
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/04—Network management architectures or arrangements
    • H04L41/046—Network management architectures or arrangements comprising network management agents or mobile agents therefor
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L49/00—Packet switching elements
    • H04L49/35—Switches specially adapted for specific applications
    • H04L49/354—Switches specially adapted for specific applications for supporting virtual local area networks [VLAN]
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G06F2009/45595—Network integration; Enabling network access in virtual machine instances
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2101/00—Indexing scheme associated with group H04L61/00
    • H04L2101/60—Types of network addresses
    • H04L2101/618—Details of network addresses
    • H04L2101/622—Layer-2 addresses, e.g. medium access control [MAC] addresses
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/40—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks using virtualisation of network functions or resources, e.g. SDN or NFV entities

Definitions

  • the data center may include a network built by SDN (Software Defined Network) and VXLAN (Virtual EXtensible Local Area Network).
  • SDN Software Defined Network
  • VXLAN Virtual EXtensible Local Area Network
  • SDN is based on a new type of network architecture.
  • the control plane and forwarding plane of the network device are separated, and the network traffic is centralized and flexibly controlled by a controller (such as an SDN controller), thereby providing a good platform for the core network and the application.
  • FIG. 1 is a schematic diagram of an application scenario in an embodiment of the present invention.
  • FIG. 2 is a flowchart of a method for configuring a forwarding policy according to an embodiment of the present invention
  • FIG. 3 is a flowchart of maintaining a first mapping relationship in an embodiment of the present invention.
  • FIG. 4 is a flowchart of a method for configuring a forwarding policy in an embodiment of the present invention
  • FIG. 5 is a hardware structural diagram of a cloud management platform in an embodiment of the present invention.
  • FIG. 6 is a structural diagram of a forwarding policy configuration apparatus in an embodiment of the present invention.
  • FIG. 7 is a hardware structural diagram of an intelligent network management center in an embodiment of the present invention.
  • FIG. 8 is a structural diagram of a forwarding policy configuration apparatus in an embodiment of the present invention.
  • first, second, third, etc. may be used to describe various information in the present invention, such information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other.
  • first information may also be referred to as the second information without departing from the scope of the invention.
  • second information may also be referred to as the first information.
  • word “if” may be interpreted to mean “at time” or "when” or "in response to determination.”
  • VLAN virtual local area network
  • different tenants need to be logically isolated in the Layer 2 domain.
  • the VLAN supports a maximum of 4096 logical isolation areas in the Layer 2 domain. Therefore, the VLAN cannot meet the rapidly increasing tenant size.
  • VXLAN technology emerged.
  • VXLAN has a larger identification space for identifying logical isolated areas, and VXLAN runs on a three-tier network, making it easier to deploy and maintain.
  • FIG. 1 is a schematic diagram of an application scenario according to an embodiment of the present invention. As shown in FIG. 1, a virtual machine 371, a virtual machine 372, a virtual machine 373, and a virtual switch 374 are configured on a physical server 370, and a virtual server 380 is configured.
  • the machine 381, the virtual machine 382, the virtual machine 383, and the virtual switch 384 are configured with a virtual machine 391, a virtual machine 392, a virtual machine 393, and a virtual switch 394 on the physical server 390.
  • the network device connected to the physical server 370 is the network device 340
  • the network device connected to the physical server 380 is the network device 350
  • the network device connected to the physical server 390 is the network device 360.
  • a cloud management platform can be deployed in the network.
  • the cloud management platform manages a large number of computing resources, storage resources, and network resources, and allocates corresponding virtual machines to tenants.
  • the cloud management platform 310 can allocate a virtual machine 371, a virtual machine 372, a virtual machine 373 to the tenant 1 on the physical server 370, and allocate a virtual machine 381 and a virtual machine to the tenant 2 on the physical server 380.
  • the virtual machine 383 allocates a virtual machine 391, a virtual machine 392, and a virtual machine 393 to the tenant 3 on the physical server 390.
  • an intelligent network management center can be deployed in the network.
  • the intelligent network management center can manage the network Network equipment.
  • the network device can be a router or a switch.
  • the intelligent network management device 330 can manage a network device 340 connected to the physical server 370, a network device 350 connected to the physical server 380, a network device 360 connected to the physical server 390, and a VXLAN network 200.
  • Network device 210 and network device 220 and the like.
  • a network formed by a virtual machine, a virtual switch, or the like on each physical server is a service layer (overlay) network, and the virtual machine and the virtual switch in the overlay network can be managed by the cloud management platform.
  • the network formed by the network device connected to the physical server, the network device in the VXLAN network, and the like is an underlay network, and the devices in the underlay network can be managed by the intelligent network management center.
  • the virtual switch 374 can set the corresponding overlay network forwarding according to the overlay network plan.
  • the policy is to perform VXLAN encapsulation on the packet, and send the VXLAN encapsulated packet to the network device 340, so that the packet will be transmitted on the underlay network.
  • the network device 340 can only transmit the packet according to the destination IP address of the packet. Therefore, the forwarding strategy of the overlay network cannot be reflected in the underlay network, which causes the disconnection between the overlay network and the underlay network.
  • the planning of the overlay network can be applied to the underlay network, so that the forwarding strategy of the overlay network can be embodied in the underlay network.
  • the network device in the underlay network may perform packet transmission on the packet from the overlay network based on the forwarding policy of the overlay network, so as to implement different processing of the different packets of the overlay network in the underlay network.
  • the packets may be forwarded based on the forwarding policy corresponding to the packets.
  • the packet 1 corresponds to the forwarding policy 1 and the packet 2 corresponds to the forwarding policy 2
  • the packet 1 is transmitted according to the forwarding policy 1
  • the packet 2 is transmitted according to the forwarding policy 2.
  • the forwarding policy for filtering the packet is set for the packet sent by the attacker, so that the packet sent by the attacker cannot be transmitted in the underlay network to ensure the security of the underlay network.
  • the packets sent by the legal users can be transmitted normally in the underlay network because the packets sent by the authorized users do not match the forwarding policy.
  • the forwarding policy configuration method in the embodiment of the present invention may be applied to the cloud management platform, and the forwarding policy configuration method may include the following steps:
  • Step 201 Obtain a first mapping relationship between the virtual machine and the network device.
  • the location relationship between the virtual machine and the network device can be maintained.
  • the process of maintaining the location relationship between the virtual machine and the network device may include, but is not limited to, maintaining the virtual machine information, the device identifier of the network device connected to the physical server where the virtual machine is located, and the network device.
  • the process of maintaining the first mapping relationship may include, but is not limited to, the following:
  • a MAC (Media Access Control) address of the physical server is obtained.
  • the cloud management platform can collect the MAC addresses of the physical servers and maintain the physical server identifiers and physical servers as shown in Table 1. Mapping of MAC addresses.
  • Physical server ID Physical server MAC address Physical server 1 MAC1 Physical server 2 MAC2 Physical server 3 MAC3 ... ... Physical server N MACN
  • step 2012 a query message carrying a MAC address is sent to the intelligent network management center.
  • the cloud management platform when the cloud management platform needs to query a network device corresponding to one or more MAC addresses (such as MAC1, MAC2, MAC3, etc.), the cloud management platform sends a query message carrying the one or more MAC addresses to the intelligent network management center.
  • MAC1 For convenience of description, the description will be made by taking MAC1 as an example.
  • the query message is used to query the device identifier of the network device connected to the physical server 370 (ie, the physical server corresponding to the MAC1) and the port identifier of the port connected to the physical server 370 on the network device.
  • the query message may be a message based on a REST (Representational State Transfer, also referred to as a representational state transfer or a representational state transfer) API (Application Programming Interface) format.
  • REST Representational State Transfer
  • representational state transfer also referred to as a representational state transfer or a representational state transfer
  • representational state transfer Application Programming Interface
  • the query message may also be a message in another format, and the processing procedure is similar to the processing in the REST API format, and is not described here.
  • the query message in the REST API format may include the following field: an interface type field, which is used to indicate that the current message is used to query the device identifier of the network device according to the MAC address and the port identifier of the port; the interface URL (Uniform Resource Locator, unified) Resource Locator field: The URL of the intelligent network management center, through which the query message can be sent to the intelligent network management center; parameter field: used to carry the MAC to be queried Address, such as MAC1 above.
  • an interface type field which is used to indicate that the current message is used to query the device identifier of the network device according to the MAC address and the port identifier of the port
  • the interface URL Uniform Resource Locator, unified
  • Resource Locator field The URL of the intelligent network management center, through which the query message can be sent to the intelligent network management center
  • parameter field used to carry the MAC to be queried Address, such as MAC1 above.
  • Step 2013 Receive a response message from the intelligent network management center, where the response message carries the device identifier and port identifier of the network device corresponding to the MAC address (ie, the MAC address carried in the query message).
  • the intelligent network management center may obtain the MAC address of the physical server from the network device that is managed by the network, where the MAC address of the physical server learned by the network device and the MAC address may be recorded in the MAC entry.
  • the port ID corresponding to the address.
  • the intelligent network management center locally maintains the mapping relationship between the MAC address, the port identifier, and the device identifier of the network device.
  • the intelligent network management center After receiving the query message carrying the MAC address from the cloud management platform, the intelligent network management center can query the mapping relationship through the MAC address, obtain the corresponding port identifier and device identifier, and carry the response of the port identifier and the device identifier. The message is sent to the cloud management platform. Thereafter, the cloud management platform can receive a response message carrying the device identifier and the port identifier.
  • the network device (such as the network device 340, the network device 350, the network device 360, the network device 210, the network device 220, etc.) is intelligent.
  • the network management center performs the management, so the intelligent network management center can directly send the MAC entry query command to the network device managed by itself, such as the MIB (Management Information Base) type MAC entry query command, or based on A MAC address entry query command of the SNMP (Simple Network Management Protocol) type, the query command is used to request to obtain a MAC address entry of a physical server learned by the network device.
  • MIB Management Information Base
  • SNMP Simple Network Management Protocol
  • the network device connected to the physical server can learn the MAC address entry corresponding to the physical server when receiving the packet from the physical server.
  • the MAC entry records the MAC address of the physical server and the port identifier of the port on the network device that is connected to the physical server.
  • the network device may send the locally learned MAC entry to the intelligent network management center. For example, as shown in Table 2, an example of a MAC entry learned for the network device 340.
  • the MAC entry learned by the network device 350 and the network device 360 is similar to the MAC entry shown in Table 2, and details are not described herein again.
  • the intelligent network management center can obtain the MAC entry from the network device managed by itself.
  • the intelligent network management center can maintain the mapping relationship between the MAC address, port identifier, and device identifier shown in Table 3. For example, after receiving the MAC entry from the network device 340 (as shown in Table 2), the intelligent network management center may record MAC1 and port 1 in the MAC entry into Table 3, and the device of the network device 340. The identification record is in Table 3. For example, after receiving the MAC entry from the network device 350 and the MAC entry of the network device 360, the intelligent network management center may also record related information in Table 3, and finally maintain the mapping relationship shown in Table 3.
  • the MAC address entries learned by the network device may also include VLAN (Virtual Local Area Network) information.
  • Table 4 may include VLAN information.
  • the intelligent network management center maintains the mapping relationship shown in Table 3
  • the VLAN information can also be recorded in the mapping relationship, as shown in Table 4.
  • other information may be included in the mapping relationship, which is not limited in the embodiment of the present invention.
  • Table 3 or Table 4 is taken as an example.
  • the intelligent network management center After the intelligent network management center queries the mapping relationship through the MAC address to obtain the corresponding port identifier and device identifier, the intelligent network management center queries the table 3 after receiving the query message carrying the MAC1 from the cloud management platform. Or, in Table 4, the port identifier is obtained as port 341, and the device identifier is further obtained as the network device 340. In addition, it is also possible to obtain a VLAN information of 100.
  • the response message may be a message based on the REST API format. In practical applications, the response message may also be a message based on other formats.
  • the processing of the response message is similar to the processing of the REST API format message, and details are not described herein again.
  • the format of the response message is not limited in the embodiment of the present invention.
  • the response message in the REST API format may include at least the following fields: an interface type field, which is used to indicate that the current message is a response message, and a parameter field, which is used to carry the MAC1, the network device 340, and the port 341.
  • the parameter field can also carry VLAN information to 100.
  • the intelligent network management center receives the MAC carrying the physical server from the cloud management platform. After the address query message is obtained, the port identifier corresponding to the MAC address is obtained from the network device managed by the network device, and the response message carrying the port identifier and the device identifier of the network device is sent to the cloud management platform. The cloud management platform receives a response message carrying the device identifier and the port identifier.
  • the intelligent network management center may parse the MAC address from the query message. , such as MAC1.
  • the intelligent network management center can directly send a MAC entry query command carrying the MAC1 to the network device managed by itself, such as a MIB type-based MAC entry query command, or based on SNMP type MAC entry query command.
  • the MAC entry query command is used to request that the network device that learns MAC1 returns a MAC entry related to MAC1.
  • the network device connected to the physical server can learn the MAC address entry corresponding to the physical server when receiving the packet from the physical server.
  • the MAC address of the physical server and the port identifier of the port connected to the physical server on the network device are recorded in the MAC entry.
  • the network device determines whether there is a MAC entry related to MAC1 locally. If yes, send the MAC entry related to MAC1 to the intelligent network management center. If no, the MAC entry is not sent to the intelligent network management center.
  • the network device 340 sends the MAC entry shown in Table 2 above to the intelligent network management center, and the network device 350/network device 360 no longer sends the MAC entry.
  • the intelligent network management center may acquire the network entry after receiving the MAC entry from the network device 340.
  • the device identification of the device 340 and the port identification 341 and the device identification 340 are sent to the cloud management platform via a response message.
  • the response message may be a message based on the REST API format, and may carry MAC1, network device 1, and port 1.
  • the MAC address entry learned by the network device may further include the VLAN information, and the response message sent by the intelligent network management center may further carry the VLAN information, such as 100.
  • the failure message may be sent to the cloud management platform, and the process is not described in detail.
  • step 2014 after receiving the response message, the second mapping relationship between the MAC address (that is, the MAC address of the physical server), the identifier of the physical server, the device identifier, and the port identifier is maintained.
  • the cloud management platform may parse the device identifier and the port identifier from the response message, for example, the network device 340 and the port 341.
  • the response message may not carry a MAC address. Due to The response message is a response message for the query message carrying the MAC1, and it can be determined that the MAC1 corresponds to the network device 340 and the port 341.
  • the MAC1 can be carried in the response message, and the MAC1 can be directly determined to correspond to the network device 340 and the port 341.
  • the cloud management platform can learn the mapping relationship between the MAC address, device identifier, and port identifier. Then, the cloud management platform can query the mapping relationship shown in Table 1 by using the MAC address to obtain the identifier of the physical server, and then maintain the second mapping relationship between the MAC address, the physical server identifier, the device identifier, and the port identifier, as shown in Table 5. Shown as an example of a second mapping relationship. In addition, the cloud management platform can further resolve the VLAN information from the response message, and learn the mapping relationship between the MAC address, the device identifier, the port identifier, and the VLAN information. Correspondingly, the second mapping relationship may further include VLAN information, as shown in Table 6, as another example of the second mapping relationship including the VLAN information.
  • step 2015 when the virtual machine is enabled, the physical server where the virtual machine is located is determined, and the second mapping relationship is queried according to the identifier of the physical server, and the corresponding device identifier and port identifier are obtained.
  • the virtual machine is managed by the cloud management platform, and the cloud management platform allocates a virtual machine to the tenant on the physical server. Therefore, the cloud management platform can know the physical server where the virtual machine is located, for example, the virtual machine 371. Both virtual machine 372 and virtual machine 373 are located on physical server 370.
  • the cloud management platform can directly determine that the virtual machine 371 corresponds to the physical server 370, and query the table according to the identifier of the physical server 370 (such as the physical server 1). Or the second mapping relationship of Table 6, the corresponding network device 340 and port 341 are obtained.
  • step 2016, the first mapping relationship between the virtual machine information, the device identifier, and the port identifier is maintained.
  • the first mapping relationship may be as shown in Table 7, or Table 8, or Table 9.
  • Table 7, or Table 8, or Table 9 The foregoing tables are only a few examples of the first mapping relationship, which is not limited in the embodiment of the present invention.
  • Virtual machine 372 Network device 340 Port 341 Virtual machine 373 Network device 340 Port 341 Virtual machine 381 Network device 350 Port 351 Virtual machine 382 Network device 350 Port 351 Virtual machine 383 Network device 350 Port 351 Virtual machine 391 Network device 360 Port 361 Virtual machine 392 Network device 360 Port 361 Virtual machine 393 Network device 360 Port 361
  • Virtual machine information Physical server ID MAC address Equipment Identity Port identifier Virtual machine 371 Physical server 370 MAC1 Network device 340 Port 341 Virtual machine 372 Physical server 370 MAC1 Network device 340 Port 341 Virtual machine 373 Physical server 370 MAC1 Network device 340 Port 341 Virtual machine 381 Physical server 380 MAC2 Network device 350 Port 351 Virtual machine 382 Physical server 380 MAC2 Network device 350 Port 351 Virtual machine 383 Physical server 380 MAC2 Network device 350 Port 351 Virtual machine 391 Physical server 390 MAC3 Network device 360 Port 361 Virtual machine 392 Physical server 390 MAC3 Network device 360 Port 361 Virtual machine 393 Physical server 390 MAC3 Network device 360 Port 361
  • Step 202 Send a notification message to an intelligent network management center corresponding to the network device.
  • the notification message carries the virtual machine information of the virtual machine and the network device information of the network device, so that the intelligent network management center configures the network device according to the notification message for the virtual
  • the forwarding policy of the machine is used to enable the network device to process the packet of the virtual machine.
  • a notification message is sent to the intelligent network management center using the location relationship of the virtual machine and the network device.
  • the notification message carries the information of the virtual machine and the information of the network device, so that the intelligent network management center configures the network device with a forwarding policy for the virtual machine according to the notification message, where the forwarding policy is used to enable the
  • the network device processes the packet of the virtual machine.
  • the first mapping based on virtual machine information, device identification of the network device, port identification of the port The information of the virtual machine may be the packet characteristic information of the virtual machine, and the information of the network device may be the device identifier (the device identifier of the network device connected to the physical server where the virtual machine is located) and the port identifier (on the network device) The port ID of the port to which the physical server is connected).
  • the forwarding policy is used to enable the network device to trust the policy in the packet that carries the packet feature information received through the port (port corresponding to the port identifier).
  • the message can include, but is not limited to, a VXLAN message.
  • the message feature information may include, but is not limited to, a VXLAN identity.
  • the virtual machine is managed by the cloud management platform. Therefore, the VXLAN identifier corresponding to each virtual machine is allocated by the cloud management platform, and the cloud management platform can obtain the VXLAN identifier corresponding to each virtual machine.
  • the virtual machine 371 corresponds to the VXLAN identifier 100.
  • the cloud management platform may also record the VXLAN identifier corresponding to each virtual machine in the first mapping relationship, so that the VXLAN identifier corresponding to the virtual machine may be directly queried based on the first mapping relationship.
  • the notification message can be a message based on the REST API format.
  • the notification message may also be a message in other formats, and the processing procedure is similar to the processing procedure in the REST API format, and details are not described herein again.
  • the embodiment of the present invention does not limit the format of the notification message.
  • the notification message of the REST API format may include at least the following field: an interface type field, used to indicate that the current message is used to set a trust to a specific VXLAN identifier for the port of the network device.
  • the VXLAN packet policy is the URL of the intelligent network management center, and the notification message can be sent to the intelligent network management center through the interface URL field;
  • the parameter field is used to carry the VXLAN identifier of the virtual machine 371, and the virtual The device identifier 340 of the network device corresponding to the machine 371 and the port identifier 341 of the port corresponding to the virtual machine 371.
  • the intelligent network management center parses the packet feature information, the device identifier, and the port identifier, and configures a forwarding policy for the network device corresponding to the device identifier, and sends the forwarding policy to the Internet equipment.
  • the forwarding policy is used to enable the network device to trust the policy in the packet carrying the packet feature information received by the port (the port corresponding to the port identifier).
  • the network device 340 is configured with a forwarding policy for the network device 340 to trust the policy in the VXLAN message carrying the VXLAN identity 100 received through the port 341.
  • the policy in the foregoing packet may include, but is not limited to, a forwarding priority.
  • a forwarding priority The following is an example in which the policy in the packet is a forwarding priority.
  • the processing manner is similar.
  • the virtual machine 371 sends a message to the virtual machine 381 as an example for description.
  • the virtual machine 371 sends a packet to the virtual machine 381, after the packet arrives at the virtual switch 371, the packet is queried to match the control flow table of the packet.
  • the controller is sent to the virtual switch 371).
  • the virtual switch 371 Based on the control flow table, the virtual switch 371 performs VXLAN encapsulation on the message.
  • the source IP address is the IP address of the virtual switch 371 and the destination IP address is the IP address of the virtual switch 384 for the outer IP header of the VXLAN encapsulated packet (that is, the VXLAN packet).
  • the VXLAN identifier is the VXLAN identifier 100 corresponding to the virtual machine 371, and the DSCP (Differentiated Services Code Point) field is the forwarding priority.
  • the forwarding priority can be configured according to the actual needs, and the value is not limited in the embodiment of the present invention.
  • the virtual switch 371 sends the VXLAN encapsulated message to the network device 340.
  • the forwarding policy is configured on the network device 340, the forwarding policy is used to enable the network device 340 to trust the forwarding priority in the VXLAN packet carrying the VXLAN identifier 100 received through the port 341, and the network device 340 receives the VXLAN through the port 341.
  • the forwarding priority in the VXLAN packet can be trusted (which is carried in the DSCP field).
  • the network device 340 can forward the message according to the forwarding priority of the DSCP field.
  • each network device in the VXLAN network also trusts the processing result of the network device 340. Therefore, each network device also forwards the packet according to the forwarding priority of the DSCP field.
  • the message is transmitted to virtual switch 384 in accordance with the forwarding priority.
  • the virtual switch 384 can remove the IP header of the VXLAN encapsulation to obtain the original packet.
  • the source IP address of the original packet is the IP address of the virtual machine 371, and the destination IP address is the IP address of the virtual machine 381. Therefore, the packet can be sent to the virtual machine 381.
  • the virtual machine 381 completes the transmission of the message.
  • each network device can forward the message sent by the virtual machine 371 to the virtual machine 381 according to the forwarding priority of the DSCP field.
  • the planning of the overlay network can be connected with the underlay network, so that the forwarding priority of the overlay network planning can be reflected in the underlay network.
  • the underlay network can perform packet transmission based on the forwarding priority, and implement different processing of the packets of different overlay networks in the underlay network.
  • the packet can be forwarded differently according to the forwarding policy corresponding to the packet.
  • the packet 1 corresponds to the forwarding policy 1 and the packet 2 corresponds to the forwarding policy 2
  • the packet 1 is transmitted according to the forwarding policy 1
  • the packet 2 is transmitted according to the forwarding policy 2.
  • the forwarding policy for filtering the packet is set for the packet sent by the attacker, so that the packet sent by the attacker cannot be transmitted in the underlay network, ensuring the security of the underlay network, and the packet sent by the legitimate user. It does not match the forwarding policy used to filter packets. Therefore, packets sent by legitimate users can be transmitted normally on the underlay network.
  • the cloud management platform may further update the first mapping relationship of the local maintenance by using the changed first mapping relationship, and send the first mapping relationship to the intelligent network.
  • the management center sends a delete message, which is used to enable the intelligent network management center to delete the forwarding policy previously configured for the network device.
  • the cloud management platform may send the communication to the intelligent network management center by using the changed first mapping relationship. Know the news.
  • the cloud management platform can obtain the first mapping relationship between the virtual machine, the device identifier, and the port identifier periodically. For example, the first mapping relationship is obtained once every 24 hours. For the specific acquisition mode, refer to step 201. If the first mapping relationship that is currently obtained is the same as the first mapping relationship maintained by the local device, the network device connected to the physical server does not change, and the process ends.
  • the network device connected to the physical server changes, and the cloud management platform can update the first mapping relationship of the local maintenance (that is, the first change after using the change)
  • the mapping relationship updates the first mapping relationship maintained locally, and sends a delete message to the intelligent network management center, where the delete message is used to enable the intelligent network management center to delete the forwarding policy previously configured for the network device, and utilize the changed first mapping
  • the relationship sends a notification message to the Intelligent Network Management Center.
  • the process of sending the notification message is similar to the step 202, and details are not described herein again.
  • the process of sending a delete message is described below.
  • the deletion message may be a message based on the REST API format. In an actual application, the deletion message may also be a message in another format, and the processing is similar to the processing of the REST API format, and details are not described herein again. No restrictions.
  • the REST API format deletion message may include the following field: an interface type field, configured to indicate that the current message is used to delete a forwarding policy configured for the network device; URL field: The URL of the intelligent network management center, through which the deletion message can be sent to the intelligent network management center; parameter field: VXLAN identifier for carrying the virtual machine 371, network device 340 (device identification), port 341 (port identification).
  • the intelligent network management center may delete the forwarding policy of the port corresponding to the port identifier configured for the network device corresponding to the device identifier.
  • the cloud management platform can obtain the first mapping relationship between the virtual machine information, the device identifier, and the port identifier, and use the currently obtained first mapping relationship. Updating the first mapping relationship of the local maintenance (that is, updating the first mapping relationship of the local maintenance by using the changed first mapping relationship), and sending a deletion message to the intelligent network management center, where the deletion message is used to delete the intelligent network management center before A forwarding policy configured by the network device, and sending a notification message to the intelligent network management center by using the changed first mapping relationship.
  • the cloud management platform can send a delete message to the intelligent network management center.
  • the delete message is used to enable the intelligent network management center to delete the forwarding policy previously configured for the network device.
  • the forwarding policy configuration method in the embodiment of the present invention may be applied to an intelligent network management center, and the forwarding policy configuration method may include the following steps:
  • Step 401 The intelligent network management receives the notification message from the cloud management platform.
  • the notification message carries virtual machine information of the virtual machine and network device information of the network device having the first mapping relationship with the virtual machine.
  • the notification message carries information of the virtual machine and information of the network device having a positional relationship with the virtual machine.
  • Step 402 The intelligent network management center configures, for the network device, a forwarding policy for the virtual device according to the notification message, where the forwarding policy is used to enable the network device to process the packet of the virtual machine.
  • the processing procedure of the intelligent network management center is the same as that of the intelligent network management center introduced in the process shown in FIG. 2, and details are not repeatedly described in the embodiment of the present invention.
  • FIG. 5 is a hardware structural diagram of a cloud management platform provided by some embodiments of the present application.
  • the cloud management platform 50 can include a processor 51 and a machine readable storage medium 52.
  • the processor 51 and the machine readable storage medium 52 can communicate via the system bus 53.
  • the processor 51 can perform the method of forwarding policy configuration described above.
  • the machine-readable storage medium 52 referred to herein can be any electronic, magnetic, optical, or other physical storage device that can contain or store information such as executable instructions, data, and the like.
  • the machine readable storage medium 72 may be a RAM (Random Access Memory), a volatile memory, a nonvolatile memory, a flash memory, a storage drive (such as a hard disk drive), a solid state drive, or any type of A storage disk (such as a compact disc, a DVD, etc.), or a similar storage medium, or a combination thereof.
  • the forwarding policy configuration logic 60 may include:
  • the maintenance module 11 is configured to obtain a first mapping relationship between the virtual machine and the network device.
  • the sending module 12 is configured to send a first notification message to the intelligent network management center corresponding to the network device, where the first notification message carries virtual machine information of the virtual machine and network device information of the network device, To make the wisdom
  • the network management center configures, for the network device, a forwarding policy for the virtual machine according to the first notification message, where the forwarding policy is used to enable the network device to process the packet of the virtual machine.
  • the first mapping relationship includes virtual machine information, a device identifier of a network device connected to a physical server where the virtual machine is located, and a port identifier of a port of the physical server to which the virtual device is connected. Mapping relations.
  • the maintenance module 11 is configured to determine, when the virtual machine is enabled, the physical server where the virtual machine is located, and query a corresponding second mapping relationship according to the MAC address of the physical server. Obtaining the corresponding device identifier and the port identifier, where the second mapping relationship is a mapping relationship between the MAC address, the identifier of the physical server, the device identifier, and the port identifier;
  • the maintenance module 11 is further configured to send a query message to the intelligent network management center, where the query message includes a media access control MAC address of the physical server;
  • the response message carries the device identifier and the port identifier respectively corresponding to the MAC address; obtaining the MAC address, the identifier of the physical server, and the A second mapping relationship between the device identifier and the port identifier.
  • the maintenance module 11 is further configured to: when the first mapping relationship changes, update a local first mapping relationship;
  • the sending module 12 is further configured to send a delete message to the intelligent network management center, where the delete message is used to delete the intelligent network management center as a forwarding policy configured by the network device;
  • the center sends the notification message, where the second notification message carries the updated virtual machine information and the network device information corresponding to the first mapping relationship.
  • modules of the device of the present invention may be integrated or integrated.
  • the above modules can be combined into one module, or can be further split into multiple sub-modules.
  • FIG. 7 is a hardware structural diagram of an intelligent network management center according to some embodiments of the present application.
  • the intelligent network management center 70 can include a processor 71 and a machine readable storage medium 72.
  • processor 71 and machine readable storage medium 72 can communicate via system bus 73.
  • the processor 71 can perform the method of forwarding policy configuration described above.
  • the machine readable storage medium 72 referred to herein can be any electronic, magnetic, optical, or other physical storage device. To include or store information such as executable instructions, data, and the like.
  • the machine readable storage medium 72 may be a RAM (Random Access Memory), a volatile memory, a nonvolatile memory, a flash memory, a storage drive (such as a hard disk drive), a solid state drive, or any type of A storage disk (such as a compact disc, a DVD, etc.), or a similar storage medium, or a combination thereof.
  • the forwarding policy configuration logic 80 can include:
  • the receiving module 21 is configured to receive a notification message from the cloud management platform, where the notification message carries virtual machine information of the virtual machine, and network device information of the first network device that has the first mapping relationship with the virtual machine;
  • the configuration module 22 is configured to configure, according to the notification message, a forwarding policy for the first network device, where the forwarding policy is used to enable the first network device to send packets to the virtual machine. Process it.
  • the forwarding policy configuration logic further includes (not shown in the figure):
  • an obtaining module configured to acquire, from the second network device, a media access control MAC entry of the physical server, where each of the MAC entries is recorded, for each second network device managed by the intelligent network management center a MAC address of the physical server connected to the second network device, and a port identifier corresponding to the port connected to the physical server on the second network device; and obtaining the MAC address and the location according to the MAC entry a mapping relationship between the port identifier and the device identifier of the network device;
  • a sending module configured to query the mapping relationship by using the MAC address to obtain a corresponding port identifier and device identifier after receiving the query message of the MAC address of the physical server from the cloud management platform; A response message of the port identifier and the device identifier is sent to the cloud management platform.
  • the obtaining module is further configured to: after receiving the query message of the MAC address carrying the physical server from the cloud management platform, obtain the third network device managed by the intelligent network management center.
  • the port corresponding to the MAC address identifies the sending module, and is further configured to send a response message carrying the port identifier and the device identifier of the third network device to the cloud management platform.
  • the forwarding policy configuration logic further includes (not shown in the figure):
  • a deleting module configured to: after receiving the deletion message carrying the network device information from the cloud management platform, instructing the first network device to delete the configured forwarding policy.
  • modules of the device of the present invention may be integrated or integrated.
  • the above modules can be combined into one module, or can be further split into multiple sub-modules.
  • the present invention can be implemented by software. Adding the necessary general hardware platform to achieve it, of course, can also be through hardware, but in many cases the former is a better implementation.
  • the technical solution of the present invention which is essential or contributes to the prior art, may be embodied in the form of a software product stored in a storage medium, including a plurality of instructions for causing a A computer device (which may be a personal computer, server, or network device, etc.) performs the methods described in various embodiments of the present invention.
  • a person skilled in the art can understand that the drawings are only a schematic diagram of a preferred embodiment, and the modules or processes in the drawings are not necessarily required to implement the invention.
  • the device embodiment since it basically corresponds to the method embodiment, reference may be made to the partial description of the method embodiment.
  • the device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separate, and the components displayed as units may or may not be physical units, ie may be located A place, or it can be distributed to multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of the embodiment. Those of ordinary skill in the art can understand and implement without any creative effort.

Landscapes

  • Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Multimedia (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

在本发明实施例中，云管理平台得到虚拟机与网络设备之间的第一映射关系；向所述网络设备对应的智能网络管理中心发送第一通知消息，所述第一通知消息中携带有所述虚拟机的虚拟机信息和所述网络设备的网络设备信息，以使所述智能网络管理中心根据所述第一通知消息为所述网络设备配置针对所述虚拟机的转发策略，所述转发策略用于使所述网络设备对所述虚拟机的报文进行处理。

Description

转发策略配置
相关申请的交叉引用
本专利申请要求于2016年8月11日提交的、申请号为201610661890.X、发明名称为“一种转发策略配置方法和装置”的中国专利申请的优先权，该申请的全文以引用的方式并入本文中。
背景技术
目前，数据中心可以包括SDN(Software Defined Network，软件定义网络)和VXLAN(Virtual eXtensible Local Area Network，可扩展虚拟局域网络)构建的网络。其中，SDN是基于一种新型的网络架构。在SDN中，分离网络设备的控制层面与转发层面，并通过控制器(如SDN控制器)对网络流量进行集中和灵活控制，从而为核心网络以及应用提供良好的平台。
附图说明
图1是本发明一种实施方式中的应用场景示意图；
图2是本发明一种实施方式中的转发策略配置方法的流程图；
图3是本发明一种实施方式中的维护第一映射关系的流程图；
图4是本发明一种实施方式中的转发策略配置方法的流程图；
图5是本发明一种实施方式中的云管理平台的硬件结构图；
图6是本发明一种实施方式中的转发策略配置装置的结构图；
图7是本发明一种实施方式中的智能网络管理中心的硬件结构图；
图8是本发明一种实施方式中的转发策略配置装置的结构图。
具体实施方式
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例， 都属于本申请保护的范围。
在本发明使用的术语仅仅是出于描述特定实施例的目的，而非限制本发明。本发明和权利要求书中所使用的单数形式的“一种”、“所述”和“该”也旨在包括多数形式，除非上下文清楚地表示其它含义。还应当理解，本文中使用的术语“和/或”是指包含一个或多个相关联的列出项目的任何或所有可能组合。
应当理解，尽管在本发明可能采用术语第一、第二、第三等来描述各种信息，但这些信息不应限于这些术语。这些术语仅用来将同一类型的信息彼此区分开。例如，在不脱离本发明范围的情况下，第一信息也可以被称为第二信息，类似地，第二信息也可以被称为第一信息。取决于语境，此外，所使用的词语“如果”可以被解释成为“在……时”或“当……时”或“响应于确定”。
在虚拟局域网(Virtual Local Area Network，VLAN中，不同租户之间需要在二层域进行逻辑隔离。然而，VLAN在二层域最大支持4096个逻辑隔离区域。因此，VLAN无法满足快速增加的租户规模。基于此，VXLAN技术应运而生。VXLAN具有更大的标识空间，用于标识逻辑隔离区域。并且，VXLAN在三层网络上运行，更加容易部署和维护。
本发明实施例中提出了一种转发策略配置方法，该方法可以应用于一数据中心。在一个例子中，该数据中心可以基于SDN+VXLAN的网络构架。该数据中心可以包括，但不限于，物理服务器、控制器(如SDN控制器等)、云管理平台、网络设备、智能网络管理中心的网络。以图1为本发明实施例的应用场景示意图，如图1所示，在物理服务器370上配置了虚拟机371、虚拟机372、虚拟机373和虚拟交换机374，在物理服务器380上配置了虚拟机381、虚拟机382、虚拟机383和虚拟交换机384，在物理服务器390上配置了虚拟机391、虚拟机392、虚拟机393和虚拟交换机394。与物理服务器370连接的网络设备为网络设备340，与物理服务器380连接的网络设备为网络设备350，与物理服务器390连接的网络设备为网络设备360。
在一个例子中，可以在网络中部署云管理平台。该云管理平台管理大量的计算资源、存储资源以及网络资源，并为租户分配相应的虚拟机。例如，如图1所示，云管理平台310可以在物理服务器370上为租户1分配虚拟机371、虚拟机372、虚拟机373，并在物理服务器380上为租户2分配虚拟机381、虚拟机382、虚拟机383，并在物理服务器390上为租户3分配虚拟机391、虚拟机392、虚拟机393。
在一个例子中，可以在网络中部署智能网络管理中心。该智能网络管理中心可以管理网 络设备。在一个例子中，网络设备可以为路由器或者交换机。例如，如图1所示，该智能网络管理设备330可以管理与物理服务器370连接的网络设备340、与物理服务器380连接的网络设备350、与物理服务器390连接的网络设备360、VXLAN网络200中的网络设备210和网络设备220等。
在图1中，由各物理服务器上的虚拟机、虚拟交换机等组建的网络为业务层(overlay)网络，可以由云管理平台对overlay网络中的虚拟机、虚拟交换机进行管理。由与物理服务器连接的网络设备、VXLAN网络中的各网络设备等组建的网络为承载层(underlay)网络，可以由智能网络管理中心对underlay网络中的各设备进行管理。
在上述应用场景下，在overlay网络中，当虚拟机371待发送给虚拟机381的报文到达虚拟交换机374后，虚拟交换机374可以根据overlay网络规划，为该报文设置对应的overlay网络的转发策略，对报文进行VXLAN封装，并将VXLAN封装后的报文发送给网络设备340，以使报文将在underlay网络进行传输。在underlay网络中，在收到报文后，由于网络设备340并不支持在overlay网络中转发策略，该网络设备340只能根据该报文的目的IP地址传输该报文。因此，无法让overlay网络的转发策略体现在underlay网络，造成了overlay网络和underlay网络的脱节。
针对上述问题，在一个例子中，可以使overlay网络的规划应用于underlay网络，使得overlay网络的转发策略，能够体现在underlay网络中。具体地，在underlay网络中的网络设备可以基于overlay网络的转发策略对来自overlay网络的报文进行报文传输，实现overlay网络的不同报文在underlay网络的区别处理。具体地，当不同报文对应不同转发策略时，可以基于报文对应的转发策略对该报文进行转发。例如，当报文1对应转发策略1，报文2对应转发策略2时，在underlay网络中，依据转发策略1对报文1进行传输，依据转发策略2对报文2进行传输。进一步地，通过为攻击者发送的报文设置用于过滤报文的转发策略，使得攻击者发送的报文无法在underlay网络中进行传输，保证underlay网络的安全性。由于合法用户发送的报文不会匹配到用于过滤报文的转发策略，因此合法用户发送的报文可以在underlay网络中正常传输。
在上述应用场景下，参见图2所示，本发明实施例中提出的转发策略配置方法，可以应用在云管理平台上，且该转发策略配置方法可以包括以下步骤：
步骤201，得到虚拟机与网络设备之间的第一映射关系。
在一个例子中，可以维护虚拟机与网络设备的位置关系。
在一个例子中，该维护虚拟机与网络设备的位置关系的过程，可以包括但不限于如下方式：维护虚拟机信息、与虚拟机所在物理服务器连接的网络设备的设备标识、该网络设备上与物理服务器连接的端口的端口标识的第一映射关系。
在一个例子中，针对步骤201，如图3所示，维护所述第一映射关系的过程，具体可以包括但不限于如下方式：
步骤2011，获得物理服务器的MAC(Media Access Control，介质访问控制)地址。其中，在物理服务器启动之后，由于物理服务器是由云管理平台进行管理的，因此，云管理平台可以收集各个物理服务器的MAC地址，并维护如表1所示的物理服务器的标识与物理服务器的MAC地址的映射关系。
表1
物理服务器的标识 物理服务器的MAC地址
物理服务器1 MAC1
物理服务器2 MAC2
物理服务器3 MAC3
… …
物理服务器N MACN
步骤2012，向智能网络管理中心发送携带MAC地址的查询消息。
在一个例子中，云管理平台需要查询一个或者多个MAC地址(如MAC1、MAC2、MAC3等)对应的网络设备时，向智能网络管理中心发送携带该一个或者多个MAC地址的查询消息。为了方便说明，以携带MAC1为例进行说明。对于携带多个MAC地址的处理方式，与此类似，不再赘述。其中，该查询消息用于查询与物理服务器370(即MAC1对应的物理服务器)连接的网络设备的设备标识、以及该网络设备上与物理服务器370连接的端口的端口标识。
在一个例子中，查询消息可以是基于REST(Representational State Transfer，表征状态传输，也可以称为具象状态传输或者表述性状态转移)API(Application Programming Interface，应用程序编程接口)格式的消息。当然，在实际应用中，查询消息也可以是其它格式的消息，其处理过程与REST API格式的处理类似，在此不再赘述，本发明实施例中对此消息格式不做限制。
在一个例子中，REST API格式的查询消息可以包括如下字段：接口类型字段，用于表示当前消息用于根据MAC地址查询网络设备的设备标识以及端口的端口标识；接口URL(Uniform Resource Locator，统一资源定位符)字段：智能网络管理中心的URL，通过该接口URL字段，可以将查询消息发送到智能网络管理中心；参数字段：用于携带待查询的MAC 地址，如上述的MAC1。
步骤2013，接收来自智能网络管理中心的响应消息，该响应消息中携带该MAC地址(即查询消息中携带的MAC地址)对应的网络设备的设备标识和端口标识。
在一个例子中，智能网络管理中心可以从自身管理的网络设备上获取到物理服务器的MAC表项，其中，该MAC表项中可以记录该网络设备学习到的物理服务器的MAC地址、以及该MAC地址对应的端口标识。并且，智能网络管理中心在本地维护该MAC地址、该端口标识、该网络设备的设备标识的映射关系。
智能网络管理中心在接收到来自云管理平台的携带MAC地址的查询消息之后，可通过该MAC地址查询映射关系，得到对应的端口标识和设备标识，并将携带该端口标识和该设备标识的响应消息发送给云管理平台。之后，云管理平台可以接收携带该设备标识和该端口标识的响应消息。
在智能网络管理中心从自身管理的网络设备上获取MAC表项”的过程中，由于各网络设备(如网络设备340、网络设备350、网络设备360、网络设备210和网络设备220等)由智能网络管理中心进行管理，因此智能网络管理中心可以直接向自身管理的各网络设备发送MAC表项查询命令，如基于MIB(Management Information Base，管理信息库)类型的MAC表项查询命令，或者，基于SNMP(Simple Network Management Protocol，简单网络管理协议)类型的MAC表项查询命令，该查询命令用于请求获取网络设备学习到的物理服务器的MAC表项。
在物理服务器启动之后，与物理服务器连接的网络设备在接收到来自物理服务器的报文时，可以学习到该物理服务器对应的MAC表项。该MAC表项记录了该物理服务器的MAC地址以及网络设备上与该物理服务器连接的端口的端口标识。网络设备在接收到来自智能网络管理中心的MAC表项查询命令后，可以将本地学习到的MAC表项发送给智能网络管理中心。例如，如表2所示，为网络设备340学习到的MAC表项的一个示例。此外，网络设备350、网络设备360学习到的MAC表项与表2所示的MAC表项类似，在此不再赘述。
表2
MAC地址 端口标识
MAC1 端口341
在各网络设备将本地学习到的MAC表项发送给智能网络管理中心之后，智能网络管理中心就可以从自身管理的网络设备上获取到MAC表项。
在智能网络管理中心在本地维护该MAC地址、该端口标识、该网络设备的设备标识的映 射关系的过程中，智能网络管理中心可以维护表3所示的MAC地址、端口标识、设备标识的映射关系。例如，智能网络管理中心在接收到来自网络设备340的MAC表项(如表2所示)后，可以将MAC表项中的MAC1和端口1记录到表3中，并将网络设备340的设备标识记录到表3中。再如，智能网络管理中心在接收到来自网络设备350的MAC表项以及网络设备360的MAC表项后，也可以将相关信息记录到表3中，最终可以维护表3所示的映射关系。
表3
MAC地址 设备标识 端口标识
MAC1 网络设备340 端口341
MAC2 网络设备350 端口351
MAC3 网络设备360 端口361
在一个例子中，网络设备学习到的MAC表项中还可以包含VLAN(Virtual Local Area Network，虚拟局域网)信息，例如，表4中可以包含VLAN信息。相应地，智能网络管理中心在维护表3所示的映射关系时，还可以在该映射关系中记录该VLAN信息，如表4所示。在实际应用中，该映射关系中还可以包含其它信息，本发明实施例中对此不做限制，以表3或者表4为例。
表4
MAC地址 设备标识 端口标识 VLAN信息
MAC1 网络设备340 端口341 100
MAC2 网络设备350 端口351 200
MAC3 网络设备360 端口361 300
在智能网络管理中心通过该MAC地址查询映射关系，得到对应的端口标识和设备标识的过程中，智能网络管理中心在接收到来自云管理平台的携带MAC1的查询消息之后，通过该MAC1查询表3或者表4，可以得到端口标识为端口341，并进一步得到设备标识为网络设备340。此外，还可以得到VLAN信息为100。
在智能网络管理中心将携带该端口标识和该设备标识的响应消息发送给云管理平台的过程中，该响应消息可以是基于REST API格式的消息。在实际应用中，该响应消息也可以是基于其它格式的消息。对该响应消息的处理过程与对REST API格式消息的处理过程类似，在此不再赘述。本发明实施例中对响应消息格式不做限制。在一个例子中，REST API格式的响应消息可以至少包括如下字段：接口类型字段，用于表示当前消息是响应消息；参数字段，用于携带MAC1、网络设备340、端口341。在一个例子中，参数字段还可以携带VLAN信息为100。
在一个例子中，在智能网络管理中心在接收到来自云管理平台的携带物理服务器的MAC 地址的查询消息后，从自身管理的网络设备上获取该MAC地址对应的端口标识，并将携带该端口标识和该网络设备的设备标识的响应消息发送给云管理平台。云管理平台接收携带该设备标识和该端口标识的响应消息。
在智能网络管理中心从自身管理的网络设备上获取该MAC地址对应的端口标识的过程中，智能网络管理中心在接收到来自云管理平台的查询消息之后，可以从该查询消息中解析出MAC地址，如MAC1。各网络设备由智能网络管理中心进行管理，因此，智能网络管理中心可以直接向自身管理的各网络设备发送携带MAC1的MAC表项查询命令，如基于MIB类型的MAC表项查询命令，或者，基于SNMP类型的MAC表项查询命令。该MAC表项查询命令用于请求学习到MAC1的网络设备返回与MAC1相关的MAC表项。
在物理服务器启动之后，与物理服务器连接的网络设备在接收到来自物理服务器的报文时，可以学习到该物理服务器对应的MAC表项。该MAC表项中记录了该物理服务器的MAC地址以及网络设备上与该物理服务器连接的端口的端口标识。基于此，网络设备在接收到来自智能网络管理中心的携带MAC1的MAC表项查询命令后，先判断本地是否有与MAC1相关的MAC表项。如果是，将与MAC1相关的MAC表项发送给智能网络管理中心。如果否，不向智能网络管理中心发送MAC表项。在本例子中，网络设备340将上述表2所示的MAC表项发送给智能网络管理中心，而网络设备350/网络设备360不再发送MAC表项。
在智能网络管理中心将携带该端口标识和该网络设备的设备标识的响应消息发送给云管理平台的过程中，智能网络管理中心在接收到来自网络设备340的MAC表项后，可以获取该网络设备340的设备标识，并通过响应消息将端口标识341和设备标识340发送给云管理平台。其中，该响应消息可以是基于REST API格式的消息，且可以携带MAC1、网络设备1、端口1。
在一个例子中，网络设备学习到的MAC表项中还可以包含VLAN信息，且智能网络管理中心发送的响应消息中还可以携带该VLAN信息，如100。
在此步骤中，如果智能网络管理中心未获得MAC1对应的端口标识和设备标识，则可以向云管理平台发送失败消息，对此过程不再详加说明。
步骤2014，在接收到响应消息后，维护MAC地址(即物理服务器的MAC地址)、物理服务器的标识、设备标识、端口标识的第二映射关系。
云管理平台在接收到响应消息之后，可以从该响应消息中解析出设备标识和端口标识，例如，网络设备340和端口341。在一个例子中，该响应消息中可以不携带MAC地址。由于 该响应消息是针对携带MAC1的查询消息的响应消息，可以确定MAC1与网络设备340、端口341相对应。在另一个例子中，该响应消息中可以携带MAC1，则可以直接确定MAC1与网络设备340、端口341相对应。
云管理平台可以获知MAC地址、设备标识、端口标识的映射关系。之后，云管理平台可以通过该MAC地址查询表1所示的映射关系，以得到物理服务器的标识，继而维护MAC地址、物理服务器的标识、设备标识、端口标识的第二映射关系，如表5所示，为第二映射关系的一个示例。此外，云管理平台还可以从响应消息中进一步解析出VLAN信息，并获知MAC地址、设备标识、端口标识、VLAN信息的映射关系。相应地，第二映射关系中还可以包含VLAN信息，如表6所示，为包含VLAN信息的第二映射关系的另一个示例。
表5
物理服务器的标识 MAC地址 设备标识 端口标识
物理服务器370 MAC1 网络设备340 端口341
物理服务器380 MAC2 网络设备350 端口351
物理服务器390 MAC3 网络设备360 端口361
表6
物理服务器的标识 MAC地址 设备标识 端口标识 VLAN信息
物理服务器370 MAC1 网络设备340 端口341 100
物理服务器380 MAC2 网络设备350 端口351 200
物理服务器390 MAC3 网络设备360 端口361 300
步骤2015，在虚拟机使能时，确定该虚拟机所在的物理服务器，并根据该物理服务器的标识查询第二映射关系，得到对应的设备标识和端口标识。
在一个例子中，由于虚拟机由云管理平台进行管理，且云管理平台在物理服务器上为租户分配虚拟机，因此，云管理平台可以获知该虚拟机所在的物理服务器，例如，虚拟机371、虚拟机372和虚拟机373均位于物理服务器370上。在虚拟机(如虚拟机371)使能(如虚拟机启动)时，云管理平台可以直接确定虚拟机371对应物理服务器370，并根据该物理服务器370的标识(如物理服务器1)查询表5或者表6的第二映射关系，得到对应的网络设备340和端口341。
步骤2016，维护虚拟机信息、设备标识、端口标识的第一映射关系。
在一个例子中，第一映射关系可以如表7、或者表8、或者表9所示，上述各表只是该第一映射关系的几个示例，本发明实施例中对此不做限制。
表7
虚拟机信息 设备标识 端口标识
虚拟机371 网络设备340 端口341
虚拟机372 网络设备340 端口341
虚拟机373 网络设备340 端口341
虚拟机381 网络设备350 端口351
虚拟机382 网络设备350 端口351
虚拟机383 网络设备350 端口351
虚拟机391 网络设备360 端口361
虚拟机392 网络设备360 端口361
虚拟机393 网络设备360 端口361
表8
虚拟机信息 物理服务器的标识 MAC地址 设备标识 端口标识
虚拟机371 物理服务器370 MAC1 网络设备340 端口341
虚拟机372 物理服务器370 MAC1 网络设备340 端口341
虚拟机373 物理服务器370 MAC1 网络设备340 端口341
虚拟机381 物理服务器380 MAC2 网络设备350 端口351
虚拟机382 物理服务器380 MAC2 网络设备350 端口351
虚拟机383 物理服务器380 MAC2 网络设备350 端口351
虚拟机391 物理服务器390 MAC3 网络设备360 端口361
虚拟机392 物理服务器390 MAC3 网络设备360 端口361
虚拟机393 物理服务器390 MAC3 网络设备360 端口361
表9
Figure PCTCN2017096648-appb-000001
步骤202，向所述网络设备对应的智能网络管理中心发送通知消息。
其中，所述通知消息中携带有所述虚拟机的虚拟机信息和所述网络设备的网络设备信息，以使所述智能网络管理中心根据所述通知消息为所述网络设备配置针对所述虚拟机的转发策略，所述转发策略用于使所述网络设备对所述虚拟机的报文进行处理。
在一个例子中，利用虚拟机与网络设备的位置关系向智能网络管理中心发送通知消息。
其中，该通知消息中携带有该虚拟机的信息和该网络设备的信息，以使智能网络管理中心根据该通知消息为该网络设备配置针对该虚拟机的转发策略，该转发策略用于使该网络设备对该虚拟机的报文进行处理。
在一个例子中，基于虚拟机信息、网络设备的设备标识、端口的端口标识的第一映射关 系，该虚拟机的信息可以为虚拟机的报文特征信息，该网络设备的信息可以为设备标识(与该虚拟机所在物理服务器连接的网络设备的设备标识)、端口标识(该网络设备上与该物理服务器连接的端口的端口标识)。
在一个例子中，该转发策略用于使该网络设备信任通过该端口(端口标识对应的端口)接收到的携带该报文特征信息的报文中的策略。
在一个例子中，该报文可以包括但不限于VXLAN报文。该报文特征信息可以包括但不限于VXLAN标识。虚拟机是由云管理平台进行管理，因此，每个虚拟机对应的VXLAN标识由云管理平台进行分配，云管理平台可以获知每个虚拟机对应的VXLAN标识，如虚拟机371对应VXLAN标识100。其中，云管理平台还可以在上述第一映射关系中记录各虚拟机对应的VXLAN标识，这样就可以基于第一映射关系直接查询到虚拟机对应的VXLAN标识。
在一个例子中，通知消息可以是基于REST API格式的消息。当然，在实际应用中，通知消息也可以是其它格式的消息，其处理过程与REST API格式的处理过程类似，在此不再赘述。另外，本发明实施例对通知消息格式不做限制。
在一个例子中，以发送针对虚拟机371的通知消息为例，REST API格式的通知消息可以至少包括如下字段：接口类型字段，用于表示当前消息用于给网络设备的端口设置信任特定VXLAN标识的VXLAN报文的策略；接口URL字段，为智能网络管理中心的URL，通过该接口URL字段，可以将通知消息发送到智能网络管理中心；参数字段，用于携带虚拟机371的VXLAN标识、虚拟机371对应的网络设备的设备标识340、虚拟机371对应的端口的端口标识341。
在一个例子中，智能网络管理中心在接收到通知消息后，解析出报文特征信息、设备标识、端口标识，并为该设备标识对应的网络设备配置转发策略，并将转发策略下发给该网络设备。其中，该转发策略用于使网络设备信任通过端口(该端口标识对应的端口)接收到的携带该报文特征信息的报文中的策略。例如，为网络设备340配置转发策略，该转发策略用于使网络设备340信任通过端口341接收到的携带VXLAN标识100的VXLAN报文中的策略。
在一个例子中，上述报文中的策略可以包括但不限于转发优先级，后续以报文中的策略为转发优先级为例，对于其它策略，其处理方式与此类似。
基于上述过程，以虚拟机371向虚拟机381发送报文为例进行说明。当虚拟机371向虚拟机381发送报文时，该报文在到达虚拟交换机371后，查询到该报文匹配的控制流表(由 控制器下发给虚拟交换机371)。基于该控制流表，虚拟交换机371对报文进行VXLAN封装。在对报文进行VXLAN封装时，对于VXLAN封装后的报文(即VXLAN报文)的外层IP头，源IP地址为虚拟交换机371的IP地址，目的IP地址为虚拟交换机384的IP地址，VXLAN标识为虚拟机371对应的VXLAN标识100，DSCP(Differentiated Services Code Point，差分服务代码点)字段为转发优先级(该转发优先级可以根据实际需要进行配置，本发明实施例中不限制其数值)。虚拟交换机371将VXLAN封装后的报文发送给网络设备340。
由于网络设备340上配置了转发策略，该转发策略用于使网络设备340信任通过端口341接收到的携带VXLAN标识100的VXLAN报文中的转发优先级，网络设备340在通过端口341接收到VXLAN报文后，可以信任VXLAN报文中的转发优先级(其携带于DSCP字段)。基于目的IP地址(虚拟交换机384的IP地址)，网络设备340可以根据DSCP字段的转发优先级转发该报文。而且，VXLAN网络中的各网络设备也都信任网络设备340的处理结果，因此，各网络设备也会根据DSCP字段的转发优先级转发报文。最终，该报文被按照转发优先级传输到虚拟交换机384。虚拟交换机384可以去除VXLAN封装的IP头，得到原始报文，该原始报文的源IP地址为虚拟机371的IP地址，目的IP地址为虚拟机381的IP地址，因此可以将报文发送给虚拟机381，至此完成报文的传输。
基于上述方式，各网络设备可以按照DSCP字段的转发优先级转发虚拟机371向虚拟机381发送的报文。这样，在SDN+VXLAN构建的网络中，可以使overlay网络的规划与underlay网络相衔接，使得overlay网络规划的转发优先级，能够体现到underlay网络。具体地，underlay网络可以基于转发优先级进行报文传输，实现不同overlay网络的报文在underlay网络的区别处理。具体地，可以针对不同报文进行区别处理，当不同报文对应不同转发策略时，可以基于报文对应的转发策略对该报文进行转发。例如，当报文1对应转发策略1，报文2对应转发策略2时，在underlay网络中，依据转发策略1对报文1进行传输，依据转发策略2对报文2进行传输。而且，通过为攻击者发送的报文设置用于过滤报文的转发策略，使得攻击者发送的报文无法在underlay网络中进行传输，保证underlay网络的安全性，且由于合法用户发送的报文不会匹配到用于过滤报文的转发策略，因此合法用户发送的报文可以在underlay网络中正常传输。
在一个例子中，当虚拟机、设备标识、端口标识的第一映射关系发生变化时，则云管理平台还可以使用变化后的第一映射关系更新本地维护的第一映射关系，并向智能网络管理中心发送删除消息，其中，该删除消息用于使智能网络管理中心删除之前为网络设备配置的转发策略。进一步的，云管理平台可以利用变化后的第一映射关系向智能网络管理中心发送通 知消息。
在一种情况下、云管理平台可以周期性获取虚拟机、设备标识、端口标识的第一映射关系，如每24小时获取一次第一映射关系，具体获取方式参见步骤201。如果当前获取的第一映射关系与本地维护的第一映射关系相同，则说明与物理服务器连接的网络设备没有发生变化，结束流程。如果当前获取的第一映射关系与本地维护的第一映射关系不同，则说明与物理服务器连接的网络设备发生变化，云管理平台可以更新本地维护的第一映射关系(即使用变化后的第一映射关系更新本地维护的第一映射关系)，并向智能网络管理中心发送删除消息，该删除消息用于使智能网络管理中心删除之前为网络设备配置的转发策略，并利用变化后的第一映射关系向智能网络管理中心发送通知消息。
其中，对于发送通知消息的过程，与步骤202类似，在此不再赘述。以下对发送删除消息的过程进行说明。删除消息可以是基于REST API格式的消息，在实际应用中，删除消息也可以是其它格式的消息，处理过程与REST API格式的处理类似，在此不再赘述，本发明实施例对此消息格式不做限制。
在一个例子中，假设虚拟机371对应的第一映射关系发生变化，REST API格式的删除消息可以包括如下字段：接口类型字段，用于表示当前消息用于删除为网络设备配置的转发策略；接口URL字段：智能网络管理中心的URL，通过该接口URL字段，可以将删除消息发送到智能网络管理中心；参数字段：用于携带虚拟机371的VXLAN标识、网络设备340(设备标识)、端口341(端口标识)。
智能网络管理中心在接收到该删除消息后，可以删除之前为该设备标识对应的网络设备配置的针对该端口标识对应的端口的转发策略。
在另一情况下、当虚拟机从一个物理服务器迁移到另一个物理服务器时，云管理平台可以获取虚拟机信息、设备标识、端口标识的第一映射关系，并使用当前获取的第一映射关系更新本地维护的第一映射关系(即使用变化后的第一映射关系更新本地维护的第一映射关系)，向智能网络管理中心发送删除消息，该删除消息用于使智能网络管理中心删除之前为网络设备配置的转发策略，并利用变化后的第一映射关系向该智能网络管理中心发送通知消息。
其中，对于获取第一映射关系的过程、发送通知消息的过程、发送删除消息的过程，均可以参考上述的处理流程，在此均不再重复赘述。
在一个例子中，当虚拟机关闭时，则云管理平台可以向智能网络管理中心发送删除消息 (其中携带虚拟机的VXLAN标识、设备标识、端口标识)，该删除消息用于使智能网络管理中心删除之前为网络设备配置的转发策略。其中，对于发送删除消息的过程，可以参考上述处理流程，在此不再赘述。
参见图4所示，本发明实施例中提出的转发策略配置方法，可以应用在智能网络管理中心上，且该转发策略配置方法可以包括以下步骤：
步骤401，智能网络管理接收来自云管理平台的通知消息，
在一个例子中，所述通知消息中携带有虚拟机的虚拟机信息、与所述虚拟机具有第一映射关系的网络设备的网络设备信息。
在一个例子中，该通知消息中携带有虚拟机的信息、与该虚拟机具有位置关系的网络设备的信息。
步骤402，智能网络管理中心根据通知消息为该网络设备配置针对该虚拟机的转发策略，该转发策略用于使该网络设备对该虚拟机的报文进行处理。
其中，智能网络管理中心的处理过程与图2所示流程中介绍的智能网络管理中心的处理过程相同，本发明实施例中对此不再重复赘述。
以上对本申请提供的方法进行了描述。下面对本申请提供的装置进行描述：
参见图5，图5为本申请一些实施例提供的云管理平台的硬件结构图。该云管理平台50可包括处理器51以及机器可读存储介质52。其中，处理器51和机器可读存储介质52可经由系统总线53通信。并且，通过读取并执行机器可读存储介质52中存储的与转发策略配置逻辑60对应的机器可执行指令，处理器51可执行上文所述的转发策略配置的方法。
本文提到的机器可读存储介质52可以是任何电子、磁性、光学或其他物理存储装置，可以包含或存储信息，如可执行指令、数据，等等。例如，所述机器可读存储介质72可以是RAM(Random Access Memory，随机存取存储器)、易失存储器、非易失性存储器、闪存、存储驱动器(如硬盘驱动器)、固态硬盘、任何类型的存储盘(如光盘、DVD等)，或者类似的存储介质，或者它们的组合。
如图6所示，从功能上划分，所述转发策略配置逻辑60可包括：
维护模块11，用于得到虚拟机与网络设备之间的第一映射关系；
发送模块12，用于向所述网络设备对应的智能网络管理中心发送第一通知消息，所述第一通知消息中携带有所述虚拟机的虚拟机信息和所述网络设备的网络设备信息，以使所述智 能网络管理中心根据所述第一通知消息为所述网络设备配置针对所述虚拟机的转发策略，所述转发策略用于使所述网络设备对所述虚拟机的报文进行处理。
其中，所述第一映射关系包括虚拟机信息、与所述虚拟机所在的物理服务器连接的网络设备的设备标识、所述网络设备连接所述虚拟机所在物理服务器的端口的端口标识之间的映射关系。
在一个例子中，所述维护模块11用于在所述虚拟机使能时，确定所述虚拟机所在的所述物理服务器，并根据所述物理服务器的MAC地址查询到对应的第二映射关系，得到对应的所述设备标识和所述端口标识，所述第二映射关系为所述MAC地址、所述物理服务器的标识、所述设备标识、所述端口标识之间的映射关系；
得到所述虚拟机的虚拟机信息、所述设备标识、所述端口标识之间的第一映射关系。
在一个例子中，所述维护模块11进一步用于向所述智能网络管理中心发送查询消息，所述查询消息包括物理服务器的介质访问控制MAC地址；
接收来自所述智能网络管理中心的响应消息，所述响应消息中携带所述MAC地址分别对应的所述设备标识和所述端口标识；得到所述MAC地址、所述物理服务器的标识、所述设备标识、所述端口标识的第二映射关系。
所述维护模块11，还用于当所述第一映射关系发生变化时，更新本地的第一映射关系；
所述发送模块12，还用于向所述智能网络管理中心发送删除消息，所述删除消息用于使所述智能网络管理中心删除为所述网络设备配置的转发策略；向所述智能网络管理中心发送所述通知消息，所述第二通知消息中携带更新的第一映射关系对应的虚拟机信息和所述网络设备信息。
其中，本发明装置的各个模块可以集成于一体，也可以分离部署。上述模块可以合并为一个模块，也可以进一步拆分成多个子模块。
参见图7，图7为本申请一些实施例提供的智能网络管理中心的硬件结构图。该智能网络管理中心70可包括处理器71以及机器可读存储介质72。其中，处理器71和机器可读存储介质72可经由系统总线73通信。并且，通过读取并执行机器可读存储介质72中存储的与转发策略配置逻辑80对应的机器可执行指令，处理器71可执行上文所述的转发策略配置的方法。
本文提到的机器可读存储介质72可以是任何电子、磁性、光学或其他物理存储装置，可 以包含或存储信息，如可执行指令、数据，等等。例如，所述机器可读存储介质72可以是RAM(Random Access Memory，随机存取存储器)、易失存储器、非易失性存储器、闪存、存储驱动器(如硬盘驱动器)、固态硬盘、任何类型的存储盘(如光盘、DVD等)，或者类似的存储介质，或者它们的组合。
如图8所示，从功能上划分，所述转发策略配置逻辑80可包括：
接收模块21，用于接收来自云管理平台的通知消息，所述通知消息中携带有虚拟机的虚拟机信息、与所述虚拟机具有第一映射关系的第一网络设备的网络设备信息；
配置模块22，用于根据所述通知消息，为所述第一网络设备配置针对所述虚拟机的转发策略，所述转发策略用于使所述第一网络设备对所述虚拟机的报文进行处理。
在一个例子中，所述转发策略配置逻辑还包括(在图中未体现)：
获取模块，用于针对智能网络管理中心所管理的每个第二网络设备，从所述第二网络设备上获取物理服务器的介质访问控制MAC表项，其中，每个所述MAC表项中记录了与所述第二网络设备相连的物理服务器的MAC地址、所述第二网络设备上与所述物理服务器连接的端口对应的端口标识；根据所述MAC表项，得到所述MAC地址、所述端口标识、所述网络设备的设备标识之间的映射关系；
发送模块，用于在接收到来自所述云管理平台的携带物理服务器的MAC地址的查询消息后，通过该MAC地址，查询所述映射关系，得到对应的端口标识和设备标识；将携带所述端口标识和所述设备标识的响应消息发送给所述云管理平台。
在一个例子中，所述获取模块，还用于在接收到来自所述云管理平台的携带物理服务器的MAC地址的查询消息后，从所述智能网络管理中心所管理的第三网络设备上获取该MAC地址对应的端口标识所述发送模块，还用于并将携带所述端口标识和所述第三网络设备的设备标识的响应消息发送给所述云管理平台。
在一个例子中，所述转发策略配置逻辑还包括(在图中未体现)：
删除模块，用于在接收到来自所述云管理平台的携带所述网络设备信息的删除消息后，指示所述第一网络设备删除所配置的转发策略。
其中，本发明装置的各个模块可以集成于一体，也可以分离部署。上述模块可以合并为一个模块，也可以进一步拆分成多个子模块。
通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到本发明可借助软件 加必需的通用硬件平台的方式来实现，当然也可以通过硬件，但很多情况下前者是更佳的实施方式。基于这样的理解，本发明的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本发明各个实施例所述的方法。本领域技术人员可以理解附图只是一个优选实施例的示意图，附图中的模块或流程并不一定是实施本发明所必须的。
对于装置实施例而言，由于其基本对应于方法实施例，所以相关之处参见方法实施例的部分说明即可。以上所描述的装置实施例仅仅是示意性的，其中所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部模块来实现本实施例方案的目的。本领域普通技术人员在不付出创造性劳动的情况下，即可以理解并实施。
需要说明的是，在本文中，诸如第一和第二等之类的关系术语仅仅用来将一个实体或者操作与另一个实体或操作区分开来，而不一定要求或者暗示这些实体或操作之间存在任何这种实际的关系或者顺序。术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、物品或者设备不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、物品或者设备所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括所述要素的过程、方法、物品或者设备中还存在另外的相同要素。
以上对本发明实施例所提供的方法和装置进行了详细介绍，本文中应用了具体个例对本发明的原理及实施方式进行了阐述，以上实施例的说明只是用于帮助理解本发明的方法及其核心思想；同时，对于本领域的一般技术人员，依据本发明的思想，在具体实施方式及应用范围上均会有改变之处，综上所述，本说明书内容不应理解为对本发明的限制。

Claims (15)

  1. 一种转发策略配置方法，包括：
    云管理平台得到虚拟机与网络设备之间的第一映射关系；
    所述云管理平台向所述网络设备对应的智能网络管理中心发送第一通知消息，所述第一通知消息中携带有所述虚拟机的虚拟机信息和所述网络设备的网络设备信息，以使所述智能网络管理中心根据所述第一通知消息为所述网络设备配置针对所述虚拟机的转发策略，所述转发策略用于使所述网络设备对所述虚拟机的报文进行处理。
  2. 根据权利要求1所述的方法，其中，所述第一映射关系包括虚拟机信息、与所述虚拟机所在的物理服务器连接的网络设备的设备标识、所述网络设备连接所述虚拟机所在物理服务器的端口的端口标识之间的映射关系。
  3. 根据权利要求2所述的方法，其特征在于，得到所述第一映射关系，包括：
    在所述虚拟机使能时，所述云管理平台确定所述虚拟机所在的所述物理服务器，并根据所述物理服务器的MAC地址查询到对应的第二映射关系，得到对应的所述设备标识和所述端口标识，所述第二映射关系为所述MAC地址、所述物理服务器的标识、所述设备标识、所述端口标识之间的映射关系；
    得到所述虚拟机的虚拟机信息、所述设备标识、所述端口标识之间的第一映射关系。
  4. 根据权利要求3所述的方法，进一步包括：
    所述云管理平台向所述智能网络管理中心发送查询消息，所述查询消息包括物理服务器的介质访问控制MAC地址；
    接收来自所述智能网络管理中心的响应消息，所述响应消息中携带所述MAC地址分别对应的所述设备标识和所述端口标识；得到所述MAC地址、所述物理服务器的标识、所述设备标识、所述端口标识的第二映射关系。
  5. 根据权利要求1所述的方法，其特征在于，所述方法进一步包括：
    当所述第一映射关系发生变化时，更新本地的第一映射关系；
    向所述智能网络管理中心发送删除消息，所述删除消息用于使所述智能网络管理中心删除为所述网络设备配置的转发策略；
    向所述智能网络管理中心发送第二通知消息，所述第二通知消息中携带更新的第一映射关系对应的虚拟机信息和所述网络设备信息。
  6. 一种转发策略配置方法，包括：
    智能网络管理中心接收来自云管理平台的通知消息，所述通知消息中携带有虚拟机的虚 拟机信息、与所述虚拟机具有第一映射关系的第一网络设备的网络设备信息；
    根据所述通知消息，所述智能管理中心为所述第一网络设备配置针对所述虚拟机的转发策略，所述转发策略用于使所述第一网络设备对所述虚拟机的报文进行处理。
  7. 根据权利要求6所述的方法，其特征在于，所述方法还包括：
    针对智能网络管理中心所管理的每个第二网络设备，所述智能网络管理中心从所述第二网络设备上获取与所述第二网络设备相连的物理服务器的介质访问控制MAC表项，其中，每个所述MAC表项中记录了与所述物理服务器的MAC地址、所述第二网络设备上与所述物理服务器连接的端口对应的端口标识；
    根据所述MAC表项，所述智能网络管理中心得到所述MAC地址、所述端口标识、所述第二网络设备的设备标识之间的映射关系；
    在接收到来自所述云管理平台的携带物理服务器的MAC地址的查询消息后，通过该MAC地址，所述智能网络管理中心查询所述映射关系，得到对应的端口标识和设备标识；
    所述智能网络管理中心将携带所述端口标识和所述设备标识的响应消息发送给所述云管理平台。
  8. 根据权利要求6所述的方法，其特征在于，所述方法还包括：
    在接收到来自所述云管理平台的携带物理服务器的MAC地址的查询消息后，从所述智能网络管理中心所管理的第三网络设备上获取该MAC地址对应的端口标识；
    并将携带所述端口标识和所述第三网络设备的设备标识的响应消息发送给所述云管理平台。
  9. 根据权利要求6所述的方法，其特征在于，所述方法进一步包括：
    在接收到来自所述云管理平台的携带所述网络设备信息的删除消息后，指示所述第一网络设备删除所配置的转发策略。
  10. 一种云管理平台，其特征在于，包括：
    处理器和机器可读存储介质，
    所述机器可读存储介质存储有能够被所述处理器执行的机器可执行指令，所述处理器被所述机器可执行指令促使：
    得到虚拟机与网络设备之间的第一映射关系；
    向所述网络设备对应的智能网络管理中心发送第一通知消息，所述第一通知消息中携带有所述虚拟机的虚拟机信息和所述网络设备的网络设备信息，以使所述智能网络管理中心根据所述第一通知消息为所述网络设备配置针对所述虚拟机的转发策略，所述转发策略用于使 所述网络设备对所述虚拟机的报文进行处理。
  11. 根据权利要求10所述的云管理平台，其特征在于，
    所述第一映射关系包括虚拟机信息、与所述虚拟机所在的物理服务器连接的网络设备的设备标识、所述网络设备连接所述虚拟机所在物理服务器的端口的端口标识之间的映射关系。
  12. 根据权利要求10所述的装置，其特征在于，所述处理器被所述机器可执行指令促使：
    在所述虚拟机使能时，所述云管理平台确定所述虚拟机所在的所述物理服务器，并根据所述物理服务器的MAC地址查询到对应的第二映射关系，得到对应的所述设备标识和所述端口标识，所述第二映射关系为所述MAC地址、所述物理服务器的标识、所述设备标识、所述端口标识之间的映射关系；
    得到所述虚拟机的虚拟机信息、所述设备标识、所述端口标识之间的第一映射关系。
  13. 一种智能网络管理中心，包括：
    处理器和机器可读存储介质，
    所述机器可读存储介质存储有能够被所述处理器执行的机器可执行指令，所述处理器被所述机器可执行指令促使以执行如权利要求6所述的转发策略配置方法。
  14. 一种机器可读存储介质，存储有机器可读指令，在被处理器调用和执行时，所述机器可执行指令促使所述处理器执行如权利要求1所述的转发策略配置方法。
  15. 一种机器可读存储介质，存储有机器可读指令，在被处理器调用和执行时，所述机器可执行指令促使所述处理器执行如权利要求5所述的转发策略配置方法。
PCT/CN2017/096648 2016-08-11 2017-08-09 转发策略配置 Ceased WO2018028606A1 (zh)

Priority Applications (3)

Application Number Priority Date Filing Date Title
EP17838736.1A EP3499799B1 (en) 2016-08-11 2017-08-09 Forwarding policy configuration
JP2019506706A JP6789376B2 (ja) 2016-08-11 2017-08-09 転送ポリシーの構成
US16/318,311 US11086653B2 (en) 2016-08-11 2017-08-09 Forwarding policy configuration

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610661890.X 2016-08-11
CN201610661890.XA CN107733670B (zh) 2016-08-11 2016-08-11 一种转发策略配置方法和装置

Publications (1)

Publication Number Publication Date
WO2018028606A1 true WO2018028606A1 (zh) 2018-02-15

Family

ID=61162701

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/096648 Ceased WO2018028606A1 (zh) 2016-08-11 2017-08-09 转发策略配置

Country Status (5)

Country Link
US (1) US11086653B2 (zh)
EP (1) EP3499799B1 (zh)
JP (1) JP6789376B2 (zh)
CN (1) CN107733670B (zh)
WO (1) WO2018028606A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113709052A (zh) * 2020-05-21 2021-11-26 中移(苏州)软件技术有限公司 一种网络报文的处理方法、装置、电子设备和存储介质

Families Citing this family (33)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9825913B2 (en) 2014-06-04 2017-11-21 Nicira, Inc. Use of stateless marking to speed up stateful firewall rule processing
US9692698B2 (en) 2014-06-30 2017-06-27 Nicira, Inc. Methods and systems to offload overlay network packet encapsulation to hardware
US11038845B2 (en) 2016-02-23 2021-06-15 Nicira, Inc. Firewall in a virtualized computing environment using physical network interface controller (PNIC) level firewall rules
CN108667886B (zh) * 2017-04-01 2020-07-28 华为技术有限公司 提供PaaS服务的方法、管理系统和云计算服务架构
US20200106773A1 (en) * 2018-09-29 2020-04-02 Fortinet, Inc. Device integration for a network access control server based on device mappings and testing verification
US10931747B2 (en) * 2019-01-31 2021-02-23 Walmart Apollo, Llc Methods and apparatus for network address identification
CN112995005B (zh) * 2019-12-17 2022-02-25 北京百度网讯科技有限公司 虚拟网络数据交换方法和装置
CN111786808A (zh) * 2020-01-10 2020-10-16 北京京东尚科信息技术有限公司 云系统的迁移方法、装置和混合云系统
US11444883B2 (en) * 2020-01-17 2022-09-13 Vmware, Inc. Signature based management of packets in a software defined networking environment
US11962518B2 (en) 2020-06-02 2024-04-16 VMware LLC Hardware acceleration techniques using flow selection
NL2026462B1 (en) * 2020-09-14 2022-05-12 Microsoft Technology Licensing Llc Reducing placement conflicts between concurrent virtual machine allocations
US11593278B2 (en) 2020-09-28 2023-02-28 Vmware, Inc. Using machine executing on a NIC to access a third party storage not supported by a NIC or host
US12021759B2 (en) 2020-09-28 2024-06-25 VMware LLC Packet processing with hardware offload units
US11636053B2 (en) 2020-09-28 2023-04-25 Vmware, Inc. Emulating a local storage by accessing an external storage through a shared port of a NIC
US11716383B2 (en) 2020-09-28 2023-08-01 Vmware, Inc. Accessing multiple external storages to present an emulated local storage through a NIC
US11829793B2 (en) 2020-09-28 2023-11-28 Vmware, Inc. Unified management of virtual machines and bare metal computers
US11792134B2 (en) 2020-09-28 2023-10-17 Vmware, Inc. Configuring PNIC to perform flow processing offload using virtual port identifiers
CN112383600A (zh) * 2020-11-03 2021-02-19 腾讯科技（深圳）有限公司 信息的处理方法、装置、计算机可读介质及电子设备
CN114500276B (zh) * 2020-11-13 2024-12-17 中兴通讯股份有限公司 数据处理方法、装置、系统和计算机可读存储介质
CN113056009B (zh) * 2021-02-20 2023-02-03 北京瀚诺半导体科技有限公司 多信道设备的网络管理方法、系统、设备及存储介质
CN115914389B (zh) * 2021-08-09 2024-10-29 北京字节跳动网络技术有限公司 云服务控制系统、方法、装置、电子设备和存储介质
US11863376B2 (en) 2021-12-22 2024-01-02 Vmware, Inc. Smart NIC leader election
US11995024B2 (en) 2021-12-22 2024-05-28 VMware LLC State sharing between smart NICs
US12229578B2 (en) 2021-12-22 2025-02-18 VMware LLC Teaming of smart NICs
US12373237B2 (en) 2022-05-27 2025-07-29 VMware LLC Logical memory addressing by smart NIC across multiple devices
US11899594B2 (en) 2022-06-21 2024-02-13 VMware LLC Maintenance of data message classification cache on smart NIC
US12481444B2 (en) 2022-06-21 2025-11-25 VMware LLC Smart NIC responding to requests from client device
US11928062B2 (en) 2022-06-21 2024-03-12 VMware LLC Accelerating data message classification with smart NICs
US11928367B2 (en) 2022-06-21 2024-03-12 VMware LLC Logical memory addressing for network devices
JP2024124611A (ja) * 2023-03-03 2024-09-13 エヌ・ティ・ティ・コミュニケーションズ株式会社 通信システム、通信方法及びコンピュータープログラム
JP2024124607A (ja) * 2023-03-03 2024-09-13 エヌ・ティ・ティ・コミュニケーションズ株式会社 通信システム、通信方法及びコンピュータープログラム
CN116389403A (zh) * 2023-04-18 2023-07-04 上海中通吉网络技术有限公司 一种查询主机网络位置关系的方法、装置及系统
CN117792709B (zh) * 2023-12-13 2024-09-27 天翼云科技有限公司 一种支持物理网络和虚拟网络互通的负载均衡方法和装置

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102136931A (zh) * 2010-09-20 2011-07-27 华为技术有限公司 虚端口网络策略配置方法、一种网络管理中心和相关设备
US20110202920A1 (en) * 2010-02-17 2011-08-18 Fujitsu Limited Apparatus and method for communication processing
CN103281248A (zh) * 2013-06-09 2013-09-04 北京星网锐捷网络技术有限公司 网络拓扑的发现方法、装置和系统
CN104601427A (zh) * 2013-10-31 2015-05-06 杭州华三通信技术有限公司 数据中心网络中的报文转发方法及装置

Family Cites Families (19)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20040098511A1 (en) * 2002-11-16 2004-05-20 Lin David H. Packet routing method and system that routes packets to one of at least two processes based on at least one routing rule
US20050002380A1 (en) * 2003-05-09 2005-01-06 Miller Robert S. Automated IT asset location system
US8301753B1 (en) * 2006-06-27 2012-10-30 Nosadia Pass Nv, Limited Liability Company Endpoint activity logging
US7991859B1 (en) * 2009-12-28 2011-08-02 Amazon Technologies, Inc. Using virtual networking devices to connect managed computer networks
RU2562438C2 (ru) * 2010-09-09 2015-09-10 Нек Корпорейшн Сетевая система и способ управления сетью
CN103026660B (zh) 2011-08-01 2015-11-25 华为技术有限公司 网络策略配置方法、管理设备以及网络管理中心设备
US8751650B2 (en) * 2012-05-10 2014-06-10 Cisco Technology, Inc. Method and apparatus for supporting access control lists in a multi-tenant environment
JP5724951B2 (ja) * 2012-06-11 2015-05-27 日立金属株式会社 ネットワーク管理装置
CN103795602B (zh) 2012-10-30 2017-05-10 华为技术有限公司 虚拟网络的网络策略配置方法及装置
US9419855B2 (en) 2014-03-14 2016-08-16 Nicira, Inc. Static routes for logical routers
CN105284080B (zh) 2014-03-31 2018-12-07 华为技术有限公司 数据中心的虚拟网络管理方法及数据中心系统
JP6305812B2 (ja) * 2014-03-31 2018-04-04 株式会社Ｎｔｔドコモ フロー制御装置及びフロー制御方法
WO2015173759A1 (en) 2014-05-13 2015-11-19 Telefonaktiebolaget L M Ericsson (Publ) Virtual flow network in a cloud environment
CN105227454B (zh) * 2014-06-18 2019-02-26 中兴通讯股份有限公司 虚拟路由系统及方法
CN104243608B (zh) * 2014-09-29 2018-02-06 华为技术有限公司 一种通信方法、云管理服务器及虚拟交换机
CN104486246B (zh) * 2014-12-23 2018-05-01 上海斐讯数据通信技术有限公司 一种基于SDN架构的VXLAN的QoS机制实现方法
WO2016199005A1 (en) * 2015-06-12 2016-12-15 Telefonaktiebolaget Lm Ericsson (Publ) Multipath forwarding in an overlay network
CN105681188A (zh) * 2015-12-28 2016-06-15 国云科技股份有限公司 一种云平台的软路由器虚拟机实现方法
CN105657078B (zh) * 2015-12-29 2019-05-31 联想(北京)有限公司 一种数据传输方法、装置及多层网络管理器

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20110202920A1 (en) * 2010-02-17 2011-08-18 Fujitsu Limited Apparatus and method for communication processing
CN102136931A (zh) * 2010-09-20 2011-07-27 华为技术有限公司 虚端口网络策略配置方法、一种网络管理中心和相关设备
CN103281248A (zh) * 2013-06-09 2013-09-04 北京星网锐捷网络技术有限公司 网络拓扑的发现方法、装置和系统
CN104601427A (zh) * 2013-10-31 2015-05-06 杭州华三通信技术有限公司 数据中心网络中的报文转发方法及装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3499799A4 *

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113709052A (zh) * 2020-05-21 2021-11-26 中移(苏州)软件技术有限公司 一种网络报文的处理方法、装置、电子设备和存储介质
CN113709052B (zh) * 2020-05-21 2024-02-27 中移(苏州)软件技术有限公司 一种网络报文的处理方法、装置、电子设备和存储介质

Also Published As

Publication number Publication date
EP3499799A4 (en) 2019-07-03
US11086653B2 (en) 2021-08-10
EP3499799B1 (en) 2020-10-14
US20190235909A1 (en) 2019-08-01
JP6789376B2 (ja) 2020-11-25
CN107733670A (zh) 2018-02-23
CN107733670B (zh) 2020-05-12
EP3499799A1 (en) 2019-06-19
JP2019525631A (ja) 2019-09-05

Similar Documents

Publication Publication Date Title
WO2018028606A1 (zh) 转发策略配置
US10630543B1 (en) Wireless mesh network implementation for IOT devices
US10715482B2 (en) Wide area service discovery for internet of things
EP3461072B1 (en) Access control in a vxlan
CN104639363B (zh) 用于在虚拟区域网络中管理云端装置的管理伺服器及其管理方法
CN103457878B (zh) 一种基于流的网络接入控制方法
CN103404084B (zh) Mac地址强制转发装置及方法
WO2017186181A1 (zh) 网络访问控制
US20170279689A1 (en) Software defined network controller for implementing tenant specific policy
WO2018028590A1 (zh) 报文传输
WO2017041168A1 (en) Pre-association discovery of services
WO2010139238A1 (zh) 实现强制mac转发功能的方法和装置
WO2014101777A1 (zh) 流表匹配方法和装置以及交换机
CN112583655B (zh) 数据传输方法、装置、电子设备及可读存储介质
US20150244586A1 (en) Network Provisioning And Deployment
CN103563304B (zh) 基于虚拟组网的交换机配置方法及集群管理设备
EP2218214B1 (en) Network location service
WO2017107871A1 (zh) 访问控制方法和网络设备
WO2018113701A1 (zh) 资源调度
US10764330B2 (en) LAN/SAN network security management
US10397141B2 (en) Access port for one or more VLANs
CN105959315B (zh) 一种用于用户迁移的ip保活方法及客户端
CN102299836A (zh) 一种访问接入设备的方法以及装置
US20250294009A1 (en) Systems and methods for management of network protocols while supporting multi-tenancy
US20210051076A1 (en) A node, control system, communication control method and program

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17838736

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2019506706

Country of ref document: JP

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2017838736

Country of ref document: EP

Effective date: 20190311